burnledger 0.8.1 → 0.9.1

package/dist/esm/cli.d.ts

@@ -3,6 +3,9 @@
  * Exit codes: 0=valid, 1=invalid, 2=usage error */
 import { type KeyListEvidence } from "./keys.js";
 import { type AnchorResult } from "./anchor.js";
+import { unwrapStatusStatement } from "./status-document.js";
+import type { PublicKeyInfo } from "./verify.js";
+export { unwrapStatusStatement };
 type Cert = Record<string, unknown>;
 /** A published status statement, exactly as GET /v1/certificates/{id}/status
  * serves it: hex strings, not decoded bytes. verifyCertificateWithStatus reads
@@ -18,24 +21,35 @@ type StatusStatement = Record<string, unknown>;
  * Demanding an API key was what stopped that reader asking the one question the
  * artifact exists to answer. */
 export declare function resolveApiBaseUrl(apiUrl: string, env: Record<string, string | undefined>): string;
-/** The API wraps every response in {"data": ...}; a caller may hand over either
- * the envelope or the document inside it. Mirrors
- * core.ParseCertificateStatusDocument, so this CLI and the Go one cannot
- * disagree about which shape the endpoint returns. Exported for testing.
+/** Load the key set and, separately, what the file establishes about the key
+ * STATUSES (ADR-017 §5a). The keys load the same way whether or not the file
+ * carries a signed statement — key_id == sha256(public_key) makes every
+ * identity self-checking — so an unsigned file is not refused. What changes is
+ * what this CLI is entitled to say about the statuses and dates. Mirrors
+ * loadKeysFromFile in cmd/cli/keys.go. Exported for testing. */
+export declare function loadKeys(path: string): Promise<{
+    keys: Map<string, PublicKeyInfo>;
+    keyList: KeyListEvidence;
+}>;
+/** Retrieve the SIGNED status statement for a certificate.
  *
- * A document that does not parse THROWS, and the caller turns that into a
- * warning and a VALID_REVOCATION_UNKNOWN verdict. That is deliberate: an answer
- * this build cannot read is silence about revocation, not a finding about the
- * certificate. Handing a half-read document to the verifier instead would
- * report "status statement signature is invalid" — a claim about the issuer —
- * when what actually happened is that something returned nonsense.
+ * It replaces a GET of /v1/certificates/{id}/revocation-status, which returned
+ * a bare {"status": "..."} with no signature over it. That answer was the API's
+ * word — or the word of whatever --api-url happened to point at — and this CLI
+ * printed it. Nothing about it was checkable, so a network attacker, a stale
+ * proxy or a wrong URL could suppress a revocation and the reader could not
+ * tell. Every field of this response that the verdict acts on is covered by the
+ * issuer's signature.
  *
- * `status` itself is NOT validated against a known set. A statement saying
- * SUSPENDED is a statement this build cannot read, and the verifier already has
- * the right answer for that: it authenticates the signature first, then reports
- * VALID_REVOCATION_UNKNOWN. Refusing it here would discard the statement before
- * anyone authenticated it. */
-export declare function unwrapStatusStatement(parsed: unknown): StatusStatement;
+ * No Authorization header is sent. The endpoint takes none, and sending an API
+ * key to an arbitrary --api-url is a credential leak the check never needed.
+ *
+ * Read under a 1 MiB cap and a total deadline, matching the anchor fetch
+ * (anchor.ts) and the Go CLI (cmd/cli/online.go): a status statement is a few
+ * hundred bytes, so anything near the cap is a misbehaving or hostile server.
+ * The AbortController bounds the whole fetch including the body read, which a
+ * server dripping bytes could otherwise hold open. Exported for testing. */
+export declare function fetchStatusStatement(apiUrl: string, certId: string): Promise<StatusStatement>;
 /** The pass/fail decision behind the exit code. A signature failure, a
  * revocation, or a transparency FAILURE (thrown, not NOT_AVAILABLE) all make
  * the certificate unusable. Revocation is no longer a separate input: it is
@@ -52,5 +66,4 @@ export declare function formatOutput(cert: Cert, sigResult: string, transparency
 /** Accept the raw API response too: GET /v1/certificates/{id} nests the
  * signed certificate as data.certificate. Exported for testing. */
 export declare function unwrapCertificate(parsed: Cert): Cert;
-export {};
 //# sourceMappingURL=cli.d.ts.map

package/dist/esm/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AACA;mDACmD;AAenD,OAAO,EAML,KAAK,eAAe,EACrB,MAAM,WAAW,CAAC;AACnB,OAAO,EAA6C,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3F,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACpC;;0EAE0E;AAC1E,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAkC/C;;;;;;;;gCAQgC;AAChC,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtD,MAAM,CAIR;AA2ED;;;;;;;;;;;;;;;;8BAgB8B;AAC9B,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,GAAG,eAAe,CAoBtE;AAqCD;;;;;;;;;;0DAU0D;AAC1D,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,YAAY,GACpE,OAAO,CAGT;AA2ID,wBAAgB,YAAY,CAC1B,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAChF,MAAM,EAAE,eAAe,GAAG,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,YAAY,EAC3E,OAAO,CAAC,EAAE,eAAe,GACxB,MAAM,CAoGR;AAgFD;mEACmE;AACnE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,IAAI,GAAG,IAAI,CAUpD"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AACA;mDACmD;AAiBnD,OAAO,EAML,KAAK,eAAe,EACrB,MAAM,WAAW,CAAC;AACnB,OAAO,EAA6C,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,KAAK,EAAuB,aAAa,EAAE,MAAM,aAAa,CAAC;AAItE,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAEjC,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACpC;;0EAE0E;AAC1E,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AA8D/C;;;;;;;;gCAQgC;AAChC,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtD,MAAM,CAIR;AAED;;;;;gEAKgE;AAChE,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC,CA+CpH;AAED;;;;;;;;;;;;;;;;;4EAiB4E;AAC5E,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAgBnG;AAuDD;;;;;;;;;;0DAU0D;AAC1D,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,YAAY,GACpE,OAAO,CAGT;AA+ID,wBAAgB,YAAY,CAC1B,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAChF,MAAM,EAAE,eAAe,GAAG,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,YAAY,EAC3E,OAAO,CAAC,EAAE,eAAe,GACxB,MAAM,CAiHR;AAgFD;mEACmE;AACnE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,IAAI,GAAG,IAAI,CAUpD"}

package/dist/esm/cli.js

@@ -6,16 +6,24 @@ import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { nodeCrypto } from "./crypto-node.js";
 import { CERTIFICATE_REVOKED, VerificationError } from "./errors.js";
-import { formatTimestamp, publicKeyFromHex, verifyCertificateWithStatus, verifyTransparency, KNOWN_FORMAT_VERSIONS, VALID_REVOCATION_UNKNOWN, } from "./verify.js";
+import { formatTimestamp, issuingImage, publicKeyFromHex, registrationQualifier, verifyCertificateWithStatus, verifyTransparency, KNOWN_FORMAT_VERSIONS, VALID_REVOCATION_UNKNOWN, } from "./verify.js";
 import { KEY_LIST_STALE, KEY_LIST_VALID, parseKeyListDocument, verifyKeyList, } from "./keys.js";
 import { ANCHOR_INCONSISTENT, checkStatementAnchor } from "./anchor.js";
-const USAGE = "Usage: burnledger check --cert <file> --keys <file> [--online --api-url <url>]\n";
+import { unwrapStatusStatement } from "./status-document.js";
+// Exported from here too: tests/cli-revocation-unknown.test.ts reads it as the
+// CLI's own parser.
