@atrib/verify 0.2.3 → 0.2.4

package/README.md

@@ -28,7 +28,7 @@ const result = await verifier.verify(recommendationDoc)
 
 `valid === true` means **both** the document's Ed25519 signature verified against the calculator's published key **and** the local recalculation produced the same distribution within `1e-9`. Either failing flips `valid` to `false` and the specific failure is reported in `signatureOk` / `calcMatch` / `warnings` so you know exactly what went wrong.
 
-## What `verify()` actually does (per spec §5.5.2)
+## What `verify()` actually does (per spec [§5.5.2](../../atrib-spec.md#552-verifying-a-settlement-recommendation))
 
 1. **Resolves the calculator's public key** from `recommendationDoc.calculated_by`. For the well-known `resolve.atrib.dev` service, the key is fetched from the `/pubkey` endpoint. For other calculators, the merchant supplies the key out-of-band.
 2. **Verifies the Ed25519 signature** over the JCS-canonicalized recommendation document (excluding the `signature` field).
@@ -39,7 +39,7 @@ const result = await verifier.verify(recommendationDoc)
 
 The key invariant per spec [§4.6](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#46-the-calculation-algorithm): any party with the same graph and the same policy MUST get the same distribution. If they don't, either the calculator cheated, the document was tampered with, or one party has a buggy implementation. Either way the merchant should not pay against this document.
 
-## Post-hoc calculation (§5.5.3)
+## Post-hoc calculation ([§5.5.3](../../atrib-spec.md#553-post-hoc-calculation-no-agent-sdk))
 
 If the agent that drove the session was not atrib-aware (no `@atrib/agent` middleware), the merchant can still produce a signed recommendation after the fact, as long as the tools were attributed:
 
@@ -98,14 +98,14 @@ const result = await verifyRecord(record, {
 
 - `provenance`: `{ token, upstream_record_hash, upstream_resolved }` per session-genesis record carrying `provenance_token` ([D044](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d044-provenance_token-field-for-cross-session-causal-anchoring) / [§1.2.6](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#126-provenance_token)). The 16-byte token truncation is irreversible: `upstream_record_hash` populates only when the caller supplies a candidate whose canonical-form SHA-256[:16] matches the token.
 - `informed_by_resolution`: `{ resolved: string[], dangling: string[] }` per record carrying `informed_by` ([D041](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d041-informed_by-linking-primitive-and-informed_by-edge-type) / [§1.2.5](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#125-informed_by)). Dangling references are flagged but do not fail verification: they signal "the verifier has not seen upstream context," not "the record is invalid."
-- `posture`: `{ timestamp_granularity, timestamp_consistent, timestamp_granularity_explicit, args_commitment_form, result_commitment_form, tool_name_form }` ([D045](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d045-privacy-postures-normative-spec-section) / [D061](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d061-add-tool_name-args_hash-result_hash-fields-to-§121) / [§8.2](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#82-opaque-name-posture) / [§8.3](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#83-salted-commitment-posture) / [§8.4](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#84-coarsened-timing-posture)). Always populated. Surfaces (a) the declared timing granularity, whether the timestamp value structurally matches the spec's trailing-zero invariant, and whether the field was explicitly set vs defaulted; (b) the structurally-detected `args_hash` / `result_hash` commitment scheme: `'salted-sha256'` when `args_salt` / `result_salt` is present, `'plain-sha256'` otherwise (the `'hmac-sha256'` variant from §8.3 is signaled out-of-band and is not structurally detectable); and (c) the §8.2 `tool_name_form`: `'hashed'` when `tool_name` matches `^sha256:[0-9a-f]{64}$`, `'plain'` for any other present value, `null` when the field is absent. Per D061 the §8.2 verbatim-vs-opaque distinction is NOT structurally detectable — both surface as `'plain'`.
+- `posture`: `{ timestamp_granularity, timestamp_consistent, timestamp_granularity_explicit, args_commitment_form, result_commitment_form, tool_name_form }` ([D045](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d045-privacy-postures-normative-spec-section) / [D061](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d061-add-tool_name-args_hash-result_hash-fields-to-§121) / [§8.2](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#82-opaque-name-posture) / [§8.3](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#83-salted-commitment-posture) / [§8.4](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#84-coarsened-timing-posture)). Always populated. Surfaces (a) the declared timing granularity, whether the timestamp value structurally matches the spec's trailing-zero invariant, and whether the field was explicitly set vs defaulted; (b) the structurally-detected `args_hash` / `result_hash` commitment scheme: `'salted-sha256'` when `args_salt` / `result_salt` is present, `'plain-sha256'` otherwise (the `'hmac-sha256'` variant from [§8.3](../../atrib-spec.md#83-salted-commitment-posture) is signaled out-of-band and is not structurally detectable); and (c) the [§8.2](../../atrib-spec.md#82-opaque-name-posture) `tool_name_form`: `'hashed'` when `tool_name` matches `^sha256:[0-9a-f]{64}$`, `'plain'` for any other present value, `null` when the field is absent. Per [D061](../../DECISIONS.md#d061-add-tool_name-args_hash-result_hash-fields-to-121) the [§8.2](../../atrib-spec.md#82-opaque-name-posture) verbatim-vs-opaque distinction is NOT structurally detectable — both surface as `'plain'`.
 - `capability_check`: `{ envelope, in_envelope, mismatches, unresolvable }` ([D051](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d051-capability-scoped-records-via-directory-published-envelopes) / [§6.7](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#67-capability-declarations)). Populated only when the caller passes a resolved `identityClaim` in options. Checks the record's `event_type` against the envelope's `event_types` allowlist and the record's `timestamp` against `expires_at`. `tool_names` (against tool_call records), `max_amount`, and `counterparties` (against transaction records) flag `unresolvable: true` because the constraints depend on data not yet on the standard record shape (`tool_name`) or out-of-band protocol events (payment amount + counterparty). Per [§6.7.3](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#673-out-of-envelope-records) out-of-envelope is a signal, not invalidation: mismatches do not flip `valid` to false. The caller is responsible for fetching the active envelope at the record's timestamp via `@atrib/directory`'s `lookup()` (or a cached equivalent); `@atrib/verify` intentionally has no `@atrib/directory` dependency.
-- `cross_attestation`: `{ signers_count, signers_valid, missing }` ([D052](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d052-cross-attestation-requirement-for-transaction-records) / [§1.7.6](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#176-cross-attestation-requirement-for-transaction-records)). Populated only on transaction records (`event_type = transaction`). Each entry in `signers[]` is verified against the cross-attestation canonical bytes (JCS form with `signers: []` and the top-level `signature` field omitted, per §1.7.6). `missing: true` when fewer than 2 signers verify — atrib's normative minimum. Per §1.7.6 missing is a SIGNAL not invalidation: `valid` stays true if the underlying signature path holds. Legacy single-signer transaction records (no `signers[]` array, only top-level `signature`) surface as `signers_count: 0, missing: true` so consumers can flag them while accepting the cryptographic validity.
+- `cross_attestation`: `{ signers_count, signers_valid, missing }` ([D052](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d052-cross-attestation-requirement-for-transaction-records) / [§1.7.6](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#176-cross-attestation-requirement-for-transaction-records)). Populated only on transaction records (`event_type = transaction`). Each entry in `signers[]` is verified against the cross-attestation canonical bytes (JCS form with `signers: []` and the top-level `signature` field omitted, per [§1.7.6](../../atrib-spec.md#176-cross-attestation-requirement-for-transaction-records)). `missing: true` when fewer than 2 signers verify — atrib's normative minimum. Per [§1.7.6](../../atrib-spec.md#176-cross-attestation-requirement-for-transaction-records) missing is a SIGNAL not invalidation: `valid` stays true if the underlying signature path holds. Legacy single-signer transaction records (no `signers[]` array, only top-level `signature`) surface as `signers_count: 0, missing: true` so consumers can flag them while accepting the cryptographic validity.
 
 **Pending per-record annotations** (tracked as a Pending decision in [DECISIONS.md P005](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#p005-reconcile-atribverify-readme-per-record-annotations-with-actual-code-surface)):
 
 - `cross_log_proof_count` / `cross_log_threshold_met` / `cross_log_equivocation_detected` ([D050](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d050-cross-log-replication-for-equivocation-defense) / [§2.11](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#211-cross-log-replication)): requires multi-log proof-bundle parsing and trusted-log-set config.
-(Note: `tool_name_form`, `args_commitment_form`, and `result_commitment_form` per §8.2/§8.3 are all now implemented under `posture` above. D061 added `tool_name`, `args_hash`, and `result_hash` to the §1.2.1 canonical record schema, completing the structural inputs.)
+(Note: `tool_name_form`, `args_commitment_form`, and `result_commitment_form` per [§8.2](../../atrib-spec.md#82-opaque-name-posture)/[§8.3](../../atrib-spec.md#83-salted-commitment-posture) are all now implemented under `posture` above. [D061](../../DECISIONS.md#d061-add-tool_name-args_hash-result_hash-fields-to-121) added `tool_name`, `args_hash`, and `result_hash` to the [§1.2.1](../../atrib-spec.md#121-field-definitions) canonical record schema, completing the structural inputs.)
 
