@atrib/verify 0.7.10 → 0.8.1

package/dist/anchor-plurality.js

@@ -0,0 +1,473 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Anchor plurality verification (D138, spec §2.11.7-§2.11.13).
+ *
+ * Implements the verifier side of the anchor interface over §2.11.3
+ * `log_proofs` arrays:
+ *
+ *   - `anchor_type` discrimination per §2.11.9: absent = `atrib-log`
+ *     carrying the legacy `(log_id, checkpoint, inclusion_proof)` triple,
+ *     so every existing bundle parses unchanged, byte-for-byte.
+ *   - Malformation rules (a)/(b) per §2.11.9: a malformed element is
+ *     excluded from every count except `proof_count` / `malformed_count`
+ *     and never invalidates the bundle or the record. Malformation takes
+ *     precedence over unknown-type surfacing: an element that violates
+ *     rule (b) is malformed even when its `anchor_type` is unregistered.
+ *   - Unknown-type forward compatibility: surfaced in `unknown_types`,
+ *     never counted toward plurality, never invalidating — the same rule
+ *     as unknown event types (§1.2.4).
+ *   - The `anchor_plurality` annotation per §2.11.11, with
+ *     `single_anchor: true` as a TIER, never a failure — signal not block,
+ *     exactly like `cross_attestation_missing` (D052) and
+ *     `in_envelope: false` (D051).
+ *   - The §2.11.4 hard conditions, UNCHANGED: `cross_log_threshold_not_met`
+ *     (consumer threshold M, default 1) and
+ *     `cross_log_equivocation_detected` (pairwise committed-leaf-byte
+ *     comparison across trusted logs) are the only hard rejections;
+ *     censorship-shaped disagreement is flagged
+ *     (`cross_log_censorship_suspected`) with the silent log identified,
+ *     never rejected.
+ *
+ * Every verification here is a pure function of the bundle, the record
+ * hash, and the caller's trust configuration (§2.11.7(c)): no network, no
+ * wall clock, no randomness. Two runs on identical input produce identical
+ * output — the same determinism discipline as §4.6.
+ *
+ * The `rfc3161-tsa` and `opentimestamps` payload interiors are STRUCTURAL
+ * in this revision, matching the conformance corpus
+ * (spec/conformance/2.11/anchors/): the commitment-binding fields
+ * (`hashed_message_hex` / `commitment_hex`) MUST equal the bundle's record
+ * hash and are checked; the DER TimeStampToken and serialized `.ots` bytes
+ * are carried opaquely. Implementations with real RFC 3161 / OTS verifiers
+ * additionally verify those payloads and treat a cryptographic failure as
+ * an invalid proof.
+ */
+import * as ed from '@noble/ed25519';
+import { sha512 } from '@noble/hashes/sha2.js';
+import { base64urlDecode, hexEncode, leafHash, sha256, verifyInclusion, } from '@atrib/mcp';
+// @noble/ed25519 v3 needs sha512 wired via the hashes object. Idempotent;
+// the same wiring @atrib/mcp performs on load, repeated so this module is
+// safe to import in isolation.
+ed.hashes.sha512 = sha512;
+ed.hashes.sha512Async = (m) => Promise.resolve(sha512(m));
+const utf8 = new TextEncoder();
+const utf8Decode = new TextDecoder();
+/** §2.11.10 domain-separation prefix for the anchoring-claim artifact. */
+export const ANCHOR_CLAIM_PREFIX = 'atrib-anchor/v1:';
+/** Registered non-atrib-log anchor types per the §2.11.8 v1 registry. */
+export const REGISTERED_NON_LOG_ANCHOR_TYPES = new Set([
+    'sigstore-rekor',
+    'rfc3161-tsa',
+    'opentimestamps',
+]);
+// ── Internals ────────────────────────────────────────────────────────
+function b64decode(s) {
+    return new Uint8Array(Buffer.from(s, 'base64'));
+}
+/**
+ * JCS-equivalent serialization for the FLAT objects the corpus signs
+ * (ASCII string / integer values only): JSON.stringify with sorted keys.
+ */
+function sortedJson(obj) {
+    const sorted = {};
+    for (const key of Object.keys(obj).sort()) {
+        const value = obj[key];
+        if (value !== undefined)
+            sorted[key] = value;
+    }
+    return JSON.stringify(sorted);
+}
+/** §2.4.2 key_id = SHA-256(key_name || 0x0A || 0x01 || public_key_bytes)[:4] */
+function computeKeyId(origin, publicKey) {
+    const nameBytes = utf8.encode(origin);
+    const preimage = new Uint8Array(nameBytes.length + 2 + publicKey.length);
+    preimage.set(nameBytes, 0);
+    preimage[nameBytes.length] = 0x0a;
+    preimage[nameBytes.length + 1] = 0x01;
+    preimage.set(publicKey, nameBytes.length + 2);
+    return sha256(preimage).slice(0, 4);
+}
+/** Parse a §2.4.3 signed note (3-line body + blank line + signature line). */
+function parseCheckpoint(checkpoint) {
+    const lines = checkpoint.split('\n');
+    if (lines.length < 5)
+        return null;
+    const origin = lines[0];
+    const sizeStr = lines[1];
+    const rootB64 = lines[2];
+    if (origin === undefined || sizeStr === undefined || rootB64 === undefined)
+        return null;
+    if (lines[3] !== '')
+        return null;
+    const sigLine = lines[4];
+    if (sigLine === undefined)
+        return null;
+    const m = sigLine.match(/^[—-] (\S+) (\S+)\s*$/);
+    if (!m)
+        return null;
+    const sigOrigin = m[1];
+    if (sigOrigin !== origin)
+        return null;
+    const decoded = b64decode(m[2]);
+    if (decoded.length !== 4 + 64)
+        return null;
+    if (!/^\d+$/.test(sizeStr))
+        return null;
+    const body = `${origin}\n${sizeStr}\n${rootB64}\n`;
+    return {
+        origin,
+        treeSize: Number(sizeStr),
+        root: b64decode(rootB64),
+        bodyBytes: utf8.encode(body),
+        keyId: decoded.slice(0, 4),
+        signature: decoded.slice(4),
+    };
+}
+/** Verify a signed checkpoint against a trust-material entry. */
+async function verifyCheckpoint(checkpoint, material) {
+    const parsed = parseCheckpoint(checkpoint);
+    if (!parsed)
+        return null;
+    if (parsed.origin !== material.origin)
+        return null;
+    const pubkey = b64decode(material.pubkey_b64);
+    const expectedKeyId = computeKeyId(material.origin, pubkey);
+    if (hexEncode(parsed.keyId) !== hexEncode(expectedKeyId))
+        return null;
+    const ok = await ed.verifyAsync(parsed.signature, parsed.bodyBytes, pubkey);
+    return ok ? parsed : null;
+}
+// ── Per-element verification (§2.11.7(c) pure function) ─────────────
+/**
+ * Verify one `log_proofs` element against the bundle's `record_hash` and
+ * the caller's trust material. Pure: no network, no clock, no randomness.
