@kya-os/mcp 1.16.2 → 1.18.0

package/dist/audit/verifier.d.ts

@@ -1,11 +1,13 @@
 import { type AuditHasher, type AuditSignatureVerifier } from './crypto.js';
-import type { AuditVerificationDimension, AuditObservationReceiptV1, AuditVerificationPolicyV1, AuditVerificationReportV1, SignedAuditCheckpointV1, SignedAuditEntryV1 } from './types.js';
+import type { AuditVerificationDimension, AuditObservationReceiptV1, AuditVerificationPolicyV1, AuditVerificationReportV1, SignedAuditCheckpointV1, SignedAuditEntryV1, SignerRef } from './types.js';
 export declare const AUDIT_REASON_CODES: Readonly<{
     readonly NOT_EVALUATED: "AUDIT_NOT_EVALUATED";
     readonly SCHEMA_INVALID: "AUDIT_SCHEMA_INVALID";
     readonly UNSUPPORTED_SUITE: "AUDIT_UNSUPPORTED_SUITE";
     readonly UNSUPPORTED_ALGORITHM: "AUDIT_UNSUPPORTED_ALGORITHM";
     readonly UNTRUSTED_RECORDER: "AUDIT_UNTRUSTED_RECORDER";
+    readonly KEY_BOUNDARY_UNRESOLVED: "AUDIT_KEY_BOUNDARY_UNRESOLVED";
+    readonly KEY_NOT_CURRENT: "AUDIT_KEY_NOT_CURRENT";
     readonly SIGNATURE_INVALID: "AUDIT_SIGNATURE_INVALID";
     readonly EVENT_DIGEST_MISMATCH: "AUDIT_EVENT_DIGEST_MISMATCH";
     readonly EVIDENCE_MANIFEST_DIGEST_MISMATCH: "AUDIT_EVIDENCE_MANIFEST_DIGEST_MISMATCH";
@@ -23,12 +25,14 @@ export declare const AUDIT_REASON_CODES: Readonly<{
     readonly CHECKPOINT_CHAIN_MISMATCH: "AUDIT_CHECKPOINT_CHAIN_MISMATCH";
     readonly CHECKPOINT_FORK_DETECTED: "AUDIT_CHECKPOINT_FORK_DETECTED";
     readonly MERKLE_PROOF_INVALID: "AUDIT_MERKLE_PROOF_INVALID";
+    readonly MERKLE_PROOF_MISSING: "AUDIT_MERKLE_PROOF_MISSING";
     readonly OBSERVER_EVIDENCE_MISSING: "AUDIT_OBSERVER_EVIDENCE_MISSING";
     readonly OBSERVATION_DIGEST_MISMATCH: "AUDIT_OBSERVATION_DIGEST_MISMATCH";
     readonly OBSERVATION_SIGNATURE_INVALID: "AUDIT_OBSERVATION_SIGNATURE_INVALID";
     readonly OBSERVATION_SCOPE_MISMATCH: "AUDIT_OBSERVATION_SCOPE_MISMATCH";
     readonly UNTRUSTED_OBSERVER: "AUDIT_UNTRUSTED_OBSERVER";
     readonly OBSERVATION_STALE: "AUDIT_OBSERVATION_STALE";
+    readonly OBSERVATION_FUTURE_DATED: "AUDIT_OBSERVATION_FUTURE_DATED";
     readonly OBSERVATION_CHAIN_MISMATCH: "AUDIT_OBSERVATION_CHAIN_MISMATCH";
     readonly UNTRUSTED_SUPPORTING_ANCHOR: "AUDIT_UNTRUSTED_SUPPORTING_ANCHOR";
     readonly SUPPORTING_ANCHOR_INVALID: "AUDIT_SUPPORTING_ANCHOR_INVALID";
@@ -44,16 +48,41 @@ export declare const AUDIT_REASON_CODES: Readonly<{
     readonly BUNDLE_SELECTION_INCOMPLETE: "AUDIT_BUNDLE_SELECTION_INCOMPLETE";
     readonly VERIFICATION_POLICY_MISMATCH: "AUDIT_VERIFICATION_POLICY_MISMATCH";
     readonly VERIFICATION_POLICY_INVALID: "AUDIT_VERIFICATION_POLICY_INVALID";
+    readonly REQUIRED_PROFILE_UNMET: "AUDIT_REQUIRED_PROFILE_UNMET";
     readonly EXPLICITLY_REDACTED: "AUDIT_EXPLICITLY_REDACTED";
     readonly EXPLICITLY_DISPOSED: "AUDIT_EXPLICITLY_DISPOSED";
     readonly EXPLICITLY_UNAVAILABLE: "AUDIT_EXPLICITLY_UNAVAILABLE";
 }>;
+/**
+ * Marks every dimension the policy's `requiredAuditProfile` depends on as
+ * invalid unless it is `valid`: AAP-1 needs cryptographic integrity, AAP-2
+ * adds chain integrity, AAP-3 adds checkpoint integrity, and AAP-4 adds
+ * observation integrity backed by a supporting anchor receipt.
+ */
+export declare function applyRequiredAuditProfile(report: AuditVerificationReportV1, policy: AuditVerificationPolicyV1, evidence?: {
+    supportingAnchors: boolean;
+}): AuditVerificationReportV1;
 export interface AuditArtifactVerifierOptions {
     hasher: AuditHasher;
     signatures: AuditSignatureVerifier;
     verifiedAt?: () => number;
+    /** How far an observation may be dated ahead of `verifiedAt` (default 120 s). */
+    maxClockSkewMs?: number;
     authorization?: AuditAuthorizationVerifier;
 }
+/** Supporting artifacts that let a verifier resolve checkpoint-bounded key validity. */
+export interface AuditVerificationContext {
+    /** Checkpoints that policy `validFromCheckpoint`/`validUntilCheckpoint` digests may name. */
+    checkpoints?: readonly SignedAuditCheckpointV1[];
+}
+/** Artifacts whose signing keys a verification relied on. */
+export interface AuditSignedArtifacts {
+    entries?: readonly SignedAuditEntryV1[];
+    checkpoints?: readonly SignedAuditCheckpointV1[];
+    observations?: readonly AuditObservationReceiptV1[];
+    /** The exporter that signed a replay-bundle manifest. */
+    exporter?: SignerRef;
+}
 /** Optional collateral verifier kept separate from structural/cryptographic verification. */
 export interface AuditAuthorizationVerifier {
     verifyAsObserved(entries: readonly SignedAuditEntryV1[], policy: AuditVerificationPolicyV1): Promise<AuditVerificationDimension>;
@@ -63,11 +92,34 @@ export interface AuditAuthorizationVerifier {
 export declare class AuditArtifactVerifier {
     private readonly options;
     constructor(options: AuditArtifactVerifierOptions);
-    verifyEntries(entries: readonly unknown[], policy: AuditVerificationPolicyV1 | unknown): Promise<AuditVerificationReportV1>;
-    verifyCheckpoint(checkpoint: SignedAuditCheckpointV1, entries: readonly SignedAuditEntryV1[], policy: AuditVerificationPolicyV1): Promise<AuditVerificationDimension>;
-    verifyObservation(checkpoint: SignedAuditCheckpointV1, receipt: AuditObservationReceiptV1, policy: AuditVerificationPolicyV1): Promise<AuditVerificationDimension>;
+    verifyEntries(entries: readonly unknown[], policy: AuditVerificationPolicyV1 | unknown, context?: AuditVerificationContext): Promise<AuditVerificationReportV1>;
+    /**
+     * Evaluates the `current` and `both` key revocation modes: whether every key
+     * these artifacts were signed with is still valid at `verifiedAt`. The
+     * as-observed check, at signing time and ledger position, stays in the
+     * integrity dimensions under every mode, because revocation does not rewrite
+     * what was observed; this result belongs in `currentAuthorization`, which the
+     * report keeps separate from it. Returns `undefined` under `as_observed`, and
+     * `indeterminate` when the verifier has no `verifiedAt` clock.
