@certrev/cert-block 1.2.1-canary.0 → 1.3.0

package/CHANGELOG.md

@@ -5,6 +5,78 @@ change the rendered cert output and never break a compiling integration** (regis
 exports, types). Anything that would alter what a visitor sees, or require integration changes,
 is announced loudly here first.
 
+## 1.3.0 · 2026-10-18
+
+Minor: **a `delivery` card can paint the face CertREV rendered for the brand's design, when the signed envelope binds
+it.** Backward compatible: **with no delivered face, or an envelope without `faceDigest`, the card renders exactly what
+1.2.1 renders, byte for byte** (the server's HTML and its seed, hydration, a streamed record, a fallback record, a
+`clientRead` read). A block without the marker and a pinned card are untouched, and no integration needs a code
+change. Like 1.1.0's marker, the new face is switched on from CertREV's side, never by the upgrade: it takes an
+envelope minted with a `faceDigest` (`@certrev/cert-contract` 0.6.0) AND a Delivery response serving the face it hashes.
+
+- **A delivered face, bound by a signed digest.** The Builder Delivery response may carry an unsigned top-level
+  `face: { html, css }` beside `payload`, `signature` and `renderDef`. The signature does not cover it; the signed
+  `payload.content.faceDigest` (`{ v: 1, defVersion, html, css }`, the lowercase hex sha256 of each half's UTF-8
+  bytes for one saved design version) binds it. The card paints the delivered face only when ALL of these hold: the
+  verdict is `render`; the card is not pinned; the block shows the whole card (below); the verified content carries a
+  `faceDigest` with `v: 1`; a well-formed face was served; a `renderDef` was served and its `v` is
+  `faceDigest.defVersion`; and sha256(html) and sha256(css), computed with WebCrypto (`crypto.subtle.digest`, the
+  global the kernel already verifies with), equal the signed values. It then paints `<style>` + css + `</style>` +
+  html inside the card's usual wrapper, which keeps `data-certrev-cert-chrome`, `data-certrev-delivery`,
+  `data-certrev-strings-version`, `data-certrev-def-version` and the seed, and gains
+  `data-certrev-face="delivered"`. It paints in place of the legacy or reader face, with no reader stylesheet and no
+  sidebar flow rules.
+- **A split banner keeps its own halves.** The delivered face is a whole design, so only a block whose `part` is
+  absent or `'full'` (or null, or a value `renderCertBlock` does not recognise, which it paints as the full card)
+  paints it. A block with `part: 'header'` or `part: 'memo'` paints its own part as 1.2.1 does, and hashes nothing.
+  The block's `mode` is not consulted: the delivered face carries the design's own layout.
+- **The browser re-checks the face before it paints it.** A server that painted the delivered face ends the seed with
+  the same `face`: `{ v: 1, baseUrl, externalId, payload, signature?, renderDef, face }`. A seed without one is the
+  1.2.1 seed byte for byte. The browser repaints the face from the seed (hydration, a later client mount, a record
+  streamed in while the page loads) only after hashing it against the seed payload's own `faceDigest`, for the
+  seed's def; a `clientRead` read is judged as the server judges it. A seed with no `face`, a malformed one, or one
+  whose hashes fail paints what 1.2.1 paints for it. While a card hydrates over the server's delivered face and the
+  browser cannot confirm it (no WebCrypto, as on an insecure `http:` page), it adopts the server's element without
+  rendering that markup, and the render right after hydration replaces it with the face 1.2.1 paints, with no
+  hydration error. A card hydrating a delivered face suspends once while WebCrypto hashes it, and keeps the server's
+  HTML on screen meanwhile; the hashes are memoized by the face's content, so one face is hashed once per process.
+- **Page weight.** The face is on the page twice: painted, and in the seed, where JSON and attribute escaping add
+  between a few percent and about 60% (more for quote- and markup-dense HTML). A face the size of the 1.2.1 reader
+  card (about 43 KB with its stylesheet) adds about 46 KB to the seed, uncompressed. The delivered face replaces the
+  card's own face, so the painted half costs about what the reader face did.
+- **Fails closed as before.** A digest rewritten in transit fails the signature, so the card renders nothing and
+  writes a `"none"` record, as for any tampering. Markup whose bytes do not hash to the signed digest is never
+  painted, and a WebCrypto failure counts as a mismatch.
+- **New API, all additive.** Root: `parseDeliveredFace` (the face sibling's shape check, as `parseRenderDef` is the
+  def's), the `DeliveredFace` type and the `CertFaceDigest` contract type. `VerifiedDelivery` and `CachedDelivery`
+  gain an optional `face`, present only on a `render` verdict whose response carried a well-formed face, so a read
+  with no face is the 1.2.1 object exactly. **`face` is carried unverified:** a `getVerifiedDelivery` caller that
+  paints it must check it against the digest first, as the card does.
+- **Dependency.** `@certrev/cert-contract` is now `^0.6.0` (was `^0.5.0`), for `CertFaceDigest`. The `^0.5.0` range
+  did not match the workspace's 0.6.0, so `pnpm -r build` on a cold tree built cert-block before cert-contract and
+  failed; it now builds in order.
+- **Unchanged:** every face 1.2.1 paints, the seed and fallback records without a face, the stale window and the
+  deadline, the pinned card, the options path (no marker), the registration and inputs, the web component, and the
+  storefront modal bundle (`src/modal/*` and `dist/modal/certrev-cert.js`: nothing it bundles changed).
+- **Tests.** `builder/__tests__/delivered-face.test.tsx` (server) and `delivered-face-client.test.tsx` (jsdom):
+  the delivered face on the server for the legacy, the legacy-without-hidden-fields and the reader defs (exact bytes,
+  the seed the 1.2.1 seed plus the face); every other case of the matrix (17 failing deliveries per def, the two
+  split-banner parts, the pinned card, a tombstone) against `__golden__/delivered-face-1.2.1.json`, rendered by the
+  unmodified 1.2.1 card; the browser's hydration (same node, no read, no error), client mount, streamed record and
+  `clientRead` with a face, and with a face the browser cannot confirm, against `__golden__/delivered-face-client-1.2.1.json`;
+  1.2.1's server HTML hydrating as served; tampering; and the seed's `face` parse and write. `delivered-face-use.test.tsx`
+  pins the one promise per face a React 19 `use` replays. `get-verified-delivery.test.ts` gains the face sibling's
+  parse, cache and settle. No existing expectation changed.
+
+## 1.2.1 · 2026-10-09
+
+Patch, stable (dist-tag `latest`): **1.2.1-canary.0, below, as a stable release.** A card the browser renders while
+the page is still loading waits for the record a streaming server sends after it, so a phone's first load of a
+streamed page keeps its card. The source is the canary's, byte for byte; only the version stamps change. No
+integration change, and the rendered cert output is unchanged: a card that hydrates, a `clientRead` card and a card
+mounted after the page has loaded paint exactly as in 1.2.0. The profile and certificate modals for the Builder card
+are not in this release.
+
 ## 1.2.1-canary.0 · 2026-10-07
 
 Patch, canary tag only: **a card the browser renders while the page is still loading waits for the record a

package/README.md

@@ -419,6 +419,16 @@ browser hydrates from it:
   `connect-src` for the Delivery origin; where it is blocked or fails, the card **renders nothing and logs
   nothing**, never a broken card and never the host's tree unmounted. It is not a Builder input: a brand that wants
   it sets it in code, on a wrapper of the registered component.
+- **The delivered face (1.3.0).** The Delivery API may serve, beside the envelope, a face it rendered for the
+  brand's design: an unsigned `face: { html, css }`. The envelope's signed `content.faceDigest`
+  (`@certrev/cert-contract` 0.6.0) holds the sha256 of each half's UTF-8 bytes and the def version they were
+  rendered for. The card paints that face (`<style>` + css + `</style>` + html, in its usual wrapper, marked
+  `data-certrev-face="delivered"`) only for an unpinned block that shows the whole card (not a split banner's
+  `part: 'header'` or `'memo'`), when the def served is that version and both hashes, computed with WebCrypto,
+  equal the signed values. The seed then ends with the same `face`, and the browser hashes it again against the
+  seed payload's digest before it paints it; with no WebCrypto (an insecure `http:` page) or bytes that do not
+  hash, the card paints what 1.2.1 paints. Every other delivery paints exactly what 1.2.1 paints, seed included.
+  The face is on the page twice (painted, and in the seed).
 - **The server's read** waits up to 8 s (the verifier's own default stays 3 s). Its cache keeps a certificate for
   60 s, then serves it for up to 5 minutes more while one background refresh runs or while CertREV cannot be
   reached; a refusal (revoked, expired) lands as soon as its refresh does. A cold placement waits once; a warm one
@@ -850,6 +860,7 @@ alongside each modal module. The load-bearing ones:
 - **`__tests__/webcomponent.test.tsx`**: the shared `renderBadgeHtml` string renderer (hand-escaping, unsafe-URL/color dropping, compact style) and the `<certrev-badge>` custom element (idempotent registration, SSR light-DOM preservation, client-mode fail-closed without a resolver).
 - **`builder/__tests__/builder.test.tsx`** covers the PUSH card and its registration: the wire-type ⇄ inputs parity lock, the fused-credential gate, and the mistyped-option degradation.
 - **`builder/__tests__/delivery-card-hydrate.test.tsx`** + **`builder/__tests__/ssr-seed.test.tsx`** (1.2.0): a server-rendered delivery card hydrates on both faces with zero browser reads, no mismatch and the same nodes; its seed is the served envelope and still verifies; revoked and browser-clock-expired cards come down; a later client mount reuses the page's seed; the server's options and none records are kept through hydration and through React's client re-render after a hydration error, with no read; a client mount with no record makes no read and paints the options face or nothing, and only with `clientRead` reads once, or renders nothing and logs nothing when the read is refused; a reviewer photo that fails to load repaints as initials; the seed and fallback-record parsers refuse malformed records and each other's; the design pin is part of the seed's key; a hidden `reviewerPhoto` or `memo`, or `display.showExpertPhoto: false` (the photo URLs), is absent from the whole server HTML and the seed carries no signature; every server render in these files runs under jsdom with no server switch; and the card's inlined reader stylesheet names no font URL. **`builder/__tests__/delivery-card.test.tsx`** pins the unreachable cases to the 1.0.3 options face byte for byte, and the 8 s deadline and the stale window; **`verify/__tests__/cache.test.ts`** the cache's stale-while-revalidate, stale-if-error and in-flight limit. **`reader/__tests__/reader-initials.test.ts`** pins the initials bytes (honorifics, escaping, hidden and missing photos, `showExpertPhoto`, the empty name).
+- **`builder/__tests__/delivered-face.test.tsx`** + **`builder/__tests__/delivered-face-client.test.tsx`** + **`builder/__tests__/delivered-face-use.test.tsx`** (1.3.0): the delivered face paints, server and browser (hydration, a client mount over the page's record, a streamed record, `clientRead`), only when its hashes match the signed digest for the def served, on an unpinned whole-card block; every other delivery, and a browser that cannot hash, renders what the unmodified 1.2.1 card rendered for the same input, byte for byte, seed included (`__golden__/delivered-face-1.2.1.json`, `__golden__/delivered-face-client-1.2.1.json`); a tampered digest suppresses.
 - **`builder/__tests__/streamed-record-card.test.tsx`** (1.2.1): a card the client renders while the page loads paints nothing, then the record the stream adds, to the document (#421) or to the server's `<html>` after React replaced it (#423, with and without `MutationObserver`), and what a client mount paints once the page loads with none; pinned, options, none and expired records; no read; hydration, `clientRead` and a loaded page unchanged.
 - **`modal/*.test.ts`**, per module: the modal element (tombstone → `markSuppressed`), the dialog view, interactions, placement, badge revalidation, and the Delivery-API verify client. `modal/own-face-modal.test.ts` puts two faces on one page and proves each control opens its own face's modal; `modal/closed-container-face.test.ts` proves a face that loads inside a closed `<details>`, tab or accordion is left alone and renders when opened (there is no runtime disclosure guard).
 - **`__tests__/readme-version.test.ts`** + **`__tests__/readme-contract.test.ts`** pin the claims in this file that rot silently: the version stamp against `package.json`, the key id, the route-example heading, and every `exports` subpath appearing under Public API.
@@ -859,7 +870,7 @@ published at `@certrev/cert-block/fixtures`).
 
