@ixo/ucan 1.1.0 → 1.2.0

package/dist/validator/validator.js

@@ -1,14 +1,17 @@
 import { ed25519 } from '@ucanto/principal';
-import { Delegation } from '@ucanto/core';
+import { Delegation, UCAN } from '@ucanto/core';
 import { claim } from '@ucanto/validator';
 import { InMemoryInvocationStore } from '../store/memory.js';
 export async function createUCANValidator(options) {
     const invocationStore = options.invocationStore ?? new InMemoryInvocationStore();
     let serverVerifier;
-    if (options.serverDid.startsWith('did:key:')) {
-        serverVerifier = ed25519.Verifier.parse(options.serverDid);
-    }
-    else {
+    async function getServerVerifier() {
+        if (serverVerifier)
+            return serverVerifier;
+        if (options.serverDid.startsWith('did:key:')) {
+            serverVerifier = ed25519.Verifier.parse(options.serverDid);
+            return serverVerifier;
+        }
         if (!options.didResolver) {
             throw new Error(`Cannot use ${options.serverDid} as server DID without a didResolver. ` +
                 `Provide a didResolver to resolve non-did:key DIDs, or use a did:key directly.`);
@@ -26,6 +29,7 @@ export async function createUCANValidator(options) {
             throw new Error(`No valid key found for server DID ${options.serverDid}`);
         }
         serverVerifier = ed25519.Verifier.parse(keyDid);
+        return serverVerifier;
     }
     const resolveDIDKey = async (did) => {
         if (typeof did !== 'string') {
@@ -85,6 +89,70 @@ export async function createUCANValidator(options) {
         }
         return exp ?? parentExp;
     }
+    async function verifyDelegationChain(delegation) {
+        const issuerDid = delegation.issuer.did();
+        const resolved = await resolveDIDKey(issuerDid);
+        if ('error' in resolved) {
+            return {
+                ok: false,
+                error: {
+                    code: 'INVALID_SIGNATURE',
+                    message: `Cannot resolve issuer DID ${issuerDid}: ${resolved.error?.message ?? 'unknown'}`,
+                },
+            };
+        }
+        if (!resolved.ok || resolved.ok.length === 0) {
+            return {
+                ok: false,
+                error: {
+                    code: 'INVALID_SIGNATURE',
+                    message: `No keys found for issuer DID ${issuerDid}`,
+                },
+            };
+        }
+        const didKey = resolved.ok[0];
+        const realVerifier = ed25519.Verifier.parse(didKey);
+        const ucanView = delegation.data;
+        const wrappedVerifier = {
+            did: () => issuerDid,
+            verify: (payload, signature) => realVerifier.verify(payload, signature),
+        };
+        const sigValid = await UCAN.verifySignature(ucanView, wrappedVerifier);
+        if (!sigValid) {
+            return {
+                ok: false,
+                error: {
+                    code: 'INVALID_SIGNATURE',
+                    message: `Signature verification failed for issuer ${issuerDid}`,
+                },
+            };
+        }
+        if (delegation.proofs && delegation.proofs.length > 0) {
+            for (const proof of delegation.proofs) {
+                const proofAudience = proof.audience.did();
+                if (proofAudience !== issuerDid) {
+                    const proofAudResolved = await resolveDIDKey(proofAudience);
+                    const proofAudKey = 'ok' in proofAudResolved && proofAudResolved.ok
+                        ? proofAudResolved.ok[0]
+                        : null;
+                    if (didKey !== proofAudKey) {
+                        return {
+                            ok: false,
+                            error: {
+                                code: 'UNAUTHORIZED',
+                                message: `Proof chain broken: proof audience ${proofAudience} does not match delegation issuer ${issuerDid}`,
+                            },
+                        };
+                    }
+                }
+                const proofResult = await verifyDelegationChain(proof);
+                if (!proofResult.ok) {
+                    return proofResult;
+                }
+            }
+        }
+        return { ok: true };
+    }
     return {
         serverDid: options.serverDid,
         async validate(invocationBase64, capabilityDef, resource) {
@@ -130,11 +198,14 @@ export async function createUCANValidator(options) {
                         },
                     };
                 }
