@kya-os/mcp 1.6.1 → 1.9.0

package/dist/delegation/index.js

@@ -6,6 +6,7 @@
  */
 export * from './vc-issuer.js';
 export * from './vc-verifier.js';
+export * from './vc-jwt-verify.js';
 export * from './bitstring.js';
 export * from './statuslist-manager.js';
 export * from './delegation-graph.js';
@@ -17,8 +18,10 @@ export * from './audience-validator.js';
 export * from './scope-matcher.js';
 export * from './holder-binding.js';
 export * from './chain-enforcement.js';
+export * from './did-resolver-registry.js';
 export { createDidKeyResolver, resolveDidKeySync, isEd25519DidKey, extractPublicKeyFromDidKey, publicKeyToJwk, } from './did-key-resolver.js';
 export { DidWebResolver, createDidWebResolver, isDidWeb, parseDidWeb, didWebToUrl, buildDidWebDocument, } from './did-web-resolver.js';
+export { verifyDidLinkage, } from './did-linkage.js';
 export { MemoryStatusListStorage } from './storage/memory-statuslist-storage.js';
 export { MemoryDelegationGraphStorage } from './storage/memory-graph-storage.js';
 //# sourceMappingURL=index.js.map

package/dist/delegation/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,EACX,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,EACX,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,gBAAgB,GAGjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC"}

package/dist/delegation/statuslist-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"statuslist-manager.d.ts","sourceRoot":"","sources":["../../src/delegation/statuslist-manager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,wBAAwB,EACxB,gBAAgB,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAoB,KAAK,mBAAmB,EAAE,KAAK,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACxG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGxD,MAAM,WAAW,yBAAyB;IACxC,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAAC;IAC9E,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,IAAI,MAAM,CAAC;IACjB,QAAQ,IAAI,MAAM,CAAC;CACpB;AAED,qBAAa,qBAAqB;IAO9B,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,eAAe;IACvB,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,YAAY;IAVtB,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,eAAe,CAAS;IAChC,yFAAyF;IACzF,OAAO,CAAC,WAAW,CAAoC;gBAG7C,OAAO,EAAE,yBAAyB,EAClC,QAAQ,EAAE,0BAA0B,EACpC,eAAe,EAAE,iBAAiB,EAClC,UAAU,EAAE,mBAAmB,EAC/B,YAAY,EAAE,qBAAqB,EAC3C,OAAO,CAAC,EAAE;QACR,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B;IAMG,mBAAmB,CAAC,OAAO,EAAE,YAAY,GAAG,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAkBpF,YAAY,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;YAezE,cAAc;IA6CtB,WAAW,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBjE,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAelD,sBAAsB;IAgDpC,oBAAoB,IAAI,MAAM;IAI9B,kBAAkB,IAAI,MAAM;CAG7B;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,yBAAyB,EAClC,QAAQ,EAAE,0BAA0B,EACpC,eAAe,EAAE,iBAAiB,EAClC,UAAU,EAAE,mBAAmB,EAC/B,YAAY,EAAE,qBAAqB,EACnC,OAAO,CAAC,EAAE;IACR,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GACA,qBAAqB,CASvB"}
+{"version":3,"file":"statuslist-manager.d.ts","sourceRoot":"","sources":["../../src/delegation/statuslist-manager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,wBAAwB,EACxB,gBAAgB,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAoB,KAAK,mBAAmB,EAAE,KAAK,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACxG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAIxD,MAAM,WAAW,yBAAyB;IACxC,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAAC;IAC9E,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,IAAI,MAAM,CAAC;IACjB,QAAQ,IAAI,MAAM,CAAC;CACpB;AAED,qBAAa,qBAAqB;IAO9B,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,eAAe;IACvB,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,YAAY;IAVtB,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,eAAe,CAAS;IAChC,yFAAyF;IACzF,OAAO,CAAC,WAAW,CAAoC;gBAG7C,OAAO,EAAE,yBAAyB,EAClC,QAAQ,EAAE,0BAA0B,EACpC,eAAe,EAAE,iBAAiB,EAClC,UAAU,EAAE,mBAAmB,EAC/B,YAAY,EAAE,qBAAqB,EAC3C,OAAO,CAAC,EAAE;QACR,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B;IAMG,mBAAmB,CAAC,OAAO,EAAE,YAAY,GAAG,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAkBpF,YAAY,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;YAezE,cAAc;IA6CtB,WAAW,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAmCjE,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAelD,sBAAsB;IAgDpC,oBAAoB,IAAI,MAAM;IAI9B,kBAAkB,IAAI,MAAM;CAG7B;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,yBAAyB,EAClC,QAAQ,EAAE,0BAA0B,EACpC,eAAe,EAAE,iBAAiB,EAClC,UAAU,EAAE,mBAAmB,EAC/B,YAAY,EAAE,qBAAqB,EACnC,OAAO,CAAC,EAAE;IACR,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GACA,qBAAqB,CASvB"}

