{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/crypto/env.ts","../src/crypto/encoding.ts","../src/jwe/plaintext.ts","../src/jwe/encrypt.ts","../src/encryptBuyerTeeSessionMaterial.ts","../src/attestation/certChain.ts","../src/trust/awsNitroRoot.ts","../src/crypto/cbor.ts","../src/attestation/coseSign1.ts","../src/trust/pcr8.ts","../src/attestation/fetch.ts","../src/attestation/nonce.ts","../src/attestation/payloadFields.ts","../src/trust/pins.ts","../src/trust/resolveExpectedPcr8.ts","../src/fetchAndVerifyAttestation.ts","../src/createEncryptedBuyerTeeSessionMaterial.ts","../src/encryptDisputeSessionMaterial.ts","../src/createEncryptedDisputeSessionMaterial.ts","../src/encryptIdentitySessionMaterial.ts","../src/createEncryptedIdentitySessionMaterial.ts","../src/encryptSellerCredentialUpload.ts","../src/createEncryptedSellerCredentialUpload.ts","../src/identityCallerAddress.ts","../src/serviceResponse.ts","../src/requestIdentityAttestation.ts","../src/uploadSellerCredential.ts","../src/verifyBuyerTeePayment.ts","../src/verifyDispute.ts","../src/client.ts","../src/eip712.ts","../src/verifyBuyerTeePaymentAttestation.ts","../src/verifyDisputeAttestation.ts","../src/verifyIdentityAttestation.ts","../src/verifySellerCredentialBundle.ts"],"sourcesContent":["export { createNitroAttestationClient } from \"./client\";\nexport { createEncryptedBuyerTeeSessionMaterial } from \"./createEncryptedBuyerTeeSessionMaterial\";\nexport { createEncryptedDisputeSessionMaterial } from \"./createEncryptedDisputeSessionMaterial\";\nexport { createEncryptedIdentitySessionMaterial } from \"./createEncryptedIdentitySessionMaterial\";\nexport { createEncryptedSellerCredentialUpload } from \"./createEncryptedSellerCredentialUpload\";\nexport { getDisputeVerifierDomainSeparator, getUnifiedPaymentVerifierDomainSeparator, hashUtf8 } from \"./eip712\";\nexport { encryptBuyerTeeSessionMaterial } from \"./encryptBuyerTeeSessionMaterial\";\nexport { encryptDisputeSessionMaterial } from \"./encryptDisputeSessionMaterial\";\nexport { encryptIdentitySessionMaterial } from \"./encryptIdentitySessionMaterial\";\nexport { encryptSellerCredentialUpload } from \"./encryptSellerCredentialUpload\";\nexport type { NitroAttestationErrorCode, NitroServiceResponseErrorDetails } from \"./errors\";\nexport { NitroAttestationError } from \"./errors\";\nexport { fetchAndVerifyAttestation } from \"./fetchAndVerifyAttestation\";\nexport { requestIdentityAttestation } from \"./requestIdentityAttestation\";\nexport { AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX, AWS_NITRO_ROOT_PEM } from \"./trust/awsNitroRoot\";\nexport type * from \"./types\";\nexport { uploadSellerCredential } from \"./uploadSellerCredential\";\nexport { verifyBuyerTeePayment } from \"./verifyBuyerTeePayment\";\nexport { verifyBuyerTeePaymentAttestation } from \"./verifyBuyerTeePaymentAttestation\";\nexport { verifyDispute } from \"./verifyDispute\";\nexport { verifyDisputeAttestation } from \"./verifyDisputeAttestation\";\nexport { verifyIdentityAttestation } from \"./verifyIdentityAttestation\";\nexport { verifySellerCredentialBundle } from \"./verifySellerCredentialBundle\";\nexport type { NitroAttestationWarning } from \"./warnings\";\n","export type NitroAttestationErrorCode =\n  | \"ATTESTATION_FETCH_FAILED\"\n  | \"ATTESTATION_RESPONSE_INVALID\"\n  | \"SERVICE_RESPONSE_ERROR\"\n  | \"ATTESTATION_NONCE_MISMATCH\"\n  | \"COSE_STRUCTURE_INVALID\"\n  | \"COSE_ALG_UNSUPPORTED\"\n  | \"COSE_SIGNATURE_INVALID_SIZE\"\n  | \"PAYLOAD_FIELD_MISSING\"\n  | \"NONCE_BINDING_FAILED\"\n  | \"FRESHNESS_CHECK_FAILED\"\n  | \"CERT_CHAIN_INVALID\"\n  | \"CERT_NOT_TIME_VALID\"\n  | \"AWS_ROOT_FINGERPRINT_MISMATCH\"\n  | \"COSE_SIGNATURE_VERIFY_FAILED\"\n  | \"PCR8_PIN_MISMATCH\"\n  | \"TRUST_PIN_REQUIRED\"\n  | \"SIGNER_NOT_TRUSTED\"\n  | \"ATTESTATION_SIGNATURE_INVALID\"\n  | \"ATTESTATION_BINDING_MISMATCH\"\n  | \"ATTESTATION_EXPIRED\"\n  | \"INVALID_PARAMETER\"\n  | \"TIMEOUT\"\n  | \"CRYPTO_UNAVAILABLE\";\n\nexport interface NitroServiceResponseErrorDetails extends Record<string, unknown> {\n  status: number;\n  statusCode?: number;\n  message?: string;\n  responseObject?: unknown;\n}\n\nexport class NitroAttestationError extends Error {\n  readonly code: NitroAttestationErrorCode;\n  override readonly cause?: unknown;\n  readonly details?: Record<string, unknown>;\n\n  constructor(\n    code: NitroAttestationErrorCode,\n    message: string,\n    options: { cause?: unknown; details?: Record<string, unknown> } = {},\n  ) {\n    super(message);\n    this.name = \"NitroAttestationError\";\n    this.code = code;\n    this.cause = options.cause;\n    this.details = options.details;\n  }\n}\n\nexport function fail(\n  code: NitroAttestationErrorCode,\n  message: string,\n  options?: { cause?: unknown; details?: Record<string, unknown> },\n): never {\n  throw new NitroAttestationError(code, message, options);\n}\n\nexport async function wrapCryptoFailure<T>(\n  promise: Promise<T>,\n  code: NitroAttestationErrorCode,\n  message: string,\n): Promise<T> {\n  try {\n    return await promise;\n  } catch (cause) {\n    fail(code, message, { cause });\n  }\n}\n","import { fail } from \"../errors\";\n\nexport interface CryptoProviderParts {\n  subtle: SubtleCrypto;\n  getRandomValues: (out: Uint8Array) => Uint8Array;\n}\n\nexport function resolveFetch(fetchOverride?: typeof fetch): typeof fetch {\n  if (fetchOverride !== undefined) {\n    if (typeof fetchOverride !== \"function\") {\n      fail(\"CRYPTO_UNAVAILABLE\", \"fetch is unavailable; pass a fetch implementation\");\n    }\n    return fetchOverride;\n  }\n\n  if (typeof globalThis.fetch !== \"function\") {\n    fail(\"CRYPTO_UNAVAILABLE\", \"fetch is unavailable; pass a fetch implementation\");\n  }\n  return globalThis.fetch.bind(globalThis);\n}\n\nexport function resolveSubtle(subtleOverride?: SubtleCrypto): SubtleCrypto {\n  const subtle = subtleOverride ?? globalThis.crypto?.subtle;\n  if (!subtle) {\n    fail(\"CRYPTO_UNAVAILABLE\", \"SubtleCrypto is unavailable; pass params.subtle\");\n  }\n  return subtle;\n}\n\nexport function resolveGetRandomValues(\n  getRandomValuesOverride?: (out: Uint8Array) => Uint8Array,\n): (out: Uint8Array) => Uint8Array {\n  if (getRandomValuesOverride) {\n    return getRandomValuesOverride;\n  }\n\n  const cryptoRef = globalThis.crypto;\n  if (typeof cryptoRef?.getRandomValues !== \"function\") {\n    fail(\"CRYPTO_UNAVAILABLE\", \"crypto.getRandomValues is unavailable; pass params.getRandomValues\");\n  }\n  return (out: Uint8Array) => cryptoRef.getRandomValues(out);\n}\n\nexport function resolveCryptoProvider(params: {\n  subtle?: SubtleCrypto;\n  getRandomValues?: (out: Uint8Array) => Uint8Array;\n}): CryptoProviderParts {\n  return {\n    subtle: resolveSubtle(params.subtle),\n    getRandomValues: resolveGetRandomValues(params.getRandomValues),\n  };\n}\n\nexport function asCrypto(subtle: SubtleCrypto, getRandomValues: (out: Uint8Array) => Uint8Array): Crypto {\n  if (typeof getRandomValues !== \"function\") {\n    fail(\"CRYPTO_UNAVAILABLE\", \"crypto.getRandomValues is unavailable; pass params.getRandomValues\");\n  }\n  return {\n    subtle,\n    getRandomValues,\n    randomUUID: () => randomUuidV4(getRandomValues),\n  } as Crypto;\n}\n\nfunction randomUuidV4(\n  getRandomValues: (out: Uint8Array) => Uint8Array,\n): `${string}-${string}-${string}-${string}-${string}` {\n  const bytes = getRandomValues(new Uint8Array(16));\n  bytes[6] = (bytes[6] & 0x0f) | 0x40;\n  bytes[8] = (bytes[8] & 0x3f) | 0x80;\n  const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, \"0\"));\n  return `${hex.slice(0, 4).join(\"\")}-${hex.slice(4, 6).join(\"\")}-${hex.slice(6, 8).join(\"\")}-${hex\n    .slice(8, 10)\n    .join(\"\")}-${hex.slice(10).join(\"\")}`;\n}\n","const BASE64_ALPHABET = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";\nconst BASE64_LOOKUP = buildLookup(BASE64_ALPHABET);\n\nfunction buildLookup(alphabet: string): Record<string, number> {\n  const lookup: Record<string, number> = {};\n  for (let index = 0; index < alphabet.length; index += 1) {\n    lookup[alphabet[index]] = index;\n  }\n  return lookup;\n}\n\nexport function bytesToHex(bytes: Uint8Array): string {\n  let out = \"\";\n  for (const byte of bytes) {\n    out += byte.toString(16).padStart(2, \"0\");\n  }\n  return out;\n}\n\nexport function normalizeHex(value: string): string {\n  return value.replace(/^0x/i, \"\").toLowerCase();\n}\n\nexport function hexToBytes(hex: string): Uint8Array {\n  const normalized = normalizeHex(hex);\n  if (normalized.length % 2 !== 0 || !/^[0-9a-f]*$/.test(normalized)) {\n    throw new Error(`Invalid hex string: ${hex}`);\n  }\n\n  const bytes = new Uint8Array(normalized.length / 2);\n  for (let index = 0; index < bytes.length; index += 1) {\n    bytes[index] = Number.parseInt(normalized.slice(index * 2, index * 2 + 2), 16);\n  }\n  return bytes;\n}\n\nexport function utf8Encode(value: string): Uint8Array {\n  if (typeof TextEncoder !== \"undefined\") {\n    return new TextEncoder().encode(value);\n  }\n\n  const bytes: number[] = [];\n  for (let index = 0; index < value.length; index += 1) {\n    const codePoint = value.codePointAt(index) as number;\n    if (codePoint > 0xffff) {\n      index += 1;\n    }\n    if (codePoint <= 0x7f) {\n      bytes.push(codePoint);\n    } else if (codePoint <= 0x7ff) {\n      bytes.push(0xc0 | (codePoint >> 6), 0x80 | (codePoint & 0x3f));\n    } else if (codePoint <= 0xffff) {\n      bytes.push(0xe0 | (codePoint >> 12), 0x80 | ((codePoint >> 6) & 0x3f), 0x80 | (codePoint & 0x3f));\n    } else {\n      bytes.push(\n        0xf0 | (codePoint >> 18),\n        0x80 | ((codePoint >> 12) & 0x3f),\n        0x80 | ((codePoint >> 6) & 0x3f),\n        0x80 | (codePoint & 0x3f),\n      );\n    }\n  }\n  return new Uint8Array(bytes);\n}\n\nexport function utf8Decode(bytes: Uint8Array): string {\n  if (typeof TextDecoder !== \"undefined\") {\n    return new TextDecoder().decode(bytes);\n  }\n\n  let out = \"\";\n  for (let index = 0; index < bytes.length; index += 1) {\n    const first = bytes[index];\n    if (first < 0x80) {\n      out += String.fromCodePoint(first);\n    } else if ((first & 0xe0) === 0xc0) {\n      out += String.fromCodePoint(((first & 0x1f) << 6) | (bytes[++index] & 0x3f));\n    } else if ((first & 0xf0) === 0xe0) {\n      out += String.fromCodePoint(((first & 0x0f) << 12) | ((bytes[++index] & 0x3f) << 6) | (bytes[++index] & 0x3f));\n    } else {\n      out += String.fromCodePoint(\n        ((first & 0x07) << 18) |\n          ((bytes[++index] & 0x3f) << 12) |\n          ((bytes[++index] & 0x3f) << 6) |\n          (bytes[++index] & 0x3f),\n      );\n    }\n  }\n  return out;\n}\n\nexport function base64Encode(bytes: Uint8Array): string {\n  let out = \"\";\n  for (let index = 0; index < bytes.length; index += 3) {\n    const first = bytes[index];\n    const second = bytes[index + 1] ?? 0;\n    const third = bytes[index + 2] ?? 0;\n    const triplet = (first << 16) | (second << 8) | third;\n\n    out += BASE64_ALPHABET[(triplet >> 18) & 0x3f];\n    out += BASE64_ALPHABET[(triplet >> 12) & 0x3f];\n    out += index + 1 < bytes.length ? BASE64_ALPHABET[(triplet >> 6) & 0x3f] : \"=\";\n    out += index + 2 < bytes.length ? BASE64_ALPHABET[triplet & 0x3f] : \"=\";\n  }\n  return out;\n}\n\nexport function base64Decode(value: string): Uint8Array {\n  return decodeBase64(value, false);\n}\n\nexport function base64UrlEncode(bytes: Uint8Array): string {\n  return base64Encode(bytes).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replace(/=+$/, \"\");\n}\n\nexport function base64UrlDecode(value: string): Uint8Array {\n  return decodeBase64(value, true);\n}\n\nfunction decodeBase64(value: string, urlSafe: boolean): Uint8Array {\n  const stripped = value.replace(/\\s+/g, \"\");\n  const normalized = urlSafe ? stripped.replaceAll(\"-\", \"+\").replaceAll(\"_\", \"/\") : stripped;\n  if (normalized.length % 4 === 1) {\n    throw new Error(\"Invalid base64 length\");\n  }\n  const padded = normalized + \"=\".repeat((4 - (normalized.length % 4)) % 4);\n\n  const bytes: number[] = [];\n  for (let index = 0; index < padded.length; index += 4) {\n    const chars = padded.slice(index, index + 4);\n    const pad = chars.endsWith(\"==\") ? 2 : chars.endsWith(\"=\") ? 1 : 0;\n    const a = lookupBase64(chars[0], BASE64_LOOKUP);\n    const b = lookupBase64(chars[1], BASE64_LOOKUP);\n    const c = chars[2] === \"=\" ? 0 : lookupBase64(chars[2], BASE64_LOOKUP);\n    const d = chars[3] === \"=\" ? 0 : lookupBase64(chars[3], BASE64_LOOKUP);\n    const triplet = (a << 18) | (b << 12) | (c << 6) | d;\n\n    bytes.push((triplet >> 16) & 0xff);\n    if (pad < 2) {\n      bytes.push((triplet >> 8) & 0xff);\n    }\n    if (pad < 1) {\n      bytes.push(triplet & 0xff);\n    }\n  }\n  return new Uint8Array(bytes);\n}\n\nfunction lookupBase64(char: string, lookup: Record<string, number>): number {\n  const value = lookup[char];\n  if (value === undefined) {\n    throw new Error(`Invalid base64 character: ${char}`);\n  }\n  return value;\n}\n\nexport function concatBytes(parts: Uint8Array[]): Uint8Array {\n  const total = parts.reduce((sum, part) => sum + part.length, 0);\n  const out = new Uint8Array(total);\n  let offset = 0;\n  for (const part of parts) {\n    out.set(part, offset);\n    offset += part.length;\n  }\n  return out;\n}\n\nexport function toUint8Array(value: ArrayBuffer | Uint8Array): Uint8Array {\n  return value instanceof Uint8Array ? value : new Uint8Array(value);\n}\n\nexport function bytesToArrayBuffer(bytes: Uint8Array): ArrayBuffer {\n  return new Uint8Array(bytes).buffer;\n}\n","import type { AttestedSellerUploadKey, SellerCredentialUploadPayload } from \"../types\";\n\nexport interface SellerCredentialUploadPlaintext {\n  payeeId?: string;\n  callerAddress?: string;\n  sessionMaterial: unknown;\n  boundPubKeySha256: string;\n  issuedAtMs: number;\n  jweId: string;\n}\n\nexport interface TeeSessionMaterialPlaintext {\n  platform: string;\n  actionType: string;\n  sessionMaterial: unknown;\n  boundPubKeySha256: string;\n}\n\nexport function buildSellerCredentialUploadPlaintext(\n  params: {\n    key: AttestedSellerUploadKey;\n    issuedAtMs: number;\n    jweId: string;\n  } & SellerCredentialUploadPayload,\n): SellerCredentialUploadPlaintext {\n  const plaintext = {\n    sessionMaterial: params.sessionMaterial,\n    ...(params.callerAddress !== undefined ? { callerAddress: params.callerAddress } : {}),\n    boundPubKeySha256: params.key.publicKeySha256Hex,\n    issuedAtMs: params.issuedAtMs,\n    jweId: params.jweId,\n  };\n\n  if (params.platform === \"wise\" || params.platform === \"monobank\") {\n    return plaintext;\n  }\n\n  return {\n    payeeId: params.payeeId,\n    ...plaintext,\n  };\n}\n\nexport function buildTeeSessionMaterialPlaintext(params: {\n  key: AttestedSellerUploadKey;\n  platform: string;\n  actionType: string;\n  sessionMaterial: unknown;\n}): TeeSessionMaterialPlaintext {\n  // Keep this wire shape in sync with src/common/nitroBridge/teeSessionUploadCipher.ts.\n  return {\n    platform: params.platform,\n    actionType: params.actionType,\n    sessionMaterial: params.sessionMaterial,\n    boundPubKeySha256: params.key.publicKeySha256Hex,\n  };\n}\n\nexport function stringifyUploadPlaintext(\n  plaintext: SellerCredentialUploadPlaintext | TeeSessionMaterialPlaintext,\n): string {\n  return JSON.stringify(plaintext);\n}\n","import { base64UrlEncode, bytesToArrayBuffer, utf8Encode } from \"../crypto/encoding\";\nimport { fail, wrapCryptoFailure } from \"../errors\";\nimport type {\n  AttestedSellerUploadKey,\n  BuyerTeeSessionMaterialPlatform,\n  DisputePlatform,\n  EncryptBuyerTeeSessionMaterialParamsFor,\n  EncryptDisputeSessionMaterialParamsFor,\n  EncryptIdentitySessionMaterialParamsFor,\n  EncryptSellerCredentialUploadParams,\n  IdentityRequestPlatform,\n} from \"../types\";\nimport {\n  buildSellerCredentialUploadPlaintext,\n  buildTeeSessionMaterialPlaintext,\n  stringifyUploadPlaintext,\n} from \"./plaintext\";\n\nconst JWE_PROTECTED_HEADER = { alg: \"RSA-OAEP-256\", enc: \"A256GCM\" } as const;\nconst JWE_ID_PATTERN = /^[A-Za-z0-9_-]{16,128}$/;\n\nexport async function encryptSellerCredentialUploadWithResolvedCrypto(params: {\n  request: EncryptSellerCredentialUploadParams;\n  subtle: SubtleCrypto;\n  getRandomValues: (out: Uint8Array) => Uint8Array;\n  now: () => number;\n}): Promise<string> {\n  const issuedAtMs = params.request.issuedAtMs ?? params.now();\n  const jweId = params.request.jweId ?? randomUuidV4(params.getRandomValues);\n  assertJweId(jweId);\n\n  return encryptKeyBoundPlaintextWithResolvedCrypto({\n    key: params.request.key,\n    plaintext: buildSellerCredentialUploadPlaintext({\n      ...params.request,\n      issuedAtMs,\n      jweId,\n    }),\n    subtle: params.subtle,\n    getRandomValues: params.getRandomValues,\n    failureContext: \"seller credential upload\",\n  });\n}\n\nexport async function encryptBuyerTeeSessionMaterialWithResolvedCrypto<\n  P extends BuyerTeeSessionMaterialPlatform,\n>(params: {\n  request: EncryptBuyerTeeSessionMaterialParamsFor<P>;\n  subtle: SubtleCrypto;\n  getRandomValues: (out: Uint8Array) => Uint8Array;\n}): Promise<string> {\n  return encryptTeeSessionMaterialWithResolvedCrypto({\n    ...params,\n    failureContext: \"buyer TEE session material\",\n  });\n}\n\nexport async function encryptIdentitySessionMaterialWithResolvedCrypto<P extends IdentityRequestPlatform>(params: {\n  request: EncryptIdentitySessionMaterialParamsFor<P>;\n  subtle: SubtleCrypto;\n  getRandomValues: (out: Uint8Array) => Uint8Array;\n}): Promise<string> {\n  return encryptTeeSessionMaterialWithResolvedCrypto({\n    ...params,\n    failureContext: \"identity session material\",\n  });\n}\n\nexport async function encryptDisputeSessionMaterialWithResolvedCrypto<P extends DisputePlatform>(params: {\n  request: EncryptDisputeSessionMaterialParamsFor<P>;\n  subtle: SubtleCrypto;\n  getRandomValues: (out: Uint8Array) => Uint8Array;\n}): Promise<string> {\n  return encryptTeeSessionMaterialWithResolvedCrypto({\n    ...params,\n    failureContext: \"dispute session material\",\n  });\n}\n\nasync function encryptTeeSessionMaterialWithResolvedCrypto(params: {\n  request: {\n    key: