@bsv/dpp-core 0.3.0-beta.1

package/dist/anchor.js

@@ -0,0 +1,145 @@
+import { CachedKeyDeriver, LockingScript, PublicKey, Signature, Utils } from '@bsv/sdk';
+/**
+ * The generic complete-representation anchor, `bsv-attestation-anchor-v1`
+ * (`spec/rules.md` §5 and §6). It lives in the core rather than in the overlay
+ * package because a reader in a browser verifies anchors without a database or
+ * an overlay engine, and `verifyPassportEvidence` (evidence.ts) reports the
+ * anchor rail beside the token rail from one package. `@bsv/dpp-overlay-topics`
+ * re-exports every name below unchanged.
+ */
+export const ATTESTATION_ANCHOR_PREFIX = 'bsv-attestation-anchor-v1';
+export const ATTESTATION_ANCHOR_PROTOCOL = [1, 'bsv attestation anchor v1'];
+export const ATTESTATION_ANCHOR_BASKET = 'attestation-anchor';
+export const ATTESTATION_ANCHOR_FIELD_COUNT = 9;
+const anyone = new CachedKeyDeriver('anyone');
+const bounds = [64, 256, 512, 512, 128, 128, 128, 66];
+function decodeText(bytes, maximum) {
+    const value = Utils.toUTF8(bytes);
+    if (!value || bytes.length > maximum || /[\u0000-\u001f\u007f-\u009f]/u.test(value) || Utils.toHex(Utils.toArray(value, 'utf8')) !== Utils.toHex(bytes)) {
+        throw new Error('anchor field is not bounded printable UTF-8');
+    }
+    return value;
+}
+function compressedKey(value) {
+    if (!/^0[23][0-9a-f]{64}$/.test(value))
+        throw new Error('expected a canonical compressed public key');
+    const key = PublicKey.fromString(value);
+    if (key.toString() !== value)
+        throw new Error('non-canonical public key');
+    return key;
+}
+export function expectedAttestationLockingKey(anchoredBy, attestationId) {
+    compressedKey(anchoredBy);
+    decodeText(Utils.toArray(attestationId, 'utf8'), 256);
+    return anyone.derivePublicKey(ATTESTATION_ANCHOR_PROTOCOL, attestationId, anchoredBy);
+}
+export function attestationAnchorFields(anchor) {
+    const values = [anchor.digest, anchor.attestationId, anchor.issuer, anchor.subject, anchor.attestationType, anchor.representation, anchor.mediaType, anchor.anchoredBy];
+    const fields = values.map((value, index) => {
+        if (typeof value !== 'string')
+            throw new Error('anchor metadata must be text');
+        const bytes = Utils.toArray(value, 'utf8');
+        if (decodeText(bytes, bounds[index]) !== value)
+            throw new Error('invalid UTF-8 metadata');
+        return bytes;
+    });
+    if (!/^[0-9a-f]{64}$/.test(anchor.digest))
+        throw new Error('invalid SHA-256 digest');
+    compressedKey(anchor.anchoredBy);
+    return [Utils.toArray(ATTESTATION_ANCHOR_PREFIX, 'utf8'), ...fields];
+}
+export function attestationAnchorSigningPreimage(fields) {
+    if (fields.length !== ATTESTATION_ANCHOR_FIELD_COUNT)
+        throw new Error('expected nine signed anchor fields');
+    const writer = new Utils.Writer();
+    for (const field of fields) {
+        writer.writeVarIntNum(field.length);
+        writer.write(field);
+    }
+    return writer.toArray();
+}
+export async function buildAttestationAnchor(anchor, signer) {
+    const fields = attestationAnchorFields(anchor);
+    const { signature } = await signer.createSignature({
+        data: attestationAnchorSigningPreimage(fields), protocolID: ATTESTATION_ANCHOR_PROTOCOL,
+        keyID: anchor.attestationId, counterparty: 'anyone',
+    });
+    const script = new LockingScript();
+    script.writeBin(expectedAttestationLockingKey(anchor.anchoredBy, anchor.attestationId).encode(true));
+    script.writeOpCode(0xac);
+    for (const field of [...fields, signature])
+        script.writeBin(field);
+    for (let index = 0; index < 5; index++)
+        script.writeOpCode(0x6d);
+    if (decodeAttestationAnchor(script) === null)
+        throw new Error('signer does not match anchoredBy');
+    return script;
+}
+export function inspectAttestationAnchor(script) {
+    const result = { keyDerivationValid: null, signatureValid: null };
+    const chunks = script.chunks;
+    if (chunks.length !== 17 || chunks[0].data?.length !== 33 || chunks[1].op !== 0xac) {
+        result.failure = 'not a bsv-attestation-anchor-v1 layout: expected a 33-byte key, OP_CHECKSIG, ten fields and five OP_2DROP';
+        return result;
+    }
+    if (!chunks.slice(12).every(chunk => chunk.op === 0x6d && chunk.data === undefined)) {
+        result.failure = 'malformed drop tail: exactly five OP_2DROP must end the script';
+        return result;
+    }
+    let fields;
+    try {
+        fields = chunks.slice(2, 12).map(chunk => {
+            if (chunk.data && chunk.data.length > 0)
+                return chunk.data;
+            if (chunk.op >= 0x51 && chunk.op <= 0x60)
+                return [chunk.op - 0x50];
+            throw new Error('expected nonempty data push');
+        });
+        if (decodeText(fields[0], 64) !== ATTESTATION_ANCHOR_PREFIX)
+            throw new Error('prefix is not bsv-attestation-anchor-v1');
+        const [digest, attestationId, issuer, subject, attestationType, representation, mediaType, anchoredBy] = fields.slice(1, 9).map((field, index) => decodeText(field, bounds[index]));
+        const metadata = { digest, attestationId, issuer, subject, attestationType, representation, mediaType, anchoredBy };
+        attestationAnchorFields(metadata);
+        result.metadata = metadata;
+    }
+    catch (cause) {
+        result.failure = cause instanceof Error ? cause.message : 'anchor fields did not decode';
+        return result;
+    }
+    try {
+        result.lockingKey = compressedKey(Utils.toHex(chunks[0].data)).toString();
+    }
+    catch (cause) {
+        result.failure = `locking key: ${cause instanceof Error ? cause.message : 'invalid'}`;
+    }
+    const derived = expectedAttestationLockingKey(result.metadata.anchoredBy, result.metadata.attestationId);
+    result.derivedKey = derived.toString();
+    result.keyDerivationValid = result.lockingKey != null && result.lockingKey === result.derivedKey;
+    try {
+        const signature = Signature.fromDER(fields[9]);
+        if (Utils.toHex(signature.toDER()) !== Utils.toHex(fields[9]))
+            throw new Error('signature is not canonical DER');
+        result.signature = fields[9];
+        result.signatureValid = derived.verify(attestationAnchorSigningPreimage(fields.slice(0, 9)), signature);
+    }
+    catch (cause) {
+        result.signatureValid = false;
+        result.failure ??= cause instanceof Error ? cause.message : 'signature did not decode';
+    }
+    return result;
+}
+/** A total strict parser: invalid or legacy outputs return null. No credential proof is implied. */
+export function decodeAttestationAnchor(script) {
+    try {
+        const inspection = inspectAttestationAnchor(script);
+        if (inspection.metadata == null || inspection.lockingKey == null || inspection.signature == null)
+            return null;
+        if (inspection.keyDerivationValid !== true || inspection.signatureValid !== true)
+            return null;
+        return { ...inspection.metadata, lockingKey: inspection.lockingKey, signature: inspection.signature };
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=anchor.js.map