 ## Version
 
-`1.2.1-canary.0`: see [CHANGELOG.md](./CHANGELOG.md) for the release history and the semver contract
+`1.3.0`: see [CHANGELOG.md](./CHANGELOG.md) for the release history and the semver contract
 (patch/minor never change the rendered cert output or break a compiling integration). Publishes
 **publicly** to npm as `@certrev/cert-block` (`publishConfig.access: public`) via GitHub Actions
 trusted publishing (OIDC); the internal `@certrev` GitHub-Packages channel mirrors it.

package/dist/builder/cert-review-card.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cert-review-card.d.ts","sourceRoot":"","sources":["../../src/builder/cert-review-card.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAG9B,OAAO,EAAE,KAAK,aAAa,EAAmB,MAAM,oCAAoC,CAAA;AAWxF,OAAO,KAAK,EAAE,qBAAqB,EAAuB,MAAM,uBAAuB,CAAA;AAmBvF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,iBAAiB,CAAA;AAEjD,MAAM,WAAW,mBAAoB,SAAQ,OAAO,CAAC,qBAAqB,CAAC;IAC1E;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;IAC3B;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE;QAChB,QAAQ,CAAC,OAAO,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,IAAI,CAAA;QACnD,QAAQ,CAAC,OAAO,CAAC,EAAE;YAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,IAAI,CAAA;KACjE,GAAG,IAAI,CAAA;IACR;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;CACpB;AAsCD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAe1F;AAoBD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,QAKjC,CAAA;AA6YJ,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,4BAiCxD;AAoFD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAA;IACtE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,uFAAuF;IACvF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACpE,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAC3B;AA6CD;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,YAAY,EAO5C,CAAA;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,YAAY,EA2BnD,CAAA;AAED,gGAAgG;AAChG,MAAM,WAAW,4BAA4B;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,OAAO,cAAc,CAAA;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAA;IACxC,4FAA4F;IAC5F,QAAQ,CAAC,yBAAyB,EAAE;QAAE,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAA;KAAE,CAAA;CACrE;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,EAAE,4BAKlC,CAAA;AAED;;;;;GAKG;AACH,MAAM,WAAW,iCAAiC;IACjD,SAAS,EAAE,OAAO,cAAc,CAAA;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,YAAY,EAAE,CAAA;IACtB;;;;OAIG;IACH,yBAAyB,EAAE;QAAE,cAAc,EAAE,OAAO,CAAA;KAAE,CAAA;CACtD;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,iCAOlC,CAAA"}
+{"version":3,"file":"cert-review-card.d.ts","sourceRoot":"","sources":["../../src/builder/cert-review-card.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAG9B,OAAO,EAAE,KAAK,aAAa,EAAmB,MAAM,oCAAoC,CAAA;AAYxF,OAAO,KAAK,EAAE,qBAAqB,EAAuB,MAAM,uBAAuB,CAAA;AA2BvF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,iBAAiB,CAAA;AAEjD,MAAM,WAAW,mBAAoB,SAAQ,OAAO,CAAC,qBAAqB,CAAC;IAC1E;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;IAC3B;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE;QAChB,QAAQ,CAAC,OAAO,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,IAAI,CAAA;QACnD,QAAQ,CAAC,OAAO,CAAC,EAAE;YAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,IAAI,CAAA;KACjE,GAAG,IAAI,CAAA;IACR;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;CACpB;AAsCD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAe1F;AAkCD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,QAKjC,CAAA;AAkdJ,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,4BAiCxD;AAoFD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAA;IACtE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,uFAAuF;IACvF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACpE,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAC3B;AA6CD;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,YAAY,EAO5C,CAAA;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,YAAY,EA2BnD,CAAA;AAED,gGAAgG;AAChG,MAAM,WAAW,4BAA4B;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,OAAO,cAAc,CAAA;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAA;IACxC,4FAA4F;IAC5F,QAAQ,CAAC,yBAAyB,EAAE;QAAE,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAA;KAAE,CAAA;CACrE;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,EAAE,4BAKlC,CAAA;AAED;;;;;GAKG;AACH,MAAM,WAAW,iCAAiC;IACjD,SAAS,EAAE,OAAO,cAAc,CAAA;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,YAAY,EAAE,CAAA;IACtB;;;;OAIG;IACH,yBAAyB,EAAE;QAAE,cAAc,EAAE,OAAO,CAAA;KAAE,CAAA;CACtD;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,iCAOlC,CAAA"}

package/dist/builder/cert-review-card.js

@@ -27,6 +27,7 @@ import { renderVerdict } from '../contract/kernel.js';
 import { getVerifiedDelivery, parseDesignPin, readVerifiedDelivery, } from '../verify/get-verified-delivery.js';
 import { CARD_READER_CSS } from './card-reader-css.js';
 import { BUILDER_CERT_CHROME_KEYS } from './cert-chrome-data.js';
+import { deliveredFaceDigest, deliveredFaceHtml, deliveredFaceMatches, faceHashesFor, showsWholeCard, } from './delivered-face.js';
 import { cardDeliveryRuntime } from './delivery-runtime.js';
 import { envelopeCardHtml, envelopeCardInput, isReaderFaceDef } from './envelope-face.js';
 import { pageHoldsServerHtml, pageRecordFor, SEED_ATTRIBUTE, seedFor, serializeFallback, serializeSeed, streamedRecordFor, subscribeStreamedRecords, watchStreamedRecords, withoutPhotos, } from './ssr-seed.js';
@@ -111,11 +112,23 @@ function suspendOn(key, start) {
         pending = start().finally(() => inflightReads.delete(key));
         inflightReads.set(key, pending);
     }
+    return suspendUntil(pending);
+}
+/** `use` where React has it (19), else the thrown promise (18). */
+function suspendUntil(pending) {
     const use = React.use;
     if (typeof use === 'function')
         return use(pending);
     throw pending;
 }
+/**
+ * 1.3.0: a delivered face's two digests, suspending once while WebCrypto computes them (`faceHashesFor` memoizes them
+ * by the face's content, so every later render of the same face, server or browser, reads them at once).
+ */
+function suspendOnFaceHashes(face) {
+    const memo = faceHashesFor(face);
+    return memo.settled ? memo.settled.hashes : suspendUntil(memo.pending);
+}
 /**
  * 1.2.0-canary.6: the reader sidebar card is a right float that the article's copy flows around, as it does on a
  * WordPress or Shopify page. On a Builder page the card sits in its own block, a flex item of the flex column that holds
@@ -186,8 +199,12 @@ function EnvelopeFace(props) {
         el.addEventListener('error', onError, true);
         return () => el.removeEventListener('error', onError, true);
     }, [onBrokenPhoto]);
-    return withSidebarFlow(props.reader, _jsx("div", { ref: ref, "data-certrev-cert-chrome": "", "data-certrev-delivery": "", "data-certrev-strings-version": CERT_STRINGS_VERSION, "data-certrev-def-version": props.defVersion, [SEED_ATTRIBUTE]: props.seed, ...(props.reader ? { 'data-certrev-face': 'reader', style: { display: 'flow-root' } } : {}), 
-        // biome-ignore lint/security/noDangerouslySetInnerHtml: renderCertBlock is the escaping-safe SSR string renderer
+    return withSidebarFlow(props.reader, _jsx("div", { ref: ref, "data-certrev-cert-chrome": "", "data-certrev-delivery": "", "data-certrev-strings-version": CERT_STRINGS_VERSION, "data-certrev-def-version": props.defVersion, [SEED_ATTRIBUTE]: props.seed, ...(props.reader
+            ? { 'data-certrev-face': 'reader', style: { display: 'flow-root' } }
+            : props.delivered
+                ? { 'data-certrev-face': 'delivered' }
+                : {}), 
+        // biome-ignore lint/security/noDangerouslySetInnerHtml: renderCertBlock is the escaping-safe SSR string renderer; a delivered face paints only when its bytes hash to the signed faceDigest
         dangerouslySetInnerHTML: { __html: props.html } }));
 }
 /** The reader face paints the author's avatar small (`.certrev-r-face.sm`); every other avatar is the expert's. */
@@ -223,6 +240,38 @@ function ReaderEnvelopeFace(props) {
         // faces (card-reader-css.ts), so the card asks the page's CSP for nothing.
         html: `<style data-certrev-reader-css>${CARD_READER_CSS}</style>${reader}`, defVersion: props.renderDef.v, seed: props.seed, onBrokenPhoto: onBrokenPhoto }));
 }
+/**
+ * 1.3.0: the delivered face this paint may use, or undefined (paint what 1.2.1 paints). Only for an unpinned card on a
+ * block that shows the whole card, a digest the verified content signs for the def's version, and a face whose UTF-8
+ * bytes hash to it (`delivered-face.ts`). Suspends once while WebCrypto hashes a face it has not seen.
+ */
+function deliveredFaceFor(payload, renderDef, face, props) {
+    if (!face || props.design || !showsWholeCard(props.part))
+        return undefined;
+    const digest = deliveredFaceDigest(payload.content, renderDef, face);
+    if (!digest)
+        return undefined;
+    return deliveredFaceMatches(suspendOnFaceHashes(face), digest) ? face : undefined;
+}
+/**
+ * 1.3.0: the delivered face, in the card's own wrapper (the same attributes as any envelope face, and
+ * `data-certrev-face="delivered"`): the server's stylesheet, then its markup. `seed` is the record that names it.
+ */
+function DeliveredEnvelopeFace(props) {
+    return _jsx(EnvelopeFace, { delivered: true, html: deliveredFaceHtml(props.face), defVersion: props.defVersion, seed: props.seed });
+}
+/**
+ * 1.3.0: what a card hydrating a seed that names a delivered face renders when the browser's own check of that face
+ * fails (no WebCrypto: an insecure context; or bytes that do not hash to the seed's digest). The server painted the
+ * delivered face there, and the browser must not render that markup, so this adopts the server's element as it stands
+ * (no attribute or innerHTML compared: `suppressHydrationWarning`; no children hydrated: `dangerouslySetInnerHTML`)
+ * and paints nothing of its own. The render right after hydration (at the browser's clock) is another component, so
+ * React replaces this element with the face 1.2.1 paints for the seed.
+ */
+function ServerFaceUntilHydrated() {
+    // biome-ignore lint/security/noDangerouslySetInnerHtml: an empty string; it only stops React hydrating the server's children
+    return _jsx("div", { suppressHydrationWarning: true, dangerouslySetInnerHTML: { __html: '' } });
+}
 /** Paint a verified payload with its def; null when the def and content give no face. */
 function paintEnvelope(payload, renderDef, props, seed) {
     if (!pinnedDefHolds(props.design, renderDef))
@@ -295,7 +344,17 @@ function paintRecord(record, props, context, judge) {
                 return null;
             }
         }
-        return paintEnvelope(record.seed.payload, record.seed.renderDef, props, record.raw);
+        // 1.3.0: a seed that names a delivered face repaints it only after the browser hashes it against the seed
+        // payload's own digest; otherwise the seed paints what 1.2.1 paints for it.
+        const { seed } = record;
+        const delivered = deliveredFaceFor(seed.payload, seed.renderDef, seed.face, props);
+        if (delivered && seed.renderDef) {
+            return _jsx(DeliveredEnvelopeFace, { face: delivered, defVersion: seed.renderDef.v, seed: record.raw });
+        }
+        // Hydrating (not `judge`) over the delivered face the server painted, which the browser could not confirm.
+        if (seed.face && !judge)
+            return _jsx(ServerFaceUntilHydrated, {});
+        return paintEnvelope(seed.payload, seed.renderDef, props, record.raw);
     }
     const html = record.fallback.face === 'options' ? fallbackFace(props) : null;
     return html === null ? (_jsx(NoFace, { record: record.raw })) : (_jsx(OptionsFace, { block: props.block, html: html, record: record.raw }));
@@ -433,6 +492,12 @@ function EnvelopeCertReviewCard(props) {
         signature: settled.signature,
         renderDef: settled.renderDef,
     });
+    // 1.3.0: the server-rendered face the Delivery API served beside the envelope, when its bytes hash to the digest the
+    // verified payload signs; the seed then carries it, so the browser can repaint (and re-check) the same face.
+    const delivered = deliveredFaceFor(seed.payload, seed.renderDef, settled.face, props);
+    if (delivered && seed.renderDef) {
+        return (_jsx(DeliveredEnvelopeFace, { face: delivered, defVersion: seed.renderDef.v, seed: serializeSeed({ ...seed, face: delivered }) }));
+    }
     return paintEnvelope(seed.payload, seed.renderDef, props, serializeSeed(seed));
 }
 export function CertReviewCard(props) {