+ * Never throws; unexpected failures surface as `invalid` (§5.8).
+ */
+export async function verifyAnchorProofElement(el, recordHash, trust) {
+    try {
+        return await verifyElementInner(el, recordHash, trust);
+    }
+    catch {
+        return {
+            status: 'invalid',
+            anchorType: typeof el?.anchor_type === 'string' ? el.anchor_type : 'atrib-log',
+            anchorId: typeof el?.anchor_id === 'string'
+                ? el.anchor_id
+                : typeof el?.log_id === 'string'
+                    ? el.log_id
+                    : '',
+            attestedTimeMs: null,
+            entryBytesB64: null,
+        };
+    }
+}
+async function verifyElementInner(el, recordHash, trust) {
+    // Guard non-object elements as malformed rather than crashing on access.
+    if (typeof el !== 'object' || el === null) {
+        return {
+            status: 'malformed',
+            anchorType: 'atrib-log',
+            anchorId: '',
+            attestedTimeMs: null,
+            entryBytesB64: null,
+        };
+    }
+    const anchorType = el.anchor_type;
+    const recordHashHex = recordHash.startsWith('sha256:')
+        ? recordHash.slice('sha256:'.length)
+        : recordHash;
+    // Rule (a): anchor_type absent (or explicit "atrib-log") requires the
+    // legacy (log_id, checkpoint, inclusion_proof) triple; when the
+    // discriminator is absent a `proof` object is additionally forbidden.
+    if (anchorType === undefined || anchorType === 'atrib-log') {
+        if (typeof el.log_id !== 'string' ||
+            typeof el.checkpoint !== 'string' ||
+            !Array.isArray(el.inclusion_proof) ||
+            (anchorType === undefined && el.proof !== undefined)) {
+            return {
+                status: 'malformed',
+                anchorType: 'atrib-log',
+                anchorId: typeof el.log_id === 'string' ? el.log_id : '',
+                attestedTimeMs: null,
+                entryBytesB64: null,
+            };
+        }
+        const base = {
+            anchorType: 'atrib-log',
+            anchorId: el.log_id,
+            attestedTimeMs: null,
+            entryBytesB64: el.entry_bytes_b64 ?? null,
+        };
+        const material = trust.trust_material.logs[el.log_id];
+        if (!material || typeof el.entry_bytes_b64 !== 'string' || typeof el.log_index !== 'number') {
+            return { ...base, status: 'invalid' };
+        }
+        const parsed = await verifyCheckpoint(el.checkpoint, material);
+        if (!parsed)
+            return { ...base, status: 'invalid' };
+        const entryBytes = b64decode(el.entry_bytes_b64);
+        // The 90-byte entry embeds record_hash at bytes [1..33] (§2.3.1).
+        if (entryBytes.length !== 90 || hexEncode(entryBytes.slice(1, 33)) !== recordHashHex) {
+            return { ...base, status: 'invalid' };
+        }
+        const proof = el.inclusion_proof.map(b64decode);
+        const ok = verifyInclusion(el.log_index, parsed.treeSize, leafHash(entryBytes), proof, parsed.root);
+        return { ...base, status: ok ? 'verified' : 'invalid' };
+    }
+    // Rule (b): anchor_type present and != "atrib-log" requires anchor_id +
+    // proof. Malformation takes precedence over unknown-type surfacing: an
+    // element violating rule (b) is malformed per §2.11.9(e) even when its
+    // anchor_type is unregistered.
+    if (typeof el.anchor_id !== 'string' || typeof el.proof !== 'object' || el.proof === null) {
+        return {
+            status: 'malformed',
+            anchorType,
+            anchorId: el.anchor_id ?? '',
+            attestedTimeMs: null,
+            entryBytesB64: null,
+        };
+    }
+    const base = {
+        anchorType,
+        anchorId: el.anchor_id,
+        attestedTimeMs: null,
+        entryBytesB64: null,
+    };
+    if (!REGISTERED_NON_LOG_ANCHOR_TYPES.has(anchorType)) {
+        // Forward compatibility (§2.11.8): surfaced, not counted, never invalidating.
+        return { ...base, status: 'unknown' };
+    }
+    const proof = el.proof;
+    if (anchorType === 'sigstore-rekor') {
+        const material = trust.trust_material.rekor?.[el.anchor_id];
+        const entryBodyB64 = proof['entry_body_b64'];
+        const logIndex = proof['log_index'];
+        const checkpoint = proof['checkpoint'];
+        const inclusionProof = proof['inclusion_proof'];
+        const integratedTimeMs = proof['integrated_time_ms'];
+        const setB64 = proof['signed_entry_timestamp_b64'];
+        if (!material ||
+            typeof entryBodyB64 !== 'string' ||
+            typeof logIndex !== 'number' ||
+            typeof checkpoint !== 'string' ||
+            !Array.isArray(inclusionProof) ||
+            typeof integratedTimeMs !== 'number' ||
+            typeof setB64 !== 'string') {
+            return { ...base, status: 'invalid' };
+        }
+        // 1. Reconstruct the anchor-claim artifact from the bundle's record_hash
+        //    (§2.11.10). An entry whose artifact does not reconstruct is an
+        //    INVALID proof — not counted, not equivocation — even when its
+        //    embedded signature is genuinely valid over its own artifact.