package/dist/anchor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anchor.js","sourceRoot":"","sources":["../src/anchor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAuB,MAAM,UAAU,CAAA;AAE5G;;;;;;;GAOG;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,CAAA;AACpE,MAAM,CAAC,MAAM,2BAA2B,GAAmB,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAA;AAC3F,MAAM,CAAC,MAAM,yBAAyB,GAAG,oBAAoB,CAAA;AAC7D,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAA;AAqB/C,MAAM,MAAM,GAAG,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAA;AAC7C,MAAM,MAAM,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;AAErD,SAAS,UAAU,CAAC,KAAe,EAAE,OAAe;IAClD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACjC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,IAAI,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACxJ,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IACrG,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IACvC,IAAI,GAAG,CAAC,QAAQ,EAAE,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;IACzE,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,UAAkB,EAAE,aAAqB;IACrF,aAAa,CAAC,UAAU,CAAC,CAAA;IACzB,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;IACrD,OAAO,MAAM,CAAC,eAAe,CAAC,2BAA2B,EAAE,aAAa,EAAE,UAAU,CAAC,CAAA;AACvF,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAsB;IAC5D,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,CAAA;IACvK,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACzC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QAC9E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAC1C,IAAI,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;QACzF,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;IACF,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;IACpF,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IAChC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,EAAE,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,CAAA;AACtE,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,MAAkB;IACjE,IAAI,MAAM,CAAC,MAAM,KAAK,8BAA8B;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;IAC3G,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,CAAA;IACjC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAAC,CAAC;IACxF,OAAO,MAAM,CAAC,OAAO,EAAE,CAAA;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,MAAsB,EAAE,MAAoB;IACvF,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAA;IAC9C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC;QACjD,IAAI,EAAE,gCAAgC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,2BAA2B;QACvF,KAAK,EAAE,MAAM,CAAC,aAAa,EAAE,YAAY,EAAE,QAAQ;KACpD,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAA;IAClC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,IAAI,CAAa,CAAC,CAAA;IAChH,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;IACxB,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,MAAM,EAAE,SAAS,CAAC;QAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAClE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE;QAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;IAChE,IAAI,uBAAuB,CAAC,MAAM,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IACjG,OAAO,MAAM,CAAA;AACf,CAAC;AAuBD,MAAM,UAAU,wBAAwB,CAAC,MAAqB;IAC5D,MAAM,MAAM,GAAgC,EAAE,kBAAkB,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAA;IAC9F,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;IAC5B,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACnF,MAAM,CAAC,OAAO,GAAG,2GAA2G,CAAA;QAC5H,OAAO,MAAM,CAAA;IACf,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QACpF,MAAM,CAAC,OAAO,GAAG,gEAAgE,CAAA;QACjF,OAAO,MAAM,CAAA;IACf,CAAC;IACD,IAAI,MAAkB,CAAA;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;YACvC,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAA;YAC1D,IAAI,KAAK,CAAC,EAAE,IAAI,IAAI,IAAI,KAAK,CAAC,EAAE,IAAI,IAAI;gBAAE,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAA;YAClE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;QAChD,CAAC,CAAC,CAAA;QACF,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,yBAAyB;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;QACvH,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACnL,MAAM,QAAQ,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;QACnH,uBAAuB,CAAC,QAAQ,CAAC,CAAA;QACjC,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAA;QACxF,OAAO,MAAM,CAAA;IACf,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,OAAO,GAAG,gBAAgB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAA;IACvF,CAAC;IACD,MAAM,OAAO,GAAG,6BAA6B,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAA;IACxG,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAA;IACtC,MAAM,CAAC,kBAAkB,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,CAAA;IAChG,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9C,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAc,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;QAC5H,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;QAC5B,MAAM,CAAC,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,gCAAgC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IACzG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,cAAc,GAAG,KAAK,CAAA;QAC7B,MAAM,CAAC,OAAO,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAA;IACxF,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,uBAAuB,CAAC,MAAqB;IAC3D,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAA;QACnD,IAAI,UAAU,CAAC,QAAQ,IAAI,IAAI,IAAI,UAAU,CAAC,UAAU,IAAI,IAAI,IAAI,UAAU,CAAC,SAAS,IAAI,IAAI;YAAE,OAAO,IAAI,CAAA;QAC7G,IAAI,UAAU,CAAC,kBAAkB,KAAK,IAAI,IAAI,UAAU,CAAC,cAAc,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAC7F,OAAO,EAAE,GAAG,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAA;IACvG,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;AACzB,CAAC"}