+export { unwrapStatusStatement };
+const USAGE = "Usage: burnledger check --cert <file> --keys <file> [--online --api-url <url>]\n" +
+    "       [[--require-certified | --require-certified-system <system_id>...] --customer-key-id <id>...]\n";
 function die(msg) { process.stderr.write(msg); process.exit(2); }
 function parseArgs(argv) {
     const args = argv.slice(2);
     if (args[0] !== "check")
         die(USAGE);
     let certPath = "", keysPath = "", online = false, apiUrl = "";
+    let requireCertified = false;
+    const systems = [];
+    const keyIds = [];
     for (let i = 1; i < args.length; i++) {
         const a = args[i];
         if (a === "--cert") {
@@ -36,11 +44,33 @@ function parseArgs(argv) {
         else if (a === "--api-key") {
             void (args[++i] ?? die("--api-key requires a value\n"));
         }
+        // ADR-025. Opt-in: without these, authorization: none verifies as it always
+        // has. The Go CLI has no equivalent yet; these names are the proposal for it.
+        else if (a === "--require-certified") {
+            requireCertified = true;
+        }
+        else if (a === "--require-certified-system") {
+            systems.push(args[++i] ?? die("--require-certified-system requires a value\n"));
+        }
+        else if (a === "--customer-key-id") {
+            keyIds.push(args[++i] ?? die("--customer-key-id requires a value\n"));
+        }
         else
             die(`Unknown argument: ${a}\n`);
     }
     if (!certPath || !keysPath)
         die("Both --cert and --keys are required.\n");
+    // Every system, or these systems: asking for both is a mistake to name, not
+    // one to resolve silently in either direction.
+    if (requireCertified && systems.length > 0) {
+        die("--require-certified and --require-certified-system are alternatives; use one\n");
+    }
+    // Certified under a key id you did not name proves nothing to you: the relay
+    // can enroll a key group of its own, and the record would name that one.
+    if ((requireCertified || systems.length > 0) && keyIds.length === 0) {
+        die("--require-certified and --require-certified-system need --customer-key-id <id>: " +
+            "certified under a key you did not name proves nothing\n");
+    }
     if (online) {
         try {
             apiUrl = resolveApiBaseUrl(apiUrl, process.env);
@@ -49,7 +79,8 @@ function parseArgs(argv) {
             die(e.message + "\n");
         }
     }
-    return { certPath, keysPath, online, apiUrl };
+    const policy = keyIds.length > 0 ? { ...(systems.length > 0 ? { systems } : {}), customerKeyIds: keyIds } : undefined;
+    return { certPath, keysPath, online, apiUrl, policy };
 }
 /** Flag first, then environment — the precedence docs/cli.md promises and the
  * Go CLI (cmd/cli/online.go resolveAPIBaseURL) implements. Exported for testing.
@@ -71,8 +102,8 @@ export function resolveApiBaseUrl(apiUrl, env) {
  * carries a signed statement — key_id == sha256(public_key) makes every
  * identity self-checking — so an unsigned file is not refused. What changes is
  * what this CLI is entitled to say about the statuses and dates. Mirrors
- * loadKeysFromFile in cmd/cli/keys.go. */
-async function loadKeys(path) {
+ * loadKeysFromFile in cmd/cli/keys.go. Exported for testing. */
+export async function loadKeys(path) {
     let entries;
     let keyList;
     try {
@@ -133,66 +164,64 @@ async function loadKeys(path) {
  * issuer's signature.
  *
  * No Authorization header is sent. The endpoint takes none, and sending an API
- * key to an arbitrary --api-url is a credential leak the check never needed. */
-async function fetchStatusStatement(apiUrl, certId) {
-    const res = await fetch(`${apiUrl.replace(/\/+$/, "")}/v1/certificates/${certId}/status`);
-    if (!res.ok)
-        throw new Error(`HTTP ${res.status}`);
-    return unwrapStatusStatement(await res.json());
-}
-/** The API wraps every response in {"data": ...}; a caller may hand over either
- * the envelope or the document inside it. Mirrors
- * core.ParseCertificateStatusDocument, so this CLI and the Go one cannot
- * disagree about which shape the endpoint returns. Exported for testing.
- *
- * A document that does not parse THROWS, and the caller turns that into a
- * warning and a VALID_REVOCATION_UNKNOWN verdict. That is deliberate: an answer
- * this build cannot read is silence about revocation, not a finding about the
- * certificate. Handing a half-read document to the verifier instead would
- * report "status statement signature is invalid" — a claim about the issuer —
- * when what actually happened is that something returned nonsense.
+ * key to an arbitrary --api-url is a credential leak the check never needed.
  *
- * `status` itself is NOT validated against a known set. A statement saying
- * SUSPENDED is a statement this build cannot read, and the verifier already has
- * the right answer for that: it authenticates the signature first, then reports
- * VALID_REVOCATION_UNKNOWN. Refusing it here would discard the statement before
- * anyone authenticated it. */
-export function unwrapStatusStatement(parsed) {
-    if (parsed === null || typeof parsed !== "object") {
-        throw new Error("status statement: response is not a JSON object");
-    }
-    let doc = parsed;
-    if (doc.certificate_id === undefined && doc.data !== null && typeof doc.data === "object") {
-        doc = doc.data;
-    }
-    for (const f of ["certificate_id", "status", "key_id"]) {
-        if (typeof doc[f] !== "string" || doc[f] === "")
-            throw new Error(`status statement: ${f} is missing`);
-    }
-    for (const f of ["statement_issued_at", "statement_expires_at"])
-        requireRfc3339(doc, f);
-    if (doc.revoked_at != null)
-        requireRfc3339(doc, "revoked_at");
-    if (typeof doc.sth_tree_size !== "number")
-        throw new Error("status statement: sth_tree_size is not a number");
-    // Refuse a short or long value rather than letting it through: a truncated
-    // signature or root hash that reaches the verifier is checked against bytes
-    // nobody sent.
-    requireHex(doc, "sth_root_hash", 32);
-    requireHex(doc, "signature", 64);
-    return doc;
-}
-function requireRfc3339(doc, field) {
-    const v = doc[field];
-    if (typeof v !== "string" || Number.isNaN(Date.parse(v))) {
-        throw new Error(`status statement: ${field} is not RFC 3339`);
+ * Read under a 1 MiB cap and a total deadline, matching the anchor fetch
+ * (anchor.ts) and the Go CLI (cmd/cli/online.go): a status statement is a few
+ * hundred bytes, so anything near the cap is a misbehaving or hostile server.
