burnledger 0.8.1 → 0.9.1

package/dist/cjs/models.js

@@ -24,6 +24,10 @@ exports.parseApiKeyListItem = parseApiKeyListItem;
 exports.parseApiKeyResponse = parseApiKeyResponse;
 exports.parseProfile = parseProfile;
 exports.parseSystemHealth = parseSystemHealth;
+exports.parseKeyEnrollmentStatement = parseKeyEnrollmentStatement;
+exports.parseTeamAuthorizationCertificate = parseTeamAuthorizationCertificate;
+exports.parseSystemRegistrationCertificate = parseSystemRegistrationCertificate;
+exports.parseKeyEnrollmentResult = parseKeyEnrollmentResult;
 // ---------------------------------------------------------------------------
 // Timestamp parsing
 // ---------------------------------------------------------------------------
@@ -109,6 +113,7 @@ function parseCertificateResponse(d) {
         revocationReason: d.revocation_reason ?? undefined,
         certificate: d.certificate,
         statusStatement: d.status_statement ?? undefined,
+        nsmAttestation: d.nsm_attestation ?? undefined,
     };
 }
 function parseRevocationStatus(d) {
@@ -273,4 +278,62 @@ function parseSystemHealth(d) {
         healthError: d.health_error ?? undefined,
     };
 }
+/** Go encodes [N]byte as an array of numbers; anything else here is a response
+ * this SDK cannot read, and is refused rather than coerced. */
+function bytesFromInts(v, field, length) {
+    if (!Array.isArray(v) ||
+        v.length !== length ||
+        !v.every((b) => Number.isInteger(b) && b >= 0 && b <= 255)) {
+        throw new Error(`${field} is not ${length} bytes`);
+    }
+    return new Uint8Array(v);
+}
+function bytesFromBase64(v, field) {
+    if (typeof v !== "string")
+        throw new Error(`${field} is not base64`);
+    const bin = atob(v);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}
+function parseKeyEnrollmentStatement(d) {
+    const group = (d.group ?? {});
+    return {
+        assertedTeamId: d.asserted_team_id,
+        customerKeyId: d.customer_key_id,
+        threshold: group.threshold,
+        members: (group.members ?? []).map((m, i) => bytesFromBase64(m, `enrollment.group.members[${i}]`)),
+        enrolledAt: parseDt(d.enrolled_at),
+        enclavePcr0: d.enclave_pcr0,
+        signature: bytesFromInts(d.signature, "enrollment.signature", 64),
+    };
+}
+function parseTeamAuthorizationCertificate(d) {
+    return {
+        assertedTeamId: d.asserted_team_id,
+        customerKeyId: d.customer_key_id,
+        notBefore: parseDt(d.not_before),
+        notAfter: parseDt(d.not_after),
+        prevKeyId: d.prev_key_id || undefined,
+        signature: bytesFromInts(d.signature, "authorization.signature", 64),
+    };
+}
+function parseSystemRegistrationCertificate(d) {
+    return {
+        systemId: d.system_id,
+        configDigest: bytesFromInts(d.config_digest, "registration.config_digest", 32),
+        queryTemplateHash: bytesFromInts(d.query_template_hash, "registration.query_template_hash", 32),
+        connectorType: d.connector_type,
+        customerKeyId: d.customer_key_id,
+        registeredAt: parseDt(d.registered_at),
+        signature: bytesFromInts(d.signature, "registration.signature", 64),
+    };
+}
+function parseKeyEnrollmentResult(d) {
+    return {
+        enrollment: parseKeyEnrollmentStatement(d.enrollment ?? {}),
+        authorization: parseTeamAuthorizationCertificate(d.authorization ?? {}),
+    };
+}
 //# sourceMappingURL=models.js.map