+        const expectedArtifact = ANCHOR_CLAIM_PREFIX + recordHash;
+        const bodyBytes = b64decode(entryBodyB64);
+        let body;
+        try {
+            body = JSON.parse(utf8Decode.decode(bodyBytes));
+        }
+        catch {
+            return { ...base, status: 'invalid' };
+        }
+        const artifactB64 = body['artifact_b64'];
+        const pubB64url = body['public_key_b64url'];
+        const sigB64url = body['signature_b64url'];
+        if (typeof artifactB64 !== 'string' ||
+            typeof pubB64url !== 'string' ||
+            typeof sigB64url !== 'string') {
+            return { ...base, status: 'invalid' };
+        }
+        const artifactBytes = b64decode(artifactB64);
+        const artifact = utf8Decode.decode(artifactBytes);
+        if (artifact !== expectedArtifact || !artifact.startsWith(ANCHOR_CLAIM_PREFIX)) {
+            return { ...base, status: 'invalid' };
+        }
+        // 2. Verify the FRESH anchoring signature over the artifact bytes —
+        //    never the record's own signature (§2.11.10).
+        const sigOk = await ed.verifyAsync(base64urlDecode(sigB64url), artifactBytes, base64urlDecode(pubB64url));
+        if (!sigOk)
+            return { ...base, status: 'invalid' };
+        // 3. Verify the inclusion proof against the checkpoint.
+        const parsed = await verifyCheckpoint(checkpoint, material);
+        if (!parsed)
+            return { ...base, status: 'invalid' };
+        const inclusionOk = verifyInclusion(logIndex, parsed.treeSize, leafHash(bodyBytes), inclusionProof.map(b64decode), parsed.root);
+        if (!inclusionOk)
+            return { ...base, status: 'invalid' };
+        // 4. Verify the signed entry timestamp over the reconstructed input.
+        const setInput = sortedJson({
+            entry_body_b64: entryBodyB64,
+            integrated_time_ms: integratedTimeMs,
+            log_index: logIndex,
+        });
+        const setOk = await ed.verifyAsync(b64decode(setB64), utf8.encode(setInput), b64decode(material.pubkey_b64));
+        if (!setOk)
+            return { ...base, status: 'invalid' };
+        return { ...base, status: 'verified', attestedTimeMs: integratedTimeMs };
+    }
+    if (anchorType === 'rfc3161-tsa') {
+        // STRUCTURAL verification in this revision: the commitment-binding
+        // field must equal the bundle's record hash; the DER token is opaque.
+        // A token whose hashedMessage differs is an invalid proof, not
+        // equivocation (§2.11.11).
+        const hashedMessageHex = proof['hashed_message_hex'];
+        const tokenB64 = proof['timestamp_token_b64'];
+        const genTimeMs = proof['gen_time_ms'];
+        if (typeof hashedMessageHex !== 'string' ||
+            typeof tokenB64 !== 'string' ||
+            typeof genTimeMs !== 'number' ||
+            hashedMessageHex !== recordHashHex ||
+            b64decode(tokenB64).length === 0) {
+            return { ...base, status: 'invalid' };
+        }
+        return { ...base, status: 'verified', attestedTimeMs: genTimeMs };
+    }
+    // opentimestamps. A `pending` proof is carried and upgraded in place
+    // later (§2.11.8); it counts in pending_count, never toward plurality.
+    const commitmentHex = proof['commitment_hex'];
+    const otsB64 = proof['ots_b64'];
+    const status = proof['status'];
+    if (typeof commitmentHex !== 'string' ||
+        typeof otsB64 !== 'string' ||
+        commitmentHex !== recordHashHex ||
+        b64decode(otsB64).length === 0) {
+        return { ...base, status: 'invalid' };
+    }
+    if (status === 'pending')
+        return { ...base, status: 'pending' };
+    const attestedTimeMs = proof['attested_time_ms'];
+    if (status !== 'complete' || typeof attestedTimeMs !== 'number') {
+        return { ...base, status: 'invalid' };
+    }
+    return { ...base, status: 'verified', attestedTimeMs };
+}
+/**
+ * Operator-group key for independence counting (§2.11.11): the declared
+ * group when the trust config names one, else one group per distinct
+ * `(anchor_type, anchor_id)` pair (the default grouping).
+ */
+export function anchorOperatorGroup(anchorType, anchorId, trust) {
+    for (const g of trust.operator_groups ?? []) {
+        for (const m of g.members) {
+            if (m.anchor_type === anchorType && m.anchor_id === anchorId)
+                return `group:${g.group}`;
+        }
+    }
+    return `pair:${anchorType} ${anchorId}`;
+}
+// ── Bundle-level verdict (§2.11.11 annotation + §2.11.4 hard conditions) ──
+/**
+ * Compute the `anchor_plurality` annotation and the unchanged §2.11.4 hard
+ * conditions for a proof bundle. Deterministic: identical bundle + trust
+ * config + not-found responses in, identical verdict out. Never throws;
+ * a structurally hopeless bundle degrades to zero counts (§5.8).
+ *
+ * `single_anchor: true` is a TIER: the record stays valid, `hard_reject`
+ * stays false. Hard rejection is reserved for `cross_log_threshold_not_met`
+ * and `cross_log_equivocation_detected`; `cross_log_censorship_suspected`
+ * is a flag, not a rejection.