+     */
+    verifyCurrentKeys(policy: AuditVerificationPolicyV1, artifacts: AuditSignedArtifacts): AuditVerificationDimension | undefined;
+    /** Verifies a checkpoint and recomputes its root from the complete journal prefix. */
+    verifyCheckpoint(checkpoint: SignedAuditCheckpointV1, entries: readonly SignedAuditEntryV1[], policy: AuditVerificationPolicyV1, context?: AuditVerificationContext): Promise<AuditVerificationDimension>;
+    /**
+     * Verifies a checkpoint's schema, suite, issuer trust, digest, signature, and
+     * declared range without its leaves. It proves only what the recorder
+     * signed; entries are bound to it separately by inclusion proofs.
+     */
+    verifySignedCheckpoint(checkpoint: SignedAuditCheckpointV1, policy: AuditVerificationPolicyV1, context?: AuditVerificationContext): Promise<AuditVerificationDimension>;
+    verifyObservation(checkpoint: SignedAuditCheckpointV1, receipt: AuditObservationReceiptV1, policy: AuditVerificationPolicyV1, context?: AuditVerificationContext): Promise<AuditVerificationDimension>;
+    private checkSignedCheckpoint;
+    /**
+     * Indexes candidate checkpoints by their recomputed digest. A policy names a
+     * boundary by digest, which commits to the checkpoint core, so a matching
+     * core authenticates the boundary's ledger epoch and tree size by itself.
+     */
+    private boundaries;
     private verifyEntry;
     private verifyChainPosition;
 }
 export declare function mergeAuditDimensions(...values: readonly AuditVerificationDimension[]): AuditVerificationDimension;
-//# sourceMappingURL=verifier.d.ts.map

package/dist/audit/verifier.js

@@ -9,6 +9,8 @@ export const AUDIT_REASON_CODES = Object.freeze({
     UNSUPPORTED_SUITE: 'AUDIT_UNSUPPORTED_SUITE',
     UNSUPPORTED_ALGORITHM: 'AUDIT_UNSUPPORTED_ALGORITHM',
     UNTRUSTED_RECORDER: 'AUDIT_UNTRUSTED_RECORDER',
+    KEY_BOUNDARY_UNRESOLVED: 'AUDIT_KEY_BOUNDARY_UNRESOLVED',
+    KEY_NOT_CURRENT: 'AUDIT_KEY_NOT_CURRENT',
     SIGNATURE_INVALID: 'AUDIT_SIGNATURE_INVALID',
     EVENT_DIGEST_MISMATCH: 'AUDIT_EVENT_DIGEST_MISMATCH',
     EVIDENCE_MANIFEST_DIGEST_MISMATCH: 'AUDIT_EVIDENCE_MANIFEST_DIGEST_MISMATCH',
@@ -26,12 +28,14 @@ export const AUDIT_REASON_CODES = Object.freeze({
     CHECKPOINT_CHAIN_MISMATCH: 'AUDIT_CHECKPOINT_CHAIN_MISMATCH',
     CHECKPOINT_FORK_DETECTED: 'AUDIT_CHECKPOINT_FORK_DETECTED',
     MERKLE_PROOF_INVALID: 'AUDIT_MERKLE_PROOF_INVALID',
+    MERKLE_PROOF_MISSING: 'AUDIT_MERKLE_PROOF_MISSING',
     OBSERVER_EVIDENCE_MISSING: 'AUDIT_OBSERVER_EVIDENCE_MISSING',
     OBSERVATION_DIGEST_MISMATCH: 'AUDIT_OBSERVATION_DIGEST_MISMATCH',
     OBSERVATION_SIGNATURE_INVALID: 'AUDIT_OBSERVATION_SIGNATURE_INVALID',
     OBSERVATION_SCOPE_MISMATCH: 'AUDIT_OBSERVATION_SCOPE_MISMATCH',
     UNTRUSTED_OBSERVER: 'AUDIT_UNTRUSTED_OBSERVER',
     OBSERVATION_STALE: 'AUDIT_OBSERVATION_STALE',
+    OBSERVATION_FUTURE_DATED: 'AUDIT_OBSERVATION_FUTURE_DATED',
     OBSERVATION_CHAIN_MISMATCH: 'AUDIT_OBSERVATION_CHAIN_MISMATCH',
     UNTRUSTED_SUPPORTING_ANCHOR: 'AUDIT_UNTRUSTED_SUPPORTING_ANCHOR',
     SUPPORTING_ANCHOR_INVALID: 'AUDIT_SUPPORTING_ANCHOR_INVALID',
@@ -47,13 +51,35 @@ export const AUDIT_REASON_CODES = Object.freeze({
     BUNDLE_SELECTION_INCOMPLETE: 'AUDIT_BUNDLE_SELECTION_INCOMPLETE',
     VERIFICATION_POLICY_MISMATCH: 'AUDIT_VERIFICATION_POLICY_MISMATCH',
     VERIFICATION_POLICY_INVALID: 'AUDIT_VERIFICATION_POLICY_INVALID',
+    REQUIRED_PROFILE_UNMET: 'AUDIT_REQUIRED_PROFILE_UNMET',
     EXPLICITLY_REDACTED: 'AUDIT_EXPLICITLY_REDACTED',
     EXPLICITLY_DISPOSED: 'AUDIT_EXPLICITLY_DISPOSED',
     EXPLICITLY_UNAVAILABLE: 'AUDIT_EXPLICITLY_UNAVAILABLE',
 });
+/** Reasons that mean "not decidable from the supplied collateral", never "wrong". */
+const INDETERMINATE_REASONS = new Set([
+    AUDIT_REASON_CODES.NOT_EVALUATED,
+    AUDIT_REASON_CODES.KEY_BOUNDARY_UNRESOLVED,
+]);
+/** Matches the proof verifier's default timestamp tolerance. */
+const DEFAULT_MAX_CLOCK_SKEW_MS = 120_000;
+/** Dimensions each audit assurance profile requires to be `valid`, in level order. */
+const PROFILE_DIMENSIONS = [
+    'cryptographicIntegrity',
+    'chainIntegrity',
+    'checkpointIntegrity',
+    'anchorIntegrity',
+];
 function dimension(verdict, reasonCodes = []) {
     return { verdict, reasonCodes: [...new Set(reasonCodes)].sort() };
 }
+function verdictOf(reasons) {
+    if (reasons.size === 0)
+        return 'valid';
+    return [...reasons].every((reason) => INDETERMINATE_REASONS.has(reason))
+        ? 'indeterminate'
+        : 'invalid';
+}
 function sameSigner(left, right) {
     return left.did === right.did && left.kid === right.kid && left.alg === right.alg;
 }
@@ -61,6 +87,58 @@ function keyIsValidAt(policy, at) {
     return (policy.validFrom === undefined || at >= policy.validFrom) &&
         (policy.validUntil === undefined || at <= policy.validUntil);
 }
+/**
+ * Checkpoint bounds place an artifact by the tree size it first appears in:
+ * `sequence + 1` for an entry, `treeSize` for a checkpoint or an observation.
+ * A key valid until checkpoint C covers positions up to C's tree size; a key
+ * valid from C covers positions after it. A boundary that is missing, or
+ * belongs to another ledger epoch, cannot place the artifact.
+ */
+function positionWithin(bounds, ledger, position, boundaries) {
+    const resolve = (digest) => {
+        if (digest === undefined)
+            return undefined;
+        const boundary = boundaries.get(digest);
+        return boundary?.ledgerId === ledger.ledgerId &&
+            boundary.ledgerEpochId === ledger.ledgerEpochId
+            ? boundary.treeSize
+            : null;
+    };
+    const from = resolve(bounds.validFromCheckpoint);
+    const until = resolve(bounds.validUntilCheckpoint);
+    if ((typeof from === 'bigint' && position <= from) ||
+        (typeof until === 'bigint' && position > until))
+        return 'outside';
+    return from === null || until === null ? 'unresolved' : 'within';
+}
+function strictest(...values) {
+    if (values.includes('outside'))
+        return 'outside';
+    return values.includes('unresolved') ? 'unresolved' : 'within';
+}
+function keyTrust(keys, signer, at, ledger, position, boundaries, epochBounds = {}) {
+    const epoch = positionWithin(epochBounds, ledger, position, boundaries);
+    let best = 'outside';
+    for (const key of keys) {
+        if (!sameSigner(key.signer, signer) || !keyIsValidAt(key, at))
+            continue;
+        const status = strictest(epoch, positionWithin(key, ledger, position, boundaries));
+        if (status === 'within')
+            return status;
+        if (status === 'unresolved')
+            best = status;
+    }
+    return best;
+}
+/**
+ * Whether the policy still lists the signer as valid at `now`. A checkpoint
+ * bound names a checkpoint that already exists, so a key valid only until one
+ * has been retired, while one valid from one has already started.