package/dist/cjs/models.js.map

@@ -1 +1 @@
-{"version":3,"file":"models.js","sourceRoot":"","sources":["../../src/models.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;;;;;;AAmVH,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,UAAU,CAAC,GAA8B;IAChD,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IAClC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC;AASD,qBAA4B,CAAM;IAChC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,aAAa,EAAE,CAAC,CAAC,cAA+B;QAChD,YAAY,EAAE,CAAC,CAAC,aAAa;QAC7B,SAAS,EAAE,CAAC,CAAC,UAAuB;QACpC,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,YAAY,EAAE,CAAC,CAAC,aAAa;QAC7B,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QAChC,YAAY,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,SAAS,CAAiB;QAC5D,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAChD,WAAW,EAAE,CAAC,CAAC,YAAY,IAAI,SAAS;QACxC,yEAAyE;QACzE,kDAAkD;QAClD,iBAAiB,EAAE,CAAC,CAAC,CAAC,kBAAkB,IAAI,SAAS,CAAsB;QAC3E,yEAAyE;QACzE,sEAAsE;QACtE,+BAA+B;QAC/B,UAAU,EAAE,CAAC,CAAC,YAAY,KAAK,IAAI;QACnC,mBAAmB,EAAE,CAAC,CAAC,CAAC,qBAAqB,IAAI,SAAS,CAAwB;KACnF,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,CAAM;IACpC,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,SAAS,EAAE,CAAC,CAAC,UAAuB;QACpC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,0BAAiC,CAAM;IACrC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,SAAS,EAAE,CAAC,CAAC,UAAuB;QACpC,MAAM,EAAE,CAAC,CAAC,MAA2B;QACrC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC;QACtD,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;QAClC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QAChC,aAAa,EAAE,CAAC,CAAC,cAAc,IAAI,SAAS;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,CAAM;IACrC,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,WAAW,EAAE,CAAC,CAAC,YAAY;KAC5B,CAAC;AACJ,CAAC;AAED,2BAAkC,CAAM;IACtC,OAAO;QACL,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,MAAM,EAAE,CAAC,CAAC,MAA2B;QACrC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC;QACvD,WAAW,EAAE,CAAC,CAAC,WAAW;YACxB,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,WAAW,CAAC;YACzC,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED,kCAAyC,CAAM;IAC7C,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9B,MAAM,EAAE,CAAC,CAAC,MAA2B;QACrC,kBAAkB,EAAE,CAAC,CAAC,mBAAyC;QAC/D,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;QACnC,gBAAgB,EAAE,CAAC,CAAC,iBAAiB,IAAI,SAAS;QAClD,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,eAAe,EAAE,CAAC,CAAC,gBAAgB,IAAI,SAAS;KACjD,CAAC;AACJ,CAAC;AAED,+BAAsC,CAAM;IAC1C,OAAO;QACL,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,MAAM,EAAE,CAAC,CAAC,MAA2B;QACrC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;QACnC,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,SAAS;KAC9B,CAAC;AACJ,CAAC;AAED,sBAA6B,CAAM;IACjC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,SAAS;QAC7B,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,6BAAoC,CAAM;IACxC,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/B,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC;AACJ,CAAC;AAED,uBAA8B,CAAM;IAClC,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,UAA0B;QACvC,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,6BAAoC,CAAM;IACxC,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,cAAc,EAAE,CAAC,CAAC,eAAe,IAAI,EAAE;QACvC,cAAc,EAAE,mBAAmB,CAAC,CAAC,CAAC,gBAAgB,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,+BAAsC,CAAM;IAC1C,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,QAAQ;QACnB,OAAO,EAAE,CAAC,CAAC,QAAQ;QACnB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;KACrB,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,CAAM;IACxC,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,iBAAiB,EAAE,CAAC,CAAC,kBAAkB,IAAI,EAAE;KAC9C,CAAC;AACJ,CAAC;AAED,uCAA8C,CAAM;IAClD,OAAO;QACL,YAAY,EAAE,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC1D,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAM;IACnC,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC;AACJ,CAAC;AAED,kCAAyC,CAAM;IAC7C,OAAO;QACL,YAAY,EAAE,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC;QAClE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAM;IAC/B,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC;AACJ,CAAC;AAED,+BAAsC,CAAM;IAC1C,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,oBAAoB,EAAE,CAAC,CAAC,qBAAqB;QAC7C,mBAAmB,EAAE,CAAC,CAAC,oBAAoB;QAC3C,kBAAkB,EAAG,CAAC,CAAC,mBAA0C,IAAI,CAAC;QACtE,gBAAgB,EAAE,CAAC,CAAC,mBAAmB;QACvC,eAAe,EAAE,CAAC,CAAC,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC;KACnE,CAAC;AACJ,CAAC;AAED,oCAA2C,CAAM;IAC/C,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,8BAAqC,CAAM;IACzC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,YAAY,EAAE,CAAC,CAAC,aAAa;QAC7B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC;QAC5C,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,6BAAoC,CAAM;IACxC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,IAAI,EAAE,CAAC,CAAC,IAAkB;QAC1B,MAAM,EAAE,CAAC,CAAC,OAAO,IAAI,SAAS;QAC9B,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QAChC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,6BAAoC,CAAM;IACxC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,MAAM,EAAE,CAAC,CAAC,OAAO,IAAI,SAAS;QAC9B,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E,SAAS,cAAc,CAAC,CAAM;IAC5B,OAAO;QACL,gBAAgB,EAAE,CAAC,CAAC,iBAAiB;QACrC,iBAAiB,EAAE,CAAC,CAAC,kBAAkB;QACvC,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,YAAY,EAAE,CAAC,CAAC,aAAa;QAC7B,cAAc,EAAE,CAAC,CAAC,gBAAgB,IAAI,SAAS;KAChD,CAAC;AACJ,CAAC;AAED,sBAA6B,CAAM;IACjC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,YAAY,EAAE,CAAC,CAAC,aAAa,IAAI,SAAS;QAC1C,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,aAAa,EAAE,CAAC,CAAC,eAAe,IAAI,SAAS;QAC7C,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;KACnE,CAAC;AACJ,CAAC;AAED,2BAAkC,CAAM;IACtC,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,YAAY,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,SAAS,CAAiB;QAC5D,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAChD,WAAW,EAAE,CAAC,CAAC,YAAY,IAAI,SAAS;KACzC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"models.js","sourceRoot":"","sources":["../../src/models.