 Each pending annotation is its own ADR scope when external consumers need it.
 

package/dist/resolve-identity.d.ts

@@ -1,19 +1,3 @@
-/**
- * Identity resolution per spec §6.3 — the 9-step verifier consultation
- * algorithm. The verifier consults the directory for a record's
- * creator_key and surfaces an `identity_resolution` object.
- *
- * This implementation is the LEGIBLE PARTIAL: steps 6 (directory
- * lookup), 8 (parse claim), and 9 (revocation cross-check) are wired
- * end-to-end. Steps 1-5 (anchor freshness, witness coverage, directory
- * checkpoint signature, append-only consistency) and step 7 (AKD proof
- * validation) require heavier cryptographic infrastructure and are
- * surfaced as explicit warnings rather than falsely claimed as passing.
- *
- * Per §5.8 degradation contract: this function never throws. Network
- * failures, malformed responses, and timeout conditions all produce
- * warnings in the returned object.
- */
 import type { RevocationEntry } from './revocations.js';
 /** Identity claim shape from spec §6.1. Mirrored here to avoid an import cycle with @atrib/directory. */
 export interface IdentityClaim {
@@ -43,26 +27,128 @@ export interface KeyRevocationStatus {
     /** True when the record being resolved was signed AFTER revocation (post-revocation). */
     since_revocation: boolean;
 }
+/**
+ * Anchor surface populated by spec §6.3 step 1 + step 2.
+ *
+ * The verifier discovers the anchor commitment on the log by querying
+ * `directory_anchor` records in the directory's reserved context_id
+ * (= sha256(directory_origin)[:16]) filtered by creator_key + timestamp.
+ * It then fetches the body (with directory_root + directory_epoch +
+ * signature) via the supplied `fetchAnchorBody` callback. The current
+ * routing target is directory-node's `/v6/anchors/<hash>` endpoint;
+ * after the §2.12 record-body archive layer ships (D070 placeholder
+ * ADR), the same callback can route to the standard archive endpoint
+ * with no change to resolveIdentity.
+ *
+ * `anchor_witness_count` and `anchor_freshness_ok` are populated when
+ * the relevant inputs are available (witness threshold config for the
+ * former; `freshnessThresholdMs` for the latter); otherwise they're
+ * `null` to distinguish "not checked" from "checked + clean."
+ */
+export interface AnchorSurface {
+    anchor_record_hash: string;
+    checkpoint_version: number;
+    anchor_timestamp: number;
+    anchor_age_ms: number;
+    anchor_witness_count: number | null;
+    anchor_freshness_ok: boolean | null;
+}
 export interface IdentityResolution {
     identity_resolved: IdentityClaim | null;
     identity_resolution_method: IdentityResolutionMethod;
     capability_envelope: CapabilityEnvelope | null;
     key_revocation_status: KeyRevocationStatus | null;
     /**
-     * lookup_proof_valid: per §6.3 step 7. NULL when the lookup returned
-     * non-membership (no proof to validate) or when the verifier hasn't
-     * implemented AKD proof validation in JS. The directory returns a
-     * proof bytes blob; validation requires the AKD WASM bridge in the
-     * verifier process. Currently null for both reasons; warnings flag
-     * which one applies.
+     * §6.3 step 7. `true` when the AKD lookup proof verifies against the
+     * directory's anchored root, `false` when verification rejects (which
+     * triggers the hard-failure rejection path), `null` when not attempted
+     * (callback or vrf pubkey omitted, or anchor fetch failed mid-flight).
      */
     lookup_proof_valid: boolean | null;
-    /** §6.3 step 5 — currently not checked; reflected in warnings. */
+    /**
+     * §6.3 step 5. `true` when the audit proof between the prior anchor
+     * and the current anchor verifies, `false` when verification rejects
+     * (triggers hard-failure rejection), `null` when not attempted.
+     */
     append_only_consistent: boolean | null;
-    /** §6.3 step 1 — currently not checked; reflected in warnings. */
-    anchor: null;
+    /**
+     * §6.3 step 1 + step 2. Populated when `directoryOperatorKey` +
+     * `logEndpoint` + `fetchAnchorBody` are all supplied AND a recent
+     * directory_anchor record was discovered on the log. `null` otherwise
+     * (a step-1 warning carries the reason).
+     */
+    anchor: AnchorSurface | null;
+    /**
+     * §6.3 step 4. `true` when the directory operator's Ed25519
+     * signature on the anchor body verifies, `false` when it doesn't
+     * (triggers §6.3 step 4 HARD failure rejection — a faulty operator
+     * is not a soft signal). `null` when the check wasn't attempted
+     * (no anchor body discovered, no `directoryOperatorKey` supplied).
+     */
+    directory_checkpoint_signature_valid: boolean | null;
     warnings: string[];
 }
+/**
+ * Inputs to the verifyLookupProof callback. Mirrors the signature of
+ * `@atrib/directory`'s `verifyLookupProof` so callers can pass it through
+ * directly. We re-declare the shape here (rather than importing from
+ * `@atrib/directory`) to keep `@atrib/verify` independent of the WASM
+ * bridge — same dependency-inversion pattern used for `upstreamCandidate`,
+ * `informedByCandidates`, and `identityClaim` elsewhere in this package.
+ */
+export interface VerifyLookupProofInput {
+    vrfPublicKey: Uint8Array;
+    rootHash: Uint8Array;
+    currentEpoch: number;
+    label: string;
+    proof: Uint8Array;
+}
+/**
+ * Inputs to the verifyAuditProof callback. Mirrors `@atrib/directory`'s
+ * `verifyAuditProof` signature; same dependency-inversion pattern as
+ * `verifyLookupProof`.
+ */
+export interface VerifyAuditProofInput {
+    /** Sequence of 32-byte root hashes, one per epoch boundary. */
+    rootHashes: Uint8Array[];
+    /** Bincode-serialized append-only proof bytes. */
+    proof: Uint8Array;
+}
+/**
+ * Signed `directory_anchor` record body. Returned by `fetchAnchorBody`.
+ * Shape mirrors `services/directory-node/src/anchor.ts:AnchorRecord`
+ * but is re-declared here so `@atrib/verify` doesn't import from a
+ * service package.
+ */
+export interface AnchorBody {
+    chain_root: string;
+    content_id: string;
+    context_id: string;
+    creator_key: string;
+    event_type: string;
+    metadata: {
+        directory_origin: string;
+        directory_root: string;
+        directory_epoch: number;
+    };
+    spec_version: string;
+    timestamp: number;
+    signature: string;
+}
+/**
+ * Log-side commitment shape returned by `GET /v1/by-context/<hex>` on
+ * log-node. Re-declared here so `@atrib/verify` doesn't import from
+ * `@atrib/log-node`. Only the fields step 1 reads are typed; the rest
+ * are tolerated.
+ */
+export interface AnchorCommitment {
+    record_hash: string;
+    log_index: number;
+    creator_key: string;
+    context_id: string;
+    timestamp_ms: number;
+    event_type: string;
+}
 export interface ResolveIdentityOptions {
     /** Directory base URL (e.g., https://directory.atrib.dev/v6). */
     directoryEndpoint?: string;
@@ -79,6 +165,90 @@ export interface ResolveIdentityOptions {
     signal?: AbortSignal;
     /** Override fetch (testing). */
     fetchImpl?: typeof fetch;
+    /**
+     * Directory operator's VRF public key (32 bytes). Required for step 7
+     * AKD lookup proof verification. When omitted, step 7 stays warning-only.
+     *
+     * For the reference HardCodedAkdVRF backend exposed by `@atrib/directory`,
+     * use `directoryVrfPublicKey()` from that package. Production directories
+     * swapping the VRF backend publish their own VRF pubkey out of band.
+     */
+    directoryVrfPublicKey?: Uint8Array;
+    /**
+     * Callback that performs AKD lookup proof verification (spec §6.3 step 7).
+     * Should be `verifyLookupProof` from `@atrib/directory`. When omitted,
+     * step 7 stays warning-only. When supplied AND `directoryVrfPublicKey`
+     * is also supplied, the verifier fetches the directory's anchor +
+     * decodes the lookup proof + calls this callback to validate.
+     *
+     * The callback returns `true` for a valid proof, `false` for an
+     * internally-consistent-but-invalid proof, and throws for malformed
+     * input. The verifier surfaces all three outcomes appropriately
+     * (true → `lookup_proof_valid: true`; false → reject per §6.3
+     * step 7 HARD failure semantics; throw → warning + null).
+     */
+    verifyLookupProof?: (input: VerifyLookupProofInput) => boolean;
+    /**
+     * Directory operator's Ed25519 public key (43-char base64url). Required
+     * for §6.3 step 1 anchor discovery: the verifier filters
+     * `directory_anchor` log entries by this key. Production deployments
+     * publish the operator key alongside the directory origin.
+     */
+    directoryOperatorKey?: string;
+    /**
+     * Tessera log endpoint (e.g., `https://log.atrib.dev/v1`). Required
+     * for §6.3 step 1 to query `directory_anchor` records via
+     * `GET /v1/by-context/<hex>`. When omitted, steps 1 + 2 + 5 are
+     * warning-only.
+     */
+    logEndpoint?: string;
+    /**
+     * Callback that retrieves a `directory_anchor` record body by its
+     * `record_hash`. The verifier fetches the COMMITMENT from the log,
+     * then uses this callback to fetch the BODY (which carries
+     * directory_root + directory_epoch + signature). Returns `null` when
+     * the body isn't available.
+     *
+     * The current routing target is `GET /v6/anchors/<hash>` on the
+     * directory itself. After the §2.12 record-body archive layer ships
+     * (D070 placeholder ADR), production deployments swap the callback
+     * to route to the standard archive endpoint without any change to
+     * resolveIdentity.
+     */
+    fetchAnchorBody?: (recordHash: string) => Promise<AnchorBody | null>;
+    /**
+     * §6.3 step 2: anchor freshness threshold (ms). When set, the
+     * verifier sets `anchor_freshness_ok` based on whether
+     * `anchor_age_ms ≤ freshnessThresholdMs`. When omitted, no threshold
+     * is applied and `anchor_freshness_ok` stays `null`.
+     */
+    freshnessThresholdMs?: number;
+    /**
+     * Callback that performs AKD audit proof verification (spec §6.3 step 5).
+     * Should be `verifyAuditProof` from `@atrib/directory`. When omitted,
+     * step 5 stays warning-only. When supplied AND step 1 surfaces an
+     * anchor pair (current + prior), the verifier fetches the audit proof
+     * from the directory and calls this callback.
+     *
+     * Returns `true` for a valid proof, `false` for invalid (triggers
+     * §6.3 step 5 HARD failure rejection), throws for malformed input.
+     */
+    verifyAuditProof?: (input: VerifyAuditProofInput) => Promise<boolean>;
+    /**
+     * §6.3 step 3: minimum count of valid witness cosignatures required
+     * on the log's checkpoint covering the anchor. When set, the
+     * verifier fetches the checkpoint, parses cosignature lines, counts
+     * lines whose origin differs from the log's own (witness signatures),
+     * and surfaces a step-3-witness-insufficient warning if below
+     * threshold. When omitted, step 3 stays warning-only.
+     *
+     * Note. Cryptographic verification of each witness signature against
+     * a configured trusted-witness set is a separate enhancement; the
+     * current implementation counts cosignature lines as a proxy. See
+     * `step-3-witness-not-cryptographically-verified` warning surfaced
+     * alongside the count.
+     */
+    witnessThreshold?: number;
 }
 export declare function resolveIdentity(creatorKey: string, opts?: ResolveIdentityOptions): Promise<IdentityResolution>;
 //# sourceMappingURL=resolve-identity.d.ts.map