+                const resolvedVerifier = await getServerVerifier();
                 const claimResult = claim(capabilityDef, [invocation], {
-                    authority: serverVerifier,
+                    authority: resolvedVerifier,
                     principal: ed25519.Verifier,
                     resolveDIDKey: resolveDIDKey,
                     canIssue: (cap, issuer) => {
+                        if (options.rootIssuers.includes('*'))
+                            return true;
                         if (options.rootIssuers.includes(issuer))
                             return true;
                         if (typeof cap.with === 'string' && cap.with.includes(issuer))
@@ -180,6 +251,7 @@ export async function createUCANValidator(options) {
                 }
                 const proofChain = buildProofChain(invocation);
                 const expiration = computeEffectiveExpiration(invocation);
+                const facts = invocation.facts;
                 return {
                     ok: true,
                     invoker: invocation.issuer.did(),
@@ -192,6 +264,80 @@ export async function createUCANValidator(options) {
                         : undefined,
                     expiration,
                     proofChain,
+                    facts: facts && facts.length > 0 ? facts : undefined,
+                };
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : 'Unknown error';
+                return { ok: false, error: { code: 'INVALID_FORMAT', message } };
+            }
+        },
+        async validateDelegation(delegationBase64) {
+            try {
+                const carBytes = new Uint8Array(Buffer.from(delegationBase64, 'base64'));
+                const extracted = await Delegation.extract(carBytes);
+                if (extracted.error) {
+                    return {
+                        ok: false,
+                        error: {
+                            code: 'INVALID_FORMAT',
+                            message: `Failed to decode: ${extracted.error?.message ?? 'unknown'}`,
+                        },
+                    };
+                }
+                const delegation = 'ok' in extracted ? extracted.ok : extracted;
+                if (!delegation?.issuer?.did || !delegation?.audience?.did) {
+                    return {
+                        ok: false,
+                        error: {
+                            code: 'INVALID_FORMAT',
+                            message: 'Delegation missing issuer or audience',
+                        },
+                    };
+                }
+                const audienceDid = delegation.audience.did();
+                if (audienceDid !== options.serverDid) {
+                    return {
+                        ok: false,
+                        error: {
+                            code: 'UNAUTHORIZED',
+                            message: `Delegation addressed to ${audienceDid}, not ${options.serverDid}`,
+                        },
+                    };
+                }
+                const expiration = computeEffectiveExpiration(delegation);
+                if (expiration !== undefined) {
+                    const nowSeconds = Math.floor(Date.now() / 1000);
+                    if (expiration < nowSeconds) {
+                        return {
+                            ok: false,
+                            error: {
+                                code: 'EXPIRED',
+                                message: `Delegation expired at ${new Date(expiration * 1000).toISOString()}`,
+                            },
+                        };
+                    }
+                }
+                const sigResult = await verifyDelegationChain(delegation);
+                if (!sigResult.ok) {
+                    return sigResult;
+                }
+                const proofChain = buildProofChain(delegation);
+                const cap = delegation.capabilities?.[0];
+                const facts = delegation.facts;
+                return {
+                    ok: true,
+                    invoker: delegation.issuer.did(),
+                    capability: cap
+                        ? {
+                            can: cap.can,
+                            with: cap.with,
+                            nb: cap.nb,
+                        }
+                        : undefined,
+                    expiration,
+                    proofChain,
+                    facts: facts && facts.length > 0 ? facts : undefined,
                 };
             }
             catch (err) {