AttestedSellerUploadKey;\n    platform: string;\n    actionType: string;\n    sessionMaterial: unknown;\n  };\n  subtle: SubtleCrypto;\n  getRandomValues: (out: Uint8Array) => Uint8Array;\n  failureContext: string;\n}): Promise<string> {\n  return encryptKeyBoundPlaintextWithResolvedCrypto({\n    key: params.request.key,\n    plaintext: buildTeeSessionMaterialPlaintext(params.request),\n    subtle: params.subtle,\n    getRandomValues: params.getRandomValues,\n    failureContext: params.failureContext,\n  });\n}\n\nasync function encryptKeyBoundPlaintextWithResolvedCrypto(params: {\n  key: AttestedSellerUploadKey;\n  plaintext: Parameters<typeof stringifyUploadPlaintext>[0];\n  subtle: SubtleCrypto;\n  getRandomValues: (out: Uint8Array) => Uint8Array;\n  failureContext: string;\n}): Promise<string> {\n  const plaintext = utf8Encode(stringifyUploadPlaintext(params.plaintext));\n\n  const cek = params.getRandomValues(new Uint8Array(32));\n  const rsaKey = await wrapCryptoFailure(\n    params.subtle.importKey(\n      \"spki\",\n      bytesToArrayBuffer(params.key.publicKeyDer),\n      { name: \"RSA-OAEP\", hash: \"SHA-256\" },\n      false,\n      [\"encrypt\"],\n    ),\n    \"CRYPTO_UNAVAILABLE\",\n    \"Failed to import attested enclave-upload RSA public key\",\n  );\n  const encryptedKey = new Uint8Array(\n    await wrapCryptoFailure(\n      params.subtle.encrypt({ name: \"RSA-OAEP\" }, rsaKey, bytesToArrayBuffer(cek)),\n      \"CRYPTO_UNAVAILABLE\",\n      \"Failed to RSA-OAEP encrypt the content encryption key\",\n    ),\n  );\n\n  const iv = params.getRandomValues(new Uint8Array(12));\n  const protectedHeader = base64UrlEncode(utf8Encode(JSON.stringify(JWE_PROTECTED_HEADER)));\n  const aad = utf8Encode(protectedHeader);\n  const aesKey = await wrapCryptoFailure(\n    params.subtle.importKey(\"raw\", bytesToArrayBuffer(cek), { name: \"AES-GCM\", length: 256 }, false, [\"encrypt\"]),\n    \"CRYPTO_UNAVAILABLE\",\n    \"Failed to import generated AES-GCM content encryption key\",\n  );\n  const encryptedPlaintext = new Uint8Array(\n    await wrapCryptoFailure(\n      params.subtle.encrypt(\n        {\n          name: \"AES-GCM\",\n          iv: bytesToArrayBuffer(iv),\n          additionalData: bytesToArrayBuffer(aad),\n          tagLength: 128,\n        },\n        aesKey,\n        bytesToArrayBuffer(plaintext),\n      ),\n      \"CRYPTO_UNAVAILABLE\",\n      `Failed to AES-GCM encrypt ${params.failureContext}`,\n    ),\n  );\n  const ciphertext = encryptedPlaintext.slice(0, encryptedPlaintext.length - 16);\n  const tag = encryptedPlaintext.slice(encryptedPlaintext.length - 16);\n\n  return [\n    protectedHeader,\n    base64UrlEncode(encryptedKey),\n    base64UrlEncode(iv),\n    base64UrlEncode(ciphertext),\n    base64UrlEncode(tag),\n  ].join(\".\");\n}\n\n// Seller upload only — buyer TEE envelopes no longer carry a jweId.\nfunction assertJweId(jweId: string): void {\n  if (!JWE_ID_PATTERN.test(jweId)) {\n    fail(\"INVALID_PARAMETER\", \"jweId must be 16-128 URL-safe characters\");\n  }\n}\n\n// Seller upload only — buyer TEE envelopes no longer carry a jweId.\nfunction randomUuidV4(getRandomValues: (out: Uint8Array) => Uint8Array): string {\n  const bytes = getRandomValues(new Uint8Array(16));\n  bytes[6] = (bytes[6] & 0x0f) | 0x40;\n  bytes[8] = (bytes[8] & 0x3f) | 0x80;\n  const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, \"0\"));\n  return `${hex.slice(0, 4).join(\"\")}-${hex.slice(4, 6).join(\"\")}-${hex.slice(6, 8).join(\"\")}-${hex\n    .slice(8, 10)\n    .join(\"\")}-${hex.slice(10).join(\"\")}`;\n}\n","import { resolveCryptoProvider } from \"./crypto/env\";\nimport { encryptBuyerTeeSessionMaterialWithResolvedCrypto } from \"./jwe/encrypt\";\nimport type { BuyerTeeSessionMaterialPlatform, EncryptBuyerTeeSessionMaterialParamsFor } from \"./types\";\n\nexport async function encryptBuyerTeeSessionMaterial<P extends BuyerTeeSessionMaterialPlatform>(\n  params: EncryptBuyerTeeSessionMaterialParamsFor<P>,\n): Promise<string> {\n  const crypto = resolveCryptoProvider(params);\n  return encryptBuyerTeeSessionMaterialWithResolvedCrypto({\n    request: params,\n    subtle: crypto.subtle,\n    getRandomValues: crypto.getRandomValues,\n  });\n}\n","import { X509Certificate } from \"@peculiar/x509\";\nimport { bytesToHex } from \"../crypto/encoding\";\nimport { asCrypto } from \"../crypto/env\";\nimport { fail, wrapCryptoFailure } from \"../errors\";\nimport { AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX, AWS_NITRO_ROOT_PEM } from \"../trust/awsNitroRoot\";\nimport type { NitroAttestationWarning } from \"../warnings\";\n\nconst CERT_EXPIRY_WARNING_WINDOW_MS = 7 * 24 * 60 * 60 * 1000;\n\nexport interface VerifiedCertificateChain {\n  leafCertificate: X509Certificate;\n  leafPublicKey: CryptoKey;\n}\n\nexport async function verifyCertificateChain(params: {\n  leafCertificateDer: Uint8Array;\n  cabundleDer: Uint8Array[];\n  rootPem?: string;\n  nowMs: number;\n  subtle: SubtleCrypto;\n  getRandomValues: (out: Uint8Array) => Uint8Array;\n  onWarning?: (warning: NitroAttestationWarning) => void;\n}): Promise<VerifiedCertificateChain> {\n  const crypto = asCrypto(params.subtle, params.getRandomValues);\n  const rootCertificate = parseCertificate(params.rootPem ?? AWS_NITRO_ROOT_PEM, \"AWS Nitro root certificate\");\n  const rootFingerprint = await certificateSha256(rootCertificate, params.subtle);\n\n  if (rootFingerprint !== AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX) {\n    fail(\"AWS_ROOT_FINGERPRINT_MISMATCH\", \"Bundled AWS Nitro root certificate fingerprint mismatch\", {\n      details: { expected: AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX, actual: rootFingerprint },\n    });\n  }\n\n  const leafCertificate = parseCertificate(params.leafCertificateDer, \"attestation leaf certificate\");\n  const cabundle = params.cabundleDer.map((der, index) => parseCertificate(der, `cabundle[${index}]`));\n  const allCertificates = [rootCertificate, ...cabundle, leafCertificate];\n  for (const certificate of allCertificates) {\n    assertCertificateTimeValid(certificate, params.nowMs);\n    warnNearExpiry(certificate, params.nowMs, params.onWarning);\n  }\n\n  const leafFingerprint = await certificateSha256(leafCertificate, params.subtle);\n  const intermediates = [];\n  for (const certificate of cabundle) {\n    const fingerprint = await certificateSha256(certificate, params.subtle);\n    if (fingerprint !== leafFingerprint && fingerprint !== rootFingerprint) {\n      intermediates.push(certificate);\n    }\n  }\n\n  const candidates = [\n    [leafCertificate, ...intermediates.slice().reverse(), rootCertificate],\n    [leafCertificate, ...intermediates, rootCertificate],\n  ];\n\n  for (const candidate of candidates) {\n    if (await verifyChainLinks(candidate, crypto)) {\n      const leafPublicKey = await wrapCryptoFailure(\n        leafCertificate.publicKey.export({ name: \"ECDSA\", namedCurve: \"P-384\" }, [\"verify\"], crypto),\n        \"CERT_CHAIN_INVALID\",\n        \"Failed to export attestation leaf public key\",\n      );\n      return { leafCertificate, leafPublicKey };\n    }\n  }\n\n  fail(\"CERT_CHAIN_INVALID\", \"Attestation certificate chain does not verify to the pinned AWS Nitro root\");\n}\n\nasync function verifyChainLinks(chain: X509Certificate[], crypto: Crypto): Promise<boolean> {\n  for (let index = 0; index < chain.length - 1; index += 1) {\n    const subject = chain[index];\n    const issuer = chain[index + 1];\n    const ok = await subject.verify({ publicKey: issuer.publicKey, signatureOnly: true }, crypto);\n    if (!ok) {\n      return false;\n    }\n  }\n\n  return chain.length > 0 && (await chain[chain.length - 1].isSelfSigned(crypto));\n}\n\nfunction parseCertificate(raw: string | Uint8Array, label: string): X509Certificate {\n  try {\n    return new X509Certificate(raw);\n  } catch (cause) {\n    fail(\"CERT_CHAIN_INVALID\", `Could not parse ${label}`, { cause });\n  }\n}\n\nasync function certificateSha256(certificate: X509Certificate, subtle: SubtleCrypto): Promise<string> {\n  return bytesToHex(new Uint8Array(await subtle.digest(\"SHA-256\", certificate.rawData)));\n}\n\nfunction assertCertificateTimeValid(certificate: X509Certificate, nowMs: number): void {\n  if (nowMs < certificate.notBefore.getTime() || nowMs > certificate.notAfter.getTime()) {\n    fail(\"CERT_NOT_TIME_VALID\", \"Certificate is outside its validity window\", {\n      details: {\n        subject: certificate.subject,\n        notBefore: certificate.notBefore.toISOString(),\n        notAfter: certificate.notAfter.toISOString(),\n      },\n    });\n  }\n}\n\nfunction warnNearExpiry(\n  certificate: X509Certificate,\n  nowMs: number,\n  onWarning?: (warning: NitroAttestationWarning) => void,\n): void {\n  if (certificate.notAfter.getTime() < nowMs + CERT_EXPIRY_WARNING_WINDOW_MS) {\n    onWarning?.({\n      code: \"CERT_VALIDITY_NEAR_EXPIRY\",\n      message: \"Certificate in Nitro attestation chain expires within 7 days\",\n      details: {\n        subject: certificate.subject,\n        notAfter: certificate.notAfter.toISOString(),\n      },\n    });\n  }\n}\n","export const AWS_NITRO_ROOT_PEM = `-----BEGIN CERTIFICATE-----\nMIICETCCAZagAwIBAgIRAPkxdWgbkK/hHUbMtOTn+FYwCgYIKoZIzj0EAwMwSTEL\nMAkGA1UEBhMCVVMxDzANBgNVBAoMBkFtYXpvbjEMMAoGA1UECwwDQVdTMRswGQYD\nVQQDDBJhd3Mubml0cm8tZW5jbGF2ZXMwHhcNMTkxMDI4MTMyODA1WhcNNDkxMDI4\nMTQyODA1WjBJMQswCQYDVQQGEwJVUzEPMA0GA1UECgwGQW1hem9uMQwwCgYDVQQL\nDANBV1MxGzAZBgNVBAMMEmF3cy5uaXRyby1lbmNsYXZlczB2MBAGByqGSM49AgEG\nBSuBBAAiA2IABPwCVOumCMHzaHDimtqQvkY4MpJzbolL//Zy2YlES1BR5TSksfbb\n48C8WBoyt7F2Bw7eEtaaP+ohG2bnUs990d0JX28TcPQXCEPZ3BABIeTPYwEoCWZE\nh8l5YoQwTcU/9KNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUkCW1DdkF\nR+eWw5b6cp3PmanfS5YwDgYDVR0PAQH/BAQDAgGGMAoGCCqGSM49BAMDA2kAMGYC\nMQCjfy+Rocm9Xue4YnwWmNJVA44fA0P5W2OpYow9OYCVRaEevL8uO1XYru5xtMPW\nrfMCMQCi85sWBbJwKKXdS6BptQFuZbT73o/gBh1qUxl/nNr12UO8Yfwr6wPLb+6N\nIwLz3/Y=\n-----END CERTIFICATE-----\n`;\n\nexport const AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX = \"641a0321a3e244efe456463195d606317ed7cdcc3c1756e09893f3c68f79bb5b\";\n","import { concatBytes, utf8Decode, utf8Encode } from \"./encoding\";\n\nexport type CborValue =\n  | bigint\n  | number\n  | string\n  | Uint8Array\n  | CborValue[]\n  | Map<CborValue, CborValue>\n  | boolean\n  | null;\n\nexport function decodeCbor(bytes: Uint8Array): CborValue {\n  const reader = new CborReader(bytes);\n  const value = reader.readValue();\n  if (!reader.done()) {\n    throw new Error(\"Trailing CBOR bytes\");\n  }\n  return value;\n}\n\nexport function encodeCbor(value: CborValue): Uint8Array {\n  if (typeof value === \"number\") {\n    if (!Number.isSafeInteger(value)) {\n      throw new Error(\"CBOR number must be a safe integer\");\n    }\n    return value >= 0 ? encodeTypeAndLength(0, value) : encodeTypeAndLength(1, -1 - value);\n  }\n  if (typeof value === \"bigint\") {\n    return value >= 0n ? encodeTypeAndLength(0, value) : encodeTypeAndLength(1, -1n - value);\n  }\n  if (typeof value === \"string\") {\n    const encoded = utf8Encode(value);\n    return concatBytes([encodeTypeAndLength(3, encoded.length), encoded]);\n  }\n  if (value instanceof Uint8Array) {\n    return concatBytes([encodeTypeAndLength(2, value.length), value]);\n  }\n  if (Array.isArray(value)) {\n    return concatBytes([encodeTypeAndLength(4, value.length), ...value.map(encodeCbor)]);\n  }\n  if (value instanceof Map) {\n    // This minimal encoder preserves Map insertion order; callers that need canonical map ordering must sort first.\n    return concatBytes([\n      encodeTypeAndLength(5, value.size),\n      ...Array.from(value.entries()).flatMap(([k, v]) => [encodeCbor(k), encodeCbor(v)]),\n    ]);\n  }\n  if (typeof value === \"boolean\") {\n    return new Uint8Array([value ? 0xf5 : 0xf4]);\n  }\n  if (value === null) {\n    return new Uint8Array([0xf6]);\n  }\n  throw new Error(\"Unsupported CBOR value\");\n}\n\nexport function encodeCoseSigStructure1(protectedHeadersBytes: Uint8Array, payloadBytes: Uint8Array): Uint8Array {\n  return encodeCbor([\"Signature1\", protectedHeadersBytes, new Uint8Array(), payloadBytes]);\n}\n\nfunction encodeTypeAndLength(majorType: number, length: number | bigint): Uint8Array {\n  const bigintLength = BigInt(length);\n  if (bigintLength < 24n) {\n    return new Uint8Array([(majorType << 5) | Number(bigintLength)]);\n  }\n  if (bigintLength <= 0xffn) {\n    return new Uint8Array([(majorType << 5) | 24, Number(bigintLength)]);\n  }\n  if (bigintLength <= 0xffffn) {\n    return new Uint8Array([(majorType << 5) | 25, Number((bigintLength >> 8n) & 0xffn), Number(bigintLength & 0xffn)]);\n  }\n  if (bigintLength <= 0xffffffffn) {\n    return new Uint8Array([\n      (majorType << 5) | 26,\n      Number((bigintLength >> 24n) & 0xffn),\n      Number((bigintLength >> 16n) & 0xffn),\n      Number((bigintLength >> 8n) & 0xffn),\n      Number(bigintLength & 0xffn),\n    ]);\n  }\n\n  return new Uint8Array([\n    (majorType << 5) | 27,\n    Number((bigintLength >> 56n) & 0xffn),\n    Number((bigintLength >> 48n) & 0xffn),\n    Number((bigintLength >> 40n) & 0xffn),\n    Number((bigintLength >> 32n) & 0xffn),\n    Number((bigintLength >> 24n) & 0xffn),\n    Number((bigintLength >> 16n) & 0xffn),\n    Number((bigintLength >> 8n) & 0xffn),\n    Number(bigintLength & 0xffn),\n  ]);\n}\n\nclass CborReader {\n  private offset = 0;\n\n  constructor(private readonly bytes: Uint8Array) {}\n\n  done(): boolean {\n    return this.offset === this.bytes.length;\n  }\n\n  readValue(): CborValue {\n    const head = this.readByte();\n    const majorType = head >> 5;\n    const additional = head & 0x1f;\n\n    if (additional === 31) {\n      return this.readIndefiniteValue(majorType);\n    }\n\n    if (majorType === 0) {\n      return this.readLength(additional);\n    }\n    if (majorType === 1) {\n      const value = this.readLength(additional);\n      return typeof value === \"bigint\" ? -1n - value : -1 - value;\n    }\n    if (majorType === 2) {\n      const length = this.lengthAsNumber(this.readLength(additional));\n      return this.readBytes(length);\n    }\n    if (majorType === 3) {\n      const length = this.lengthAsNumber(this.readLength(additional));\n      return utf8Decode(this.readBytes(length));\n    }\n    if (majorType === 4) {\n      const length = this.lengthAsNumber(this.readLength(additional));\n      const out: CborValue[] = [];\n      for (let index = 0; index < length; index += 1) {\n        out.push(this.readValue());\n      }\n      return out;\n    }\n    if (majorType === 5) {\n      const length = this.lengthAsNumber(this.readLength(additional));\n      const out = new Map<CborValue, CborValue>();\n      for (let index = 0; index < length; index += 1) {\n        out.set(this.readValue(), this.readValue());\n      }\n      return out;\n    }\n    if (majorType === 6) {\n      this.readLength(additional);\n      return this.readValue();\n    }\n    if (majorType === 7) {\n      if (additional === 20) {\n        return false;\n      }\n      if (additional === 21) {\n        return true;\n      }\n      if (additional === 22) {\n        return null;\n      }\n    }\n    throw new Error(`Unsupported CBOR major/additional type: ${majorType}/${additional}`);\n  }\n\n  private readIndefiniteValue(majorType: number): CborValue {\n    if (majorType === 2) {\n      const chunks: Uint8Array[] = [];\n      while (!this.consumeBreak()) {\n        const chunk = this.readValue();\n        if (!(chunk instanceof Uint8Array)) {\n          throw new Error(\"Indefinite CBOR byte string chunk must be a byte string\");\n        }\n        chunks.push(chunk);\n      }\n      return concatBytes(chunks);\n    }\n    if (majorType === 3) {\n      let out = \"\";\n      while (!this.consumeBreak()) {\n        const chunk = this.readValue();\n        if (typeof chunk !== \"string\") {\n          throw new Error(\"Indefinite CBOR text string chunk must be a text string\");\n        }\n        out += chunk;\n      }\n      return out;\n    }\n    if (majorType === 4) {\n      const out: CborValue[] = [];\n      while (!this.consumeBreak()) {\n        out.push(this.readValue());\n      }\n      return out;\n    }\n    if (majorType === 5) {\n      const out = new Map<CborValue, CborValue>();\n      while (!this.consumeBreak()) {\n        const key = this.readValue();\n        if (this.peekBreak()) {\n          throw new Error(\"Indefinite CBOR map ended after a key\");\n        }\n        out.set(key, this.readValue());\n      }\n      return out;\n    }\n    throw new Error(`Indefinite CBOR major type ${majorType} is not supported`);\n  }\n\n  private readLength(additional: number): number | bigint {\n    if (additional < 24) {\n      return additional;\n    }\n    if (additional === 24) {\n      return this.readByte();\n    }\n    if (additional === 25) {\n      return (this.readByte() << 8) | this.readByte();\n    }\n    if (additional === 26) {\n      return (this.readByte() * 0x1000000 + (this.readByte() << 16) + (this.readByte() << 8) + this.readByte()) >>> 0;\n    }\n    if (additional === 27) {\n      let value = 0n;\n      for (let index = 0; index < 8; index += 1) {\n        value = (value << 8n) | BigInt(this.readByte());\n      }\n      return value <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(value) : value;\n    }\n    throw new Error(\"Indefinite CBOR lengths are not supported\");\n  }\n\n  private readByte(): number {\n    if (this.offset >= this.bytes.length) {\n      throw new Error(\"Unexpected end of CBOR input\");\n    }\n    return this.bytes[this.offset++];\n  }\n\n  private peekBreak(): boolean {\n    return this.offset < this.bytes.length && this.bytes[this.offset] === 0xff;\n  }\n\n  private consumeBreak(): boolean {\n    if (this.peekBreak()) {\n      this.offset += 1;\n      return true;\n    }\n    return false;\n  }\n\n  private readBytes(length: number): Uint8Array {\n    if (this.offset + length > this.bytes.length) {\n      throw new Error(\"Unexpected end of CBOR byte string\");\n    }\n    const out = this.bytes.slice(this.offset, this.offset + length);\n    this.offset += length;\n    return out;\n  }\n\n  private lengthAsNumber(value: number | bigint): number {\n    if (typeof value === \"bigint\") {\n      throw new Error(\"CBOR length exceeds JavaScript safe integer range\");\n    }\n    return value;\n  }\n}\n","import { decodeCbor, encodeCoseSigStructure1 } from \"../crypto/cbor\";\nimport { fail, wrapCryptoFailure } from \"../errors\";\n\nexport interface DecodedCoseSign1 {\n  protectedHeadersBytes: Uint8Array;\n  payloadBytes: Uint8Array;\n  signature: Uint8Array;\n}\n\nexport function decodeCoseSign1(attestationDocument: Uint8Array): DecodedCoseSign1 {\n  const untagged = attestationDocument[0] === 0xd2 ? attestationDocument.slice(1) : attestationDocument;\n  let decoded: unknown;\n  try {\n    decoded = decodeCbor(untagged);\n  } catch (cause) {\n    fail(\"COSE_STRUCTURE_INVALID\", \"Attestation document is not a valid COSE_Sign1 CBOR value\", { cause });\n  }\n\n  if (!Array.isArray(decoded) || decoded.length !