+ */
+function keyIsCurrent(keys, signer, now) {
+    return keys.some((key) => sameSigner(key.signer, signer) && keyIsValidAt(key, now) &&
+        key.validUntilCheckpoint === undefined);
+}
 function exactJson(left, right) {
     try {
         return canonicalizeJson(left) === canonicalizeJson(right);
@@ -87,17 +165,41 @@ function invalidPolicyReport(policy) {
         currentAuthorization: dimension('indeterminate', [AUDIT_REASON_CODES.NOT_EVALUATED]),
     };
 }
+/**
+ * Marks every dimension the policy's `requiredAuditProfile` depends on as
+ * invalid unless it is `valid`: AAP-1 needs cryptographic integrity, AAP-2
+ * adds chain integrity, AAP-3 adds checkpoint integrity, and AAP-4 adds
+ * observation integrity backed by a supporting anchor receipt.
+ */
+export function applyRequiredAuditProfile(report, policy, evidence = { supportingAnchors: false }) {
+    if (policy.requiredAuditProfile === undefined)
+        return report;
+    const level = Number(policy.requiredAuditProfile.slice(-1));
+    const result = { ...report };
+    for (const name of PROFILE_DIMENSIONS.slice(0, level)) {
+        const unmet = report[name].verdict !== 'valid' ||
+            (name === 'anchorIntegrity' && !evidence.supportingAnchors);
+        if (unmet) {
+            result[name] = dimension('invalid', [
+                ...report[name].reasonCodes,
+                AUDIT_REASON_CODES.REQUIRED_PROFILE_UNMET,
+            ]);
+        }
+    }
+    return result;
+}
 /** Pure historical verifier. It never reads live nonce state or applies current freshness. */
 export class AuditArtifactVerifier {
     options;
     constructor(options) {
         this.options = options;
     }
-    async verifyEntries(entries, policy) {
+    async verifyEntries(entries, policy, context = {}) {
         if (!auditVerificationPolicySchema.safeParse(policy).success) {
             return invalidPolicyReport(policy);
         }
         const verificationPolicy = policy;
+        const boundaries = await this.boundaries(context.checkpoints ?? []);
         const cryptoReasons = new Set();
         const chainReasons = new Set();
         const validatedEntries = [];
@@ -113,7 +215,7 @@ export class AuditArtifactVerifier {
             }
             const entry = parsed.data;
             const index = validatedEntries.length;
-            await this.verifyEntry(entry, verificationPolicy, cryptoReasons);
+            await this.verifyEntry(entry, verificationPolicy, boundaries, cryptoReasons);
             this.verifyChainPosition(entry, validatedEntries[index - 1], index, chainReasons);
             validatedEntries.push(entry);
         }
@@ -133,48 +235,57 @@ export class AuditArtifactVerifier {
                 this.options.authorization.verifyAsObserved(validatedEntries, verificationPolicy),
                 this.options.authorization.verifyCurrent(validatedEntries, verificationPolicy),
             ]);
-        return {
+        const currentKeys = this.verifyCurrentKeys(verificationPolicy, { entries: validatedEntries });
+        return applyRequiredAuditProfile({
             schema: 'https://schema.kya-os.org/v1/protocol/audit/verification-report/v1.0.0',
             policyId: verificationPolicy.policyId,
             ...(this.options.verifiedAt === undefined ? {} : { verifiedAt: this.options.verifiedAt() }),
-            cryptographicIntegrity: dimension(cryptoReasons.size === 0 && entries.length > 0 ? 'valid' : 'invalid', cryptoReasons),
+            cryptographicIntegrity: dimension(entries.length > 0 ? verdictOf(cryptoReasons) : 'invalid', cryptoReasons),
             chainIntegrity: dimension(chainReasons.size === 0 && entries.length > 0 ? 'valid' : 'invalid', chainReasons),
             checkpointIntegrity: dimension('indeterminate', [AUDIT_REASON_CODES.CHECKPOINT_MISSING]),
             anchorIntegrity: dimension('indeterminate', [AUDIT_REASON_CODES.OBSERVER_EVIDENCE_MISSING]),
             scopeEvidenceCompleteness: dimension(entries.length > 0 ? 'indeterminate' : 'invalid', [AUDIT_REASON_CODES.NOT_EVALUATED]),
             authorizedAsObserved,
-            currentAuthorization,
-        };
+            currentAuthorization: currentKeys === undefined
+                ? currentAuthorization
+                : mergeAuditDimensions(currentAuthorization, currentKeys),
+        }, verificationPolicy);
     }
-    async verifyCheckpoint(checkpoint, entries, policy) {
-        const reasons = new Set();
-        if (!auditVerificationPolicySchema.safeParse(policy).success) {
-            return dimension('invalid', [AUDIT_REASON_CODES.VERIFICATION_POLICY_INVALID]);
-        }
-        const parsedCheckpoint = signedAuditCheckpointSchema.safeParse(checkpoint);
-        if (!parsedCheckpoint.success) {
-            return dimension('invalid', [AUDIT_REASON_CODES.SCHEMA_INVALID]);
-        }
-        const validated = parsedCheckpoint.data;
-        const core = validated.core;
-        if (!policy.acceptedIntegritySuites.includes(core.integritySuite)) {
-            reasons.add(AUDIT_REASON_CODES.UNSUPPORTED_SUITE);
-        }
-        if (!policy.acceptedAlgorithms.includes(core.issuer.alg)) {
-            reasons.add(AUDIT_REASON_CODES.UNSUPPORTED_ALGORITHM);
-        }
-        const epochPolicy = policy.trustedLedgerEpochs.find((candidate) => candidate.ledgerId === core.ledgerId &&
-            candidate.ledgerEpochId === core.ledgerEpochId);
-        if (!epochPolicy?.recorderKeys.some((candidate) => sameSigner(candidate.signer, core.issuer) && keyIsValidAt(candidate, core.createdAt))) {
-            reasons.add(AUDIT_REASON_CODES.UNTRUSTED_RECORDER);
-        }
-        const expectedDigest = await hashAuditValue(this.options.hasher, AUDIT_DIGEST_DOMAINS.checkpoint, core);
-        if (expectedDigest !== validated.checkpointDigest) {
-            reasons.add(AUDIT_REASON_CODES.CHECKPOINT_DIGEST_MISMATCH);
-        }
-        if (!(await this.options.signatures.verify(canonicalizeJsonBytes(core), validated.jws, core.issuer))) {
-            reasons.add(AUDIT_REASON_CODES.CHECKPOINT_SIGNATURE_INVALID);
-        }
+    /**
+     * Evaluates the `current` and `both` key revocation modes: whether every key
+     * these artifacts were signed with is still valid at `verifiedAt`. The
+     * as-observed check, at signing time and ledger position, stays in the
+     * integrity dimensions under every mode, because revocation does not rewrite
+     * what was observed; this result belongs in `currentAuthorization`, which the
+     * report keeps separate from it. Returns `undefined` under `as_observed`, and
+     * `indeterminate` when the verifier has no `verifiedAt` clock.