package/dist/validator/validator.js.map

@@ -1 +1 @@
-{"version":3,"file":"validator.js","sourceRoot":"","sources":["../../src/validator/validator.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAG1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AA6J7D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAA+B;IAE/B,MAAM,eAAe,GACnB,OAAO,CAAC,eAAe,IAAI,IAAI,uBAAuB,EAAE,CAAC;IAI3D,IAAI,cAAwB,CAAC;IAE7B,IAAI,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAE7C,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QAEN,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,cAAc,OAAO,CAAC,SAAS,wCAAwC;gBACrE,+EAA+E,CAClF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,CACxC,OAAO,CAAC,SAAsC,CAC/C,CAAC;QAEF,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,gCAAgC,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAC/E,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,gCAAgC,OAAO,CAAC,SAAS,IAAI;gBACnD,8DAA8D,CACjE,CAAC;QACJ,CAAC;QAGD,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAGD,MAAM,aAAa,GAAG,KAAK,EAAE,GAA8B,EAAE,EAAE;QAE7D,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,GAAG,CAAC,CAAC;YAClE,OAAO;gBACL,KAAK,EAAE;oBACL,IAAI,EAAE,uBAAgC;oBACtC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC;oBAChB,OAAO,EAAE,4BAA4B,OAAO,GAAG,EAAE;iBAClD;aACF,CAAC;QACJ,CAAC;QAGD,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,CAAC;QAGD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,IAAI,IAAI,MAAM,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAE3C,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;YAC3B,CAAC;YACD,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;gBACtB,OAAO;oBACL,KAAK,EAAE;wBACL,IAAI,EAAE,uBAAgC;wBACtC,GAAG;wBACH,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;qBAC9B;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK,EAAE;gBACL,IAAI,EAAE,uBAAgC;gBACtC,GAAG;gBACH,OAAO,EAAE,uBAAuB,GAAG,EAAE;aACtC;SACF,CAAC;IACJ,CAAC,CAAC;IAOF,SAAS,eAAe,CAAC,UAAe;QACtC,IAAI,CAAC,UAAU,EAAE,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,WAAW,GAAG,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,CAAC;IAOD,SAAS,0BAA0B,CAAC,UAAe;QACjD,MAAM,GAAG,GACP,OAAO,UAAU,EAAE,UAAU,KAAK,QAAQ;YAC1C,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;YAC7B,CAAC,CAAC,UAAU,CAAC,UAAU;YACvB,CAAC,CAAC,SAAS,CAAC;QAEhB,IAAI,CAAC,UAAU,EAAE,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,OAAO,GAAG,CAAC;QACb,CAAC;QAED,MAAM,SAAS,GAAG,0BAA0B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAEnE,IAAI,GAAG,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACjD,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,GAAG,IAAI,SAAS,CAAC;IAC1B,CAAC;IAED,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAE5B,KAAK,CAAC,QAAQ,CACZ,gBAAgB,EAChB,aAAa,EACb,QAAQ;YAER,IAAI,CAAC;gBAEH,MAAM,QAAQ,GAAG,IAAI,UAAU,CAC7B,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CACxC,CAAC;gBAGF,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACrD,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;oBACpB,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE;4BACL,IAAI,EAAE,gBAAgB;4BACtB,OAAO,EAAE,qBAAqB,SAAS,CAAC,KAAK,EAAE,OAAO,IAAI,SAAS,EAAE;yBACtE;qBACF,CAAC;gBACJ,CAAC;gBAED,MAAM,UAAU,GAAG,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBAGhE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;oBAC3D,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE;4BACL,IAAI,EAAE,gBAAgB;4BACtB,OAAO,EAAE,uCAAuC;yBACjD;qBACF,CAAC;gBACJ,CAAC;gBAGD,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;gBAC9C,IAAI,WAAW,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;oBACtC,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE;4BACL,IAAI,EAAE,cAAc;4BACpB,OAAO,EAAE,2BAA2B,WAAW,SAAS,OAAO,CAAC,SAAS,EAAE;yBAC5E;qBACF,CAAC;gBACJ,CAAC;gBAGD,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;gBACjD,IAAI,aAAa,IAAI,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;oBAChE,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE;4BACL,IAAI,EAAE,QAAQ;4BACd,OAAO,EAAE,kCAAkC;yBAC5C;qBACF,CAAC;gBACJ,CAAC;gBAID,MAAM,WAAW,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC,UAAU,CAAC,EAAE;oBACrD,SAAS,EAAE,cAAc;oBACzB,SAAS,EAAE,OAAO,CAAC,QAAQ;oBAE3B,aAAa,EAAE,aAAoB;oBACnC,QAAQ,EAAE,CAAC,GAAqB,EAAE,MAAc,EAAE,EAAE;wBAElD,IAAI,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC;4BAAE,OAAO,IAAI,CAAC;wBAEtD,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;4BAC3D,OAAO,IAAI,CAAC;wBACd,OAAO,KAAK,CAAC;oBACf,CAAC;oBACD,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;iBAC1C,CAAC,CAAC;gBAEH,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC;gBAEvC,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;oBAEvB,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,IAAI,sBAAsB,CAAC;oBACtE,MAAM,aAAa,GACjB,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;wBAC1B,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;wBAC3B,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;wBAC5B,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;oBAEhC,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE;4BACL,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,cAAc;4BACzD,OAAO,EAAE,QAAQ;yBAClB;qBACF,CAAC;gBACJ,CAAC;gBAGD,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC;gBAClD,IAAI,YAAY,IAAI,YAAY,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAEnD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAc,CAAC;oBAC5C,MAAM,eAAe,GACnB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;wBACrB,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;wBAC5C,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;4BACrB,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAE/C,IAAI,CAAC,eAAe,EAAE,CAAC;wBACrB,OAAO;4BACL,EAAE,EAAE,KAAK;4BACT,KAAK,EAAE;gCACL,IAAI,EAAE,cAAc;gCACpB,OAAO,EAAE,YAAY,YAAY,CAAC,IAAI,mBAAmB,QAAQ,EAAE;6BACpE;yBACF,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAGD,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBAC3C,CAAC;gBAGD,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;gBAC/C,MAAM,UAAU,GAAG,0BAA0B,CAAC,UAAU,CAAC,CAAC;gBAE1D,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE;oBAChC,UAAU,EAAE,YAAY;wBACtB,CAAC,CAAC;4BACE,GAAG,EAAE,YAAY,CAAC,GAAG;4BACrB,IAAI,EAAE,YAAY,CAAC,IAAc;4BACjC,EAAE,EAAE,YAAY,CAAC,EAAyC;yBAC3D;wBACH,CAAC,CAAC,SAAS;oBACb,UAAU;oBACV,UAAU;iBACX,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE,CAAC;YACnE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"validator.js","sourceRoot":"","sources":["../../src/validator/validator.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAG1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAyL7D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAA+B;IAE/B,MAAM,eAAe,GACnB,OAAO,CAAC,eAAe,IAAI,IAAI,uBAAuB,EAAE,CAAC;IAM3D,IAAI,cAAoC,CAAC;IAEzC,KAAK,UAAU,iBAAiB;QAC9B,IAAI,cAAc;YAAE,OAAO,cAAc,CAAC;QAE1C,IAAI,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7C,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC3D,OAAO,cAAc,CAAC;QACxB,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,cAAc,OAAO,CAAC,SAAS,wCAAwC;gBACrE,+EAA+E,CAClF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,CACxC,OAAO,CAAC,SAAsC,CAC/C,CAAC;QAEF,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,gCAAgC,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAC/E,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,gCAAgC,OAAO,CAAC,SAAS,IAAI;gBACnD,8DAA8D,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChD,OAAO,cAAc,CAAC;IACxB,CAAC;IAGD,MAAM,aAAa,GAAG,KAAK,EAAE,GAA8B,EAAE,EAAE;QAE7D,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,GAAG,CAAC,CAAC;YAClE,OAAO;gBACL,KAAK,EAAE;oBACL,IAAI,EAAE,uBAAgC;oBACtC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC;oBAChB,OAAO,EAAE,4BAA4B,OAAO,GAAG,EAAE;iBAClD;aACF,CAAC;QACJ,CAAC;QAGD,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,CAAC;QAGD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,IAAI,IAAI,MAAM,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAE3C,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;YAC3B,CAAC;YACD,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;gBACtB,OAAO;oBACL,KAAK,EAAE;wBACL,IAAI,EAAE,uBAAgC;wBACtC,GAAG;wBACH,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;qBAC9B;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK,EAAE;gBACL,IAAI,EAAE,uBAAgC;gBACtC,GAAG;gBACH,OAAO,EAAE,uBAAuB,GAAG,EAAE;aACtC;SACF,CAAC;IACJ,CAAC,CAAC;IAOF,SAAS,eAAe,CAAC,UAAe;QACtC,IAAI,CAAC,UAAU,EAAE,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,WAAW,GAAG,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,CAAC;IAOD,SAAS,0BAA0B,CAAC,UAAe;QACjD,MAAM,GAAG,GACP,OAAO,UAAU,EAAE,UAAU,KAAK,QAAQ;YAC1C,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;YAC7B,CAAC,CAAC,UAAU,CAAC,UAAU;YACvB,CAAC,CAAC,SAAS,CAAC;QAEhB,IAAI,CAAC,UAAU,EAAE,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,OAAO,GAAG,CAAC;QACb,CAAC;QAED,MAAM,SAAS,GAAG,0BAA0B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAEnE,IAAI,GAAG,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACjD,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,GAAG,IAAI,SAAS,CAAC;IAC1B,CAAC;IAQD,KAAK,UAAU,qBAAqB,CAAC,UAAe;QAClD,MAAM,SAAS,GAAW,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAGlD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAClC,SAAsC,CACvC,CAAC;QACF,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;YACxB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACL,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