@kya-os/cli 1.8.3 → 2.0.2

package/dist/sidecar/sidecar/src/conformance/reference/adapter-helpers.js

@@ -0,0 +1,117 @@
+/*
+MIT License
+
+Copyright (c) 2026 KYA-OS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+*/
+// Vendored reference harness; see PROVENANCE.json and LICENSE. Public-package import adaptations only.
+/**
+ * Standalone helpers for the {@link ReferenceConformanceAdapter}.
+ *
+ * These are pure, dependency-light free functions extracted from
+ * `reference-adapter.ts` to keep that module under the size guardrail. Like the
+ * adapter itself, they only ever compose the package's PUBLIC primitives — no
+ * verification logic is re-implemented here.
+ */
+import { createDidKeyResolver, createDidWebResolver, } from '@kya-os/mcp';
+import { validateDelegationChain as validateCardDelegationChain, } from '@kya-os/mcp/card';
+/**
+ * Resolve a DID against the vector's supplied documents, falling back to the
+ * offline method resolvers (did:key derives from the DID itself; did:web reads
+ * the static fetch map). Keeps signature verification self-contained.
+ */
+export function makeMultiResolver(didDocuments, fetchProvider) {
+    const didKey = createDidKeyResolver();
+    const didWeb = createDidWebResolver(fetchProvider);
+    return {
+        resolve: async (did) => {
+            const supplied = didDocuments[did];
+            if (supplied) {
+                return supplied;
+            }
+            if (did.startsWith('did:key:')) {
+                return didKey.resolve(did);
+            }
+            if (did.startsWith('did:web:')) {
+                return didWeb.resolve(did);
+            }
+            return null;
+        },
+    };
+}
+export function isUsableEd25519Document(doc) {
+    const vm = doc?.verificationMethod?.[0];
+    const jwk = vm?.publicKeyJwk;
+    return Boolean(jwk && jwk.kty === 'OKP' && jwk.crv === 'Ed25519' && jwk.x);
+}
+export function didWebUrl(did) {
+    if (!did.startsWith('did:web:'))
+        return null;
+    const remainder = did.slice('did:web:'.length);
+    const parts = remainder.split(':').map((p) => decodeURIComponent(p));
+    const domain = parts[0];
+    if (!domain)
+        return null;
+    const path = parts.slice(1);
+    return path.length === 0
+        ? `https://${domain}/.well-known/did.json`
+        : `https://${domain}/${path.join('/')}/did.json`;
+}
+/** Project a vector's loosely-typed JWK into the card layer's `Ed25519PublicJwk`. */
+export function toEd25519PublicJwk(k) {
+    return { kty: 'OKP', crv: 'Ed25519', x: k.x, ...(k.kid ? { kid: k.kid } : {}) };
+}
+/** The DID part of a `did#fragment` key id (`kid.split('#')[0]`), or `''`. */
+export function didOfKid(kid) {
+    return kid ? (kid.split('#')[0] ?? '') : '';
+}
+/**
+ * Resolve a signing key by exact `kid`. Fail-closed per the {@link ResolveKey}
+ * contract: THROW when the `kid` is unresolvable (the verifier records
+ * `key_unresolvable`), never return a prefix match.
+ */
+export function resolveJwksKey(keys, kid) {
+    const key = keys.find((k) => k.kid === kid);
+    if (!key)
+        throw new Error(`no JWKS key resolves kid ${kid}`);
+    return key;
+}
+/**
+ * Wire the PUBLIC card `validateDelegationChain` into an {@link AccountabilityVerifier}:
+ * the edge holds iff the chain attenuates correctly AND `card.responsibleParty ===
+ * issuer(rootVC)` AND the recomputed leaf invoker equals the asserted `proofDid`
+ * (the delegation/proof JOIN). `fresh` mirrors the structural validity.