package/dist/delegation/statuslist-manager.js

@@ -7,6 +7,7 @@
  */
 import { BitstringManager } from './bitstring.js';
 import { canonicalizeJSON } from './utils.js';
+import { assertStatusPurpose } from '../utils/statuslist-purpose.js';
 export class StatusList2021Manager {
     storage;
     identity;
@@ -83,8 +84,22 @@ export class StatusList2021Manager {
         if (!statusList) {
             throw new Error(`Status list not found: ${statusListCredential} — cannot determine revocation status`);
         }
+        // Fail-CLOSED on statusPurpose parity via the shared validator: the resolved list MUST be the
+        // SAME KIND the credential points at, else its clear bit would report "not revoked" from the
+        // wrong list — a fail-OPEN revocation bypass.
+        assertStatusPurpose(statusList.credentialSubject.statusPurpose, credentialStatus.statusPurpose);
         const manager = await BitstringManager.decode(statusList.credentialSubject.encodedList, this.compressor, this.decompressor);
-        const index = parseInt(statusListIndex, 10);
+        // Strict decimal, fail-closed: lenient parseInt would read "0x2A" as 0 / "42abc" as 42, and a
+        // whitespace/NaN index used to slip past getBit's guard and read as "not revoked" (fail-open).
+        if (!/^[0-9]+$/.test(statusListIndex)) {
+            throw new Error(`Invalid statusListIndex "${statusListIndex}" — must be a canonical non-negative decimal`);
+        }
+        const index = Number(statusListIndex);
+        // A canonical-decimal string can still exceed 2^53-1 and lose precision; reject it explicitly at
+        // the parse layer (matches revocation.ts parseIndex) rather than leaning only on getBit's bounds.
+        if (!Number.isSafeInteger(index)) {
+            throw new Error(`statusListIndex "${statusListIndex}" exceeds the safe integer range`);
+        }
         return manager.getBit(index);
     }
     async getRevokedIndices(statusListId) {