package/dist/attestation.d.ts

@@ -0,0 +1,40 @@
+import { type WalletProtocol } from '@bsv/sdk';
+import type { DataSigner } from './signatures.js';
+export declare const LIFECYCLE_CLAIM_FORMAT: "dpp-lifecycle-v1";
+export declare const LIFECYCLE_CLAIM_PROTOCOL: WalletProtocol;
+export declare const LIFECYCLE_REPRESENTATION: "dpp-lifecycle-json-v1";
+export declare const LIFECYCLE_MEDIA_TYPE: "application/json";
+export type LifecycleEventType = 'Origin' | 'Transfer' | 'Transformation' | 'Disposition';
+/** Native token-operation evidence. This is a different format from a VSC SEAL. */
+export interface LifecycleClaim {
+    claimFormat: typeof LIFECYCLE_CLAIM_FORMAT;
+    passportId: string;
+    recordId: string;
+    eventType: LifecycleEventType;
+    timestamp: string;
+    issuer: string;
+    issuerKeyId: string;
+    issuerKeyDid?: string;
+    profile: string;
+    profile_version: number;
+}
+export interface SignedLifecycleClaim extends LifecycleClaim {
+    signature: string;
+}
+export interface LifecycleClaimVerification {
+    signature: 'verified' | 'invalid';
+    identityBinding: 'key-identified' | 'requires-resolution';
+    issuerKey?: string;
+    reason?: string;
+}
+export declare function assertSignedLifecycleClaim(value: unknown): asserts value is SignedLifecycleClaim;
+export declare function signLifecycleClaim(claim: LifecycleClaim, signer: DataSigner): Promise<SignedLifecycleClaim>;
+/** This checks native signature attribution; DID authority and status are separate checks. */
+export declare function verifyLifecycleClaim(value: unknown, expected?: {
+    passportId?: string;
+    recordId?: string;
+}): LifecycleClaimVerification;
+/** The commitment includes the signature. Signing and anchoring have different preimages. */
+export declare function lifecycleClaimBytes(claim: SignedLifecycleClaim): number[];
+export declare function lifecycleClaimDigest(claim: SignedLifecycleClaim): string;
+//# sourceMappingURL=attestation.d.ts.map

package/dist/attestation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation.d.ts","sourceRoot":"","sources":["../src/attestation.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4C,KAAK,cAAc,EAAE,MAAM,UAAU,CAAA;AAGxF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAEjD,eAAO,MAAM,sBAAsB,EAAG,kBAA2B,CAAA;AACjE,eAAO,MAAM,wBAAwB,EAAE,cAA0C,CAAA;AACjF,eAAO,MAAM,wBAAwB,EAAG,uBAAgC,CAAA;AACxE,eAAO,MAAM,oBAAoB,EAAG,kBAA2B,CAAA;AAC/D,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,UAAU,GAAG,gBAAgB,GAAG,aAAa,CAAA;AAEzF,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,OAAO,sBAAsB,CAAA;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,kBAAkB,CAAA;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,OAAO,EAAE,MAAM,CAAA;IACf,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAAG,SAAS,EAAE,MAAM,CAAA;CAAE;AAElF,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,UAAU,GAAG,SAAS,CAAA;IACjC,eAAe,EAAE,gBAAgB,GAAG,qBAAqB,CAAA;IACzD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAiDD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,oBAAoB,CAEhG;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,oBAAoB,CAAC,CASjH;AAED,8FAA8F;AAC9F,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,QAAQ,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACxD,0BAA0B,CAgB5B;AAED,6FAA6F;AAC7F,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,EAAE,CAGzE;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,CAExE"}