package/dist/resolve-identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-identity.d.ts","sourceRoot":"","sources":["../src/resolve-identity.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAEvD,yGAAyG;AACzG,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,eAAe,GAAG,iBAAiB,GAAG,cAAc,CAAA;IAChE,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACtC,YAAY,CAAC,EAAE,kBAAkB,CAAA;IACjC,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,2CAA2C;AAC3C,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,UAAU,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IAChD,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,MAAM,wBAAwB,GAChC,kBAAkB,GAClB,qBAAqB,GACrB,qBAAqB,GACrB,UAAU,CAAA;AAEd,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,YAAY,CAAA;IAChD,sEAAsE;IACtE,oBAAoB,EAAE,MAAM,CAAA;IAC5B,yFAAyF;IACzF,gBAAgB,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,iBAAiB,EAAE,aAAa,GAAG,IAAI,CAAA;IACvC,0BAA0B,EAAE,wBAAwB,CAAA;IACpD,mBAAmB,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAC9C,qBAAqB,EAAE,mBAAmB,GAAG,IAAI,CAAA;IACjD;;;;;;;OAOG;IACH,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAAA;IAClC,kEAAkE;IAClE,sBAAsB,EAAE,OAAO,GAAG,IAAI,CAAA;IACtC,kEAAkE;IAClE,MAAM,EAAE,IAAI,CAAA;IACZ,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,iEAAiE;IACjE,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,mEAAmE;IACnE,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IAC1C,8CAA8C;IAC9C,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,gCAAgC;IAChC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB;AAID,wBAAsB,eAAe,CACnC,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC,kBAAkB,CAAC,CAmG7B"}
+{"version":3,"file":"resolve-identity.d.ts","sourceRoot":"","sources":["../src/resolve-identity.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAEvD,yGAAyG;AACzG,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,eAAe,GAAG,iBAAiB,GAAG,cAAc,CAAA;IAChE,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACtC,YAAY,CAAC,EAAE,kBAAkB,CAAA;IACjC,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,2CAA2C;AAC3C,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,UAAU,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IAChD,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,MAAM,wBAAwB,GAChC,kBAAkB,GAClB,qBAAqB,GACrB,qBAAqB,GACrB,UAAU,CAAA;AAEd,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,YAAY,CAAA;IAChD,sEAAsE;IACtE,oBAAoB,EAAE,MAAM,CAAA;IAC5B,yFAAyF;IACzF,gBAAgB,EAAE,OAAO,CAAA;CAC1B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,aAAa;IAC5B,kBAAkB,EAAE,MAAM,CAAA;IAC1B,kBAAkB,EAAE,MAAM,CAAA;IAC1B,gBAAgB,EAAE,MAAM,CAAA;IACxB,aAAa,EAAE,MAAM,CAAA;IACrB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,mBAAmB,EAAE,OAAO,GAAG,IAAI,CAAA;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,iBAAiB,EAAE,aAAa,GAAG,IAAI,CAAA;IACvC,0BAA0B,EAAE,wBAAwB,CAAA;IACpD,mBAAmB,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAC9C,qBAAqB,EAAE,mBAAmB,GAAG,IAAI,CAAA;IACjD;;;;;OAKG;IACH,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAAA;IAClC;;;;OAIG;IACH,sBAAsB,EAAE,OAAO,GAAG,IAAI,CAAA;IACtC;;;;;OAKG;IACH,MAAM,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5B;;;;;;OAMG;IACH,oCAAoC,EAAE,OAAO,GAAG,IAAI,CAAA;IACpD,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,UAAU,CAAA;IACxB,QAAQ,EAAE,UAAU,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,UAAU,CAAA;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,+DAA+D;IAC/D,UAAU,EAAE,UAAU,EAAE,CAAA;IACxB,kDAAkD;IAClD,KAAK,EAAE,UAAU,CAAA;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE;QACR,gBAAgB,EAAE,MAAM,CAAA;QACxB,cAAc,EAAE,MAAM,CAAA;QACtB,eAAe,EAAE,MAAM,CAAA;KACxB,CAAA;IACD,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,iEAAiE;IACjE,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,mEAAmE;IACnE,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IAC1C,8CAA8C;IAC9C,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,gCAAgC;IAChC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,UAAU,CAAA;IAClC;;;;;;;;;;;;OAYG;IACH,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,sBAAsB,KAAK,OAAO,CAAA;IAC9D;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;;;;;;;OAYG;IACH,eAAe,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;IACpE;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACrE;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAID,wBAAsB,eAAe,CACnC,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC,kBAAkB,CAAC,CAkQ7B"}