+ */
+export function makeAccountabilityVerifier(acc) {
+    return async (card) => {
+        const result = validateCardDelegationChain(acc.chain, {
+            resourceOwner: acc.resourceOwner,
+            ...(acc.resource ? { resource: acc.resource } : {}),
+            ...(acc.now !== undefined ? { now: () => acc.now } : {}),
+        });
+        const responsiblePartyOk = card.responsibleParty === result.responsibleParty;
+        const joinOk = acc.proofDid === undefined || result.leafInvoker === acc.proofDid;
+        return { verified: result.ok && responsiblePartyOk && joinOk, fresh: result.ok };
+    };
+}
+export function asMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=adapter-helpers.js.map

package/dist/sidecar/sidecar/src/conformance/reference/adapter-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-helpers.js","sourceRoot":"","sources":["../../../../../../sidecar/src/conformance/reference/adapter-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;EAsBE;AACF,uGAAuG;AACvG;;;;;;;GAOG;AAEH,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GAErB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,uBAAuB,IAAI,2BAA2B,GAIvD,MAAM,kBAAkB,CAAC;AAM1B;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,YAAqC,EACrC,aAA4B;IAE5B,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;IACnD,OAAO;QACL,OAAO,EAAE,KAAK,EAAE,GAAW,EAA+B,EAAE;YAC1D,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,QAAuB,CAAC;YACjC,CAAC;YACD,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC;YACD,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAuB;IAC7D,MAAM,EAAE,GAAG,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,EAAE,EAAE,YAAsE,CAAC;IACvF,OAAO,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC;QACtB,CAAC,CAAC,WAAW,MAAM,uBAAuB;QAC1C,CAAC,CAAC,WAAW,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;AACrD,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,kBAAkB,CAAC,CAAuB;IACxD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAClF,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,QAAQ,CAAC,GAAuB;IAC9C,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAwB,EAAE,GAAW;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,EAAE,CAAC,CAAC;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,GAAkC;IAElC,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;QACpB,MAAM,MAAM,GAAG,2BAA2B,CAAC,GAAG,CAAC,KAAwB,EAAE;YACvE,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,GAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC,CAAC;QACH,MAAM,kBAAkB,GAAG,IAAI,CAAC,gBAAgB,KAAK,MAAM,CAAC,gBAAgB,CAAC;QAC7E,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,GAAG,CAAC,QAAQ,CAAC;QACjF,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,IAAI,kBAAkB,IAAI,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;IACnF,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/sidecar/sidecar/src/conformance/reference/crypto-kit.js

@@ -0,0 +1,101 @@
+/*
+MIT License
+
+Copyright (c) 2026 KYA-OS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+*/
+// Vendored reference harness; see PROVENANCE.json and LICENSE. Public-package import adaptations only.
+/**
+ * Crypto kit shared by the reference adapter and the vector generator.
+ *
+ * Centralizes the Ed25519 VC signing/verification convention
+ * (`Ed25519Signature2020` over RFC 8785 canonicalized VC, minus `proof`) and the
+ * gzip compression StatusList2021 uses, so the generator and the verifier cannot
+ * drift. Pure Node built-ins + the package's public canonicalize/bitstring
+ * primitives — no test-only helpers.
+ */
+import * as zlib from 'node:zlib';
+import { canonicalizeJSON } from '@kya-os/mcp/delegation';
+/** gzip compressor matching StatusList2021's expected encoding. */
+export const conformanceCompressor = {
+    compress(data) {
+        return new Promise((resolve, reject) => {
+            zlib.gzip(Buffer.from(data), (err, result) => err ? reject(err) : resolve(new Uint8Array(result)));
+        });
+    },
+};
+export const conformanceDecompressor = {
+    decompress(data) {
+        return new Promise((resolve, reject) => {
+            zlib.gunzip(Buffer.from(data), (err, result) => err ? reject(err) : resolve(new Uint8Array(result)));
+        });
+    },
+};
+/**
+ * Sign a VC-shaped object (`Ed25519Signature2020`). Strips any existing `proof`,
+ * canonicalizes (RFC 8785), signs with `privateKeyBase64`, and returns the proof
+ * block. This is the exact convention {@link ed25519SignatureVerifier} checks.
+ */
+export async function signVC(crypto, vcWithoutProof, privateKeyBase64, verificationMethod) {
+    const unsigned = { ...vcWithoutProof };
+    delete unsigned['proof'];
+    const canonical = canonicalizeJSON(unsigned);
+    const signature = await crypto.sign(new TextEncoder().encode(canonical), privateKeyBase64);
+    return {
+        type: 'Ed25519Signature2020',
+        created: '2026-01-01T00:00:00.000Z',
+        verificationMethod,
+        proofPurpose: 'assertionMethod',
+        proofValue: Buffer.from(signature).toString('base64url'),
+    };
+}
+/**
+ * Verify the `Ed25519Signature2020` proof a {@link signVC}-produced credential
+ * carries. Wired into {@link DelegationCredentialVerifier} as its
+ * `signatureVerifier`.