+ * The AbortController bounds the whole fetch including the body read, which a
+ * server dripping bytes could otherwise hold open. Exported for testing. */
+export async function fetchStatusStatement(apiUrl, certId) {
+    const url = `${apiUrl.replace(/\/+$/, "")}/v1/certificates/${certId}/status`;
+    const controller = new AbortController();
+    const timer = setTimeout(() => { controller.abort(); }, STATUS_FETCH_TIMEOUT_MS);
+    try {
+        const res = await fetch(url, { signal: controller.signal });
+        const body = await readCapped(res);
+        if (!res.ok)
+            throw new Error(`HTTP ${res.status}`);
+        try {
+            return unwrapStatusStatement(JSON.parse(body));
+        }
+        catch (e) {
+            throw new Error(`parse response: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
+    finally {
+        clearTimeout(timer);
     }
 }
-function requireHex(doc, field, bytes) {
-    const v = doc[field];
-    if (typeof v !== "string" || !new RegExp(`^[0-9a-fA-F]{${bytes * 2}}$`).test(v)) {
-        throw new Error(`status statement: ${field} is not ${bytes} bytes of hex`);
+/** How much of the status response to buffer (1 MiB) and how long the whole
+ * fetch may take (10 s), matching cmd/cli/online.go and anchor.ts. */
+const MAX_STATUS_BYTES = 1 << 20;
+const STATUS_FETCH_TIMEOUT_MS = 10_000;
+/** Read a response body, stopping at the cap instead of buffering whatever a
+ * hostile server decides to send. The stream is cancelled on the way out, so an
+ * endless body costs one megabyte and not the process. */
+async function readCapped(res) {
+    const reader = res.body?.getReader();
+    if (reader === undefined)
+        return "";
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.length;
+        if (total > MAX_STATUS_BYTES) {
+            await reader.cancel();
+            throw new Error(`read response: body exceeds ${MAX_STATUS_BYTES} bytes`);
+        }
+        chunks.push(value);
+    }
+    const joined = new Uint8Array(total);
+    let at = 0;
+    for (const c of chunks) {
+        joined.set(c, at);
+        at += c.length;
     }
+    return new TextDecoder().decode(joined);
 }
 /** The verdicts a reader can act on, and therefore the ones that exit 0.
  *
@@ -291,8 +320,15 @@ function pushRecordCounts(L, sys) {
     }
 }
 /**
- * Per system: did the enclave check it against a customer-signed registration,
- * and under which key?
+ * Per system: did the enclave check it against a registration, under which key,
+ * and what does the image that signed the record make of that?
+ *
+ * Printed for exactly the verdicts that say the record's own signature
+ * verified: VALID, VALID_REVOCATION_UNKNOWN, the two soft key verdicts and
+ * REVOKED, as in the Go and Python CLIs and the /verify page. The qualifier is
+ * read from issuer.enclave_pcr0, which that signature covers, and
+ * verifyCertificate checks it before any of those verdicts is reached. Beside
+ * INVALID the field is unverified bytes, so nothing is printed there.
  *
  * This line is the WHOLE POINT of the field. ADR-025 §2: the enclave cannot
  * refuse a second enrollment for a team — that needs durable state — so a parent
@@ -312,12 +348,11 @@ function pushRegistrationEvidence(L, cert) {
             "its absence is not a pass)");
         return;
     }
+    const qualifier = registrationQualifier(issuingImage(cert));
     for (const sys of cert.systems ?? []) {
         const name = sys.system_name;
         if (sys.authorization === "certified") {
-            L.push(`  Registration [${name}]: certified under ${sys.customer_key_id} — ` +
-                "the enclave checked this system against a customer-signed registration. " +
-                "If that key id is not yours, someone else authorized this verification.");
+            L.push(`  Registration [${name}]: certified under ${sys.customer_key_id} — ${qualifier}`);
         }
         else if (sys.authorization === "none") {
             L.push(`  Registration [${name}]: none — this verification was NOT checked against ` +
@@ -345,8 +380,9 @@ function displayHash(v) {
     return String(v);
 }
 export function formatOutput(cert, sigResult, transparency, transparencyFailed, status, online, anchor, keyList) {
-    const id = cert.certificate_id.slice(0, 6);
-    const sub = displayHash(cert.subject.identifier_hash);
+    // This line prints for records that FAILED verification too, so it must not
+    // assume the shape verification would have checked.
+    const id = typeof cert.certificate_id === "string" ? cert.certificate_id.slice(0, 6) : "unknown";
     const att = cert.attestation;
     const L = [];
     // A proven-inconsistent anchor outranks every verdict below it, including
@@ -362,25 +398,34 @@ export function formatOutput(cert, sigResult, transparency, transparencyFailed,
         pushStatementEvidence(L, status);
         return L.join("\n") + "\n";
     }
-    // A soft key verdict is not a forgery: every signature verified, and what
-    // could not be established is the key's authority. "INVALID" would send an
-    // auditor hunting for tampering that is not there, and "VALID" — which this
-    // CLI printed — claims a check that did not happen.
-    const note = SOFT_KEY_VERDICTS[sigResult];
-    if (note !== undefined)
-        return `Verification record dc_${id}: ${sigResult} (${note})\n`;
     // Revocation is now a signed fact, so the reader gets the evidence with the
     // verdict: who said it, when, and which log entry it points at.
     if (sigResult === REVOKED) {
         L.push(`Verification record dc_${id}: INVALID (REVOKED)`);
+        pushRegistrationEvidence(L, cert);
         pushStatementEvidence(L, status);
         pushAnchorEvidence(L, anchor);
         return L.join("\n") + "\n";
     }
-    if (!USABLE_VERDICTS.has(sigResult))
+    const note = SOFT_KEY_VERDICTS[sigResult];
+    if (!USABLE_VERDICTS.has(sigResult) && note === undefined) {
         return `Verification record dc_${id}: INVALID (${sigResult})\n`;
+    }
+    // A failed proof refuses the record, and it outranks a soft key verdict: a
+    // verdict that asks for a human must not hide one that refuses. The Python
+    // CLI and the /verify page already put it first; this CLI and Go printed
+    // the soft verdict instead.
     if (transparencyFailed)
         return `Verification record dc_${id}: INVALID (transparency: ${transparency})\n`;
+    // A soft key verdict is not a forgery: every signature verified, and what
+    // could not be established is the key's authority. "INVALID" would send an
+    // auditor hunting for tampering that is not there, and "VALID" — which this
+    // CLI printed — claims a check that did not happen.
+    if (note !== undefined) {
+        L.push(`Verification record dc_${id}: ${sigResult} (${note})`);
+        pushRegistrationEvidence(L, cert);
+        return L.join("\n") + "\n";
+    }
     // The two usable verdicts. VALID is sayable without a qualifier for the first
     // time: it is reached only when a fresh statement, signed by a key from the
     // key file and naming this certificate, said ACTIVE. Everything short of that
@@ -390,6 +435,7 @@ export function formatOutput(cert, sigResult, transparency, transparencyFailed,
         ? `${VALID_REVOCATION_UNKNOWN} (${online ? REVOCATION_UNKNOWN_ONLINE : REVOCATION_UNKNOWN_OFFLINE})`
         : "VALID (a signed status statement says this record is live)";
     L.push(`Verification record dc_${id}: ${tag}`);
+    const sub = displayHash(cert.subject.identifier_hash);
     L.push(`  Subject: sha256:${sub.slice(0, 6)}...`);
     L.push(`  Format version: ${cert.certificate_format_version}`);
     // v3 carries ONE system list at the top level, with both counts on each
@@ -534,7 +580,13 @@ export function unwrapCertificate(parsed) {
 }
 async function main() {
     const args = parseArgs(process.argv);
-    const cert = unwrapCertificate(JSON.parse(await readFile(args.certPath, "utf-8")));
+    const parsed = JSON.parse(await readFile(args.certPath, "utf-8"));
+    // No record to give a verdict about. Go's loader refuses the same file at
+    // unmarshal and exits 2, as this does.