package/dist/resolve-identity.js

@@ -1,4 +1,22 @@
 // SPDX-License-Identifier: Apache-2.0
+/**
+ * Identity resolution per spec §6.3 — the 9-step verifier consultation
+ * algorithm. The verifier consults the directory for a record's
+ * creator_key and surfaces an `identity_resolution` object.
+ *
+ * This implementation is the LEGIBLE PARTIAL: steps 6 (directory
+ * lookup), 8 (parse claim), and 9 (revocation cross-check) are wired
+ * end-to-end. Steps 1-5 (anchor freshness, witness coverage, directory
+ * checkpoint signature, append-only consistency) and step 7 (AKD proof
+ * validation) require heavier cryptographic infrastructure and are
+ * surfaced as explicit warnings rather than falsely claimed as passing.
+ *
+ * Per §5.8 degradation contract: this function never throws. Network
+ * failures, malformed responses, and timeout conditions all produce
+ * warnings in the returned object.
+ */
+import * as ed25519 from '@noble/ed25519';
+import canonicalize from 'canonicalize';
 const DEFAULT_DIRECTORY = 'https://directory.atrib.dev/v6';
 export async function resolveIdentity(creatorKey, opts = {}) {
     const warnings = [];
@@ -33,6 +51,7 @@ export async function resolveIdentity(creatorKey, opts = {}) {
                 capability_envelope: null,
                 key_revocation_status: status,
                 lookup_proof_valid: null,
+                directory_checkpoint_signature_valid: null,
                 append_only_consistent: null,
                 anchor: null,
                 warnings,
@@ -52,6 +71,7 @@ export async function resolveIdentity(creatorKey, opts = {}) {
             capability_envelope: null,
             key_revocation_status: status,
             lookup_proof_valid: null,
+            directory_checkpoint_signature_valid: null,
             append_only_consistent: null,
             anchor: null,
             warnings,
@@ -65,6 +85,7 @@ export async function resolveIdentity(creatorKey, opts = {}) {
             capability_envelope: null,
             key_revocation_status: applyRevocationOnly(creatorKey, opts, warnings),
             lookup_proof_valid: null,
+            directory_checkpoint_signature_valid: null,
             append_only_consistent: null,
             anchor: null,
             warnings,
@@ -82,22 +103,539 @@ export async function resolveIdentity(creatorKey, opts = {}) {
             capability_envelope: null,
             key_revocation_status: applyRevocationOnly(creatorKey, opts, warnings),
             lookup_proof_valid: null,
+            directory_checkpoint_signature_valid: null,
             append_only_consistent: null,
             anchor: null,
             warnings,
         };
     }
+    // Step 1 (anchor discovery on the log) + Step 2 (anchor freshness threshold).
+    // Runs when `directoryOperatorKey` + `logEndpoint` + `fetchAnchorBody` are
+    // all supplied. Discovers the most recent directory_anchor record on the
+    // log (in the directory's reserved context_id), fetches its body via
+    // the supplied callback, cross-checks the body's metadata, and populates
+    // the `anchor` output field.
+    //
+    // T (the record's timestamp) defaults to `recordTimestamp` opt; falls back
+    // to `Date.now()` when unset (verifying a record produced just-in-time).
+    const T = typeof opts.recordTimestamp === 'number' ? opts.recordTimestamp : Date.now();
+    let anchor = null;
+    let anchorBody = null;
+    let priorAnchorBody = null;
+    let directorySignatureValid = null;
+    if (opts.logEndpoint && opts.directoryOperatorKey && opts.fetchAnchorBody) {
+        const stepOneResult = await runStepOne({
+            logEndpoint: opts.logEndpoint,
+            directoryOperatorKey: opts.directoryOperatorKey,
+            fetchAnchorBody: opts.fetchAnchorBody,
+            directoryEndpoint,
+            recordTimestamp: T,
+            freshnessThresholdMs: opts.freshnessThresholdMs,
+            fetchFn,
+            signal: opts.signal,
+            warnings,
+        });
+        if (stepOneResult) {
+            anchor = stepOneResult.anchor;
+            anchorBody = stepOneResult.currentBody;
+            priorAnchorBody = stepOneResult.priorBody;
+        }
+    }
+    // Step 4 (directory checkpoint signature verification). HARD failure
+    // path per spec §6.3: a directory operator returning an invalidly-
+    // signed anchor body is a fault, not a soft signal — reject the
+    // entire query. Step 4 runs only when step 1 surfaced a body AND
+    // `directoryOperatorKey` was supplied (which step 1 already required).
+    if (anchorBody && opts.directoryOperatorKey) {
+        const ok = await verifyAnchorSignature(anchorBody, opts.directoryOperatorKey, warnings);
+        directorySignatureValid = ok;
+        if (ok) {
+            const idx = warnings.findIndex((w) => w.startsWith('step-4-checkpoint-signature-not-checked'));
+            if (idx >= 0)
+                warnings.splice(idx, 1);
+        }
+        else {
+            // §6.3 step 4 hard-failure: reject. Anchor + step-4 result stay
+            // populated so consumers see WHY the rejection happened.
+            return {
+                identity_resolved: null,
+                identity_resolution_method: 'rejected',
+                capability_envelope: null,
+                key_revocation_status: applyRevocationOnly(creatorKey, opts, warnings),
+                lookup_proof_valid: null,
+                append_only_consistent: null,
+                anchor,
+                directory_checkpoint_signature_valid: false,
+                warnings,
+            };
+        }
+    }
+    // Step 3 (witness coverage on the log's checkpoint). Soft signal:
+    // counts cosignature lines on the latest log checkpoint whose origin
+    // differs from the log's own (= witness signatures). Compares against
+    // `witnessThreshold`. Implemented as a count-only check; cryptographic
+    // verification of each witness signature is a separate enhancement.
+    // log-node currently produces single-signer checkpoints (no witnesses
+    // cosigning), so the actual count is 0 against any production
+    // checkpoint as of the time of writing — that's honest data, not
+    // a bug; the threshold semantic still works once witnesses come online.
+    if (opts.logEndpoint && anchor) {
+        const witnessCount = await runStepThree(opts.logEndpoint, opts.witnessThreshold, fetchFn, opts.signal, warnings);
+        if (witnessCount !== null) {
+            // anchor is non-null here (we checked above); update its witness count.
+            anchor = { ...anchor, anchor_witness_count: witnessCount };
+        }
+    }
+    // Step 7 (AKD lookup proof verification). Only attempted when the
+    // caller supplies both `verifyLookupProof` (the bridge wrapper from
+    // `@atrib/directory`) and `directoryVrfPublicKey`. When supplied AND
+    // the proof is missing/malformed, we surface a warning and proceed
+    // (soft signal). When the proof verifies as invalid, §6.3 step 7
+    // mandates a HARD failure: the result is rejected.
+    //
+    // When step 1 surfaced a log-anchored body, step 7 verifies against
+    // the LOG-ANCHORED root (stronger; catches directory body forgery).
+    // Otherwise it falls back to the directory's self-reported `/anchor`.
+    let lookupProofValid = null;
+    if (opts.verifyLookupProof && opts.directoryVrfPublicKey) {
+        const stepSevenOutcome = await runStepSeven(creatorKey, directoryEndpoint, lookupBody.proof, opts.verifyLookupProof, opts.directoryVrfPublicKey, fetchFn, opts.signal, warnings, anchorBody);
+        if (stepSevenOutcome === 'rejected') {
+            return {
+                identity_resolved: null,
+                identity_resolution_method: 'rejected',
+                capability_envelope: null,
+                key_revocation_status: applyRevocationOnly(creatorKey, opts, warnings),
+                lookup_proof_valid: false,
+                append_only_consistent: null,
+                anchor,
+                directory_checkpoint_signature_valid: directorySignatureValid,
+                warnings,
+            };
+        }
+        lookupProofValid = stepSevenOutcome; // true | null
+    }
+    // Step 5 (append-only consistency). Only attempted when step 1 surfaced
+    // both a current AND a prior anchor body (need a pair for audit_verify),
+    // AND `verifyAuditProof` callback is supplied.
+    let appendOnlyConsistent = null;
+    if (opts.verifyAuditProof && anchorBody && priorAnchorBody) {
+        const stepFiveOutcome = await runStepFive({
+            currentBody: anchorBody,
+            priorBody: priorAnchorBody,
+            directoryEndpoint,
+            verifyAuditProof: opts.verifyAuditProof,
+            fetchFn,
+            signal: opts.signal,
+            warnings,
+        });
+        if (stepFiveOutcome === 'rejected') {
+            // §6.3 step 5 hard-failure path: append-only consistency violated.
+            return {
+                identity_resolved: null,
+                identity_resolution_method: 'rejected',
+                capability_envelope: null,
+                key_revocation_status: applyRevocationOnly(creatorKey, opts, warnings),
+                lookup_proof_valid: lookupProofValid,
+                append_only_consistent: false,
+                anchor,
+                directory_checkpoint_signature_valid: directorySignatureValid,
+                warnings,
+            };
+        }
+        appendOnlyConsistent = stepFiveOutcome; // true | null
+    }
     return {
         identity_resolved: claim,
         identity_resolution_method: 'directory_lookup',
         capability_envelope: claim.capabilities ?? null,
         key_revocation_status: applyRevocationOnly(creatorKey, opts, warnings),
-        lookup_proof_valid: null,
-        append_only_consistent: null,
-        anchor: null,
+        lookup_proof_valid: lookupProofValid,
+        append_only_consistent: appendOnlyConsistent,
+        anchor,
+        directory_checkpoint_signature_valid: directorySignatureValid,
         warnings,
     };
 }
+/**
+ * Compute the directory's reserved context_id from its origin per the
+ * pattern in services/directory-node/src/anchor.ts: sha256(origin)
+ * truncated to the first 16 bytes (32 hex chars).
+ */
+function deriveDirectoryContextId(origin) {
+    // Use SubtleCrypto if available to avoid importing @noble/hashes here.
+    // (The SDK callers already import @noble/hashes; this function lives
+    // in the verify package which we keep dep-light.)
+    const enc = new TextEncoder().encode(origin);
+    // Synchronous SHA-256 via @noble/hashes is already a transitive dep
+    // (through @atrib/mcp); use it to keep the call sync.