package/dist/attestation.js

@@ -0,0 +1,111 @@
+import { CachedKeyDeriver, Hash, Signature, Utils } from '@bsv/sdk';
+import { canonicalBytes } from './canonical.js';
+import { identityKeyFromDidKey } from './did.js';
+export const LIFECYCLE_CLAIM_FORMAT = 'dpp-lifecycle-v1';
+export const LIFECYCLE_CLAIM_PROTOCOL = [1, 'dpp attestation v1'];
+export const LIFECYCLE_REPRESENTATION = 'dpp-lifecycle-json-v1';
+export const LIFECYCLE_MEDIA_TYPE = 'application/json';
+const allowed = new Set([
+    'claimFormat', 'passportId', 'recordId', 'eventType', 'timestamp', 'issuer',
+    'issuerKeyId', 'issuerKeyDid', 'profile', 'profile_version', 'signature',
+]);
+const types = new Set(['Origin', 'Transfer', 'Transformation', 'Disposition']);
+const anyone = new CachedKeyDeriver('anyone');
+function text(value, field, maximum) {
+    if (typeof value !== 'string' || value.length === 0 || /[\u0000-\u001f\u007f-\u009f]/u.test(value)) {
+        throw new Error(`${field} must be nonempty printable text`);
+    }
+    const bytes = Utils.toArray(value, 'utf8');
+    if (bytes.length > maximum || Utils.toUTF8(bytes) !== value)
+        throw new Error(`${field} exceeds its UTF-8 bound`);
+}
+function validate(value, signed) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('claim must be an object');
+    const claim = value;
+    for (const field of Object.keys(claim)) {
+        if (!allowed.has(field) || (!signed && field === 'signature'))
+            throw new Error(`unsupported claim field ${field}`);
+    }
+    if (claim.claimFormat !== LIFECYCLE_CLAIM_FORMAT)
+        throw new Error('unsupported claimFormat');
+    for (const field of ['passportId', 'recordId', 'issuer'])
+        text(claim[field], field, 512);
+    for (const field of ['issuerKeyId', 'profile'])
+        text(claim[field], field, 256);
+    if (typeof claim.eventType !== 'string' || !types.has(claim.eventType))
+        throw new Error('unsupported eventType');
+    if (!Number.isSafeInteger(claim.profile_version) || claim.profile_version < 1)
+        throw new Error('invalid profile_version');
+    text(claim.timestamp, 'timestamp', 64);
+    const date = /^(\d{4})-(\d{2})-(\d{2})T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/.exec(claim.timestamp);
+    if (!date || !Number.isFinite(Date.parse(claim.timestamp)))
+        throw new Error('timestamp must be an ISO date-time with timezone');
+    const days = new Date(Date.UTC(Number(date[1]), Number(date[2]), 0)).getUTCDate();
+    if (Number(date[3]) < 1 || Number(date[3]) > days)
+        throw new Error('timestamp contains an invalid calendar day');
+    if (!/^did:[a-z0-9]+:(?:[A-Za-z0-9._:-]|%[0-9A-Fa-f]{2})*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})$/.test(claim.issuer))
+        throw new Error('issuer must be a DID without a path, query or fragment');
+    if (claim.issuer.startsWith('did:key:')) {
+        if (claim.issuerKeyDid !== undefined)
+            throw new Error('did:key issuer must omit issuerKeyDid');
+        identityKeyFromDidKey(claim.issuer);
+    }
+    else {
+        text(claim.issuerKeyDid, 'issuerKeyDid', 256);
+        identityKeyFromDidKey(claim.issuerKeyDid);
+    }
+    if (signed) {
+        if (typeof claim.signature !== 'string' || !/^(?:[0-9a-f]{2}){8,72}$/.test(claim.signature))
+            throw new Error('signature must be lowercase DER hex');
+        const signature = Signature.fromDER(claim.signature, 'hex');
+        if (Utils.toHex(signature.toDER()) !== claim.signature)
+            throw new Error('signature must use canonical DER');
+    }
+    canonicalBytes(claim);
+}
+export function assertSignedLifecycleClaim(value) {
+    validate(value, true);
+}
+export async function signLifecycleClaim(claim, signer) {
+    validate(claim, false);
+    const { signature } = await signer.createSignature({
+        data: canonicalBytes(claim), protocolID: LIFECYCLE_CLAIM_PROTOCOL,
+        keyID: claim.passportId, counterparty: 'anyone',
+    });
+    const signed = { ...claim, signature: Utils.toHex(signature) };
+    if (verifyLifecycleClaim(signed).signature !== 'verified')
+        throw new Error('signer does not match the declared issuer key');
+    return signed;
+}
+/** This checks native signature attribution; DID authority and status are separate checks. */
+export function verifyLifecycleClaim(value, expected = {}) {
+    try {
+        assertSignedLifecycleClaim(value);
+        if (expected.passportId !== undefined && value.passportId !== expected.passportId)
+            throw new Error('passportId does not match the requested subject');
+        if (expected.recordId !== undefined && value.recordId !== expected.recordId)
+            throw new Error('recordId does not match the requested state');
+        const issuerKey = identityKeyFromDidKey(value.issuerKeyDid ?? value.issuer);
+        const { signature, ...claim } = value;
+        const publicKey = anyone.derivePublicKey(LIFECYCLE_CLAIM_PROTOCOL, value.passportId, issuerKey);
+        if (!publicKey.verify(canonicalBytes(claim), Signature.fromDER(signature, 'hex')))
+            throw new Error('native claim signature does not verify');
+        return {
+            signature: 'verified', issuerKey,
+            identityBinding: value.issuer.startsWith('did:key:') ? 'key-identified' : 'requires-resolution',
+        };
+    }
+    catch (error) {
+        return { signature: 'invalid', identityBinding: 'requires-resolution', reason: error instanceof Error ? error.message : 'invalid claim' };
+    }
+}
+/** The commitment includes the signature. Signing and anchoring have different preimages. */
+export function lifecycleClaimBytes(claim) {
+    assertSignedLifecycleClaim(claim);
+    return canonicalBytes(claim);
+}
+export function lifecycleClaimDigest(claim) {
+    return Utils.toHex(Hash.sha256(lifecycleClaimBytes(claim)));
+}
+//# sourceMappingURL=attestation.js.map