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        die(`${args.certPath}: not a JSON object\n`);
+    }
+    const cert = unwrapCertificate(parsed);
     const { keys, keyList } = await loadKeys(args.keysPath);
     // Fetched first, because the verdict now depends on it. A status statement is
     // an input to the verdict, not a footnote printed beside one:
@@ -571,15 +623,20 @@ async function main() {
     // and VALID_KEY_COMPROMISED_LATER are cases verifyCertificateWithStatus
     // deliberately refused to call VALID, and this is the tool an auditor runs in
     // a script — the one whose exit code gets trusted.
+    //
+    // Only a VerificationError is a verdict. Anything else is a defect in this
+    // CLI or the SDK under it; printing it as INVALID dressed a crash up as a
+    // finding about the record, so it propagates and exits 2 instead.
     let sigResult = "VALID";
     try {
-        sigResult = await verifyCertificateWithStatus(nodeCrypto, cert, keys, status ?? null);
+        sigResult = await verifyCertificateWithStatus(nodeCrypto, cert, keys, status ?? null, undefined, {
+            requireAuthorization: args.policy,
+        });
     }
     catch (e) {
-        if (e instanceof VerificationError && e.code === CERTIFICATE_REVOKED)
-            sigResult = REVOKED;
-        else
-            sigResult = e instanceof Error ? e.message : "unknown error";
+        if (!(e instanceof VerificationError))
+            throw e;
+        sigResult = e.code === CERTIFICATE_REVOKED ? REVOKED : e.message;
     }
     // NOT_AVAILABLE (no proof) is a legitimate result; only a thrown error is a
     // transparency FAILURE and must fail the verdict + exit code.
@@ -589,7 +646,9 @@ async function main() {
         transparency = await verifyTransparency(nodeCrypto, cert, keys);
     }
     catch (e) {
-        transparency = e instanceof Error ? e.message : "unknown error";
+        if (!(e instanceof VerificationError))
+            throw e;
+        transparency = e.message;
         transparencyFailed = true;
     }
     const valid = certVerdict(sigResult, transparencyFailed, anchor);

package/dist/esm/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AACA;mDACmD;AAEnD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,2BAA2B,EAC3B,kBAAkB,EAClB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,aAAa,GAGd,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAqB,MAAM,aAAa,CAAC;AAQ3F,MAAM,KAAK,GAAG,kFAAkF,CAAC;AAEjG,SAAS,GAAG,CAAC,GAAW,IAAW,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhF,SAAS,SAAS,CAAC,IAAc;IAG/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO;QAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,QAAQ,GAAG,EAAE,EAAE,QAAQ,GAAG,EAAE,EAAE,MAAM,GAAG,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC;IAC9D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,2BAA2B,CAAC,CAAC;QAAC,CAAC;aAC5E,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,2BAA2B,CAAC,CAAC;QAAC,CAAC;aACjF,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC;QAAC,CAAC;aACxC,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAAC,CAAC;QAC1F,2EAA2E;QAC3E,2EAA2E;QAC3E,2DAA2D;aACtD,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,8BAA8B,CAAC,CAAC,CAAC;QAAC,CAAC;;YACnF,GAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;QAAE,GAAG,CAAC,wCAAwC,CAAC,CAAC;IAC1E,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAE,CAAW,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;gCAQgC;AAChC,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EAAE,GAAuC;IAEvD,MAAM,KAAK,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACjH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;0CAK0C;AAC1C,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,IAAI,OAAmB,CAAC;IACxB,IAAI,OAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC5E,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;QACnB,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,8BAA8B;QAC9B,OAAO,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAE,CAAW,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,kBAAkB;QAClB,IAAI,CAAC,CAAC,UAAU,KAAK,aAAa,IAAI,CAAC,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACvE,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,GAAG,8DAA8D,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,GAAkB,CAAC;QACvB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE;gBACrD,SAAS,EAAE,CAAC,CAAC,UAAU;gBACvB,SAAS,EAAE,CAAC,CAAC,UAAU;gBACvB,QAAQ,EAAE,CAAC,CAAC,SAAS,IAAI,SAAS;gBAClC,eAAe,EAAE,CAAC,CAAC,gBAAgB,IAAI,SAAS;aACjD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,uBAAwB,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QACzD,CAAC;QACD,6EAA6E;QAC7E,4EAA4E;QAC5E,oDAAoD;QACpD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC;YACrD,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,uCAAuC,GAAG,CAAC,KAAK,KAAK,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;YACnE,GAAG,CAAC,4CAA4C,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;QACjE,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;gFAWgF;AAChF,KAAK,UAAU,oBAAoB,CAAC,MAAc,EAAE,MAAc;IAChE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,oBAAoB,MAAM,SAAS,CAAC,CAAC;IAC1F,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,OAAO,qBAAqB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;;;;;8BAgB8B;AAC9B,MAAM,UAAU,qBAAqB,CAAC,MAAe;IACnD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,GAAG,GAAG,MAAyB,CAAC;IACpC,IAAI,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1F,GAAG,GAAG,GAAG,CAAC,IAAuB,CAAC;IACpC,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QACvD,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;IACxG,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,sBAAsB,CAAC;QAAE,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACxF,IAAI,GAAG,CAAC,UAAU,IAAI,IAAI;QAAE,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC9D,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC9G,2EAA2E;IAC3E,4EAA4E;IAC5E,eAAe;IACf,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;IACrC,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;IACjC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,GAAoB,EAAE,KAAa;IACzD,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,kBAAkB,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAoB,EAAE,KAAa,EAAE,KAAa;IACpE,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,MAAM,CAAC,gBAAgB,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,WAAW,KAAK,eAAe,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED;;;;;;;;iFAQiF;AACjF,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC;AAE1F;;;;;;;uCAOuC;AACvC,MAAM,OAAO,GAAG,SAAS,CAAC;AAE1B;;;;;;;;;;0DAU0D;AAC1D,MAAM,UAAU,WAAW,CACzB,SAAiB,EAAE,kBAA2B,EAAE,MAAqB;IAErE,IAAI,MAAM,EAAE,OAAO,KAAK,mBAAmB;QAAE,OAAO,KAAK,CAAC;IAC1D,OAAO,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,kBAAkB,CAAC;AAC/D,CAAC;AAED;;;+DAG+D;AAC/D,MAAM,iBAAiB,GAA2B;IAChD,wBAAwB,EACtB,yEAAyE;QACzE,8DAA8D;IAChE,2BAA2B,EACzB,gEAAgE;QAChE,sCAAsC;CACzC,CAAC;AAEF;;;;;;;;mEAQmE;AACnE,MAAM,0BAA0B,GAC9B,qEAAqE;IACrE,yDAAyD,CAAC;AAC5D,MAAM,yBAAyB,GAC7B,mEAAmE;IACnE,uFAAuF,CAAC;AAE1F;;;;;;;;;;;;;GAaG;AACH,MAAM,sBAAsB,GAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAErG,SAAS,0BAA0B,CAAC,OAAe;IACjD,OAAO,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,qFAAqF;AACrF,MAAM,oBAAoB,GACxB,mEAAmE;IACnE,sEAAsE,CAAC;AAEzE;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,CAAW,EAAE,GAA8B;IACnE,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,CAAC,CAAC,cAAwB,CAAC;QAC5C,CAAC,CAAC,IAAI,CACJ,cAAc,CAAC,CAAC,WAAqB,MAAM,QAAQ,mBAAmB;YACpE,GAAG,CAAC,CAAC,cAAwB,iBAAiB;YAC9C,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