== 4) {\n    fail(\"COSE_STRUCTURE_INVALID\", \"COSE_Sign1 must be [protected, unprotected, payload, signature]\");\n  }\n\n  const [protectedHeadersBytes, unprotectedHeaders, payloadBytes, signature] = decoded;\n  if (\n    !(protectedHeadersBytes instanceof Uint8Array) ||\n    !(unprotectedHeaders instanceof Map) ||\n    !(payloadBytes instanceof Uint8Array) ||\n    !(signature instanceof Uint8Array)\n  ) {\n    fail(\"COSE_STRUCTURE_INVALID\", \"COSE_Sign1 fields have invalid CBOR types\");\n  }\n\n  assertProtectedHeader(protectedHeadersBytes);\n  if (signature.length !== 96) {\n    fail(\"COSE_SIGNATURE_INVALID_SIZE\", `Expected a 96-byte ES384 signature, got ${signature.length} bytes`);\n  }\n\n  return { protectedHeadersBytes, payloadBytes, signature };\n}\n\nexport async function verifyCoseSignature(params: {\n  protectedHeadersBytes: Uint8Array;\n  payloadBytes: Uint8Array;\n  signature: Uint8Array;\n  leafPublicKey: CryptoKey;\n  subtle: SubtleCrypto;\n}): Promise<void> {\n  const sigStructure = encodeCoseSigStructure1(params.protectedHeadersBytes, params.payloadBytes);\n  const ok = await wrapCryptoFailure(\n    params.subtle.verify({ name: \"ECDSA\", hash: \"SHA-384\" }, params.leafPublicKey, params.signature, sigStructure),\n    \"COSE_SIGNATURE_VERIFY_FAILED\",\n    \"COSE_Sign1 signature verification failed\",\n  );\n  if (!ok) {\n    fail(\"COSE_SIGNATURE_VERIFY_FAILED\", \"COSE_Sign1 signature does not verify with the attestation leaf certificate\");\n  }\n}\n\nfunction assertProtectedHeader(protectedHeadersBytes: Uint8Array): void {\n  let decoded: unknown;\n  try {\n    decoded = decodeCbor(protectedHeadersBytes);\n  } catch (cause) {\n    fail(\"COSE_STRUCTURE_INVALID\", \"COSE protected headers are not a valid CBOR map\", { cause });\n  }\n  if (!(decoded instanceof Map)) {\n    fail(\"COSE_STRUCTURE_INVALID\", \"COSE protected headers must be a CBOR map\");\n  }\n  if (decoded.get(1) !== -35) {\n    fail(\"COSE_ALG_UNSUPPORTED\", \"COSE protected header alg must be -35 (ES384)\");\n  }\n}\n","import { fail } from \"../errors\";\n\nconst PCR8_HEX_LENGTH = 96;\n\nexport function normalizePcr8Pin(value: string, label: string): string {\n  const normalized = value.replace(/^0x/i, \"\").toLowerCase();\n  if (normalized.length !== PCR8_HEX_LENGTH || !/^[0-9a-f]+$/.test(normalized)) {\n    fail(\"TRUST_PIN_REQUIRED\", `${label} must be ${PCR8_HEX_LENGTH} lowercase hex characters`);\n  }\n  return normalized;\n}\n\nexport function parseAdvertisedPcr8(value: string, label: string): string {\n  const normalized = normalizePcr8Pin(value, label);\n  if (value !== normalized) {\n    fail(\"ATTESTATION_RESPONSE_INVALID\", `${label} must be ${PCR8_HEX_LENGTH} lowercase hex characters`);\n  }\n  return normalized;\n}\n","import { base64Decode, concatBytes, utf8Decode, utf8Encode } from \"../crypto/encoding\";\nimport { fail, NitroAttestationError } from \"../errors\";\nimport { parseAdvertisedPcr8 } from \"../trust/pcr8\";\n\nconst MAX_ATTESTATION_RESPONSE_BYTES = 256 * 1024;\nconst NETWORK_LAYER_FETCH_ATTEMPTS = 3;\nconst NETWORK_LAYER_RETRY_DELAY_MS = 150;\nconst ETH_ADDRESS_PATTERN = /^0x[0-9a-fA-F]{40}$/;\n\nexport interface AttestationEnvelope {\n  attestationDocument: Uint8Array;\n  nonce: string;\n  advertised: {\n    chainId?: number;\n    verifyingContract?: string;\n    expectedSigner?: string;\n    expectedPcr8?: string;\n  };\n}\n\nexport function buildAttestationUrl(attestationServiceUrl: string, nonceHex: string): URL {\n  const url = new URL(attestationServiceUrl);\n  const strippedPath = url.pathname.replace(/\\/+$/, \"\");\n  url.pathname = strippedPath.endsWith(\"/attestation\") ? strippedPath : `${strippedPath}/attestation`;\n  url.search = \"\";\n  url.searchParams.set(\"nonce\", nonceHex);\n  return url;\n}\n\nexport async function fetchAttestationEnvelope(params: {\n  attestationServiceUrl: string;\n  nonceHex: string;\n  fetch: typeof fetch;\n  timeoutMs: number;\n}): Promise<AttestationEnvelope> {\n  const url = buildAttestationUrl(params.attestationServiceUrl, params.nonceHex);\n  const response = await fetchWithNetworkRetry(url.toString(), params.fetch, params.timeoutMs);\n  const responseText = await readResponseText(response);\n  if (!response.ok) {\n    fail(\"ATTESTATION_FETCH_FAILED\", `GET /attestation failed with HTTP ${response.status}`, {\n      details: { status: response.status, body: responseText.slice(0, 400) },\n    });\n  }\n\n  let body: unknown;\n  try {\n    body = JSON.parse(responseText);\n  } catch (cause) {\n    fail(\"ATTESTATION_RESPONSE_INVALID\", \"GET /attestation returned non-JSON response\", { cause });\n  }\n\n  return validateAttestationEnvelope(body);\n}\n\nfunction validateAttestationEnvelope(body: unknown): AttestationEnvelope {\n  if (!isRecord(body) || body.success !== true || !isRecord(body.responseObject)) {\n    fail(\"ATTESTATION_RESPONSE_INVALID\", \"Expected { success: true, responseObject: {...} }\");\n  }\n\n  const responseObject = body.responseObject;\n  if (typeof responseObject.attestationDocument !== \"string\" || typeof responseObject.nonce !== \"string\") {\n    fail(\"ATTESTATION_RESPONSE_INVALID\", \"Attestation response is missing attestationDocument or nonce\");\n  }\n\n  let attestationDocument: Uint8Array;\n  try {\n    attestationDocument = base64Decode(responseObject.attestationDocument);\n  } catch (cause) {\n    fail(\"ATTESTATION_RESPONSE_INVALID\", \"attestationDocument is not valid base64\", { cause });\n  }\n  if (attestationDocument.length === 0) {\n    fail(\"ATTESTATION_RESPONSE_INVALID\", \"attestationDocument decoded to empty bytes\");\n  }\n\n  return {\n    attestationDocument,\n    nonce: responseObject.nonce.toLowerCase(),\n    advertised: {\n      chainId: typeof responseObject.chainId === \"number\" ? responseObject.chainId : undefined,\n      verifyingContract: parseOptionalAddress(responseObject.verifyingContract, \"verifyingContract\"),\n      expectedSigner: parseOptionalAddress(responseObject.expectedSigner, \"expectedSigner\"),\n      expectedPcr8: parseOptionalAdvertisedPcr8(responseObject.expectedPcr8, \"expectedPcr8\"),\n    },\n  };\n}\n\nasync function readResponseText(response: Response): Promise<string> {\n  if (!response.body) {\n    const responseText = await response.text();\n    assertResponseSize(utf8Encode(responseText).length);\n    return responseText;\n  }\n\n  const reader = response.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let totalBytes = 0;\n  while (true) {\n    const { done, value } = await reader.read();\n    if (done) {\n      break;\n    }\n    if (value) {\n      totalBytes += value.length;\n      assertResponseSize(totalBytes);\n      chunks.push(value);\n    }\n  }\n  return utf8Decode(concatBytes(chunks));\n}\n\nfunction assertResponseSize(totalBytes: number): void {\n  if (totalBytes > MAX_ATTESTATION_RESPONSE_BYTES) {\n    fail(\"ATTESTATION_RESPONSE_INVALID\", \"GET /attestation response exceeded maximum size\", {\n      details: { maxBytes: MAX_ATTESTATION_RESPONSE_BYTES, actualBytes: totalBytes },\n    });\n  }\n}\n\nfunction parseOptionalAddress(value: unknown, label: string): string | undefined {\n  if (value === undefined) {\n    return undefined;\n  }\n  if (typeof value !== \"string\" || !ETH_ADDRESS_PATTERN.test(value)) {\n    fail(\"ATTESTATION_RESPONSE_INVALID\", `${label} must be a 0x-prefixed 20-byte hex address`);\n  }\n  return value.toLowerCase();\n}\n\nfunction parseOptionalAdvertisedPcr8(value: unknown, label: string): string | undefined {\n  if (value === undefined) {\n    return undefined;\n  }\n  if (typeof value !== \"string\") {\n    fail(\"ATTESTATION_RESPONSE_INVALID\", `${label} must be a 96-character lowercase hex string`);\n  }\n  try {\n    return parseAdvertisedPcr8(value, label);\n  } catch (cause) {\n    fail(\"ATTESTATION_RESPONSE_INVALID\", `${label} must be a 96-character lowercase hex string`, { cause });\n  }\n}\n\nasync function fetchWithNetworkRetry(url: string, fetcher: typeof fetch, timeoutMs: number): Promise<Response> {\n  let attempt = 1;\n  while (true) {\n    try {\n      return await fetchWithTimeout(url, fetcher, timeoutMs);\n    } catch (cause) {\n      if (!isNetworkLayerFetchFailure(cause) || attempt >= NETWORK_LAYER_FETCH_ATTEMPTS) {\n        throw cause;\n      }\n      await sleep(NETWORK_LAYER_RETRY_DELAY_MS * attempt);\n      attempt += 1;\n    }\n  }\n}\n\nasync function fetchWithTimeout(url: string, fetcher: typeof fetch, timeoutMs: number): Promise<Response> {\n  const controller = typeof AbortController !== \"undefined\" ? new AbortController() : undefined;\n  let timeoutHandle: ReturnType<typeof setTimeout> | undefined;\n  const timeoutPromise = new Promise<never>((_, reject) => {\n    timeoutHandle = setTimeout(() => {\n      controller?.abort();\n      reject(new Error(\"timeout\"));\n    }, timeoutMs);\n  });\n\n  try {\n    const response = await Promise.race([\n      fetcher(url, {\n        headers: { accept: \"application/json\" },\n        signal: controller?.signal,\n      }),\n      timeoutPromise,\n    ]);\n    if (timeoutHandle !== undefined) {\n      clearTimeout(timeoutHandle);\n    }\n    return response;\n  } catch (cause) {\n    if (timeoutHandle !== undefined) {\n      clearTimeout(timeoutHandle);\n    }\n    if (cause instanceof Error && (cause.name === \"AbortError\" || cause.message === \"timeout\")) {\n      fail(\"TIMEOUT\", `GET /attestation timed out after ${timeoutMs}ms`, { cause });\n    }\n    fail(\"ATTESTATION_FETCH_FAILED\", \"GET /attestation failed at the network layer\", {\n      cause,\n      details: { layer: \"network\" },\n    });\n  }\n}\n\nfunction isNetworkLayerFetchFailure(cause: unknown): boolean {\n  return (\n    cause instanceof NitroAttestationError &&\n    cause.code === \"ATTESTATION_FETCH_FAILED\" &&\n    cause.details?.layer === \"network\"\n  );\n}\n\nfunction sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n","import { bytesToHex } from \"../crypto/encoding\";\nimport { fail } from \"../errors\";\n\nexport const NONCE_BYTE_LENGTH = 32;\n\nexport function generateNonceHex(getRandomValues: (out: Uint8Array) => Uint8Array): string {\n  return bytesToHex(getRandomValues(new Uint8Array(NONCE_BYTE_LENGTH)));\n}\n\nexport function assertNonceEcho(echoedNonce: string, expectedNonce: string): void {\n  if (echoedNonce.toLowerCase() !== expectedNonce) {\n    fail(\"ATTESTATION_NONCE_MISMATCH\", \"Attestation service echoed a different nonce\", {\n      details: { expectedNonce, echoedNonce },\n    });\n  }\n}\n","import { decodeCbor } from \"../crypto/cbor\";\nimport { bytesToHex, utf8Decode } from \"../crypto/encoding\";\nimport { fail } from \"../errors\";\n\nexport interface DecodedAttestationPayload {\n  timestampMs: number;\n  nonceHex: string;\n  pcr0Hex: string;\n  pcr1Hex: string;\n  pcr2Hex: string;\n  pcr8Hex: string;\n  certificateDer: Uint8Array;\n  cabundleDer: Uint8Array[];\n  publicKeyDer: Uint8Array;\n}\n\nexport function decodeAttestationPayload(payloadBytes: Uint8Array): DecodedAttestationPayload {\n  let decoded: unknown;\n  try {\n    decoded = decodeCbor(payloadBytes);\n  } catch (cause) {\n    fail(\"PAYLOAD_FIELD_MISSING\", \"Attestation payload is not a valid CBOR map\", { cause });\n  }\n\n  const payload = requireMap(decoded, \"payload\");\n  const pcrs = requireMap(payload.get(\"pcrs\"), \"pcrs\");\n  const userData = requireBytes(payload.get(\"user_data\"), \"user_data\");\n\n  return {\n    timestampMs: requireTimestamp(payload.get(\"timestamp\")),\n    nonceHex: utf8Decode(userData),\n    pcr0Hex: optionalPcrHex(pcrs, 0),\n    pcr1Hex: optionalPcrHex(pcrs, 1),\n    pcr2Hex: optionalPcrHex(pcrs, 2),\n    pcr8Hex: bytesToHex(requireBytes(pcrs.get(8), \"pcrs[8]\")),\n    certificateDer: requireBytes(payload.get(\"certificate\"), \"certificate\"),\n    cabundleDer: requireArray(payload.get(\"cabundle\"), \"cabundle\").map((entry, index) =>\n      requireBytes(entry, `cabundle[${index}]`),\n    ),\n    publicKeyDer: requireBytes(payload.get(\"public_key\"), \"public_key\"),\n  };\n}\n\nfunction optionalPcrHex(pcrs: Map<unknown, unknown>, index: number): string {\n  const value = pcrs.get(index);\n  return value instanceof Uint8Array ? bytesToHex(value) : \"\";\n}\n\nfunction requireTimestamp(value: unknown): number {\n  if (typeof value === \"number\" && Number.isSafeInteger(value) && value >= 0) {\n    return value;\n  }\n  fail(\"PAYLOAD_FIELD_MISSING\", \"Attestation payload timestamp must be an unsigned safe integer\");\n}\n\nfunction requireMap(value: unknown, label: string): Map<unknown, unknown> {\n  if (value instanceof Map) {\n    return value;\n  }\n  fail(\"PAYLOAD_FIELD_MISSING\", `Attestation payload field ${label} must be a CBOR map`);\n}\n\nfunction requireBytes(value: unknown, label: string): Uint8Array {\n  if (value instanceof Uint8Array) {\n    return value;\n  }\n  fail(\"PAYLOAD_FIELD_MISSING\", `Attestation payload field ${label} must be a byte string`);\n}\n\nfunction requireArray(value: unknown, label: string): unknown[] {\n  if (Array.isArray(value)) {\n    return value;\n  }\n  fail(\"PAYLOAD_FIELD_MISSING\", `Attestation payload field ${label} must be an array`);\n}\n","import type { NitroAttestationEnvironment } from \"../types\";\nimport { normalizePcr8Pin } from \"./pcr8\";\n\nexport const STAGING_ATTESTATION_SERVICE_URL = \"https://attestation-service-staging.zkp2p.xyz\";\nexport const PRODUCTION_ATTESTATION_SERVICE_URL = \"https://attestation-service.zkp2p.xyz\";\n\nexport const STAGING_PCR8 =\n  \"5636e3bd96f847cf12cfd9de7faa8cad0e6fa00962ce16ba185f8e5ea57105abb3cc9cc34f1e1e4de3444ceabcca7485\";\nexport const PRODUCTION_PCR8 =\n  \"41a4ae0b9b96752cab5addb7d22689b3070e564e29f90a54316fa33fa38ea51387a6e887ea4f5a4b0cc34f69cea3f40e\";\n\nexport const DEFAULT_EXPECTED_PCR8_BY_HOST: Record<string, string> = {\n  \"attestation-service-staging.zkp2p.xyz\": normalizePcr8Pin(STAGING_PCR8, \"bundled staging PCR8\"),\n  \"attestation-service.zkp2p.xyz\": normalizePcr8Pin(PRODUCTION_PCR8, \"bundled production PCR8\"),\n};\n\nexport const DEFAULT_ENVIRONMENT_CONFIG: Record<\n  NitroAttestationEnvironment,\n  {\n    attestationServiceUrl: string;\n    expectedPcr8Hex: string;\n  }\n> = {\n  staging: {\n    attestationServiceUrl: STAGING_ATTESTATION_SERVICE_URL,\n    expectedPcr8Hex: STAGING_PCR8,\n  },\n  production: {\n    attestationServiceUrl: PRODUCTION_ATTESTATION_SERVICE_URL,\n    expectedPcr8Hex: PRODUCTION_PCR8,\n  },\n};\n","import { fail } from \"../errors\";\nimport type { TrustPins } from \"../types\";\nimport type { NitroAttestationWarning } from \"../warnings\";\nimport { normalizePcr8Pin } from \"./pcr8\";\nimport { DEFAULT_EXPECTED_PCR8_BY_HOST } from \"./pins\";\n\nexport function resolveExpectedPcr8(params: {\n  trust?: TrustPins;\n  hostname: string;\n  advertisedExpectedPcr8?: string;\n  onWarning?: (warning: NitroAttestationWarning) => void;\n}): string {\n  const { trust, advertisedExpectedPcr8, onWarning } = params;\n  const hostname = params.hostname.toLowerCase();\n\n  if (trust?.expectedPcr8Hex) {\n    return normalizePcr8Pin(trust.expectedPcr8Hex, \"trust.expectedPcr8Hex\");\n  }\n\n  const hostPins = trust?.expectedPcr8ByHost;\n  const hostPin = hostPins ? findHostPin(hostPins, hostname) : undefined;\n  if (hostPin) {\n    return normalizePcr8Pin(hostPin, `trust.expectedPcr8ByHost[${hostname}]`);\n  }\n\n  const bundledPin = DEFAULT_EXPECTED_PCR8_BY_HOST[hostname];\n  if (bundledPin) {\n    return bundledPin;\n  }\n\n  if (trust?.strictPin === true) {\n    fail(\"TRUST_PIN_REQUIRED\", `No trusted PCR8 pin is configured for ${hostname}`);\n  }\n\n  if (advertisedExpectedPcr8) {\n    const normalizedAdvertisedPin = normalizePcr8Pin(advertisedExpectedPcr8, \"service-advertised expectedPcr8\");\n    onWarning?.({\n      code: \"TRUST_PIN_NOT_PROVIDED\",\n      message: `No caller or bundled PCR8 pin was available for ${hostname}; falling back to service-advertised expectedPcr8`,\n      details: { hostname, expectedPcr8: normalizedAdvertisedPin },\n    });\n    return normalizedAdvertisedPin;\n  }\n\n  fail(\"TRUST_PIN_REQUIRED\", `No trusted or service-advertised PCR8 pin is available for ${hostname}`);\n}\n\nfunction findHostPin(hostPins: Record<string, string>, hostname: string): string | undefined {\n  for (const [configuredHost, pin] of Object.entries(hostPins)) {\n    if (configuredHost.toLowerCase() === hostname) {\n      return pin;\n    }\n  }\n  return undefined;\n}\n","import { verifyCertificateChain } from \"./attestation/certChain\";\nimport { decodeCoseSign1, verifyCoseSignature } from \"./attestation/coseSign1\";\nimport { fetchAttestationEnvelope } from \"./attestation/fetch\";\nimport { assertNonceEcho, generateNonceHex } from \"./attestation/nonce\";\nimport { decodeAttestationPayload } from \"./attestation/payloadFields\";\nimport { bytesToArrayBuffer, bytesToHex } from \"./crypto/encoding\";\nimport { resolveCryptoProvider, resolveFetch } from \"./crypto/env\";\nimport { fail } from \"./errors\";\nimport { DEFAULT_TIMEOUT_MS } from \"./timeout\";\nimport { resolveExpectedPcr8 } from \"./trust/resolveExpectedPcr8\";\nimport type { AttestedSellerUploadKey, FetchAndVerifyAttestationParams, VerifiedAttestation } from \"./types\";\n\nconst DEFAULT_FRESHNESS_WINDOW_MS = 5 * 60 * 1000;\n\nexport async function fetchAttestedUploadKey(\n  params: FetchAndVerifyAttestationParams,\n): Promise<AttestedSellerUploadKey> {\n  return (await fetchAndVerifyAttestation(params)).attestedSellerUploadKey;\n}\n\nexport async function fetchAndVerifyAttestation(params: FetchAndVerifyAttestationParams): Promise<VerifiedAttestation> {\n  const fetcher = resolveFetch(params.fetch);\n  const crypto = resolveCryptoProvider(params);\n  const now = params.now ?? Date.now;\n  const nonceHex = generateNonceHex(crypto.getRandomValues);\n  const response = await fetchAttestationEnvelope({\n    attestationServiceUrl: params.attestationServiceUrl,\n    nonceHex,\n    fetch: fetcher,\n    timeoutMs: params.timeoutMs ?? DEFAULT_TIMEOUT_MS,\n  });\n  assertNonceEcho(response.nonce, nonceHex);\n\n  const { protectedHeadersBytes, payloadBytes, signature } = decodeCoseSign1(response.attestationDocument);\n  const payload = decodeAttestationPayload(payloadBytes);\n\n  if (payload.nonceHex !