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;;;;;;;;;;AA8VH,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,UAAU,CAAC,GAA8B;IAChD,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IAClC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC;AASD,qBAA4B,CAAM;IAChC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,aAAa,EAAE,CAAC,CAAC,cAA+B;QAChD,YAAY,EAAE,CAAC,CAAC,aAAa;QAC7B,SAAS,EAAE,CAAC,CAAC,UAAuB;QACpC,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,YAAY,EAAE,CAAC,CAAC,aAAa;QAC7B,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QAChC,YAAY,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,SAAS,CAAiB;QAC5D,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAChD,WAAW,EAAE,CAAC,CAAC,YAAY,IAAI,SAAS;QACxC,yEAAyE;QACzE,kDAAkD;QAClD,iBAAiB,EAAE,CAAC,CAAC,CAAC,kBAAkB,IAAI,SAAS,CAAsB;QAC3E,yEAAyE;QACzE,sEAAsE;QACtE,+BAA+B;QAC/B,UAAU,EAAE,CAAC,CAAC,YAAY,KAAK,IAAI;QACnC,mBAAmB,EAAE,CAAC,CAAC,CAAC,qBAAqB,IAAI,SAAS,CAAwB;KACnF,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,CAAM;IACpC,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,SAAS,EAAE,CAAC,CAAC,UAAuB;QACpC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,0BAAiC,CAAM;IACrC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,SAAS,EAAE,CAAC,CAAC,UAAuB;QACpC,MAAM,EAAE,CAAC,CAAC,MAA2B;QACrC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC;QACtD,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;QAClC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QAChC,aAAa,EAAE,CAAC,CAAC,cAAc,IAAI,SAAS;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,CAAM;IACrC,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,WAAW,EAAE,CAAC,CAAC,YAAY;KAC5B,CAAC;AACJ,CAAC;AAED,2BAAkC,CAAM;IACtC,OAAO;QACL,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,MAAM,EAAE,CAAC,CAAC,MAA2B;QACrC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC;QACvD,WAAW,EAAE,CAAC,CAAC,WAAW;YACxB,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,WAAW,CAAC;YACzC,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED,kCAAyC,CAAM;IAC7C,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9B,MAAM,EAAE,CAAC,CAAC,MAA2B;QACrC,kBAAkB,EAAE,CAAC,CAAC,mBAAyC;QAC/D,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;QACnC,gBAAgB,EAAE,CAAC,CAAC,iBAAiB,IAAI,SAAS;QAClD,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,eAAe,EAAE,CAAC,CAAC,gBAAgB,IAAI,SAAS;QAChD,cAAc,EAAE,CAAC,CAAC,eAAe,IAAI,SAAS;KAC/C,CAAC;AACJ,CAAC;AAED,+BAAsC,CAAM;IAC1C,OAAO;QACL,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,MAAM,EAAE,CAAC,CAAC,MAA2B;QACrC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;QACnC,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,SAAS;KAC9B,CAAC;AACJ,CAAC;AAED,sBAA6B,CAAM;IACjC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,SAAS;QAC7B,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,6BAAoC,CAAM;IACxC,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/B,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC;AACJ,CAAC;AAED,uBAA8B,CAAM;IAClC,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,UAA0B;QACvC,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,6BAAoC,CAAM;IACxC,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,cAAc,EAAE,CAAC,CAAC,eAAe,IAAI,EAAE;QACvC,cAAc,EAAE,mBAAmB,CAAC,CAAC,CAAC,gBAAgB,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,+BAAsC,CAAM;IAC1C,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,QAAQ;QACnB,OAAO,EAAE,CAAC,CAAC,QAAQ;QACnB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;KACrB,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,CAAM;IACxC,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,iBAAiB,EAAE,CAAC,CAAC,kBAAkB,IAAI,EAAE;KAC9C,CAAC;AACJ,CAAC;AAED,uCAA8C,CAAM;IAClD,OAAO;QACL,YAAY,EAAE,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC1D,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAM;IACnC,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC;AACJ,CAAC;AAED,kCAAyC,CAAM;IAC7C,OAAO;QACL,YAAY,EAAE,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC;QAClE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAM;IAC/B,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC;AACJ,CAAC;AAED,+BAAsC,CAAM;IAC1C,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,oBAAoB,EAAE,CAAC,CAAC,qBAAqB;QAC7C,mBAAmB,EAAE,CAAC,CAAC,oBAAoB;QAC3C,kBAAkB,EAAG,CAAC,CAAC,mBAA0C,IAAI,CAAC;QACtE,gBAAgB,EAAE,CAAC,CAAC,mBAAmB;QACvC,eAAe,EAAE,CAAC,CAAC,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC;KACnE,CAAC;AACJ,CAAC;AAED,oCAA2C,CAAM;IAC/C,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,8BAAqC,CAAM;IACzC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,YAAY,EAAE,CAAC,CAAC,aAAa;QAC7B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC;QAC5C,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,6BAAoC,CAAM;IACxC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,IAAI,EAAE,CAAC,CAAC,IAAkB;QAC1B,MAAM,EAAE,CAAC,CAAC,OAAO,IAAI,SAAS;QAC9B,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QAChC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,6BAAoC,CAAM;IACxC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,MAAM,EAAE,CAAC,CAAC,OAAO,IAAI,SAAS;QAC9B,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E,SAAS,cAAc,CAAC,CAAM;IAC5B,OAAO;QACL,gBAAgB,EAAE,CAAC,CAAC,iBAAiB;QACrC,iBAAiB,EAAE,CAAC,CAAC,kBAAkB;QACvC,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,YAAY,EAAE,CAAC,CAAC,aAAa;QAC7B,cAAc,EAAE,CAAC,CAAC,gBAAgB,IAAI,SAAS;KAChD,CAAC;AACJ,CAAC;AAED,sBAA6B,CAAM;IACjC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,YAAY,EAAE,CAAC,CAAC,aAAa,IAAI,SAAS;QAC1C,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,aAAa,EAAE,CAAC,CAAC,eAAe,IAAI,SAAS;QAC7C,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;KACnE,CAAC;AACJ,CAAC;AAED,2BAAkC,CAAM;IACtC,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,YAAY,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,SAAS,CAAiB;QAC5D,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAChD,WAAW,EAAE,CAAC,CAAC,YAAY,IAAI,SAAS;KACzC,CAAC;AACJ,CAAC;AAuDD;+DAC+D;AAC/D,SAAS,aAAa,CAAC,CAAU,EAAE,KAAa,EAAE,MAAc;IAC9D,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACjB,CAAC,CAAC,MAAM,KAAK,MAAM;QACnB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,EAC1D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,WAAW,MAAM,QAAQ,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,CAAa,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,eAAe,CAAC,CAAU,EAAE,KAAa;IAChD,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,gBAAgB,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qCAA4C,CAAM;IAChD,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAQ,CAAC;IACrC,OAAO;QACL,cAAc,EAAE,CAAC,CAAC,gBAAgB;QAClC,aAAa,EAAE,CAAC,CAAC,eAAe;QAChC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACzD,eAAe,CAAC,CAAC,EAAE,4BAA4B,CAAC,GAAG,CAAC,CACrD;QACD,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;QAClC,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,sBAAsB,EAAE,EAAE,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,2CAAkD,CAAM;IACtD,OAAO;QACL,cAAc,EAAE,CAAC,CAAC,gBAAgB;QAClC,aAAa,EAAE,CAAC,CAAC,eAAe;QAChC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QAChC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9B,SAAS,EAAE,CAAC,CAAC,WAAW,IAAI,SAAS;QACrC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,yBAAyB,EAAE,EAAE,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,4CAAmD,CAAM;IACvD,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,aAAa,EAAE,4BAA4B,EAAE,EAAE,CAAC;QAC9E,iBAAiB,EAAE,aAAa,CAAC,CAAC,CAAC,mBAAmB,EAAE,kCAAkC,EAAE,EAAE,CAAC;QAC/F,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,aAAa,EAAE,CAAC,CAAC,eAAe;QAChC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;QACtC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,wBAAwB,EAAE,EAAE,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,kCAAyC,CAAM;IAC7C,OAAO;QACL,UAAU,EAAE,2BAA2B,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;QAC3D,aAAa,EAAE,iCAAiC,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC;KACxE,CAAC;AACJ,CAAC"}