package/dist/builder/cert-review-card.js.map

@@ -1 +1 @@
-{"version":3,"file":"cert-review-card.js","sourceRoot":"","sources":["../../src/builder/cert-review-card.tsx"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAC9B,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAChC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAA;AACxE,OAAO,EAAsB,eAAe,EAAE,MAAM,oCAAoC,CAAA;AACxF,OAAO,EAAE,oBAAoB,EAA2B,MAAM,6BAA6B,CAAA;AAC3F,OAAO,EAAoB,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACvE,OAAO,EAEN,mBAAmB,EACnB,cAAc,EACd,oBAAoB,GAEpB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAEtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzF,OAAO,EAGN,mBAAmB,EACnB,aAAa,EACb,cAAc,EACd,OAAO,EACP,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,aAAa,GACb,MAAM,eAAe,CAAA;AAEtB;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAA;AA4CjD;;;;;;;;;GASG;AACH,SAAS,IAAI,CAAC,KAAc;IAC3B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;AAC9C,CAAC;AAED,yFAAyF;AACzF,SAAS,YAAY,CAAC,KAAc;IACnC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,CAAA;AAChC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,IAAiE;IACzF,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACxC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACxC,OAAO,UAAU,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACpF,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,KAA2C,CAAA;IAClE,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACvD,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtF,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IAC/D,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;IACvC,IAAI,IAAI,KAAK,aAAa,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAA;IACzE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAA;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,EAAqC,CAAA;AAClE,SAAS,SAAS,CAAC,GAAW,EAAE,KAAsC;IACrE,IAAI,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO,GAAG,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;QAC1D,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IAChC,CAAC;IACD,MAAM,GAAG,GAAI,KAAsD,CAAC,GAAG,CAAA;IACvE,IAAI,OAAO,GAAG,KAAK,UAAU;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC,CAAA;IAClD,MAAM,OAAO,CAAA;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,wBAAwB,GACpC,wCAAwC;IACxC,wIAAwI;IACxI,oIAAoI;IACpI,oIAAoI;IACpI,GAAG,CAAA;AAEJ,mHAAmH;AACnH,SAAS,eAAe,CAAC,MAA2B,EAAE,IAAwB;IAC7E,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,OAAO,CACN,8BACE,IAAI,EAEL,6CAAiC,EAAE,EAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,GAAI,IACnG,CACH,CAAA;AACF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,YAAY,CAAC,KAQrB;IACA,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAiB,IAAI,CAAC,CAAA;IAC9C,MAAM,EAAE,aAAa,EAAE,GAAG,KAAK,CAAA;IAC/B,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACpB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAA;QACtB,IAAI,CAAC,EAAE;YAAE,OAAM;QACf,MAAM,OAAO,GAAG,CAAC,CAAa,EAAE,EAAE;YACjC,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;YACtC,IAAI,MAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,UAAU,CAAC,MAAM,CAAC,CAAA;QACtD,CAAC,CAAA;QACD,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACrC,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACtD,CAAC,EAAE,EAAE,CAAC,CAAA;IACN,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACpB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAA;QACtB,IAAI,CAAC,EAAE,IAAI,CAAC,aAAa;YAAE,OAAM;QACjC,iGAAiG;QACjG,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC;YAC5E,IAAI,GAAG,YAAY,gBAAgB,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY,KAAK,CAAC;gBAAE,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;QAC/G,CAAC;QACD,2EAA2E;QAC3E,MAAM,OAAO,GAAG,CAAC,CAAQ,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAA;YACpB,IAAI,GAAG,YAAY,gBAAgB,IAAI,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAChG,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;YAChC,CAAC;QACF,CAAC,CAAA;QACD,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;QAC3C,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;IAC5D,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAA;IACnB,OAAO,eAAe,CACrB,KAAK,CAAC,MAAM,EACZ,cACC,GAAG,EAAE,GAAG,8BACiB,EAAE,2BAGL,EAAE,kCACM,oBAAoB,8BACxB,KAAK,CAAC,UAAU,EACpC,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,IAAI,KAC9B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,iHAAiH;QACjH,uBAAuB,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,GAC9C,CACF,CAAA;AACF,CAAC;AAID,mHAAmH;AACnH,SAAS,WAAW,CAAC,GAAqB;IACzC,OAAO,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAA;AACzE,CAAC;AAaD;;;GAGG;AACH,SAAS,cAAc,CAAC,MAA6B,EAAE,SAAqC;IAC3F,OAAO,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,SAAS,EAAE,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,CAAA;AAClF,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,KAK3B;IACA,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAyB,EAAE,CAAC,CAAA;IACtE,MAAM,aAAa,GAAG,KAAK,CAAC,WAAW,CACtC,CAAC,MAAmB,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAC5F,EAAE,CACF,CAAA;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAA;IACxF,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE;QACjE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,MAAM,EAAE,OAAO,CAAC,MAAM;KACtB,CAAC,CAAA;IACF,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,OAAO,CACN,KAAC,YAAY,IACZ,MAAM;QACN,oGAAoG;QACpG,2EAA2E;QAC3E,IAAI,EAAE,kCAAkC,eAAe,WAAW,MAAM,EAAE,EAC1E,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,EAC7B,IAAI,EAAE,KAAK,CAAC,IAAI,EAChB,aAAa,EAAE,aAAa,GAC3B,CACF,CAAA;AACF,CAAC;AAED,yFAAyF;AACzF,SAAS,aAAa,CACrB,OAAoB,EACpB,SAAqC,EACrC,KAAwB,EACxB,IAAY;IAEZ,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC;QAAE,OAAO,IAAI,CAAA;IACzD,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACtD,kHAAkH;IAClH,iGAAiG;IACjG,IAAI,eAAe,CAAC,SAAS,CAAC,IAAI,SAAS,EAAE,CAAC;QAC7C,qGAAqG;QACrG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;YAChH,OAAO,IAAI,CAAA;QACZ,OAAO,KAAC,kBAAkB,IAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,GAAI,CAAA;IAC/F,CAAC;IACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IACnG,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,OAAO,KAAC,YAAY,IAAC,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,GAAI,CAAA;AAC1F,CAAC;AAED,MAAM,gBAAgB,GAAsB,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;AAE7E;;;;;GAKG;AACH,SAAS,YAAY,CAAC,KAAwB;IAC7C,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IACvB,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,EAAE,MAAM,CAAA;IACtC,MAAM,IAAI,GACT,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;QACtE,CAAC,CAAC,KAAK,CAAC,IAAI;QACZ,CAAC,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC;YAChE,CAAC,CAAE,MAAwB;YAC3B,CAAC,CAAC,SAAS,CAAA;IACd,OAAO,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;AACpC,CAAC;AAED,0GAA0G;AAC1G,SAAS,WAAW,CAAC,KAA+F;IACnH,OAAO,CACN,0CAC0B,EAAE,kCAIG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,8BAC5C,OAAO,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KACxG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC1E,iHAAiH;QACjH,uBAAuB,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,GAC9C,CACF,CAAA;AACF,CAAC;AAED,iGAAiG;AACjG,SAAS,MAAM,CAAC,KAAkC;IACjD,OAAO,cAAK,MAAM,QAAO,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,MAAM,GAAM,CAAA;AAC9D,CAAC;AAED,iHAAiH;AACjH,SAAS,qBAAqB,CAAC,KAAwB,EAAE,WAAoB;IAC5E,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACrD,MAAM,IAAI,GAAiB,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAC7D,MAAM,MAAM,GAAG,iBAAiB,CAAC;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,IAAI;KACJ,CAAC,CAAA;IACF,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,KAAC,MAAM,IAAC,MAAM,EAAE,MAAM,GAAI,CAAC,CAAC,CAAC,KAAC,WAAW,IAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,GAAI,CAAA;AACpH,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CACnB,MAAkB,EAClB,KAAwB,EACxB,OAA4C,EAC5C,KAAc;IAEd,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;QACtB,IAAI,KAAK,EAAE,CAAC;YACX,IAAI,CAAC;gBACJ,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAA;YACnF,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,IAAI,CAAA;YACZ,CAAC;QACF,CAAC;QACD,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAA;IACpF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC5E,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CACtB,KAAC,MAAM,IAAC,MAAM,EAAE,MAAM,CAAC,GAAG,GAAI,CAC9B,CAAC,CAAC,CAAC,CACH,KAAC,WAAW,IAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,GAAI,CACnE,CAAA;AACF,CAAC;AAED,6GAA6G;AAC7G,SAAS,eAAe,CAAC,KAAwB;IAChD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;IAChC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAC,WAAW,IAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,GAAI,CAAA;AAC9E,CAAC;AAED,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,SAAkB,CAAA;AAE9C;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,KAAwB;IACnD,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAA;IAChC,+GAA+G;IAC/G,oBAAoB,EAAE,CAAA;IACtB,MAAM,MAAM,GAAG,KAAK,CAAC,oBAAoB,CACxC,wBAAwB,EACxB,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,EACtE,aAAa,CACb,CAAA;IACD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACrC,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,eAAe,CAAC,KAAK,CAAC,CAAA;IACpD,MAAM,OAAO,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAA;IAC9F,OAAO,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;AACjD,CAAC;AAED,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,GAAG,EAAE,GAAE,CAAC,CAAA;AAErC;;;;;;;GAOG;AACH,SAAS,YAAY;IACpB,OAAO,KAAK,CAAC,oBAAoB,CAChC,cAAc,EACd,GAAG,EAAE,CAAC,KAAK,EACX,GAAG,EAAE,CAAC,IAAI,CACV,CAAA;AACF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,SAAS,sBAAsB,CAAC,KAAwB;IACvD,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAA;IAChC,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;IAChC,uFAAuF;IACvF,MAAM,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IACjD,mGAAmG;IACnG,MAAM,OAAO,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAA;IAC9F,mHAAmH;IACnH,uEAAuE;IACvE,MAAM,QAAQ,GACb,OAAO,QAAQ,KAAK,WAAW;QAC9B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;IACrF,MAAM,SAAS,GAAG,OAAO,QAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,mBAAmB,EAAE,CAAC,CAAA;IACpH,mHAAmH;IACnH,mHAAmH;IACnH,iBAAiB;IACjB,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CACpC,GAAG,EAAE,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,CACjH,CAAA;IACD,IAAI,YAAY;QAAE,OAAO,KAAC,kBAAkB,OAAK,KAAK,GAAI,CAAA;IAC1D,IAAI,SAAS,EAAE,CAAC;QACf,IAAI,QAAQ;YAAE,OAAO,WAAW,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC,CAAA;QACtE,IAAI,aAAa;YAAE,OAAO,IAAI,CAAA;QAC9B,IAAI,CAAC,KAAK,CAAC,UAAU;YAAE,OAAO,eAAe,CAAC,KAAK,CAAC,CAAA;IACrD,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;IACxB,MAAM,IAAI,GAAG;QACZ,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO;QACP,KAAK,EAAE,EAAE,CAAC,KAAK;QACf,MAAM;QACN,UAAU,EAAE,EAAE,CAAC,UAAU;QACzB,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE;QACzB,SAAS,EAAE,EAAE,CAAC,SAAS;KACvB,CAAA;IACD,MAAM,GAAG,GAAG,MAAM;QACjB,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,UAAU,WAAW,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE;QACvF,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,UAAU,EAAE,CAAA;IACzC,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7F,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,KAAK,IAAI,CAAC,CAAA;IAC5G,kHAAkH;IAClH,kGAAkG;IAClG,MAAM,IAAI,GAAG,OAAO,CAAC;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO;QAChC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;KAC5B,CAAC,CAAA;IACF,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;AAC/E,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAA0B;IACxD,0FAA0F;IAC1F,+FAA+F;IAC/F,sDAAsD;IACtD,6GAA6G;IAC7G,gHAAgH;IAChH,kHAAkH;IAClH,6FAA6F;IAC7F,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,cAAc,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAA;IAC9E,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACrC,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;QACvD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAA;QACpC,OAAO,CACN,KAAC,QAAQ,IAAC,QAAQ,EAAE,IAAI,YACvB,KAAC,sBAAsB,IACtB,OAAO,EAAE,MAAM,CAAC,OAAO,EACvB,UAAU,EAAE,OAAO,EACnB,IAAI,EAAE,KAAK,CAAC,IAAI,EAChB,IAAI,EAAE,KAAK,CAAC,IAAI,EAChB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,KAAK,EACZ,UAAU,EAAE,KAAK,CAAC,UAAU,KAAK,IAAI,GACpC,GACQ,CACX,CAAA;IACF,CAAC;IACD,IAAI,MAAM;QAAE,OAAO,IAAI,CAAA;IAEvB,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC7C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA,CAAC,iDAAiD;IAChF,OAAO,KAAC,WAAW,IAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,GAAI,CAAA;AACjD,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,KAA0B,EAAE,MAAiC;IACrF,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IACvC,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAE5C,2FAA2F;IAC3F,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,EAAE,eAAe,KAAK,KAAK,CAAA;IACzD,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAEhF,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,EAAE,MAAM,CAAA;IACtC,MAAM,KAAK,GAA4C,MAAM;QAC5D,CAAC,CAAC;YACA,WAAW,EAAE,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC;YAC7C,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC;YACrC,YAAY,EAAE,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC;YAC/C,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,QAAQ,CAA+C;YACrF,uEAAuE;YACvE,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC;YACnC,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC;SACvC;QACF,CAAC,CAAC,SAAS,CAAA;IAEZ,OAAO,eAAe,CAAC;QACtB,wFAAwF;QACxF,sFAAsF;QACtF,EAAE;QACF,0FAA0F;QAC1F,yFAAyF;QACzF,sFAAsF;QACtF,+CAA+C;QAC/C,EAAE;QACF,yFAAyF;QACzF,sFAAsF;QACtF,yFAAyF;QACzF,wFAAwF;QACxF,oFAAoF;QACpF,wFAAwF;QACxF,8EAA8E;QAC9E,EAAE;QACF,uFAAuF;QACvF,wFAAwF;QACxF,yFAAyF;QACzF,uFAAuF;QACvF,qEAAqE;QACrE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,MAAM,IAAI,QAAQ;QACtC,KAAK;QACL,yEAAyE;QACzE,uFAAuF;QACvF,kEAAkE;QAClE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,KAAK,EAAE;YACN,UAAU,EAAE,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,WAAW;YACzD,WAAW,EAAE,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC;YAC5C,YAAY;YACZ,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,EAAE;YACtC,oBAAoB,EAAE,QAAQ,EAAE,UAAU,IAAI,EAAE;YAChD,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;YACpC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YACtB,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;YAC5B,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;YAC1C,cAAc,EAAE,SAAS;YACzB,kFAAkF;YAClF,oFAAoF;YACpF,mFAAmF;YACnF,+EAA+E;YAC/E,gFAAgF;YAChF,iFAAiF;YACjF,sCAAsC;YACtC,eAAe,EAAE,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;SAClE;KACD,CAAC,CAAA;AACH,CAAC;AAgCD,0FAA0F;AAC1F,MAAM,eAAe,GAA4E;IAChG,kBAAkB,EAAE,QAAQ;IAC5B,sBAAsB,EAAE,QAAQ;IAChC,WAAW,EAAE,QAAQ;IACrB,YAAY,EAAE,QAAQ;IACtB,GAAG,EAAE,UAAU;IACf,UAAU,EAAE,UAAU;IACtB,IAAI,EAAE,UAAU;IAChB,eAAe,EAAE,QAAQ;IACzB,SAAS,EAAE,QAAQ;IACnB,aAAa,EAAE,QAAQ;IACvB,kBAAkB,EAAE,QAAQ;IAC5B,SAAS,EAAE,QAAQ;IACnB,WAAW,EAAE,QAAQ;IACrB,iBAAiB,EAAE,QAAQ;IAC3B,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,QAAQ;IACrB,OAAO,EAAE,QAAQ;IACjB,SAAS,EAAE,QAAQ;IACnB,cAAc,EAAE,QAAQ;IACxB,QAAQ,EAAE,QAAQ;CAClB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,sBAAsB,GAAuE;IAClG,eAAe,EACd,kPAAkP;IACnP,SAAS,EACR,8IAA8I;IAC/I,QAAQ,EACP,mUAAmU;CACpU,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAA4B,wBAAwB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3F,IAAI;IACJ,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;IAC3B,GAAG,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,wFAAwF;IACxF,yFAAyF;IACzF,QAAQ,EAAE,IAAI;CACd,CAAC,CAAC,CAAA;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA4B;IACxD;QACC,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,QAAQ;QACd,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,uCAAuC;QACnD,YAAY,EAAE,SAAS;QACvB,IAAI,EAAE;YACL,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE;YACtC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;YACpC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE;SACxC;KACD;IACD;QACC,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,QAAQ;QACd,YAAY,EAAE,aAAa;QAC3B,yFAAyF;QACzF,wEAAwE;QACxE,UAAU,EAAE,wDAAwD;QACpE,YAAY,EAAE,MAAM;QACpB,IAAI,EAAE;YACL,EAAE,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,EAAE;YAChD,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE;YACzC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE;SACrC;KACD;CACD,CAAA;AAWD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAiC;IACjE,IAAI,EAAE,mBAAmB;IACzB,SAAS,EAAE,cAAc;IACzB,MAAM,EAAE,CAAC,GAAG,gBAAgB,EAAE,GAAG,WAAW,CAAC;IAC7C,yBAAyB,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE;CACnD,CAAA;AAqBD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsC;IACtE,IAAI,EAAE,mBAAmB;IACzB,SAAS,EAAE,cAAc;IACzB,WAAW,EACV,4HAA4H;IAC7H,MAAM,EAAE,CAAC,GAAG,gBAAgB,EAAE,GAAG,WAAW,CAAC;IAC7C,yBAAyB,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE;CACnD,CAAA"}