+ */
+export function ed25519SignatureVerifier(crypto) {
+    return async (vc, publicKeyJwk) => {
+        try {
+            const jwk = publicKeyJwk;
+            if (!jwk.x) {
+                return { valid: false, reason: 'missing public key x coordinate' };
+            }
+            const publicKeyBase64 = Buffer.from(jwk.x, 'base64url').toString('base64');
+            const unsigned = { ...vc };
+            delete unsigned['proof'];
+            const canonical = canonicalizeJSON(unsigned);
+            const proofValue = vc.proof?.proofValue;
+            if (!proofValue) {
+                return { valid: false, reason: 'missing proofValue' };
+            }
+            const signature = new Uint8Array(Buffer.from(proofValue, 'base64url'));
+            const valid = await crypto.verify(new TextEncoder().encode(canonical), signature, publicKeyBase64);
+            return { valid, reason: valid ? undefined : 'signature verification failed' };
+        }
+        catch (error) {
+            return {
+                valid: false,
+                reason: `verification error: ${error instanceof Error ? error.message : String(error)}`,
+            };
+        }
+    };
+}
+//# sourceMappingURL=crypto-kit.js.map

package/dist/sidecar/sidecar/src/conformance/reference/crypto-kit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-kit.js","sourceRoot":"","sources":["../../../../../../sidecar/src/conformance/reference/crypto-kit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;EAsBE;AACF,uGAAuG;AACvG;;;;;;;;GAQG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAS1D,mEAAmE;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAwB;IACxD,QAAQ,CAAC,IAAgB;QACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAC3C,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CACpD,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAA0B;IAC5D,UAAU,CAAC,IAAgB;QACzB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7C,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CACpD,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,MAA0B,EAC1B,cAAuC,EACvC,gBAAwB,EACxB,kBAA0B;IAE1B,MAAM,QAAQ,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC;IACvC,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC3F,OAAO;QACL,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,0BAA0B;QACnC,kBAAkB;QAClB,YAAY,EAAE,iBAAiB;QAC/B,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;KACzD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAA0B;IAE1B,OAAO,KAAK,EAAE,EAAwB,EAAE,YAAqB,EAAE,EAAE;QAC/D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAA8B,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;YACrE,CAAC;YACD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC3E,MAAM,QAAQ,GAAG,EAAE,GAAI,EAA8B,EAAE,CAAC;YACxD,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;YACzB,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC7C,MAAM,UAAU,GAAG,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC;YACxC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YACxD,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,UAAoB,EAAE,WAAW,CAAC,CAAC,CAAC;YACjF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAC/B,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EACnC,SAAS,EACT,eAAe,CAChB,CAAC;YACF,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B,EAAE,CAAC;QAChF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,uBAAuB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aACxF,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/sidecar/sidecar/src/conformance/reference/reference-adapter.js

@@ -0,0 +1,326 @@
+/*
+MIT License
+
+Copyright (c) 2026 KYA-OS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+*/
+// Vendored reference harness; see PROVENANCE.json and LICENSE. Public-package import adaptations only.
+/**
+ * Reference {@link ConformanceAdapter} for `@kya-os/mcp`: every method delegates
+ * to the package's PUBLIC verify primitives (signed proofs, delegation chains,
+ * status lists, did:key/did:web resolution, and the Entity Card layer) and
+ * re-implements no verification logic — passing the suite here proves the
+ * reference implementation is conformant against the same vectors any other
+ * implementation would run. Standalone helpers live in `./adapter-helpers.ts`.
+ *
+ * All methods are fail-closed: any thrown error or unmet property becomes
+ * `{ outcome: 'fail' }`.
+ */
+import { ProofVerifier, DelegationCredentialVerifier, createDidKeyResolver, createDidWebResolver, MemoryNonceCacheProvider, parseExtensionSettings, requireExtension, } from '@kya-os/mcp';
+import { NodeCryptoProvider } from '@kya-os/mcp/providers';
+import { validateDelegationChain, } from '@kya-os/mcp/delegation';
+import { BitstringManager } from '@kya-os/mcp/delegation';
+import { ClockProvider, FetchProvider } from '@kya-os/mcp/providers';
+// The Entity Card layer (`org.kya-os/proof.v1` + the typed card) lives on the
+// `@kya-os/mcp/card` subpath, NOT the package root — wire its PUBLIC verify
+// primitives here exactly as the legacy ones above (no forked logic).