+     */
+    verifyCurrentKeys(policy, artifacts) {
+        if (policy.keyRevocationMode === 'as_observed')
+            return undefined;
+        const now = this.options.verifiedAt?.();
+        if (now === undefined)
+            return dimension('indeterminate', [AUDIT_REASON_CODES.NOT_EVALUATED]);
+        const recorderKeys = (ledger) => policy.trustedLedgerEpochs.find((candidate) => candidate.ledgerId === ledger.ledgerId &&
+            candidate.ledgerEpochId === ledger.ledgerEpochId)?.recorderKeys ?? [];
+        const current = [
+            ...(artifacts.entries ?? []).map((entry) => keyIsCurrent(recorderKeys(entry.core), entry.core.recorder, now)),
+            ...(artifacts.checkpoints ?? []).map((checkpoint) => keyIsCurrent(recorderKeys(checkpoint.core), checkpoint.core.issuer, now)),
+            ...(artifacts.observations ?? []).map((receipt) => keyIsCurrent(policy.trustedObservers, receipt.core.observer, now)),
+            ...(artifacts.exporter === undefined
+                ? []
+                : [keyIsCurrent(policy.authorizedExporters.flatMap((exporter) => exporter.signerKeys), artifacts.exporter, now)]),
+        ];
+        return current.every(Boolean)
+            ? dimension('valid')
+            : dimension('invalid', [AUDIT_REASON_CODES.KEY_NOT_CURRENT]);
+    }
+    /** Verifies a checkpoint and recomputes its root from the complete journal prefix. */
+    async verifyCheckpoint(checkpoint, entries, policy, context = {}) {
+        const checked = await this.checkSignedCheckpoint(checkpoint, policy, context);
+        if (checked.kind === 'rejected')
+            return checked.result;
+        const { core, reasons } = checked;
         const expectedSize = Number(core.treeSize);
         const first = entries[0];
         const last = entries[entries.length - 1];
@@ -193,11 +304,26 @@ export class AuditArtifactVerifier {
             if (root !== core.rootDigest)
                 reasons.add(AUDIT_REASON_CODES.CHECKPOINT_ROOT_MISMATCH);
         }
-        return dimension(reasons.size === 0 ? 'valid' : 'invalid', reasons);
+        return dimension(verdictOf(reasons), reasons);
     }
-    async verifyObservation(checkpoint, receipt, policy) {
+    /**
+     * Verifies a checkpoint's schema, suite, issuer trust, digest, signature, and
+     * declared range without its leaves. It proves only what the recorder
+     * signed; entries are bound to it separately by inclusion proofs.
+     */
+    async verifySignedCheckpoint(checkpoint, policy, context = {}) {
+        const checked = await this.checkSignedCheckpoint(checkpoint, policy, context);
+        if (checked.kind === 'rejected')
+            return checked.result;
+        const { core, reasons } = checked;
+        if (core.firstSequence !== '0' ||
+            BigInt(core.lastSequence) + 1n !== BigInt(core.treeSize)) {
+            reasons.add(AUDIT_REASON_CODES.CHECKPOINT_RANGE_MISMATCH);
+        }
+        return dimension(verdictOf(reasons), reasons);
+    }
+    async verifyObservation(checkpoint, receipt, policy, context = {}) {
         const reasons = new Set();
-        let freshnessIndeterminate = false;
         if (!auditVerificationPolicySchema.safeParse(policy).success) {
             return dimension('invalid', [AUDIT_REASON_CODES.VERIFICATION_POLICY_INVALID]);
         }
@@ -222,15 +348,23 @@ export class AuditArtifactVerifier {
         if (!policy.acceptedAlgorithms.includes(core.observer.alg)) {
             reasons.add(AUDIT_REASON_CODES.UNSUPPORTED_ALGORITHM);
         }
-        if (!policy.trustedObservers.some((candidate) => sameSigner(candidate.signer, core.observer) &&
-            keyIsValidAt(candidate, core.observedAt))) {
+        const boundaries = await this.boundaries([
+            ...(context.checkpoints ?? []),
+            validatedCheckpoint,
+        ]);
+        const trust = keyTrust(policy.trustedObservers, core.observer, core.observedAt, core, BigInt(core.treeSize), boundaries);
+        if (trust === 'outside')
             reasons.add(AUDIT_REASON_CODES.UNTRUSTED_OBSERVER);
-        }
+        if (trust === 'unresolved')
+            reasons.add(AUDIT_REASON_CODES.KEY_BOUNDARY_UNRESOLVED);
         if (policy.requiredCheckpointFreshnessMs !== undefined) {
             const now = this.options.verifiedAt?.();
             if (now === undefined) {
                 reasons.add(AUDIT_REASON_CODES.NOT_EVALUATED);
-                freshnessIndeterminate = true;
+            }
+            else if (core.observedAt > now + (this.options.maxClockSkewMs ?? DEFAULT_MAX_CLOCK_SKEW_MS)) {
+                // A future-dated observation would otherwise count as perfectly fresh.
+                reasons.add(AUDIT_REASON_CODES.OBSERVATION_FUTURE_DATED);
             }
             else if (now - core.observedAt > policy.requiredCheckpointFreshnessMs) {
                 reasons.add(AUDIT_REASON_CODES.OBSERVATION_STALE);
@@ -243,11 +377,67 @@ export class AuditArtifactVerifier {
         if (!(await this.options.signatures.verify(canonicalizeJsonBytes(core), validatedReceipt.jws, core.observer))) {
             reasons.add(AUDIT_REASON_CODES.OBSERVATION_SIGNATURE_INVALID);
         }
-        const onlyIndeterminate = freshnessIndeterminate &&
-            [...reasons].every((reason) => reason === AUDIT_REASON_CODES.NOT_EVALUATED);
-        return dimension(reasons.size === 0 ? 'valid' : onlyIndeterminate ? 'indeterminate' : 'invalid', reasons);
+        return dimension(verdictOf(reasons), reasons);
+    }
+    async checkSignedCheckpoint(checkpoint, policy, context) {
+        if (!auditVerificationPolicySchema.safeParse(policy).success) {
+            return {
+                kind: 'rejected',
+                result: dimension('invalid', [AUDIT_REASON_CODES.VERIFICATION_POLICY_INVALID]),
+            };
+        }
+        const parsedCheckpoint = signedAuditCheckpointSchema.safeParse(checkpoint);
+        if (!parsedCheckpoint.success) {
+            return {
+                kind: 'rejected',
+                result: dimension('invalid', [AUDIT_REASON_CODES.SCHEMA_INVALID]),
+            };
+        }
+        const reasons = new Set();
+        const validated = parsedCheckpoint.data;
+        const core = validated.core;
+        if (!policy.acceptedIntegritySuites.includes(core.integritySuite)) {
+            reasons.add(AUDIT_REASON_CODES.UNSUPPORTED_SUITE);
+        }
+        if (!policy.acceptedAlgorithms.includes(core.issuer.alg)) {
+            reasons.add(AUDIT_REASON_CODES.UNSUPPORTED_ALGORITHM);
+        }
+        const epochPolicy = policy.trustedLedgerEpochs.find((candidate) => candidate.ledgerId === core.ledgerId &&
+            candidate.ledgerEpochId === core.ledgerEpochId);
+        const trust = keyTrust(epochPolicy?.recorderKeys ?? [], core.issuer, core.createdAt, core, BigInt(core.treeSize), await this.boundaries([...(context.checkpoints ?? []), validated]), epochPolicy);
+        if (trust === 'outside')
+            reasons.add(AUDIT_REASON_CODES.UNTRUSTED_RECORDER);
+        if (trust === 'unresolved')
+            reasons.add(AUDIT_REASON_CODES.KEY_BOUNDARY_UNRESOLVED);
+        const expectedDigest = await hashAuditValue(this.options.hasher, AUDIT_DIGEST_DOMAINS.checkpoint, core);
+        if (expectedDigest !== validated.checkpointDigest) {
+            reasons.add(AUDIT_REASON_CODES.CHECKPOINT_DIGEST_MISMATCH);
+        }
+        if (!(await this.options.signatures.verify(canonicalizeJsonBytes(core), validated.jws, core.issuer))) {
+            reasons.add(AUDIT_REASON_CODES.CHECKPOINT_SIGNATURE_INVALID);
+        }
+        return { kind: 'checked', core, reasons };
+    }
+    /**
+     * Indexes candidate checkpoints by their recomputed digest. A policy names a
+     * boundary by digest, which commits to the checkpoint core, so a matching
+     * core authenticates the boundary's ledger epoch and tree size by itself.