package/dist/delegation/statuslist-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"statuslist-manager.js","sourceRoot":"","sources":["../../src/delegation/statuslist-manager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EAAE,gBAAgB,EAAwD,MAAM,gBAAgB,CAAC;AAExG,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAa9C,MAAM,OAAO,qBAAqB;IAOtB;IACA;IACA;IACA;IACA;IAVF,iBAAiB,CAAS;IAC1B,eAAe,CAAS;IAChC,yFAAyF;IACjF,WAAW,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEvD,YACU,OAAkC,EAClC,QAAoC,EACpC,eAAkC,EAClC,UAA+B,EAC/B,YAAmC,EAC3C,OAGC;QARO,YAAO,GAAP,OAAO,CAA2B;QAClC,aAAQ,GAAR,QAAQ,CAA4B;QACpC,oBAAe,GAAf,eAAe,CAAmB;QAClC,eAAU,GAAV,UAAU,CAAqB;QAC/B,iBAAY,GAAZ,YAAY,CAAuB;QAM3C,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,IAAI,4BAA4B,CAAC;QACpF,IAAI,CAAC,eAAe,GAAG,OAAO,EAAE,eAAe,IAAI,MAAM,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,OAAoC;QAC5D,MAAM,YAAY,GAAG,GAAG,IAAI,CAAC,iBAAiB,IAAI,OAAO,KAAK,CAAC;QAE/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAE7D,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAEzD,MAAM,gBAAgB,GAAqB;YACzC,EAAE,EAAE,GAAG,YAAY,IAAI,KAAK,EAAE;YAC9B,IAAI,EAAE,qBAAqB;YAC3B,aAAa,EAAE,OAAO;YACtB,eAAe,EAAE,KAAK,CAAC,QAAQ,EAAE;YACjC,oBAAoB,EAAE,YAAY;SACnC,CAAC;QAEF,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,gBAAkC,EAAE,OAAgB;QACrE,MAAM,EAAE,oBAAoB,EAAE,GAAG,gBAAgB,CAAC;QAElD,mFAAmF;QACnF,gEAAgE;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACjF,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;QAEtF,gFAAgF;QAChF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,oBAAoB,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC;QAEtE,2CAA2C;QAC3C,MAAM,SAAS,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,gBAAkC,EAAE,OAAgB;QAC/E,MAAM,EAAE,oBAAoB,EAAE,eAAe,EAAE,GAAG,gBAAgB,CAAC;QAEnE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,0BAA0B,oBAAoB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAC3C,UAAU,CAAC,iBAAiB,CAAC,WAAW,EACxC,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QAEF,MAAM,KAAK,GAAG,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE/B,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;QAE3C,MAAM,iBAAiB,GAA6B;YAClD,GAAG,UAAU;YACb,iBAAiB,EAAE;gBACjB,GAAG,UAAU,CAAC,iBAAiB;gBAC/B,WAAW;aACZ;SACF,CAAC;QAEF,MAAM,kBAAkB,GAAG,EAAE,GAAG,iBAAiB,EAAE,CAAC;QACpD,OAAQ,kBAA8C,CAAC,OAAO,CAAC,CAAC;QAEhE,MAAM,WAAW,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CACtC,WAAW,EACX,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EACtB,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CACzB,CAAC;QAEF,MAAM,gBAAgB,GAA6B;YACjD,GAAG,iBAAiB;YACpB,KAAK;SACN,CAAC;QAEF,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,gBAAkC;QAClD,MAAM,EAAE,oBAAoB,EAAE,eAAe,EAAE,GAAG,gBAAgB,CAAC;QAEnE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,0BAA0B,oBAAoB,uCAAuC,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAC3C,UAAU,CAAC,iBAAiB,CAAC,WAAW,EACxC,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QAEF,MAAM,KAAK,GAAG,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QAC5C,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,YAAoB;QAC1C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAC3C,UAAU,CAAC,iBAAiB,CAAC,WAAW,EACxC,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QAEF,OAAO,OAAO,CAAC,UAAU,EAAE,CAAC;IAC9B,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAClC,YAAoB,EACpB,OAAoC;QAEpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAChE,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAClC,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;QAE3C,MAAM,kBAAkB,GAAG;YACzB,UAAU,EAAE;gBACV,wCAAwC;gBACxC,yCAAyC;aACtB;YACrB,EAAE,EAAE,YAAY;YAChB,IAAI,EAAE,CAAC,sBAAsB,EAAE,0BAA0B,CAAqB;YAC9E,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;YAC9B,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACtC,iBAAiB,EAAE;gBACjB,EAAE,EAAE,GAAG,YAAY,OAAO;gBAC1B,IAAI,EAAE,gBAAyB;gBAC/B,aAAa,EAAE,OAAO;gBACtB,WAAW;aACZ;SACF,CAAC;QAEF,MAAM,WAAW,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CACtC,WAAW,EACX,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EACtB,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CACzB,CAAC;QAEF,MAAM,gBAAgB,GAA6B;YACjD,GAAG,kBAAkB;YACrB,KAAK;SACN,CAAC;QAEF,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;IACnE,CAAC;IAED,oBAAoB;QAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAkC,EAClC,QAAoC,EACpC,eAAkC,EAClC,UAA+B,EAC/B,YAAmC,EACnC,OAGC;IAED,OAAO,IAAI,qBAAqB,CAC9B,OAAO,EACP,QAAQ,EACR,eAAe,EACf,UAAU,EACV,YAAY,EACZ,OAAO,CACR,CAAC;AACJ,CAAC"}