+import { verifyCardProof as verifyCardProofPrimitive, verifyCard, parseCard, InMemoryNonceCache, } from '@kya-os/mcp/card';
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+import { CryptoProviderAuditHasher, digestAuditEvent, parseAuditProducerEvent, Rfc9162MerkleTree, } from '@kya-os/mcp/audit';
+import { canonicalizeJSON as canonicalizeJson } from '@kya-os/mcp';
+import { conformanceCompressor, conformanceDecompressor, ed25519SignatureVerifier, } from './crypto-kit.js';
+import { asMessage, didOfKid, didWebUrl, isUsableEd25519Document, makeAccountabilityVerifier, makeMultiResolver, resolveJwksKey, toEd25519PublicJwk, } from './adapter-helpers.js';
+const PASS = { outcome: 'pass' };
+function fail(detail) {
+    return { outcome: 'fail', detail };
+}
+/**
+ * `ClockProvider` pinned to a fixed epoch-ms "now" so timestamp-skew vectors are
+ * deterministic regardless of wall-clock time.
+ */
+class PinnedClock extends ClockProvider {
+    constructor(nowMs) {
+        super();
+        this.nowMs = nowMs;
+    }
+    now() {
+        return this.nowMs;
+    }
+    isWithinSkew(timestampMs, skewSeconds) {
+        return Math.abs(this.nowMs - timestampMs) <= skewSeconds * 1000;
+    }
+    hasExpired(expiresAt) {
+        return this.nowMs > expiresAt;
+    }
+    calculateExpiry(ttlSeconds) {
+        return this.nowMs + ttlSeconds * 1000;
+    }
+    format(timestamp) {
+        return new Date(timestamp).toISOString();
+    }
+}
+/**
+ * Offline `FetchProvider` serving DID documents and status lists from in-memory
+ * maps the vector supplies — the harness does no network I/O, so vectors stay
+ * hermetic and reproducible.
+ */
+class StaticFetchProvider extends FetchProvider {
+    constructor(didDocuments = {}, urlBodies = {}) {
+        super();
+        this.didDocuments = didDocuments;
+        this.urlBodies = urlBodies;
+    }
+    async resolveDID(did) {
+        return this.didDocuments[did] ?? null;
+    }
+    async fetchStatusList() {
+        return null;
+    }
+    async fetchDelegationChain() {
+        return [];
+    }
+    async fetch(url) {
+        const body = this.urlBodies[url];
+        if (body === undefined) {
+            return new Response('not found', { status: 404 });
+        }
+        return new Response(JSON.stringify(body), {
+            status: 200,
+            headers: { 'content-type': 'application/json' },
+        });
+    }
+}
+export class ReferenceConformanceAdapter {
+    constructor() {
+        this.name = '@kya-os/mcp (reference)';
+        this.crypto = new NodeCryptoProvider();
+    }
+    async verifySignedProof(input) {
+        try {
+            const verifier = new ProofVerifier({
+                cryptoProvider: this.crypto,
+                clockProvider: new PinnedClock(input.now * 1000),
+                nonceCacheProvider: new MemoryNonceCacheProvider(),
+                fetchProvider: new StaticFetchProvider(),
+                timestampSkewSeconds: input.skewSeconds,
+            });
+            const result = await verifier.verifyProof(input.proof, input.publicKeyJwk, 
+            // Content binding (suite ≥ 1.1.0): when the vector says what the
+            // verifier "received", re-hash it under the proof's own `prf` profile
+            // and compare to the bound hashes.