+ */
+export async function verifyAnchorPlurality(bundle, trust, notFoundResponses = []) {
+    const elements = typeof bundle === 'object' && bundle !== null && Array.isArray(bundle.log_proofs)
+        ? bundle.log_proofs
+        : [];
+    const recordHash = typeof bundle === 'object' && bundle !== null && typeof bundle.record_hash === 'string'
+        ? bundle.record_hash
+        : '';
+    const results = [];
+    for (const el of elements) {
+        results.push(await verifyAnchorProofElement(el, recordHash, trust));
+    }
+    const malformedIndices = [];
+    const invalidIndices = [];
+    const unknownTypes = [];
+    const groups = new Set();
+    const times = [];
+    let verified = 0;
+    let pending = 0;
+    results.forEach((r, i) => {
+        if (r.status === 'malformed')
+            malformedIndices.push(i);
+        if (r.status === 'invalid')
+            invalidIndices.push(i);
+        if (r.status === 'unknown' && !unknownTypes.includes(r.anchorType)) {
+            unknownTypes.push(r.anchorType);
+        }
+        if (r.status === 'pending')
+            pending += 1;
+        if (r.status === 'verified') {
+            verified += 1;
+            groups.add(anchorOperatorGroup(r.anchorType, r.anchorId, trust));
+            if (r.attestedTimeMs !== null)
+                times.push(r.attestedTimeMs);
+        }
+    });
+    const requiredAnchors = trust.required_anchors ?? 2;
+    const thresholdM = trust.threshold_m ?? 1;
+    const trustedLogs = trust.trusted_logs ?? [];
+    // §2.11.4 threshold: count verified atrib-log proofs in the trusted set.
+    // Untrusted-set proofs are surfaced, never counted toward M.
+    const trustedVerified = results.filter((r) => r.status === 'verified' && r.anchorType === 'atrib-log' && trustedLogs.includes(r.anchorId));
+    const untrustedSurfaced = results
+        .filter((r) => r.status === 'verified' && r.anchorType === 'atrib-log' && !trustedLogs.includes(r.anchorId))
+        .map((r) => r.anchorId);
+    const thresholdNotMet = trustedVerified.length < thresholdM;
+    // §2.11.4 step 4, unchanged: pairwise committed-leaf-byte comparison
+    // across trusted logs for the same record_hash.
+    let equivocation = false;
+    let disagreeingPair = null;
+    for (let i = 0; i < trustedVerified.length; i++) {
+        for (let j = i + 1; j < trustedVerified.length; j++) {
+            const a = trustedVerified[i];
+            const b = trustedVerified[j];
+            if (a.entryBytesB64 !== null && b.entryBytesB64 !== null && a.entryBytesB64 !== b.entryBytesB64) {
+                equivocation = true;
+                disagreeingPair = {
+                    log_id_a: a.anchorId,
+                    leaf_hash_a_hex: hexEncode(leafHash(b64decode(a.entryBytesB64))),
+                    log_id_b: b.anchorId,
+                    leaf_hash_b_hex: hexEncode(leafHash(b64decode(b.entryBytesB64))),
+                };
+            }
+        }
+    }
+    // §2.11.4 censorship-shaped equivocation: a trusted log reports not-found
+    // inside the epoch window while another trusted log holds a verified
+    // proof. Flag, not rejection; the silent log is identified.
+    let censorship = false;
+    let silentLog = null;
+    for (const nf of notFoundResponses) {
+        if (nf.status === 'not_found' && trustedLogs.includes(nf.log_id) && trustedVerified.length > 0) {
+            censorship = true;
+            silentLog = nf.log_id;
+        }
+    }
+    const independentCount = groups.size;
+    const annotation = {
+        proof_count: elements.length,
+        verified_count: verified,
+        pending_count: pending,
+        malformed_count: malformedIndices.length,
+        unknown_types: unknownTypes,
+        independent_count: independentCount,
+        plurality_met: independentCount >= requiredAnchors,
+        single_anchor: independentCount === 1,
+        equivocation_detected: equivocation,
+        anchored_at_range_ms: times.length > 0 ? [Math.min(...times), Math.max(...times)] : null,
+    };
+    return {
+        anchor_plurality: annotation,
+        malformed_indices: malformedIndices,
+        invalid_indices: invalidIndices,
+        trusted_verified_count: trustedVerified.length,
+        cross_log_threshold_not_met: thresholdNotMet,
+        cross_log_equivocation_detected: equivocation,
+        cross_log_censorship_suspected: censorship,
+        silent_log: silentLog,
+        untrusted_surfaced: untrustedSurfaced,
+        disagreeing_pair: disagreeingPair,
+        // Hard rejection is reserved for the §2.11.4 conditions. single_anchor
+        // is a tier, never a failure (§2.11.11).
+        hard_reject: thresholdNotMet || equivocation,
+    };
+}
+//# sourceMappingURL=anchor-plurality.js.map

package/dist/anchor-plurality.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anchor-plurality.js","sourceRoot":"","sources":["../src/anchor-plurality.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EACL,eAAe,EACf,SAAS,EACT,QAAQ,EACR,MAAM,EACN,eAAe,GAChB,MAAM,YAAY,CAAA;AAEnB,0EAA0E;AAC1E,0EAA0E;AAC1E,+BAA+B;AAC/B,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAA;AACzB,EAAE,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;AAErE,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAA;AAC9B,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAA;AAEpC,0EAA0E;AAC1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAA;AAErD,yEAAyE;AACzE,MAAM,CAAC,MAAM,+BAA+B,GAAwB,IAAI,GAAG,CAAC;IAC1E,gBAAgB;IAChB,aAAa;IACb,gBAAgB;CACjB,CAAC,CAAA;AA+HF,wEAAwE;AAExE,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAA;AACjD,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,GAAoC;IACtD,MAAM,MAAM,GAAoC,EAAE,CAAA;IAClD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;QACtB,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;AAC/B,CAAC;AAED,gFAAgF;AAChF,SAAS,YAAY,CAAC,MAAc,EAAE,SAAqB;IACzD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACrC,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;IACxE,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAA;IACrC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC7C,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AACrC,CAAC;AAWD,8EAA8E;AAC9E,SAAS,eAAe,CAAC,UAAkB;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACpC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACjC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACvB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACxB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACxB,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACvF,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAA;IAChC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACxB,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACtC,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;IAChD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACnB,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,CAAW,CAAA;IAChC,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IACrC,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC,CAAA;IACzC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE;QAAE,OAAO,IAAI,CAAA;IAC1C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IACvC,MAAM,IAAI,GAAG,GAAG,MAAM,KAAK,OAAO,KAAK,OAAO,IAAI,CAAA;IAClD,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC;QACzB,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC;QACxB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAC5B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1B,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;KAC5B,CAAA;AACH,CAAC;AAED,iEAAiE;AACjE,KAAK,UAAU,gBAAgB,CAC7B,UAAkB,EAClB,QAA0B;IAE1B,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAClD,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;IAC7C,MAAM,aAAa,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3D,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAA;IACrE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IAC3E,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;AAC3B,CAAC;AAED,uEAAuE;AAEvE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,EAAsB,EACtB,UAAkB,EAClB,KAAwB;IAExB,IAAI,CAAC;QACH,OAAO,MAAM,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,OAAO,EAAE,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW;YAC9E,QAAQ,EACN,OAAO,EAAE,EAAE,SAAS,KAAK,QAAQ;gBAC/B,CAAC,CAAC,EAAE,CAAC,SAAS;gBACd,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,KAAK,QAAQ;oBAC9B,CAAC,CAAC,EAAE,CAAC,MAAM;oBACX,CAAC,CAAC,EAAE;YACV,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB,CAAA;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,EAAsB,EACtB,UAAkB,EAClB,KAAwB;IAExB,yEAAyE;IACzE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,UAAU,EAAE,WAAW;YACvB,QAAQ,EAAE,EAAE;YACZ,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB,CAAA;IACH,CAAC;IAED,MAAM,UAAU,GAAG,EAAE,CAAC,WAAW,CAAA;IACjC,MAAM,aAAa,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;QACpD,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;QACpC,CAAC,CAAC,UAAU,CAAA;IAEd,sEAAsE;IACtE,gEAAgE;IAChE,sEAAsE;IACtE,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;QAC3D,IACE,OAAO,EAAE,CAAC,MAAM,KAAK,QAAQ;YAC7B,OAAO,EAAE,CAAC,UAAU,KAAK,QAAQ;YACjC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC;YAClC,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,EACpD,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,UAAU,EAAE,WAAW;gBACvB,QAAQ,EAAE,OAAO,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;gBACxD,cAAc,EAAE,IAAI;gBACpB,aAAa,EAAE,IAAI;aACpB,CAAA;QACH,CAAC;QACD,MAAM,IAAI,GAAwC;YAChD,UAAU,EAAE,WAAW;YACvB,QAAQ,EAAE,EAAE,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,EAAE,CAAC,eAAe,IAAI,IAAI;SAC1C,CAAA;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,CAAA;QACrD,IAAI,CAAC,QAAQ,IAAI,OAAO,EAAE,CAAC,eAAe,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC5F,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QACvC,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;QAC9D,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QAClD,MAAM,UAAU,GAAG,SAAS,CAAC,EAAE,CAAC,eAAe,CAAC,CAAA;QAChD,kEAAkE;QAClE,IAAI,UAAU,CAAC,MAAM,KAAK,EAAE,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;YACrF,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QACvC,CAAC;QACD,MAAM,KAAK,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC/C,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QACnG,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,CAAA;IACzD,CAAC;IAED,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,+BAA+B;IAC/B,IAAI,OAAO,EAAE,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ,IAAI,EAAE,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1F,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,UAAU;YACV,QAAQ,EAAE,EAAE,CAAC,SAAS,IAAI,EAAE;YAC5B,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAwC;QAChD,UAAU;QACV,QAAQ,EAAE,EAAE,CAAC,SAAS;QACtB,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,IAAI;KACpB,CAAA;IAED,IAAI,CAAC,+BAA+B,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,8EAA8E;QAC9E,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IACvC,CAAC;IAED,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAA;IAEtB,IAAI,UAAU,KAAK,gBAAgB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,CAAA;QAC3D,MAAM,YAAY,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAA;QAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,CAAA;QACnC,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,CAAA;QACtC,MAAM,cAAc,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC/C,MAAM,gBAAgB,GAAG,KAAK,CAAC,oBAAoB,CAAC,CAAA;QACpD,MAAM,MAAM,GAAG,KAAK,CAAC,4BAA4B,CAAC,CAAA;QAClD,IACE,CAAC,QAAQ;YACT,OAAO,YAAY,KAAK,QAAQ;YAChC,OAAO,QAAQ,KAAK,QAAQ;YAC5B,OAAO,UAAU,KAAK,QAAQ;YAC9B,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;YAC9B,OAAO,gBAAgB,KAAK,QAAQ;YACpC,OAAO,MAAM,KAAK,QAAQ,EAC1B,CAAC;YACD,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QACvC,CAAC;QACD,yEAAyE;QACzE,oEAAoE;QACpE,mEAAmE;QACnE,kEAAkE;QAClE,MAAM,gBAAgB,GAAG,mBAAmB,GAAG,UAAU,CAAA;QACzD,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,CAAC,CAAA;QACzC,IAAI,IAA6B,CAAA;QACjC,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAA4B,CAAA;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QACvC,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,CAAA;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAA;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAC1C,IACE,OAAO,WAAW,KAAK,QAAQ;YAC/B,OAAO,SAAS,KAAK,QAAQ;YAC7B,OAAO,SAAS,KAAK,QAAQ,EAC7B,CAAC;YACD,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QACvC,CAAC;QACD,MAAM,aAAa,GAAG,SAAS,CAAC,WAAW,CAAC,CAAA;QAC5C,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;QACjD,IAAI,QAAQ,KAAK,gBAAgB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC/E,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QACvC,CAAC;QACD,oEAAoE;QACpE,kDAAkD;QAClD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,WAAW,CAChC,eAAe,CAAC,SAAS,CAAC,EAC1B,aAAa,EACb,eAAe,CAAC,SAAS,CAAC,CAC3B,CAAA;QACD,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QACjD,wDAAwD;QACxD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;QAC3D,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QAClD,MAAM,WAAW,GAAG,eAAe,CACjC,QAAQ,EACR,MAAM,CAAC,QAAQ,EACf,QAAQ,CAAC,SAAS,CAAC,EAClB,cAA2B,CAAC,GAAG,CAAC,SAAS,CAAC,EAC3C,MAAM,CAAC,IAAI,CACZ,CAAA;QACD,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QACvD,qEAAqE;QACrE,MAAM,QAAQ,GAAG,UAAU,CAAC;YAC1B,cAAc,EAAE,YAAY;YAC5B,kBAAkB,EAAE,gBAAgB;YACpC,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAA;QACF,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,WAAW,CAChC,SAAS,CAAC,MAAM,CAAC,EACjB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EACrB,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC/B,CAAA;QACD,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QACjD,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAA;IAC1E,CAAC;IAED,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;QACjC,mEAAmE;QACnE,sEAAsE;QACtE,+DAA+D;QAC/D,2BAA2B;QAC3B,MAAM,gBAAgB,GAAG,KAAK,CAAC,oBAAoB,CAAC,CAAA;QACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,qBAAqB,CAAC,CAAA;QAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,aAAa,CAAC,CAAA;QACtC,IACE,OAAO,gBAAgB,KAAK,QAAQ;YACpC,OAAO,QAAQ,KAAK,QAAQ;YAC5B,OAAO,SAAS,KAAK,QAAQ;YAC7B,gBAAgB,KAAK,aAAa;YAClC,SAAS,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAChC,CAAC;YACD,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QACvC,CAAC;QACD,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,CAAA;IACnE,CAAC;IAED,qEAAqE;IACrE,uEAAuE;IACvE,MAAM,aAAa,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAA;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,CAAA;IAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC9B,IACE,OAAO,aAAa,KAAK,QAAQ;QACjC,OAAO,MAAM,KAAK,QAAQ;QAC1B,aAAa,KAAK,aAAa;QAC/B,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAC9B,CAAC;QACD,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IACvC,CAAC;IACD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC/D,MAAM,cAAc,GAAG,KAAK,CAAC,kBAAkB,CAAC,CAAA;IAChD,IAAI,MAAM,KAAK,UAAU,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IACvC,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,CAAA;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAkB,EAClB,QAAgB,EAChB,KAAwB;IAExB,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,WAAW,KAAK,UAAU,IAAI,CAAC,CAAC,SAAS,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC,CAAC,KAAK,EAAE,CAAA;QACzF,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,UAAU,IAAI,QAAQ,EAAE,CAAA;AACzC,CAAC;AAED,6EAA6E;AAE7E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAyB,EACzB,KAAwB,EACxB,oBAA8C,EAAE;IAEhD,MAAM,QAAQ,GACZ,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAC/E,CAAC,CAAC,MAAM,CAAC,UAAU;QACnB,CAAC,CAAC,EAAE,CAAA;IACR,MAAM,UAAU,GACd,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;QACrF,CAAC,CAAC,MAAM,CAAC,WAAW;QACpB,CAAC,CAAC,EAAE,CAAA;IAER,MAAM,OAAO,GAA0B,EAAE,CAAA;IACzC,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,MAAM,wBAAwB,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAA;IACrE,CAAC;IAED,MAAM,gBAAgB,GAAa,EAAE,CAAA;IACrC,MAAM,cAAc,GAAa,EAAE,CAAA;IACnC,MAAM,YAAY,GAAa,EAAE,CAAA;IACjC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAA;IAChC,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,OAAO,GAAG,CAAC,CAAA;IAEf,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvB,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW;YAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACtD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAClD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;YACnE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;QACjC,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,CAAA;QACxC,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC5B,QAAQ,IAAI,CAAC,CAAA;YACb,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAA;YAChE,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAA;QAC7D,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,eAAe,GAAG,KAAK,CAAC,gBAAgB,IAAI,CAAC,CAAA;IACnD,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,IAAI,CAAC,CAAA;IACzC,MAAM,WAAW,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAA;IAE5C,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC,UAAU,KAAK,WAAW,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CACnG,CAAA;IACD,MAAM,iBAAiB,GAAG,OAAO;SAC9B,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC,UAAU,KAAK,WAAW,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAC/F;SACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IACzB,MAAM,eAAe,GAAG,eAAe,CAAC,MAAM,GAAG,UAAU,CAAA;IAE3D,qEAAqE;IACrE,gDAAgD;IAChD,IAAI,YAAY,GAAG,KAAK,CAAA;IACxB,IAAI,eAAe,GAAiC,IAAI,CAAA;IACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChD,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACpD,MAAM,CAAC,GAAG,eAAe,CAAC,CAAC,CAAwB,CAAA;YACnD,MAAM,CAAC,GAAG,eAAe,CAAC,CAAC,CAAwB,CAAA;YACnD,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;gBAChG,YAAY,GAAG,IAAI,CAAA;gBACnB,eAAe,GAAG;oBAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,eAAe,EAAE,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;oBAChE,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,eAAe,EAAE,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;iBACjE,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,qEAAqE;IACrE,4DAA4D;IAC5D,IAAI,UAAU,GAAG,KAAK,CAAA;IACtB,IAAI,SAAS,GAAkB,IAAI,CAAA;IACnC,KAAK,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;QACnC,IAAI,EAAE,CAAC,MAAM,KAAK,WAAW,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/F,UAAU,GAAG,IAAI,CAAA;YACjB,SAAS,GAAG,EAAE,CAAC,MAAM,CAAA;QACvB,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAA;IACpC,MAAM,UAAU,GAA8B;QAC5C,WAAW,EAAE,QAAQ,CAAC,MAAM;QAC5B,cAAc,EAAE,QAAQ;QACxB,aAAa,EAAE,OAAO;QACtB,eAAe,EAAE,gBAAgB,CAAC,MAAM;QACxC,aAAa,EAAE,YAAY;QAC3B,iBAAiB,EAAE,gBAAgB;QACnC,aAAa,EAAE,gBAAgB,IAAI,eAAe;QAClD,aAAa,EAAE,gBAAgB,KAAK,CAAC;QACrC,qBAAqB,EAAE,YAAY;QACnC,oBAAoB,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;KACzF,CAAA;IAED,OAAO;QACL,gBAAgB,EAAE,UAAU;QAC5B,iBAAiB,EAAE,gBAAgB;QACnC,eAAe,EAAE,cAAc;QAC/B,sBAAsB,EAAE,eAAe,CAAC,MAAM;QAC9C,2BAA2B,EAAE,eAAe;QAC5C,+BAA+B,EAAE,YAAY;QAC7C,8BAA8B,EAAE,UAAU;QAC1C,UAAU,EAAE,SAAS;QACrB,kBAAkB,EAAE,iBAAiB;QACrC,gBAAgB,EAAE,eAAe;QACjC,uEAAuE;QACvE,yCAAyC;QACzC,WAAW,EAAE,eAAe,IAAI,YAAY;KAC7C,CAAA;AACH,CAAC"}

package/dist/authorization-evidence.d.ts

@@ -1,6 +1,7 @@
 import type { JWK, JSONWebKeySet, JWTPayload } from 'jose';
 import type { AAuthAuthorizationEvidenceInput, AAuthAuthorizationEvidenceVerification } from './aauth-evidence.js';
 import type { DpopReplayCache } from './dpop-replay-cache.js';
+import type { X401AuthorizationEvidenceInput, X401AuthorizationEvidenceVerification } from './x401-evidence.js';
 export type EvidenceCheckStatus = 'passed' | 'failed' | 'unresolved' | 'not_checked';
 export type OAuthSignaturePolicy = 'require' | 'best-effort' | 'off';
 export type OAuthEvidenceProtocol = 'oauth2' | 'mcp_oauth';
@@ -151,9 +152,12 @@ export declare function verifyOAuthAuthorizationEvidence(input: OAuthAuthorizati
 export type AuthorizationEvidenceInput = {
     protocol?: 'aauth';
     aauth: AAuthAuthorizationEvidenceInput;
+} | {
+    protocol?: 'x401';
+    x401: X401AuthorizationEvidenceInput;
 } | {
     protocol?: OAuthEvidenceProtocol;
     oauth: OAuthAuthorizationEvidenceInput;
-} | AAuthAuthorizationEvidenceInput | OAuthAuthorizationEvidenceInput;
-export declare function verifyAuthorizationEvidence(evidence: AuthorizationEvidenceInput): Promise<EvidenceVerificationBlock | AAuthAuthorizationEvidenceVerification>;
+} | AAuthAuthorizationEvidenceInput | X401AuthorizationEvidenceInput | OAuthAuthorizationEvidenceInput;
+export declare function verifyAuthorizationEvidence(evidence: AuthorizationEvidenceInput): Promise<EvidenceVerificationBlock | AAuthAuthorizationEvidenceVerification | X401AuthorizationEvidenceVerification>;
 //# sourceMappingURL=authorization-evidence.d.ts.map

package/dist/authorization-evidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-evidence.d.ts","sourceRoot":"","sources":["../src/authorization-evidence.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE,UAAU,EAAoB,MAAM,MAAM,CAAA;AAE5E,OAAO,KAAK,EACV,+BAA+B,EAC/B,sCAAsC,EACvC,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,eAAe,EAAsB,MAAM,wBAAwB,CAAA;AAEjF,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,YAAY,GAAG,aAAa,CAAA;AACpF,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,aAAa,GAAG,KAAK,CAAA;AACpE,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,WAAW,CAAA;AAE1D,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,mBAAmB,CAAA;IAC3B,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,yBAAyB,CAAC,QAAQ,GAAG,OAAO;IAC3D,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,cAAc,EAAE,OAAO,GAAG,IAAI,CAAA;IAC9B,aAAa,EAAE,OAAO,GAAG,IAAI,CAAA;IAC7B,WAAW,EAAE,uBAAuB,EAAE,CAAA;IACtC,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,OAAO,CAAC,EAAE,QAAQ,CAAA;CACnB;AAED,MAAM,WAAW,kCAAkC;IACjD,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CACrB;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAA;IAChC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC5B;AAED,MAAM,WAAW,sBAAuB,SAAQ,UAAU;IACxD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC5B,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,GAAG,CAAC,EAAE;QACJ,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,GAAG,CAAC,EAAE,GAAG,CAAA;QACT,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KACvB,CAAA;IACD,GAAG,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAA;IAC9C,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAA;CACnD;AAED,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,OAAO,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC5B,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,GAAG,CAAC,EAAE;QACJ,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,GAAG,CAAC,EAAE,GAAG,CAAA;QACT,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KACvB,CAAA;IACD,GAAG,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAA;IAC9C,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAA;IAClD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,EAAE,qBAAqB,CAAA;IAChC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,MAAM,CAAC,EAAE,sBAAsB,CAAA;IAC/B,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,aAAa,CAAC,EAAE,+BAA+B,CAAA;IAC/C,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,SAAS,CAAC,EAAE,mBAAmB,CAAA;IAC/B,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,aAAa,CAAA;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,yBAAyB,CAAC,EAAE,8BAA8B,CAAA;IAC1D,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,4BAA4B,CAAC,EAAE,kCAAkC,EAAE,CAAA;IACnE,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,eAAe,CAAC,EAAE,oBAAoB,CAAA;IACtC,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,OAAO,CAAA;IACpB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAA;IACxB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,eAAe,EAAE,OAAO,CAAA;CACzB;AAED,MAAM,WAAW,sCAAuC,SAAQ,yBAAyB,CAAC;IACxF,KAAK,EAAE,eAAe,CAAA;IACtB,IAAI,EAAE,cAAc,GAAG,IAAI,CAAA;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB,CAAC;IACA,QAAQ,EAAE,qBAAqB,CAAA;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,OAAO,CAAA;IACpB,QAAQ,EAAE,OAAO,CAAA;IACjB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACnB;AA2gBD,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,+BAA+B,GACrC,OAAO,CAAC,sCAAsC,CAAC,CA+FjD;AAED,MAAM,MAAM,0BAA0B,GAClC;IACE,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,KAAK,EAAE,+BAA+B,CAAA;CACvC,GACD;IACE,QAAQ,CAAC,EAAE,qBAAqB,CAAA;IAChC,KAAK,EAAE,+BAA+B,CAAA;CACvC,GACD,+BAA+B,GAC/B,+BAA+B,CAAA;AAkBnC,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,0BAA0B,GACnC,OAAO,CAAC,yBAAyB,GAAG,sCAAsC,CAAC,CAiB7E"}