+{"version":3,"file":"statuslist-manager.js","sourceRoot":"","sources":["../../src/delegation/statuslist-manager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EAAE,gBAAgB,EAAwD,MAAM,gBAAgB,CAAC;AAExG,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAarE,MAAM,OAAO,qBAAqB;IAOtB;IACA;IACA;IACA;IACA;IAVF,iBAAiB,CAAS;IAC1B,eAAe,CAAS;IAChC,yFAAyF;IACjF,WAAW,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEvD,YACU,OAAkC,EAClC,QAAoC,EACpC,eAAkC,EAClC,UAA+B,EAC/B,YAAmC,EAC3C,OAGC;QARO,YAAO,GAAP,OAAO,CAA2B;QAClC,aAAQ,GAAR,QAAQ,CAA4B;QACpC,oBAAe,GAAf,eAAe,CAAmB;QAClC,eAAU,GAAV,UAAU,CAAqB;QAC/B,iBAAY,GAAZ,YAAY,CAAuB;QAM3C,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,IAAI,4BAA4B,CAAC;QACpF,IAAI,CAAC,eAAe,GAAG,OAAO,EAAE,eAAe,IAAI,MAAM,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,OAAoC;QAC5D,MAAM,YAAY,GAAG,GAAG,IAAI,CAAC,iBAAiB,IAAI,OAAO,KAAK,CAAC;QAE/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAE7D,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAEzD,MAAM,gBAAgB,GAAqB;YACzC,EAAE,EAAE,GAAG,YAAY,IAAI,KAAK,EAAE;YAC9B,IAAI,EAAE,qBAAqB;YAC3B,aAAa,EAAE,OAAO;YACtB,eAAe,EAAE,KAAK,CAAC,QAAQ,EAAE;YACjC,oBAAoB,EAAE,YAAY;SACnC,CAAC;QAEF,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,gBAAkC,EAAE,OAAgB;QACrE,MAAM,EAAE,oBAAoB,EAAE,GAAG,gBAAgB,CAAC;QAElD,mFAAmF;QACnF,gEAAgE;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACjF,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;QAEtF,gFAAgF;QAChF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,oBAAoB,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC;QAEtE,2CAA2C;QAC3C,MAAM,SAAS,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,gBAAkC,EAAE,OAAgB;QAC/E,MAAM,EAAE,oBAAoB,EAAE,eAAe,EAAE,GAAG,gBAAgB,CAAC;QAEnE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,0BAA0B,oBAAoB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAC3C,UAAU,CAAC,iBAAiB,CAAC,WAAW,EACxC,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QAEF,MAAM,KAAK,GAAG,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE/B,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;QAE3C,MAAM,iBAAiB,GAA6B;YAClD,GAAG,UAAU;YACb,iBAAiB,EAAE;gBACjB,GAAG,UAAU,CAAC,iBAAiB;gBAC/B,WAAW;aACZ;SACF,CAAC;QAEF,MAAM,kBAAkB,GAAG,EAAE,GAAG,iBAAiB,EAAE,CAAC;QACpD,OAAQ,kBAA8C,CAAC,OAAO,CAAC,CAAC;QAEhE,MAAM,WAAW,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CACtC,WAAW,EACX,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EACtB,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CACzB,CAAC;QAEF,MAAM,gBAAgB,GAA6B;YACjD,GAAG,iBAAiB;YACpB,KAAK;SACN,CAAC;QAEF,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,gBAAkC;QAClD,MAAM,EAAE,oBAAoB,EAAE,eAAe,EAAE,GAAG,gBAAgB,CAAC;QAEnE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,0BAA0B,oBAAoB,uCAAuC,CACtF,CAAC;QACJ,CAAC;QAED,8FAA8F;QAC9F,6FAA6F;QAC7F,8CAA8C;QAC9C,mBAAmB,CAAC,UAAU,CAAC,iBAAiB,CAAC,aAAa,EAAE,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAEhG,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAC3C,UAAU,CAAC,iBAAiB,CAAC,WAAW,EACxC,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QAEF,8FAA8F;QAC9F,+FAA+F;QAC/F,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,4BAA4B,eAAe,8CAA8C,CAAC,CAAC;QAC7G,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;QACtC,iGAAiG;QACjG,kGAAkG;QAClG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,oBAAoB,eAAe,kCAAkC,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,YAAoB;QAC1C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAC3C,UAAU,CAAC,iBAAiB,CAAC,WAAW,EACxC,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QAEF,OAAO,OAAO,CAAC,UAAU,EAAE,CAAC;IAC9B,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAClC,YAAoB,EACpB,OAAoC;QAEpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAChE,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAClC,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;QAE3C,MAAM,kBAAkB,GAAG;YACzB,UAAU,EAAE;gBACV,wCAAwC;gBACxC,yCAAyC;aACtB;YACrB,EAAE,EAAE,YAAY;YAChB,IAAI,EAAE,CAAC,sBAAsB,EAAE,0BAA0B,CAAqB;YAC9E,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;YAC9B,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACtC,iBAAiB,EAAE;gBACjB,EAAE,EAAE,GAAG,YAAY,OAAO;gBAC1B,IAAI,EAAE,gBAAyB;gBAC/B,aAAa,EAAE,OAAO;gBACtB,WAAW;aACZ;SACF,CAAC;QAEF,MAAM,WAAW,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CACtC,WAAW,EACX,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EACtB,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CACzB,CAAC;QAEF,MAAM,gBAAgB,GAA6B;YACjD,GAAG,kBAAkB;YACrB,KAAK;SACN,CAAC;QAEF,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;IACnE,CAAC;IAED,oBAAoB;QAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAkC,EAClC,QAAoC,EACpC,eAAkC,EAClC,UAA+B,EAC/B,YAAmC,EACnC,OAGC;IAED,OAAO,IAAI,qBAAqB,CAC9B,OAAO,EACP,QAAQ,EACR,eAAe,EACf,UAAU,EACV,YAAY,EACZ,OAAO,CACR,CAAC;AACJ,CAAC"}