package/dist/cjs/node-runtime.d.ts

@@ -0,0 +1,40 @@
+/** The Node-only capabilities the shared client needs, injected at the entry.
+ *
+ * WHY THIS EXISTS. `client.ts` is imported by BOTH entry points — the Node one
+ * (index.ts) and the browser one (index.browser.ts). A few of its methods are
+ * Node-only by nature: key enrolment and system registration (ADR-025 §2 makes a
+ * client the customer runs locally the only place enrolment can happen), and
+ * `savePdf`, which writes to a filesystem path. Their implementations live in
+ * `enclave-registration.ts`, `enclave-seal.ts` (and, through them, `key-group.ts`
+ * and `crypto-node.ts`) and in `node:fs/promises` — all of which import
+ * `node:crypto` or another Node builtin.
+ *
+ * If the client named any of those modules directly — even behind a dynamic
+ * `import("./enclave-registration.js")` — a browser bundler following the browser
+ * entry's graph would drag `node:crypto` into the bundle and fail the build (the
+ * dashboard's vite build did exactly this). So the client never names them. The
+ * Node entry registers a loader for them here on import; the browser entry never
+ * does. A browser caller of a Node-only method therefore gets a clear error, and
+ * a browser bundle of the browser entry reaches no Node builtin at all.
+ *
+ * The imports below are type-only, so they are erased at build and add nothing to
+ * any bundle.
+ */
+import type * as RegistrationModule from "./enclave-registration.js";
+import type * as EnclaveSealModule from "./enclave-seal.js";
+/** The Node-only surface the client reaches through {@link loadNodeRuntime}. */
+export interface NodeRuntime {
+    readonly registration: typeof RegistrationModule;
+    readonly seal: typeof EnclaveSealModule;
+    /** `node:fs/promises`' `writeFile`, narrowed to what `savePdf` needs. */
+    writeFile(path: string, data: Uint8Array): Promise<void>;
+}
+type NodeRuntimeLoader = () => Promise<NodeRuntime>;
+/** Register the Node runtime. Called once by the Node entry point (index.ts) on
+ * import; never by the browser entry. */
+export declare function setNodeRuntimeLoader(load: NodeRuntimeLoader): void;
+/** Load the Node-only runtime, or throw if it was never registered — the case in
+ * a browser bundle built from `burnledger/browser`. */
+export declare function loadNodeRuntime(): Promise<NodeRuntime>;
+export {};
+//# sourceMappingURL=node-runtime.d.ts.map