+{"version":3,"file":"authorization-evidence.d.ts","sourceRoot":"","sources":["../src/authorization-evidence.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE,UAAU,EAAoB,MAAM,MAAM,CAAA;AAE5E,OAAO,KAAK,EACV,+BAA+B,EAC/B,sCAAsC,EACvC,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,eAAe,EAAsB,MAAM,wBAAwB,CAAA;AAEjF,OAAO,KAAK,EACV,8BAA8B,EAC9B,qCAAqC,EACtC,MAAM,oBAAoB,CAAA;AAE3B,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,YAAY,GAAG,aAAa,CAAA;AACpF,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,aAAa,GAAG,KAAK,CAAA;AACpE,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,WAAW,CAAA;AAE1D,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,mBAAmB,CAAA;IAC3B,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,yBAAyB,CAAC,QAAQ,GAAG,OAAO;IAC3D,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,cAAc,EAAE,OAAO,GAAG,IAAI,CAAA;IAC9B,aAAa,EAAE,OAAO,GAAG,IAAI,CAAA;IAC7B,WAAW,EAAE,uBAAuB,EAAE,CAAA;IACtC,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,OAAO,CAAC,EAAE,QAAQ,CAAA;CACnB;AAED,MAAM,WAAW,kCAAkC;IACjD,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CACrB;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAA;IAChC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC5B;AAED,MAAM,WAAW,sBAAuB,SAAQ,UAAU;IACxD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC5B,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,GAAG,CAAC,EAAE;QACJ,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,GAAG,CAAC,EAAE,GAAG,CAAA;QACT,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KACvB,CAAA;IACD,GAAG,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAA;IAC9C,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAA;CACnD;AAED,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,OAAO,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC5B,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,GAAG,CAAC,EAAE;QACJ,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,GAAG,CAAC,EAAE,GAAG,CAAA;QACT,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KACvB,CAAA;IACD,GAAG,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAA;IAC9C,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAA;IAClD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,EAAE,qBAAqB,CAAA;IAChC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,MAAM,CAAC,EAAE,sBAAsB,CAAA;IAC/B,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,aAAa,CAAC,EAAE,+BAA+B,CAAA;IAC/C,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,SAAS,CAAC,EAAE,mBAAmB,CAAA;IAC/B,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,aAAa,CAAA;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,yBAAyB,CAAC,EAAE,8BAA8B,CAAA;IAC1D,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,4BAA4B,CAAC,EAAE,kCAAkC,EAAE,CAAA;IACnE,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,eAAe,CAAC,EAAE,oBAAoB,CAAA;IACtC,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,OAAO,CAAA;IACpB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAA;IACxB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,eAAe,EAAE,OAAO,CAAA;CACzB;AAED,MAAM,WAAW,sCAAuC,SAAQ,yBAAyB,CAAC;IACxF,KAAK,EAAE,eAAe,CAAA;IACtB,IAAI,EAAE,cAAc,GAAG,IAAI,CAAA;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB,CAAC;IACA,QAAQ,EAAE,qBAAqB,CAAA;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,OAAO,CAAA;IACpB,QAAQ,EAAE,OAAO,CAAA;IACjB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACnB;AA2gBD,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,+BAA+B,GACrC,OAAO,CAAC,sCAAsC,CAAC,CA+FjD;AAED,MAAM,MAAM,0BAA0B,GAClC;IACE,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,KAAK,EAAE,+BAA+B,CAAA;CACvC,GACD;IACE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,8BAA8B,CAAA;CACrC,GACD;IACE,QAAQ,CAAC,EAAE,qBAAqB,CAAA;IAChC,KAAK,EAAE,+BAA+B,CAAA;CACvC,GACD,+BAA+B,GAC/B,8BAA8B,GAC9B,+BAA+B,CAAA;AAiCnC,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,0BAA0B,GACnC,OAAO,CACR,yBAAyB,GAAG,sCAAsC,GAAG,qCAAqC,CAC3G,CA0BA"}

package/dist/authorization-evidence.js

@@ -2,6 +2,7 @@
 import { base64urlEncode, sha256 } from '@atrib/mcp';
 import { calculateJwkThumbprint, createLocalJWKSet, decodeJwt, decodeProtectedHeader, importJWK, jwtVerify, } from 'jose';
 import { verifyAAuthAuthorizationEvidence } from './aauth-evidence.js';
+import { verifyX401AuthorizationEvidence } from './x401-evidence.js';
 function asArray(value) {
     if (typeof value === 'string')
         return [value];
@@ -426,6 +427,17 @@ function isAAuthAuthorizationEvidenceInput(evidence) {
         'httpSignature' in evidence ||
         'r3' in evidence);
 }
+function isX401AuthorizationEvidenceInput(evidence) {
+    if (evidence.protocol === 'x401')
+        return true;
+    return ('headers' in evidence ||
+        'headerSet' in evidence ||
+        'proofRequest' in evidence ||
+        'proofResponse' in evidence ||
+        'proofResult' in evidence ||
+        'resultVerified' in evidence ||
+        'tokenVerified' in evidence);
+}
 export async function verifyAuthorizationEvidence(evidence) {
     if ('aauth' in evidence) {
         return verifyAAuthAuthorizationEvidence({
@@ -433,6 +445,15 @@ export async function verifyAuthorizationEvidence(evidence) {
             protocol: 'aauth',
         });
     }
+    if ('x401' in evidence) {
+        return verifyX401AuthorizationEvidence({
+            ...evidence.x401,
+            protocol: 'x401',
+        });
+    }
+    if (isX401AuthorizationEvidenceInput(evidence)) {
+        return verifyX401AuthorizationEvidence(evidence);
+    }
     if (isAAuthAuthorizationEvidenceInput(evidence)) {
         return verifyAAuthAuthorizationEvidence(evidence);
     }