,CAC/C,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,wBAAwB,CAAC,CAAW,EAAE,IAA6B;IAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,0BAAoC,CAAC;IAC1D,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1E,CAAC,CAAC,IAAI,CACJ,sCAAsC,OAAO,uBAAuB;YAClE,4BAA4B,CAC/B,CAAC;QACF,OAAO;IACT,CAAC;IACD,KAAK,MAAM,GAAG,IAAK,IAAI,CAAC,OAAqC,IAAI,EAAE,EAAE,CAAC;QACpE,MAAM,IAAI,GAAG,GAAG,CAAC,WAAqB,CAAC;QACvC,IAAI,GAAG,CAAC,aAAa,KAAK,WAAW,EAAE,CAAC;YACtC,CAAC,CAAC,IAAI,CACJ,mBAAmB,IAAI,sBAAsB,GAAG,CAAC,eAAyB,KAAK;gBAC7E,0EAA0E;gBAC1E,yEAAyE,CAC5E,CAAC;QACJ,CAAC;aAAM,IAAI,GAAG,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YACxC,CAAC,CAAC,IAAI,CACJ,mBAAmB,IAAI,sDAAsD;gBAC3E,iCAAiC,CACpC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,uEAAuE;YACvE,wEAAwE;YACxE,iCAAiC;YACjC,CAAC,CAAC,IAAI,CACJ,mBAAmB,IAAI,kBAAkB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,GAAG;gBACnF,kCAAkC,CACrC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACxF,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,OAAQ,CAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,IAAU,EAAE,SAAiB,EAAE,YAAoB,EAAE,kBAA2B,EAChF,MAAmC,EAAE,MAAe,EAAE,MAAqB,EAC3E,OAAyB;IAEzB,MAAM,EAAE,GAAI,IAAI,CAAC,cAAyB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,WAAW,CAAE,IAAI,CAAC,OAAmC,CAAC,eAAe,CAAC,CAAC;IACnF,MAAM,GAAG,GAAG,IAAI,CAAC,WAAsC,CAAC;IACxD,MAAM,CAAC,GAAa,EAAE,CAAC;IAEvB,0EAA0E;IAC1E,8EAA8E;IAC9E,2EAA2E;IAC3E,6EAA6E;IAC7E,+DAA+D;IAC/D,+DAA+D;IAC/D,IAAI,MAAM,EAAE,OAAO,KAAK,mBAAmB,EAAE,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,qCAAqC,CAAC,CAAC;QAC1E,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7B,CAAC,CAAC,IAAI,CAAC,wCAAwC,SAAS,6CAA6C,CAAC,CAAC;QACvG,qBAAqB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACjC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,oDAAoD;IACpD,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,0BAA0B,EAAE,KAAK,SAAS,KAAK,IAAI,KAAK,CAAC;IACxF,4EAA4E;IAC5E,gEAAgE;IAChE,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QAC1B,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,qBAAqB,CAAC,CAAC;QAC1D,qBAAqB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACjC,kBAAkB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9B,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,0BAA0B,EAAE,cAAc,SAAS,KAAK,CAAC;IACrG,IAAI,kBAAkB;QAAE,OAAO,0BAA0B,EAAE,4BAA4B,YAAY,KAAK,CAAC;IAEzG,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,qCAAqC;IACrC,MAAM,GAAG,GAAG,SAAS,KAAK,wBAAwB;QAChD,CAAC,CAAC,GAAG,wBAAwB,KAAK,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,0BAA0B,GAAG;QACpG,CAAC,CAAC,4DAA4D,CAAC;IACjE,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,0BAAoC,EAAE,CAAC,CAAC;IAEzE,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,oEAAoE;IACpE,0CAA0C;IAC1C,MAAM,GAAG,GAAI,IAAI,CAAC,OAAqC,IAAI,EAAE,CAAC;IAC9D,CAAC,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3G,CAAC,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAI,CAAC,CAAC,cAAyB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC,CAAC,IAAI,CAAC,oBAAoB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAI,CAAC,CAAC,cAAyB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACxF,gBAAgB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzB,CAAC,CAAC,IAAI,CAAC,gBAAgB,GAAG,CAAC,WAAqB,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAqB,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAEV,wEAAwE;IACxE,8EAA8E;IAC9E,yCAAyC;IACzC,EAAE;IACF,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,MAAM,GAAG,IAAI,CAAC,MAA6C,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,EAAE,YAAY,CAAC;IAClC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,0BAAoC,CAAC;QAC1D,IAAI,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC,2DAA2D,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,IAAI,CACJ,2BAA2B,OAAO,wCAAwC;gBACxE,uCAAuC,IAAI,EAAE,CAChD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,wBAAwB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAElC,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,IAAI,CAAC,YAAuC,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,WAAqB,yBAAyB,CAAC,CAAC;IACzF,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,uBAAuB,YAAY,KAAK,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,qBAAqB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACjC,kBAAkB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9B,mBAAmB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAC7B,CAAC;AAED;;;;;;;;+EAQ+E;AAC/E,SAAS,mBAAmB,CAAC,CAAW,EAAE,CAA8B;IACtE,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO;IAC5B,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACf,CAAC,CAAC,IAAI,CAAC,mEAAmE;YACxE,qEAAqE,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QAChC,CAAC,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YACjB,wEAAwE;YACxE,sEAAsE;YACtE,sDAAsD;YACtD,CAAC,CAAC,IAAI,CAAC,gEAAgE;gBACrE,2EAA2E,CAAC,CAAC;QACjF,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QAChC,CAAC,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC,SAAS,KAAK;YACrF,uDAAuD,CAAC,CAAC;QAC3D,OAAO;IACT,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC,MAAM,MAAM;QACzE,6CAA6C,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;+CAM+C;AAC/C,SAAS,kBAAkB,CAAC,CAAW,EAAE,MAAgC;IACvE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,CAAC,CAAC,IAAI,CAAC,2BAA2B,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;;;0DAS0D;AAC1D,SAAS,qBAAqB,CAAC,CAAW,EAAE,MAAmC;IAC7E,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,CAAC,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;IAClF,CAAC,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,IAAI,CAAC,sBAAsB,eAAe,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM;QAC5E,GAAG,eAAe,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACrD,8EAA8E;IAC9E,4EAA4E;IAC5E,gEAAgE;IAChE,CAAC,CAAC,IAAI,CAAC,sCAAsC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;QAC3E,QAAQ,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,UAAU,IAAI,IAAI;QAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC7F,IAAI,MAAM,CAAC,0BAA0B,IAAI,IAAI,EAAE,CAAC;QAC9C,CAAC,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,MAAM,CAAC,oBAAoB,IAAI,IAAI,EAAE,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED;mEACmE;AACnE,MAAM,UAAU,iBAAiB,CAAC,MAAY;IAC5C,IAAI,IAAI,GAAG,MAAM,CAAC;IAClB,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,IAAI,GAAG,IAAI,CAAC,IAAY,CAAC;IAClF,IACE,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;QAChE,IAAI,CAAC,WAAoB,CAAC,MAAM,KAAK,SAAS,EAC/C,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,WAAmB,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAS,CAAC,CAAC;IAC3F,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAExD,8EAA8E;IAC9E,8DAA8D;IAC9D,wDAAwD;IACxD,2EAA2E;IAC3E,8EAA8E;IAC9E,6CAA6C;IAC7C,IAAI,MAAmC,CAAC;IACxC,IAAI,MAAgC,CAAC;IACrC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,cAAwB,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,0EAA0E;YAC1E,yEAAyE;YACzE,mEAAmE;YACnE,mDAAmD;YACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iDAAiD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAChG,CAAC;QACJ,CAAC;QACD,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,SAAS;QACT,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAgB,CAAC,CAAC;YAC9C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,wEAAwE;IACxE,8EAA8E;IAC9E,mDAAmD;IACnD,IAAI,SAAS,GAAG,OAAO,CAAC;IACxB,IAAI,CAAC;QAAC,SAAS,GAAG,MAAM,2BAA2B,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC;IAAC,CAAC;IAC9F,OAAO,CAAC,EAAE,CAAC;QACT,IAAI,CAAC,YAAY,iBAAiB,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB;YAAE,SAAS,GAAG,OAAO,CAAC;;YACrF,SAAS,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;IACpE,CAAC;IAED,4EAA4E;