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const { sha256 } = require('@noble/hashes/sha2.js');
+    const digest = sha256(enc);
+    return Array.from(digest.slice(0, 16))
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+/**
+ * Spec §6.3 step 1: discover the most recent `directory_anchor` record
+ * on the log whose timestamp is ≤ T (the verifying record's timestamp),
+ * fetch its body, cross-check the body's signed metadata, and populate
+ * the verifier's `anchor` output field. Step 2 (freshness threshold)
+ * piggybacks since we have anchor.timestamp + recordTimestamp here.
+ *
+ * Side effects (only on the warnings array):
+ *   - Removes the up-front step-1-anchor-not-checked warning when
+ *     anchor discovery succeeds (a more specific warning replaces it
+ *     when the body fetch fails or the cross-check rejects).
+ *
+ * Returns null when discovery couldn't be completed (log fetch
+ * failure, no anchor matches, body fetch fails). Returns a
+ * StepOneSuccess when the anchor is discovered + body retrieved +
+ * metadata cross-check passes.
+ *
+ * Cross-check (lightweight sanity): body's metadata.directory_origin
+ * must be a non-empty string; body's metadata.directory_epoch must be
+ * a number; body's signature must be a non-empty string.
+ * Stronger: re-canonicalize the body and verify the signature against
+ * the operator's pubkey (deferred to a follow-on commit; the log's
+ * inclusion proof already authenticates the hash, so the signature
+ * re-verify is defense-in-depth, not load-bearing for step 1).
+ */
+async function runStepOne(opts) {
+    const directoryOrigin = await fetchDirectoryOrigin(opts.directoryEndpoint, opts.fetchFn, opts.signal, opts.warnings);
+    if (!directoryOrigin)
+        return null;
+    const contextHex = deriveDirectoryContextId(directoryOrigin);
+    let entries;
+    try {
+        const url = `${opts.logEndpoint.replace(/\/$/, '')}/by-context/${contextHex}`;
+        const res = await opts.fetchFn(url, {
+            headers: { accept: 'application/json' },
+            ...(opts.signal ? { signal: opts.signal } : {}),
+        });
+        if (res.status === 404) {
+            opts.warnings.push('step-1-anchor-not-found: no directory_anchor records in the directory\'s context_id on the log');
+            return null;
+        }
+        if (!res.ok) {
+            opts.warnings.push(`step-1-log-fetch-error: ${res.status} ${res.statusText}`);
+            return null;
+        }
+        const body = await res.json();
+        entries = body.entries ?? [];
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        opts.warnings.push(`step-1-log-fetch-error: ${msg}`);
+        return null;
+    }
+    // Filter by event_type=directory_anchor + creator_key match + timestamp ≤ T.
+    // The handleByContext response is newest-first.
+    const matches = entries.filter((e) => e.event_type === 'directory_anchor' &&
+        e.creator_key === opts.directoryOperatorKey &&
+        e.timestamp_ms <= opts.recordTimestamp);
+    if (matches.length === 0) {
+        opts.warnings.push('step-1-anchor-not-found: no directory_anchor on the log matches the operator key + timestamp window');
+        return null;
+    }
+    const current = matches[0]; // newest-first → first match is the most recent
+    const prior = matches[1] ?? null; // second-most-recent, if any
+    // Fetch the body for the current anchor (and predecessor when present).
+    const recordHashStr = current.record_hash.startsWith('sha256:') ? current.record_hash : `sha256:${current.record_hash}`;
+    let currentBody;
+    try {
+        currentBody = await opts.fetchAnchorBody(recordHashStr);
+    }
+    catch (e) {
+        opts.warnings.push(`step-1-body-fetch-error: ${e instanceof Error ? e.message : String(e)}`);
+        return null;
+    }
+    if (!currentBody) {
+        opts.warnings.push(`step-1-body-not-available: anchor ${recordHashStr} present on log but body not retrievable from directory or archive`);
+        return null;
+    }
+    // Cross-check: body's signed metadata must be self-consistent. Strong
+    // checks (signature re-verify against operator pubkey) are deferred;
+    // log inclusion already authenticates the hash, so this catches body
+    // forgery scenarios without re-implementing Ed25519 verify here.
+    if (typeof currentBody.metadata?.directory_origin !== 'string' ||
+        currentBody.metadata.directory_origin.length === 0 ||
+        typeof currentBody.metadata?.directory_epoch !== 'number' ||
+        typeof currentBody.metadata?.directory_root !== 'string' ||
+        typeof currentBody.signature !== 'string' ||
+        currentBody.signature.length === 0) {
+        opts.warnings.push('step-1-body-malformed: anchor body missing required metadata fields');
+        return null;
+    }
+    if (currentBody.creator_key !== opts.directoryOperatorKey) {
+        opts.warnings.push('step-1-body-creator-mismatch: anchor body creator_key does not match directoryOperatorKey');
+        return null;
+    }
+    // Optional predecessor body for step 5; tolerate failure since step 5
+    // can stay warning-only without it.
+    let priorBody = null;
+    if (prior) {
+        const priorHashStr = prior.record_hash.startsWith('sha256:') ? prior.record_hash : `sha256:${prior.record_hash}`;
+        try {
+            priorBody = await opts.fetchAnchorBody(priorHashStr);
+        }
+        catch {
+            // Soft: step 5 will note its absence.
+        }
+    }
+    const anchorAgeMs = opts.recordTimestamp - current.timestamp_ms;
+    const freshnessOk = typeof opts.freshnessThresholdMs === 'number'
+        ? anchorAgeMs <= opts.freshnessThresholdMs
+        : null;
+    if (typeof opts.freshnessThresholdMs === 'number' && freshnessOk === false) {
+        opts.warnings.push(`step-2-anchor-stale: anchor_age_ms=${anchorAgeMs} > threshold=${opts.freshnessThresholdMs}`);
+    }
+    const surface = {
+        anchor_record_hash: recordHashStr,
+        checkpoint_version: currentBody.metadata.directory_epoch,
+        anchor_timestamp: current.timestamp_ms,
+        anchor_age_ms: anchorAgeMs,
+        anchor_witness_count: null, // step 3, deferred
+        anchor_freshness_ok: freshnessOk,
+    };
+    // Remove the up-front step-1 warning since we did discover one.
+    const idx = opts.warnings.findIndex((w) => w.startsWith('step-1-anchor-not-checked'));
+    if (idx >= 0)
+        opts.warnings.splice(idx, 1);
+    return { anchor: surface, currentBody, priorBody };
+}
+/**
+ * Fetch the directory's origin string from its `/anchor` endpoint.
+ * The origin is what we hash to compute the directory's reserved
+ * context_id for log-side anchor discovery.
+ *
+ * Returns null on any error (warnings array gets a step-1-origin-fetch entry).
+ */
+async function fetchDirectoryOrigin(directoryEndpoint, fetchFn, signal, warnings) {
+    try {
+        const url = `${directoryEndpoint.replace(/\/$/, '')}/anchor`;
+        const res = await fetchFn(url, {
+            headers: { accept: 'application/json' },
+            ...(signal ? { signal } : {}),
+        });
+        if (!res.ok) {
+            warnings.push(`step-1-origin-fetch-error: ${res.status} ${res.statusText}`);
+            return null;
+        }
+        const body = await res.json();
+        if (typeof body.directory_origin !== 'string' || body.directory_origin.length === 0) {
+            warnings.push('step-1-origin-missing: directory /anchor response missing directory_origin');
+            return null;
+        }
+        return body.directory_origin;
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        warnings.push(`step-1-origin-fetch-error: ${msg}`);
+        return null;
+    }
+}
+/**
+ * Spec §6.3 step 5: append-only consistency check. Fetches the audit
+ * proof between the prior anchor's epoch and the current anchor's
+ * epoch from the directory's `/v6/audit-proof` endpoint, then runs
+ * verify_audit_proof against the [prior_root, current_root] pair.
+ *
+ * Returns:
+ *   - `true`     when the audit proof verifies
+ *   - `null`     when verification couldn't be attempted (fetch or
+ *                decode error, callback throws)
+ *   - `'rejected'` when verification rejects → §6.3 step 5 HARD failure
+ */
+async function runStepFive(opts) {
+    const fromEpoch = opts.priorBody.metadata.directory_epoch;
+    const toEpoch = opts.currentBody.metadata.directory_epoch;
+    if (toEpoch <= fromEpoch) {
+        opts.warnings.push(`step-5-invalid-epoch-range: prior=${fromEpoch} >= current=${toEpoch}`);
+        return null;
+    }
+    // Fetch audit proof from the directory.
+    let proofB64u;
+    try {
+        const url = `${opts.directoryEndpoint.replace(/\/$/, '')}/audit-proof?from=${fromEpoch}&to=${toEpoch}`;
+        const res = await opts.fetchFn(url, {
+            headers: { accept: 'application/json' },
+            ...(opts.signal ? { signal: opts.signal } : {}),
+        });
+        if (!res.ok) {
+            opts.warnings.push(`step-5-audit-proof-fetch-error: ${res.status} ${res.statusText}`);
+            return null;
+        }
+        const body = await res.json();
+        if (typeof body.proof !== 'string' || body.proof.length === 0) {
+            opts.warnings.push('step-5-audit-proof-missing: directory /audit-proof response missing proof field');
+            return null;
+        }
+        proofB64u = body.proof;
+    }
+    catch (e) {
+        opts.warnings.push(`step-5-audit-proof-fetch-error: ${e instanceof Error ? e.message : String(e)}`);
+        return null;
+    }
+    // Decode roots + proof.
+    let priorRoot;
+    let currentRoot;
+    let proof;
+    try {
+        priorRoot = hexToBytes(opts.priorBody.metadata.directory_root);
+        currentRoot = hexToBytes(opts.currentBody.metadata.directory_root);
+        if (priorRoot.length !== 32 || currentRoot.length !== 32) {
+            throw new Error('directory_root must be 32 bytes');
+        }
+        proof = base64urlToBytes(proofB64u);
+    }
+    catch (e) {
+        opts.warnings.push(`step-5-input-decode-error: ${e instanceof Error ? e.message : String(e)}`);
+        return null;
+    }
+    let verified;
+    try {
+        verified = await opts.verifyAuditProof({
+            rootHashes: [priorRoot, currentRoot],
+            proof,
+        });
+    }
+    catch (e) {
+        opts.warnings.push(`step-5-verify-threw: ${e instanceof Error ? e.message : String(e)}`);
+        return null;
+    }
+    if (verified) {
+        const idx = opts.warnings.findIndex((w) => w.startsWith('step-5-append-only-not-checked'));
+        if (idx >= 0)
+            opts.warnings.splice(idx, 1);
+        return true;
+    }
+    opts.warnings.push('step-5-audit-proof-invalid: audit proof did not verify against the prior + current anchored roots');
+    return 'rejected';