package/dist/cjs/node-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-runtime.d.ts","sourceRoot":"","sources":["../../src/node-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,KAAK,kBAAkB,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,KAAK,iBAAiB,MAAM,mBAAmB,CAAC;AAE5D,gFAAgF;AAChF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,YAAY,EAAE,OAAO,kBAAkB,CAAC;IACjD,QAAQ,CAAC,IAAI,EAAE,OAAO,iBAAiB,CAAC;IACxC,yEAAyE;IACzE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D;AAED,KAAK,iBAAiB,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;AAIpD;yCACyC;AACzC,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAElE;AAED;uDACuD;AACvD,wBAAgB,eAAe,IAAI,OAAO,CAAC,WAAW,CAAC,CAUtD"}

package/dist/cjs/node-runtime.js

@@ -0,0 +1,42 @@
+"use strict";
+/** The Node-only capabilities the shared client needs, injected at the entry.
+ *
+ * WHY THIS EXISTS. `client.ts` is imported by BOTH entry points — the Node one
+ * (index.ts) and the browser one (index.browser.ts). A few of its methods are
+ * Node-only by nature: key enrolment and system registration (ADR-025 §2 makes a
+ * client the customer runs locally the only place enrolment can happen), and
+ * `savePdf`, which writes to a filesystem path. Their implementations live in
+ * `enclave-registration.ts`, `enclave-seal.ts` (and, through them, `key-group.ts`
+ * and `crypto-node.ts`) and in `node:fs/promises` — all of which import
+ * `node:crypto` or another Node builtin.
+ *
+ * If the client named any of those modules directly — even behind a dynamic
+ * `import("./enclave-registration.js")` — a browser bundler following the browser
+ * entry's graph would drag `node:crypto` into the bundle and fail the build (the
+ * dashboard's vite build did exactly this). So the client never names them. The
+ * Node entry registers a loader for them here on import; the browser entry never
+ * does. A browser caller of a Node-only method therefore gets a clear error, and
+ * a browser bundle of the browser entry reaches no Node builtin at all.
+ *
+ * The imports below are type-only, so they are erased at build and add nothing to
+ * any bundle.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setNodeRuntimeLoader = setNodeRuntimeLoader;
+exports.loadNodeRuntime = loadNodeRuntime;
+let loader;
+/** Register the Node runtime. Called once by the Node entry point (index.ts) on
+ * import; never by the browser entry. */
+function setNodeRuntimeLoader(load) {
+    loader = load;
+}
+/** Load the Node-only runtime, or throw if it was never registered — the case in
+ * a browser bundle built from `burnledger/browser`. */
+function loadNodeRuntime() {
+    if (loader === undefined) {
+        return Promise.reject(new Error("this operation is Node-only (key enrolment, system registration and " +
+            'savePdf); import BurnLedger from "burnledger", not "burnledger/browser".'));
+    }
+    return loader();
+}
+//# sourceMappingURL=node-runtime.js.map

package/dist/cjs/node-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-runtime.js","sourceRoot":"","sources":["../../src/node-runtime.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;;;AAeH,IAAI,MAAqC,CAAC;AAE1C;yCACyC;AACzC,8BAAqC,IAAuB;IAC1D,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC;AAED;uDACuD;AACvD;IACE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,sEAAsE;YACpE,0EAA0E,CAC7E,CACF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,EAAE,CAAC;AAClB,CAAC"}

package/dist/cjs/status-document.d.ts

@@ -0,0 +1,25 @@
+/** Reading a status statement as the status endpoint serves it, before anything
+ * verifies it. Shared by the CLI and the /verify page's status button, so the two
+ * agree on what counts as a statement: an answer that is not one is silence
+ * about revocation, while a statement that is one and fails is a refusal. */
+type StatusStatement = Record<string, unknown>;
+/** The API wraps every response in {"data": ...}; a caller may hand over either
+ * the envelope or the document inside it. Mirrors
+ * core.ParseCertificateStatusDocument, so this CLI and the Go one cannot
+ * disagree about which shape the endpoint returns. Exported for testing.
+ *
+ * A document that does not parse THROWS, and the caller turns that into a
+ * warning and a VALID_REVOCATION_UNKNOWN verdict. That is deliberate: an answer
+ * this build cannot read is silence about revocation, not a finding about the
+ * certificate. Handing a half-read document to the verifier instead would
+ * report "status statement signature is invalid" — a claim about the issuer —
+ * when what actually happened is that something returned nonsense.
+ *
+ * `status` itself is NOT validated against a known set. A statement saying
+ * SUSPENDED is a statement this build cannot read, and the verifier already has
+ * the right answer for that: it authenticates the signature first, then reports
+ * VALID_REVOCATION_UNKNOWN. Refusing it here would discard the statement before
+ * anyone authenticated it. */
+export declare function unwrapStatusStatement(parsed: unknown): StatusStatement;
+export {};
+//# sourceMappingURL=status-document.d.ts.map

package/dist/cjs/status-document.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-document.d.ts","sourceRoot":"","sources":["../../src/status-document.ts"],"names":[],"mappings":"AAAA;;;6EAG6E;AAE7E,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE/C;;;;;;;;;;;;;;;;8BAgB8B;AAC9B,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,GAAG,eAAe,CAoBtE"}