IAC5E,8DAA8D;IAC9D,IAAI,YAAY,GAAG,eAAe,CAAC;IACnC,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,CAAC;QAAC,YAAY,GAAG,MAAM,kBAAkB,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;IACxE,OAAO,CAAC,EAAE,CAAC;QAAC,YAAY,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QAAC,kBAAkB,GAAG,IAAI,CAAC;IAAC,CAAC;IAEzG,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAEjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CACtG,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,uEAAuE;AACvE,gFAAgF;AAChF,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AACD,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AACA;mDACmD;AAEnD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EACL,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,2BAA2B,EAC3B,kBAAkB,EAClB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,aAAa,GAGd,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAqB,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAG7D,+EAA+E;AAC/E,oBAAoB;AACpB,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAOjC,MAAM,KAAK,GACT,kFAAkF;IAClF,wGAAwG,CAAC;AAE3G,SAAS,GAAG,CAAC,GAAW,IAAW,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhF,SAAS,SAAS,CAAC,IAAc;IAI/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO;QAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,QAAQ,GAAG,EAAE,EAAE,QAAQ,GAAG,EAAE,EAAE,MAAM,GAAG,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC;IAC9D,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,2BAA2B,CAAC,CAAC;QAAC,CAAC;aAC5E,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,2BAA2B,CAAC,CAAC;QAAC,CAAC;aACjF,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC;QAAC,CAAC;aACxC,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAAC,CAAC;QAC1F,2EAA2E;QAC3E,2EAA2E;QAC3E,2DAA2D;aACtD,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,8BAA8B,CAAC,CAAC,CAAC;QAAC,CAAC;QACxF,4EAA4E;QAC5E,8EAA8E;aACzE,IAAI,CAAC,KAAK,qBAAqB,EAAE,CAAC;YAAC,gBAAgB,GAAG,IAAI,CAAC;QAAC,CAAC;aAC7D,IAAI,CAAC,KAAK,4BAA4B,EAAE,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,+CAA+C,CAAC,CAAC,CAAC;QAClF,CAAC;aACI,IAAI,CAAC,KAAK,mBAAmB,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,sCAAsC,CAAC,CAAC,CAAC;QAAC,CAAC;;YACzG,GAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;QAAE,GAAG,CAAC,wCAAwC,CAAC,CAAC;IAC1E,4EAA4E;IAC5E,+CAA+C;IAC/C,IAAI,gBAAgB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,gFAAgF,CAAC,CAAC;IACxF,CAAC;IACD,6EAA6E;IAC7E,yEAAyE;IACzE,IAAI,CAAC,gBAAgB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,GAAG,CACD,kFAAkF;YAChF,yDAAyD,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAE,CAAW,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GACV,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;;;gCAQgC;AAChC,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EAAE,GAAuC;IAEvD,MAAM,KAAK,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACjH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;gEAKgE;AAChE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAY;IACzC,IAAI,OAAmB,CAAC;IACxB,IAAI,OAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC5E,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;QACnB,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,8BAA8B;QAC9B,OAAO,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAE,CAAW,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,kBAAkB;QAClB,IAAI,CAAC,CAAC,UAAU,KAAK,aAAa,IAAI,CAAC,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACvE,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,GAAG,8DAA8D,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,GAAkB,CAAC;QACvB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE;gBACrD,SAAS,EAAE,CAAC,CAAC,UAAU;gBACvB,SAAS,EAAE,CAAC,CAAC,UAAU;gBACvB,QAAQ,EAAE,CAAC,CAAC,SAAS,IAAI,SAAS;gBAClC,eAAe,EAAE,CAAC,CAAC,gBAAgB,IAAI,SAAS;aACjD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,uBAAwB,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QACzD,CAAC;QACD,6EAA6E;QAC7E,4EAA4E;QAC5E,oDAAoD;QACpD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC;YACrD,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,uCAAuC,GAAG,CAAC,KAAK,KAAK,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;YACnE,GAAG,CAAC,4CAA4C,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;QACjE,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;;;;;4EAiB4E;AAC5E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc,EAAE,MAAc;IACvE,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,oBAAoB,MAAM,SAAS,CAAC;IAC7E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;IACjF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC;YACH,OAAO,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;sEACsE;AACtE,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE,CAAC;AACjC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAEvC;;0DAE0D;AAC1D,KAAK,UAAU,UAAU,CAAC,GAAa;IACrC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,SAAS,CAAC;QACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;QACtB,IAAI,KAAK,GAAG,gBAAgB,EAAE,CAAC;YAC7B,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,+BAA+B,gBAAgB,QAAQ,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClB,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;iFAQiF;AACjF,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC;AAE1F;;;;;;;uCAOuC;AACvC,MAAM,OAAO,GAAG,SAAS,CAAC;AAE1B;;;;;;;;;;0DAU0D;AAC1D,MAAM,UAAU,WAAW,CACzB,SAAiB,EAAE,kBAA2B,EAAE,MAAqB;IAErE,IAAI,MAAM,EAAE,OAAO,KAAK,mBAAmB;QAAE,OAAO,KAAK,CAAC;IAC1D,OAAO,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,kBAAkB,CAAC;AAC/D,CAAC;AAED;;;+DAG+D;AAC/D,MAAM,iBAAiB,GAA2B;IAChD,wBAAwB,EACtB,yEAAyE;QACzE,8DAA8D;IAChE,2BAA2B,EACzB,gEAAgE;QAChE,sCAAsC;CACzC,CAAC;AAEF;;;;;;;;mEAQmE;AACnE,MAAM,0BAA0B,GAC9B,qEAAqE;IACrE,yDAAyD,CAAC;AAC5D,MAAM,yBAAyB,GAC7B,mEAAmE;IACnE,uFAAuF,CAAC;AAE1F;;;;;;;;;;;;;GAaG;AACH,MAAM,sBAAsB,GAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAErG,SAAS,0BAA0B,CAAC,OAAe;IACjD,OAAO,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,qFAAqF;AACrF,MAAM,oBAAoB,GACxB,mEAAmE;IACnE,sEAAsE,CAAC;AAEzE;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,CAAW,EAAE,GAA8B;IACnE,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,CAAC,CAAC,cAAwB,CAAC;QAC5C,CAAC,CAAC,IAAI,CACJ,cAAc,CAAC,CAAC,WAAqB,MAAM,QAAQ,mBAAmB;YACpE,GAAG,CAAC,CAAC,cAAwB,iBAAiB;YAC9C,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,CAC/C,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,wBAAwB,CAAC,CAAW,EAAE,IAA6B;IAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,0BAAoC,CAAC;IAC1D,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1E,CAAC,CAAC,IAAI,CACJ,sCAAsC,OAAO,uBAAuB;YAClE,4BAA4B,CAC/B,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,qBAAqB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,KAAK,MAAM,GAAG,IAAK,IAAI,CAAC,OAAqC,IAAI,EAAE,EAAE,CAAC;QACpE,MAAM,IAAI,GAAG,GAAG,CAAC,WAAqB,CAAC;QACvC,IAAI,GAAG,CAAC,aAAa,KAAK,WAAW,EAAE,CAAC;YACtC,CAAC,CAAC,IAAI,CAAC,mBAAmB,IAAI,sBAAsB,GAAG,CAAC,eAAyB,MAAM,SAAS,EAAE,CAAC,CAAC;QACtG,CAAC;aAAM,IAAI,GAAG,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YACxC,CAAC,CAAC,IAAI,CACJ,mBAAmB,IAAI,sDAAsD;gBAC3E,iCAAiC,CACpC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,uEAAuE;YACvE,wEAAwE;YACxE,iCAAiC;YACjC,CAAC,CAAC,IAAI,CACJ,mBAAmB,IAAI,kBAAkB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,GAAG;gBACnF,kCAAkC,CACrC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACxF,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,OAAQ,CAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,IAAU,EAAE,SAAiB,EAAE,YAAoB,EAAE,kBAA2B,EAChF,MAAmC,EAAE,MAAe,EAAE,MAAqB,EAC3E,OAAyB;IAEzB,4EAA4E;IAC5E,oDAAoD;IACpD,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjG,MAAM,GAAG,GAAG,IAAI,CAAC,WAAsC,CAAC;IACxD,MAAM,CAAC,GAAa,EAAE,CAAC;IAEvB,0EAA0E;IAC1E,8EAA8E;IAC9E,2EAA2E;IAC3E,6EAA6E;IAC7E,+DAA+D;IAC/D,+DAA+D;IAC/D,IAAI,MAAM,EAAE,OAAO,KAAK,mBAAmB,EAAE,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,qCAAqC,CAAC,CAAC;QAC1E,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7B,CAAC,CAAC,IAAI,CAAC,wCAAwC,SAAS,6CAA6C,CAAC,CAAC;QACvG,qBAAqB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACjC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED,4EAA4E;IAC5E,gEAAgE;IAChE,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QAC1B,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,qBAAqB,CAAC,CAAC;QAC1D,wBAAwB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAClC,qBAAqB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACjC,kBAAkB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9B,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC1D,OAAO,0BAA0B,EAAE,cAAc,SAAS,KAAK,CAAC;IAClE,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,4BAA4B;IAC5B,IAAI,kBAAkB;QAAE,OAAO,0BAA0B,EAAE,4BAA4B,YAAY,KAAK,CAAC;IACzG,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,oDAAoD;IACpD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,SAAS,KAAK,IAAI,GAAG,CAAC,CAAC;QAC/D,wBAAwB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,qCAAqC;IACrC,MAAM,GAAG,GAAG,SAAS,KAAK,wBAAwB;QAChD,CAAC,CAAC,GAAG,wBAAwB,KAAK,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,0BAA0B,GAAG;QACpG,CAAC,CAAC,4DAA4D,CAAC;IACjE,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,WAAW,CAAE,IAAI,CAAC,OAAmC,CAAC,eAAe,CAAC,CAAC;IACnF,CAAC,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,0BAAoC,EAAE,CAAC,CAAC;IAEzE,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,oEAAoE;IACpE,0CAA0C;IAC1C,MAAM,GAAG,GAAI,IAAI,CAAC,OAAqC,IAAI,EAAE,CAAC;IAC9D,CAAC,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3G,CAAC,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAI,CAAC,CAAC,cAAyB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC,CAAC,IAAI,CAAC,oBAAoB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAI,CAAC,CAAC,cAAyB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACxF,gBAAgB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzB,CAAC,CAAC,IAAI,CAAC,gBAAgB,GAAG,CAAC,WAAqB,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAqB,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAEV,wEAAwE;IACxE,8EAA8E;IAC9E,yCAAyC;IACzC,EAAE;IACF,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,MAAM,GAAG,IAAI,CAAC,MAA6C,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,EAAE,YAAY,CAAC;IAClC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,0BAAoC,CAAC;QAC1D,IAAI,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC,2DAA2D,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,IAAI,CACJ,2BAA2B,OAAO,wCAAwC;gBACxE,uCAAuC,IAAI,EAAE,CAChD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,wBAAwB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAElC,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,IAAI,CAAC,YAAuC,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,WAAqB,yBAAyB,CAAC,CAAC;IACzF,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,uBAAuB,YAAY,KAAK,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,qBAAqB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACjC,kBAAkB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9B,mBAAmB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAC7B,CAAC;AAED;;;;;;;;+EAQ+E;AAC/E,SAAS,mBAAmB,CAAC,CAAW,EAAE,CAA8B;IACtE,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO;IAC5B,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACf,CAAC,CAAC,IAAI,CAAC,mEAAmE;YACxE,qEAAqE,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QAChC,CAAC,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YACjB,wEAAwE;YACxE,sEAAsE;YACtE,sDAAsD;YACtD,CAAC,CAAC,IAAI,CAAC,gEAAgE;gBACrE,2EAA2E,CAAC,CAAC;QACjF,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QAChC,CAAC,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC,SAAS,KAAK;YACrF,uDAAuD,CAAC,CAAC;QAC3D,OAAO;IACT,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC,MAAM,MAAM;QACzE,6CAA6C,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;+CAM+C;AAC/C,SAAS,kBAAkB,CAAC,CAAW,EAAE,MAAgC;IACvE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,CAAC,CAAC,IAAI,CAAC,2BAA2B,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;;;0DAS0D;AAC1D,SAAS,qBAAqB,CAAC,CAAW,EAAE,MAAmC;IAC7E,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,CAAC,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;IAClF,CAAC,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,IAAI,CAAC,sBAAsB,eAAe,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM;QAC5E,GAAG,eAAe,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACrD,8EAA8E;IAC9E,4EAA4E;IAC5E,gEAAgE;IAChE,CAAC,CAAC,IAAI,CAAC,sCAAsC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;QAC3E,QAAQ,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,UAAU,IAAI,IAAI;QAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC7F,IAAI,MAAM,CAAC,0BAA0B,IAAI,IAAI,EAAE,CAAC;QAC9C,CAAC,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,MAAM,CAAC,oBAAoB,IAAI,IAAI,EAAE,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED;mEACmE;AACnE,MAAM,UAAU,iBAAiB,CAAC,MAAY;IAC5C,IAAI,IAAI,GAAG,MAAM,CAAC;IAClB,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,IAAI,GAAG,IAAI,CAAC,IAAY,CAAC;IAClF,IACE,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;QAChE,IAAI,CAAC,WAAoB,CAAC,MAAM,KAAK,SAAS,EAC/C,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,WAAmB,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3E,0EAA0E;IAC1E,uCAAuC;IACvC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,uBAAuB,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAc,CAAC,CAAC;IAC/C,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAExD,8EAA8E;IAC9E,8DAA8D;IAC9D,wDAAwD;IACxD,2EAA2E;IAC3E,8EAA8E;IAC9E,6CAA6C;IAC7C,IAAI,MAAmC,CAAC;IACxC,IAAI,MAAgC,CAAC;IACrC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,cAAwB,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,0EAA0E;YAC1E,yEAAyE;YACzE,mEAAmE;YACnE,mDAAmD;YACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iDAAiD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAChG,CAAC;QACJ,CAAC;QACD,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,SAAS;QACT,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAgB,CAAC,CAAC;YAC9C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,wEAAwE;IACxE,8EAA8E;IAC9E,mDAAmD;IACnD,EAAE;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,kEAAkE;IAClE,IAAI,SAAS,GAAG,OAAO,CAAC;IACxB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,2BAA2B,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,IAAI,IAAI,EAAE,SAAS,EAAE;YAC/F,oBAAoB,EAAE,IAAI,CAAC,MAAM;SAClC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,EAAE,CAAC;QACT,IAAI,CAAC,CAAC,CAAC,YAAY,iBAAiB,CAAC;YAAE,MAAM,CAAC,CAAC;QAC/C,SAAS,GAAG,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACnE,CAAC;IAED,4EAA4E;IAC5E,8DAA8D;IAC9D,IAAI,YAAY,GAAG,eAAe,CAAC;IACnC,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,CAAC;QAAC,YAAY,GAAG,MAAM,kBAAkB,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;IACxE,OAAO,CAAC,EAAE,CAAC;QACT,IAAI,CAAC,CAAC,CAAC,YAAY,iBAAiB,CAAC;YAAE,MAAM,CAAC,CAAC;QAC/C,YAAY,GAAG,CAAC,CAAC,OAAO,CAAC;QACzB,kBAAkB,GAAG,IAAI,CAAC;IAC5B,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAEjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CACtG,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,uEAAuE;AACvE,gFAAgF;AAChF,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AACD,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/esm/client.d.ts

@@ -4,7 +4,12 @@
  * Pagination uses AsyncIterable<T> via Paginator.