+            input.expected);
+            return result.valid ? PASS : fail(result.reason ?? 'proof rejected');
+        }
+        catch (error) {
+            return fail(`verifySignedProof threw: ${asMessage(error)}`);
+        }
+    }
+    async verifyDelegationChain(input) {
+        try {
+            const fetchProvider = new StaticFetchProvider(input.didDocuments);
+            const didResolver = makeMultiResolver(input.didDocuments, fetchProvider);
+            const credentialVerifier = new DelegationCredentialVerifier({
+                didResolver,
+                signatureVerifier: ed25519SignatureVerifier(this.crypto),
+            });
+            const verifierPort = {
+                verifyDelegationCredential: (credential, options) => credentialVerifier.verifyDelegationCredential(credential, {
+                    skipStatus: true, // status handled by the dedicated status-list vectors
+                    ...(options?.skipSignature ? { skipSignature: true } : {}),
+                }),
+            };
+            const ancestors = (input.ancestors ?? []);
+            const result = await validateDelegationChain(input.leaf, {
+                serverDid: input.serverDid,
+                verifier: verifierPort,
+                statusListConfigured: false,
+                resolveDelegationChain: ancestors.length > 0
+                    ? async () => [...ancestors, input.leaf]
+                    : undefined,
+            });
+            return result.valid ? PASS : fail(result.reason ?? 'chain rejected');
+        }
+        catch (error) {
+            return fail(`verifyDelegationChain threw: ${asMessage(error)}`);
+        }
+    }
+    async verifyStatusList(input) {
+        try {
+            const credential = input.credential;
+            const status = credential.credentialStatus;
+            if (!status) {
+                return fail('credential has no credentialStatus to verify');
+            }
+            // Status resolver backed by the supplied StatusList2021Credentials, decoded
+            // with the SAME bitstring primitive the manager uses (DRY).
+            const statusListResolver = {
+                checkStatus: async (s) => {
+                    const list = input.statusLists[s.statusListCredential];
+                    if (!list) {
+                        throw new Error(`status list not found: ${s.statusListCredential}`);
+                    }
+                    const manager = await BitstringManager.decode(list.credentialSubject.encodedList, conformanceCompressor, conformanceDecompressor);
+                    return manager.getBit(parseInt(s.statusListIndex, 10));
+                },
+            };
+            const fetchProvider = new StaticFetchProvider(input.didDocuments);
+            const didResolver = makeMultiResolver(input.didDocuments, fetchProvider);
+            const verifier = new DelegationCredentialVerifier({
+                didResolver,
+                statusListResolver,
+                signatureVerifier: ed25519SignatureVerifier(this.crypto),
+            });
+            const result = await verifier.verifyDelegationCredential(credential, {
+                skipCache: true,
+            });
+            return result.valid ? PASS : fail(result.reason ?? 'credential rejected');
+        }
+        catch (error) {
+            return fail(`verifyStatusList threw: ${asMessage(error)}`);
+        }
+    }
+    async resolveDidKey(input) {
+        try {
+            const resolver = createDidKeyResolver();
+            const doc = await resolver.resolve(input.did);
+            return isUsableEd25519Document(doc)
+                ? PASS
+                : fail(`did:key resolution produced no usable verification method for ${input.did}`);
+        }
+        catch (error) {
+            return fail(`resolveDidKey threw: ${asMessage(error)}`);
+        }
+    }
+    async resolveDidWeb(input) {
+        try {
+            // did:web is fetched from its well-known URL; serve the vector's document
+            // there (or nothing, for the not-found negative case).
+            const url = didWebUrl(input.did);
+            const urlBodies = url && input.didDocument !== undefined
+                ? { [url]: input.didDocument }
+                : {};
+            const resolver = createDidWebResolver(new StaticFetchProvider({}, urlBodies));
+            const doc = await resolver.resolve(input.did);
+            return isUsableEd25519Document(doc)
+                ? PASS
+                : fail(`did:web resolution produced no usable verification method for ${input.did}`);
+        }
+        catch (error) {
+            return fail(`resolveDidWeb threw: ${asMessage(error)}`);
+        }
+    }
+    async verifyCardProof(input) {
+        try {
+            const keys = input.jwks.keys.map(toEd25519PublicJwk);
+            // A fresh single-use nonce cache per vector: race-free consume, pinned clock.
+            const nonceCache = new InMemoryNonceCache({ now: () => input.nowMs });
+            const result = await verifyCardProofPrimitive(input.proof, input.request, {
+                resolveKey: (kid) => resolveJwksKey(keys, kid),
+                resolveDidKeys: (did) => keys.filter((k) => didOfKid(k.kid) === did),
+                expectedAudience: input.expectedAudience,
+                // Omit the seam for the nonce-seam-missing vector; the verifier MUST fail closed without it.