package/dist/delegation/vc-jwt-verify.d.ts

@@ -0,0 +1,61 @@
+/**
+ * VC-JWT (compact JWS) delegation verification — the high-level check.
+ *
+ * `utils.ts` already provides the VC-JWT PRIMITIVES (`createUnsignedVCJWT`,
+ * `completeVCJWT`, `parseVCJWT`). What was missing is the high-level VERIFY:
+ * resolving the issuer DID and checking the envelope signature against its
+ * published key, so {@link DelegationCredentialVerifier} can accept the JWT
+ * serialization of a Verifiable Credential (W3C VC Data Model 1.1 §6.3.1) — the
+ * compact JWS a browser wallet mints, where the envelope signature over
+ * `header.payload` IS the proof and there is no embedded Data Integrity `proof`
+ * block. A verifier that only accepts embedded-proof VCs rejects that wire
+ * format as "Missing proof".
+ *
+ * This module adds only the envelope-signature check; parsing stays in
+ * `parseVCJWT`, and the extracted credential flows through the SAME downstream
+ * checks (basic shape, expiry, status) as a Data Integrity VC.
+ *
+ * Related: W3C VC Data Model 1.1 §6.3.1 (JWT), KYA-OS §4.3
+ */
+import type { DelegationCredential } from "../types/protocol.js";
+import type { DIDResolver, DelegationVCVerificationResult } from "./vc-verifier.types.js";
+/**
+ * The credential's own declared issuer as a DID string (VC `issuer` may be a
+ * string or an object with `id`). `undefined` when absent/malformed. The
+ * verifier requires this to equal the JWT `iss` — a credential must not claim
+ * an issuer other than the key that actually signed the envelope.
+ */
+export declare function credentialIssuerDid(credential: DelegationCredential): string | undefined;
+/** A parsed, structurally-valid VC-JWT plus the coordinates to look up its key. */
+export type PreparedVcJwt = {
+    vc: DelegationCredential;
+    issuerDid: string;
+    kid: string | undefined;
+    basicCheckMs: number;
+} | {
+    failure: DelegationVCVerificationResult;
+};
+/**
+ * Parse a VC-JWT and run the no-network fast checks: 3-part structure, the
+ * basic property checks (with no embedded-`proof` requirement — the envelope is
+ * the proof), and issuer↔`iss` consistency (the credential must not name an
+ * issuer other than the key that signs it). Returns the validated credential
+ * and its key-lookup coordinates, or a terminal `failure` at the `basic` stage.
+ * The issuer DID is taken from the `iss` claim, never the inner `vc.issuer`.
+ */
+export declare function prepareVcJwtCredential(jwt: string, startTime: number): PreparedVcJwt;
+export interface VcJwtSignatureResult {
+    valid: boolean;
+    reason?: string;
+    durationMs: number;
+}
+/**
+ * Verify a VC-JWT's EdDSA envelope signature against the issuer's published
+ * key. Resolves `issuerDid`, selects the verification method named by `kid`
+ * (or the first when `kid` is absent), imports its `publicKeyJwk`, and checks
+ * the compact JWS with `jose` — `algorithms` pinned to `EdDSA`, so a token
+ * cannot downgrade the suite or claim `alg: none`. Fail-closed: any
+ * resolution, key-import, or verification problem denies.
+ */
+export declare function verifyVcJwtSignature(jwt: string, issuerDid: string, kid: string | undefined, didResolver: DIDResolver | undefined): Promise<VcJwtSignatureResult>;
+//# sourceMappingURL=vc-jwt-verify.d.ts.map