+     */
+    async boundaries(checkpoints) {
+        const result = new Map();
+        for (const candidate of checkpoints) {
+            if (!signedAuditCheckpointSchema.safeParse(candidate).success)
+                continue;
+            const core = candidate.core;
+            result.set(await hashAuditValue(this.options.hasher, AUDIT_DIGEST_DOMAINS.checkpoint, core), {
+                ledgerId: core.ledgerId,
+                ledgerEpochId: core.ledgerEpochId,
+                treeSize: BigInt(core.treeSize),
+            });
+        }
+        return result;
     }
-    async verifyEntry(entry, policy, reasons) {
+    async verifyEntry(entry, policy, boundaries, reasons) {
         if (!policy.acceptedIntegritySuites.includes(entry.core.integritySuite)) {
             reasons.add(AUDIT_REASON_CODES.UNSUPPORTED_SUITE);
         }
@@ -256,10 +446,11 @@ export class AuditArtifactVerifier {
         }
         const epochPolicy = policy.trustedLedgerEpochs.find((candidate) => candidate.ledgerId === entry.core.ledgerId &&
             candidate.ledgerEpochId === entry.core.ledgerEpochId);
-        const trustedKey = epochPolicy?.recorderKeys.find((candidate) => sameSigner(candidate.signer, entry.core.recorder) &&
-            keyIsValidAt(candidate, entry.core.recordedAt));
-        if (trustedKey === undefined)
+        const trust = keyTrust(epochPolicy?.recorderKeys ?? [], entry.core.recorder, entry.core.recordedAt, entry.core, BigInt(entry.core.sequence) + 1n, boundaries, epochPolicy);
+        if (trust === 'outside')
             reasons.add(AUDIT_REASON_CODES.UNTRUSTED_RECORDER);
+        if (trust === 'unresolved')
+            reasons.add(AUDIT_REASON_CODES.KEY_BOUNDARY_UNRESOLVED);
         const eventDigest = await digestAuditEvent(this.options.hasher, entry.core.event);
         if (eventDigest !== entry.core.eventDigest || eventDigest !== entry.eventDigest) {
             reasons.add(AUDIT_REASON_CODES.EVENT_DIGEST_MISMATCH);

package/dist/audit/verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../src/audit/verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACrF,OAAO,EAAE,cAAc,EAAiD,MAAM,aAAa,CAAC;AAC5F,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,gBAAgB,EAChB,2BAA2B,EAC3B,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAYtB,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9C,aAAa,EAAE,qBAAqB;IACpC,cAAc,EAAE,sBAAsB;IACtC,iBAAiB,EAAE,yBAAyB;IAC5C,qBAAqB,EAAE,6BAA6B;IACpD,kBAAkB,EAAE,0BAA0B;IAC9C,iBAAiB,EAAE,yBAAyB;IAC5C,qBAAqB,EAAE,6BAA6B;IACpD,iCAAiC,EAAE,yCAAyC;IAC5E,qBAAqB,EAAE,6BAA6B;IACpD,gBAAgB,EAAE,wBAAwB;IAC1C,qBAAqB,EAAE,6BAA6B;IACpD,YAAY,EAAE,oBAAoB;IAClC,oBAAoB,EAAE,4BAA4B;IAClD,eAAe,EAAE,uBAAuB;IACxC,kBAAkB,EAAE,0BAA0B;IAC9C,0BAA0B,EAAE,kCAAkC;IAC9D,4BAA4B,EAAE,oCAAoC;IAClE,wBAAwB,EAAE,gCAAgC;IAC1D,yBAAyB,EAAE,iCAAiC;IAC5D,yBAAyB,EAAE,iCAAiC;IAC5D,wBAAwB,EAAE,gCAAgC;IAC1D,oBAAoB,EAAE,4BAA4B;IAClD,yBAAyB,EAAE,iCAAiC;IAC5D,2BAA2B,EAAE,mCAAmC;IAChE,6BAA6B,EAAE,qCAAqC;IACpE,0BAA0B,EAAE,kCAAkC;IAC9D,kBAAkB,EAAE,0BAA0B;IAC9C,iBAAiB,EAAE,yBAAyB;IAC5C,0BAA0B,EAAE,kCAAkC;IAC9D,2BAA2B,EAAE,mCAAmC;IAChE,yBAAyB,EAAE,iCAAiC;IAC5D,8BAA8B,EAAE,sCAAsC;IACtE,qCAAqC,EAAE,6CAA6C;IACpF,mCAAmC,EAAE,2CAA2C;IAChF,qBAAqB,EAAE,6BAA6B;IACpD,+BAA+B,EAAE,uCAAuC;IACxE,wBAAwB,EAAE,gCAAgC;IAC1D,4BAA4B,EAAE,oCAAoC;IAClE,yBAAyB,EAAE,iCAAiC;IAC5D,gCAAgC,EAAE,wCAAwC;IAC1E,2BAA2B,EAAE,mCAAmC;IAChE,4BAA4B,EAAE,oCAAoC;IAClE,2BAA2B,EAAE,mCAAmC;IAChE,mBAAmB,EAAE,2BAA2B;IAChD,mBAAmB,EAAE,2BAA2B;IAChD,sBAAsB,EAAE,8BAA8B;CAC9C,CAAC,CAAC;AAEZ,SAAS,SAAS,CAChB,OAA8C,EAC9C,cAAgC,EAAE;IAElC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,UAAU,CAAC,IAAe,EAAE,KAAgB;IACnD,OAAO,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC;AACpF,CAAC;AAED,SAAS,YAAY,CAAC,MAAgC,EAAE,EAAU;IAChE,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC;QAC/D,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,SAAS,CAAC,IAAa,EAAE,KAAc;IAC9C,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAe;IAC1C,MAAM,QAAQ,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAC5D,OAAQ,MAAiC,CAAC,QAAQ,KAAK,QAAQ;QAC/D,CAAC,CAAE,MAA+B,CAAC,QAAQ;QAC3C,CAAC,CAAC,gBAAgB,CAAC;IACrB,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAC,CAAC;IACvF,OAAO;QACL,MAAM,EAAE,wEAAwE;QAChF,QAAQ;QACR,sBAAsB,EAAE,OAAO;QAC/B,cAAc,EAAE,OAAO;QACvB,mBAAmB,EAAE,OAAO;QAC5B,eAAe,EAAE,OAAO;QACxB,yBAAyB,EAAE,OAAO;QAClC,oBAAoB,EAAE,SAAS,CAAC,eAAe,EAAE,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QACpF,oBAAoB,EAAE,SAAS,CAAC,eAAe,EAAE,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;KACrF,CAAC;AACJ,CAAC;AAqBD,8FAA8F;AAC9F,MAAM,OAAO,qBAAqB;IACH;IAA7B,YAA6B,OAAqC;QAArC,YAAO,GAAP,OAAO,CAA8B;IAAG,CAAC;IAEtE,KAAK,CAAC,aAAa,CACjB,OAA2B,EAC3B,MAA2C;QAE3C,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;YAC7D,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,kBAAkB,GAAG,MAAmC,CAAC;QAC/D,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QACxC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;QACvC,MAAM,gBAAgB,GAAyB,EAAE,CAAC;QAElD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAC;QACnE,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,OAAO,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,aAAa,CAAC,GAAG,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;gBACrD,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;gBACpD,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAA0B,CAAC;YAChD,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC;YACtC,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,kBAAkB,EAAE,aAAa,CAAC,CAAC;YACjE,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;YAClF,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,IAAI,CAChD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CACxD,CAAC;QACF,MAAM,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,GAChD,IAAI,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;YACtC,CAAC,CAAC;gBACE,SAAS,CAAC,eAAe,EAAE;oBACzB,oBAAoB;wBAClB,CAAC,CAAC,kBAAkB,CAAC,qCAAqC;wBAC1D,CAAC,CAAC,kBAAkB,CAAC,8BAA8B;iBACtD,CAAC;gBACF,SAAS,CAAC,eAAe,EAAE;oBACzB,kBAAkB,CAAC,mCAAmC;iBACvD,CAAC;aACH;YACH,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC;gBAChB,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;gBACjF,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;aAC/E,CAAC,CAAC;QACT,OAAO;YACL,MAAM,EAAE,wEAAwE;YAChF,QAAQ,EAAE,kBAAkB,CAAC,QAAQ;YACrC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;YAC3F,sBAAsB,EAAE,SAAS,CAC/B,aAAa,CAAC,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EACpE,aAAa,CACd;YACD,cAAc,EAAE,SAAS,CACvB,YAAY,CAAC,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EACnE,YAAY,CACb;YACD,mBAAmB,EAAE,SAAS,CAAC,eAAe,EAAE,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;YACxF,eAAe,EAAE,SAAS,CAAC,eAAe,EAAE,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAC;YAC3F,yBAAyB,EAAE,SAAS,CAClC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,EAChD,CAAC,kBAAkB,CAAC,aAAa,CAAC,CACnC;YACD,oBAAoB;YACpB,oBAAoB;SACrB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,UAAmC,EACnC,OAAsC,EACtC,MAAiC;QAEjC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;YAC7D,OAAO,SAAS,CAAC,SAAS,EAAE,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC3E,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC,SAAS,EAAE,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAA+B,CAAC;QACnE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YAClE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAChE,SAAS,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;YACpC,SAAS,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa,CAAC,CAAC;QAClD,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAChD,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACxF,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,cAAc,CACzC,IAAI,CAAC,OAAO,CAAC,MAAM,EACnB,oBAAoB,CAAC,UAAU,EAC/B,IAAI,CACL,CAAC;QACF,IAAI,cAAc,KAAK,SAAS,CAAC,gBAAgB,EAAE,