+                ...(input.omitNonceSeam ? {} : { consumeNonceIfFresh: nonceCache.consume }),
+                now: () => input.nowMs,
+                skewSec: input.skewSeconds,
+                ...(input.tokenCnfJkt !== undefined ? { tokenCnfJkt: input.tokenCnfJkt } : {}),
+            });
+            return result.ok ? PASS : fail(result.reasons.join(', '));
+        }
+        catch (error) {
+            return fail(`verifyCardProof threw: ${asMessage(error)}`);
+        }
+    }
+    async verifyEntityCard(input) {
+        try {
+            const card = parseCard(input.card); // throws on a malformed card → fail-closed
+            const deps = {
+                ...(input.trustedIssuers ? { trustedIssuers: input.trustedIssuers } : {}),
+                ...(input.cimdKeyProven !== undefined ? { cimdKeyProven: input.cimdKeyProven } : {}),
+                ...(input.accountability
+                    ? { accountabilityVerifier: makeAccountabilityVerifier(input.accountability) }
+                    : {}),
+            };
+            const result = await verifyCard(card, deps);
+            return result.ok
+                ? PASS
+                : fail(`card rejected (level ${result.conformanceLevel})`);
+        }
+        catch (error) {
+            return fail(`verifyEntityCard rejected: ${asMessage(error)}`);
+        }
+    }
+    async verifyAuditIntegrity(input) {
+        try {
+            const hasher = new CryptoProviderAuditHasher(this.crypto);
+            const tree = new Rfc9162MerkleTree(hasher);
+            const event = parseAuditProducerEvent(input.event);
+            const eventValid = canonicalizeJson(event) === input.eventCanonical &&
+                await digestAuditEvent(hasher, event) === input.eventDigest;
+            const canonicalizationValid = input.canonicalization === undefined ||
+                canonicalizeJson(input.canonicalization.value) === input.canonicalization.canonical;
+            const leaves = input.leaves;
+            const root = await tree.root(leaves);
+            const inclusion = await tree.verifyInclusion({
+                leaf: leaves[input.inclusion.leafIndex],
+                leafIndex: input.inclusion.leafIndex,
+                treeSize: leaves.length,
+                root: input.root,
+                auditPath: input.inclusion.auditPath,
+            });
+            const consistency = await tree.verifyConsistency({
+                oldSize: input.consistency.oldSize,
+                newSize: leaves.length,
+                oldRoot: input.consistency.oldRoot,
+                newRoot: input.root,
+                auditPath: input.consistency.auditPath,
+            });
+            return eventValid && canonicalizationValid && root === input.root && inclusion && consistency
+                ? PASS
+                : fail('audit event canonicalization/digest, Merkle root, or proof rejected');
+        }
+        catch (error) {
+            return fail(`verifyAuditIntegrity threw: ${asMessage(error)}`);
+        }
+    }
+    async evaluateNegotiation(input) {
+        try {
+            const serverSettings = parseExtensionSettings(input.serverSettings);
+            if (serverSettings === undefined) {
+                return fail('vector serverSettings are not a valid settings object');
+            }
+            const guard = requireExtension(serverSettings);
+            const params = isRecord(input.request.params) ? input.request.params : undefined;
+            const verdict = guard({
+                meta: params?.['_meta'],
+                method: input.request.method,
+                ...(input.initializeCapabilities !== undefined
+                    ? { initializeCapabilities: input.initializeCapabilities }
+                    : {}),
+            });
+            return verdict.ok
+                ? PASS
+                : fail(`rejected ${verdict.error.code} (${verdict.error.data.reason})`);
+        }
+        catch (error) {
+            return fail(`evaluateNegotiation threw: ${asMessage(error)}`);
+        }
+    }
+}
+//# sourceMappingURL=reference-adapter.js.map