package/dist/delegation/vc-jwt-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vc-jwt-verify.d.ts","sourceRoot":"","sources":["../../src/delegation/vc-jwt-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,KAAK,EACV,WAAW,EAEX,8BAA8B,EAC/B,MAAM,wBAAwB,CAAC;AAQhC;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,oBAAoB,GAC/B,MAAM,GAAG,SAAS,CAOpB;AAmBD,mFAAmF;AACnF,MAAM,MAAM,aAAa,GACrB;IACE,EAAE,EAAE,oBAAoB,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;CACtB,GACD;IAAE,OAAO,EAAE,8BAA8B,CAAA;CAAE,CAAC;AAEhD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,GAChB,aAAa,CAmCf;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AASD;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,WAAW,EAAE,WAAW,GAAG,SAAS,GACnC,OAAO,CAAC,oBAAoB,CAAC,CAwC/B"}

package/dist/delegation/vc-jwt-verify.js

@@ -0,0 +1,131 @@
+/**
+ * VC-JWT (compact JWS) delegation verification — the high-level check.
+ *
+ * `utils.ts` already provides the VC-JWT PRIMITIVES (`createUnsignedVCJWT`,
+ * `completeVCJWT`, `parseVCJWT`). What was missing is the high-level VERIFY:
+ * resolving the issuer DID and checking the envelope signature against its
+ * published key, so {@link DelegationCredentialVerifier} can accept the JWT
+ * serialization of a Verifiable Credential (W3C VC Data Model 1.1 §6.3.1) — the
+ * compact JWS a browser wallet mints, where the envelope signature over
+ * `header.payload` IS the proof and there is no embedded Data Integrity `proof`
+ * block. A verifier that only accepts embedded-proof VCs rejects that wire
+ * format as "Missing proof".
+ *
+ * This module adds only the envelope-signature check; parsing stays in
+ * `parseVCJWT`, and the extracted credential flows through the SAME downstream
+ * checks (basic shape, expiry, status) as a Data Integrity VC.
+ *
+ * Related: W3C VC Data Model 1.1 §6.3.1 (JWT), KYA-OS §4.3
+ */
+import { compactVerify, importJWK } from "jose";
+import { parseVCJWT } from "./utils.js";
+import { validateBasicProperties } from "./vc-verification-checks.js";
+function errMsg(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/**
+ * The credential's own declared issuer as a DID string (VC `issuer` may be a
+ * string or an object with `id`). `undefined` when absent/malformed. The
+ * verifier requires this to equal the JWT `iss` — a credential must not claim
+ * an issuer other than the key that actually signed the envelope.
+ */
+export function credentialIssuerDid(credential) {
+    const iss = credential.issuer;
+    if (typeof iss === "string")
+        return iss;
+    if (iss && typeof iss === "object" && typeof iss.id === "string") {
+        return iss.id;
+    }
+    return undefined;
+}
+function jwtBasicFailure(reason, startTime, basicCheckMs) {
+    return {
+        valid: false,
+        reason,
+        stage: "basic",
+        metrics: basicCheckMs !== undefined
+            ? { basicCheckMs, totalMs: Date.now() - startTime }
+            : { totalMs: Date.now() - startTime },
+        checks: { basicValid: false },
+    };
+}
+/**
+ * Parse a VC-JWT and run the no-network fast checks: 3-part structure, the
+ * basic property checks (with no embedded-`proof` requirement — the envelope is
+ * the proof), and issuer↔`iss` consistency (the credential must not name an
+ * issuer other than the key that signs it). Returns the validated credential
+ * and its key-lookup coordinates, or a terminal `failure` at the `basic` stage.
+ * The issuer DID is taken from the `iss` claim, never the inner `vc.issuer`.
+ */
+export function prepareVcJwtCredential(jwt, startTime) {
+    const parsed = parseVCJWT(jwt);
+    if (!parsed) {
+        return { failure: jwtBasicFailure("Not a valid VC-JWT (parse failed)", startTime) };
+    }
+    const basicCheckStart = Date.now();
+    const vc = parsed.payload.vc;
+    const basicValidation = validateBasicProperties(vc, {
+        requireEmbeddedProof: false,
+    });
+    const basicCheckMs = Date.now() - basicCheckStart;
+    if (!basicValidation.valid) {
+        return {
+            failure: jwtBasicFailure(basicValidation.reason, startTime, basicCheckMs),
+        };
+    }
+    if (credentialIssuerDid(vc) !== parsed.payload.iss) {
+        return {
+            failure: jwtBasicFailure("Credential `issuer` does not match the JWT `iss` (the verified signer)", startTime, basicCheckMs),
+        };
+    }
+    return {
+        vc,
+        issuerDid: parsed.payload.iss,
+        kid: parsed.header.kid,
+        basicCheckMs,
+    };
+}
+function selectVerificationMethod(methods, kid) {
+    return kid ? methods.find((m) => m.id === kid) : methods[0];
+}
+/**
+ * Verify a VC-JWT's EdDSA envelope signature against the issuer's published
+ * key. Resolves `issuerDid`, selects the verification method named by `kid`
+ * (or the first when `kid` is absent), imports its `publicKeyJwk`, and checks
+ * the compact JWS with `jose` — `algorithms` pinned to `EdDSA`, so a token
+ * cannot downgrade the suite or claim `alg: none`. Fail-closed: any
+ * resolution, key-import, or verification problem denies.
+ */
+export async function verifyVcJwtSignature(jwt, issuerDid, kid, didResolver) {
+    const startTime = Date.now();
+    const done = (valid, reason) => ({
+        valid,
+        reason,
+        durationMs: Date.now() - startTime,
+    });
+    if (!didResolver) {
+        return done(false, "No DID resolver configured — signature cannot be verified");
+    }
+    const didDoc = await didResolver.resolve(issuerDid);
+    if (!didDoc) {
+        return done(false, `Could not resolve issuer DID: ${issuerDid}`);
+    }
+    const vm = selectVerificationMethod(didDoc.verificationMethod ?? [], kid);
+    if (!vm) {
+        return done(false, kid
+            ? `Verification method ${kid} not found in DID Document`
+            : "DID Document has no verification method");
+    }
+    if (!vm.publicKeyJwk) {
+        return done(false, "Verification method missing publicKeyJwk");
+    }
+    try {
+        const key = await importJWK(vm.publicKeyJwk, "EdDSA");
+        await compactVerify(jwt, key, { algorithms: ["EdDSA"] });
+        return done(true);
+    }
+    catch (err) {
+        return done(false, `JWT envelope signature is not valid: ${errMsg(err)}`);
+    }
+}
+//# sourceMappingURL=vc-jwt-verify.js.map

package/dist/delegation/vc-jwt-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vc-jwt-verify.js","sourceRoot":"","sources":["../../src/delegation/vc-jwt-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAQhD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAEtE,SAAS,MAAM,CAAC,GAAY;IAC1B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAgC;IAEhC,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC;IAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACjE,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CACtB,MAA0B,EAC1B,SAAiB,EACjB,YAAqB;IAErB,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,MAAM;QACN,KAAK,EAAE,OAAO;QACd,OAAO,EACL,YAAY,KAAK,SAAS;YACxB,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE;YACnD,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE;QACzC,MAAM,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE;KAC9B,CAAC;AACJ,CAAC;AAYD;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAW,EACX,SAAiB;IAEjB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,mCAAmC,EAAE,SAAS,CAAC,EAAE,CAAC;IACtF,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,EAA0B,CAAC;IACrD,MAAM,eAAe,GAAG,uBAAuB,CAAC,EAAE,EAAE;QAClD,oBAAoB,EAAE,KAAK;KAC5B,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;IAElD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC3B,OAAO;YACL,OAAO,EAAE,eAAe,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC;SAC1E,CAAC;IACJ,CAAC;IAED,IAAI,mBAAmB,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACnD,OAAO;YACL,OAAO,EAAE,eAAe,CACtB,wEAAwE,EACxE,SAAS,EACT,YAAY,CACb;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE;QACF,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG;QAC7B,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG;QACtB,YAAY;KACb,CAAC;AACJ,CAAC;AAQD,SAAS,wBAAwB,CAC/B,OAA6B,EAC7B,GAAuB;IAEvB,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAW,EACX,SAAiB,EACjB,GAAuB,EACvB,WAAoC;IAEpC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,MAAe,EAAwB,EAAE,CAAC,CAAC;QACvE,KAAK;QACL,MAAM;QACN,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;KACnC,CAAC,CAAC;IAEH,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CACT,KAAK,EACL,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC,KAAK,EAAE,iCAAiC,SAAS,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,EAAE,GAAG,wBAAwB,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IAC1E,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,IAAI,CACT,KAAK,EACL,GAAG;YACD,CAAC,CAAC,uBAAuB,GAAG,4BAA4B;YACxD,CAAC,CAAC,yCAAyC,CAC9C,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,KAAK,EAAE,0CAA0C,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,EAAE,CAAC,YAAmB,EAAE,OAAO,CAAC,CAAC;QAC7D,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,KAAK,EAAE,wCAAwC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC"}