== nonceHex) {\n    fail(\"NONCE_BINDING_FAILED\", \"Attestation payload user_data did not match the request nonce\", {\n      details: { expectedNonce: nonceHex, payloadNonce: payload.nonceHex },\n    });\n  }\n\n  const freshnessWindowMs = params.trust?.freshnessWindowMs ?? DEFAULT_FRESHNESS_WINDOW_MS;\n  const nowMs = now();\n  if (Math.abs(nowMs - payload.timestampMs) > freshnessWindowMs) {\n    fail(\"FRESHNESS_CHECK_FAILED\", `Attestation timestamp skew exceeds ${freshnessWindowMs}ms`, {\n      details: { timestampMs: payload.timestampMs, nowMs, freshnessWindowMs },\n    });\n  }\n\n  const hostname = new URL(params.attestationServiceUrl).hostname;\n  const expectedPcr8 = resolveExpectedPcr8({\n    trust: params.trust,\n    hostname,\n    advertisedExpectedPcr8: response.advertised.expectedPcr8,\n    onWarning: params.onWarning,\n  });\n  if (payload.pcr8Hex !== expectedPcr8) {\n    fail(\"PCR8_PIN_MISMATCH\", \"Attestation PCR8 does not match the trusted pin\", {\n      details: { expectedPcr8, actualPcr8: payload.pcr8Hex },\n    });\n  }\n\n  const { leafPublicKey } = await verifyCertificateChain({\n    leafCertificateDer: payload.certificateDer,\n    cabundleDer: payload.cabundleDer,\n    rootPem: params.trust?.awsNitroRootPem,\n    nowMs,\n    subtle: crypto.subtle,\n    getRandomValues: crypto.getRandomValues,\n    onWarning: params.onWarning,\n  });\n  await verifyCoseSignature({ protectedHeadersBytes, payloadBytes, signature, leafPublicKey, subtle: crypto.subtle });\n\n  return {\n    attestedSellerUploadKey: {\n      publicKeyDer: payload.publicKeyDer,\n      publicKeySha256Hex: bytesToHex(\n        new Uint8Array(await crypto.subtle.digest(\"SHA-256\", bytesToArrayBuffer(payload.publicKeyDer))),\n      ),\n    },\n    payload: {\n      timestampMs: payload.timestampMs,\n      pcr0Hex: payload.pcr0Hex,\n      pcr1Hex: payload.pcr1Hex,\n      pcr2Hex: payload.pcr2Hex,\n      pcr8Hex: payload.pcr8Hex,\n      nonceHex: payload.nonceHex,\n      advertised: response.advertised,\n    },\n  };\n}\n","import { encryptBuyerTeeSessionMaterial } from \"./encryptBuyerTeeSessionMaterial\";\nimport { fetchAttestedUploadKey } from \"./fetchAndVerifyAttestation\";\nimport type { BuyerTeeSessionMaterialPlatform, CreateEncryptedBuyerTeeSessionMaterialParamsFor } from \"./types\";\n\nexport async function createEncryptedBuyerTeeSessionMaterial<P extends BuyerTeeSessionMaterialPlatform>(\n  params: CreateEncryptedBuyerTeeSessionMaterialParamsFor<P>,\n): Promise<string> {\n  return encryptBuyerTeeSessionMaterial({\n    ...params,\n    key: await fetchAttestedUploadKey(params),\n  });\n}\n","import { resolveCryptoProvider } from \"./crypto/env\";\nimport { encryptDisputeSessionMaterialWithResolvedCrypto } from \"./jwe/encrypt\";\nimport type { DisputePlatform, EncryptDisputeSessionMaterialParamsFor } from \"./types\";\n\nexport async function encryptDisputeSessionMaterial<P extends DisputePlatform>(\n  params: EncryptDisputeSessionMaterialParamsFor<P>,\n): Promise<string> {\n  const crypto = resolveCryptoProvider(params);\n  return encryptDisputeSessionMaterialWithResolvedCrypto({\n    request: params,\n    subtle: crypto.subtle,\n    getRandomValues: crypto.getRandomValues,\n  });\n}\n","import { encryptDisputeSessionMaterial } from \"./encryptDisputeSessionMaterial\";\nimport { fetchAttestedUploadKey } from \"./fetchAndVerifyAttestation\";\nimport type { CreateEncryptedDisputeSessionMaterialParamsFor, DisputePlatform } from \"./types\";\n\nexport async function createEncryptedDisputeSessionMaterial<P extends DisputePlatform>(\n  params: CreateEncryptedDisputeSessionMaterialParamsFor<P>,\n): Promise<string> {\n  return encryptDisputeSessionMaterial({\n    key: await fetchAttestedUploadKey(params),\n    platform: params.platform,\n    actionType: params.actionType,\n    sessionMaterial: params.sessionMaterial,\n    subtle: params.subtle,\n    getRandomValues: params.getRandomValues,\n  });\n}\n","import { resolveCryptoProvider } from \"./crypto/env\";\nimport { encryptIdentitySessionMaterialWithResolvedCrypto } from \"./jwe/encrypt\";\nimport type { EncryptIdentitySessionMaterialParamsFor, IdentityRequestPlatform } from \"./types\";\n\nexport async function encryptIdentitySessionMaterial<P extends IdentityRequestPlatform>(\n  params: EncryptIdentitySessionMaterialParamsFor<P>,\n): Promise<string> {\n  const crypto = resolveCryptoProvider(params);\n  return encryptIdentitySessionMaterialWithResolvedCrypto({\n    request: params,\n    subtle: crypto.subtle,\n    getRandomValues: crypto.getRandomValues,\n  });\n}\n","import { encryptIdentitySessionMaterial } from \"./encryptIdentitySessionMaterial\";\nimport { fetchAttestedUploadKey } from \"./fetchAndVerifyAttestation\";\nimport type { CreateEncryptedIdentitySessionMaterialParamsFor, IdentityRequestPlatform } from \"./types\";\n\nexport async function createEncryptedIdentitySessionMaterial<P extends IdentityRequestPlatform>(\n  params: CreateEncryptedIdentitySessionMaterialParamsFor<P>,\n): Promise<string> {\n  return encryptIdentitySessionMaterial({\n    key: await fetchAttestedUploadKey(params),\n    platform: params.platform,\n    actionType: params.actionType,\n    sessionMaterial: params.sessionMaterial,\n    subtle: params.subtle,\n    getRandomValues: params.getRandomValues,\n  });\n}\n","import { resolveCryptoProvider } from \"./crypto/env\";\nimport { encryptSellerCredentialUploadWithResolvedCrypto } from \"./jwe/encrypt\";\nimport type { EncryptSellerCredentialUploadParams } from \"./types\";\n\nexport async function encryptSellerCredentialUpload(params: EncryptSellerCredentialUploadParams): Promise<string> {\n  const crypto = resolveCryptoProvider(params);\n  return encryptSellerCredentialUploadWithResolvedCrypto({\n    request: params,\n    subtle: crypto.subtle,\n    getRandomValues: crypto.getRandomValues,\n    now: params.now ?? Date.now,\n  });\n}\n","import { encryptSellerCredentialUpload } from \"./encryptSellerCredentialUpload\";\nimport { fetchAttestedUploadKey } from \"./fetchAndVerifyAttestation\";\nimport type { CreateEncryptedSellerCredentialUploadParams } from \"./types\";\n\nexport async function createEncryptedSellerCredentialUpload(\n  params: CreateEncryptedSellerCredentialUploadParams,\n): Promise<string> {\n  return encryptSellerCredentialUpload({\n    ...params,\n    key: await fetchAttestedUploadKey(params),\n  });\n}\n","import { getAddress } from \"ethers\";\nimport { fail } from \"./errors\";\n\nexport function normalizeIdentityCallerAddress(callerAddress: string): string {\n  try {\n    return getAddress(callerAddress);\n  } catch (cause) {\n    fail(\"INVALID_PARAMETER\", \"callerAddress must be a valid Ethereum address\", { cause });\n  }\n}\n","import { resolveFetch } from \"./crypto/env\";\nimport { fail, type NitroServiceResponseErrorDetails } from \"./errors\";\nimport { DEFAULT_TIMEOUT_MS } from \"./timeout\";\n\ninterface ServiceResponseEnvelope<T> {\n  success?: boolean;\n  statusCode?: number;\n  message?: string;\n  responseObject?: T;\n}\n\nconst SERVICE_RESPONSE_SNIPPET_LENGTH = 400;\n\nexport async function postJsonServiceResponse<T>(params: {\n  attestationServiceUrl: string;\n  path: string;\n  body: unknown;\n  fetch?: typeof fetch;\n  failureContext: string;\n  timeoutMs?: number;\n}): Promise<T> {\n  const fetcher = resolveFetch(params.fetch);\n  const timeoutMs = params.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n  const controller = new AbortController();\n  let timeoutHandle: ReturnType<typeof setTimeout> | undefined;\n  const timeoutPromise = new Promise<never>((_, reject) => {\n    timeoutHandle = setTimeout(() => {\n      controller.abort();\n      reject(new Error(\"timeout\"));\n    }, timeoutMs);\n  });\n  let response: Response;\n  let responseText: string;\n  try {\n    response = await Promise.race([\n      fetcher(buildServiceUrl(params.attestationServiceUrl, params.path), {\n        method: \"POST\",\n        headers: {\n          accept: \"application/json\",\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify(params.body),\n        signal: controller.signal,\n      }),\n      timeoutPromise,\n    ]);\n    responseText = await Promise.race([response.text(), timeoutPromise]);\n  } catch (cause) {\n    if (controller.signal.aborted) {\n      fail(\"TIMEOUT\", `${params.failureContext} timed out after ${timeoutMs}ms`, { cause });\n    }\n    fail(\"ATTESTATION_FETCH_FAILED\", `${params.failureContext} failed at the network layer`, { cause });\n  } finally {\n    clearTimeout(timeoutHandle);\n  }\n\n  if (!response.ok) {\n    const envelope = parseServiceResponseEnvelope(responseText);\n    if (envelope?.success === false) {\n      failWithServiceResponseEnvelope(params.failureContext, response.status, envelope);\n    }\n\n    fail(\"ATTESTATION_FETCH_FAILED\", `${params.failureContext} failed with HTTP ${response.status}`, {\n      details: { status: response.status, body: responseText.slice(0, 400) },\n    });\n  }\n\n  let envelope: ServiceResponseEnvelope<T>;\n  try {\n    envelope = JSON.parse(responseText) as typeof envelope;\n  } catch (cause) {\n    fail(\"ATTESTATION_RESPONSE_INVALID\", `${params.failureContext} returned a non-JSON ServiceResponse`, { cause });\n  }\n\n  if (envelope.success !== true) {\n    if (envelope.success === false) {\n      failWithServiceResponseEnvelope(params.failureContext, response.status, envelope);\n    }\n\n    fail(\"ATTESTATION_RESPONSE_INVALID\", `${params.failureContext} returned an unsuccessful ServiceResponse`);\n  }\n\n  if (!isRecord(envelope.responseObject)) {\n    fail(\"ATTESTATION_RESPONSE_INVALID\", `${params.failureContext} returned a ServiceResponse without responseObject`, {\n      details: {\n        status: response.status,\n        envelopeSnippet: formatEnvelopeSnippet(envelope),\n      },\n    });\n  }\n\n  return envelope.responseObject as T;\n}\n\nfunction parseServiceResponseEnvelope(responseText: string): ServiceResponseEnvelope<unknown> | undefined {\n  try {\n    return JSON.parse(responseText) as ServiceResponseEnvelope<unknown>;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction failWithServiceResponseEnvelope(\n  failureContext: string,\n  status: number,\n  envelope: ServiceResponseEnvelope<unknown>,\n): never {\n  const details: NitroServiceResponseErrorDetails = {\n    status,\n    statusCode: envelope.statusCode,\n    message: envelope.message,\n    responseObject: envelope.responseObject,\n  };\n\n  fail(\"SERVICE_RESPONSE_ERROR\", `${failureContext} returned an unsuccessful ServiceResponse`, { details });\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction formatEnvelopeSnippet(envelope: ServiceResponseEnvelope<unknown>): string {\n  return JSON.stringify(envelope).slice(0, SERVICE_RESPONSE_SNIPPET_LENGTH);\n}\n\nfunction buildServiceUrl(attestationServiceUrl: string, path: string): string {\n  const url = new URL(attestationServiceUrl);\n  url.pathname = `${url.pathname.replace(/\\/+$/u, \"\")}${path}`;\n  url.search = \"\";\n  return url.toString();\n}\n","import { createEncryptedIdentitySessionMaterial } from \"./createEncryptedIdentitySessionMaterial\";\nimport { normalizeIdentityCallerAddress } from \"./identityCallerAddress\";\nimport { postJsonServiceResponse } from \"./serviceResponse\";\nimport type {\n  IdentityAttestationOutputFor,\n  IdentityRequestPlatform,\n  RequestIdentityAttestationParamsFor,\n} from \"./types\";\n\nexport async function requestIdentityAttestation<P extends IdentityRequestPlatform>(\n  params: RequestIdentityAttestationParamsFor<P>,\n): Promise<IdentityAttestationOutputFor<P>> {\n  const callerAddress = normalizeIdentityCallerAddress(params.callerAddress);\n  const encryptedSessionMaterial = await createEncryptedIdentitySessionMaterial({\n    attestationServiceUrl: params.attestationServiceUrl,\n    trust: params.trust,\n    fetch: params.fetch,\n    subtle: params.subtle,\n    getRandomValues: params.getRandomValues,\n    now: params.now,\n    onWarning: params.onWarning,\n    timeoutMs: params.timeoutMs,\n    platform: params.platform,\n    actionType: params.actionType,\n    sessionMaterial: params.sessionMaterial,\n  });\n\n  return postJsonServiceResponse<IdentityAttestationOutputFor<P>>({\n    attestationServiceUrl: params.attestationServiceUrl,\n    path: \"/identity\",\n    fetch: params.fetch,\n    failureContext: \"POST /identity\",\n    timeoutMs: params.timeoutMs,\n    body: {\n      platform: params.platform,\n      actionType: params.actionType,\n      callerAddress,\n      encryptedSessionMaterial,\n      params: params.params,\n    },\n  });\n}\n","import { createEncryptedSellerCredentialUpload } from \"./createEncryptedSellerCredentialUpload\";\nimport { postJsonServiceResponse } from \"./serviceResponse\";\nimport type { SellerCredentialBundle, UploadSellerCredentialParams } from \"./types\";\n\nexport async function uploadSellerCredential(params: UploadSellerCredentialParams): Promise<SellerCredentialBundle> {\n  const encryptedUpload = await createEncryptedSellerCredentialUpload(params);\n\n  return postJsonServiceResponse<SellerCredentialBundle>({\n    attestationServiceUrl: params.attestationServiceUrl,\n    path: `/seller/credentials/${encodeURIComponent(params.platform)}`,\n    fetch: params.fetch,\n    failureContext: \"POST /seller/credentials\",\n    timeoutMs: params.timeoutMs,\n    body: { encryptedUpload },\n  });\n}\n","import { createEncryptedBuyerTeeSessionMaterial } from \"./createEncryptedBuyerTeeSessionMaterial\";\nimport { postJsonServiceResponse } from \"./serviceResponse\";\nimport type {\n  BuyerTeeAttestationOutputFor,\n  BuyerTeeSessionMaterialPlatform,\n  VerifyBuyerTeePaymentParamsFor,\n} from \"./types\";\n\nexport async function verifyBuyerTeePayment<P extends BuyerTeeSessionMaterialPlatform>(\n  params: VerifyBuyerTeePaymentParamsFor<P>,\n): Promise<BuyerTeeAttestationOutputFor<P>> {\n  const encryptedSessionMaterial = await createEncryptedBuyerTeeSessionMaterial(params);\n\n  return postJsonServiceResponse<BuyerTeeAttestationOutputFor<P>>({\n    attestationServiceUrl: params.attestationServiceUrl,\n    path: `/buyer/verify/${encodeURIComponent(params.platform)}/${encodeURIComponent(params.actionType)}`,\n    fetch: params.fetch,\n    failureContext: \"POST /buyer/verify\",\n    timeoutMs: params.timeoutMs,\n    body: {\n      encryptedSessionMaterial,\n      params: params.params,\n      chainId: params.chainId,\n      intent: params.intent,\n    },\n  });\n}\n","import { createEncryptedDisputeSessionMaterial } from \"./createEncryptedDisputeSessionMaterial\";\nimport { postJsonServiceResponse } from \"./serviceResponse\";\nimport type { DisputeAttestationOutputFor, DisputePlatform, VerifyDisputeParamsFor } from \"./types\";\n\nexport async function verifyDispute<P extends DisputePlatform>(\n  params: VerifyDisputeParamsFor<P>,\n): Promise<DisputeAttestationOutputFor<P>> {\n  const encryptedSessionMaterial = await createEncryptedDisputeSessionMaterial(params);\n\n  return postJsonServiceResponse<DisputeAttestationOutputFor<P>>({\n    attestationServiceUrl: params.attestationServiceUrl,\n    path: `/dispute/verify/${encodeURIComponent(params.platform)}/${encodeURIComponent(params.actionType)}`,\n    fetch: params.fetch,\n    failureContext: \"POST /dispute/verify\",\n    timeoutMs: params.timeoutMs,\n    body: {\n      encryptedSessionMaterial,\n      params: params.params,\n      chainId: params.chainId,\n      intentHash: params.intentHash,\n    },\n  });\n}\n","import { createEncryptedBuyerTeeSessionMaterial as createEncryptedBuyerTeeSessionMaterialOnce } from \"./createEncryptedBuyerTeeSessionMaterial\";\nimport { createEncryptedDisputeSessionMaterial as createEncryptedDisputeSessionMaterialOnce } from \"./createEncryptedDisputeSessionMaterial\";\nimport { createEncryptedIdentitySessionMaterial as createEncryptedIdentitySessionMaterialOnce } from \"./createEncryptedIdentitySessionMaterial\";\nimport { createEncryptedSellerCredentialUpload as createEncryptedSellerCredentialUploadOnce } from \"./createEncryptedSellerCredentialUpload\";\nimport { encryptBuyerTeeSessionMaterial as encryptBuyerTeeSessionMaterialOnce } from \"./encryptBuyerTeeSessionMaterial\";\nimport { encryptDisputeSessionMaterial as encryptDisputeSessionMaterialOnce } from \"./encryptDisputeSessionMaterial\";\nimport { encryptIdentitySessionMaterial as encryptIdentitySessionMaterialOnce } from \"./encryptIdentitySessionMaterial\";\nimport { encryptSellerCredentialUpload as encryptSellerCredentialUploadOnce } from \"./encryptSellerCredentialUpload\";\nimport { fetchAndVerifyAttestation as fetchAndVerifyAttestationOnce } from \"./fetchAndVerifyAttestation\";\nimport { requestIdentityAttestation as requestIdentityAttestationOnce } from \"./requestIdentityAttestation\";\nimport { DEFAULT_ENVIRONMENT_CONFIG } from \"./trust/pins\";\nimport type {\n  BuyerTeeAttestationOutputFor,\n  BuyerTeeSessionMaterialPlatform,\n  DisputeAttestationOutputFor,\n  DisputePlatform,\n  IdentityAttestationOutputFor,\n  IdentityRequestPlatform,\n  NitroAttestationClient,\n  NitroAttestationClientOptions,\n  NitroAttestationClientVerifyBuyerTeePaymentParamsFor,\n  NitroAttestationClientVerifyDisputeParamsFor,\n  RequestIdentityAttestationParamsFor,\n  TrustPins,\n  VerifyBuyerTeePaymentParamsFor,\n} from \"./types\";\nimport { uploadSellerCredential as uploadSellerCredentialOnce } from \"./uploadSellerCredential\";\nimport { verifyBuyerTeePayment as verifyBuyerTeePaymentOnce } from \"./verifyBuyerTeePayment\";\nimport { verifyDispute as verifyDisputeOnce } from \"./verifyDispute\";\n\nexport function createNitroAttestationClient(options: NitroAttestationClientOptions): NitroAttestationClient {\n  const environmentDefaults = DEFAULT_ENVIRONMENT_CONFIG[options.environment];\n  const baseUrl = options.attestationServiceUrl ?? environmentDefaults.attestationServiceUrl;\n  const baseTrust = mergeTrust({ strictPin: true }, options.trust);\n  const withRequestDefaults = <T extends ClientRequestOptions>(params: T) => ({\n    ...params,\n    attestationServiceUrl: params.attestationServiceUrl ?? baseUrl,\n    trust: mergeTrust(baseTrust, params.trust),\n    fetch: params.fetch ?? options.fetch,\n    subtle: params.subtle ?? options.subtle,\n    getRandomValues: params.getRandomValues ?? options.getRandomValues,\n    now: params.now ?? options.now,\n    onWarning: params.onWarning ?? options.onWarning,\n    timeoutMs: params.timeoutMs ?? options.timeoutMs,\n  });\n  const withCryptoDefaults = <T extends CryptoOverrides>(params: T) => ({\n    ...params,\n    subtle: params.subtle ?? options.subtle,\n    getRandomValues: params.getRandomValues ?? options.getRandomValues,\n  });\n\n  return {\n    createEncryptedBuyerTeeSessionMaterial: (params) =>\n      createEncryptedBuyerTeeSessionMaterialOnce(withRequestDefaults(params)),\n    createEncryptedIdentitySessionMaterial: (params) =>\n      createEncryptedIdentitySessionMaterialOnce(withRequestDefaults(params)),\n    createEncryptedDisputeSessionMaterial: (params) =>\n      createEncryptedDisputeSessionMaterialOnce(withRequestDefaults(params)),\n    createEncryptedSellerCredentialUpload: (params) =>\n      createEncryptedSellerCredentialUploadOnce(withRequestDefaults(params)),\n    requestIdentityAttestation: <P extends IdentityRequestPlatform>(\n      params: Omit<RequestIdentityAttestationParamsFor<P>, \"attestationServiceUrl\"> & {\n        attestationServiceUrl?: string;\n      },\n    ): Promise<IdentityAttestationOutputFor<P>> => {\n      return requestIdentityAttestationOnce<P>(withRequestDefaults(params));\n    },\n    uploadSellerCredential: (params) => uploadSellerCredentialOnce(withRequestDefaults(params)),\n    verifyBuyerTeePayment: <P extends BuyerTeeSessionMaterialPlatform>(\n      params: NitroAttestationClientVerifyBuyerTeePaymentParamsFor<P>,\n    ): Promise<BuyerTeeAttestationOutputFor<P>> => {\n      const verifyParams = withRequestDefaults(params) as unknown as VerifyBuyerTeePaymentParamsFor<P>;\n\n      return verifyBuyerTeePaymentOnce<P>(verifyParams);\n    },\n    verifyDispute: <P extends DisputePlatform>(\n      params: NitroAttestationClientVerifyDisputeParamsFor<P>,\n    ): Promise<DisputeAttestationOutputFor<P>> => {\n      return verifyDisputeOnce<P>(withRequestDefaults(params));\n    },\n    fetchAndVerifyAttestation: (params = {}) => fetchAndVerifyAttestationOnce(withRequestDefaults(params)),\n    encryptBuyerTeeSessionMaterial: (params) => encryptBuyerTeeSessionMaterialOnce(withCryptoDefaults(params)),\n    encryptIdentitySessionMaterial: (params) => encryptIdentitySessionMaterialOnce(withCryptoDefaults(params)),\n    encryptDisputeSessionMaterial: (params) => encryptDisputeSessionMaterialOnce(withCryptoDefaults(params)),\n    encryptSellerCredentialUpload: (params) =>\n      encryptSellerCredentialUploadOnce({\n        ...withCryptoDefaults(params),\n        now: params.now ?? options.now,\n      }),\n  };\n}\n\ninterface ClientRequestOptions extends CryptoOverrides {\n  attestationServiceUrl?: string;\n  trust?: TrustPins;\n  fetch?: typeof fetch;\n  now?: () => number;\n  onWarning?: NitroAttestationClientOptions[\"onWarning\"];\n  timeoutMs?: number;\n}\n\ninterface CryptoOverrides {\n  subtle?: SubtleCrypto;\n  getRandomValues?: (out: Uint8Array) => Uint8Array;\n}\n\nfunction mergeTrust(base: TrustPins, override: TrustPins | undefined): TrustPins {\n  if (!override) {\n    return base;\n  }\n  return {\n    ...base,\n    ...override,\n    expectedPcr8ByHost: {\n      ...base.expectedPcr8ByHost,\n      ...override.expectedPcr8ByHost,\n    },\n  };\n}\n","import { concat, getAddress, keccak256, recoverAddress, TypedDataEncoder, toUtf8Bytes, verifyTypedData } from \"ethers\";\nimport { fail } from \"./errors\";\nimport type { DisputeVerifierDomain, Eip712Field, UnifiedPaymentVerifierDomain } from \"./types\";\n\n// Duplicated from src/common/constants/unifiedPaymentVerifier.ts.\nexport const UNIFIED_PAYMENT_VERIFIER_DOMAIN = {\n  name: \"UnifiedPaymentVerifier\",\n  version: \"1\",\n} as const;\n\nexport const PAYMENT_ATTESTATION_TYPES: Record<string, Eip712Field[]> = {\n  PaymentAttestation: [\n    { name: \"intentHash\", type: \"bytes32\" },\n    { name: \"releaseAmount\", type: \"uint256\" },\n    { name: \"dataHash\", type: \"bytes32\" },\n  ],\n};\n\nexport const PAYMENT_ATTESTATION_TYPESTRING =\n  \"PaymentAttestation(bytes32 intentHash,uint256 releaseAmount,bytes32 dataHash)\";\nexport const PAYMENT_ATTESTATION_TYPEHASH = hashUtf8(PAYMENT_ATTESTATION_TYPESTRING);\n\n// Duplicated from src/dispute/disputeTypedData.ts.\nexport const DISPUTE_VERIFIER_DOMAIN = {\n  name: \"ZKP2P DisputeVerifier\",\n  version: \"1\",\n} as const;\n\nexport const DISPUTE_ATTESTATION_TYPES: Record<string, Eip712Field[]> = {\n  DisputeAttestation: [\n    { name: \"intentHash\", type: \"bytes32\" },\n    { name: \"dataHash\", type: \"bytes32\" },\n  ],\n};\n\nexport const DISPUTE_ATTESTATION_TYPESTRING = \"DisputeAttestation(bytes32 intentHash,bytes32 dataHash)\";\nexport const DISPUTE_ATTESTATION_TYPEHASH = hashUtf8(DISPUTE_ATTESTATION_TYPESTRING);\n\n// Duplicated from src/identity/identityTypedData.ts.\nexport const IDENTITY_DOMAIN = {\n  name: \"ZKP2PIdentityVerifier\",\n  version: \"1\",\n} as const;\n\nexport const IDENTITY_ATTESTATION_TYPES: Record<string, Eip712Field[]> = {\n  IdentityAttestation: [\n    { name: \"method\", type: \"bytes32\" },\n    { name: \"actionType\", type: \"bytes32\" },\n    { name: \"callerAddress\", type: \"address\" },\n    { name: \"payeeIdHash\", type: \"bytes32\" },\n    { name: \"dataHash\", type: \"bytes32\" },\n    { name: \"issuedAt\", type: \"uint256\" },\n    { name: \"validUntil\", type: \"uint256\" },\n  ],\n};\n\nexport const IDENTITY_ATTESTATION_TYPESTRING =\n  \"IdentityAttestation(bytes32 method,bytes32 actionType,address callerAddress,bytes32 payeeIdHash,bytes32 dataHash,uint256 issuedAt,uint256 validUntil)\";\nexport const IDENTITY_ATTESTATION_TYPEHASH = hashUtf8(IDENTITY_ATTESTATION_TYPESTRING);\nexport const IDENTITY_DOMAIN_SEPARATOR = TypedDataEncoder.hashDomain(IDENTITY_DOMAIN).toLowerCase();\n\n// Duplicated from src/api/seller/sellerBundleSignature.ts.\nexport const SELLER_CREDENTIAL_BUNDLE_DOMAIN = {\n  name: \"ZKP2P Seller Credential Bundle\",\n  version: \"1\",\n} as const;\n\nexport const SELLER_CREDENTIAL_BUNDLE_TYPES: Record<string, Eip712Field[]> = {\n  SellerCredentialBundle: [\n    { name: \"platform\", type: \"string\" },\n    { name: \"payeeIdHash\", type: \"bytes32\" },\n    { name: \"encryptedBlobHash\", type: \"bytes32\" },\n    { name: \"encryptedDataKeyHash\", type: \"bytes32\" },\n    { name: \"nonceHash\", type: \"bytes32\" },\n    { name: \"credentialType\", type: \"string\" },\n    { name: \"credentialValidatedAt\", type: \"string\" },\n    { name: \"credentialExpiresAt\", type: \"string\" },\n  ],\n};\n\nexport function getUnifiedPaymentVerifierDomain(params: UnifiedPaymentVerifierDomain) {\n  return {\n    ...UNIFIED_PAYMENT_VERIFIER_DOMAIN,\n    chainId: params.chainId,\n    verifyingContract: getAddress(params.verifyingContract),\n  };\n}\n\nexport function getUnifiedPaymentVerifierDomainSeparator(params: UnifiedPaymentVerifierDomain): string {\n  return TypedDataEncoder.hashDomain(getUnifiedPaymentVerifierDomain(params)).toLowerCase();\n}\n\nexport function getDisputeVerifierDomain(params: DisputeVerifierDomain) {\n  return {\n    ...DISPUTE_VERIFIER_DOMAIN,\n    chainId: params.chainId,\n    verifyingContract: getAddress(params.verifyingContract),\n  };\n}\n\nexport function getDisputeVerifierDomainSeparator(params: DisputeVerifierDomain): string {\n  return TypedDataEncoder.hashDomain(getDisputeVerifierDomain(params)).toLowerCase();\n}\n\nexport function hashUtf8(value: string): string {\n  return keccak256(toUtf8Bytes(value)).toLowerCase();\n}\n\nexport function hashHexBytes(hex: string): string {\n  return keccak256(hex).toLowerCase();\n}\n\nexport function recoverSignerFromDomainSeparator(params: {\n  domainSeparator: string;\n  types: Record<string, Eip712Field[]>;\n  value: Record<string, unknown>;\n  signature: string;\n}): string {\n  try {\n    const structHash = TypedDataEncoder.from(params.types).hash(params.value);\n    const digest = keccak256(concat([\"0x1901\", params.domainSeparator, structHash]));\n    return normalizeAddress(recoverAddress(digest, params.signature));\n  } catch (cause) {\n    fail(\"ATTESTATION_SIGNATURE_INVALID\", \"Unable to recover signer from attestation signature\", { cause });\n  }\n}\n\nexport function recoverSignerFromKnownDomain(params: {\n  domain: Record<string, unknown>;\n  types: Record<string, Eip712Field[]>;\n  value: Record<string, unknown>;\n  signature: string;\n}): string {\n  try {\n    return normalizeAddress(verifyTypedData(params.domain, params.types, params.value, params.signature));\n  } catch (cause) {\n    fail(\"ATTESTATION_SIGNATURE_INVALID\", \"Unable to verify attestation signature\", { cause });\n  }\n}\n\nexport function assertTrustedSigner(recoveredSigner: string, trustedSigners: readonly string[]): string {\n  const recovered = normalizeAddress(recoveredSigner);\n  const normalizedTrustedSigners = new Set(trustedSigners.map((signer) => normalizeAddress(signer)));\n  if (!normalizedTrustedSigners.has(recovered)) {\n    fail(\"SIGNER_NOT_TRUSTED\", \"Recovered signer is not in trustedSigners\", {\n      details: { recoveredSigner: recovered, trustedSigners: Array.from(normalizedTrustedSigners) },\n    });\n  }\n  return recovered;\n}\n\nexport function assertTrustedPayloadSigner(params: {\n  payloadSigner: string;\n  recoveredSigner: string;\n  trustedSigners: readonly string[];\n}): string {\n  const recovered = assertTrustedSigner(params.recoveredSigner, params.trustedSigners);\n  const payloadSigner = normalizeAddress(params.payloadSigner);\n  if (payloadSigner !== recovered) {\n    fail(\"ATTESTATION_SIGNATURE_INVALID\", \"Payload signer does not match the recovered signer\", {\n      details: { payloadSigner, recoveredSigner: recovered },\n    });\n  }\n  return recovered;\n}\n\nexport function assertLowercaseHexEqual(actual: string, expected: string, label: string): void {\n  if (actual.toLowerCase() !== expected.toLowerCase()) {\n    fail(\"ATTESTATION_BINDING_MISMATCH\", `${label} did not match expected value`, {\n      details: { actual, expected },\n    });\n  }\n}\n\nexport function assertAddressEqual(actual: string, expected: string, label: string): void {\n  let normalizedActual: string;\n  let normalizedExpected: string;\n  try {\n    normalizedActual = normalizeAddress(actual);\n    normalizedExpected = normalizeAddress(expected);\n  } catch (cause) {\n    fail(\"INVALID_PARAMETER\", `${label} must be a valid Ethereum address`, { cause });\n  }\n\n  if (normalizedActual !== normalizedExpected) {\n    fail(\"ATTESTATION_BINDING_MISMATCH\", `${label} did not match expected value`, {\n      details: { actual, expected },\n    });\n  }\n}\n\nexport function assertStringEqual(actual: string, expected: string, label: string): void {\n  if (actual !== expected) {\n    fail(\"ATTESTATION_BINDING_MISMATCH\", `${label} did not match expected value`, {\n      details: { actual, expected },\n    });\n  }\n}\n\nexport function assertTypedDataTypesEqual(\n  actual: Record<string, Eip712Field[]>,\n  expected: Record<string, Eip712Field[]>,\n): void {\n  if (JSON.stringify(actual) !== JSON.stringify(expected)) {\n    fail(\"ATTESTATION_BINDING_MISMATCH\", \"typedDataSpec.types did not match the expected EIP-712 types\");\n  }\n}\n\nexport function requireVerifierOption(value: string | undefined, label: string): string {\n  if (typeof value !== \"string\") {\n    fail(\"INVALID_PARAMETER\", `${label} is required`);\n  }\n  return value;\n}\n\nfunction normalizeAddress(address: string): string {\n  return getAddress(address).toLowerCase();\n}\n","import {\n  assertLowercaseHexEqual,\n  assertStringEqual,\n  assertTrustedPayloadSigner,\n  assertTypedDataTypesEqual,\n  getUnifiedPaymentVerifierDomainSeparator,\n  hashHexBytes,\n  PAYMENT_ATTESTATION_TYPEHASH,\n  PAYMENT_ATTESTATION_TYPES,\n  recoverSignerFromDomainSeparator,\n  requireVerifierOption,\n} from \"./eip712\";\nimport type {\n  BuyerTeeAttestationOutputFor,\n  BuyerTeeSessionMaterialPlatform,\n  VerifyBuyerTeePaymentAttestationOptionsFor,\n} from \"./types\";\n\nexport function verifyBuyerTeePaymentAttestation<P extends BuyerTeeSessionMaterialPlatform>(\n  payload: BuyerTeeAttestationOutputFor<P>,\n  options: VerifyBuyerTeePaymentAttestationOptionsFor<P>,\n): BuyerTeeAttestationOutputFor<P> {\n  assertStringEqual(payload.platform, options.expectedPlatform, \"platform\");\n  assertStringEqual(payload.actionType, options.expectedActionType, \"actionType\");\n  assertStringEqual(payload.typedDataSpec.primaryType, \"PaymentAttestation\", \"typedDataSpec.primaryType\");\n  assertTypedDataTypesEqual(payload.typedDataSpec.types, PAYMENT_ATTESTATION_TYPES);\n  assertLowercaseHexEqual(payload.typeHash, PAYMENT_ATTESTATION_TYPEHASH, \"typeHash\");\n  assertLowercaseHexEqual(\n    payload.domainSeparator,\n    getUnifiedPaymentVerifierDomainSeparator(options.expectedDomain),\n    \"domainSeparator\",\n  );\n\n  // Pin encodedPaymentDetails to the signed dataHash so a proxy can't swap the\n  // plaintext payment details while keeping the signed typedDataValue intact.\n  assertLowercaseHexEqual(\n    hashHexBytes(payload.encodedPaymentDetails),\n    payload.typedDataValue.dataHash,\n    \"encodedPaymentDetails\",\n  );\n  assertLowercaseHexEqual(\n    payload.typedDataValue.intentHash,\n    requireVerifierOption(options.expectedIntentHash, \"expectedIntentHash\"),\n    \"typedDataValue.intentHash\",\n  );\n\n  const recoveredSigner = recoverSignerFromDomainSeparator({\n    domainSeparator: payload.domainSeparator,\n    types: PAYMENT_ATTESTATION_TYPES,\n    value: { ...payload.typedDataValue },\n    signature: payload.signature,\n  });\n  assertTrustedPayloadSigner({\n    payloadSigner: payload.signer,\n    recoveredSigner,\n    trustedSigners: options.trustedSigners,\n  });\n\n  return payload;\n}\n","import { AbiCoder } from \"ethers\";\nimport {\n  assertLowercaseHexEqual,\n  assertStringEqual,\n  assertTrustedPayloadSigner,\n  assertTypedDataTypesEqual,\n  DISPUTE_ATTESTATION_TYPEHASH,\n  DISPUTE_ATTESTATION_TYPES,\n  getDisputeVerifierDomainSeparator,\n  hashHexBytes,\n  hashUtf8,\n  recoverSignerFromDomainSeparator,\n  requireVerifierOption,\n} from \"./eip712\";\nimport { fail } from \"./errors\";\nimport type { DisputeAttestationOutputFor, DisputePlatform, VerifyDisputeAttestationOptionsFor } from \"./types\";\n\nconst DISPUTE_DETAILS_ABI =\n  \"tuple(bytes32 paymentMethod,bytes32 originalPaymentId,bytes32 disputeId,uint256 paymentAmount,bytes32 paymentCurrency)\";\n\nexport function verifyDisputeAttestation<P extends DisputePlatform>(\n  payload: DisputeAttestationOutputFor<P>,\n  options: VerifyDisputeAttestationOptionsFor<P>,\n): DisputeAttestationOutputFor<P> {\n  assertStringEqual(payload.platform, options.expectedPlatform, \"platform\");\n  assertStringEqual(payload.actionType, options.expectedActionType, \"actionType\");\n  assertStringEqual(payload.typedDataSpec.primaryType, \"DisputeAttestation\", \"typedDataSpec.primaryType\");\n  assertTypedDataTypesEqual(payload.typedDataSpec.types, DISPUTE_ATTESTATION_TYPES);\n  assertLowercaseHexEqual(payload.typeHash, DISPUTE_ATTESTATION_TYPEHASH, \"typeHash\");\n  assertLowercaseHexEqual(\n    payload.domainSeparator,\n    getDisputeVerifierDomainSeparator(options.expectedDomain),\n    \"domainSeparator\",\n  );\n  assertLowercaseHexEqual(\n    payload.typedDataValue.intentHash,\n    requireVerifierOption(options.expectedIntentHash, \"expectedIntentHash\"),\n    \"typedDataValue.intentHash\",\n  );\n  assertLowercaseHexEqual(\n    hashHexBytes(payload.encodedDisputeDetails),\n    payload.typedDataValue.dataHash,\n    \"encodedDisputeDetails\",\n  );\n  assertLowercaseHexEqual(payload.disputeDetails.paymentMethod, hashUtf8(payload.platform), \"paymentMethod\");\n  assertDisputeDetailsEncoding(payload);\n\n  const recoveredSigner = recoverSignerFromDomainSeparator({\n    domainSeparator: payload.domainSeparator,\n    types: DISPUTE_ATTESTATION_TYPES,\n    value: { ...payload.typedDataValue },\n    signature: payload.signature,\n  });\n  assertTrustedPayloadSigner({\n    payloadSigner: payload.signer,\n    recoveredSigner,\n    trustedSigners: options.trustedSigners,\n  });\n\n  return payload;\n}\n\nfunction assertDisputeDetailsEncoding(payload: DisputeAttestationOutputFor<DisputePlatform>): void {\n  let expectedEncoding: string;\n  try {\n    const details = payload.disputeDetails;\n    expectedEncoding = AbiCoder.defaultAbiCoder().encode(\n      [DISPUTE_DETAILS_ABI],\n      [\n        [\n          details.paymentMethod,\n          details.originalPaymentId,\n          details.disputeId,\n          details.paymentAmount,\n          details.paymentCurrency,\n        ],\n      ],\n    );\n  } catch (cause) {\n    fail(\"ATTESTATION_RESPONSE_INVALID\", \"disputeDetails could not be ABI encoded\", { cause });\n  }\n\n  assertLowercaseHexEqual(payload.encodedDisputeDetails, expectedEncoding, \"disputeDetails\");\n}\n","import {\n  assertAddressEqual,\n  assertLowercaseHexEqual,\n  assertStringEqual,\n  assertTrustedPayloadSigner,\n  assertTypedDataTypesEqual,\n  hashUtf8,\n  IDENTITY_ATTESTATION_TYPEHASH,\n  IDENTITY_ATTESTATION_TYPES,\n  IDENTITY_DOMAIN,\n  IDENTITY_DOMAIN_SEPARATOR,\n  recoverSignerFromKnownDomain,\n  requireVerifierOption,\n} from \"./eip712\";\nimport { fail } from \"./errors\";\nimport type {\n  IdentityAttestationOutputFor,\n  IdentityPlatform,\n  NormalizedIdentityDetails,\n  VerifyIdentityAttestationOptionsFor,\n} from \"./types\";\n\nconst IDENTITY_CANONICAL_FIELD_ORDER = [\"platform\", \"actionType\", \"payeeId\", \"username\", \"metadata\"] as const;\n\nexport function verifyIdentityAttestation<P extends IdentityPlatform>(\n  payload: IdentityAttestationOutputFor<P>,\n  options: VerifyIdentityAttestationOptionsFor<P>,\n): NormalizedIdentityDetails<P> {\n  assertStringEqual(payload.platform, options.expectedPlatform, \"platform\");\n  assertStringEqual(payload.actionType, options.expectedActionType, \"actionType\");\n  assertStringEqual(payload.identity.platform, payload.platform, \"identity.platform\");\n  assertStringEqual(payload.identity.actionType, payload.actionType, \"identity.actionType\");\n  assertStringEqual(payload.typedDataSpec.primaryType, \"IdentityAttestation\", \"typedDataSpec.primaryType\");\n  assertTypedDataTypesEqual(payload.typedDataSpec.types, IDENTITY_ATTESTATION_TYPES);\n  assertLowercaseHexEqual(payload.domainSeparator, IDENTITY_DOMAIN_SEPARATOR, \"domainSeparator\");\n  assertLowercaseHexEqual(payload.typeHash, IDENTITY_ATTESTATION_TYPEHASH, \"typeHash\");\n  assertLowercaseHexEqual(payload.identity.method, hashUtf8(payload.identity.platform), \"identity.method\");\n  // Bind the plaintext payeeId to the signed payeeIdHash so a malformed response\n  // can't return a different plaintext while keeping a valid signature.