+{"version":3,"file":"cert-review-card.js","sourceRoot":"","sources":["../../src/builder/cert-review-card.tsx"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAC9B,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAChC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAA;AACxE,OAAO,EAAsB,eAAe,EAAE,MAAM,oCAAoC,CAAA;AACxF,OAAO,EAAE,oBAAoB,EAA2B,MAAM,6BAA6B,CAAA;AAC3F,OAAO,EAAoB,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACvE,OAAO,EAGN,mBAAmB,EACnB,cAAc,EACd,oBAAoB,GAEpB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAEtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,EAEN,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,EACb,cAAc,GACd,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzF,OAAO,EAGN,mBAAmB,EACnB,aAAa,EACb,cAAc,EACd,OAAO,EACP,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,aAAa,GACb,MAAM,eAAe,CAAA;AAEtB;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAA;AA4CjD;;;;;;;;;GASG;AACH,SAAS,IAAI,CAAC,KAAc;IAC3B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;AAC9C,CAAC;AAED,yFAAyF;AACzF,SAAS,YAAY,CAAC,KAAc;IACnC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,CAAA;AAChC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,IAAiE;IACzF,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACxC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACxC,OAAO,UAAU,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACpF,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,KAA2C,CAAA;IAClE,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACvD,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtF,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IAC/D,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;IACvC,IAAI,IAAI,KAAK,aAAa,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAA;IACzE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAA;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,EAAqC,CAAA;AAClE,SAAS,SAAS,CAAC,GAAW,EAAE,KAAsC;IACrE,IAAI,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO,GAAG,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;QAC1D,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IAChC,CAAC;IACD,OAAO,YAAY,CAAC,OAAO,CAAC,CAAA;AAC7B,CAAC;AAED,mEAAmE;AACnE,SAAS,YAAY,CAAI,OAAmB;IAC3C,MAAM,GAAG,GAAI,KAAsD,CAAC,GAAG,CAAA;IACvE,IAAI,OAAO,GAAG,KAAK,UAAU;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC,CAAA;IAClD,MAAM,OAAO,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,IAAmB;IAC/C,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAChC,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;AACvE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,wBAAwB,GACpC,wCAAwC;IACxC,wIAAwI;IACxI,oIAAoI;IACpI,oIAAoI;IACpI,GAAG,CAAA;AAEJ,mHAAmH;AACnH,SAAS,eAAe,CAAC,MAA2B,EAAE,IAAwB;IAC7E,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,OAAO,CACN,8BACE,IAAI,EAEL,6CAAiC,EAAE,EAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,GAAI,IACnG,CACH,CAAA;AACF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,YAAY,CAAC,KAUrB;IACA,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAiB,IAAI,CAAC,CAAA;IAC9C,MAAM,EAAE,aAAa,EAAE,GAAG,KAAK,CAAA;IAC/B,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACpB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAA;QACtB,IAAI,CAAC,EAAE;YAAE,OAAM;QACf,MAAM,OAAO,GAAG,CAAC,CAAa,EAAE,EAAE;YACjC,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;YACtC,IAAI,MAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,UAAU,CAAC,MAAM,CAAC,CAAA;QACtD,CAAC,CAAA;QACD,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACrC,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACtD,CAAC,EAAE,EAAE,CAAC,CAAA;IACN,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACpB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAA;QACtB,IAAI,CAAC,EAAE,IAAI,CAAC,aAAa;YAAE,OAAM;QACjC,iGAAiG;QACjG,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC;YAC5E,IAAI,GAAG,YAAY,gBAAgB,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY,KAAK,CAAC;gBAAE,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;QAC/G,CAAC;QACD,2EAA2E;QAC3E,MAAM,OAAO,GAAG,CAAC,CAAQ,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAA;YACpB,IAAI,GAAG,YAAY,gBAAgB,IAAI,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAChG,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;YAChC,CAAC;QACF,CAAC,CAAA;QACD,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;QAC3C,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;IAC5D,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAA;IACnB,OAAO,eAAe,CACrB,KAAK,CAAC,MAAM,EACZ,cACC,GAAG,EAAE,GAAG,8BACiB,EAAE,2BAGL,EAAE,kCACM,oBAAoB,8BACxB,KAAK,CAAC,UAAU,EACpC,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,IAAI,KAC9B,CAAC,KAAK,CAAC,MAAM;YAChB,CAAC,CAAC,EAAE,mBAAmB,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE;YACpE,CAAC,CAAC,KAAK,CAAC,SAAS;gBAChB,CAAC,CAAC,EAAE,mBAAmB,EAAE,WAAW,EAAE;gBACtC,CAAC,CAAC,EAAE,CAAC;QACP,4LAA4L;QAC5L,uBAAuB,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,GAC9C,CACF,CAAA;AACF,CAAC;AAID,mHAAmH;AACnH,SAAS,WAAW,CAAC,GAAqB;IACzC,OAAO,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAA;AACzE,CAAC;AAaD;;;GAGG;AACH,SAAS,cAAc,CAAC,MAA6B,EAAE,SAAqC;IAC3F,OAAO,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,SAAS,EAAE,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,CAAA;AAClF,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,KAK3B;IACA,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAyB,EAAE,CAAC,CAAA;IACtE,MAAM,aAAa,GAAG,KAAK,CAAC,WAAW,CACtC,CAAC,MAAmB,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAC5F,EAAE,CACF,CAAA;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAA;IACxF,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE;QACjE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,MAAM,EAAE,OAAO,CAAC,MAAM;KACtB,CAAC,CAAA;IACF,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,OAAO,CACN,KAAC,YAAY,IACZ,MAAM;QACN,oGAAoG;QACpG,2EAA2E;QAC3E,IAAI,EAAE,kCAAkC,eAAe,WAAW,MAAM,EAAE,EAC1E,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,EAC7B,IAAI,EAAE,KAAK,CAAC,IAAI,EAChB,aAAa,EAAE,aAAa,GAC3B,CACF,CAAA;AACF,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CACxB,OAAoB,EACpB,SAAqC,EACrC,IAA+B,EAC/B,KAAwB;IAExB,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IAC1E,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;IACpE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC7B,OAAO,oBAAoB,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AAClF,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,KAI9B;IACA,OAAO,KAAC,YAAY,IAAC,SAAS,QAAC,IAAI,EAAE,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,GAAI,CAAA;AACvH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,uBAAuB;IAC/B,6HAA6H;IAC7H,OAAO,cAAK,wBAAwB,QAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAI,CAAA;AACjF,CAAC;AAED,yFAAyF;AACzF,SAAS,aAAa,CACrB,OAAoB,EACpB,SAAqC,EACrC,KAAwB,EACxB,IAAY;IAEZ,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC;QAAE,OAAO,IAAI,CAAA;IACzD,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACtD,kHAAkH;IAClH,iGAAiG;IACjG,IAAI,eAAe,CAAC,SAAS,CAAC,IAAI,SAAS,EAAE,CAAC;QAC7C,qGAAqG;QACrG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;YAChH,OAAO,IAAI,CAAA;QACZ,OAAO,KAAC,kBAAkB,IAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,GAAI,CAAA;IAC/F,CAAC;IACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IACnG,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,OAAO,KAAC,YAAY,IAAC,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,GAAI,CAAA;AAC1F,CAAC;AAED,MAAM,gBAAgB,GAAsB,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;AAE7E;;;;;GAKG;AACH,SAAS,YAAY,CAAC,KAAwB;IAC7C,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IACvB,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,EAAE,MAAM,CAAA;IACtC,MAAM,IAAI,GACT,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;QACtE,CAAC,CAAC,KAAK,CAAC,IAAI;QACZ,CAAC,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC;YAChE,CAAC,CAAE,MAAwB;YAC3B,CAAC,CAAC,SAAS,CAAA;IACd,OAAO,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;AACpC,CAAC;AAED,0GAA0G;AAC1G,SAAS,WAAW,CAAC,KAA+F;IACnH,OAAO,CACN,0CAC0B,EAAE,kCAIG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,8BAC5C,OAAO,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KACxG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC1E,iHAAiH;QACjH,uBAAuB,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,GAC9C,CACF,CAAA;AACF,CAAC;AAED,iGAAiG;AACjG,SAAS,MAAM,CAAC,KAAkC;IACjD,OAAO,cAAK,MAAM,QAAO,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,MAAM,GAAM,CAAA;AAC9D,CAAC;AAED,iHAAiH;AACjH,SAAS,qBAAqB,CAAC,KAAwB,EAAE,WAAoB;IAC5E,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACrD,MAAM,IAAI,GAAiB,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAC7D,MAAM,MAAM,GAAG,iBAAiB,CAAC;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,IAAI;KACJ,CAAC,CAAA;IACF,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,KAAC,MAAM,IAAC,MAAM,EAAE,MAAM,GAAI,CAAC,CAAC,CAAC,KAAC,WAAW,IAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,GAAI,CAAA;AACpH,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CACnB,MAAkB,EAClB,KAAwB,EACxB,OAA4C,EAC5C,KAAc;IAEd,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;QACtB,IAAI,KAAK,EAAE,CAAC;YACX,IAAI,CAAC;gBACJ,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAA;YACnF,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,IAAI,CAAA;YACZ,CAAC;QACF,CAAC;QACD,0GAA0G;QAC1G,4EAA4E;QAC5E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAA;QACvB,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAClF,IAAI,SAAS,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACjC,OAAO,KAAC,qBAAqB,IAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,GAAI,CAAA;QAClG,CAAC;QACD,2GAA2G;QAC3G,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,KAAC,uBAAuB,KAAG,CAAA;QAC3D,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAA;IACtE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC5E,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CACtB,KAAC,MAAM,IAAC,MAAM,EAAE,MAAM,CAAC,GAAG,GAAI,CAC9B,CAAC,CAAC,CAAC,CACH,KAAC,WAAW,IAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,GAAI,CACnE,CAAA;AACF,CAAC;AAED,6GAA6G;AAC7G,SAAS,eAAe,CAAC,KAAwB;IAChD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;IAChC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAC,WAAW,IAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,GAAI,CAAA;AAC9E,CAAC;AAED,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,SAAkB,CAAA;AAE9C;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,KAAwB;IACnD,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAA;IAChC,+GAA+G;IAC/G,oBAAoB,EAAE,CAAA;IACtB,MAAM,MAAM,GAAG,KAAK,CAAC,oBAAoB,CACxC,wBAAwB,EACxB,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,EACtE,aAAa,CACb,CAAA;IACD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACrC,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,eAAe,CAAC,KAAK,CAAC,CAAA;IACpD,MAAM,OAAO,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAA;IAC9F,OAAO,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;AACjD,CAAC;AAED,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,GAAG,EAAE,GAAE,CAAC,CAAA;AAErC;;;;;;;GAOG;AACH,SAAS,YAAY;IACpB,OAAO,KAAK,CAAC,oBAAoB,CAChC,cAAc,EACd,GAAG,EAAE,CAAC,KAAK,EACX,GAAG,EAAE,CAAC,IAAI,CACV,CAAA;AACF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,SAAS,sBAAsB,CAAC,KAAwB;IACvD,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAA;IAChC,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;IAChC,uFAAuF;IACvF,MAAM,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IACjD,mGAAmG;IACnG,MAAM,OAAO,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAA;IAC9F,mHAAmH;IACnH,uEAAuE;IACvE,MAAM,QAAQ,GACb,OAAO,QAAQ,KAAK,WAAW;QAC9B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;IACrF,MAAM,SAAS,GAAG,OAAO,QAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,mBAAmB,EAAE,CAAC,CAAA;IACpH,mHAAmH;IACnH,mHAAmH;IACnH,iBAAiB;IACjB,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CACpC,GAAG,EAAE,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,CACjH,CAAA;IACD,IAAI,YAAY;QAAE,OAAO,KAAC,kBAAkB,OAAK,KAAK,GAAI,CAAA;IAC1D,IAAI,SAAS,EAAE,CAAC;QACf,IAAI,QAAQ;YAAE,OAAO,WAAW,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC,CAAA;QACtE,IAAI,aAAa;YAAE,OAAO,IAAI,CAAA;QAC9B,IAAI,CAAC,KAAK,CAAC,UAAU;YAAE,OAAO,eAAe,CAAC,KAAK,CAAC,CAAA;IACrD,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;IACxB,MAAM,IAAI,GAAG;QACZ,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO;QACP,KAAK,EAAE,EAAE,CAAC,KAAK;QACf,MAAM;QACN,UAAU,EAAE,EAAE,CAAC,UAAU;QACzB,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE;QACzB,SAAS,EAAE,EAAE,CAAC,SAAS;KACvB,CAAA;IACD,MAAM,GAAG,GAAG,MAAM;QACjB,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,UAAU,WAAW,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE;QACvF,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,UAAU,EAAE,CAAA;IACzC,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7F,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,KAAK,IAAI,CAAC,CAAA;IAC5G,kHAAkH;IAClH,kGAAkG;IAClG,MAAM,IAAI,GAAG,OAAO,CAAC;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO;QAChC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;KAC5B,CAAC,CAAA;IACF,qHAAqH;IACrH,6GAA6G;IAC7G,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACrF,IAAI,SAAS,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACjC,OAAO,CACN,KAAC,qBAAqB,IACrB,IAAI,EAAE,SAAS,EACf,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAC5B,IAAI,EAAE,aAAa,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,GAChD,CACF,CAAA;IACF,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;AAC/E,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAA0B;IACxD,0FAA0F;IAC1F,+FAA+F;IAC/F,sDAAsD;IACtD,6GAA6G;IAC7G,gHAAgH;IAChH,kHAAkH;IAClH,6FAA6F;IAC7F,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,cAAc,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAA;IAC9E,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACrC,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;QACvD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAA;QACpC,OAAO,CACN,KAAC,QAAQ,IAAC,QAAQ,EAAE,IAAI,YACvB,KAAC,sBAAsB,IACtB,OAAO,EAAE,MAAM,CAAC,OAAO,EACvB,UAAU,EAAE,OAAO,EACnB,IAAI,EAAE,KAAK,CAAC,IAAI,EAChB,IAAI,EAAE,KAAK,CAAC,IAAI,EAChB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,KAAK,EACZ,UAAU,EAAE,KAAK,CAAC,UAAU,KAAK,IAAI,GACpC,GACQ,CACX,CAAA;IACF,CAAC;IACD,IAAI,MAAM;QAAE,OAAO,IAAI,CAAA;IAEvB,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC7C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA,CAAC,iDAAiD;IAChF,OAAO,KAAC,WAAW,IAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,GAAI,CAAA;AACjD,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,KAA0B,EAAE,MAAiC;IACrF,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IACvC,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAE5C,2FAA2F;IAC3F,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,EAAE,eAAe,KAAK,KAAK,CAAA;IACzD,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAEhF,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,EAAE,MAAM,CAAA;IACtC,MAAM,KAAK,GAA4C,MAAM;QAC5D,CAAC,CAAC;YACA,WAAW,EAAE,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC;YAC7C,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC;YACrC,YAAY,EAAE,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC;YAC/C,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,QAAQ,CAA+C;YACrF,uEAAuE;YACvE,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC;YACnC,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC;SACvC;QACF,CAAC,CAAC,SAAS,CAAA;IAEZ,OAAO,eAAe,CAAC;QACtB,wFAAwF;QACxF,sFAAsF;QACtF,EAAE;QACF,0FAA0F;QAC1F,yFAAyF;QACzF,sFAAsF;QACtF,+CAA+C;QAC/C,EAAE;QACF,yFAAyF;QACzF,sFAAsF;QACtF,yFAAyF;QACzF,wFAAwF;QACxF,oFAAoF;QACpF,wFAAwF;QACxF,8EAA8E;QAC9E,EAAE;QACF,uFAAuF;QACvF,wFAAwF;QACxF,yFAAyF;QACzF,uFAAuF;QACvF,qEAAqE;QACrE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,MAAM,IAAI,QAAQ;QACtC,KAAK;QACL,yEAAyE;QACzE,uFAAuF;QACvF,kEAAkE;QAClE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,KAAK,EAAE;YACN,UAAU,EAAE,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,WAAW;YACzD,WAAW,EAAE,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC;YAC5C,YAAY;YACZ,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,EAAE;YACtC,oBAAoB,EAAE,QAAQ,EAAE,UAAU,IAAI,EAAE;YAChD,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;YACpC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YACtB,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;YAC5B,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;YAC1C,cAAc,EAAE,SAAS;YACzB,kFAAkF;YAClF,oFAAoF;YACpF,mFAAmF;YACnF,+EAA+E;YAC/E,gFAAgF;YAChF,iFAAiF;YACjF,sCAAsC;YACtC,eAAe,EAAE,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;SAClE;KACD,CAAC,CAAA;AACH,CAAC;AAgCD,0FAA0F;AAC1F,MAAM,eAAe,GAA4E;IAChG,kBAAkB,EAAE,QAAQ;IAC5B,sBAAsB,EAAE,QAAQ;IAChC,WAAW,EAAE,QAAQ;IACrB,YAAY,EAAE,QAAQ;IACtB,GAAG,EAAE,UAAU;IACf,UAAU,EAAE,UAAU;IACtB,IAAI,EAAE,UAAU;IAChB,eAAe,EAAE,QAAQ;IACzB,SAAS,EAAE,QAAQ;IACnB,aAAa,EAAE,QAAQ;IACvB,kBAAkB,EAAE,QAAQ;IAC5B,SAAS,EAAE,QAAQ;IACnB,WAAW,EAAE,QAAQ;IACrB,iBAAiB,EAAE,QAAQ;IAC3B,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,QAAQ;IACrB,OAAO,EAAE,QAAQ;IACjB,SAAS,EAAE,QAAQ;IACnB,cAAc,EAAE,QAAQ;IACxB,QAAQ,EAAE,QAAQ;CAClB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,sBAAsB,GAAuE;IAClG,eAAe,EACd,kPAAkP;IACnP,SAAS,EACR,8IAA8I;IAC/I,QAAQ,EACP,mUAAmU;CACpU,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAA4B,wBAAwB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3F,IAAI;IACJ,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;IAC3B,GAAG,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,wFAAwF;IACxF,yFAAyF;IACzF,QAAQ,EAAE,IAAI;CACd,CAAC,CAAC,CAAA;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA4B;IACxD;QACC,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,QAAQ;QACd,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,uCAAuC;QACnD,YAAY,EAAE,SAAS;QACvB,IAAI,EAAE;YACL,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE;YACtC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;YACpC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE;SACxC;KACD;IACD;QACC,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,QAAQ;QACd,YAAY,EAAE,aAAa;QAC3B,yFAAyF;QACzF,wEAAwE;QACxE,UAAU,EAAE,wDAAwD;QACpE,YAAY,EAAE,MAAM;QACpB,IAAI,EAAE;YACL,EAAE,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,EAAE;YAChD,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE;YACzC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE;SACrC;KACD;CACD,CAAA;AAWD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAiC;IACjE,IAAI,EAAE,mBAAmB;IACzB,SAAS,EAAE,cAAc;IACzB,MAAM,EAAE,CAAC,GAAG,gBAAgB,EAAE,GAAG,WAAW,CAAC;IAC7C,yBAAyB,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE;CACnD,CAAA;AAqBD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsC;IACtE,IAAI,EAAE,mBAAmB;IACzB,SAAS,EAAE,cAAc;IACzB,WAAW,EACV,4HAA4H;IAC7H,MAAM,EAAE,CAAC,GAAG,gBAAgB,EAAE,GAAG,WAAW,CAAC;IAC7C,yBAAyB,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE;CACnD,CAAA"}