,6BAA6B,SAAS,KAAK,QAAQ,CAAC,KAAK,EAAE,OAAO,IAAI,SAAS,EAAE;iBAC3F;aACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACL,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,gCAAgC,SAAS,EAAE;iBACrD;aACF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAIpD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC;QAOjC,MAAM,eAAe,GAAG;YACtB,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS;YACpB,MAAM,EAAE,CAAC,OAAmB,EAAE,SAAkB,EAAE,EAAE,CAClD,YAAY,CAAC,MAAM,CACjB,OAAO,EAEP,SAAgB,CACjB;SACJ,CAAC;QAGF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,eAAsB,CAAC,CAAC;QAC9E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACL,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,4CAA4C,SAAS,EAAE;iBACjE;aACF,CAAC;QACJ,CAAC;QAGD,IAAI,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;gBAEtC,MAAM,aAAa,GAAW,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;gBACnD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;oBAEhC,MAAM,gBAAgB,GAAG,MAAM,aAAa,CAC1C,aAA0C,CAC3C,CAAC;oBACF,MAAM,WAAW,GACf,IAAI,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,EAAE;wBAC7C,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;wBACxB,CAAC,CAAC,IAAI,CAAC;oBAEX,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;wBAC3B,OAAO;4BACL,EAAE,EAAE,KAAK;4BACT,KAAK,EAAE;gCACL,IAAI,EAAE,cAAc;gCACpB,OAAO,EAAE,sCAAsC,aAAa,qCAAqC,SAAS,EAAE;6BAC7G;yBACF,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,MAAM,WAAW,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;gBACvD,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;oBACpB,OAAO,WAAW,CAAC;gBACrB,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAE5B,KAAK,CAAC,QAAQ,CACZ,gBAAgB,EAChB,aAAa,EACb,QAAQ;YAER,IAAI,CAAC;gBAEH,MAAM,QAAQ,GAAG,IAAI,UAAU,CAC7B,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CACxC,CAAC;gBAGF,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACrD,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;oBACpB,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE;4BACL,IAAI,EAAE,gBAAgB;4BACtB,OAAO,EAAE,qBAAqB,SAAS,CAAC,KAAK,EAAE,OAAO,IAAI,SAAS,EAAE;yBACtE;qBACF,CAAC;gBACJ,CAAC;gBAED,MAAM,UAAU,GAAG,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBAGhE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;oBAC3D,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE;4BACL,IAAI,EAAE,gBAAgB;4BACtB,OAAO,EAAE,uCAAuC;yBACjD;qBACF,CAAC;gBACJ,CAAC;gBAGD,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;gBAC9C,IAAI,WAAW,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;oBACtC,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE;4BACL,IAAI,EAAE,cAAc;4BACpB,OAAO,EAAE,2BAA2B,WAAW,SAAS,OAAO,CAAC,SAAS,EAAE;yBAC5E;qBACF,CAAC;gBACJ,CAAC;gBAGD,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;gBACjD,IAAI,aAAa,IAAI,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;oBAChE,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE;4BACL,IAAI,EAAE,QAAQ;4BACd,OAAO,EAAE,kCAAkC;yBAC5C;qBACF,CAAC;gBACJ,CAAC;gBAID,MAAM,gBAAgB,GAAG,MAAM,iBAAiB,EAAE,CAAC;gBACnD,MAAM,WAAW,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC,UAAU,CAAC,EAAE;oBACrD,SAAS,EAAE,gBAAgB;oBAC3B,SAAS,EAAE,OAAO,CAAC,QAAQ;oBAE3B,aAAa,EAAE,aAAoB;oBACnC,QAAQ,EAAE,CAAC,GAAqB,EAAE,MAAc,EAAE,EAAE;wBAElD,IAAI,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;4BAAE,OAAO,IAAI,CAAC;wBAEnD,IAAI,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC;4BAAE,OAAO,IAAI,CAAC;wBAEtD,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;4BAC3D,OAAO,IAAI,CAAC;wBACd,OAAO,KAAK,CAAC;oBACf,CAAC;oBACD,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;iBAC1C,CAAC,CAAC;gBAEH,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC;gBAEvC,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;oBAEvB,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,IAAI,sBAAsB,CAAC;oBACtE,MAAM,aAAa,GACjB,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;wBAC1B,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;wBAC3B,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;wBAC5B,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;oBAEhC,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE;4BACL,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,cAAc;4BACzD,OAAO,EAAE,QAAQ;yBAClB;qBACF,CAAC;gBACJ,CAAC;gBAGD,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC;gBAClD,IAAI,YAAY,IAAI,YAAY,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAEnD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAc,CAAC;oBAC5C,MAAM,eAAe,GACnB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;wBACrB,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;wBAC5C,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;4BACrB,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAE/C,IAAI,CAAC,eAAe,EAAE,CAAC;wBACrB,OAAO;4BACL,EAAE,EAAE,KAAK;4BACT,KAAK,EAAE;gCACL,IAAI,EAAE,cAAc;gCACpB,OAAO,EAAE,YAAY,YAAY,CAAC,IAAI,mBAAmB,QAAQ,EAAE;6BACpE;yBACF,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAGD,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBAC3C,CAAC;gBAGD,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;gBAC/C,MAAM,UAAU,GAAG,0BAA0B,CAAC,UAAU,CAAC,CAAC;gBAI1D,MAAM,KAAK,GAAI,UAAkB,CAAC,KAErB,CAAC;gBAEd,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE;oBAChC,UAAU,EAAE,YAAY;wBACtB,CAAC,CAAC;4BACE,GAAG,EAAE,YAAY,CAAC,GAAG;4BACrB,IAAI,EAAE,YAAY,CAAC,IAAc;4BACjC,EAAE,EAAE,YAAY,CAAC,EAAyC;yBAC3D;wBACH,CAAC,CAAC,SAAS;oBACb,UAAU;oBACV,UAAU;oBACV,KAAK,EAAE,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;iBACrD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE,CAAC;YACnE,CAAC;QACH,CAAC;QAED,KAAK,CAAC,kBAAkB,CACtB,gBAAwB;YAExB,IAAI,CAAC;gBAEH,MAAM,QAAQ,GAAG,IAAI,UAAU,CAC7B,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CACxC,CAAC;gBAGF,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACrD,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;oBACpB,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE;4BACL,IAAI,EAAE,gBAAgB;4BACtB,OAAO,EAAE,qBAAqB,SAAS,CAAC,KAAK,EAAE,OAAO,IAAI,SAAS,EAAE;yBACtE;qBACF,CAAC;gBACJ,CAAC;gBAED,MAAM,UAAU,GAAG,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBAGhE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;oBAC3D,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE;4BACL,IAAI,EAAE,gBAAgB;4BACtB,OAAO,EAAE,uCAAuC;yBACjD;qBACF,CAAC;gBACJ,CAAC;gBAGD,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;gBAC9C,IAAI,WAAW,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;oBACtC,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE;4BACL,IAAI,EAAE,cAAc;4BACpB,OAAO,EAAE,2BAA2B,WAAW,SAAS,OAAO,CAAC,SAAS,EAAE;yBAC5E;qBACF,CAAC;gBACJ,CAAC;gBAGD,MAAM,UAAU,GAAG,0BAA0B,CAAC,UAAU,CAAC,CAAC;gBAC1D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;oBACjD,IAAI,UAAU,GAAG,UAAU,EAAE,CAAC;wBAC5B,OAAO;4BACL,EAAE,EAAE,KAAK;4BACT,KAAK,EAAE;gCACL,IAAI,EAAE,SAAS;gCACf,OAAO,EAAE,yBAAyB,IAAI,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE;6BAC9E;yBACF,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAGD,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,UAAU,CAAC,CAAC;gBAC1D,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;oBAClB,OAAO,SAAS,CAAC;gBACnB,CAAC;gBAGD,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;gBAC/C,MAAM,GAAG,GAAG,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC;gBAEzC,MAAM,KAAK,GAAI,UAAkB,CAAC,KAErB,CAAC;gBAEd,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE;oBAChC,UAAU,EAAE,GAAG;wBACb,CAAC,CAAC;4BACE,GAAG,EAAE,GAAG,CAAC,GAAG;4BACZ,IAAI,EAAE,GAAG,CAAC,IAAc;4BACxB,EAAE,EAAE,GAAG,CAAC,EAAyC;yBAClD;wBACH,CAAC,CAAC,SAAS;oBACb,UAAU;oBACV,UAAU;oBACV,KAAK,EAAE,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;iBACrD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE,CAAC;YACnE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ixo/ucan",
   "description": "UCAN authorization for any service - built on ucanto",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -11,28 +11,39 @@
   "types": "./dist/index.d.ts",
   "exports": {
     ".": {
+      "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
-      "types": "./dist/index.d.ts"
+      "default": "./dist/index.js"
     },
     "./validator": {
+      "types": "./dist/validator/validator.d.ts",
       "import": "./dist/validator/validator.js",
-      "types": "./dist/validator/validator.d.ts"
+      "default": "./dist/validator/validator.js"
     },
     "./client": {
+      "types": "./dist/client/create-client.d.ts",
       "import": "./dist/client/create-client.js",
-      "types": "./dist/client/create-client.d.ts"
+      "default": "./dist/client/create-client.js"
     },
     "./capabilities": {
+      "types": "./dist/capabilities/capability.d.ts",
       "import": "./dist/capabilities/capability.js",
-      "types": "./dist/capabilities/capability.d.ts"
+      "default": "./dist/capabilities/capability.js"
     },
     "./did": {
+      "types": "./dist/did/ixo-resolver.d.ts",
       "import": "./dist/did/ixo-resolver.js",
-      "types": "./dist/did/ixo-resolver.d.ts"
+      "default": "./dist/did/ixo-resolver.js"
+    },
+    "./did/web": {
+      "types": "./dist/did/web-resolver.d.ts",
+      "import": "./dist/did/web-resolver.js",
+      "default": "./dist/did/web-resolver.js"
     },
     "./store": {
+      "types": "./dist/store/memory.d.ts",
       "import": "./dist/store/memory.js",
-      "types": "./dist/store/memory.d.ts"
+      "default": "./dist/store/memory.js"
     }
   },
   "devDependencies": {