package/dist/sidecar/sidecar/src/conformance/reference/reference-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reference-adapter.js","sourceRoot":"","sources":["../../../../../../sidecar/src/conformance/reference/reference-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;EAsBE;AACF,uGAAuG;AACvG;;;;;;;;;;GAUG;AAEH,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,oBAAoB,EACpB,wBAAwB,EACxB,sBAAsB,EACtB,gBAAgB,GAKjB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EACL,uBAAuB,GAExB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACrE,8EAA8E;AAC9E,4EAA4E;AAC5E,sEAAsE;AACtE,OAAO,EACL,eAAe,IAAI,wBAAwB,EAC3C,UAAU,EACV,SAAS,EACT,kBAAkB,GAEnB,MAAM,kBAAkB,CAAC;AAc1B,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC5I,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,GAElB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gBAAgB,IAAI,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,SAAS,EACT,QAAQ,EACR,SAAS,EACT,uBAAuB,EACvB,0BAA0B,EAC1B,iBAAiB,EACjB,cAAc,EACd,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,IAAI,GAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAChD,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,WAAY,SAAQ,aAAa;IACrC,YAA6B,KAAa;QACxC,KAAK,EAAE,CAAC;QADmB,UAAK,GAAL,KAAK,CAAQ;IAE1C,CAAC;IACD,GAAG;QACD,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IACD,YAAY,CAAC,WAAmB,EAAE,WAAmB;QACnD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,WAAW,GAAG,IAAI,CAAC;IAClE,CAAC;IACD,UAAU,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;IAChC,CAAC;IACD,eAAe,CAAC,UAAkB;QAChC,OAAO,IAAI,CAAC,KAAK,GAAG,UAAU,GAAG,IAAI,CAAC;IACxC,CAAC;IACD,MAAM,CAAC,SAAiB;QACtB,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,mBAAoB,SAAQ,aAAa;IAC7C,YACmB,eAAwC,EAAE,EAC1C,YAAqC,EAAE;QAExD,KAAK,EAAE,CAAC;QAHS,iBAAY,GAAZ,YAAY,CAA8B;QAC1C,cAAS,GAAT,SAAS,CAA8B;IAG1D,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,GAAW;QAC1B,OAAQ,IAAI,CAAC,YAAY,CAAC,GAAG,CAAiB,IAAI,IAAI,CAAC;IACzD,CAAC;IACD,KAAK,CAAC,eAAe;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,oBAAoB;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,GAAW;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;YACxC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,2BAA2B;IAAxC;QACW,SAAI,GAAG,yBAAyB,CAAC;QACzB,WAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAsOrD,CAAC;IApOC,KAAK,CAAC,iBAAiB,CAAC,KAAuB;QAC7C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,aAAa,CAAC;gBACjC,cAAc,EAAE,IAAI,CAAC,MAAM;gBAC3B,aAAa,EAAE,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC;gBAChD,kBAAkB,EAAE,IAAI,wBAAwB,EAAE;gBAClD,aAAa,EAAE,IAAI,mBAAmB,EAAE;gBACxC,oBAAoB,EAAE,KAAK,CAAC,WAAW;aACxC,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CACvC,KAAK,CAAC,KAAoD,EAC1D,KAAK,CAAC,YAA0B;YAChC,iEAAiE;YACjE,sEAAsE;YACtE,mCAAmC;YACnC,KAAK,CAAC,QAAuD,CAC9D,CAAC;YACF,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,gBAAgB,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,4BAA4B,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,KAA2B;QACrD,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,mBAAmB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAClE,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;YAEzE,MAAM,kBAAkB,GAAG,IAAI,4BAA4B,CAAC;gBAC1D,WAAW;gBACX,iBAAiB,EAAE,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC;aACzD,CAAC,CAAC;YACH,MAAM,YAAY,GAAqC;gBACrD,0BAA0B,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAClD,kBAAkB,CAAC,0BAA0B,CAAC,UAAU,EAAE;oBACxD,UAAU,EAAE,IAAI,EAAE,sDAAsD;oBACxE,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3D,CAAC;aACL,CAAC;YAEF,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAA2B,CAAC;YACpE,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAC1C,KAAK,CAAC,IAA4B,EAClC;gBACE,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,YAAY;gBACtB,oBAAoB,EAAE,KAAK;gBAC3B,sBAAsB,EACpB,SAAS,CAAC,MAAM,GAAG,CAAC;oBAClB,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,SAAS,EAAE,KAAK,CAAC,IAA4B,CAAC;oBAChE,CAAC,CAAC,SAAS;aAChB,CACF,CAAC;YACF,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,gBAAgB,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,gCAAgC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAsB;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,KAAK,CAAC,UAAkC,CAAC;YAC5D,MAAM,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC;YAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC,8CAA8C,CAAC,CAAC;YAC9D,CAAC;YAED,4EAA4E;YAC5E,4DAA4D;YAC5D,MAAM,kBAAkB,GAAG;gBACzB,WAAW,EAAE,KAAK,EAAE,CAAmB,EAAoB,EAAE;oBAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAExC,CAAC;oBACd,IAAI,CAAC,IAAI,EAAE,CAAC;wBACV,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC;oBACtE,CAAC;oBACD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAC3C,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAClC,qBAAqB,EACrB,uBAAuB,CACxB,CAAC;oBACF,OAAO,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC;gBACzD,CAAC;aACF,CAAC;YAEF,MAAM,aAAa,GAAG,IAAI,mBAAmB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAClE,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;YACzE,MAAM,QAAQ,GAAG,IAAI,4BAA4B,CAAC;gBAChD,WAAW;gBACX,kBAAkB;gBAClB,iBAAiB,EAAE,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC;aACzD,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,0BAA0B,CAAC,UAAU,EAAE;gBACnE,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,qBAAqB,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,2BAA2B,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAyB;QAC3C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9C,OAAO,uBAAuB,CAAC,GAAG,CAAC;gBACjC,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,IAAI,CAAC,iEAAiE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,wBAAwB,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAyB;QAC3C,IAAI,CAAC;YACH,0EAA0E;YAC1E,uDAAuD;YACvD,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,SAAS,GAAG,GAAG,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;gBACtD,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,WAAW,EAAE;gBAC9B,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,mBAAmB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;YAC9E,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9C,OAAO,uBAAuB,CAAC,GAAG,CAAC;gBACjC,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,IAAI,CAAC,iEAAiE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,wBAAwB,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAqB;QACzC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YACrD,8EAA8E;YAC9E,MAAM,UAAU,GAAG,IAAI,kBAAkB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACtE,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAsB,EAAE;gBACvF,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC;gBAC9C,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC;gBACpE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,6FAA6F;gBAC7F,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;gBAC3E,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK;gBACtB,OAAO,EAAE,KAAK,CAAC,WAAW;gBAC1B,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/E,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,0BAA0B,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAsB;QAC3C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,2CAA2C;YAC/E,MAAM,IAAI,GAAmB;gBAC3B,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpF,GAAG,CAAC,KAAK,CAAC,cAAc;oBACtB,CAAC,CAAC,EAAE,sBAAsB,EAAE,0BAA0B,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE;oBAC9E,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC5C,OAAO,MAAM,CAAC,EAAE;gBACd,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,gBAAgB,GAAG,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,8BAA8B,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,KAA0B;QACnD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1D,MAAM,IAAI,GAAG,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACnD,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,cAAc;gBACjE,MAAM,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,KAAK,CAAC,WAAW,CAAC;YAC9D,MAAM,qBAAqB,GAAG,KAAK,CAAC,gBAAgB,KAAK,SAAS;gBAChE,gBAAgB,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,gBAAgB,CAAC,SAAS,CAAC;YACtF,MAAM,MAAM,GAAG,KAAK,CAAC,MAAkB,CAAC;YACxC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC;gBAC3C,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAE;gBACxC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,SAAS;gBACpC,QAAQ,EAAE,MAAM,CAAC,MAAM;gBACvB,IAAI,EAAE,KAAK,CAAC,IAAc;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,SAAqB;aACjD,CAAC,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC;gBAC/C,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,OAAO;gBAClC,OAAO,EAAE,MAAM,CAAC,MAAM;gBACtB,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,OAAiB;gBAC5C,OAAO,EAAE,KAAK,CAAC,IAAc;gBAC7B,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,SAAqB;aACnD,CAAC,CAAC;YACH,OAAO,UAAU,IAAI,qBAAqB,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,SAAS,IAAI,WAAW;gBAC3F,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,+BAA+B,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAAuB;QAC/C,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,sBAAsB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YACpE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO,IAAI,CAAC,uDAAuD,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YACjF,MAAM,OAAO,GAAG,KAAK,CAAC;gBACpB,IAAI,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC;gBACvB,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;gBAC5B,GAAG,CAAC,KAAK,CAAC,sBAAsB,KAAK,SAAS;oBAC5C,CAAC,CAAC,EAAE,sBAAsB,EAAE,KAAK,CAAC,sBAAsB,EAAE;oBAC1D,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;YACH,OAAO,OAAO,CAAC,EAAE;gBACf,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,8BAA8B,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;CACF"}