  */
 import type { ApiKeyListItem, ApiKeyResponse, Attestation, BatchAttestationResponse, BatchRevokeResponse, CertificateResponse, CertificateStats, ConsistencyProof, InclusionProof, LogEntry, Profile, RevocationStatus, SignedTreeHead, System, SystemHealth, VerifyResult, Webhook, WebhookDelivery, WebhookRotateResponse } from "./models.js";
+import type { KeyEnrollmentResult, SystemRegistrationCertificate } from "./models.js";
 import { Paginator } from "./pagination.js";
+import type { CustomerKeyGroup } from "./customer-keys.js";
+import type { EnclavePinOptions, RegisteredSystem } from "./enclave-registration.js";
+import type { EnclaveIdentity } from "./enclave-seal.js";
+import type { KeyGroupSigner } from "./key-group.js";
 export interface BurnLedgerOptions {
     apiKey: string;
     baseUrl?: string;
@@ -33,6 +38,13 @@ export declare class BurnLedger {
         connectionConfig?: Record<string, unknown>;
         dsn?: string;
         uri?: string;
+        /**
+         * The connection config already sealed to the enclave — by
+         * sealConnectionConfig, or by createRegisteredSystem, which does it for you.
+         * The API relays these bytes and cannot open them. Instead of
+         * connectionConfig/dsn/uri, never beside them.
+         */
+        sealedConnectionConfig?: Uint8Array;
         subjectQuery: string;
         hashScope?: string;
         /** The system holds data you treat as PHI. Makes the default proof mode
@@ -125,6 +137,89 @@ export declare class BurnLedger {
         email: string;
     }): Promise<Profile>;
     deleteMe(): Promise<void>;
+    /**
+     * Verify the enclave: `GET /v1/enclave/attestation` over a 32-byte challenge
+     * drawn here (or `pin.nonce`), checked against the PCR0 you pinned out of band.
+     * Returns the keys the document binds. Throws EnclaveAttestationError on
+     * anything short of a document from the pinned image answering this challenge.
+     * Pass the result as `enclave` to the calls below: configs are sealed to it,
+     * and every document they return must verify under its signing key.
+     */
+    attestEnclaveIdentity(pin: EnclavePinOptions): Promise<EnclaveIdentity>;
+    /**
+     * Enrol a key group for your team (ENROLL_KEY). Every member signs; the private
+     * keys stay with the signers. `notAfter` is the latest the authorization may
+     * end, signed by every member so a relayed copy of this request cannot renew
+     * it; it defaults to the enclave's 90-day maximum. Throws VerificationError
+     * unless both documents that come back verify under `enclave`'s signing key,
+     * name exactly this group — ADR-025 §2's one comparison — and your team, end
+     * exactly at `notAfter` and do not start after `now` (this machine's clock by default).
+     */
+    enrollKeyGroup(opts: {
+        teamId: string;
+        group: CustomerKeyGroup;
+        signers: readonly KeyGroupSigner[];
+        enclave: EnclaveIdentity;
+        notAfter?: Date;
+        /** The time to judge the answer's not_before against. Defaults to now. */
+        now?: Date;
+    }): Promise<KeyEnrollmentResult>;
+    /**
+     * Replace an enrolled group with another (ROTATE_KEY). The OUTGOING group
+     * signs at its threshold and EVERY incoming member signs, over the same
+     * request and `notAfter`. Systems registered under the old group keep working
+     * through the link this issues; nothing is re-registered. The answer is checked
+     * as `enrollKeyGroup`'s is, and must also link to the outgoing group.
+     */
+    rotateKeyGroup(opts: {
+        teamId: string;
+        previousGroup: CustomerKeyGroup;
+        previousSigners: readonly KeyGroupSigner[];
+        nextGroup: CustomerKeyGroup;
+        nextSigners: readonly KeyGroupSigner[];
+        enclave: EnclaveIdentity;
+        notAfter?: Date;
+        /** The time to judge the answer's not_before against. Defaults to now. */
+        now?: Date;
+    }): Promise<KeyEnrollmentResult>;
+    /**
+     * Register an existing system under your key group (REGISTER_SYSTEM), signed at
+     * the group's threshold. `config` must be the exact bytes submitted when the
+     * system was created, and `queryTemplate` the system's subject query exactly.
+     * The registration that comes back must verify under `enclave`'s signing key.
+     */
+    registerSystemWithKey(opts: {
+        teamId: string;
+        group: CustomerKeyGroup;
+        signers: readonly KeyGroupSigner[];
+        enclave: EnclaveIdentity;
+        systemId: string;
+        config: Uint8Array | string;
+        queryTemplate: string;
+        connectorType: string;
+    }): Promise<SystemRegistrationCertificate>;
+    /**
+     * ADR-025's whole customer path for a new system: seal the config to `enclave`
+     * (from {@link attestEnclaveIdentity}), create the system with only the sealed
+     * bytes, and register it under your key group.
+     */
+    createRegisteredSystem(opts: {
+        teamId: string;
+        group: CustomerKeyGroup;
+        signers: readonly KeyGroupSigner[];
+        enclave: EnclaveIdentity;
+        name: string;
+        connectorType: string;
+        connectionConfig?: Record<string, unknown>;
+        dsn?: string;
+        uri?: string;
+        subjectQuery: string;
+        hashScope?: string;
+        phiInScope?: boolean;
+        maxRecords?: number;
+        maxBytes?: number;
+        queryTimeout?: string;
+    }): Promise<RegisteredSystem>;
     getSystemHealth(systemId: string): Promise<SystemHealth>;
     getLogHead(): Promise<SignedTreeHead>;
     getLogEntry(index: number): Promise<LogEntry>;