package/dist/cjs/status-document.js

@@ -0,0 +1,62 @@
+"use strict";
+/** Reading a status statement as the status endpoint serves it, before anything
+ * verifies it. Shared by the CLI and the /verify page's status button, so the two
+ * agree on what counts as a statement: an answer that is not one is silence
+ * about revocation, while a statement that is one and fails is a refusal. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.unwrapStatusStatement = unwrapStatusStatement;
+/** The API wraps every response in {"data": ...}; a caller may hand over either
+ * the envelope or the document inside it. Mirrors
+ * core.ParseCertificateStatusDocument, so this CLI and the Go one cannot
+ * disagree about which shape the endpoint returns. Exported for testing.
+ *
+ * A document that does not parse THROWS, and the caller turns that into a
+ * warning and a VALID_REVOCATION_UNKNOWN verdict. That is deliberate: an answer
+ * this build cannot read is silence about revocation, not a finding about the
+ * certificate. Handing a half-read document to the verifier instead would
+ * report "status statement signature is invalid" — a claim about the issuer —
+ * when what actually happened is that something returned nonsense.
+ *
+ * `status` itself is NOT validated against a known set. A statement saying
+ * SUSPENDED is a statement this build cannot read, and the verifier already has
+ * the right answer for that: it authenticates the signature first, then reports
+ * VALID_REVOCATION_UNKNOWN. Refusing it here would discard the statement before
+ * anyone authenticated it. */
+function unwrapStatusStatement(parsed) {
+    if (parsed === null || typeof parsed !== "object") {
+        throw new Error("status statement: response is not a JSON object");
+    }
+    let doc = parsed;
+    if (doc.certificate_id === undefined && doc.data !== null && typeof doc.data === "object") {
+        doc = doc.data;
+    }
+    for (const f of ["certificate_id", "status", "key_id"]) {
+        if (typeof doc[f] !== "string" || doc[f] === "")
+            throw new Error(`status statement: ${f} is missing`);
+    }
+    for (const f of ["statement_issued_at", "statement_expires_at"])
+        requireRfc3339(doc, f);
+    if (doc.revoked_at != null)
+        requireRfc3339(doc, "revoked_at");
+    if (typeof doc.sth_tree_size !== "number")
+        throw new Error("status statement: sth_tree_size is not a number");
+    // Refuse a short or long value rather than letting it through: a truncated
+    // signature or root hash that reaches the verifier is checked against bytes
+    // nobody sent.
+    requireHex(doc, "sth_root_hash", 32);
+    requireHex(doc, "signature", 64);
+    return doc;
+}
+function requireRfc3339(doc, field) {
+    const v = doc[field];
+    if (typeof v !== "string" || Number.isNaN(Date.parse(v))) {
+        throw new Error(`status statement: ${field} is not RFC 3339`);
+    }
+}
+function requireHex(doc, field, bytes) {
+    const v = doc[field];
+    if (typeof v !== "string" || !new RegExp(`^[0-9a-fA-F]{${bytes * 2}}$`).test(v)) {
+        throw new Error(`status statement: ${field} is not ${bytes} bytes of hex`);
+    }
+}
+//# sourceMappingURL=status-document.js.map

package/dist/cjs/status-document.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-document.js","sourceRoot":"","sources":["../../src/status-document.ts"],"names":[],"mappings":";AAAA;;;6EAG6E;;;AAI7E;;;;;;;;;;;;;;;;8BAgB8B;AAC9B,+BAAsC,MAAe;IACnD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,GAAG,GAAG,MAAyB,CAAC;IACpC,IAAI,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1F,GAAG,GAAG,GAAG,CAAC,IAAuB,CAAC;IACpC,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QACvD,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;IACxG,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,sBAAsB,CAAC;QAAE,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACxF,IAAI,GAAG,CAAC,UAAU,IAAI,IAAI;QAAE,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC9D,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC9G,2EAA2E;IAC3E,4EAA4E;IAC5E,eAAe;IACf,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;IACrC,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;IACjC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,GAAoB,EAAE,KAAa;IACzD,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,kBAAkB,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAoB,EAAE,KAAa,EAAE,KAAa;IACpE,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,MAAM,CAAC,gBAAgB,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,WAAW,KAAK,eAAe,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC"}