package/dist/delegation/vc-verification-checks.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Delegation Credential Verifier — stateless verification checks.
+ *
+ * The basic (schema/expiry/subject-shape), signature, and credential-status
+ * checks, as pure functions. Extracted from `DelegationCredentialVerifier` (in
+ * `./vc-verifier.ts`) so the class holds only orchestration + its cache.
+ */
+import type { DelegationCredential, CredentialStatus } from "../types/protocol.js";
+import type { DIDResolver, StatusListResolver, StatusCheckResult, SignatureVerificationFunction, DelegationVCVerificationResult } from "./vc-verifier.types.js";
+/**
+ * Stage 1: schema, expiry, status field, and subject-shape checks (no network).
+ *
+ * `requireEmbeddedProof` (default `true`) demands a Data Integrity `proof`
+ * block. The VC-JWT path passes `false`: a compact JWS carries no embedded
+ * `proof` — its envelope signature is the proof, verified separately by
+ * {@link verifyVcJwtSignature}.
+ */
+export declare function validateBasicProperties(vc: DelegationCredential, options?: {
+    requireEmbeddedProof?: boolean;
+}): {
+    valid: boolean;
+    reason?: string;
+};
+/**
+ * Fold the parallel signature + status results — with the already-passed basic
+ * stage — into the final verification result. Pure (no caching; the verifier
+ * caches a valid result itself). Shared by the Data Integrity and VC-JWT paths,
+ * which both reach here only after `validateBasicProperties` passed, so
+ * `basicValid` is true.
+ */
+export declare function combineVerificationResult(signatureResult: {
+    valid: boolean;
+    reason?: string;
+    durationMs?: number;
+}, statusResult: StatusCheckResult, basicCheckMs: number, startTime: number): DelegationVCVerificationResult;
+/** Stage 2a: resolve the issuer key and verify the embedded proof signature. */
+export declare function verifySignature(vc: DelegationCredential, didResolver: DIDResolver | undefined, signatureVerifier: SignatureVerificationFunction | undefined): Promise<{
+    valid: boolean;
+    reason?: string;
+    durationMs?: number;
+}>;
+/**
+ * Stage 2b: resolve a credential's revocation status, fail-closed. Every deny is
+ * labelled with a {@link StatusOutcome} so consumers can tell a settled
+ * `revoked` (re-consent) from a transient `status_unresolvable` (retry):
+ * a missing resolver or a resolver that throws both DENY as
+ * `status_unresolvable`; a set status bit DENIES as `revoked`.
+ */
+export declare function checkCredentialStatus(status: CredentialStatus, statusListResolver: StatusListResolver | undefined): Promise<StatusCheckResult>;
+//# sourceMappingURL=vc-verification-checks.d.ts.map

package/dist/delegation/vc-verification-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vc-verification-checks.d.ts","sourceRoot":"","sources":["../../src/delegation/vc-verification-checks.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,gBAAgB,EACjB,MAAM,sBAAsB,CAAC;AAM9B,OAAO,KAAK,EACV,WAAW,EAGX,kBAAkB,EAClB,iBAAiB,EACjB,6BAA6B,EAC7B,8BAA8B,EAC/B,MAAM,wBAAwB,CAAC;AAShC;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,EAAE,EAAE,oBAAoB,EACxB,OAAO,GAAE;IAAE,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/C;IACD,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAuCA;AAqCD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,eAAe,EAAE;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,EACzE,YAAY,EAAE,iBAAiB,EAC/B,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB,8BAA8B,CAqBhC;AAED,gFAAgF;AAChF,wBAAsB,eAAe,CACnC,EAAE,EAAE,oBAAoB,EACxB,WAAW,EAAE,WAAW,GAAG,SAAS,EACpC,iBAAiB,EAAE,6BAA6B,GAAG,SAAS,GAC3D,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6EnE;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,gBAAgB,EACxB,kBAAkB,EAAE,kBAAkB,GAAG,SAAS,GACjD,OAAO,CAAC,iBAAiB,CAAC,CAqC5B"}