+}
+/**
+ * Runs spec §6.3 step 7 — AKD lookup proof verification — against the
+ * directory's currently-anchored root.
+ *
+ * Returns:
+ *   - `true`  when the proof verified
+ *   - `null`  when verification couldn't be attempted (anchor fetch
+ *             failed, proof was missing or undecodable, callback threw)
+ *   - `'rejected'` when the proof verified as INVALID — §6.3 step 7
+ *                  hard-failure path; caller short-circuits the result
+ *
+ * On `true`, removes the `step-7-akd-proof-not-validated` warning that
+ * was pushed up front; the warning becomes inaccurate once we've
+ * actually validated. The step-1 anchor cross-check warning stays
+ * regardless: this implementation trusts the directory's self-reported
+ * `/anchor` root rather than cross-checking against a log-anchored
+ * `directory_anchor` record.
+ */
+async function runStepSeven(creatorKey, directoryEndpoint, proofB64u, verifyLookupProof, vrfPublicKey, fetchFn, signal, warnings, 
+/**
+ * Optional log-anchored body from step 1. When supplied, step 7
+ * verifies the lookup proof against the LOG-ANCHORED root + epoch
+ * (stronger; catches directory body forgery). When null, falls back
+ * to the directory's self-reported `/anchor` (still useful but
+ * weaker — depends on the directory being honest about its current
+ * state). The fallback path is tracked by the step-1 warnings
+ * since step 1 is what discovers the log-anchored body in the first
+ * place.
+ */
+logAnchoredBody) {
+    if (typeof proofB64u !== 'string' || proofB64u.length === 0) {
+        warnings.push('step-7-proof-missing: directory lookup did not return a proof field');
+        return null;
+    }
+    // Source the (root, epoch) pair: prefer log-anchored body when supplied.
+    let rootHashHex;
+    let currentEpoch;
+    if (logAnchoredBody) {
+        rootHashHex = logAnchoredBody.metadata.directory_root;
+        currentEpoch = logAnchoredBody.metadata.directory_epoch;
+    }
+    else {
+        let anchorResp;
+        try {
+            const url = `${directoryEndpoint.replace(/\/$/, '')}/anchor`;
+            const res = await fetchFn(url, {
+                headers: { accept: 'application/json' },
+                ...(signal ? { signal } : {}),
+            });
+            if (!res.ok) {
+                warnings.push(`step-7-anchor-fetch-error: ${res.status} ${res.statusText}`);
+                return null;
+            }
+            anchorResp = await res.json();
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            warnings.push(`step-7-anchor-fetch-error: ${msg}`);
+            return null;
+        }
+        if (typeof anchorResp.epoch !== 'number' || typeof anchorResp.root_hash !== 'string') {
+            warnings.push('step-7-anchor-malformed: anchor response missing epoch or root_hash');
+            return null;
+        }
+        rootHashHex = anchorResp.root_hash;
+        currentEpoch = anchorResp.epoch;
+    }
+    let rootHash;
+    let proof;
+    try {
+        rootHash = hexToBytes(rootHashHex);
+        if (rootHash.length !== 32) {
+            throw new Error(`root_hash must be 32 bytes (got ${rootHash.length})`);
+        }
+        proof = base64urlToBytes(proofB64u);
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        warnings.push(`step-7-input-decode-error: ${msg}`);
+        return null;
+    }
+    let verified;
+    try {
+        verified = verifyLookupProof({
+            vrfPublicKey,
+            rootHash,
+            currentEpoch,
+            label: creatorKey,
+            proof,
+        });
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        warnings.push(`step-7-verify-threw: ${msg}`);
+        return null;
+    }
+    if (verified) {
+        // We did the check; the up-front warning is now inaccurate.
+        const idx = warnings.findIndex((w) => w.startsWith('step-7-akd-proof-not-validated'));
+        if (idx >= 0)
+            warnings.splice(idx, 1);
+        return true;
+    }
+    warnings.push('step-7-akd-proof-invalid: AKD lookup proof did not verify against the directory\'s anchored root');
+    return 'rejected';
+}
+/** Decode a hex string into bytes. Throws on odd-length or non-hex input. */
+function hexToBytes(hex) {
+    if (hex.length % 2 !== 0)
+        throw new Error('hex string must have even length');
+    const out = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < out.length; i++) {
+        const byte = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+        if (Number.isNaN(byte))
+            throw new Error(`invalid hex at offset ${i * 2}`);
+        out[i] = byte;
+    }
+    return out;
+}
+/** Decode a base64url string into bytes. Pads as needed. */
+function base64urlToBytes(s) {
+    const padLen = (4 - (s.length % 4)) % 4;
+    return new Uint8Array(Buffer.from(s + '='.repeat(padLen), 'base64url'));
+}
 /**
  * Step 9 helper: cross-check the revocation registry. since_revocation
  * is true when the record's log_index is strictly greater than the
@@ -118,4 +656,129 @@ function applyRevocationOnly(creatorKey, opts, warnings) {
         since_revocation: sinceRevocation,
     };
 }
+/**
+ * Spec §6.3 step 4 — verify the directory operator's Ed25519 signature
+ * on the anchor record body.
+ *
+ * The signed bytes are the canonical (JCS-style) JSON of the body MINUS
+ * the `signature` field. The atrib substrate uses `canonicalize` (RFC
+ * 8785 JCS); the directory's own emitDirectoryAnchor canonicalizes the
+ * unsigned shape THEN appends the signature, so re-canonicalizing the
+ * body without `signature` reproduces the bytes the operator signed.
+ *
+ * Returns `true` for a valid signature, `false` otherwise. Pushes a
+ * `step-4-signature-invalid` warning on rejection so consumers see why.
+ * Errors during canonicalization, base64url decode, or ed25519 verify
+ * all return `false` — a fault during step 4 is not a soft signal,
+ * per spec §6.3 ("a directory operator returning an invalidly-signed
+ * checkpoint is a fault").
+ */
+async function verifyAnchorSignature(body, expectedOperatorKey, warnings) {
+    // Re-canonicalize without the signature field. Order matches the
+    // emit-side: every non-signature field is included.
+    const { signature, ...unsigned } = body;
+    const canonical = canonicalize(unsigned);
+    if (typeof canonical !== 'string') {
+        warnings.push('step-4-canonicalize-failed: anchor body could not be canonicalized');
+        return false;
+    }
+    let sigBytes;
+    let pubBytes;
+    try {
+        sigBytes = base64urlToBytes(signature);
+        pubBytes = base64urlToBytes(expectedOperatorKey);
+    }
+    catch (e) {
+        warnings.push(`step-4-decode-failed: ${e instanceof Error ? e.message : String(e)}`);
+        return false;
+    }
+    if (sigBytes.length !== 64 || pubBytes.length !== 32) {
+        warnings.push(`step-4-decode-failed: signature must be 64 bytes (got ${sigBytes.length}), pubkey 32 bytes (got ${pubBytes.length})`);
+        return false;
+    }
+    let ok = false;
+    try {
+        ok = await ed25519.verifyAsync(sigBytes, new TextEncoder().encode(canonical), pubBytes);
+    }
+    catch (e) {
+        warnings.push(`step-4-verify-threw: ${e instanceof Error ? e.message : String(e)}`);
+        return false;
+    }
+    if (!ok) {
+        warnings.push('step-4-signature-invalid: directory operator signature on anchor body did not verify');
+    }
+    return ok;
+}
+/**
+ * Spec §6.3 step 3 — count witness cosignatures on the log's latest
+ * checkpoint. Soft signal.
+ *
+ * Fetches `GET /v1/checkpoint` from the log, parses the C2SP signed-note
+ * format, counts cosignature lines whose origin differs from the log's
+ * own (= witnesses, not the log signing itself). Compares against
+ * `threshold` and surfaces a step-3-witness-insufficient warning if
+ * below.
+ *
+ * Returns the count when discoverable; `null` when the count couldn't
+ * be determined (fetch failure, malformed checkpoint, etc.).
+ *
+ * Implementation note. This is a count-only check: each cosignature
+ * line is parsed for shape and origin, but the signatures are NOT
+ * cryptographically verified against a configured trusted-witness
+ * set. The `step-3-witness-not-cryptographically-verified` warning
+ * surfaces alongside the count to make this honest. Verifying each
+ * signature against trusted witness vkeys is a separate enhancement.
+ */
+async function runStepThree(logEndpoint, threshold, fetchFn, signal, warnings) {
+    let checkpointText;
+    try {
+        const url = `${logEndpoint.replace(/\/$/, '')}/checkpoint`;
+        const res = await fetchFn(url, {
+            headers: { accept: 'text/plain' },
+            ...(signal ? { signal } : {}),
+        });
+        if (!res.ok) {
+            warnings.push(`step-3-checkpoint-fetch-error: ${res.status} ${res.statusText}`);
+            return null;
+        }
+        checkpointText = await res.text();
+    }
+    catch (e) {
+        warnings.push(`step-3-checkpoint-fetch-error: ${e instanceof Error ? e.message : String(e)}`);
+        return null;
+    }
+    // Parse the C2SP signed-note format: `body\n\n<signature lines>`.
+    // The first line of the body is the log's origin string; cosignature
+    // lines whose origin matches are the log's own signature, not witness
+    // cosignatures.
+    const blankSep = checkpointText.indexOf('\n\n');
+    if (blankSep < 0) {
+        warnings.push('step-3-checkpoint-malformed: signed-note body/signature separator not found');
+        return null;
+    }
+    const body = checkpointText.slice(0, blankSep);
+    const sigBlock = checkpointText.slice(blankSep + 2);
+    const logOrigin = body.split('\n', 1)[0] ?? '';
+    let witnessCount = 0;
+    for (const line of sigBlock.split('\n')) {
+        if (!line.trim())
+            continue;
+        // Each signature line starts with em-dash + space + origin + space + sigToken.
+        const match = line.match(/^[—\-] (\S+) (\S+)\s*$/);
+        if (!match)
+            continue;
+        const sigOrigin = match[1];
+        if (sigOrigin !== logOrigin)
+            witnessCount += 1;
+    }
+    warnings.push('step-3-witness-not-cryptographically-verified: witness cosignature count is line-based, not cryptographically verified against a trusted-witness set');
+    if (typeof threshold === 'number' && witnessCount < threshold) {
+        warnings.push(`step-3-witness-insufficient: actual=${witnessCount}, required=${threshold}`);
+    }
+    // Remove the up-front step-3-witness-not-checked warning since we did parse the checkpoint.
+    const idx = warnings.findIndex((w) => w.startsWith('step-3-witness-not-checked'));
+    if (idx >= 0)
+        warnings.splice(idx, 1);
+    return witnessCount;
+}
 //# sourceMappingURL=resolve-identity.js.map