package/dist/attestation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation.js","sourceRoot":"","sources":["../src/attestation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAuB,MAAM,UAAU,CAAA;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAGhD,MAAM,CAAC,MAAM,sBAAsB,GAAG,kBAA2B,CAAA;AACjE,MAAM,CAAC,MAAM,wBAAwB,GAAmB,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAA;AACjF,MAAM,CAAC,MAAM,wBAAwB,GAAG,uBAAgC,CAAA;AACxE,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAA2B,CAAA;AA0B/D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;IACtB,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ;IAC3E,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,iBAAiB,EAAE,WAAW;CACzE,CAAC,CAAA;AACF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC,CAAA;AAC9E,MAAM,MAAM,GAAG,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAA;AAE7C,SAAS,IAAI,CAAC,KAAc,EAAE,KAAa,EAAE,OAAe;IAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnG,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kCAAkC,CAAC,CAAA;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IAC1C,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0BAA0B,CAAC,CAAA;AAClH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc,EAAE,MAAe;IAC/C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;IACnH,MAAM,KAAK,GAAG,KAAgC,CAAA;IAC9C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,KAAK,WAAW,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAA;IACpH,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,sBAAsB;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;IAC5F,KAAK,MAAM,KAAK,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAU;QAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA;IACjG,KAAK,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,SAAS,CAAU;QAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA;IACvF,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IAChH,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC,IAAK,KAAK,CAAC,eAA0B,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;IACrI,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;IACtC,MAAM,IAAI,GAAG,4EAA4E,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAC/G,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IAC/H,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAA;IACjF,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IAChH,IAAI,CAAC,wFAAwF,CAAC,IAAI,CAAC,KAAK,CAAC,MAAgB,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IACrM,IAAK,KAAK,CAAC,MAAiB,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAC9F,qBAAqB,CAAC,KAAK,CAAC,MAAgB,CAAC,CAAA;IAC/C,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,cAAc,EAAE,GAAG,CAAC,CAAA;QAC7C,qBAAqB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAC3C,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACnJ,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QAC3D,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAc,CAAC,KAAK,KAAK,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IACzH,CAAC;IACD,cAAc,CAAC,KAAK,CAAC,CAAA;AACvB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAqB,EAAE,MAAkB;IAChF,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACtB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC;QACjD,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,wBAAwB;QACjE,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,QAAQ;KAChD,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAA;IAC9D,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAC,SAAS,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAC3H,OAAO,MAAM,CAAA;AACf,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,oBAAoB,CAClC,KAAc,EACd,WAAuD,EAAE;IAEzD,IAAI,CAAC;QACH,0BAA0B,CAAC,KAAK,CAAC,CAAA;QACjC,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QACrJ,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;QAC3I,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,MAAM,CAAC,CAAA;QAC3E,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,EAAE,GAAG,KAAK,CAAA;QACrC,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,wBAAwB,EAAE,KAAK,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;QAC/F,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;QAC5I,OAAO;YACL,SAAS,EAAE,UAAU,EAAE,SAAS;YAChC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,qBAAqB;SAChG,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAA;IAC3I,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,mBAAmB,CAAC,KAA2B;IAC7D,0BAA0B,CAAC,KAAK,CAAC,CAAA;IACjC,OAAO,cAAc,CAAC,KAAK,CAAC,CAAA;AAC9B,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAA2B;IAC9D,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC7D,CAAC"}

package/dist/blob.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Owner-tier blob binding (`spec/record-model.md` §7): the encrypted owner-tier
+ * blob lives off-chain. Its SHA-256 goes on-chain as payload_owner_hash
+ * (field 11). The fetched ciphertext MUST hash to field 11 before any
+ * decryption is attempted (§7); mismatch renders "Could not verify."
+ */
+/** SHA-256 of the ciphertext blob, hex - the value carried in field 11. */
+export declare function ownerBlobHash(ciphertext: number[]): string;
+/** Check fetched ciphertext against the on-chain payload_owner_hash. */
+export declare function verifyOwnerBlob(ciphertext: number[], payloadOwnerHash: string): boolean;
+//# sourceMappingURL=blob.d.ts.map

package/dist/blob.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blob.d.ts","sourceRoot":"","sources":["../src/blob.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,CAE1D;AAED,wEAAwE;AACxE,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAAE,EACpB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAET"}