package/dist/cjs/verify.d.ts

@@ -28,6 +28,9 @@ import type { TransparencyResult, VerificationResult } from "./models.js";
  * script on the page could otherwise push a version onto it.
  */
 export declare const KNOWN_FORMAT_VERSIONS: readonly string[];
+/** Decode hex: whole bytes, digits in either case, nothing else. Anything else
+ * throws TypeError. It is exported, so its input is a boundary: reading a stray
+ * character as 0, as it once did, turned a typo into different bytes. */
 export declare function hexToBytes(hex: string): Uint8Array;
 export declare function bytesToHex(bytes: Uint8Array): string;
 /** A signing key's disposition (ADR-017 §1).
@@ -110,8 +113,90 @@ export declare function evaluateKey(pki: PublicKeyInfo, anchor: number | null):
  */
 export declare function certificateAnchor(certificate: Record<string, unknown>): number | null;
 type Cert = Record<string, unknown>;
+/**
+ * Require what ADR-025 lets a record prove: that a key group you name signed the
+ * registration the enclave checked each system against before measuring it.
+ *
+ * A pass means each required system is `certified` under one of
+ * `customerKeyIds`, in a record from an enclave image of wire protocol 12 or
+ * later — the first that registers a system only with that key group's
+ * signatures. A record from an earlier image (PRE_PROTOCOL_12_IMAGES), or one
+ * that names no image, fails: those images could say `certified` with no
+ * customer signature at all.
+ *
+ * Off unless asked for, because a record that says `authorization: none` is
+ * still a genuine record. Whoever relays requests to the enclave can always
+ * leave a registration out (ADR-025 §5, §8), and the enclave cannot refuse that
+ * for want of durable state. So "my systems must be certified" can be enforced
+ * in one place only: here, by the party relying on the record.
+ */
+export interface AuthorizationPolicy {
+    /** The system_ids that must be certified. Omitted: every system the record covers. */
+    readonly systems?: readonly string[];
+    /**
+     * The key groups you accept. Required: `certified` under a key id you did not
+     * name proves nothing to you, because the relay can enroll a key group of its
+     * own and the record would name that one.
+     */
+    readonly customerKeyIds: readonly string[];
+}
+export interface VerifyOptions {
+    /**
+     * Refuse the record, with a VerificationError whose code is
+     * AUTHORIZATION_POLICY_FAILED, unless it meets this policy. Omitted: no
+     * requirement, and `authorization: none` verifies as it always has.
+     */
+    readonly requireAuthorization?: AuthorizationPolicy;
+}
+/**
+ * The enclave images that issued format 9.0 while running wire protocol 11 or
+ * earlier, by PCR0, as the published measurement history records them
+ * (website/docs/enclave-measurements/, docs/CONNECTOR-STATUS.md).
+ *
+ * Their `certified` is not evidence of a customer signature. Before protocol 12
+ * the enclave enrolled a key group with no proof that anyone held its keys, and
+ * registered a system for whoever relayed the authorization — so the host could
+ * make a genuine 9.0 record say `certified`, under a key id it chose, with no
+ * customer signature anywhere (reproduced by an independent re-review,
+ * 2026-09-13).
+ *
+ * THE SET IS CLOSED BY POLICY, NOT BY ENFORCEMENT: the release runbook forbids
+ * admitting or rolling back to an image of protocol 11 or earlier once any
+ * customer key is enrolled, and admitting one takes a KMS re-pin, which ADR-027
+ * leaves to the owner. The protocol-12 cutover's KMS tighten drops every
+ * measurement here from the signing key's policy, after which none of them can
+ * sign. v42 ran for seven minutes and is recorded as issuing nothing; it is here
+ * because it held the signing key while it ran.
+ *
+ * The Python SDK carries the same list, in _verify.py.
+ */
+export declare const PRE_PROTOCOL_12_IMAGES: ReadonlyMap<string, string>;
+/**
+ * What a record's signed issuer.enclave_pcr0 makes of `certified`: whether the
+ * image that signed it could mark a system certified without the customer's
+ * signature. "protocol-12-or-later" is the inference the closed list licenses:
+ * a genuine 9.0 record under any other measurement was signed by a later image.
+ */
+export type IssuingImage = {
+    readonly kind: "unnamed";
+} | {
+    readonly kind: "before-protocol-12";
+    readonly name: string;
+    readonly pcr0: string;
+} | {
+    readonly kind: "protocol-12-or-later";
+    readonly pcr0: string;
+};
+export declare function issuingImage(certificate: Cert): IssuingImage;
+/**
+ * What `certified` is evidence of, given the image that signed the record: the
+ * words every verifier prints after "certified under <key id> —". The Go CLI
+ * (cmd/cli/registration_image.go), both SDK CLIs and the /verify page state it
+ * identically, and testdata/registration_line_cases.json holds them to it.
+ */
+export declare function registrationQualifier(image: IssuingImage): string;
 /** Verify all signatures on a deletion certificate offline. */
-export declare function verifyCertificate(crypto: CryptoOps, certificate: Cert, publicKeys: Map<string, PublicKeyInfo>): Promise<VerificationResult>;
+export declare function verifyCertificate(crypto: CryptoOps, certificate: Cert, publicKeys: Map<string, PublicKeyInfo>, options?: VerifyOptions): Promise<VerificationResult>;
 /** Verify the transparency proof embedded in a certificate. */
 export declare function verifyTransparency(crypto: CryptoOps, certificate: Cert, publicKeys: Map<string, PublicKeyInfo>): Promise<TransparencyResult>;
 /** Reconstruct the certificate JSON as it existed at issuance time.
@@ -149,8 +234,11 @@ export declare function canonicalJson(obj: unknown): Uint8Array;
  * Exported from this module so the timestamp_vectors.json suite can diff it
  * against Go directly. It is deliberately not re-exported from index.ts, so it
  * is not part of the published package surface.
+ *
+ * `field` names the value in a refusal. It defaults to the word these messages
+ * always used, for callers normalizing a time that is not a field of a document.
  */
-export declare function formatTimestamp(ts: unknown): string;
+export declare function formatTimestamp(ts: unknown, field?: string): string;
 /**
  * Port of Go's BuildTreeHeadPayload.
  *
@@ -211,7 +299,24 @@ export declare const VALID_REVOCATION_UNKNOWN = "VALID_REVOCATION_UNKNOWN";
  *
  * The third row is the point: `verifyCertificate` answers VALID there, which
  * reads as "not revoked" and is not something it checked.
+ *
+ * `options` is passed to {@link verifyCertificate} unchanged.
+ */
+export declare function verifyCertificateWithStatus(crypto: CryptoOps, certificate: Cert, publicKeys: Map<string, PublicKeyInfo>, status?: Record<string, unknown> | null, now?: Date, options?: VerifyOptions): Promise<string>;
+/**
+ * The statement half of {@link verifyCertificateWithStatus}: authenticate a
+ * status statement about `certificateId` against the published keys, and read
+ * it at `now`. The /verify page's QR lookup has a record id and no record, and
+ * uses this so it shows what a signed, fresh statement says, never what the
+ * status endpoint claims.
+ *
+ * | input | result |
+ * |---|---|
+ * | fresh, REVOKED | throws VerificationError, code CERTIFICATE_REVOKED |
+ * | fresh, ACTIVE | the statement key's verdict: `"VALID"`, or a soft one |
+ * | stale, or a status this SDK does not know | `"VALID_REVOCATION_UNKNOWN"` |
+ * | unknown or unusable key, bad signature, another certificate | throws VerificationError |
  */
-export declare function verifyCertificateWithStatus(crypto: CryptoOps, certificate: Cert, publicKeys: Map<string, PublicKeyInfo>, status?: Record<string, unknown> | null, now?: Date): Promise<string>;
+export declare function verifyStatusStatement(crypto: CryptoOps, status: Record<string, unknown>, publicKeys: Map<string, PublicKeyInfo>, certificateId: unknown, now?: Date): Promise<string>;
 export {};
 //# sourceMappingURL=verify.d.ts.map