package/dist/builder/delivered-face.d.ts

@@ -0,0 +1,74 @@
+/**
+ * ─────────────────────────────────────────────────────────────────────────────
+ * The delivered face gate: when the Builder card may paint the server's markup (1.3.0)
+ * ─────────────────────────────────────────────────────────────────────────────
+ *
+ * The Delivery API may serve a server-rendered face (`face: { html, css }`) beside the signed artifact. That sibling
+ * is UNSIGNED. What binds it is the signed `payload.content.faceDigest` (cert-contract 0.6.0): the lowercase hex sha256
+ * of the markup's and the stylesheet's UTF-8 bytes, for one saved design version. The card paints the delivered face
+ * only when ALL of these hold:
+ *
+ *  - the verdict is `render` (the caller has already checked that);
+ *  - the card is not pinned (a design pin keeps 1.2.1's pinned face; the caller checks that);
+ *  - the block shows the whole card: `part` is not `'header'` or `'memo'`, so a split banner never paints the face
+ *    twice (`showsWholeCard`);
+ *  - the verified content carries a digest it understands (`v: 1`, two 64-char lowercase hex digests, a numeric
+ *    `defVersion`);
+ *  - a well-formed face was served;
+ *  - a def was served and its `v` IS the digest's `defVersion` (markup rendered for another design version is not
+ *    this design);
+ *  - sha256(html) and sha256(css) equal the signed values.
+ *
+ * In every other case the card paints exactly what 1.2.1 paints. Markup whose bytes do not hash to the signed digest
+ * is never painted, and a WebCrypto failure counts as a mismatch, never as a pass.
+ *
+ * Hashing uses WebCrypto (`crypto.subtle.digest`), the global the kernel verifies with, so it runs wherever the card
+ * already verifies (Node SSR, edge runtimes, a browser in a secure context). It is react-free; the card owns the
+ * suspension around the async digest.
+ */
+import type { CertContent, CertFaceDigest } from '../contract/kernel.js';
+import type { DeliveredFace } from '../verify/get-verified-delivery.js';
+import type { CertChromeRenderDef } from './cert-chrome-data.js';
+/**
+ * Whether a block shows the whole card, by `renderCertBlock`'s own rule: only `'header'` and `'memo'` split the
+ * banner; absent, `'full'`, null or anything unrecognised is the full card. A split block keeps its own part even
+ * when a delivered face matches, because the delivered face is a whole design.
+ */
+export declare function showsWholeCard(part: unknown): boolean;
+/** The signed digest, accepted only in the shape cert-contract 0.6.0 defines; anything else is null. */
+export declare function acceptedFaceDigest(content: CertContent | null | undefined): CertFaceDigest | null;
+/**
+ * The synchronous half of the gate: the digest to hash the face against, or null when the delivered face cannot
+ * paint whatever its bytes are (no digest, no face, no def, or a def of another version). The card hashes only when
+ * this is non-null, so a delivery without a face never suspends a second time.
+ */
+export declare function deliveredFaceDigest(content: CertContent | null | undefined, renderDef: CertChromeRenderDef | null, face: DeliveredFace | null | undefined): CertFaceDigest | null;
+/** Lowercase hex sha256 of a string's UTF-8 bytes, via WebCrypto. */
+export declare function sha256HexUtf8(text: string): Promise<string>;
+/** The two digests of a delivered face. */
+export interface DeliveredFaceHashes {
+    readonly html: string;
+    readonly css: string;
+}
+/** Hash both halves. Never rejects: a WebCrypto failure (none in an insecure context) is null, which never matches. */
+export declare function hashDeliveredFace(face: DeliveredFace): Promise<DeliveredFaceHashes | null>;
+/** The asynchronous half's verdict: both halves hash to the signed values. */
+export declare function deliveredFaceMatches(hashes: DeliveredFaceHashes | null, digest: CertFaceDigest): boolean;
+/** The markup the card paints for a matching face: the stylesheet first, then the face. */
+export declare function deliveredFaceHtml(face: DeliveredFace): string;
+/** One face's hashing: the pending digest, and its answer once settled. */
+export interface FaceHashMemo {
+    readonly pending: Promise<DeliveredFaceHashes | null>;
+    settled?: {
+        readonly hashes: DeliveredFaceHashes | null;
+    };
+}
+/**
+ * The memoized hashing of one face, keyed by its CONTENT (both strings), not by the object: the browser parses a seed
+ * from the page afresh on each render, and a server's cached read and a seed of the same face share one entry. A
+ * failure settles to null and stays settled (a context with no WebCrypto does not gain one).
+ */
+export declare function faceHashesFor(face: DeliveredFace): FaceHashMemo;
+/** Test seam: forget every face's hashes (a new process). */
+export declare function forgetFaceHashesForTests(): void;
+//# sourceMappingURL=delivered-face.d.ts.map

package/dist/builder/delivered-face.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivered-face.d.ts","sourceRoot":"","sources":["../../src/builder/delivered-face.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAA;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAIhE;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAErD;AAED,wGAAwG;AACxG,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,GAAG,cAAc,GAAG,IAAI,CAQjG;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAClC,OAAO,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,EACvC,SAAS,EAAE,mBAAmB,GAAG,IAAI,EACrC,IAAI,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GACpC,cAAc,GAAG,IAAI,CAKvB;AAED,qEAAqE;AACrE,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKjE;AAED,2CAA2C;AAC3C,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACpB;AAED,uHAAuH;AACvH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAOhG;AAED,8EAA8E;AAC9E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAExG;AAED,2FAA2F;AAC3F,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAE7D;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAA;IACrD,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAA;KAAE,CAAA;CACzD;AAMD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,YAAY,CAgB/D;AAED,6DAA6D;AAC7D,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C"}

package/dist/builder/delivered-face.js

@@ -0,0 +1,122 @@
+/**
+ * ─────────────────────────────────────────────────────────────────────────────
+ * The delivered face gate: when the Builder card may paint the server's markup (1.3.0)
+ * ─────────────────────────────────────────────────────────────────────────────
+ *
+ * The Delivery API may serve a server-rendered face (`face: { html, css }`) beside the signed artifact. That sibling
+ * is UNSIGNED. What binds it is the signed `payload.content.faceDigest` (cert-contract 0.6.0): the lowercase hex sha256
+ * of the markup's and the stylesheet's UTF-8 bytes, for one saved design version. The card paints the delivered face
+ * only when ALL of these hold:
+ *
+ *  - the verdict is `render` (the caller has already checked that);
+ *  - the card is not pinned (a design pin keeps 1.2.1's pinned face; the caller checks that);
+ *  - the block shows the whole card: `part` is not `'header'` or `'memo'`, so a split banner never paints the face
+ *    twice (`showsWholeCard`);
+ *  - the verified content carries a digest it understands (`v: 1`, two 64-char lowercase hex digests, a numeric
+ *    `defVersion`);
+ *  - a well-formed face was served;
+ *  - a def was served and its `v` IS the digest's `defVersion` (markup rendered for another design version is not
+ *    this design);
+ *  - sha256(html) and sha256(css) equal the signed values.
+ *
+ * In every other case the card paints exactly what 1.2.1 paints. Markup whose bytes do not hash to the signed digest
+ * is never painted, and a WebCrypto failure counts as a mismatch, never as a pass.
+ *
+ * Hashing uses WebCrypto (`crypto.subtle.digest`), the global the kernel verifies with, so it runs wherever the card
+ * already verifies (Node SSR, edge runtimes, a browser in a secure context). It is react-free; the card owns the
+ * suspension around the async digest.
+ */
+const SHA256_HEX = /^[0-9a-f]{64}$/;
+/**
+ * Whether a block shows the whole card, by `renderCertBlock`'s own rule: only `'header'` and `'memo'` split the
+ * banner; absent, `'full'`, null or anything unrecognised is the full card. A split block keeps its own part even
+ * when a delivered face matches, because the delivered face is a whole design.
+ */
+export function showsWholeCard(part) {
+    return part !== 'header' && part !== 'memo';
+}
+/** The signed digest, accepted only in the shape cert-contract 0.6.0 defines; anything else is null. */
+export function acceptedFaceDigest(content) {
+    const digest = content?.faceDigest;
+    if (typeof digest !== 'object' || digest === null || Array.isArray(digest))
+        return null;
+    const { v, defVersion, html, css } = digest;
+    if (v !== 1 || typeof defVersion !== 'number' || !Number.isFinite(defVersion))
+        return null;
+    if (typeof html !== 'string' || !SHA256_HEX.test(html))
+        return null;
+    if (typeof css !== 'string' || !SHA256_HEX.test(css))
+        return null;
+    return { v: 1, defVersion, html, css };
+}
+/**
+ * The synchronous half of the gate: the digest to hash the face against, or null when the delivered face cannot
+ * paint whatever its bytes are (no digest, no face, no def, or a def of another version). The card hashes only when
+ * this is non-null, so a delivery without a face never suspends a second time.
+ */
+export function deliveredFaceDigest(content, renderDef, face) {
+    if (!face)
+        return null;
+    const digest = acceptedFaceDigest(content);
+    if (!digest || !renderDef || renderDef.v !== digest.defVersion)
+        return null;
+    return digest;
+}
+/** Lowercase hex sha256 of a string's UTF-8 bytes, via WebCrypto. */
+export async function sha256HexUtf8(text) {
+    const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(text)));
+    let hex = '';
+    for (const byte of digest)
+        hex += byte.toString(16).padStart(2, '0');
+    return hex;
+}
+/** Hash both halves. Never rejects: a WebCrypto failure (none in an insecure context) is null, which never matches. */
+export async function hashDeliveredFace(face) {
+    try {
+        const [html, css] = await Promise.all([sha256HexUtf8(face.html), sha256HexUtf8(face.css)]);
+        return { html, css };
+    }
+    catch {
+        return null;
+    }
+}
+/** The asynchronous half's verdict: both halves hash to the signed values. */
+export function deliveredFaceMatches(hashes, digest) {
+    return hashes !== null && hashes.html === digest.html && hashes.css === digest.css;
+}
+/** The markup the card paints for a matching face: the stylesheet first, then the face. */
+export function deliveredFaceHtml(face) {
+    return `<style>${face.css}</style>${face.html}`;
+}
+/** How many faces' hashes are kept (insertion order; the oldest goes first). A page or a brand has one or a few. */
+const FACE_HASH_MEMO_MAX = 64;
+const faceHashMemo = new Map();
+/**
+ * The memoized hashing of one face, keyed by its CONTENT (both strings), not by the object: the browser parses a seed
+ * from the page afresh on each render, and a server's cached read and a seed of the same face share one entry. A
+ * failure settles to null and stays settled (a context with no WebCrypto does not gain one).
+ */
+export function faceHashesFor(face) {
+    const key = `${face.html.length}:${face.html}${face.css}`;
+    const known = faceHashMemo.get(key);
+    if (known)
+        return known;
+    const fresh = {
+        pending: hashDeliveredFace(face).then((hashes) => {
+            fresh.settled = { hashes };
+            return hashes;
+        }),
+    };
+    if (faceHashMemo.size >= FACE_HASH_MEMO_MAX) {
+        const oldest = faceHashMemo.keys().next().value;
+        if (oldest !== undefined)
+            faceHashMemo.delete(oldest);
+    }
+    faceHashMemo.set(key, fresh);
+    return fresh;
+}
+/** Test seam: forget every face's hashes (a new process). */
+export function forgetFaceHashesForTests() {
+    faceHashMemo.clear();
+}
+//# sourceMappingURL=delivered-face.js.map