package/src/client/create-client.ts

@@ -14,6 +14,7 @@ import type {
   Delegation,
   Capability,
   Principal,
+  Fact,
 } from '@ucanto/interface';
 import type { SupportedDID } from '../types.js';
 
@@ -199,6 +200,8 @@ export async function createDelegation(options: {
   notBefore?: number;
   /** Parent delegations (proof chain) */
   proofs?: Delegation[];
+  /** Verifiable facts and proofs of knowledge (UCAN spec §3.2.4) */
+  facts?: Fact[];
 }): Promise<Delegation> {
   // Create principal from any DID (did:key, did:ixo, did:web, etc.)
   const audiencePrincipal = createPrincipal(options.audience);
@@ -211,6 +214,7 @@ export async function createDelegation(options: {
     expiration: options.expiration ?? Infinity,
     proofs: options.proofs,
     notBefore: options.notBefore,
+    facts: options.facts,
   });
 }
 
@@ -252,6 +256,8 @@ export async function createInvocation(options: {
   proofs?: Delegation[];
   /** Expiration timestamp (Unix seconds). Defaults to Infinity (never expires). */
   expiration?: number;
+  /** Verifiable facts and proofs of knowledge (UCAN spec §3.2.4) */
+  facts?: Fact[];
 }) {
   // Create principal from any DID (did:key, did:ixo, did:web, etc.)
   const audiencePrincipal = createPrincipal(options.audience);
@@ -262,6 +268,7 @@ export async function createInvocation(options: {
     capability: options.capability,
     proofs: options.proofs ?? [],
     expiration: options.expiration ?? Infinity,
+    facts: options.facts,
   });
 }
 
@@ -344,4 +351,4 @@ export async function parseDelegation(serialized: string): Promise<Delegation> {
 }
 
 // Re-export useful types
-export type { Signer, Delegation, Capability };
+export type { Signer, Delegation, Capability, Fact };