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CACxC,qBAAqB,CAAC,IAAI,CAAC,EAC3B,SAAS,CAAC,GAAG,EACb,IAAI,CAAC,MAAM,CACZ,CAAC,EAAE,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC;YACrC,YAAY,KAAK,OAAO,CAAC,MAAM;YAC/B,KAAK,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,aAAa;YAC3C,IAAI,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,YAAY;YACzC,IAAI,EAAE,WAAW,KAAK,IAAI,CAAC,eAAe;YAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBAC3D,KAAK,CAAC,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACrD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;iBAC1D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YACnD,IAAI,IAAI,KAAK,IAAI,CAAC,UAAU;gBAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,SAAS,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,UAAmC,EACnC,OAAkC,EAClC,MAAiC;QAEjC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,IAAI,sBAAsB,GAAG,KAAK,CAAC;QACnC,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;YAC7D,OAAO,SAAS,CAAC,SAAS,EAAE,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC3E,MAAM,aAAa,GAAG,6BAA6B,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,gBAAgB,CAAC,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YACxD,OAAO,SAAS,CAAC,SAAS,EAAE,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,IAA+B,CAAC;QAC7E,MAAM,gBAAgB,GAAG,aAAa,CAAC,IAAiC,CAAC;QACzE,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC;QACnC,IAAI,IAAI,CAAC,MAAM;YACb,gEAAgE,EAAE,CAAC;YACnE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,mBAAmB,CAAC,IAAI,CAAC,QAAQ;YACrD,IAAI,CAAC,aAAa,KAAK,mBAAmB,CAAC,IAAI,CAAC,aAAa;YAC7D,IAAI,CAAC,gBAAgB,KAAK,mBAAmB,CAAC,gBAAgB;YAC9D,IAAI,CAAC,QAAQ,KAAK,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC9C,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;YAC3C,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,MAAM,CAAC,6BAA6B,KAAK,SAAS,EAAE,CAAC;YACvD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;YACxC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;gBAC9C,sBAAsB,GAAG,IAAI,CAAC;YAChC,CAAC;iBAAM,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,6BAA6B,EAAE,CAAC;gBACxE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,IAAI,CAAC,OAAO,CAAC,MAAM,EACnB,oBAAoB,CAAC,WAAW,EAChC,IAAI,CACL,CAAC;QACF,IAAI,MAAM,KAAK,gBAAgB,CAAC,iBAAiB,EAAE,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CACxC,qBAAqB,CAAC,IAAI,CAAC,EAC3B,gBAAgB,CAAC,GAAG,EACpB,IAAI,CAAC,QAAQ,CACd,CAAC,EAAE,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,6BAA6B,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,iBAAiB,GAAG,sBAAsB;YAC9C,CAAC,GAAG,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,kBAAkB,CAAC,aAAa,CAAC,CAAC;QAC9E,OAAO,SAAS,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC5G,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,KAAyB,EACzB,MAAiC,EACjC,OAAoB;QAEpB,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACxE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACjE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAChE,SAAS,CAAC,QAAQ,KAAK,KAAK,CAAC,IAAI,CAAC,QAAQ;YAC1C,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,WAAW,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC9D,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;YACjD,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAClD,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;QAEjF,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClF,IAAI,WAAW,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,WAAW,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;YAChF,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,2BAA2B,CACtD,IAAI,CAAC,OAAO,CAAC,MAAM,EACnB,KAAK,CAAC,IAAI,CAAC,KAAK,CACjB,CAAC;QACF,IAAI,cAAc,KAAK,KAAK,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,iCAAiC,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5E,IAAI,WAAW,KAAK,KAAK,CAAC,WAAW;YAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;QAE7F,MAAM,eAAe,GAAG,6BAA6B,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACrF,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CACxC,qBAAqB,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,EACjD,KAAK,CAAC,eAAe,CAAC,GAAG,EACzB,KAAK,CAAC,IAAI,CAAC,QAAQ,CACpB,CAAC,EAAE,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAEO,mBAAmB,CACzB,KAAyB,EACzB,QAAwC,EACxC,KAAa,EACb,OAAoB;QAEpB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;gBAChC,IAAI,KAAK,CAAC,IAAI,CAAC,mBAAmB,KAAK,IAAI;oBACzC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,KAAK,sBAAsB,EAAE,CAAC;oBACxD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;iBAAM,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;gBAClE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;YACvD,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,CAAC,QAAQ;YAChD,KAAK,CAAC,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC;gBACxE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,mBAAmB,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,oBAAoB,CAClC,GAAG,MAA6C;IAEhD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,wEAAwE;QACxE,OAAO,SAAS,CAAC,eAAe,EAAE,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC;QACjE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;IACnF,OAAO,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;AAC1E,CAAC"}
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../src/audit/verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACrF,OAAO,EAAE,cAAc,EAAiD,MAAM,aAAa,CAAC;AAC5F,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,gBAAgB,EAChB,2BAA2B,EAC3B,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAetB,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9C,aAAa,EAAE,qBAAqB;IACpC,cAAc,EAAE,sBAAsB;IACtC,iBAAiB,EAAE,yBAAyB;IAC5C,qBAAqB,EAAE,6BAA6B;IACpD,kBAAkB,EAAE,0BAA0B;IAC9C,uBAAuB,EAAE,+BAA+B;IACxD,eAAe,EAAE,uBAAuB;IACxC,iBAAiB,EAAE,yBAAyB;IAC5C,qBAAqB,EAAE,6BAA6B;IACpD,iCAAiC,EAAE,yCAAyC;IAC5E,qBAAqB,EAAE,6BAA6B;IACpD,gBAAgB,EAAE,wBAAwB;IAC1C,qBAAqB,EAAE,6BAA6B;IACpD,YAAY,EAAE,oBAAoB;IAClC,oBAAoB,EAAE,4BAA4B;IAClD,eAAe,EAAE,uBAAuB;IACxC,kBAAkB,EAAE,0BAA0B;IAC9C,0BAA0B,EAAE,kCAAkC;IAC9D,4BAA4B,EAAE,oCAAoC;IAClE,wBAAwB,EAAE,gCAAgC;IAC1D,yBAAyB,EAAE,iCAAiC;IAC5D,yBAAyB,EAAE,iCAAiC;IAC5D,wBAAwB,EAAE,gCAAgC;IAC1D,oBAAoB,EAAE,4BAA4B;IAClD,oBAAoB,EAAE,4BAA4B;IAClD,yBAAyB,EAAE,iCAAiC;IAC5D,2BAA2B,EAAE,mCAAmC;IAChE,6BAA6B,EAAE,qCAAqC;IACpE,0BAA0B,EAAE,kCAAkC;IAC9D,kBAAkB,EAAE,0BAA0B;IAC9C,iBAAiB,EAAE,yBAAyB;IAC5C,wBAAwB,EAAE,gCAAgC;IAC1D,0BAA0B,EAAE,kCAAkC;IAC9D,2BAA2B,EAAE,mCAAmC;IAChE,yBAAyB,EAAE,iCAAiC;IAC5D,8BAA8B,EAAE,sCAAsC;IACtE,qCAAqC,EAAE,6CAA6C;IACpF,mCAAmC,EAAE,2CAA2C;IAChF,qBAAqB,EAAE,6BAA6B;IACpD,+BAA+B,EAAE,uCAAuC;IACxE,wBAAwB,EAAE,gCAAgC;IAC1D,4BAA4B,EAAE,oCAAoC;IAClE,yBAAyB,EAAE,iCAAiC;IAC5D,gCAAgC,EAAE,wCAAwC;IAC1E,2BAA2B,EAAE,mCAAmC;IAChE,4BAA4B,EAAE,oCAAoC;IAClE,2BAA2B,EAAE,mCAAmC;IAChE,sBAAsB,EAAE,8BAA8B;IACtD,mBAAmB,EAAE,2BAA2B;IAChD,mBAAmB,EAAE,2BAA2B;IAChD,sBAAsB,EAAE,8BAA8B;CAC9C,CAAC,CAAC;AAEZ,qFAAqF;AACrF,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IACzD,kBAAkB,CAAC,aAAa;IAChC,kBAAkB,CAAC,uBAAuB;CAC3C,CAAC,CAAC;AAEH,gEAAgE;AAChE,MAAM,yBAAyB,GAAG,OAAO,CAAC;AAE1C,sFAAsF;AACtF,MAAM,kBAAkB,GAAG;IACzB,wBAAwB;IACxB,gBAAgB;IAChB,qBAAqB;IACrB,iBAAiB;CACT,CAAC;AAEX,SAAS,SAAS,CAChB,OAA8C,EAC9C,cAAgC,EAAE;IAElC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,SAAS,CAAC,OAA4B;IAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACvC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtE,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,IAAe,EAAE,KAAgB;IACnD,OAAO,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC;AACpF,CAAC;AAED,SAAS,YAAY,CAAC,MAAgC,EAAE,EAAU;IAChE,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC;QAC/D,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC;AACjE,CAAC;AAeD;;;;;;GAMG;AACH,SAAS,cAAc,CACrB,MAAwB,EACxB,MAAsB,EACtB,QAAgB,EAChB,UAAgC;IAEhC,MAAM,OAAO,GAAG,CAAC,MAA0B,EAA6B,EAAE;QACxE,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