\n  assertLowercaseHexEqual(payload.identity.payeeIdHash, hashUtf8(payload.identity.payeeId), \"identity.payeeIdHash\");\n  assertLowercaseHexEqual(payload.typedDataValue.method, payload.identity.method, \"typedDataValue.method\");\n  assertLowercaseHexEqual(\n    payload.typedDataValue.actionType,\n    hashUtf8(payload.identity.actionType),\n    \"typedDataValue.actionType\",\n  );\n  assertAddressEqual(\n    payload.typedDataValue.callerAddress,\n    requireVerifierOption(options.expectedCallerAddress, \"expectedCallerAddress\"),\n    \"typedDataValue.callerAddress\",\n  );\n  assertLowercaseHexEqual(\n    payload.typedDataValue.payeeIdHash,\n    payload.identity.payeeIdHash,\n    \"typedDataValue.payeeIdHash\",\n  );\n  assertLowercaseHexEqual(\n    payload.typedDataValue.payeeIdHash,\n    requireVerifierOption(options.expectedPayeeIdHash, \"expectedPayeeIdHash\"),\n    \"typedDataValue.payeeIdHash\",\n  );\n  assertLowercaseHexEqual(\n    payload.typedDataValue.dataHash,\n    hashIdentityData(payload.identity),\n    \"typedDataValue.dataHash\",\n  );\n  assertNotExpired(payload.typedDataValue.validUntil, options.now ?? Date.now);\n\n  const recoveredSigner = recoverSignerFromKnownDomain({\n    domain: IDENTITY_DOMAIN,\n    types: IDENTITY_ATTESTATION_TYPES,\n    value: { ...payload.typedDataValue },\n    signature: payload.signature,\n  });\n  assertTrustedPayloadSigner({\n    payloadSigner: payload.signer,\n    recoveredSigner,\n    trustedSigners: options.trustedSigners,\n  });\n\n  return payload.identity;\n}\n\nfunction hashIdentityData(details: NormalizedIdentityDetails): string {\n  const canonicalFields = {\n    platform: details.platform,\n    actionType: details.actionType,\n    payeeId: details.payeeId,\n    username: details.username,\n    metadata: sortMetadata(details.metadata),\n  };\n  const canonical = JSON.stringify(\n    Object.fromEntries(IDENTITY_CANONICAL_FIELD_ORDER.map((field) => [field, canonicalFields[field]])),\n  );\n\n  return hashUtf8(canonical);\n}\n\nfunction sortMetadata(metadata: Record<string, string>): Record<string, string> {\n  return Object.fromEntries(Object.entries(metadata).sort(([left], [right]) => left.localeCompare(right)));\n}\n\nfunction assertNotExpired(validUntil: string, now: () => number): void {\n  const nowMs = now();\n  if (BigInt(nowMs) > BigInt(validUntil)) {\n    fail(\"ATTESTATION_EXPIRED\", \"Identity attestation validUntil is in the past\", {\n      details: { validUntil, nowMs },\n    });\n  }\n}\n","import {\n  assertLowercaseHexEqual,\n  assertStringEqual,\n  assertTrustedSigner,\n  hashUtf8,\n  recoverSignerFromKnownDomain,\n  requireVerifierOption,\n  SELLER_CREDENTIAL_BUNDLE_DOMAIN,\n  SELLER_CREDENTIAL_BUNDLE_TYPES,\n} from \"./eip712\";\nimport { fail } from \"./errors\";\nimport type {\n  SellerCredentialBundleFor,\n  SellerCredentialUploadPlatform,\n  VerifySellerCredentialBundleOptionsFor,\n} from \"./types\";\n\nexport function verifySellerCredentialBundle<P extends SellerCredentialUploadPlatform>(\n  bundle: SellerCredentialBundleFor<P>,\n  options: VerifySellerCredentialBundleOptionsFor<P>,\n): SellerCredentialBundleFor<P> {\n  assertStringEqual(bundle.platform, options.expectedPlatform, \"platform\");\n  assertLowercaseHexEqual(\n    bundle.payeeIdHash,\n    requireVerifierOption(options.expectedPayeeIdHash, \"expectedPayeeIdHash\"),\n    \"payeeIdHash\",\n  );\n  assertCredentialNotExpired(bundle.credentialExpiresAt, options.now ?? Date.now);\n\n  const recoveredSigner = recoverSignerFromKnownDomain({\n    domain: SELLER_CREDENTIAL_BUNDLE_DOMAIN,\n    types: SELLER_CREDENTIAL_BUNDLE_TYPES,\n    value: buildSellerCredentialBundleValue(bundle),\n    signature: bundle.bundleSignature,\n  });\n  assertTrustedSigner(recoveredSigner, options.trustedSigners);\n\n  return bundle;\n}\n\nfunction buildSellerCredentialBundleValue(bundle: SellerCredentialBundleFor<SellerCredentialUploadPlatform>) {\n  return {\n    platform: bundle.platform,\n    payeeIdHash: bundle.payeeIdHash,\n    encryptedBlobHash: hashUtf8(bundle.encryptedBlob),\n    encryptedDataKeyHash: hashUtf8(bundle.encryptedDataKey),\n    nonceHash: hashUtf8(bundle.nonce),\n    credentialType: bundle.credentialType,\n    credentialValidatedAt: bundle.credentialValidatedAt,\n    credentialExpiresAt: bundle.credentialExpiresAt ?? \"\",\n  };\n}\n\nfunction assertCredentialNotExpired(credentialExpiresAt: string | null, now: () => number): void {\n  const nowMs = now();\n  if (credentialExpiresAt !== null && BigInt(nowMs) > BigInt(credentialExpiresAt)) {\n    fail(\"ATTESTATION_EXPIRED\", \"Seller credential bundle credentialExpiresAt is in the past\", {\n      details: { credentialExpiresAt, nowMs },\n    });\n  }\n}\n"],"mappings":"ubAAA,IAAAA,GAAA,GAAAC,GAAAD,GAAA,2CAAAE,EAAA,uBAAAC,EAAA,0BAAAC,EAAA,2CAAAC,EAAA,0CAAAC,EAAA,2CAAAC,EAAA,0CAAAC,EAAA,iCAAAC,GAAA,mCAAAC,EAAA,kCAAAC,EAAA,mCAAAC,EAAA,kCAAAC,EAAA,8BAAAC,EAAA,sCAAAC,GAAA,6CAAAC,GAAA,aAAAC,EAAA,+BAAAC,EAAA,2BAAAC,GAAA,0BAAAC,GAAA,qCAAAC,GAAA,kBAAAC,GAAA,6BAAAC,GAAA,8BAAAC,GAAA,iCAAAC,KAAA,eAAAC,GAAA1B,ICgCO,IAAM2B,EAAN,cAAoC,KAAM,CACtC,KACS,MACT,QAET,YACEC,EACAC,EACAC,EAAkE,CAAC,EACnE,CACA,MAAMD,CAAO,EACb,KAAK,KAAO,wBACZ,KAAK,KAAOD,EACZ,KAAK,MAAQE,EAAQ,MACrB,KAAK,QAAUA,EAAQ,OACzB,CACF,EAEO,SAASC,EACdH,EACAC,EACAC,EACO,CACP,MAAM,IAAIH,EAAsBC,EAAMC,EAASC,CAAO,CACxD,CAEA,eAAsBE,EACpBC,EACAL,EACAC,EACY,CACZ,GAAI,CACF,OAAO,MAAMI,CACf,OAASC,EAAO,CACdH,EAAKH,EAAMC,EAAS,CAAE,MAAAK,CAAM,CAAC,CAC/B,CACF,CC7DO,SAASC,EAAaC,EAA4C,CACvE,OAAIA,IAAkB,QAChB,OAAOA,GAAkB,YAC3BC,EAAK,qBAAsB,mDAAmD,EAEzED,IAGL,OAAO,WAAW,OAAU,YAC9BC,EAAK,qBAAsB,mDAAmD,EAEzE,WAAW,MAAM,KAAK,UAAU,EACzC,CAEO,SAASC,GAAcC,EAA6C,CACzE,IAAMC,EAASD,GAAkB,WAAW,QAAQ,OACpD,OAAKC,GACHH,EAAK,qBAAsB,iDAAiD,EAEvEG,CACT,CAEO,SAASC,GACdC,EACiC,CACjC,GAAIA,EACF,OAAOA,EAGT,IAAMC,EAAY,WAAW,OAC7B,OAAI,OAAOA,GAAW,iBAAoB,YACxCN,EAAK,qBAAsB,oEAAoE,EAEzFO,GAAoBD,EAAU,gBAAgBC,CAAG,CAC3D,CAEO,SAASC,EAAsBC,EAGd,CACtB,MAAO,CACL,OAAQR,GAAcQ,EAAO,MAAM,EACnC,gBAAiBL,GAAuBK,EAAO,eAAe,CAChE,CACF,CAEO,SAASC,GAASP,EAAsBQ,EAA0D,CACvG,OAAI,OAAOA,GAAoB,YAC7BX,EAAK,qBAAsB,oEAAoE,EAE1F,CACL,OAAAG,EACA,gBAAAQ,EACA,WAAY,IAAMC,GAAaD,CAAe,CAChD,CACF,CAEA,SAASC,GACPD,EACqD,CACrD,IAAME,EAAQF,EAAgB,IAAI,WAAW,EAAE,CAAC,EAChDE,EAAM,CAAC,EAAKA,EAAM,CAAC,EAAI,GAAQ,GAC/BA,EAAM,CAAC,EAAKA,EAAM,CAAC,EAAI,GAAQ,IAC/B,IAAMC,EAAM,MAAM,KAAKD,EAAQE,GAASA,EAAK,SAAS,EAAE,EAAE,SAAS,EAAG,GAAG,CAAC,EAC1E,MAAO,GAAGD,EAAI,MAAM,EAAG,CAAC,EAAE,KAAK,EAAE,CAAC,IAAIA,EAAI,MAAM,EAAG,CAAC,EAAE,KAAK,EAAE,CAAC,IAAIA,EAAI,MAAM,EAAG,CAAC,EAAE,KAAK,EAAE,CAAC,IAAIA,EAC3F,MAAM,EAAG,EAAE,EACX,KAAK,EAAE,CAAC,IAAIA,EAAI,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EACvC,CC1EA,IAAME,EAAkB,mEAClBC,EAAgBC,GAAYF,CAAe,EAEjD,SAASE,GAAYC,EAA0C,CAC7D,IAAMC,EAAiC,CAAC,EACxC,QAASC,EAAQ,EAAGA,EAAQF,EAAS,OAAQE,GAAS,EACpDD,EAAOD,EAASE,CAAK,CAAC,EAAIA,EAE5B,OAAOD,CACT,CAEO,SAASE,EAAWC,EAA2B,CACpD,IAAIC,EAAM,GACV,QAAWC,KAAQF,EACjBC,GAAOC,EAAK,SAAS,EAAE,EAAE,SAAS,EAAG,GAAG,EAE1C,OAAOD,CACT,CAmBO,SAASE,EAAWC,EAA2B,CACpD,GAAI,OAAO,YAAgB,IACzB,OAAO,IAAI,YAAY,EAAE,OAAOA,CAAK,EAGvC,IAAMC,EAAkB,CAAC,EACzB,QAASC,EAAQ,EAAGA,EAAQF,EAAM,OAAQE,GAAS,EAAG,CACpD,IAAMC,EAAYH,EAAM,YAAYE,CAAK,EACrCC,EAAY,QACdD,GAAS,GAEPC,GAAa,IACfF,EAAM,KAAKE,CAAS,EACXA,GAAa,KACtBF,EAAM,KAAK,IAAQE,GAAa,EAAI,IAAQA,EAAY,EAAK,EACpDA,GAAa,MACtBF,EAAM,KAAK,IAAQE,GAAa,GAAK,IAASA,GAAa,EAAK,GAAO,IAAQA,EAAY,EAAK,EAEhGF,EAAM,KACJ,IAAQE,GAAa,GACrB,IAASA,GAAa,GAAM,GAC5B,IAASA,GAAa,EAAK,GAC3B,IAAQA,EAAY,EACtB,CAEJ,CACA,OAAO,IAAI,WAAWF,CAAK,CAC7B,CAEO,SAASG,EAAWH,EAA2B,CACpD,GAAI,OAAO,YAAgB,IACzB,OAAO,IAAI,YAAY,EAAE,OAAOA,CAAK,EAGvC,IAAII,EAAM,GACV,QAASH,EAAQ,EAAGA,EAAQD,EAAM,OAAQC,GAAS,EAAG,CACpD,IAAMI,EAAQL,EAAMC,CAAK,EACrBI,EAAQ,IACVD,GAAO,OAAO,cAAcC,CAAK,GACvBA,EAAQ,OAAU,IAC5BD,GAAO,OAAO,eAAgBC,EAAQ,KAAS,EAAML,EAAM,EAAEC,CAAK,EAAI,EAAK,GACjEI,EAAQ,OAAU,IAC5BD,GAAO,OAAO,eAAgBC,EAAQ,KAAS,IAAQL,EAAM,EAAEC,CAAK,EAAI,KAAS,EAAMD,EAAM,EAAEC,CAAK,EAAI,EAAK,EAE7GG,GAAO,OAAO,eACVC,EAAQ,IAAS,IACfL,EAAM,EAAEC,CAAK,EAAI,KAAS,IAC1BD,EAAM,EAAEC,CAAK,EAAI,KAAS,EAC3BD,EAAM,EAAEC,CAAK,EAAI,EACtB,CAEJ,CACA,OAAOG,CACT,CAEO,SAASE,GAAaN,EAA2B,CACtD,IAAII,EAAM,GACV,QAASH,EAAQ,EAAGA,EAAQD,EAAM,OAAQC,GAAS,EAAG,CACpD,IAAMI,EAAQL,EAAMC,CAAK,EACnBM,EAASP,EAAMC,EAAQ,CAAC,GAAK,EAC7BO,EAAQR,EAAMC,EAAQ,CAAC,GAAK,EAC5BQ,EAAWJ,GAAS,GAAOE,GAAU,EAAKC,EAEhDJ,GAAOM,EAAiBD,GAAW,GAAM,EAAI,EAC7CL,GAAOM,EAAiBD,GAAW,GAAM,EAAI,EAC7CL,GAAOH,EAAQ,EAAID,EAAM,OAASU,EAAiBD,GAAW,EAAK,EAAI,EAAI,IAC3EL,GAAOH,EAAQ,EAAID,EAAM,OAASU,EAAgBD,EAAU,EAAI,EAAI,GACtE,CACA,OAAOL,CACT,CAEO,SAASO,GAAaZ,EAA2B,CACtD,OAAOa,GAAab,EAAO,EAAK,CAClC,CAEO,SAASc,EAAgBb,EAA2B,CACzD,OAAOM,GAAaN,CAAK,EAAE,WAAW,IAAK,GAAG,EAAE,WAAW,IAAK,GAAG,EAAE,QAAQ,MAAO,EAAE,CACxF,CAMA,SAASc,GAAaC,EAAeC,EAA8B,CACjE,IAAMC,EAAWF,EAAM,QAAQ,OAAQ,EAAE,EACnCG,EAAaF,EAAUC,EAAS,WAAW,IAAK,GAAG,EAAE,WAAW,IAAK,GAAG,EAAIA,EAClF,GAAIC,EAAW,OAAS,IAAM,EAC5B,MAAM,IAAI,MAAM,uBAAuB,EAEzC,IAAMC,EAASD,EAAa,IAAI,QAAQ,EAAKA,EAAW,OAAS,GAAM,CAAC,EAElEE,EAAkB,CAAC,EACzB,QAASC,EAAQ,EAAGA,EAAQF,EAAO,OAAQE,GAAS,EAAG,CACrD,IAAMC,EAAQH,EAAO,MAAME,EAAOA,EAAQ,CAAC,EACrCE,EAAMD,EAAM,SAAS,IAAI,EAAI,EAAIA,EAAM,SAAS,GAAG,EAAI,EAAI,EAC3DE,EAAIC,EAAaH,EAAM,CAAC,EAAGI,CAAa,EACxCC,EAAIF,EAAaH,EAAM,CAAC,EAAGI,CAAa,EACxCE,EAAIN,EAAM,CAAC,IAAM,IAAM,EAAIG,EAAaH,EAAM,CAAC,EAAGI,CAAa,EAC/DG,GAAIP,EAAM,CAAC,IAAM,IAAM,EAAIG,EAAaH,EAAM,CAAC,EAAGI,CAAa,EAC/DI,EAAWN,GAAK,GAAOG,GAAK,GAAOC,GAAK,EAAKC,GAEnDT,EAAM,KAAMU,GAAW,GAAM,GAAI,EAC7BP,EAAM,GACRH,EAAM,KAAMU,GAAW,EAAK,GAAI,EAE9BP,EAAM,GACRH,EAAM,KAAKU,EAAU,GAAI,CAE7B,CACA,OAAO,IAAI,WAAWV,CAAK,CAC7B,CAEA,SAASK,EAAaM,EAAcC,EAAwC,CAC1E,IAAMjB,EAAQiB,EAAOD,CAAI,EACzB,GAAIhB,IAAU,OACZ,MAAM,IAAI,MAAM,6BAA6BgB,CAAI,EAAE,EAErD,OAAOhB,CACT,CAEO,SAASkB,EAAYC,EAAiC,CAC3D,IAAMC,EAAQD,EAAM,OAAO,CAACE,EAAKC,IAASD,EAAMC,EAAK,OAAQ,CAAC,EACxDC,EAAM,IAAI,WAAWH,CAAK,EAC5BI,EAAS,EACb,QAAWF,KAAQH,EACjBI,EAAI,IAAID,EAAME,CAAM,EACpBA,GAAUF,EAAK,OAEjB,OAAOC,CACT,CAMO,SAASE,EAAmBC,EAAgC,CACjE,OAAO,IAAI,WAAWA,CAAK,EAAE,MAC/B,CC3JO,SAASC,GACdC,EAKiC,CACjC,IAAMC,EAAY,CAChB,gBAAiBD,EAAO,gBACxB,GAAIA,EAAO,gBAAkB,OAAY,CAAE,cAAeA,EAAO,aAAc,EAAI,CAAC,EACpF,kBAAmBA,EAAO,IAAI,mBAC9B,WAAYA,EAAO,WACnB,MAAOA,EAAO,KAChB,EAEA,OAAIA,EAAO,WAAa,QAAUA,EAAO,WAAa,WAC7CC,EAGF,CACL,QAASD,EAAO,QAChB,GAAGC,CACL,CACF,CAEO,SAASC,GAAiCF,EAKjB,CAE9B,MAAO,CACL,SAAUA,EAAO,SACjB,WAAYA,EAAO,WACnB,gBAAiBA,EAAO,gBACxB,kBAAmBA,EAAO,IAAI,kBAChC,CACF,CAEO,SAASG,GACdF,EACQ,CACR,OAAO,KAAK,UAAUA,CAAS,CACjC,CC5CA,IAAMG,GAAuB,CAAE,IAAK,eAAgB,IAAK,SAAU,EAC7DC,GAAiB,0BAEvB,eAAsBC,GAAgDC,EAKlD,CAClB,IAAMC,EAAaD,EAAO,QAAQ,YAAcA,EAAO,IAAI,EACrDE,EAAQF,EAAO,QAAQ,OAASG,GAAaH,EAAO,eAAe,EACzE,OAAAI,GAAYF,CAAK,EAEVG,GAA2C,CAChD,IAAKL,EAAO,QAAQ,IACpB,UAAWM,GAAqC,CAC9C,GAAGN,EAAO,QACV,WAAAC,EACA,MAAAC,CACF,CAAC,EACD,OAAQF,EAAO,OACf,gBAAiBA,EAAO,gBACxB,eAAgB,0BAClB,CAAC,CACH,CAEA,eAAsBO,GAEpBP,EAIkB,CAClB,OAAOQ,GAA4C,CACjD,GAAGR,EACH,eAAgB,4BAClB,CAAC,CACH,CAEA,eAAsBS,GAAoFT,EAItF,CAClB,OAAOQ,GAA4C,CACjD,GAAGR,EACH,eAAgB,2BAClB,CAAC,CACH,CAEA,eAAsBU,GAA2EV,EAI7E,CAClB,OAAOQ,GAA4C,CACjD,GAAGR,EACH,eAAgB,0BAClB,CAAC,CACH,CAEA,eAAeQ,GAA4CR,EAUvC,CAClB,OAAOK,GAA2C,CAChD,IAAKL,EAAO,QAAQ,IACpB,UAAWW,GAAiCX,EAAO,OAAO,EAC1D,OAAQA,EAAO,OACf,gBAAiBA,EAAO,gBACxB,eAAgBA,EAAO,cACzB,CAAC,CACH,CAEA,eAAeK,GAA2CL,EAMtC,CAClB,IAAMY,EAAYC,EAAWC,GAAyBd,EAAO,SAAS,CAAC,EAEjEe,EAAMf,EAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,EAC/CgB,EAAS,MAAMC,EACnBjB,EAAO,OAAO,UACZ,OACAkB,EAAmBlB,EAAO,IAAI,YAAY,EAC1C,CAAE,KAAM,WAAY,KAAM,SAAU,EACpC,GACA,CAAC,SAAS,CACZ,EACA,qBACA,yDACF,EACMmB,EAAe,IAAI,WACvB,MAAMF,EACJjB,EAAO,OAAO,QAAQ,CAAE,KAAM,UAAW,EAAGgB,EAAQE,EAAmBH,CAAG,CAAC,EAC3E,qBACA,uDACF,CACF,EAEMK,EAAKpB,EAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,EAC9CqB,EAAkBC,EAAgBT,EAAW,KAAK,UAAUhB,EAAoB,CAAC,CAAC,EAClF0B,EAAMV,EAAWQ,CAAe,EAChCG,EAAS,MAAMP,EACnBjB,EAAO,OAAO,UAAU,MAAOkB,EAAmBH,CAAG,EAAG,CAAE,KAAM,UAAW,OAAQ,GAAI,EAAG,GAAO,CAAC,SAAS,CAAC,EAC5G,qBACA,2DACF,EACMU,EAAqB,IAAI,WAC7B,MAAMR,EACJjB,EAAO,OAAO,QACZ,CACE,KAAM,UACN,GAAIkB,EAAmBE,CAAE,EACzB,eAAgBF,EAAmBK,CAAG,EACtC,UAAW,GACb,EACAC,EACAN,EAAmBN,CAAS,CAC9B,EACA,qBACA,6BAA6BZ,EAAO,cAAc,EACpD,CACF,EACM0B,EAAaD,EAAmB,MAAM,EAAGA,EAAmB,OAAS,EAAE,EACvEE,EAAMF,EAAmB,MAAMA,EAAmB,OAAS,EAAE,EAEnE,MAAO,CACLJ,EACAC,EAAgBH,CAAY,EAC5BG,EAAgBF,CAAE,EAClBE,EAAgBI,CAAU,EAC1BJ,EAAgBK,CAAG,CACrB,EAAE,KAAK,GAAG,CACZ,CAGA,SAASvB,GAAYF,EAAqB,CACnCJ,GAAe,KAAKI,CAAK,GAC5B0B,EAAK,oBAAqB,0CAA0C,CAExE,CAGA,SAASzB,GAAa0B,EAA0D,CAC9E,IAAMC,EAAQD,EAAgB,IAAI,WAAW,EAAE,CAAC,EAChDC,EAAM,CAAC,EAAKA,EAAM,CAAC,EAAI,GAAQ,GAC/BA,EAAM,CAAC,EAAKA,EAAM,CAAC,EAAI,GAAQ,IAC/B,IAAMC,EAAM,MAAM,KAAKD,EAAQE,GAASA,EAAK,SAAS,EAAE,EAAE,SAAS,EAAG,GAAG,CAAC,EAC1E,MAAO,GAAGD,EAAI,MAAM,EAAG,CAAC,EAAE,KAAK,EAAE,CAAC,IAAIA,EAAI,MAAM,EAAG,CAAC,EAAE,KAAK,EAAE,CAAC,IAAIA,EAAI,MAAM,EAAG,CAAC,EAAE,KAAK,EAAE,CAAC,IAAIA,EAC3F,MAAM,EAAG,EAAE,EACX,KAAK,EAAE,CAAC,IAAIA,EAAI,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EACvC,CChLA,eAAsBE,EACpBC,EACiB,CACjB,IAAMC,EAASC,EAAsBF,CAAM,EAC3C,OAAOG,GAAiD,CACtD,QAASH,EACT,OAAQC,EAAO,OACf,gBAAiBA,EAAO,eAC1B,CAAC,CACH,CCbA,IAAAG,GAAgC,0BCAzB,IAAMC,EAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBrBC,EAAwC,mEDTrD,IAAMC,GAAgC,MAAc,GAAK,IAOzD,eAAsBC,GAAuBC,EAQP,CACpC,IAAMC,EAASC,GAASF,EAAO,OAAQA,EAAO,eAAe,EACvDG,EAAkBC,GAAiBJ,EAAO,SAAWK,EAAoB,4BAA4B,EACrGC,EAAkB,MAAMC,GAAkBJ,EAAiBH,EAAO,MAAM,EAE1EM,IAAoBE,GACtBC,EAAK,gCAAiC,0DAA2D,CAC/F,QAAS,CAAE,SAAUD,EAAuC,OAAQF,CAAgB,CACtF,CAAC,EAGH,IAAMI,EAAkBN,GAAiBJ,EAAO,mBAAoB,8BAA8B,EAC5FW,EAAWX,EAAO,YAAY,IAAI,CAACY,EAAKC,IAAUT,GAAiBQ,EAAK,YAAYC,CAAK,GAAG,CAAC,EAC7FC,EAAkB,CAACX,EAAiB,GAAGQ,EAAUD,CAAe,EACtE,QAAWK,KAAeD,EACxBE,GAA2BD,EAAaf,EAAO,KAAK,EACpDiB,GAAeF,EAAaf,EAAO,MAAOA,EAAO,SAAS,EAG5D,IAAMkB,EAAkB,MAAMX,GAAkBG,EAAiBV,EAAO,MAAM,EACxEmB,EAAgB,CAAC,EACvB,QAAWJ,KAAeJ,EAAU,CAClC,IAAMS,EAAc,MAAMb,GAAkBQ,EAAaf,EAAO,MAAM,EAClEoB,IAAgBF,GAAmBE,IAAgBd,GACrDa,EAAc,KAAKJ,CAAW,CAElC,CAEA,IAAMM,EAAa,CACjB,CAACX,EAAiB,GAAGS,EAAc,MAAM,EAAE,QAAQ,EAAGhB,CAAe,EACrE,CAACO,EAAiB,GAAGS,EAAehB,CAAe,CACrD,EAEA,QAAWmB,KAAaD,EACtB,GAAI,MAAME,GAAiBD,EAAWrB,CAAM,EAAG,CAC7C,IAAMuB,EAAgB,MAAMC,EAC1Bf,EAAgB,UAAU,OAAO,CAAE,KAAM,QAAS,WAAY,OAAQ,EAAG,CAAC,QAAQ,EAAGT,CAAM,EAC3F,qBACA,8CACF,EACA,MAAO,CAAE,gBAAAS,EAAiB,cAAAc,CAAc,CAC1C,CAGFf,EAAK,qBAAsB,4EAA4E,CACzG,CAEA,eAAec,GAAiBG,EAA0BzB,EAAkC,CAC1F,QAASY,EAAQ,EAAGA,EAAQa,EAAM,OAAS,EAAGb,GAAS,EAAG,CACxD,IAAMc,EAAUD,EAAMb,CAAK,EACrBe,EAASF,EAAMb,EAAQ,CAAC,EAE9B,GAAI,CADO,MAAMc,EAAQ,OAAO,CAAE,UAAWC,EAAO,UAAW,cAAe,EAAK,EAAG3B,CAAM,EAE1F,MAAO,EAEX,CAEA,OAAOyB,EAAM,OAAS,GAAM,MAAMA,EAAMA,EAAM,OAAS,CAAC,EAAE,aAAazB,CAAM,CAC/E,CAEA,SAASG,GAAiByB,EAA0BC,EAAgC,CAClF,GAAI,CACF,OAAO,IAAI,mBAAgBD,CAAG,CAChC,OAASE,EAAO,CACdtB,EAAK,qBAAsB,mBAAmBqB,CAAK,GAAI,CAAE,MAAAC,CAAM,CAAC,CAClE,CACF,CAEA,eAAexB,GAAkBQ,EAA8BiB,EAAuC,CACpG,OAAOC,EAAW,IAAI,WAAW,MAAMD,EAAO,OAAO,UAAWjB,EAAY,OAAO,CAAC,CAAC,CACvF,CAEA,SAASC,GAA2BD,EAA8BmB,EAAqB,EACjFA,EAAQnB,EAAY,UAAU,QAAQ,GAAKmB,EAAQnB,EAAY,SAAS,QAAQ,IAClFN,EAAK,sBAAuB,6CAA8C,CACxE,QAAS,CACP,QAASM,EAAY,QACrB,UAAWA,EAAY,UAAU,YAAY,EAC7C,SAAUA,EAAY,SAAS,YAAY,CAC7C,CACF,CAAC,CAEL,CAEA,SAASE,GACPF,EACAmB,EACAC,EACM,CACFpB,EAAY,SAAS,QAAQ,EAAImB,EAAQpC,IAC3CqC,IAAY,CACV,KAAM,4BACN,QAAS,+DACT,QAAS,CACP,QAASpB,EAAY,QACrB,SAAUA,EAAY,SAAS,YAAY,CAC7C,CACF,CAAC,CAEL,CE7GO,SAASqB,EAAWC,EAA8B,CACvD,IAAMC,EAAS,IAAIC,GAAWF,CAAK,EAC7BG,EAAQF,EAAO,UAAU,EAC/B,GAAI,CAACA,EAAO,KAAK,EACf,MAAM,IAAI,MAAM,qBAAqB,EAEvC,OAAOE,CACT,CAEO,SAASC,EAAWD,EAA8B,CACvD,GAAI,OAAOA,GAAU,SAAU,CAC7B,GAAI,CAAC,OAAO,cAAcA,CAAK,EAC7B,MAAM,IAAI,MAAM,oCAAoC,EAEtD,OAAOA,GAAS,EAAIE,EAAoB,EAAGF,CAAK,EAAIE,EAAoB,EAAG,GAAKF,CAAK,CACvF,CACA,GAAI,OAAOA,GAAU,SACnB,OAAOA,GAAS,GAAKE,EAAoB,EAAGF,CAAK,EAAIE,EAAoB,EAAG,CAAC,GAAKF,CAAK,EAEzF,GAAI,OAAOA,GAAU,SAAU,CAC7B,IAAMG,EAAUC,EAAWJ,CAAK,EAChC,OAAOK,EAAY,CAACH,EAAoB,EAAGC,EAAQ,MAAM,EAAGA,CAAO,CAAC,CACtE,CACA,GAAIH,aAAiB,WACnB,OAAOK,EAAY,CAACH,EAAoB,EAAGF,EAAM,MAAM,EAAGA,CAAK,CAAC,EAElE,GAAI,MAAM,QAAQA,CAAK,EACrB,OAAOK,EAAY,CAACH,EAAoB,EAAGF,EAAM,MAAM,EAAG,GAAGA,EAAM,IAAIC,CAAU,CAAC,CAAC,EAErF,GAAID,aAAiB,IAEnB,OAAOK,EAAY,CACjBH,EAAoB,EAAGF,EAAM,IAAI,EACjC,GAAG,MAAM,KAAKA,EAAM,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAACM,EAAGC,CAAC,IAAM,CAACN,EAAWK,CAAC,EAAGL,EAAWM,CAAC,CAAC,CAAC,CACnF,CAAC,EAEH,GAAI,OAAOP,GAAU,UACnB,OAAO,IAAI,WAAW,CAACA,EAAQ,IAAO,GAAI,CAAC,EAE7C,GAAIA,IAAU,KACZ,OAAO,IAAI,WAAW,CAAC,GAAI,CAAC,EAE9B,MAAM,IAAI,MAAM,wBAAwB,CAC1C,CAEO,SAASQ,GAAwBC,EAAmCC,EAAsC,CAC/G,OAAOT,EAAW,CAAC,aAAcQ,EAAuB,IAAI,WAAcC,CAAY,CAAC,CACzF,CAEA,SAASR,EAAoBS,EAAmBC,EAAqC,CACnF,IAAMC,EAAe,OAAOD,CAAM,EAClC,OAAIC,EAAe,IACV,IAAI,WAAW,CAAEF,GAAa,EAAK,OAAOE,CAAY,CAAC,CAAC,EAE7DA,GAAgB,MACX,IAAI,WAAW,CAAEF,GAAa,EAAK,GAAI,OAAOE,CAAY,CAAC,CAAC,EAEjEA,GAAgB,QACX,IAAI,WAAW,CAAEF,GAAa,EAAK,GAAI,OAAQE,GAAgB,GAAM,KAAK,EAAG,OAAOA,EAAe,KAAK,CAAC,CAAC,EAE/GA,GAAgB,YACX,IAAI,WAAW,CACnBF,GAAa,EAAK,GACnB,OAAQE,GAAgB,IAAO,KAAK,EACpC,OAAQA,GAAgB,IAAO,KAAK,EACpC,OAAQA,GAAgB,GAAM,KAAK,EACnC,OAAOA,EAAe,KAAK,CAC7B,CAAC,EAGI,IAAI,WAAW,CACnBF,GAAa,EAAK,GACnB,OAAQE,GAAgB,IAAO,KAAK,EACpC,OAAQA,GAAgB,IAAO,KAAK,EACpC,OAAQA,GAAgB,