package/dist/cjs/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAO7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAwE1E;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAQjD,CAAC;AAqIH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CASlD;AAYD,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAQpD;AAoCD;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,aAAa,CAAC;AAE7D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;2DAEuD;IACvD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;8CAE0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,aAAa,CAAC,CAqBxB;AAED,+CAA+C;AAC/C,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAC3D,eAAO,MAAM,eAAe,oBAAoB,CAAC;AACjD,eAAO,MAAM,2BAA2B,gCAAgC,CAAC;AACzE,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAoBnE;;;sEAGsE;AACtE,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAyB7E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAUrF;AAiFD,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpC,+DAA+D;AAC/D,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GACrC,OAAO,CAAC,kBAAkB,CAAC,CA0H7B;AAKD,+DAA+D;AAC/D,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAwF7B;AAMD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,IAAI,GAAG,UAAU,CAK3D;AAMD;;wCAEwC;AACxC,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,CAEtD;AA4ED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,OAAO,GAAG,MAAM,CAMnD;AAyaD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAW9E;AAqFD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,UAAU,EAAE,GAClB,OAAO,CAAC,OAAO,CAAC,CAwDlB;AAGD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,UAAU,CAoBZ;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAqB5E;AAED,uFAAuF;AACvF,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EACtC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACvC,GAAG,CAAC,EAAE,IAAI,GACT,OAAO,CAAC,MAAM,CAAC,CA8FjB"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAQ7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAyE1E;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAQjD,CAAC;AAqIH;;yEAEyE;AACzE,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAQlD;AAaD,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAQpD;AAoCD;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,aAAa,CAAC;AAE7D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;2DAEuD;IACvD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;8CAE0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,aAAa,CAAC,CA4BxB;AAED,+CAA+C;AAC/C,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAC3D,eAAO,MAAM,eAAe,oBAAoB,CAAC;AACjD,eAAO,MAAM,2BAA2B,gCAAgC,CAAC;AACzE,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAoBnE;;;sEAGsE;AACtE,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAqC7E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAUrF;AA0FD,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,mBAAmB;IAClC,sFAAsF;IACtF,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAED,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,mBAAmB,CAAC;CACrD;AAoCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAQ7D,CAAC;AAEH;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACrF;IAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAErE,wBAAgB,YAAY,CAAC,WAAW,EAAE,IAAI,GAAG,YAAY,CAQ5D;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAmBjE;AA0ED,+DAA+D;AAC/D,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EACtC,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,kBAAkB,CAAC,CA+H7B;AAKD,+DAA+D;AAC/D,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAe7B;AA6FD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,IAAI,GAAG,UAAU,CAK3D;AAMD;;wCAEwC;AACxC,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,CAEtD;AA4HD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,SAAc,GAAG,MAAM,CAMxE;AAybD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAW9E;AA0FD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,UAAU,EAAE,GAClB,OAAO,CAAC,OAAO,CAAC,CA6DlB;AAGD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,UAAU,CAuBZ;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAqB5E;AAED,uFAAuF;AACvF,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EACtC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACvC,GAAG,CAAC,EAAE,IAAI,EACV,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EACtC,aAAa,EAAE,OAAO,EACtB,GAAG,CAAC,EAAE,IAAI,GACT,OAAO,CAAC,MAAM,CAAC,CAoFjB"}