package/dist/builder/delivered-face.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivered-face.js","sourceRoot":"","sources":["../../src/builder/delivered-face.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAMH,MAAM,UAAU,GAAG,gBAAgB,CAAA;AAEnC;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAa;IAC3C,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,MAAM,CAAA;AAC5C,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,kBAAkB,CAAC,OAAuC;IACzE,MAAM,MAAM,GAAa,OAAuD,EAAE,UAAU,CAAA;IAC5F,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IACvF,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAiC,CAAA;IACtE,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1F,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACnE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACjE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAClC,OAAuC,EACvC,SAAqC,EACrC,IAAsC;IAEtC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC,KAAK,MAAM,CAAC,UAAU;QAAE,OAAO,IAAI,CAAA;IAC3E,OAAO,MAAM,CAAA;AACd,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY;IAC/C,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACpG,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,MAAM,IAAI,IAAI,MAAM;QAAE,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACpE,OAAO,GAAG,CAAA;AACX,CAAC;AAQD,uHAAuH;AACvH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAmB;IAC1D,IAAI,CAAC;QACJ,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAC1F,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;IACrB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,oBAAoB,CAAC,MAAkC,EAAE,MAAsB;IAC9F,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAA;AACnF,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,iBAAiB,CAAC,IAAmB;IACpD,OAAO,UAAU,IAAI,CAAC,GAAG,WAAW,IAAI,CAAC,IAAI,EAAE,CAAA;AAChD,CAAC;AAQD,oHAAoH;AACpH,MAAM,kBAAkB,GAAG,EAAE,CAAA;AAC7B,MAAM,YAAY,GAAG,IAAI,GAAG,EAAwB,CAAA;AAEpD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAmB;IAChD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACzD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACnC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAA;IACvB,MAAM,KAAK,GAAiB;QAC3B,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YAChD,KAAK,CAAC,OAAO,GAAG,EAAE,MAAM,EAAE,CAAA;YAC1B,OAAO,MAAM,CAAA;QACd,CAAC,CAAC;KACF,CAAA;IACD,IAAI,YAAY,CAAC,IAAI,IAAI,kBAAkB,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;QAC/C,IAAI,MAAM,KAAK,SAAS;YAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACtD,CAAC;IACD,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC5B,OAAO,KAAK,CAAA;AACb,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,wBAAwB;IACvC,YAAY,CAAC,KAAK,EAAE,CAAA;AACrB,CAAC"}

package/dist/builder/delivery-runtime.d.ts

@@ -31,7 +31,7 @@ export interface CardDeliveryRuntime {
 export declare function cardDeliveryRuntime(): CardDeliveryRuntime;
 /**
  * Test seam: replace parts of the runtime (a fresh cache unless one is given) and forget the page's envelope seeds
- * (a fresh runtime is a fresh page). Returns a restore.
+ * (a fresh runtime is a fresh page) and (1.3.0) every delivered face's memoized hashes. Returns a restore.
  */
 export declare function setCardDeliveryRuntimeForTests(overrides: Partial<CardDeliveryRuntime>): () => void;
 //# sourceMappingURL=delivery-runtime.d.ts.map

package/dist/builder/delivery-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delivery-runtime.d.ts","sourceRoot":"","sources":["../../src/builder/delivery-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AAIxE,iGAAiG;AACjG,eAAO,MAAM,wBAAwB,OAAQ,CAAA;AAC7C,wGAAwG;AACxG,eAAO,MAAM,sBAAsB,SAAU,CAAA;AAE7C,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAA;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,OAAO,KAAK,CAAA;IACtC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAA;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC3B;AA6BD,wBAAgB,mBAAmB,IAAI,mBAAmB,CAEzD;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,MAAM,IAAI,CAYlG"}
+{"version":3,"file":"delivery-runtime.d.ts","sourceRoot":"","sources":["../../src/builder/delivery-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AAKxE,iGAAiG;AACjG,eAAO,MAAM,wBAAwB,OAAQ,CAAA;AAC7C,wGAAwG;AACxG,eAAO,MAAM,sBAAsB,SAAU,CAAA;AAE7C,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAA;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,OAAO,KAAK,CAAA;IACtC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAA;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC3B;AA6BD,wBAAgB,mBAAmB,IAAI,mBAAmB,CAEzD;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,MAAM,IAAI,CAalG"}

package/dist/builder/delivery-runtime.js

@@ -15,6 +15,7 @@
  * the same cache shape, so they exercise what production runs.
  */
 import { TtlCache } from '../verify/cache.js';
+import { forgetFaceHashesForTests } from './delivered-face.js';
 import { CERT_ISSUER_KID, CERT_ISSUER_PUBLIC_KEY_PEM } from './issuer-key.js';
 import { forgetPageSeedsForTests } from './ssr-seed.js';
 /** The card's server read deadline. A brand's server waits this long once per cold placement. */
@@ -48,10 +49,11 @@ export function cardDeliveryRuntime() {
 }
 /**
  * Test seam: replace parts of the runtime (a fresh cache unless one is given) and forget the page's envelope seeds
- * (a fresh runtime is a fresh page). Returns a restore.
+ * (a fresh runtime is a fresh page) and (1.3.0) every delivered face's memoized hashes. Returns a restore.
  */
 export function setCardDeliveryRuntimeForTests(overrides) {
     forgetPageSeedsForTests();
+    forgetFaceHashesForTests();
     const previous = runtime;
     const now = overrides.now ?? previous.now;
     runtime = {

package/dist/builder/delivery-runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"delivery-runtime.js","sourceRoot":"","sources":["../../src/builder/delivery-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAE7C,OAAO,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAA;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AAEvD,iGAAiG;AACjG,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAA;AAC7C,wGAAwG;AACxG,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAA;AAU7C,MAAM,eAAe,GAA0B,CAAC,GAAG,EAAE,EAAE,CACtD,GAAG,KAAK,eAAe,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAEpF,SAAS,YAAY,CAAC,GAAkB;IACvC,OAAO,IAAI,QAAQ,CAAiB;QACnC,KAAK,EAAE,MAAM;QACb,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,sBAAsB;QAC/B,wFAAwF;QACxF,+EAA+E;QAC/E,aAAa,EAAE,wBAAwB,GAAG,KAAK;QAC/C,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvB,CAAC,CAAA;AACH,CAAC;AAED,SAAS,cAAc;IACtB,OAAO;QACN,UAAU,EAAE,eAAe;QAC3B,SAAS,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK;QACjC,KAAK,EAAE,YAAY,EAAE;QACrB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,SAAS,EAAE,wBAAwB;KACnC,CAAA;AACF,CAAC;AAED,IAAI,OAAO,GAAwB,cAAc,EAAE,CAAA;AAEnD,MAAM,UAAU,mBAAmB;IAClC,OAAO,OAAO,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,SAAuC;IACrF,uBAAuB,EAAE,CAAA;IACzB,MAAM,QAAQ,GAAG,OAAO,CAAA;IACxB,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAA;IACzC,OAAO,GAAG;QACT,GAAG,QAAQ;QACX,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC;QACxB,GAAG,SAAS;KACZ,CAAA;IACD,OAAO,GAAG,EAAE;QACX,OAAO,GAAG,QAAQ,CAAA;IACnB,CAAC,CAAA;AACF,CAAC"}
+{"version":3,"file":"delivery-runtime.js","sourceRoot":"","sources":["../../src/builder/delivery-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAE7C,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AAC9D,OAAO,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAA;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AAEvD,iGAAiG;AACjG,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAA;AAC7C,wGAAwG;AACxG,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAA;AAU7C,MAAM,eAAe,GAA0B,CAAC,GAAG,EAAE,EAAE,CACtD,GAAG,KAAK,eAAe,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAEpF,SAAS,YAAY,CAAC,GAAkB;IACvC,OAAO,IAAI,QAAQ,CAAiB;QACnC,KAAK,EAAE,MAAM;QACb,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,sBAAsB;QAC/B,wFAAwF;QACxF,+EAA+E;QAC/E,aAAa,EAAE,wBAAwB,GAAG,KAAK;QAC/C,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvB,CAAC,CAAA;AACH,CAAC;AAED,SAAS,cAAc;IACtB,OAAO;QACN,UAAU,EAAE,eAAe;QAC3B,SAAS,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK;QACjC,KAAK,EAAE,YAAY,EAAE;QACrB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,SAAS,EAAE,wBAAwB;KACnC,CAAA;AACF,CAAC;AAED,IAAI,OAAO,GAAwB,cAAc,EAAE,CAAA;AAEnD,MAAM,UAAU,mBAAmB;IAClC,OAAO,OAAO,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,SAAuC;IACrF,uBAAuB,EAAE,CAAA;IACzB,wBAAwB,EAAE,CAAA;IAC1B,MAAM,QAAQ,GAAG,OAAO,CAAA;IACxB,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAA;IACzC,OAAO,GAAG;QACT,GAAG,QAAQ;QACX,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC;QACxB,GAAG,SAAS;KACZ,CAAA;IACD,OAAO,GAAG,EAAE;QACX,OAAO,GAAG,QAAQ,CAAA;IACnB,CAAC,CAAA;AACF,CAAC"}

package/dist/builder/index.d.ts

@@ -27,7 +27,10 @@
  * for the entry it renders inside (`builderContext.content.id`) from the CertREV Delivery API on
  * `baseUrl` (an https certrev.com origin, nothing else), verifies it against the baked
  * `cert-issuer-1` key, re-judges revocation and expiry at every render, and paints the brand's
- * render def served beside it. A revoked, expired, unverifiable or unreachable cert, a marker that
+ * render def served beside it. 1.3.0: when the Delivery API also serves a server-rendered face
+ * (`face: { html, css }`, unsigned) and the verified envelope signs that face's sha256 digests for the
+ * def version served (`content.faceDigest`), an unpinned whole-card block paints that face instead;
+ * markup that does not hash to the signed digest is never painted. A revoked, expired, unverifiable or unreachable cert, a marker that
  * is not exactly that shape, or a missing entry id renders nothing. A block WITHOUT the marker
  * (every entry exported before 1.1.0) renders from its options exactly as 1.0.3 did, so the
  * paragraph above still describes it: an editor who deletes the marker gets the options face back,