3C,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,OAAO,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAC,QAAQ;YAC3C,QAAQ,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;YAC/C,CAAC,CAAC,QAAQ,CAAC,QAAQ;YACnB,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,QAAQ,IAAI,IAAI,CAAC;QAChD,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,GAAG,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,OAAO,IAAI,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnE,CAAC;AAED,SAAS,SAAS,CAAC,GAAG,MAAqB;IACzC,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,OAAO,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC;AACjE,CAAC;AAED,SAAS,QAAQ,CACf,IAAyC,EACzC,MAAiB,EACjB,EAAU,EACV,MAAsB,EACtB,QAAgB,EAChB,UAAgC,EAChC,cAAgC,EAAE;IAElC,MAAM,KAAK,GAAG,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxE,IAAI,IAAI,GAAgB,SAAS,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC;YAAE,SAAS;QACxE,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;QACnF,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC;QACvC,IAAI,MAAM,KAAK,YAAY;YAAE,IAAI,GAAG,MAAM,CAAC;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CACnB,IAAyC,EACzC,MAAiB,EACjB,GAAW;IAEX,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC;QAChF,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,SAAS,CAAC,IAAa,EAAE,KAAc;IAC9C,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAe;IAC1C,MAAM,QAAQ,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAC5D,OAAQ,MAAiC,CAAC,QAAQ,KAAK,QAAQ;QAC/D,CAAC,CAAE,MAA+B,CAAC,QAAQ;QAC3C,CAAC,CAAC,gBAAgB,CAAC;IACrB,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAC,CAAC;IACvF,OAAO;QACL,MAAM,EAAE,wEAAwE;QAChF,QAAQ;QACR,sBAAsB,EAAE,OAAO;QAC/B,cAAc,EAAE,OAAO;QACvB,mBAAmB,EAAE,OAAO;QAC5B,eAAe,EAAE,OAAO;QACxB,yBAAyB,EAAE,OAAO;QAClC,oBAAoB,EAAE,SAAS,CAAC,eAAe,EAAE,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QACpF,oBAAoB,EAAE,SAAS,CAAC,eAAe,EAAE,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;KACrF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAiC,EACjC,MAAiC,EACjC,WAA2C,EAAE,iBAAiB,EAAE,KAAK,EAAE;IAEvE,IAAI,MAAM,CAAC,oBAAoB,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO;YAC5C,CAAC,IAAI,KAAK,iBAAiB,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QAC9D,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,SAAS,EAAE;gBAClC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW;gBAC3B,kBAAkB,CAAC,sBAAsB;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AA0CD,8FAA8F;AAC9F,MAAM,OAAO,qBAAqB;IACH;IAA7B,YAA6B,OAAqC;QAArC,YAAO,GAAP,OAAO,CAA8B;IAAG,CAAC;IAEtE,KAAK,CAAC,aAAa,CACjB,OAA2B,EAC3B,MAA2C,EAC3C,UAAoC,EAAE;QAEtC,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;YAC7D,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,kBAAkB,GAAG,MAAmC,CAAC;QAC/D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QACpE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QACxC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;QACvC,MAAM,gBAAgB,GAAyB,EAAE,CAAC;QAElD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAC;QACnE,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,OAAO,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,aAAa,CAAC,GAAG,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;gBACrD,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;gBACpD,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAA0B,CAAC;YAChD,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC;YACtC,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;YAC7E,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;YAClF,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,IAAI,CAChD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CACxD,CAAC;QACF,MAAM,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,GAChD,IAAI,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;YACtC,CAAC,CAAC;gBACE,SAAS,CAAC,eAAe,EAAE;oBACzB,oBAAoB;wBAClB,CAAC,CAAC,kBAAkB,CAAC,qCAAqC;wBAC1D,CAAC,CAAC,kBAAkB,CAAC,8BAA8B;iBACtD,CAAC;gBACF,SAAS,CAAC,eAAe,EAAE;oBACzB,kBAAkB,CAAC,mCAAmC;iBACvD,CAAC;aACH;YACH,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC;gBAChB,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;gBACjF,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;aAC/E,CAAC,CAAC;QACT,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC9F,OAAO,yBAAyB,CAAC;YAC/B,MAAM,EAAE,wEAAwE;YAChF,QAAQ,EAAE,kBAAkB,CAAC,QAAQ;YACrC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;YAC3F,sBAAsB,EAAE,SAAS,CAC/B,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,EACzD,aAAa,CACd;YACD,cAAc,EAAE,SAAS,CACvB,YAAY,CAAC,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EACnE,YAAY,CACb;YACD,mBAAmB,EAAE,SAAS,CAAC,eAAe,EAAE,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;YACxF,eAAe,EAAE,SAAS,CAAC,eAAe,EAAE,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAC;YAC3F,yBAAyB,EAAE,SAAS,CAClC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,EAChD,CAAC,kBAAkB,CAAC,aAAa,CAAC,CACnC;YACD,oBAAoB;YACpB,oBAAoB,EAAE,WAAW,KAAK,SAAS;gBAC7C,CAAC,CAAC,oBAAoB;gBACtB,CAAC,CAAC,oBAAoB,CAAC,oBAAoB,EAAE,WAAW,CAAC;SAC5D,EAAE,kBAAkB,CAAC,CAAC;IACzB,CAAC;IAED;;;;;;;;OAQG;IACH,iBAAiB,CACf,MAAiC,EACjC,SAA+B;QAE/B,IAAI,MAAM,CAAC,iBAAiB,KAAK,aAAa;YAAE,OAAO,SAAS,CAAC;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;QACxC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC,eAAe,EAAE,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC;QAC7F,MAAM,YAAY,GAAG,CAAC,MAAsB,EAAuC,EAAE,CACnF,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC5C,SAAS,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;YACtC,SAAS,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa,CAAC,EAAE,YAAY,IAAI,EAAE,CAAC;QAC1E,MAAM,OAAO,GAAG;YACd,GAAG,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACzC,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACnE,GAAG,CAAC,SAAS,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAClD,YAAY,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC3E,GAAG,CAAC,SAAS,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAChD,YAAY,CAAC,MAAM,CAAC,gBAAgB,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACpE,GAAG,CAAC,SAAS,CAAC,QAAQ,KAAK,SAAS;gBAClC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,YAAY,CACX,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EACrE,SAAS,CAAC,QAAQ,EAClB,GAAG,CACJ,CAAC,CAAC;SACR,CAAC;QACF,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YAC3B,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC;YACpB,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,sFAAsF;IACtF,KAAK,CAAC,gBAAgB,CACpB,UAAmC,EACnC,OAAsC,EACtC,MAAiC,EACjC,UAAoC,EAAE;QAEtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9E,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC;QACvD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAElC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC;YACrC,YAAY,KAAK,OAAO,CAAC,MAAM;YAC/B,KAAK,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,aAAa;YAC3C,IAAI,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,YAAY;YACzC,IAAI,EAAE,WAAW,KAAK,IAAI,CAAC,eAAe;YAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBAC3D,KAAK,CAAC,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACrD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;iBAC1D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YACnD,IAAI,IAAI,KAAK,IAAI,CAAC,UAAU;gBAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,sBAAsB,CAC1B,UAAmC,EACnC,MAAiC,EACjC,UAAoC,EAAE;QAEtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9E,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC;QACvD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAClC,IAAI,IAAI,CAAC,aAAa,KAAK,GAAG;YAC5B,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,UAAmC,EACnC,OAAkC,EAClC,MAAiC,EACjC,UAAoC,EAAE;QAEtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;YAC7D,OAAO,SAAS,CAAC,SAAS,EAAE,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC3E,MAAM,aAAa,GAAG,6BAA6B