package/dist/blob.js

@@ -0,0 +1,16 @@
+import { Hash, Utils } from '@bsv/sdk';
+/**
+ * Owner-tier blob binding (`spec/record-model.md` §7): the encrypted owner-tier
+ * blob lives off-chain. Its SHA-256 goes on-chain as payload_owner_hash
+ * (field 11). The fetched ciphertext MUST hash to field 11 before any
+ * decryption is attempted (§7); mismatch renders "Could not verify."
+ */
+/** SHA-256 of the ciphertext blob, hex - the value carried in field 11. */
+export function ownerBlobHash(ciphertext) {
+    return Utils.toHex(Hash.sha256(ciphertext));
+}
+/** Check fetched ciphertext against the on-chain payload_owner_hash. */
+export function verifyOwnerBlob(ciphertext, payloadOwnerHash) {
+    return payloadOwnerHash !== '' && ownerBlobHash(ciphertext) === payloadOwnerHash;
+}
+//# sourceMappingURL=blob.js.map

package/dist/blob.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blob.js","sourceRoot":"","sources":["../src/blob.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAEtC;;;;;GAKG;AAEH,2EAA2E;AAC3E,MAAM,UAAU,aAAa,CAAC,UAAoB;IAChD,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAA;AAC7C,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAC7B,UAAoB,EACpB,gBAAwB;IAExB,OAAO,gBAAgB,KAAK,EAAE,IAAI,aAAa,CAAC,UAAU,CAAC,KAAK,gBAAgB,CAAA;AAClF,CAAC"}

package/dist/canonical.d.ts

@@ -0,0 +1,32 @@
+/** Thrown when a value cannot be canonicalised, rather than guessed at. */
+export declare class CanonicalError extends Error {
+    constructor(message: string);
+}
+/**
+ * The bytes both sides of an attestation sign and hash (`spec/rules.md` §4).
+ *
+ * **A deliberate subset of RFC 8785, not an implementation of it.** JCS is
+ * mostly a specification for the hard cases: number formatting, surrogate
+ * pairs, escape selection. This payload has none of them, and a partial JCS
+ * that silently mishandled one would be worse than no JCS at all, because two
+ * implementations would agree on every value they had tested and differ on the
+ * first one they had not. So this canonicalises what it can, refuses everything
+ * else, and the refusal is the feature: keys sorted by code point, no
+ * whitespace, string values JSON-escaped, integer values only when they are
+ * safe integers. Two honest encoders of one claim produce identical bytes or an
+ * error, never a second encoding.
+ *
+ * An absent optional property and a present-but-undefined one are different
+ * things here on purpose: `undefined` is refused, not skipped, so a claim built
+ * with a property present and empty is a refusal rather than a different
+ * digest. Callers spread optional properties conditionally.
+ *
+ * The parameter is `object` rather than a claim type because more than one
+ * signed shape uses this rule, and one canonicaliser serving all of them is the
+ * point: a fork is a copy that drifts. `fixtures/anchor-v3.json` pins the output
+ * for one complete claim, and every implementing party asserts against it.
+ */
+export declare function canonicalBytes(claim: object): number[];
+/** The canonical string, for a fixture or an error message to show a human. */
+export declare function canonicalString(claim: object): string;
+//# sourceMappingURL=canonical.d.ts.map

package/dist/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../src/canonical.ts"],"names":[],"mappings":"AAGA,2EAA2E;AAC3E,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAiBtD;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErD"}

package/dist/canonical.js

@@ -0,0 +1,54 @@
+import { Utils } from '@bsv/sdk';
+import { compareCodePoints } from './canonicalJson.js';
+/** Thrown when a value cannot be canonicalised, rather than guessed at. */
+export class CanonicalError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CanonicalError';
+    }
+}
+/**
+ * The bytes both sides of an attestation sign and hash (`spec/rules.md` §4).
+ *
+ * **A deliberate subset of RFC 8785, not an implementation of it.** JCS is
+ * mostly a specification for the hard cases: number formatting, surrogate
+ * pairs, escape selection. This payload has none of them, and a partial JCS
+ * that silently mishandled one would be worse than no JCS at all, because two
+ * implementations would agree on every value they had tested and differ on the
+ * first one they had not. So this canonicalises what it can, refuses everything
+ * else, and the refusal is the feature: keys sorted by code point, no
+ * whitespace, string values JSON-escaped, integer values only when they are
+ * safe integers. Two honest encoders of one claim produce identical bytes or an
+ * error, never a second encoding.
+ *
+ * An absent optional property and a present-but-undefined one are different
+ * things here on purpose: `undefined` is refused, not skipped, so a claim built
+ * with a property present and empty is a refusal rather than a different
+ * digest. Callers spread optional properties conditionally.
+ *
+ * The parameter is `object` rather than a claim type because more than one
+ * signed shape uses this rule, and one canonicaliser serving all of them is the
+ * point: a fork is a copy that drifts. `fixtures/anchor-v3.json` pins the output
+ * for one complete claim, and every implementing party asserts against it.
+ */
+export function canonicalBytes(claim) {
+    const entries = Object.entries(claim).sort(([a], [b]) => compareCodePoints(a, b));
+    const parts = [];
+    for (const [key, value] of entries) {
+        if (typeof value === 'string') {
+            parts.push(`${JSON.stringify(key)}:${JSON.stringify(value)}`);
+            continue;
+        }
+        if (typeof value === 'number' && Number.isSafeInteger(value)) {
+            parts.push(`${JSON.stringify(key)}:${value}`);
+            continue;
+        }
+        throw new CanonicalError(`${key} is not canonicalisable: only strings and safe integers are, and this is ${typeof value}`);
+    }
+    return Utils.toArray(`{${parts.join(',')}}`, 'utf8');
+}
+/** The canonical string, for a fixture or an error message to show a human. */
+export function canonicalString(claim) {
+    return Utils.toUTF8(canonicalBytes(claim));
+}
+//# sourceMappingURL=canonical.js.map