package/src/did/web-resolver.ts

@@ -0,0 +1,140 @@
+/**
+ * @fileoverview did:web resolver for UCAN validation
+ *
+ * Resolves did:web identifiers by fetching the DID document from
+ * the well-known endpoint as defined in the did:web specification.
+ *
+ * @see https://w3c-ccg.github.io/did-method-web/
+ */
+
+import type { DID } from '@ucanto/interface';
+import type { DIDKeyResolver, KeyDID } from '../types.js';
+
+export interface WebDIDResolverConfig {
+  fetch?: typeof globalThis.fetch;
+  /** If true, retry with http:// when https:// fetch fails. Default: false. */
+  fallbackToHttp?: boolean;
+}
+
+interface VerificationMethod {
+  id: string;
+  type: string;
+  publicKeyMultibase?: string;
+}
+
+/**
+ * Creates a DID resolver for did:web identifiers
+ *
+ * Fetches the DID document from `https://{domain}/.well-known/did.json`
+ * (or `https://{domain}/{path}/did.json` for path-based did:web DIDs)
+ * and extracts Ed25519 verification methods as did:key identifiers.
+ *
+ * @example
+ * ```typescript
+ * const resolver = createWebDIDResolver();
+ * const result = await resolver('did:web:sandbox.ixo.world');
+ * if ('ok' in result) {
+ *   console.log('Keys:', result.ok); // ['did:key:z6Mk...']
+ * }
+ * ```
+ */
+export function createWebDIDResolver(
+  config?: WebDIDResolverConfig,
+): DIDKeyResolver {
+  const fetchFn = config?.fetch ?? globalThis.fetch;
+
+  return async (
+    did: DID,
+  ): Promise<
+    { ok: KeyDID[] } | { error: { name: string; did: string; message: string } }
+  > => {
+    if (!did.startsWith('did:web:')) {
+      return {
+        error: {
+          name: 'DIDKeyResolutionError',
+          did,
+          message: `Cannot resolve ${did}: not a did:web identifier`,
+        },
+      };
+    }
+
+    try {
+      // did:web:example.com → https://example.com/.well-known/did.json
+      // did:web:example.com:path:to → https://example.com/path/to/did.json
+      const parts = did.slice('did:web:'.length).split(':');
+      const domain = decodeURIComponent(parts[0]!);
+      const pathSegments = parts.slice(1).map(decodeURIComponent);
+
+      const path =
+        pathSegments.length > 0
+          ? `/${pathSegments.join('/')}/did.json`
+          : '/.well-known/did.json';
+
+      const httpsUrl = `https://${domain}${path}`;
+
+      let response: Response | null = null;
+      let fetchUrl = httpsUrl;
+
+      try {
+        response = await fetchFn(httpsUrl);
+      } catch (httpsError) {
+        if (config?.fallbackToHttp) {
+          fetchUrl = `http://${domain}${path}`;
+          response = await fetchFn(fetchUrl);
+        } else {
+          throw httpsError;
+        }
+      }
+
+      if (!response.ok && config?.fallbackToHttp && fetchUrl === httpsUrl) {
+        // HTTPS returned a non-ok status, try HTTP
+        fetchUrl = `http://${domain}${path}`;
+        response = await fetchFn(fetchUrl);
+      }
+
+      if (!response.ok) {
+        return {
+          error: {
+            name: 'DIDKeyResolutionError',
+            did,
+            message: `Failed to fetch DID document from ${fetchUrl}: HTTP ${response.status}`,
+          },
+        };
+      }
+
+      const doc = (await response.json()) as {
+        verificationMethod?: VerificationMethod[];
+      };
+
+      const keys: KeyDID[] = [];
+      for (const vm of doc.verificationMethod ?? []) {
+        if (
+          vm.type.includes('Ed25519') &&
+          vm.publicKeyMultibase?.startsWith('z')
+        ) {
+          keys.push(`did:key:${vm.publicKeyMultibase}`);
+        }
+      }
+
+      if (keys.length === 0) {
+        return {
+          error: {
+            name: 'DIDKeyResolutionError',
+            did,
+            message: `No valid Ed25519 verification methods found in DID document for ${did}`,
+          },
+        };
+      }
+
+      return { ok: keys };
+    } catch (error) {
+      return {
+        error: {
+          name: 'DIDKeyResolutionError',
+          did,
+          message: `Failed to resolve ${did}: ${error instanceof Error ? error.message : 'Unknown error'}`,
+        },
+      };
+    }
+  };
+}

package/src/index.ts

@@ -107,6 +107,7 @@ export {
   type Signer,
   type Delegation,
   type Capability,
+  type Fact,
 } from './client/create-client.js';
 
 // =============================================================================
@@ -119,6 +120,11 @@ export {
   type IxoDIDResolverConfig,
 } from './did/ixo-resolver.js';
 
+export {
+  createWebDIDResolver,
+  type WebDIDResolverConfig,
+} from './did/web-resolver.js';
+
 // =============================================================================
 // Store (for replay protection)
 // =============================================================================