IAAO,KAAK,EACpC,OAAQA,GAAgB,IAAO,KAAK,EACpC,OAAQA,GAAgB,IAAO,KAAK,EACpC,OAAQA,GAAgB,IAAO,KAAK,EACpC,OAAQA,GAAgB,GAAM,KAAK,EACnC,OAAOA,EAAe,KAAK,CAC7B,CAAC,CACH,CAEA,IAAMd,GAAN,KAAiB,CAGf,YAA6BF,EAAmB,CAAnB,WAAAA,CAAoB,CAApB,MAFrB,OAAS,EAIjB,MAAgB,CACd,OAAO,KAAK,SAAW,KAAK,MAAM,MACpC,CAEA,WAAuB,CACrB,IAAMiB,EAAO,KAAK,SAAS,EACrBH,EAAYG,GAAQ,EACpBC,EAAaD,EAAO,GAE1B,GAAIC,IAAe,GACjB,OAAO,KAAK,oBAAoBJ,CAAS,EAG3C,GAAIA,IAAc,EAChB,OAAO,KAAK,WAAWI,CAAU,EAEnC,GAAIJ,IAAc,EAAG,CACnB,IAAMX,EAAQ,KAAK,WAAWe,CAAU,EACxC,OAAO,OAAOf,GAAU,SAAW,CAAC,GAAKA,EAAQ,GAAKA,CACxD,CACA,GAAIW,IAAc,EAAG,CACnB,IAAMC,EAAS,KAAK,eAAe,KAAK,WAAWG,CAAU,CAAC,EAC9D,OAAO,KAAK,UAAUH,CAAM,CAC9B,CACA,GAAID,IAAc,EAAG,CACnB,IAAMC,EAAS,KAAK,eAAe,KAAK,WAAWG,CAAU,CAAC,EAC9D,OAAOC,EAAW,KAAK,UAAUJ,CAAM,CAAC,CAC1C,CACA,GAAID,IAAc,EAAG,CACnB,IAAMC,EAAS,KAAK,eAAe,KAAK,WAAWG,CAAU,CAAC,EACxDE,EAAmB,CAAC,EAC1B,QAASC,EAAQ,EAAGA,EAAQN,EAAQM,GAAS,EAC3CD,EAAI,KAAK,KAAK,UAAU,CAAC,EAE3B,OAAOA,CACT,CACA,GAAIN,IAAc,EAAG,CACnB,IAAMC,EAAS,KAAK,eAAe,KAAK,WAAWG,CAAU,CAAC,EACxDE,EAAM,IAAI,IAChB,QAASC,EAAQ,EAAGA,EAAQN,EAAQM,GAAS,EAC3CD,EAAI,IAAI,KAAK,UAAU,EAAG,KAAK,UAAU,CAAC,EAE5C,OAAOA,CACT,CACA,GAAIN,IAAc,EAChB,YAAK,WAAWI,CAAU,EACnB,KAAK,UAAU,EAExB,GAAIJ,IAAc,EAAG,CACnB,GAAII,IAAe,GACjB,MAAO,GAET,GAAIA,IAAe,GACjB,MAAO,GAET,GAAIA,IAAe,GACjB,OAAO,IAEX,CACA,MAAM,IAAI,MAAM,2CAA2CJ,CAAS,IAAII,CAAU,EAAE,CACtF,CAEQ,oBAAoBJ,EAA8B,CACxD,GAAIA,IAAc,EAAG,CACnB,IAAMQ,EAAuB,CAAC,EAC9B,KAAO,CAAC,KAAK,aAAa,GAAG,CAC3B,IAAMC,EAAQ,KAAK,UAAU,EAC7B,GAAI,EAAEA,aAAiB,YACrB,MAAM,IAAI,MAAM,yDAAyD,EAE3ED,EAAO,KAAKC,CAAK,CACnB,CACA,OAAOf,EAAYc,CAAM,CAC3B,CACA,GAAIR,IAAc,EAAG,CACnB,IAAIM,EAAM,GACV,KAAO,CAAC,KAAK,aAAa,GAAG,CAC3B,IAAMG,EAAQ,KAAK,UAAU,EAC7B,GAAI,OAAOA,GAAU,SACnB,MAAM,IAAI,MAAM,yDAAyD,EAE3EH,GAAOG,CACT,CACA,OAAOH,CACT,CACA,GAAIN,IAAc,EAAG,CACnB,IAAMM,EAAmB,CAAC,EAC1B,KAAO,CAAC,KAAK,aAAa,GACxBA,EAAI,KAAK,KAAK,UAAU,CAAC,EAE3B,OAAOA,CACT,CACA,GAAIN,IAAc,EAAG,CACnB,IAAMM,EAAM,IAAI,IAChB,KAAO,CAAC,KAAK,aAAa,GAAG,CAC3B,IAAMI,EAAM,KAAK,UAAU,EAC3B,GAAI,KAAK,UAAU,EACjB,MAAM,IAAI,MAAM,uCAAuC,EAEzDJ,EAAI,IAAII,EAAK,KAAK,UAAU,CAAC,CAC/B,CACA,OAAOJ,CACT,CACA,MAAM,IAAI,MAAM,8BAA8BN,CAAS,mBAAmB,CAC5E,CAEQ,WAAWI,EAAqC,CACtD,GAAIA,EAAa,GACf,OAAOA,EAET,GAAIA,IAAe,GACjB,OAAO,KAAK,SAAS,EAEvB,GAAIA,IAAe,GACjB,OAAQ,KAAK,SAAS,GAAK,EAAK,KAAK,SAAS,EAEhD,GAAIA,IAAe,GACjB,OAAQ,KAAK,SAAS,EAAI,UAAa,KAAK,SAAS,GAAK,KAAO,KAAK,SAAS,GAAK,GAAK,KAAK,SAAS,IAAO,EAEhH,GAAIA,IAAe,GAAI,CACrB,IAAIf,EAAQ,GACZ,QAASkB,EAAQ,EAAGA,EAAQ,EAAGA,GAAS,EACtClB,EAASA,GAAS,GAAM,OAAO,KAAK,SAAS,CAAC,EAEhD,OAAOA,GAAS,OAAO,OAAO,gBAAgB,EAAI,OAAOA,CAAK,EAAIA,CACpE,CACA,MAAM,IAAI,MAAM,2CAA2C,CAC7D,CAEQ,UAAmB,CACzB,GAAI,KAAK,QAAU,KAAK,MAAM,OAC5B,MAAM,IAAI,MAAM,8BAA8B,EAEhD,OAAO,KAAK,MAAM,KAAK,QAAQ,CACjC,CAEQ,WAAqB,CAC3B,OAAO,KAAK,OAAS,KAAK,MAAM,QAAU,KAAK,MAAM,KAAK,MAAM,IAAM,GACxE,CAEQ,cAAwB,CAC9B,OAAI,KAAK,UAAU,GACjB,KAAK,QAAU,EACR,IAEF,EACT,CAEQ,UAAUY,EAA4B,CAC5C,GAAI,KAAK,OAASA,EAAS,KAAK,MAAM,OACpC,MAAM,IAAI,MAAM,oCAAoC,EAEtD,IAAMK,EAAM,KAAK,MAAM,MAAM,KAAK,OAAQ,KAAK,OAASL,CAAM,EAC9D,YAAK,QAAUA,EACRK,CACT,CAEQ,eAAejB,EAAgC,CACrD,GAAI,OAAOA,GAAU,SACnB,MAAM,IAAI,MAAM,mDAAmD,EAErE,OAAOA,CACT,CACF,EC9PO,SAASsB,GAAgBC,EAAmD,CACjF,IAAMC,EAAWD,EAAoB,CAAC,IAAM,IAAOA,EAAoB,MAAM,CAAC,EAAIA,EAC9EE,EACJ,GAAI,CACFA,EAAUC,EAAWF,CAAQ,CAC/B,OAASG,EAAO,CACdC,EAAK,yBAA0B,4DAA6D,CAAE,MAAAD,CAAM,CAAC,CACvG,EAEI,CAAC,MAAM,QAAQF,CAAO,GAAKA,EAAQ,SAAW,IAChDG,EAAK,yBAA0B,iEAAiE,EAGlG,GAAM,CAACC,EAAuBC,EAAoBC,EAAcC,CAAS,EAAIP,EAC7E,OACE,EAAEI,aAAiC,aACnC,EAAEC,aAA8B,MAChC,EAAEC,aAAwB,aAC1B,EAAEC,aAAqB,cAEvBJ,EAAK,yBAA0B,2CAA2C,EAG5EK,GAAsBJ,CAAqB,EACvCG,EAAU,SAAW,IACvBJ,EAAK,8BAA+B,2CAA2CI,EAAU,MAAM,QAAQ,EAGlG,CAAE,sBAAAH,EAAuB,aAAAE,EAAc,UAAAC,CAAU,CAC1D,CAEA,eAAsBE,GAAoBC,EAMxB,CAChB,IAAMC,EAAeC,GAAwBF,EAAO,sBAAuBA,EAAO,YAAY,EACnF,MAAMG,EACfH,EAAO,OAAO,OAAO,CAAE,KAAM,QAAS,KAAM,SAAU,EAAGA,EAAO,cAAeA,EAAO,UAAWC,CAAY,EAC7G,+BACA,0CACF,GAEER,EAAK,+BAAgC,4EAA4E,CAErH,CAEA,SAASK,GAAsBJ,EAAyC,CACtE,IAAIJ,EACJ,GAAI,CACFA,EAAUC,EAAWG,CAAqB,CAC5C,OAASF,EAAO,CACdC,EAAK,yBAA0B,kDAAmD,CAAE,MAAAD,CAAM,CAAC,CAC7F,CACMF,aAAmB,KACvBG,EAAK,yBAA0B,2CAA2C,EAExEH,EAAQ,IAAI,CAAC,IAAM,KACrBG,EAAK,uBAAwB,+CAA+C,CAEhF,CCrEA,IAAMW,GAAkB,GAEjB,SAASC,EAAiBC,EAAeC,EAAuB,CACrE,IAAMC,EAAaF,EAAM,QAAQ,OAAQ,EAAE,EAAE,YAAY,EACzD,OAAIE,EAAW,SAAWJ,IAAmB,CAAC,cAAc,KAAKI,CAAU,IACzEC,EAAK,qBAAsB,GAAGF,CAAK,YAAYH,EAAe,2BAA2B,EAEpFI,CACT,CAEO,SAASE,GAAoBJ,EAAeC,EAAuB,CACxE,IAAMC,EAAaH,EAAiBC,EAAOC,CAAK,EAChD,OAAID,IAAUE,GACZC,EAAK,+BAAgC,GAAGF,CAAK,YAAYH,EAAe,2BAA2B,EAE9FI,CACT,CCdA,IAAMG,GAAiC,IAAM,KACvCC,GAA+B,EAC/BC,GAA+B,IAC/BC,GAAsB,sBAarB,SAASC,GAAoBC,EAA+BC,EAAuB,CACxF,IAAMC,EAAM,IAAI,IAAIF,CAAqB,EACnCG,EAAeD,EAAI,SAAS,QAAQ,OAAQ,EAAE,EACpD,OAAAA,EAAI,SAAWC,EAAa,SAAS,cAAc,EAAIA,EAAe,GAAGA,CAAY,eACrFD,EAAI,OAAS,GACbA,EAAI,aAAa,IAAI,QAASD,CAAQ,EAC/BC,CACT,CAEA,eAAsBE,GAAyBC,EAKd,CAC/B,IAAMH,EAAMH,GAAoBM,EAAO,sBAAuBA,EAAO,QAAQ,EACvEC,EAAW,MAAMC,GAAsBL,EAAI,SAAS,EAAGG,EAAO,MAAOA,EAAO,SAAS,EACrFG,EAAe,MAAMC,GAAiBH,CAAQ,EAC/CA,EAAS,IACZI,EAAK,2BAA4B,qCAAqCJ,EAAS,MAAM,GAAI,CACvF,QAAS,CAAE,OAAQA,EAAS,OAAQ,KAAME,EAAa,MAAM,EAAG,GAAG,CAAE,CACvE,CAAC,EAGH,IAAIG,EACJ,GAAI,CACFA,EAAO,KAAK,MAAMH,CAAY,CAChC,OAASI,EAAO,CACdF,EAAK,+BAAgC,8CAA+C,CAAE,MAAAE,CAAM,CAAC,CAC/F,CAEA,OAAOC,GAA4BF,CAAI,CACzC,CAEA,SAASE,GAA4BF,EAAoC,EACnE,CAACG,GAASH,CAAI,GAAKA,EAAK,UAAY,IAAQ,CAACG,GAASH,EAAK,cAAc,IAC3ED,EAAK,+BAAgC,mDAAmD,EAG1F,IAAMK,EAAiBJ,EAAK,gBACxB,OAAOI,EAAe,qBAAwB,UAAY,OAAOA,EAAe,OAAU,WAC5FL,EAAK,+BAAgC,8DAA8D,EAGrG,IAAIM,EACJ,GAAI,CACFA,EAAsBC,GAAaF,EAAe,mBAAmB,CACvE,OAASH,EAAO,CACdF,EAAK,+BAAgC,0CAA2C,CAAE,MAAAE,CAAM,CAAC,CAC3F,CACA,OAAII,EAAoB,SAAW,GACjCN,EAAK,+BAAgC,4CAA4C,EAG5E,CACL,oBAAAM,EACA,MAAOD,EAAe,MAAM,YAAY,EACxC,WAAY,CACV,QAAS,OAAOA,EAAe,SAAY,SAAWA,EAAe,QAAU,OAC/E,kBAAmBG,GAAqBH,EAAe,kBAAmB,mBAAmB,EAC7F,eAAgBG,GAAqBH,EAAe,eAAgB,gBAAgB,EACpF,aAAcI,GAA4BJ,EAAe,aAAc,cAAc,CACvF,CACF,CACF,CAEA,eAAeN,GAAiBH,EAAqC,CACnE,GAAI,CAACA,EAAS,KAAM,CAClB,IAAME,EAAe,MAAMF,EAAS,KAAK,EACzC,OAAAc,GAAmBC,EAAWb,CAAY,EAAE,MAAM,EAC3CA,CACT,CAEA,IAAMc,EAAShB,EAAS,KAAK,UAAU,EACjCiB,EAAuB,CAAC,EAC1BC,EAAa,EACjB,OAAa,CACX,GAAM,CAAE,KAAAC,EAAM,MAAAC,CAAM,EAAI,MAAMJ,EAAO,KAAK,EAC1C,GAAIG,EACF,MAEEC,IACFF,GAAcE,EAAM,OACpBN,GAAmBI,CAAU,EAC7BD,EAAO,KAAKG,CAAK,EAErB,CACA,OAAOC,EAAWC,EAAYL,CAAM,CAAC,CACvC,CAEA,SAASH,GAAmBI,EAA0B,CAChDA,EAAa7B,IACfe,EAAK,+BAAgC,kDAAmD,CACtF,QAAS,CAAE,SAAUf,GAAgC,YAAa6B,CAAW,CAC/E,CAAC,CAEL,CAEA,SAASN,GAAqBQ,EAAgBG,EAAmC,CAC/E,GAAIH,IAAU,OAGd,OAAI,OAAOA,GAAU,UAAY,CAAC5B,GAAoB,KAAK4B,CAAK,IAC9DhB,EAAK,+BAAgC,GAAGmB,CAAK,4CAA4C,EAEpFH,EAAM,YAAY,CAC3B,CAEA,SAASP,GAA4BO,EAAgBG,EAAmC,CACtF,GAAIH,IAAU,OAGd,CAAI,OAAOA,GAAU,UACnBhB,EAAK,+BAAgC,GAAGmB,CAAK,8CAA8C,EAE7F,GAAI,CACF,OAAOC,GAAoBJ,EAAOG,CAAK,CACzC,OAASjB,EAAO,CACdF,EAAK,+BAAgC,GAAGmB,CAAK,+CAAgD,CAAE,MAAAjB,CAAM,CAAC,CACxG,EACF,CAEA,eAAeL,GAAsBL,EAAa6B,EAAuBC,EAAsC,CAC7G,IAAIC,EAAU,EACd,OACE,GAAI,CACF,OAAO,MAAMC,GAAiBhC,EAAK6B,EAASC,CAAS,CACvD,OAASpB,EAAO,CACd,GAAI,CAACuB,GAA2BvB,CAAK,GAAKqB,GAAWrC,GACnD,MAAMgB,EAER,MAAMwB,GAAMvC,GAA+BoC,CAAO,EAClDA,GAAW,CACb,CAEJ,CAEA,eAAeC,GAAiBhC,EAAa6B,EAAuBC,EAAsC,CACxG,IAAMK,EAAa,OAAO,gBAAoB,IAAc,IAAI,gBAAoB,OAChFC,EACEC,EAAiB,IAAI,QAAe,CAACC,EAAGC,IAAW,CACvDH,EAAgB,WAAW,IAAM,CAC/BD,GAAY,MAAM,EAClBI,EAAO,IAAI,MAAM,SAAS,CAAC,CAC7B,EAAGT,CAAS,CACd,CAAC,EAED,GAAI,CACF,IAAM1B,EAAW,MAAM,QAAQ,KAAK,CAClCyB,EAAQ7B,EAAK,CACX,QAAS,CAAE,OAAQ,kBAAmB,EACtC,OAAQmC,GAAY,MACtB,CAAC,EACDE,CACF,CAAC,EACD,OAAID,IAAkB,QACpB,aAAaA,CAAa,EAErBhC,CACT,OAASM,EAAO,CACV0B,IAAkB,QACpB,aAAaA,CAAa,EAExB1B,aAAiB,QAAUA,EAAM,OAAS,cAAgBA,EAAM,UAAY,YAC9EF,EAAK,UAAW,oCAAoCsB,CAAS,KAAM,CAAE,MAAApB,CAAM,CAAC,EAE9EF,EAAK,2BAA4B,+CAAgD,CAC/E,MAAAE,EACA,QAAS,CAAE,MAAO,SAAU,CAC9B,CAAC,CACH,CACF,CAEA,SAASuB,GAA2BvB,EAAyB,CAC3D,OACEA,aAAiB8B,GACjB9B,EAAM,OAAS,4BACfA,EAAM,SAAS,QAAU,SAE7B,CAEA,SAASwB,GAAMO,EAA2B,CACxC,OAAO,IAAI,QAASC,GAAY,WAAWA,EAASD,CAAE,CAAC,CACzD,CAEA,SAAS7B,GAASY,EAAkD,CAClE,OAAO,OAAOA,GAAU,UAAYA,IAAU,MAAQ,CAAC,MAAM,QAAQA,CAAK,CAC5E,CC5MO,IAAMmB,GAAoB,GAE1B,SAASC,GAAiBC,EAA0D,CACzF,OAAOC,EAAWD,EAAgB,IAAI,WAAWF,EAAiB,CAAC,CAAC,CACtE,CAEO,SAASI,GAAgBC,EAAqBC,EAA6B,CAC5ED,EAAY,YAAY,IAAMC,GAChCC,EAAK,6BAA8B,+CAAgD,CACjF,QAAS,CAAE,cAAAD,EAAe,YAAAD,CAAY,CACxC,CAAC,CAEL,CCCO,SAASG,GAAyBC,EAAqD,CAC5F,IAAIC,EACJ,GAAI,CACFA,EAAUC,EAAWF,CAAY,CACnC,OAASG,EAAO,CACdC,EAAK,wBAAyB,8CAA+C,CAAE,MAAAD,CAAM,CAAC,CACxF,CAEA,IAAME,EAAUC,GAAWL,EAAS,SAAS,EACvCM,EAAOD,GAAWD,EAAQ,IAAI,MAAM,EAAG,MAAM,EAC7CG,EAAWC,EAAaJ,EAAQ,IAAI,WAAW,EAAG,WAAW,EAEnE,MAAO,CACL,YAAaK,GAAiBL,EAAQ,IAAI,WAAW,CAAC,EACtD,SAAUM,EAAWH,CAAQ,EAC7B,QAASI,GAAeL,EAAM,CAAC,EAC/B,QAASK,GAAeL,EAAM,CAAC,EAC/B,QAASK,GAAeL,EAAM,CAAC,EAC/B,QAASM,EAAWJ,EAAaF,EAAK,IAAI,CAAC,EAAG,SAAS,CAAC,EACxD,eAAgBE,EAAaJ,EAAQ,IAAI,aAAa,EAAG,aAAa,EACtE,YAAaS,GAAaT,EAAQ,IAAI,UAAU,EAAG,UAAU,EAAE,IAAI,CAACU,EAAOC,IACzEP,EAAaM,EAAO,YAAYC,CAAK,GAAG,CAC1C,EACA,aAAcP,EAAaJ,EAAQ,IAAI,YAAY,EAAG,YAAY,CACpE,CACF,CAEA,SAASO,GAAeL,EAA6BS,EAAuB,CAC1E,IAAMC,EAAQV,EAAK,IAAIS,CAAK,EAC5B,OAAOC,aAAiB,WAAaJ,EAAWI,CAAK,EAAI,EAC3D,CAEA,SAASP,GAAiBO,EAAwB,CAChD,GAAI,OAAOA,GAAU,UAAY,OAAO,cAAcA,CAAK,GAAKA,GAAS,EACvE,OAAOA,EAETb,EAAK,wBAAyB,gEAAgE,CAChG,CAEA,SAASE,GAAWW,EAAgBC,EAAsC,CACxE,GAAID,aAAiB,IACnB,OAAOA,EAETb,EAAK,wBAAyB,6BAA6Bc,CAAK,qBAAqB,CACvF,CAEA,SAAST,EAAaQ,EAAgBC,EAA2B,CAC/D,GAAID,aAAiB,WACnB,OAAOA,EAETb,EAAK,wBAAyB,6BAA6Bc,CAAK,wBAAwB,CAC1F,CAEA,SAASJ,GAAaG,EAAgBC,EAA0B,CAC9D,GAAI,MAAM,QAAQD,CAAK,EACrB,OAAOA,EAETb,EAAK,wBAAyB,6BAA6Bc,CAAK,mBAAmB,CACrF,CCvEO,IAAMC,GAAkC,gDAClCC,GAAqC,wCAErCC,GACX,mGACWC,GACX,mGAEWC,GAAwD,CACnE,wCAAyCC,EAAiBH,GAAc,sBAAsB,EAC9F,gCAAiCG,EAAiBF,GAAiB,yBAAyB,CAC9F,EAEaG,GAMT,CACF,QAAS,CACP,sBAAuBN,GACvB,gBAAiBE,EACnB,EACA,WAAY,CACV,sBAAuBD,GACvB,gBAAiBE,EACnB,CACF,ECzBO,SAASI,GAAoBC,EAKzB,CACT,GAAM,CAAE,MAAAC,EAAO,uBAAAC,EAAwB,UAAAC,CAAU,EAAIH,EAC/CI,EAAWJ,EAAO,SAAS,YAAY,EAE7C,GAAIC,GAAO,gBACT,OAAOI,EAAiBJ,EAAM,gBAAiB,uBAAuB,EAGxE,IAAMK,EAAWL,GAAO,mBAClBM,EAAUD,EAAWE,GAAYF,EAAUF,CAAQ,EAAI,OAC7D,GAAIG,EACF,OAAOF,EAAiBE,EAAS,4BAA4BH,CAAQ,GAAG,EAG1E,IAAMK,EAAaC,GAA8BN,CAAQ,EACzD,GAAIK,EACF,OAAOA,EAOT,GAJIR,GAAO,YAAc,IACvBU,EAAK,qBAAsB,yCAAyCP,CAAQ,EAAE,EAG5EF,EAAwB,CAC1B,IAAMU,EAA0BP,EAAiBH,EAAwB,iCAAiC,EAC1G,OAAAC,IAAY,CACV,KAAM,yBACN,QAAS,mDAAmDC,CAAQ,oDACpE,QAAS,CAAE,SAAAA,EAAU,aAAcQ,CAAwB,CAC7D,CAAC,EACMA,CACT,CAEAD,EAAK,qBAAsB,8DAA8DP,CAAQ,EAAE,CACrG,CAEA,SAASI,GAAYF,EAAkCF,EAAsC,CAC3F,OAAW,CAACS,EAAgBC,CAAG,IAAK,OAAO,QAAQR,CAAQ,EACzD,GAAIO,EAAe,YAAY,IAAMT,EACnC,OAAOU,CAIb,CC1CA,IAAMC,GAA8B,IAAS,IAE7C,eAAsBC,EACpBC,EACkC,CAClC,OAAQ,MAAMC,EAA0BD,CAAM,GAAG,uBACnD,CAEA,eAAsBC,EAA0BD,EAAuE,CACrH,IAAME,EAAUC,EAAaH,EAAO,KAAK,EACnCI,EAASC,EAAsBL,CAAM,EACrCM,EAAMN,EAAO,KAAO,KAAK,IACzBO,EAAWC,GAAiBJ,EAAO,eAAe,EAClDK,EAAW,MAAMC,GAAyB,CAC9C,sBAAuBV,EAAO,sBAC9B,SAAAO,EACA,MAAOL,EACP,UAAWF,EAAO,WAAa,GACjC,CAAC,EACDW,GAAgBF,EAAS,MAAOF,CAAQ,EAExC,GAAM,CAAE,sBAAAK,EAAuB,aAAAC,EAAc,UAAAC,CAAU,EAAIC,GAAgBN,EAAS,mBAAmB,EACjGO,EAAUC,GAAyBJ,CAAY,EAEjDG,EAAQ,WAAaT,GACvBW,EAAK,uBAAwB,gEAAiE,CAC5F,QAAS,CAAE,cAAeX,EAAU,aAAcS,EAAQ,QAAS,CACrE,CAAC,EAGH,IAAMG,EAAoBnB,EAAO,OAAO,mBAAqBF,GACvDsB,EAAQd,EAAI,EACd,KAAK,IAAIc,EAAQJ,EAAQ,WAAW,EAAIG,GAC1CD,EAAK,yBAA0B,sCAAsCC,CAAiB,KAAM,CAC1F,QAAS,CAAE,YAAaH,EAAQ,YAAa,MAAAI,EAAO,kBAAAD,CAAkB,CACxE,CAAC,EAGH,IAAME,GAAW,IAAI,IAAIrB,EAAO,qBAAqB,EAAE,SACjDsB,EAAeC,GAAoB,CACvC,MAAOvB,EAAO,MACd,SAAAqB,GACA,uBAAwBZ,EAAS,WAAW,aAC5C,UAAWT,EAAO,SACpB,CAAC,EACGgB,EAAQ,UAAYM,GACtBJ,EAAK,oBAAqB,kDAAmD,CAC3E,QAAS,CAAE,aAAAI,EAAc,WAAYN,EAAQ,OAAQ,CACvD,CAAC,EAGH,GAAM,CAAE,cAAAQ,EAAc,EAAI,MAAMC,GAAuB,CACrD,mBAAoBT,EAAQ,eAC5B,YAAaA,EAAQ,YACrB,QAAShB,EAAO,OAAO,gBACvB,MAAAoB,EACA,OAAQhB,EAAO,OACf,gBAAiBA,EAAO,gBACxB,UAAWJ,EAAO,SACpB,CAAC,EACD,aAAM0B,GAAoB,CAAE,sBAAAd,EAAuB,aAAAC,EAAc,UAAAC,EAAW,cAAAU,GAAe,OAAQpB,EAAO,MAAO,CAAC,EAE3G,CACL,wBAAyB,CACvB,aAAcY,EAAQ,aACtB,mBAAoBW,EAClB,IAAI,WAAW,MAAMvB,EAAO,OAAO,OAAO,UAAWwB,EAAmBZ,EAAQ,YAAY,CAAC,CAAC,CAChG,CACF,EACA,QAAS,CACP,YAAaA,EAAQ,YACrB,QAASA,EAAQ,QACjB,QAASA,EAAQ,QACjB,QAASA,EAAQ,QACjB,QAASA,EAAQ,QACjB,SAAUA,EAAQ,SAClB,WAAYP,EAAS,UACvB,CACF,CACF,CCvFA,eAAsBoB,EACpBC,EACiB,CACjB,OAAOC,EAA+B,CACpC,GAAGD,EACH,IAAK,MAAME,EAAuBF,CAAM,CAC1C,CAAC,CACH,CCPA,eAAsBG,EACpBC,EACiB,CACjB,IAAMC,EAASC,EAAsBF,CAAM,EAC3C,OAAOG,GAAgD,CACrD,QAASH,EACT,OAAQC,EAAO,OACf,gBAAiBA,EAAO,eAC1B,CAAC,CACH,CCTA,eAAsBG,EACpBC,EACiB,CACjB,OAAOC,EAA8B,CACnC,IAAK,MAAMC,EAAuBF,CAAM,EACxC,SAAUA,EAAO,SACjB,WAAYA,EAAO,WACnB,gBAAiBA,EAAO,gBACxB,OAAQA,EAAO,OACf,gBAAiBA,EAAO,eAC1B,CAAC,CACH,CCXA,eAAsBG,EACpBC,EACiB,CACjB,IAAMC,EAASC,EAAsBF,CAAM,EAC3C,OAAOG,GAAiD,CACtD,QAASH,EACT,OAAQC,EAAO,OACf,gBAAiBA,EAAO,eAC1B,CAAC,CACH,CCTA,eAAsBG,EACpBC,EACiB,CACjB,OAAOC,EAA+B,CACpC,IAAK,MAAMC,EAAuBF,CAAM,EACxC,SAAUA,EAAO,SACjB,WAAYA,EAAO,WACnB,gBAAiBA,EAAO,gBACxB,OAAQA,EAAO,OACf,gBAAiBA,EAAO,eAC1B,CAAC,CACH,CCXA,eAAsBG,EAA8BC,EAA8D,CAChH,IAAMC,EAASC,EAAsBF,CAAM,EAC3C,OAAOG,GAAgD,CACrD,QAASH,EACT,OAAQC,EAAO,OACf,gBAAiBA,EAAO,gBACxB,IAAKD,EAAO,KAAO,KAAK,GAC1B,CAAC,CACH,CCRA,eAAsBI,EACpBC,EACiB,CACjB,OAAOC,EAA8B,CACnC,GAAGD,EACH,IAAK,MAAME,EAAuBF,CAAM,CAC1C,CAAC,CACH,CCXA,IAAAG,GAA2B,kBAGpB,SAASC,GAA+BC,EAA+B,CAC5E,GAAI,CACF,SAAO,eAAWA,CAAa,CACjC,OAASC,EAAO,CACdC,EAAK,oBAAqB,iDAAkD,CAAE,MAAAD,CAAM,CAAC,CACvF,CACF,CCEA,IAAME,GAAkC,IAExC,eAAsBC,EAA2BC,EAOlC,CACb,IAAMC,EAAUC,EAAaF,EAAO,KAAK,EACnCG,EAAYH,EAAO,WAAa,IAChCI,EAAa,IAAI,gBACnBC,EACEC,EAAiB,IAAI,QAAe,CAACC,EAAGC,IAAW,CACvDH,EAAgB,WAAW,IAAM,CAC/BD,EAAW,MAAM,EACjBI,EAAO,IAAI,MAAM,SAAS,CAAC,CAC7B,EAAGL,CAAS,CACd,CAAC,EACGM,EACAC,EACJ,GAAI,CACFD,EAAW,MAAM,QAAQ,KAAK,CAC5BR,EAAQU,GAAgBX,EAAO,sBAAuBA,EAAO,IAAI,EAAG,CAClE,OAAQ,OACR,QAAS,CACP,OAAQ,mBACR,eAAgB,kBAClB,EACA,KAAM,KAAK,UAAUA,EAAO,IAAI,EAChC,OAAQI,EAAW,MACrB,CAAC,EACDE,CACF,CAAC,EACDI,EAAe,MAAM,QAAQ,KAAK,CAACD,EAAS,KAAK,EAAGH,CAAc,CAAC,CACrE,OAASM,EAAO,CACVR,EAAW,OAAO,SACpBS,EAAK,UAAW,GAAGb,EAAO,cAAc,oBAAoBG,CAAS,KAAM,CAAE,MAAAS,CAAM,CAAC,EAEtFC,EAAK,2BAA4B,GAAGb,EAAO,cAAc,+BAAgC,CAAE,MAAAY,CAAM,CAAC,CACpG,QAAE,CACA,aAAaP,CAAa,CAC5B,CAEA,GAAI,CAACI,EAAS,GAAI,CAChB,IAAMK,EAAWC,GAA6BL,CAAY,EACtDI,GAAU,UAAY,IACxBE,GAAgChB,EAAO,eAAgBS,EAAS,OAAQK,CAAQ,EAGlFD,EAAK,2BAA4B,GAAGb,EAAO,cAAc,qBAAqBS,EAAS,MAAM,GAAI,CAC/F,QAAS,CAAE,OAAQA,EAAS,OAAQ,KAAMC,EAAa,MAAM,EAAG,GAAG,CAAE,CACvE,CAAC,CACH,CAEA,IAAII,EACJ,GAAI,CACFA,EAAW,KAAK,MAAMJ,CAAY,CACpC,OAASE,EAAO,CACdC,EAAK,+BAAgC,GAAGb,EAAO,cAAc,uCAAwC,CAAE,MAAAY,CAAM,CAAC,CAChH,CAEA,OAAIE,EAAS,UAAY,KACnBA,EAAS,UAAY,IACvBE,GAAgChB,EAAO,eAAgBS,EAAS,OAAQK,CAAQ,EAGlFD,EAAK,+BAAgC,GAAGb,EAAO,cAAc,2CAA2C,GAGrGiB,GAASH,EAAS,cAAc,GACnCD,EAAK,+BAAgC,GAAGb,EAAO,cAAc,qDAAsD,CACjH,QAAS,CACP,OAAQS,EAAS,OACjB,gBAAiBS,GAAsBJ,CAAQ,CACjD,CACF,CAAC,EAGIA,EAAS,cAClB,CAEA,SAASC,GAA6BL,EAAoE,CACxG,GAAI,CACF,OAAO,KAAK,MAAMA,CAAY,CAChC,MAAQ,CACN,MACF,CACF,CAEA,SAASM,GACPG,EACAC,EACAN,EACO,CACP,IAAMO,EAA4C,CAChD,OAAAD,EACA,WAAYN,EAAS,WACrB,QAASA,EAAS,QAClB,eAAgBA,EAAS,cAC3B,EAEAD,EAAK,yBAA0B,GAAGM,CAAc,4CAA6C,CAAE,QAAAE,CAAQ,CAAC,CAC1G,CAEA,SAASJ,GAASK,EAAkD,CAClE,OAAO,OAAOA,GAAU,UAAYA,IAAU,MAAQ,CAAC,MAAM,QAAQA,CAAK,CAC5E,CAEA,SAASJ,GAAsBJ,EAAoD,CACjF,OAAO,KAAK,UAAUA,CAAQ,EAAE,MAAM,EAAGhB,EAA+B,CAC1E,CAEA,SAASa,GAAgBY,EAA+BC,EAAsB,CAC5E,IAAMC,EAAM,IAAI,IAAIF,CAAqB,EACzC,OAAAE,EAAI,SAAW,GAAGA,EAAI,SAAS,QAAQ,QAAS,EAAE,CAAC,GAAGD,CAAI,GAC1DC,EAAI,OAAS,GACNA,EAAI,SAAS,CACtB,CCzHA,eAAsBC,EACpBC,EAC0C,CAC1C,IAAMC,EAAgBC,GAA+BF,EAAO,aAAa,EACnEG,EAA2B,MAAMC,EAAuC,CAC5E,sBAAuBJ,EAAO,sBAC9B,MAAOA,EAAO,MACd,MAAOA,EAAO,MACd,OAAQA,EAAO,OACf,gBAAiBA,EAAO,gBACxB,IAAKA,EAAO,IACZ,UAAWA,EAAO,UAClB,UAAWA,EAAO,UAClB,SAAUA,EAAO,SACjB,WAAYA,EAAO,WACnB,gBAAiBA,EAAO,eAC1B,CAAC,EAED,OAAOK,EAAyD,CAC9D,sBAAuBL,EAAO,sBAC9B,KAAM,YACN,MAAOA,EAAO,MACd,eAAgB,iBAChB,UAAWA,EAAO,UAClB,KAAM,CACJ,SAAUA,EAAO,SACjB,WAAYA,EAAO,WACnB,cAAAC,EACA,yBAAAE,EACA,OAAQH,EAAO,MACjB,CACF,CAAC,CACH,CCrCA,eAAsBM,GAAuBC,EAAuE,CAClH,IAAMC,EAAkB,MAAMC,EAAsCF,CAAM,EAE1E,OAAOG,EAAgD,CACrD,sBAAuBH,EAAO,sBAC9B,KAAM,uBAAuB,mBAAmBA,EAAO,QAAQ,CAAC,GAChE,MAAOA,EAAO,MACd,eAAgB,2BAChB,UAAWA,EAAO,UAClB,KAAM,CAAE,gBAAAC,CAAgB,CAC1B,CAAC,CACH,CCPA,eAAsBG,GACpBC,EAC0C,CAC1C,IAAMC,EAA2B,MAAMC,EAAuCF,CAAM,EAEpF,OAAOG,EAAyD,CAC9D,sBAAuBH,EAAO,sBAC9B,KAAM,iBAAiB,mBAAmBA,EAAO,QAAQ,CAAC,IAAI,mBAAmBA,EAAO,UAAU,CAAC,GACnG,MAAOA,EAAO,MACd,eAAgB,qBAChB,UAAWA,EAAO,UAClB,KAAM,CACJ,yBAAAC,EACA,OAAQD,EAAO,OACf,QAASA,EAAO,QAChB,OAAQA,EAAO,MACjB,CACF,CAAC,CACH,CCtBA,eAAsBI,GACpBC,EACyC,CACzC,IAAMC,EAA2B,MAAMC,EAAsCF,CAAM,EAEnF,OAAOG,EAAwD,CAC7D,sBAAuBH,EAAO,sBAC9B,KAAM,mBAAmB,mBAAmBA,EAAO,QAAQ,CAAC,IAAI,mBAAmBA,EAAO,UAAU,CAAC,GACrG,MAAOA,EAAO,MACd,eAAgB,uBAChB,UAAWA,EAAO,UAClB,KAAM,CACJ,yBAAAC,EACA,OAAQD,EAAO,OACf,QAASA,EAAO,QAChB,WAAYA,EAAO,UACrB,CACF,CAAC,CACH,CCQO,SAASI,GAA6BC,EAAgE,CAC3G,IAAMC,EAAsBC,GAA2BF,EAAQ,WAAW,EACpEG,EAAUH,EAAQ,uBAAyBC,EAAoB,sBAC/DG,EAAYC,GAAW,CAAE,UAAW,EAAK,EAAGL,EAAQ,KAAK,EACzDM,EAAuDC,IAAe,CAC1E,GAAGA,EACH,sBAAuBA,EAAO,uBAAyBJ,EACvD,MAAOE,GAAWD,EAAWG,EAAO,KAAK,EACzC,MAAOA,EAAO,OAASP,EAAQ,MAC/B,OAAQO,EAAO,QAAUP,EAAQ,OACjC,gBAAiBO,EAAO,iBAAmBP,EAAQ,gBACnD,IAAKO,EAAO,KAAOP,EAAQ,IAC3B,UAAWO,EAAO,WAAaP,EAAQ,UACvC,UAAWO,EAAO,WAAaP,EAAQ,SACzC,GACMQ,EAAiDD,IAAe,CACpE,GAAGA,EACH,OAAQA,EAAO,QAAUP,EAAQ,OACjC,gBAAiBO,EAAO,iBAAmBP,EAAQ,eACrD,GAEA,MAAO,CACL,uCAAyCO,GACvCE,EAA2CH,EAAoBC,CAAM,CAAC,EACxE,uCAAyCA,GACvCG,EAA2CJ,EAAoBC,CAAM,CAAC,EACxE,sCAAwCA,GACtCI,EAA0CL,EAAoBC,CAAM,CAAC,EACvE,sCAAwCA,GACtCK,EAA0CN,EAAoBC,CAAM,CAAC,EACvE,2BACEA,GAIOM,EAAkCP,EAAoBC,CAAM,CAAC,EAEtE,uBAAyBA,GAAWO,GAA2BR,EAAoBC,CAAM,CAAC,EAC1F,sBACEA,GAC6C,CAC7C,IAAMQ,EAAeT,EAAoBC,CAAM,EAE/C,OAAOS,GAA6BD,CAAY,CAClD,EACA,cACER,GAEOU,GAAqBX,EAAoBC,CAAM,CAAC,EAEzD,0BAA2B,CAACA,EAAS,CAAC,IAAMW,EAA8BZ,EAAoBC,CAAM,CAAC,EACrG,+BAAiCA,GAAWY,EAAmCX,EAAmBD,CAAM,CAAC,EACzG,+BAAiCA,GAAWa,EAAmCZ,EAAmBD,CAAM,CAAC,EACzG,8BAAgCA,GAAWc,EAAkCb,EAAmBD,CAAM,CAAC,EACvG,8BAAgCA,GAC9Be,EAAkC,CAChC,GAAGd,EAAmBD,CAAM,EAC5B,IAAKA,EAAO,KAAOP,EAAQ,GAC7B,CAAC,CACL,CACF,CAgBA,SAASK,GAAWkB,EAAiBC,EAA4C,CAC/E,OAAKA,EAGE,CACL,GAAGD,EACH,GAAGC,EACH,mBAAoB,CAClB,GAAGD,EAAK,mBACR,GAAGC,EAAS,kBACd,CACF,EATSD,CAUX,CCtHA,IAAAE,EAA8G,kBAKvG,IAAMC,GAAkC,CAC7C,KAAM,yBACN,QAAS,GACX,EAEaC,GAA2D,CACtE,mBAAoB,CAClB,CAAE,KAAM,aAAc,KAAM,SAAU,EACtC,CAAE,KAAM,gBAAiB,KAAM,SAAU,EACzC,CAAE,KAAM,WAAY,KAAM,SAAU,CACtC,CACF,EAEaC,GACX,gFACWC,GAA+BC,EAASF,EAA8B,EAGtEG,GAA0B,CACrC,KAAM,wBACN,QAAS,GACX,EAEaC,GAA2D,CACtE,mBAAoB,CAClB,CAAE,KAAM,aAAc,KAAM,SAAU,EACtC,CAAE,KAAM,WAAY,KAAM,SAAU,CACtC,CACF,EAEaC,GAAiC,0DACjCC,GAA+BJ,EAASG,EAA8B,EAGtEE,GAAkB,CAC7B,KAAM,wBACN,QAAS,GACX,EAEaC,GAA4D,CACvE,oBAAqB,CACnB,CAAE,KAAM,SAAU,KAAM,SAAU,EAClC,CAAE,KAAM,aAAc,KAAM,SAAU,EACtC,CAAE,KAAM,gBAAiB,KAAM,SAAU,EACzC,CAAE,KAAM,cAAe,KAAM,SAAU,EACvC,CAAE,KAAM,WAAY,KAAM,SAAU,EACpC,CAAE,KAAM,WAAY,KAAM,SAAU,EACpC,CAAE,KAAM,aAAc,KAAM,SAAU,CACxC,CACF,EAEaC,GACX,wJACWC,GAAgCR,EAASO,EAA+B,EACxEE,GAA4B,mBAAiB,WAAWJ,EAAe,EAAE,YAAY,EAGrFK,GAAkC,CAC7C,KAAM,iCACN,QAAS,GACX,EAEaC,GAAgE,CAC3E,uBAAwB,CACtB,CAAE,KAAM,WAAY,KAAM,QAAS,EACnC,CAAE,KAAM,cAAe,KAAM,SAAU,EACvC,CAAE,KAAM,oBAAqB,KAAM,SAAU,EAC7C,CAAE,KAAM,uBAAwB,KAAM,SAAU,EAChD,CAAE,KAAM,YAAa,KAAM,SAAU,EACrC,CAAE,KAAM,iBAAkB,KAAM,QAAS,EACzC,CAAE,KAAM,wBAAyB,KAAM,QAAS,EAChD,CAAE,KAAM,sBAAuB,KAAM,QAAS,CAChD,CACF,EAEO,SAASC,GAAgCC,EAAsC,CACpF,MAAO,CACL,GAAGjB,GACH,QAASiB,EAAO,QAChB,qBAAmB,cAAWA,EAAO,iBAAiB,CACxD,CACF,CAEO,SAASC,GAAyCD,EAA8C,CACrG,OAAO,mBAAiB,WAAWD,GAAgCC,CAAM,CAAC,EAAE,YAAY,CAC1F,CAEO,SAASE,GAAyBF,EAA+B,CACtE,MAAO,CACL,GAAGZ,GACH,QAASY,EAAO,QAChB,qBAAmB,cAAWA,EAAO,iBAAiB,CACxD,CACF,CAEO,SAASG,GAAkCH,EAAuC,CACvF,OAAO,mBAAiB,WAAWE,GAAyBF,CAAM,CAAC,EAAE,YAAY,CACnF,CAEO,SAASb,EAASiB,EAAuB,CAC9C,SAAO,gBAAU,eAAYA,CAAK,CAAC,EAAE,YAAY,CACnD,CAEO,SAASC,GAAaC,EAAqB,CAChD,SAAO,aAAUA,CAAG,EAAE,YAAY,CACpC,CAEO,SAASC,GAAiCP,EAKtC,CACT,GAAI,CACF,IAAMQ,EAAa,mBAAiB,KAAKR,EAAO,KAAK,EAAE,KAAKA,EAAO,KAAK,EAClES,KAAS,gBAAU,UAAO,CAAC,SAAUT,EAAO,gBAAiBQ,CAAU,CAAC,CAAC,EAC/E,OAAOE,KAAiB,kBAAeD,EAAQT,EAAO,SAAS,CAAC,CAClE,OAASW,EAAO,CACdC,EAAK,gCAAiC,sDAAuD,CAAE,MAAAD,CAAM,CAAC,CACxG,CACF,CAEO,SAASE,GAA6Bb,EAKlC,CACT,GAAI,CACF,OAAOU,KAAiB,mBAAgBV,EAAO,OAAQA,EAAO,MAAOA,EAAO,MAAOA,EAAO,SAAS,CAAC,CACtG,OAASW,EAAO,CACdC,EAAK,gCAAiC,yCAA0C,CAAE,MAAAD,CAAM,CAAC,CAC3F,CACF,CAEO,SAASG,GAAoBC,EAAyBC,EAA2C,CACtG,IAAMC,EAAYP,EAAiBK,CAAe,EAC5CG,EAA2B,IAAI,IAAIF,EAAe,IAAKG,GAAWT,EAAiBS,CAAM,CAAC,CAAC,EACjG,OAAKD,EAAyB,IAAID,CAAS,GACzCL,EAAK,qBAAsB,4CAA6C,CACtE,QAAS,CAAE,gBAAiBK,EAAW,eAAgB,MAAM,KAAKC,CAAwB,CAAE,CAC9F,CAAC,EAEID,CACT,CAEO,SAASG,EAA2BpB,EAIhC,CACT,IAAMiB,EAAYH,GAAoBd,EAAO,gBAAiBA,EAAO,cAAc,EAC7EqB,EAAgBX,EAAiBV,EAAO,aAAa,EAC3D,OAAIqB,IAAkBJ,GACpBL,EAAK,gCAAiC,qDAAsD,CAC1F,QAAS,CAAE,cAAAS,EAAe,gBAAiBJ,CAAU,CACvD,CAAC,EAEIA,CACT,CAEO,SAASK,EAAwBC,EAAgBC,EAAkBC,EAAqB,CACzFF,EAAO,YAAY,IAAMC,EAAS,YAAY,GAChDZ,EAAK,+BAAgC,GAAGa,CAAK,gCAAiC,CAC5E,QAAS,CAAE,OAAAF,EAAQ,SAAAC,CAAS,CAC9B,CAAC,CAEL,CAEO,SAASE,GAAmBH,EAAgBC,EAAkBC,EAAqB,CACxF,IAAIE,EACAC,EACJ,GAAI,CACFD,EAAmBjB,EAAiBa,CAAM,EAC1CK,EAAqBlB,EAAiBc,CAAQ,CAChD,OAASb,EAAO,CACdC,EAAK,oBAAqB,GAAGa,CAAK,oCAAqC,CAAE,MAAAd,CAAM,CAAC,CAClF,CAEIgB,IAAqBC,GACvBhB,EAAK,+BAAgC,GAAGa,CAAK,gCAAiC,CAC5E,QAAS,CAAE,OAAAF,EAAQ,SAAAC,CAAS,CAC9B,CAAC,CAEL,CAEO,SAASK,EAAkBN,EAAgBC,EAAkBC,EAAqB,CACnFF,IAAWC,GACbZ,EAAK,+BAAgC,GAAGa,CAAK,gCAAiC,CAC5E,QAAS,CAAE,OAAAF,EAAQ,SAAAC,CAAS,CAC9B,CAAC,CAEL,CAEO,SAASM,EACdP,EACAC,EACM,CACF,KAAK,UAAUD,CAAM,IAAM,KAAK,UAAUC,CAAQ,GACpDZ,EAAK,+BAAgC,8DAA8D,CAEvG,CAEO,SAASmB,EAAsB3B,EAA2BqB,EAAuB,CACtF,OAAI,OAAOrB,GAAU,UACnBQ,EAAK,oBAAqB,GAAGa,CAAK,cAAc,EAE3CrB,CACT,CAEA,SAASM,EAAiBsB,EAAyB,CACjD,SAAO,cAAWA,CAAO,EAAE,YAAY,CACzC,CCvMO,SAASC,GACdC,EACAC,EACiC,CACjCC,EAAkBF,EAAQ,SAAUC,EAAQ,iBAAkB,UAAU,EACxEC,EAAkBF,EAAQ,WAAYC,EAAQ,mBAAoB,YAAY,EAC9EC,EAAkBF,EAAQ,cAAc,YAAa,qBAAsB,2BAA2B,EACtGG,EAA0BH,EAAQ,cAAc,MAAOI,EAAyB,EAChFC,EAAwBL,EAAQ,SAAUM,GAA8B,UAAU,EAClFD,EACEL,EAAQ,gBACRO,GAAyCN,EAAQ,cAAc,EAC/D,iBACF,EAIAI,EACEG,GAAaR,EAAQ,qBAAqB,EAC1CA,EAAQ,eAAe,SACvB,uBACF,EACAK,EACEL,EAAQ,eAAe,WACvBS,EAAsBR,EAAQ,mBAAoB,oBAAoB,EACtE,2BACF,EAEA,IAAMS,EAAkBC,GAAiC,CACvD,gBAAiBX,EAAQ,gBACzB,MAAOI,GACP,MAAO,CAAE,GAAGJ,EAAQ,cAAe,EACnC,UAAWA,EAAQ,SACrB,CAAC,EACD,OAAAY,EAA2B,CACzB,cAAeZ,EAAQ,OACvB,gBAAAU,EACA,eAAgBT,EAAQ,cAC1B,CAAC,EAEMD,CACT,CC3DA,IAAAa,GAAyB,kBAiBzB,IAAMC,GACJ,yHAEK,SAASC,GACdC,EACAC,EACgC,CAChCC,EAAkBF,EAAQ,SAAUC,EAAQ,iBAAkB,UAAU,EACxEC,EAAkBF,EAAQ,WAAYC,EAAQ,mBAAoB,YAAY,EAC9EC,EAAkBF,EAAQ,cAAc,YAAa,qBAAsB,2BAA2B,EACtGG,EAA0BH,EAAQ,cAAc,MAAOI,EAAyB,EAChFC,EAAwBL,EAAQ,SAAUM,GAA8B,UAAU,EAClFD,EACEL,EAAQ,gBACRO,GAAkCN,EAAQ,cAAc,EACxD,iBACF,EACAI,EACEL,EAAQ,eAAe,WACvBQ,EAAsBP,EAAQ,mBAAoB,oBAAoB,EACtE,2BACF,EACAI,EACEI,GAAaT,EAAQ,qBAAqB,EAC1CA,EAAQ,eAAe,SACvB,uBACF,EACAK,EAAwBL,EAAQ,eAAe,cAAeU,EAASV,EAAQ,QAAQ,EAAG,eAAe,EACzGW,GAA6BX,CAAO,EAEpC,IAAMY,EAAkBC,GAAiC,CACvD,gBAAiBb,EAAQ,gBACzB,MAAOI,GACP,MAAO,CAAE,GAAGJ,EAAQ,cAAe,EACnC,UAAWA,EAAQ,SACrB,CAAC,EACD,OAAAc,EAA2B,CACzB,cAAed,EAAQ,OACvB,gBAAAY,EACA,eAAgBX,EAAQ,cAC1B,CAAC,EAEMD,CACT,CAEA,SAASW,GAA6BX,EAA6D,CACjG,IAAIe,EACJ,GAAI,CACF,IAAMC,EAAUhB,EAAQ,eACxBe,EAAmB,YAAS,gBAAgB,EAAE,OAC5C,CAACjB,EAAmB,EACpB,CACE,CACEkB,EAAQ,cACRA,EAAQ,kBACRA,EAAQ,UACRA,EAAQ,cACRA,EAAQ,eACV,CACF,CACF,CACF,OAASC,EAAO,CACdC,EAAK,+BAAgC,0CAA2C,CAAE,MAAAD,CAAM,CAAC,CAC3F,CAEAZ,EAAwBL,EAAQ,sBAAuBe,EAAkB,gBAAgB,CAC3F,CC7DA,IAAMI,GAAiC,CAAC,WAAY,aAAc,UAAW,WAAY,UAAU,EAE5F,SAASC,GACdC,EACAC,EAC8B,CAC9BC,EAAkBF,EAAQ,SAAUC,EAAQ,iBAAkB,UAAU,EACxEC,EAAkBF,EAAQ,WAAYC,EAAQ,mBAAoB,YAAY,EAC9EC,EAAkBF,EAAQ,SAAS,SAAUA,EAAQ,SAAU,mBAAmB,EAClFE,EAAkBF,EAAQ,SAAS,WAAYA,EAAQ,WAAY,qBAAqB,EACxFE,EAAkBF,EAAQ,cAAc,YAAa,sBAAuB,2BAA2B,EACvGG,EAA0BH,EAAQ,cAAc,MAAOI,EAA0B,EACjFC,EAAwBL,EAAQ,gBAAiBM,GAA2B,iBAAiB,EAC7FD,EAAwBL,EAAQ,SAAUO,GAA+B,UAAU,EACnFF,EAAwBL,EAAQ,SAAS,OAAQQ,EAASR,EAAQ,SAAS,QAAQ,EAAG,iBAAiB,EAGvGK,EAAwBL,EAAQ,SAAS,YAAaQ,EAASR,EAAQ,SAAS,OAAO,EAAG,sBAAsB,EAChHK,EAAwBL,EAAQ,eAAe,OAAQA,EAAQ,SAAS,OAAQ,uBAAuB,EACvGK,EACEL,EAAQ,eAAe,WACvBQ,EAASR,EAAQ,SAAS,UAAU,EACpC,2BACF,EACAS,GACET,EAAQ,eAAe,cACvBU,EAAsBT,EAAQ,sBAAuB,uBAAuB,EAC5E,8BACF,EACAI,EACEL,EAAQ,eAAe,YACvBA,EAAQ,SAAS,YACjB,4BACF,EACAK,EACEL,EAAQ,eAAe,YACvBU,EAAsBT,EAAQ,oBAAqB,qBAAqB,EACxE,4BACF,EACAI,EACEL,EAAQ,eAAe,SACvBW,GAAiBX,EAAQ,QAAQ,EACjC,yBACF,EACAY,GAAiBZ,EAAQ,eAAe,WAAYC,EAAQ,KAAO,KAAK,GAAG,EAE3E,IAAMY,EAAkBC,GAA6B,CACnD,OAAQC,GACR,MAAOX,GACP,MAAO,CAAE,GAAGJ,EAAQ,cAAe,EACnC,UAAWA,EAAQ,SACrB,CAAC,EACD,OAAAgB,EAA2B,CACzB,cAAehB,EAAQ,OACvB,gBAAAa,EACA,eAAgBZ,EAAQ,cAC1B,CAAC,EAEMD,EAAQ,QACjB,CAEA,SAASW,GAAiBM,EAA4C,CACpE,IAAMC,EAAkB,CACtB,SAAUD,EAAQ,SAClB,WAAYA,EAAQ,WACpB,QAASA,EAAQ,QACjB,SAAUA,EAAQ,SAClB,SAAUE,GAAaF,EAAQ,QAAQ,CACzC,EACMG,EAAY,KAAK,UACrB,OAAO,YAAYtB,GAA+B,IAAKuB,GAAU,CAACA,EAAOH,EAAgBG,CAAK,CAAC,CAAC,CAAC,CACnG,EAEA,OAAOb,EAASY,CAAS,CAC3B,CAEA,SAASD,GAAaG,EAA0D,CAC9E,OAAO,OAAO,YAAY,OAAO,QAAQA,CAAQ,EAAE,KAAK,CAAC,CAACC,CAAI,EAAG,CAACC,CAAK,IAAMD,EAAK,cAAcC,CAAK,CAAC,CAAC,CACzG,CAEA,SAASZ,GAAiBa,EAAoBC,EAAyB,CACrE,IAAMC,EAAQD,EAAI,EACd,OAAOC,CAAK,EAAI,OAAOF,CAAU,GACnCG,EAAK,sBAAuB,iDAAkD,CAC5E,QAAS,CAAE,WAAAH,EAAY,MAAAE,CAAM,CAC/B,CAAC,CAEL,CC5FO,SAASE,GACdC,EACAC,EAC8B,CAC9BC,EAAkBF,EAAO,SAAUC,EAAQ,iBAAkB,UAAU,EACvEE,EACEH,EAAO,YACPI,EAAsBH,EAAQ,oBAAqB,qBAAqB,EACxE,aACF,EACAI,GAA2BL,EAAO,oBAAqBC,EAAQ,KAAO,KAAK,GAAG,EAE9E,IAAMK,EAAkBC,GAA6B,CACnD,OAAQC,GACR,MAAOC,GACP,MAAOC,GAAiCV,CAAM,EAC9C,UAAWA,EAAO,eACpB,CAAC,EACD,OAAAW,GAAoBL,EAAiBL,EAAQ,cAAc,EAEpDD,CACT,CAEA,SAASU,GAAiCV,EAAmE,CAC3G,MAAO,CACL,SAAUA,EAAO,SACjB,YAAaA,EAAO,YACpB,kBAAmBY,EAASZ,EAAO,aAAa,EAChD,qBAAsBY,EAASZ,EAAO,gBAAgB,EACtD,UAAWY,EAASZ,EAAO,KAAK,EAChC,eAAgBA,EAAO,eACvB,sBAAuBA,EAAO,sBAC9B,oBAAqBA,EAAO,qBAAuB,EACrD,CACF,CAEA,SAASK,GAA2BQ,EAAoCC,EAAyB,CAC/F,IAAMC,EAAQD,EAAI,EACdD,IAAwB,MAAQ,OAAOE,CAAK,EAAI,OAAOF,CAAmB,GAC5EG,EAAK,sBAAuB,8DAA+D,CACzF,QAAS,CAAE,oBAAAH,EAAqB,MAAAE,CAAM,CACxC,CAAC,CAEL","names":["src_exports","__export","AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX","AWS_NITRO_ROOT_PEM","NitroAttestationError","createEncryptedBuyerTeeSessionMaterial","createEncryptedDisputeSessionMaterial","createEncryptedIdentitySessionMaterial","createEncryptedSellerCredentialUpload","createNitroAttestationClient","encryptBuyerTeeSessionMaterial","encryptDisputeSessionMaterial","encryptIdentitySessionMaterial","encryptSellerCredentialUpload","fetchAndVerifyAttestation","getDisputeVerifierDomainSeparator","getUnifiedPaymentVerifierDomainSeparator","hashUtf8","requestIdentityAttestation","uploadSellerCredential","verifyBuyerTeePayment","verifyBuyerTeePaymentAttestation","verifyDispute","verifyDisputeAttestation","verifyIdentityAttestation","verifySellerCredentialBundle","__toCommonJS","NitroAttestationError","code","message","options","fail","wrapCryptoFailure","promise","cause","resolveFetch","fetchOverride","fail","resolveSubtle","subtleOverride","subtle","resolveGetRandomValues","getRandomValuesOverride","cryptoRef","out","resolveCryptoProvider","params","asCrypto","getRandomValues","randomUuidV4","bytes","hex","byte","BASE64_ALPHABET","BASE64_LOOKUP","buildLookup","alphabet","lookup","index","bytesToHex","bytes","out","byte","utf8Encode","value","bytes","index","codePoint","utf8Decode","out","first","base64Encode","second","third","triplet","BASE64_ALPHABET","base64Decode","decodeBase64","base64UrlEncode","decodeBase64","value","urlSafe","stripped","normalized","padded","bytes","index","chars","pad","a","lookupBase64","BASE64_LOOKUP","b","c","d","triplet","char","lookup","concatBytes","parts","total","sum","part","out","offset","bytesToArrayBuffer","bytes","buildSellerCredentialUploadPlaintext","params","plaintext","buildTeeSessionMaterialPlaintext","stringifyUploadPlaintext","JWE_PROTECTED_HEADER","JWE_ID_PATTERN","encryptSellerCredentialUploadWithResolvedCrypto","params","issuedAtMs","jweId","randomUuidV4","assertJweId","encryptKeyBoundPlaintextWithResolvedCrypto","buildSellerCredentialUploadPlaintext","encryptBuyerTeeSessionMaterialWithResolvedCrypto","encryptTeeSessionMaterialWithResolvedCrypto","encryptIdentitySessionMaterialWithResolvedCrypto","encryptDisputeSessionMaterialWithResolvedCrypto","buildTeeSessionMaterialPlaintext","plaintext","utf8Encode","stringifyUploadPlaintext","cek","rsaKey","wrapCryptoFailure","bytesToArrayBuffer","encryptedKey","iv","protectedHeader","base64UrlEncode","aad","aesKey","encryptedPlaintext","ciphertext","tag","fail","getRandomValues","bytes","hex","byte","encryptBuyerTeeSessionMaterial","params","crypto","resolveCryptoProvider","encryptBuyerTeeSessionMaterialWithResolvedCrypto","import_x509","AWS_NITRO_ROOT_PEM","AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX","CERT_EXPIRY_WARNING_WINDOW_MS","verifyCertificateChain","params","crypto","asCrypto","rootCertificate","parseCertificate","AWS_NITRO_ROOT_PEM","rootFingerprint","certificateSha256","AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX","fail","leafCertificate","cabundle","der","index","allCertificates","certificate","assertCertificateTimeValid","warnNearExpiry","leafFingerprint","intermediates","fingerprint","candidates","candidate","verifyChainLinks","leafPublicKey","wrapCryptoFailure","chain","subject","issuer","raw","label","cause","subtle","bytesToHex","nowMs","onWarning","decodeCbor","bytes","reader","CborReader","value","encodeCbor","encodeTypeAndLength","encoded","utf8Encode","concatBytes","k","v","encodeCoseSigStructure1","protectedHeadersBytes","payloadBytes","majorType","length","bigintLength","head","additional","utf8Decode","out","index","chunks","chunk","key","decodeCoseSign1","attestationDocument","untagged","decoded","decodeCbor","cause","fail","protectedHeadersBytes","unprotectedHeaders","payloadBytes","signature","assertProtectedHeader","verifyCoseSignature","params","sigStructure","encodeCoseSigStructure1","wrapCryptoFailure","PCR8_HEX_LENGTH","normalizePcr8Pin","value","label","normalized","fail","parseAdvertisedPcr8","MAX_ATTESTATION_RESPONSE_BYTES","NETWORK_LAYER_FETCH_ATTEMPTS","NETWORK_LAYER_RETRY_DELAY_MS","ETH_ADDRESS_PATTERN","buildAttestationUrl","attestationServiceUrl","nonceHex","url","strippedPath","fetchAttestationEnvelope","params","response","fetchWithNetworkRetry","responseText","readResponseText","fail","body","cause","validateAttestationEnvelope","isRecord","responseObject","attestationDocument","base64Decode","parseOptionalAddress","parseOptionalAdvertisedPcr8","assertResponseSize","utf8Encode","reader","chunks","totalBytes","done","value","utf8Decode","concatBytes","label","parseAdvertisedPcr8","fetcher","timeoutMs","attempt","fetchWithTimeout","isNetworkLayerFetchFailure","sleep","controller","timeoutHandle","timeoutPromise","_","reject","NitroAttestationError","ms","resolve","NONCE_BYTE_LENGTH","generateNonceHex","getRandomValues","bytesToHex","assertNonceEcho","echoedNonce","expectedNonce","fail","decodeAttestationPayload","payloadBytes","decoded","decodeCbor","cause","fail","payload","requireMap","pcrs","userData","requireBytes","requireTimestamp","utf8Decode","optionalPcrHex","bytesToHex","requireArray","entry","index","value","label","STAGING_ATTESTATION_SERVICE_URL","PRODUCTION_ATTESTATION_SERVICE_URL","STAGING_PCR8","PRODUCTION_PCR8","DEFAULT_EXPECTED_PCR8_BY_HOST","normalizePcr8Pin","DEFAULT_ENVIRONMENT_CONFIG","resolveExpectedPcr8","params","trust","advertisedExpectedPcr8","onWarning","hostname","normalizePcr8Pin","hostPins","hostPin","findHostPin","bundledPin","DEFAULT_EXPECTED_PCR8_BY_HOST","fail","normalizedAdvertisedPin","configuredHost","pin","DEFAULT_FRESHNESS_WINDOW_MS","fetchAttestedUploadKey","params","fetchAndVerifyAttestation","fetcher","resolveFetch","crypto","resolveCryptoProvider","now","nonceHex","generateNonceHex","response","fetchAttestationEnvelope","assertNonceEcho","protectedHeadersBytes","payloadBytes","signature","decodeCoseSign1","payload","decodeAttestationPayload","fail","freshnessWindowMs","nowMs","hostname","expectedPcr8","resolveExpectedPcr8","leafPublicKey","verifyCertificateChain","verifyCoseSignature","bytesToHex","bytesToArrayBuffer","createEncryptedBuyerTeeSessionMaterial","params","encryptBuyerTeeSessionMaterial","fetchAttestedUploadKey","encryptDisputeSessionMaterial","params","crypto","resolveCryptoProvider","encryptDisputeSessionMaterialWithResolvedCrypto","createEncryptedDisputeSessionMaterial","params","encryptDisputeSessionMaterial","fetchAttestedUploadKey","encryptIdentitySessionMaterial","params","crypto","resolveCryptoProvider","encryptIdentitySessionMaterialWithResolvedCrypto","createEncryptedIdentitySessionMaterial","params","encryptIdentitySessionMaterial","fetchAttestedUploadKey","encryptSellerCredentialUpload","params","crypto","resolveCryptoProvider","encryptSellerCredentialUploadWithResolvedCrypto","createEncryptedSellerCredentialUpload","params","encryptSellerCredentialUpload","fetchAttestedUploadKey","import_ethers","normalizeIdentityCallerAddress","callerAddress","cause","fail","SERVICE_RESPONSE_SNIPPET_LENGTH","postJsonServiceResponse","params","fetcher","resolveFetch","timeoutMs","controller","timeoutHandle","timeoutPromise","_","reject","response","responseText","buildServiceUrl","cause","fail","envelope","parseServiceResponseEnvelope","failWithServiceResponseEnvelope","isRecord","formatEnvelopeSnippet","failureContext","status","details","value","attestationServiceUrl","path","url","requestIdentityAttestation","params","callerAddress","normalizeIdentityCallerAddress","encryptedSessionMaterial","createEncryptedIdentitySessionMaterial","postJsonServiceResponse","uploadSellerCredential","params","encryptedUpload","createEncryptedSellerCredentialUpload","postJsonServiceResponse","verifyBuyerTeePayment","params","encryptedSessionMaterial","createEncryptedBuyerTeeSessionMaterial","postJsonServiceResponse","verifyDispute","params","encryptedSessionMaterial","createEncryptedDisputeSessionMaterial","postJsonServiceResponse","createNitroAttestationClient","options","environmentDefaults","DEFAULT_ENVIRONMENT_CONFIG","baseUrl","baseTrust","mergeTrust","withRequestDefaults","params","withCryptoDefaults","createEncryptedBuyerTeeSessionMaterial","createEncryptedIdentitySessionMaterial","createEncryptedDisputeSessionMaterial","createEncryptedSellerCredentialUpload","requestIdentityAttestation","uploadSellerCredential","verifyParams","verifyBuyerTeePayment","verifyDispute","fetchAndVerifyAttestation","encryptBuyerTeeSessionMaterial","encryptIdentitySessionMaterial","encryptDisputeSessionMaterial","encryptSellerCredentialUpload","base","override","import_ethers","UNIFIED_PAYMENT_VERIFIER_DOMAIN","PAYMENT_ATTESTATION_TYPES","PAYMENT_ATTESTATION_TYPESTRING","PAYMENT_ATTESTATION_TYPEHASH","hashUtf8","DISPUTE_VERIFIER_DOMAIN","DISPUTE_ATTESTATION_TYPES","DISPUTE_ATTESTATION_TYPESTRING","DISPUTE_ATTESTATION_TYPEHASH","IDENTITY_DOMAIN","IDENTITY_ATTESTATION_TYPES","IDENTITY_ATTESTATION_TYPESTRING","IDENTITY_ATTESTATION_TYPEHASH","IDENTITY_DOMAIN_SEPARATOR","SELLER_CREDENTIAL_BUNDLE_DOMAIN","SELLER_CREDENTIAL_BUNDLE_TYPES","getUnifiedPaymentVerifierDomain","params","getUnifiedPaymentVerifierDomainSeparator","getDisputeVerifierDomain","getDisputeVerifierDomainSeparator","value","hashHexBytes","hex","recoverSignerFromDomainSeparator","structHash","digest","normalizeAddress","cause","fail","recoverSignerFromKnownDomain","assertTrustedSigner","recoveredSigner","trustedSigners","recovered","normalizedTrustedSigners","signer","assertTrustedPayloadSigner","payloadSigner","assertLowercaseHexEqual","actual","expected","label","assertAddressEqual","normalizedActual","normalizedExpected","assertStringEqual","assertTypedDataTypesEqual","requireVerifierOption","address","verifyBuyerTeePaymentAttestation","payload","options","assertStringEqual","assertTypedDataTypesEqual","PAYMENT_ATTESTATION_TYPES","assertLowercaseHexEqual","PAYMENT_ATTESTATION_TYPEHASH","getUnifiedPaymentVerifierDomainSeparator","hashHexBytes","requireVerifierOption","recoveredSigner","recoverSignerFromDomainSeparator","assertTrustedPayloadSigner","import_ethers","DISPUTE_DETAILS_ABI","verifyDisputeAttestation","payload","options","assertStringEqual","assertTypedDataTypesEqual","DISPUTE_ATTESTATION_TYPES","assertLowercaseHexEqual","DISPUTE_ATTESTATION_TYPEHASH","getDisputeVerifierDomainSeparator","requireVerifierOption","hashHexBytes","hashUtf8","assertDisputeDetailsEncoding","recoveredSigner","recoverSignerFromDomainSeparator","assertTrustedPayloadSigner","expectedEncoding","details","cause","fail","IDENTITY_CANONICAL_FIELD_ORDER","verifyIdentityAttestation","payload","options","assertStringEqual","assertTypedDataTypesEqual","IDENTITY_ATTESTATION_TYPES","assertLowercaseHexEqual","IDENTITY_DOMAIN_SEPARATOR","IDENTITY_ATTESTATION_TYPEHASH","hashUtf8","assertAddressEqual","requireVerifierOption","hashIdentityData","assertNotExpired","recoveredSigner","recoverSignerFromKnownDomain","IDENTITY_DOMAIN","assertTrustedPayloadSigner","details","canonicalFields","sortMetadata","canonical","field","metadata","left","right","validUntil","now","nowMs","fail","verifySellerCredentialBundle","bundle","options","assertStringEqual","assertLowercaseHexEqual","requireVerifierOption","assertCredentialNotExpired","recoveredSigner","recoverSignerFromKnownDomain","SELLER_CREDENTIAL_BUNDLE_DOMAIN","SELLER_CREDENTIAL_BUNDLE_TYPES","buildSellerCredentialBundleValue","assertTrustedSigner","hashUtf8","credentialExpiresAt","now","nowMs","fail"]}