,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,gBAAgB,CAAC,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YACxD,OAAO,SAAS,CAAC,SAAS,EAAE,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,IAA+B,CAAC;QAC7E,MAAM,gBAAgB,GAAG,aAAa,CAAC,IAAiC,CAAC;QACzE,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC;QACnC,IAAI,IAAI,CAAC,MAAM;YACb,gEAAgE,EAAE,CAAC;YACnE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,mBAAmB,CAAC,IAAI,CAAC,QAAQ;YACrD,IAAI,CAAC,aAAa,KAAK,mBAAmB,CAAC,IAAI,CAAC,aAAa;YAC7D,IAAI,CAAC,gBAAgB,KAAK,mBAAmB,CAAC,gBAAgB;YAC9D,IAAI,CAAC,QAAQ,KAAK,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC;YACvC,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;YAC9B,mBAAmB;SACpB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,CACpB,MAAM,CAAC,gBAAgB,EACvB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,UAAU,EACf,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EACrB,UAAU,CACX,CAAC;QACF,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;QAC5E,IAAI,KAAK,KAAK,YAAY;YAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;QACpF,IAAI,MAAM,CAAC,6BAA6B,KAAK,SAAS,EAAE,CAAC;YACvD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;YACxC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;YAChD,CAAC;iBAAM,IAAI,IAAI,CAAC,UAAU,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,yBAAyB,CAAC,EAAE,CAAC;gBAC9F,uEAAuE;gBACvE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAC;YAC3D,CAAC;iBAAM,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,6BAA6B,EAAE,CAAC;gBACxE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,IAAI,CAAC,OAAO,CAAC,MAAM,EACnB,oBAAoB,CAAC,WAAW,EAChC,IAAI,CACL,CAAC;QACF,IAAI,MAAM,KAAK,gBAAgB,CAAC,iBAAiB,EAAE,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CACxC,qBAAqB,CAAC,IAAI,CAAC,EAC3B,gBAAgB,CAAC,GAAG,EACpB,IAAI,CAAC,QAAQ,CACd,CAAC,EAAE,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,6BAA6B,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,UAAmC,EACnC,MAAiC,EACjC,OAAiC;QAEjC,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;YAC7D,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAC;aAC/E,CAAC;QACJ,CAAC;QACD,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC3E,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;aAClE,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAA+B,CAAC;QACnE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YAClE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAChE,SAAS,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;YACpC,SAAS,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,QAAQ,CACpB,WAAW,EAAE,YAAY,IAAI,EAAE,EAC/B,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,SAAS,EACd,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EACrB,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,EAClE,WAAW,CACZ,CAAC;QACF,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;QAC5E,IAAI,KAAK,KAAK,YAAY;YAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;QAEpF,MAAM,cAAc,GAAG,MAAM,cAAc,CACzC,IAAI,CAAC,OAAO,CAAC,MAAM,EACnB,oBAAoB,CAAC,UAAU,EAC/B,IAAI,CACL,CAAC;QACF,IAAI,cAAc,KAAK,SAAS,CAAC,gBAAgB,EAAE,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CACxC,qBAAqB,CAAC,IAAI,CAAC,EAC3B,SAAS,CAAC,GAAG,EACb,IAAI,CAAC,MAAM,CACZ,CAAC,EAAE,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC5C,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,UAAU,CACtB,WAA+B;QAE/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;QACrD,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;YACpC,IAAI,CAAC,2BAA2B,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,OAAO;gBAAE,SAAS;YACxE,MAAM,IAAI,GAAI,SAAqC,CAAC,IAAI,CAAC;YACzD,MAAM,CAAC,GAAG,CACR,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,EAChF;gBACE,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;aAChC,CACF,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,KAAyB,EACzB,MAAiC,EACjC,UAAgC,EAChC,OAAoB;QAEpB,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACxE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACjE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAChE,SAAS,CAAC,QAAQ,KAAK,KAAK,CAAC,IAAI,CAAC,QAAQ;YAC1C,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,QAAQ,CACpB,WAAW,EAAE,YAAY,IAAI,EAAE,EAC/B,KAAK,CAAC,IAAI,CAAC,QAAQ,EACnB,KAAK,CAAC,IAAI,CAAC,UAAU,EACrB,KAAK,CAAC,IAAI,EACV,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,EAChC,UAAU,EACV,WAAW,CACZ,CAAC;QACF,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;QAC5E,IAAI,KAAK,KAAK,YAAY;YAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;QAEpF,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClF,IAAI,WAAW,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,WAAW,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;YAChF,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,2BAA2B,CACtD,IAAI,CAAC,OAAO,CAAC,MAAM,EACnB,KAAK,CAAC,IAAI,CAAC,KAAK,CACjB,CAAC;QACF,IAAI,cAAc,KAAK,KAAK,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,iCAAiC,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5E,IAAI,WAAW,KAAK,KAAK,CAAC,WAAW;YAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;QAE7F,MAAM,eAAe,GAAG,6BAA6B,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACrF,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CACxC,qBAAqB,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,EACjD,KAAK,CAAC,eAAe,CAAC,GAAG,EACzB,KAAK,CAAC,IAAI,CAAC,QAAQ,CACpB,CAAC,EAAE,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAEO,mBAAmB,CACzB,KAAyB,EACzB,QAAwC,EACxC,KAAa,EACb,OAAoB;QAEpB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;gBAChC,IAAI,KAAK,CAAC,IAAI,CAAC,mBAAmB,KAAK,IAAI;oBACzC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,KAAK,sBAAsB,EAAE,CAAC;oBACxD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;iBAAM,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;gBAClE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;YACvD,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,CAAC,QAAQ;YAChD,KAAK,CAAC,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC;gBACxE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,mBAAmB,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,oBAAoB,CAClC,GAAG,MAA6C;IAEhD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,wEAAwE;QACxE,OAAO,SAAS,CAAC,eAAe,EAAE,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC;QACjE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;IACnF,OAAO,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;AAC1E,CAAC"}

package/dist/auth/handshake.d.ts

@@ -39,6 +39,12 @@ export interface AuthHandshakeConfig {
     };
     authorization: {
         authorizationUrl: string;
+        /**
+         * Fallback lifetime in milliseconds for the challenge's advertised
+         * `expiresAt`, used only when the token store cannot report the expiry of
+         * the token it just created. The store's own expiry is advertised otherwise,
+         * so the challenge never outlives its token.
+         */
         resumeTokenTtl?: number;
         /**
          * How to handle agents with no reputation history (404 from reputation
@@ -100,6 +106,12 @@ export declare class MemoryResumeTokenStore implements ResumeTokenStore {
     } | null>;
     fulfill(token: string): Promise<void>;
     clear(): void;
+    /**
+     * Every token gets the same TTL, so insertion order is expiry order: drop
+     * from the front until the first live token. Each token is dropped once, so
+     * the cost is amortized constant per create().
+     */
+    private sweepExpired;
 }
 /**
  * Verify agent delegation or return authorization hints.
@@ -116,4 +128,3 @@ export declare class MemoryResumeTokenStore implements ResumeTokenStore {
  */
 export declare function verifyOrHints(agentDid: string, scopes: string[], config: AuthHandshakeConfig): Promise<VerifyOrHintsResult>;
 export declare function hasSensitiveScopes(scopes: string[]): boolean;
-//# sourceMappingURL=handshake.d.ts.map