package/dist/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../src/canonical.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEtD,2EAA2E;AAC3E,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAA;IAC9B,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACjF,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAC7D,SAAQ;QACV,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7D,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAA;YAC7C,SAAQ;QACV,CAAC;QACD,MAAM,IAAI,cAAc,CACtB,GAAG,GAAG,4EAA4E,OAAO,KAAK,EAAE,CACjG,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;AACtD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAA;AAC5C,CAAC"}

package/dist/canonicalJson.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Canonical JSON for nested documents: the publisher policy and the evidence
+ * package manifest. Native claims keep the flat restricted form of
+ * canonical.ts; this one exists because those documents nest objects and
+ * arrays. Object keys are sorted recursively by code point, there is no
+ * whitespace, arrays keep their order, `undefined` members are omitted, and
+ * only strings, booleans and safe integers are values. Anything else has no
+ * canonical form and is refused by name, so two implementations that both
+ * accept a document hash the same bytes.
+ */
+export declare class CanonicalJsonError extends Error {
+    constructor(path: string, detail: string);
+}
+/**
+ * Key order by Unicode code point, so two implementations agree on keys that
+ * mix astral characters with U+E000 to U+FFFF, where UTF-16 code unit order
+ * differs. Every key in the documents this serves is ASCII today; the rule is
+ * stated once so a future key does not turn into a divergence.
+ */
+export declare function compareCodePoints(a: string, b: string): number;
+export declare function canonicalJson(value: unknown, path?: string): string;
+//# sourceMappingURL=canonicalJson.d.ts.map

package/dist/canonicalJson.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonicalJson.d.ts","sourceRoot":"","sources":["../src/canonicalJson.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAIzC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAa9D;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAa,GAAG,MAAM,CAcvE"}

package/dist/canonicalJson.js

@@ -0,0 +1,60 @@
+/**
+ * Canonical JSON for nested documents: the publisher policy and the evidence
+ * package manifest. Native claims keep the flat restricted form of
+ * canonical.ts; this one exists because those documents nest objects and
+ * arrays. Object keys are sorted recursively by code point, there is no
+ * whitespace, arrays keep their order, `undefined` members are omitted, and
+ * only strings, booleans and safe integers are values. Anything else has no
+ * canonical form and is refused by name, so two implementations that both
+ * accept a document hash the same bytes.
+ */
+export class CanonicalJsonError extends Error {
+    constructor(path, detail) {
+        super(`${path} is not canonicalisable: ${detail}`);
+        this.name = 'CanonicalJsonError';
+    }
+}
+/**
+ * Key order by Unicode code point, so two implementations agree on keys that
+ * mix astral characters with U+E000 to U+FFFF, where UTF-16 code unit order
+ * differs. Every key in the documents this serves is ASCII today; the rule is
+ * stated once so a future key does not turn into a divergence.
+ */
+export function compareCodePoints(a, b) {
+    const left = a[Symbol.iterator]();
+    const right = b[Symbol.iterator]();
+    for (;;) {
+        const x = left.next();
+        const y = right.next();
+        if (x.done && y.done)
+            return 0;
+        if (x.done)
+            return -1;
+        if (y.done)
+            return 1;
+        const cx = x.value.codePointAt(0);
+        const cy = y.value.codePointAt(0);
+        if (cx !== cy)
+            return cx < cy ? -1 : 1;
+    }
+}
+export function canonicalJson(value, path = 'document') {
+    if (typeof value === 'string')
+        return JSON.stringify(value);
+    if (typeof value === 'boolean')
+        return value ? 'true' : 'false';
+    if (typeof value === 'number') {
+        if (!Number.isSafeInteger(value))
+            throw new CanonicalJsonError(path, 'only safe integers are canonical numbers');
+        return String(value);
+    }
+    if (Array.isArray(value))
+        return `[${value.map((v, i) => canonicalJson(v, `${path}[${i}]`)).join(',')}]`;
+    if (value != null && typeof value === 'object') {
+        const record = value;
+        const keys = Object.keys(record).filter((k) => record[k] !== undefined).sort(compareCodePoints);
+        return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(record[k], `${path}.${k}`)}`).join(',')}}`;
+    }
+    throw new CanonicalJsonError(path, `only strings, booleans, safe integers, arrays and objects are, and this is ${value === null ? 'null' : typeof value}`);
+}
+//# sourceMappingURL=canonicalJson.js.map