package/dist/resolve-identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-identity.js","sourceRoot":"","sources":["../src/resolve-identity.ts"],"names":[],"mappings":"AAAA,sCAAsC;AA6FtC,MAAM,iBAAiB,GAAG,gCAAgC,CAAA;AAE1D,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAkB,EAClB,OAA+B,EAAE;IAEjC,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,IAAI,iBAAiB,CAAA;IACrE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IAEvC,oEAAoE;IACpE,kEAAkE;IAClE,uBAAuB;IACvB,QAAQ,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAA;IAChG,QAAQ,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAA;IACjG,QAAQ,CAAC,IAAI,CAAC,6GAA6G,CAAC,CAAA;IAC5H,QAAQ,CAAC,IAAI,CAAC,6FAA6F,CAAC,CAAA;IAC5G,QAAQ,CAAC,IAAI,CAAC,+FAA+F,CAAC,CAAA;IAE9G,2BAA2B;IAC3B,IAAI,UAAU,GAAiF,EAAE,CAAA;IACjG,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAA;QAC9F,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC7B,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC,CAAA;QACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,8DAA8D;YAC9D,UAAU,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;QAC/B,CAAC;aAAM,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC,2BAA2B,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;YACxE,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;YAC9D,OAAO;gBACL,iBAAiB,EAAE,IAAI;gBACvB,0BAA0B,EAAE,UAAU;gBACtC,mBAAmB,EAAE,IAAI;gBACzB,qBAAqB,EAAE,MAAM;gBAC7B,kBAAkB,EAAE,IAAI;gBACxB,sBAAsB,EAAE,IAAI;gBAC5B,MAAM,EAAE,IAAI;gBACZ,QAAQ;aACT,CAAA;QACH,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,MAAM,GAAG,CAAC,IAAI,EAAuB,CAAA;QACpD,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACtD,QAAQ,CAAC,IAAI,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC9D,OAAO;YACL,iBAAiB,EAAE,IAAI;YACvB,0BAA0B,EAAE,UAAU;YACtC,mBAAmB,EAAE,IAAI;YACzB,qBAAqB,EAAE,MAAM;YAC7B,kBAAkB,EAAE,IAAI;YACxB,sBAAsB,EAAE,IAAI;YAC5B,MAAM,EAAE,IAAI;YACZ,QAAQ;SACT,CAAA;IACH,CAAC;IAED,wBAAwB;IACxB,IAAI,UAAU,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO;YACL,iBAAiB,EAAE,IAAI;YACvB,0BAA0B,EAAE,qBAAqB;YACjD,mBAAmB,EAAE,IAAI;YACzB,qBAAqB,EAAE,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC;YACtE,kBAAkB,EAAE,IAAI;YACxB,sBAAsB,EAAE,IAAI;YAC5B,MAAM,EAAE,IAAI;YACZ,QAAQ;SACT,CAAA;IACH,CAAC;IAED,oEAAoE;IACpE,kEAAkE;IAClE,kEAAkE;IAClE,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAA;IAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC5E,QAAQ,CAAC,IAAI,CAAC,2FAA2F,CAAC,CAAA;QAC1G,OAAO;YACL,iBAAiB,EAAE,IAAI;YACvB,0BAA0B,EAAE,UAAU;YACtC,mBAAmB,EAAE,IAAI;YACzB,qBAAqB,EAAE,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC;YACtE,kBAAkB,EAAE,IAAI;YACxB,sBAAsB,EAAE,IAAI;YAC5B,MAAM,EAAE,IAAI;YACZ,QAAQ;SACT,CAAA;IACH,CAAC;IAED,OAAO;QACL,iBAAiB,EAAE,KAAK;QACxB,0BAA0B,EAAE,kBAAkB;QAC9C,mBAAmB,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;QAC/C,qBAAqB,EAAE,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC;QACtE,kBAAkB,EAAE,IAAI;QACxB,sBAAsB,EAAE,IAAI;QAC5B,MAAM,EAAE,IAAI;QACZ,QAAQ;KACT,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,UAAkB,EAClB,IAA4B,EAC5B,QAAkB;IAElB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAA;QAC/E,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,eAAe,GACnB,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,IAAI,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,SAAS,CAAA;IAClF,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,iBAAiB;QAC/B,oBAAoB,EAAE,KAAK,CAAC,SAAS;QACrC,gBAAgB,EAAE,eAAe;KAClC,CAAA;AACH,CAAC"}
+{"version":3,"file":"resolve-identity.js","sourceRoot":"","sources":["../src/resolve-identity.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,YAAY,MAAM,cAAc,CAAA;AA0QvC,MAAM,iBAAiB,GAAG,gCAAgC,CAAA;AAE1D,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAkB,EAClB,OAA+B,EAAE;IAEjC,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,IAAI,iBAAiB,CAAA;IACrE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IAEvC,oEAAoE;IACpE,kEAAkE;IAClE,uBAAuB;IACvB,QAAQ,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAA;IAChG,QAAQ,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAA;IACjG,QAAQ,CAAC,IAAI,CAAC,6GAA6G,CAAC,CAAA;IAC5H,QAAQ,CAAC,IAAI,CAAC,6FAA6F,CAAC,CAAA;IAC5G,QAAQ,CAAC,IAAI,CAAC,+FAA+F,CAAC,CAAA;IAE9G,2BAA2B;IAC3B,IAAI,UAAU,GAAiF,EAAE,CAAA;IACjG,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAA;QAC9F,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC7B,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC,CAAA;QACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,8DAA8D;YAC9D,UAAU,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;QAC/B,CAAC;aAAM,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC,2BAA2B,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;YACxE,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;YAC9D,OAAO;gBACL,iBAAiB,EAAE,IAAI;gBACvB,0BAA0B,EAAE,UAAU;gBACtC,mBAAmB,EAAE,IAAI;gBACzB,qBAAqB,EAAE,MAAM;gBAC7B,kBAAkB,EAAE,IAAI;gBACxB,oCAAoC,EAAE,IAAI;gBAC1C,sBAAsB,EAAE,IAAI;gBAC5B,MAAM,EAAE,IAAI;gBACZ,QAAQ;aACT,CAAA;QACH,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,MAAM,GAAG,CAAC,IAAI,EAAuB,CAAA;QACpD,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACtD,QAAQ,CAAC,IAAI,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC9D,OAAO;YACL,iBAAiB,EAAE,IAAI;YACvB,0BAA0B,EAAE,UAAU;YACtC,mBAAmB,EAAE,IAAI;YACzB,qBAAqB,EAAE,MAAM;YAC7B,kBAAkB,EAAE,IAAI;YACtB,oCAAoC,EAAE,IAAI;YAC5C,sBAAsB,EAAE,IAAI;YAC5B,MAAM,EAAE,IAAI;YACZ,QAAQ;SACT,CAAA;IACH,CAAC;IAED,wBAAwB;IACxB,IAAI,UAAU,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO;YACL,iBAAiB,EAAE,IAAI;YACvB,0BAA0B,EAAE,qBAAqB;YACjD,mBAAmB,EAAE,IAAI;YACzB,qBAAqB,EAAE,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC;YACtE,kBAAkB,EAAE,IAAI;YACtB,oCAAoC,EAAE,IAAI;YAC5C,sBAAsB,EAAE,IAAI;YAC5B,MAAM,EAAE,IAAI;YACZ,QAAQ;SACT,CAAA;IACH,CAAC;IAED,oEAAoE;IACpE,kEAAkE;IAClE,kEAAkE;IAClE,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAA;IAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC5E,QAAQ,CAAC,IAAI,CAAC,2FAA2F,CAAC,CAAA;QAC1G,OAAO;YACL,iBAAiB,EAAE,IAAI;YACvB,0BAA0B,EAAE,UAAU;YACtC,mBAAmB,EAAE,IAAI;YACzB,qBAAqB,EAAE,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC;YACtE,kBAAkB,EAAE,IAAI;YACtB,oCAAoC,EAAE,IAAI;YAC5C,sBAAsB,EAAE,IAAI;YAC5B,MAAM,EAAE,IAAI;YACZ,QAAQ;SACT,CAAA;IACH,CAAC;IAED,8EAA8E;IAC9E,2EAA2E;IAC3E,yEAAyE;IACzE,qEAAqE;IACrE,yEAAyE;IACzE,6BAA6B;IAC7B,EAAE;IACF,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,CAAC,GAAG,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAA;IACtF,IAAI,MAAM,GAAyB,IAAI,CAAA;IACvC,IAAI,UAAU,GAAsB,IAAI,CAAA;IACxC,IAAI,eAAe,GAAsB,IAAI,CAAA;IAC7C,IAAI,uBAAuB,GAAmB,IAAI,CAAA;IAClD,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QAC1E,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC;YACrC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,iBAAiB;YACjB,eAAe,EAAE,CAAC;YAClB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,OAAO;YACP,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ;SACT,CAAC,CAAA;QACF,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,GAAG,aAAa,CAAC,MAAM,CAAA;YAC7B,UAAU,GAAG,aAAa,CAAC,WAAW,CAAA;YACtC,eAAe,GAAG,aAAa,CAAC,SAAS,CAAA;QAC3C,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,mEAAmE;IACnE,gEAAgE;IAChE,iEAAiE;IACjE,uEAAuE;IACvE,IAAI,UAAU,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,MAAM,qBAAqB,CAAC,UAAU,EAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAA;QACvF,uBAAuB,GAAG,EAAE,CAAA;QAC5B,IAAI,EAAE,EAAE,CAAC;YACP,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,yCAAyC,CAAC,CAAC,CAAA;YAC9F,IAAI,GAAG,IAAI,CAAC;gBAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACvC,CAAC;aAAM,CAAC;YACN,gEAAgE;YAChE,yDAAyD;YACzD,OAAO;gBACL,iBAAiB,EAAE,IAAI;gBACvB,0BAA0B,EAAE,UAAU;gBACtC,mBAAmB,EAAE,IAAI;gBACzB,qBAAqB,EAAE,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC;gBACtE,kBAAkB,EAAE,IAAI;gBACxB,sBAAsB,EAAE,IAAI;gBAC5B,MAAM;gBACN,oCAAoC,EAAE,KAAK;gBAC3C,QAAQ;aACT,CAAA;QACH,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,qEAAqE;IACrE,sEAAsE;IACtE,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,8DAA8D;IAC9D,iEAAiE;IACjE,wEAAwE;IACxE,IAAI,IAAI,CAAC,WAAW,IAAI,MAAM,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,MAAM,YAAY,CACrC,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,gBAAgB,EACrB,OAAO,EACP,IAAI,CAAC,MAAM,EACX,QAAQ,CACT,CAAA;QACD,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,wEAAwE;YACxE,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,oBAAoB,EAAE,YAAY,EAAE,CAAA;QAC5D,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,oEAAoE;IACpE,qEAAqE;IACrE,mEAAmE;IACnE,iEAAiE;IACjE,mDAAmD;IACnD,EAAE;IACF,oEAAoE;IACpE,oEAAoE;IACpE,sEAAsE;IACtE,IAAI,gBAAgB,GAAmB,IAAI,CAAA;IAC3C,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACzD,MAAM,gBAAgB,GAAG,MAAM,YAAY,CACzC,UAAU,EACV,iBAAiB,EACjB,UAAU,CAAC,KAAK,EAChB,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,qBAAqB,EAC1B,OAAO,EACP,IAAI,CAAC,MAAM,EACX,QAAQ,EACR,UAAU,CACX,CAAA;QACD,IAAI,gBAAgB,KAAK,UAAU,EAAE,CAAC;YACpC,OAAO;gBACL,iBAAiB,EAAE,IAAI;gBACvB,0BAA0B,EAAE,UAAU;gBACtC,mBAAmB,EAAE,IAAI;gBACzB,qBAAqB,EAAE,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC;gBACtE,kBAAkB,EAAE,KAAK;gBACzB,sBAAsB,EAAE,IAAI;gBAC5B,MAAM;gBACN,oCAAoC,EAAE,uBAAuB;gBAC7D,QAAQ;aACT,CAAA;QACH,CAAC;QACD,gBAAgB,GAAG,gBAAgB,CAAA,CAAC,cAAc;IACpD,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,+CAA+C;IAC/C,IAAI,oBAAoB,GAAmB,IAAI,CAAA;IAC/C,IAAI,IAAI,CAAC,gBAAgB,IAAI,UAAU,IAAI,eAAe,EAAE,CAAC;QAC3D,MAAM,eAAe,GAAG,MAAM,WAAW,CAAC;YACxC,WAAW,EAAE,UAAU;YACvB,SAAS,EAAE,eAAe;YAC1B,iBAAiB;YACjB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,OAAO;YACP,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ;SACT,CAAC,CAAA;QACF,IAAI,eAAe,KAAK,UAAU,EAAE,CAAC;YACnC,mEAAmE;YACnE,OAAO;gBACL,iBAAiB,EAAE,IAAI;gBACvB,0BAA0B,EAAE,UAAU;gBACtC,mBAAmB,EAAE,IAAI;gBACzB,qBAAqB,EAAE,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC;gBACtE,kBAAkB,EAAE,gBAAgB;gBACpC,sBAAsB,EAAE,KAAK;gBAC7B,MAAM;gBACN,oCAAoC,EAAE,uBAAuB;gBAC7D,QAAQ;aACT,CAAA;QACH,CAAC;QACD,oBAAoB,GAAG,eAAe,CAAA,CAAC,cAAc;IACvD,CAAC;IAED,OAAO;QACL,iBAAiB,EAAE,KAAK;QACxB,0BAA0B,EAAE,kBAAkB;QAC9C,mBAAmB,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;QAC/C,qBAAqB,EAAE,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC;QACtE,kBAAkB,EAAE,gBAAgB;QACpC,sBAAsB,EAAE,oBAAoB;QAC5C,MAAM;QACN,oCAAoC,EAAE,uBAAuB;QAC7D,QAAQ;KACT,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,MAAc;IAC9C,uEAAuE;IACvE,qEAAqE;IACrE,kDAAkD;IAClD,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC5C,oEAAoE;IACpE,sDAAsD;IACtD,iEAAiE;IACjE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,uBAAuB,CAAiD,CAAA;IACnG,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAC1B,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;SACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAA;AACb,CAAC;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,KAAK,UAAU,UAAU,CAAC,IAAmB;IAC3C,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;IACpH,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAA;IACjC,MAAM,UAAU,GAAG,wBAAwB,CAAC,eAAe,CAAC,CAAA;IAE5D,IAAI,OAA2B,CAAA;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,UAAU,EAAE,CAAA;QAC7E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAClC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC,CAAA;QACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,gGAAgG,CAAC,CAAA;YACpH,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,2BAA2B,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;YAC7E,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAsC,CAAA;QACjE,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAA;IAC9B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACtD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAA;QACpD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,6EAA6E;IAC7E,gDAAgD;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAC5B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,UAAU,KAAK,kBAAkB;QACnC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,oBAAoB;QAC3C,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC,eAAe,CACzC,CAAA;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,qGAAqG,CAAC,CAAA;QACzH,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAE,CAAA,CAAC,gDAAgD;IAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA,CAAC,6BAA6B;IAE9D,wEAAwE;IACxE,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,OAAO,CAAC,WAAW,EAAE,CAAA;IACvH,IAAI,WAA8B,CAAA;IAClC,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,CAAA;IACzD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,4BAA4B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAC5F,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,qCAAqC,aAAa,oEAAoE,CAAC,CAAA;QAC1I,OAAO,IAAI,CAAA;IACb,CAAC;IAED,sEAAsE;IACtE,qEAAqE;IACrE,qEAAqE;IACrE,iEAAiE;IACjE,IACE,OAAO,WAAW,CAAC,QAAQ,EAAE,gBAAgB,KAAK,QAAQ;QAC1D,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAClD,OAAO,WAAW,CAAC,QAAQ,EAAE,eAAe,KAAK,QAAQ;QACzD,OAAO,WAAW,CAAC,QAAQ,EAAE,cAAc,KAAK,QAAQ;QACxD,OAAO,WAAW,CAAC,SAAS,KAAK,QAAQ;QACzC,WAAW,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAClC,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAA;QACzF,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,WAAW,CAAC,WAAW,KAAK,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,2FAA2F,CAAC,CAAA;QAC/G,OAAO,IAAI,CAAA;IACb,CAAC;IAED,sEAAsE;IACtE,oCAAoC;IACpC,IAAI,SAAS,GAAsB,IAAI,CAAA;IACvC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,YAAY,GAAG,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,WAAW,EAAE,CAAA;QAChH,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAA;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,YAAY,CAAA;IAC/D,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,oBAAoB,KAAK,QAAQ;QAC3C,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,oBAAoB;QAC1C,CAAC,CAAC,IAAI,CAAA;IACV,IAAI,OAAO,IAAI,CAAC,oBAAoB,KAAK,QAAQ,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;QAC3E,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,sCAAsC,WAAW,gBAAgB,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAA;IAClH,CAAC;IAED,MAAM,OAAO,GAAkB;QAC7B,kBAAkB,EAAE,aAAa;QACjC,kBAAkB,EAAE,WAAW,CAAC,QAAQ,CAAC,eAAe;QACxD,gBAAgB,EAAE,OAAO,CAAC,YAAY;QACtC,aAAa,EAAE,WAAW;QAC1B,oBAAoB,EAAE,IAAI,EAAE,mBAAmB;QAC/C,mBAAmB,EAAE,WAAW;KACjC,CAAA;IAED,gEAAgE;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC,CAAA;IACrF,IAAI,GAAG,IAAI,CAAC;QAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IAE1C,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAA;AACpD,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,oBAAoB,CACjC,iBAAyB,EACzB,OAAqB,EACrB,MAA+B,EAC/B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAA;QAC5D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC7B,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,QAAQ,CAAC,IAAI,CAAC,8BAA8B,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;YAC3E,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAmC,CAAA;QAC9D,IAAI,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpF,QAAQ,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAA;YAC3F,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAA;IAC9B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACtD,QAAQ,CAAC,IAAI,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAYD;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,WAAW,CAAC,IAAoB;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAA;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAA;IACzD,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,qCAAqC,SAAS,eAAe,OAAO,EAAE,CAAC,CAAA;QAC1F,OAAO,IAAI,CAAA;IACb,CAAC;IAED,wCAAwC;IACxC,IAAI,SAAiB,CAAA;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,SAAS,OAAO,OAAO,EAAE,CAAA;QACtG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAClC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,mCAAmC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;YACrF,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAwB,CAAA;QACnD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAA;YACrG,OAAO,IAAI,CAAA;QACb,CAAC;QACD,SAAS,GAAG,IAAI,CAAC,KAAK,CAAA;IACxB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,mCAAmC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACnG,OAAO,IAAI,CAAA;IACb,CAAC;IAED,wBAAwB;IACxB,IAAI,SAAqB,CAAA;IACzB,IAAI,WAAuB,CAAA;IAC3B,IAAI,KAAiB,CAAA;IACrB,IAAI,CAAC;QACH,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;QAC9D,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;QAClE,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,WAAW,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QACpD,CAAC;QACD,KAAK,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAA;IACrC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,8BAA8B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAC9F,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,QAAiB,CAAA;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC;YACrC,UAAU,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC;YACpC,KAAK;SACN,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,wBAAwB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACxF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,gCAAgC,CAAC,CAAC,CAAA;QAC1F,IAAI,GAAG,IAAI,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QAC1C,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,mGAAmG,CAAC,CAAA;IACvH,OAAO,UAAU,CAAA;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,YAAY,CACzB,UAAkB,EAClB,iBAAyB,EACzB,SAA6B,EAC7B,iBAA6D,EAC7D,YAAwB,EACxB,OAAqB,EACrB,MAA+B,EAC/B,QAAkB;AAClB;;;;;;;;;GASG;AACH,eAAkC;IAElC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,QAAQ,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAA;QACpF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,yEAAyE;IACzE,IAAI,WAAmB,CAAA;IACvB,IAAI,YAAoB,CAAA;IACxB,IAAI,eAAe,EAAE,CAAC;QACpB,WAAW,GAAG,eAAe,CAAC,QAAQ,CAAC,cAAc,CAAA;QACrD,YAAY,GAAG,eAAe,CAAC,QAAQ,CAAC,eAAe,CAAA;IACzD,CAAC;SAAM,CAAC;QACN,IAAI,UAAkD,CAAA;QACtD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAA;YAC5D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;gBAC7B,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9B,CAAC,CAAA;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,QAAQ,CAAC,IAAI,CAAC,8BAA8B,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;gBAC3E,OAAO,IAAI,CAAA;YACb,CAAC;YACD,UAAU,GAAG,MAAM,GAAG,CAAC,IAAI,EAAuB,CAAA;QACpD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;YACtD,QAAQ,CAAC,IAAI,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAA;YAClD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACrF,QAAQ,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAA;YACpF,OAAO,IAAI,CAAA;QACb,CAAC;QACD,WAAW,GAAG,UAAU,CAAC,SAAS,CAAA;QAClC,YAAY,GAAG,UAAU,CAAC,KAAK,CAAA;IACjC,CAAC;IAED,IAAI,QAAoB,CAAA;IACxB,IAAI,KAAiB,CAAA;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAAA;QAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;QACxE,CAAC;QACD,KAAK,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAA;IACrC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACtD,QAAQ,CAAC,IAAI,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,QAAiB,CAAA;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,iBAAiB,CAAC;YAC3B,YAAY;YACZ,QAAQ;YACR,YAAY;YACZ,KAAK,EAAE,UAAU;YACjB,KAAK;SACN,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACtD,QAAQ,CAAC,IAAI,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAA;QAC5C,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,4DAA4D;QAC5D,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,gCAAgC,CAAC,CAAC,CAAA;QACrF,IAAI,GAAG,IAAI,CAAC;YAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACrC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAA;IACjH,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IAC7E,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACtD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACzE,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;IACf,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,4DAA4D;AAC5D,SAAS,gBAAgB,CAAC,CAAS;IACjC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IACvC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC,CAAA;AACzE,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,UAAkB,EAClB,IAA4B,EAC5B,QAAkB;IAElB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAA;QAC/E,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,eAAe,GACnB,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,IAAI,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,SAAS,CAAA;IAClF,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,iBAAiB;QAC/B,oBAAoB,EAAE,KAAK,CAAC,SAAS;QACrC,gBAAgB,EAAE,eAAe;KAClC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,qBAAqB,CAClC,IAAgB,EAChB,mBAA2B,EAC3B,QAAkB;IAElB,iEAAiE;IACjE,oDAAoD;IACpD,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAA;IACvC,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;IACxC,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,QAAQ,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAA;QACnF,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,QAAoB,CAAA;IACxB,IAAI,QAAoB,CAAA;IACxB,IAAI,CAAC;QACH,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAA;QACtC,QAAQ,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,CAAA;IAClD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,CAAC,IAAI,CAAC,yBAAyB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACpF,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,yDAAyD,QAAQ,CAAC,MAAM,2BAA2B,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;QACpI,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,EAAE,GAAG,KAAK,CAAA;IACd,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAA;IACzF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,CAAC,IAAI,CAAC,wBAAwB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACnF,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,QAAQ,CAAC,IAAI,CAAC,sFAAsF,CAAC,CAAA;IACvG,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,UAAU,YAAY,CACzB,WAAmB,EACnB,SAA6B,EAC7B,OAAqB,EACrB,MAA+B,EAC/B,QAAkB;IAElB,IAAI,cAAsB,CAAA;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAA;QAC1D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC7B,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;YACjC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,QAAQ,CAAC,IAAI,CAAC,kCAAkC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;YAC/E,OAAO,IAAI,CAAA;QACb,CAAC;QACD,cAAc,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IACnC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,CAAC,IAAI,CAAC,kCAAkC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAC7F,OAAO,IAAI,CAAA;IACb,CAAC;IAED,kEAAkE;IAClE,qEAAqE;IACrE,sEAAsE;IACtE,gBAAgB;IAChB,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAC/C,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAA;QAC5F,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IAC9C,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAA;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAE9C,IAAI,YAAY,GAAG,CAAC,CAAA;IACpB,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAQ;QAC1B,+EAA+E;QAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAA;QAClD,IAAI,CAAC,KAAK;YAAE,SAAQ;QACpB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAW,CAAA;QACpC,IAAI,SAAS,KAAK,SAAS;YAAE,YAAY,IAAI,CAAC,CAAA;IAChD,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,sJAAsJ,CAAC,CAAA;IAErK,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,YAAY,GAAG,SAAS,EAAE,CAAC;QAC9D,QAAQ,CAAC,IAAI,CAAC,uCAAuC,YAAY,cAAc,SAAS,EAAE,CAAC,CAAA;IAC7F,CAAC;IAED,4FAA4F;IAC5F,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC,CAAA;IACjF,IAAI,GAAG,IAAI,CAAC;QAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IAErC,OAAO,YAAY,CAAA;AACrB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atrib/verify",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -30,7 +30,7 @@
     "@noble/ed25519": "^2.3.0",
     "@noble/hashes": "^2.2.0",
     "canonicalize": "^2.1.0",
-    "@atrib/mcp": "0.5.0"
+    "@atrib/mcp": "0.6.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",