package/dist/canonicalJson.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonicalJson.js","sourceRoot":"","sources":["../src/canonicalJson.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,IAAY,EAAE,MAAc;QACtC,KAAK,CAAC,GAAG,IAAI,4BAA4B,MAAM,EAAE,CAAC,CAAA;QAClD,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;IAClC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAS,EAAE,CAAS;IACpD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAA;IACjC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAA;IAClC,SAAS,CAAC;QACR,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACrB,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;QACtB,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI;YAAE,OAAO,CAAC,CAAA;QAC9B,IAAI,CAAC,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,CAAA;QACrB,IAAI,CAAC,CAAC,IAAI;YAAE,OAAO,CAAC,CAAA;QACpB,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAW,CAAA;QAC3C,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAW,CAAA;QAC3C,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACxC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,IAAI,GAAG,UAAU;IAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC3D,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,kBAAkB,CAAC,IAAI,EAAE,0CAA0C,CAAC,CAAA;QAChH,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IACxG,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,KAAgC,CAAA;QAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;QAC/F,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IAC7G,CAAC;IACD,MAAM,IAAI,kBAAkB,CAAC,IAAI,EAAE,8EAA8E,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAA;AAC5J,CAAC"}

package/dist/codec.d.ts

@@ -0,0 +1,45 @@
+import { LockingScript, PublicKey } from '@bsv/sdk';
+import type { DppState, DppStateData, DppStateDataV2, DppStateV1, DppStateV2, Outpoint } from './types.js';
+/** Thrown when a script does not carry a well-formed DPP output of a version this reader decodes. */
+export declare class DppFormatError extends Error {
+    constructor(message: string);
+}
+/** Whether signable content, of either version, is version 2. */
+export declare function isV2Data(d: object): d is DppStateDataV2;
+/** Fields 1–12 (the signable content) of a version 1 state as raw wire bytes, in standard order. */
+export declare function dataFields(d: DppStateData): number[][];
+/** An outpoint as the version 2 fields 12 and 13 carry it: 32 txid bytes in display order, then a big-endian uint32 index. */
+export declare function outpointFieldBytes(outpoint: Outpoint | null): number[];
+/** Fields 1–15 (the signable content) of a version 2 state as raw wire bytes, in standard order. */
+export declare function dataFieldsV2(d: DppStateDataV2): number[][];
+/** All fields of a state as raw wire bytes: 14 for version 1, 17 for version 2. */
+export declare function stateToFields(s: DppState): number[][];
+/**
+ * Build the DPP locking script: <33-byte key> OP_CHECKSIG <fields> drops.
+ * Custody-neutral (`spec/record-model.md` §2): the locking key may be treasury-derived or user-held.
+ * The drop tail is one OP_2DROP per pair of fields and one OP_DROP for an odd
+ * field left over: seven OP_2DROP for version 1, eight and an OP_DROP for version 2.
+ */
+export declare function buildLockingScript(state: DppState, lockingPublicKey: PublicKey | string): LockingScript;
+/** Validate and type raw version 1 fields per `spec/record-model.md` §2-§3. Throws DppFormatError. */
+export declare function fieldsToState(fields: number[][]): DppStateV1;
+/** Validate and type raw version 2 fields per `spec/record-model-v2.md` §2-§3. Throws DppFormatError. */
+export declare function fieldsToStateV2(fields: number[][]): DppStateV2;
+/**
+ * Parse a DPP output script of either version. Throws DppFormatError when the
+ * script is not a well-formed DPP output: the field count selects the version's
+ * rules (fourteen fields for version 1, seventeen for version 2), the version
+ * field must agree with the count, and any other count or version is refused by
+ * name so an older reader meeting a newer state fails clearly rather than
+ * guessing.
+ */
+export declare function parseDppOutput(script: LockingScript): {
+    state: DppState;
+    lockingPublicKey: PublicKey;
+};
+/** Non-throwing variant of parseDppOutput, for scanning arbitrary outputs. */
+export declare function tryParseDppOutput(script: LockingScript): {
+    state: DppState;
+    lockingPublicKey: PublicKey;
+} | null;
+//# sourceMappingURL=codec.d.ts.map

package/dist/codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codec.d.ts","sourceRoot":"","sources":["../src/codec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAM,SAAS,EAA2B,MAAM,UAAU,CAAA;AAgBhF,OAAO,KAAK,EAAoB,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAE5H,qGAAqG;AACrG,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,OAAO,EAAE,MAAM;CAI5B;AAmCD,iEAAiE;AACjE,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,IAAI,cAAc,CAEvD;AAED,oGAAoG;AACpG,wBAAgB,UAAU,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,EAAE,EAAE,CAetD;AAED,8HAA8H;AAC9H,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,GAAG,MAAM,EAAE,CAStE;AAED,oGAAoG;AACpG,wBAAgB,YAAY,CAAC,CAAC,EAAE,cAAc,GAAG,MAAM,EAAE,EAAE,CAoB1D;AAED,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,EAAE,EAAE,CAGrD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,QAAQ,EACf,gBAAgB,EAAE,SAAS,GAAG,MAAM,GACnC,aAAa,CAmBf;AAsID,sGAAsG;AACtG,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,UAAU,CA+D5D;AAED,yGAAyG;AACzG,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,UAAU,CAuE9D;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG;IACrD,KAAK,EAAE,QAAQ,CAAA;IACf,gBAAgB,EAAE,SAAS,CAAA;CAC5B,CAyCA;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa,GAAG;IACxD,KAAK,EAAE,QAAQ,CAAA;IACf,gBAAgB,EAAE,SAAS,CAAA;CAC5B,GAAG,IAAI,CAMP"}