package/dist/delegation/vc-verification-checks.js

@@ -0,0 +1,212 @@
+/**
+ * Delegation Credential Verifier — stateless verification checks.
+ *
+ * The basic (schema/expiry/subject-shape), signature, and credential-status
+ * checks, as pure functions. Extracted from `DelegationCredentialVerifier` (in
+ * `./vc-verifier.ts`) so the class holds only orchestration + its cache.
+ */
+import { isDelegationCredentialExpired, isDelegationCredentialNotYetValid, validateDelegationCredential, } from "../types/protocol.js";
+/**
+ * Properties a DelegationCredential `credentialSubject` may carry. Anything
+ * else is treated as a claim-intended field and rejected by default — a
+ * permission credential must not smuggle claims (KYA-OS §11.6).
+ */
+const DELEGATION_SUBJECT_KEYS = ["id", "delegation"];
+/**
+ * Stage 1: schema, expiry, status field, and subject-shape checks (no network).
+ *
+ * `requireEmbeddedProof` (default `true`) demands a Data Integrity `proof`
+ * block. The VC-JWT path passes `false`: a compact JWS carries no embedded
+ * `proof` — its envelope signature is the proof, verified separately by
+ * {@link verifyVcJwtSignature}.
+ */
+export function validateBasicProperties(vc, options = {}) {
+    const schemaValidation = validateDelegationCredential(vc);
+    if (!schemaValidation.success) {
+        return {
+            valid: false,
+            reason: `Schema validation failed: ${schemaValidation.error?.message}`,
+        };
+    }
+    if (isDelegationCredentialExpired(vc)) {
+        return { valid: false, reason: "Delegation credential expired" };
+    }
+    if (isDelegationCredentialNotYetValid(vc)) {
+        return { valid: false, reason: "Delegation credential not yet valid" };
+    }
+    const delegation = vc.credentialSubject.delegation;
+    if (delegation.status === "revoked") {
+        return { valid: false, reason: "Delegation status is revoked" };
+    }
+    if (delegation.status === "expired") {
+        return { valid: false, reason: "Delegation status is expired" };
+    }
+    if (!delegation.issuerDid || !delegation.subjectDid) {
+        return { valid: false, reason: "Missing issuer or subject DID" };
+    }
+    if ((options.requireEmbeddedProof ?? true) && !vc.proof) {
+        return { valid: false, reason: "Missing proof" };
+    }
+    const subjectShape = validateSubjectShape(vc);
+    if (!subjectShape.valid) {
+        return subjectShape;
+    }
+    return { valid: true };
+}
+/**
+ * Reject a delegation credential whose `credentialSubject` carries properties
+ * other than `id` and `delegation`. Claim-bearing fields in a permission
+ * credential separate designation from authorization — the confused-deputy
+ * class (KYA-OS §11.6). Unconditional as of 1.4.0.
+ */
+function validateSubjectShape(vc) {
+    const extraneous = Object.keys(vc.credentialSubject).filter((key) => !DELEGATION_SUBJECT_KEYS.includes(key));
+    if (extraneous.length === 0) {
+        return { valid: true };
+    }
+    return {
+        valid: false,
+        reason: `credentialSubject contains non-delegation field(s): ${extraneous.join(", ")}. ` +
+            `A DelegationCredential subject MUST carry only 'id' and 'delegation' (KYA-OS §11.6).`,
+    };
+}
+function findVerificationMethod(didDoc, verificationMethodId) {
+    return didDoc.verificationMethod?.find((vm) => vm.id === verificationMethodId);
+}
+/**
+ * Fold the parallel signature + status results — with the already-passed basic
+ * stage — into the final verification result. Pure (no caching; the verifier
+ * caches a valid result itself). Shared by the Data Integrity and VC-JWT paths,
+ * which both reach here only after `validateBasicProperties` passed, so
+ * `basicValid` is true.
+ */
+export function combineVerificationResult(signatureResult, statusResult, basicCheckMs, startTime) {
+    const allValid = signatureResult.valid && statusResult.valid;
+    return {
+        valid: allValid,
+        reason: !allValid
+            ? signatureResult.reason || statusResult.reason || "Unknown failure"
+            : undefined,
+        statusOutcome: statusResult.outcome,
+        stage: "complete",
+        metrics: {
+            basicCheckMs,
+            signatureCheckMs: signatureResult.durationMs || 0,
+            statusCheckMs: statusResult.durationMs || 0,
+            totalMs: Date.now() - startTime,
+        },
+        checks: {
+            basicValid: true,
+            signatureValid: signatureResult.valid,
+            statusValid: statusResult.valid,
+        },
+    };
+}
+/** Stage 2a: resolve the issuer key and verify the embedded proof signature. */
+export async function verifySignature(vc, didResolver, signatureVerifier) {
+    const startTime = Date.now();
+    try {
+        const issuerDid = typeof vc.issuer === "string" ? vc.issuer : vc.issuer.id;
+        if (!didResolver || !signatureVerifier) {
+            return {
+                valid: false,
+                reason: "No DID resolver or signature verifier configured — signature cannot be verified",
+                durationMs: Date.now() - startTime,
+            };
+        }
+        const didDoc = await didResolver.resolve(issuerDid);
+        if (!didDoc) {
+            return {
+                valid: false,
+                reason: `Could not resolve issuer DID: ${issuerDid}`,
+                durationMs: Date.now() - startTime,
+            };
+        }
+        if (!vc.proof) {
+            return {
+                valid: false,
+                reason: "Proof is missing",
+                durationMs: Date.now() - startTime,
+            };
+        }
+        const verificationMethodId = vc.proof["verificationMethod"];
+        if (!verificationMethodId) {
+            return {
+                valid: false,
+                reason: "Proof missing verificationMethod",
+                durationMs: Date.now() - startTime,
+            };
+        }
+        const verificationMethod = findVerificationMethod(didDoc, verificationMethodId);
+        if (!verificationMethod) {
+            return {
+                valid: false,
+                reason: `Verification method ${verificationMethodId} not found`,
+                durationMs: Date.now() - startTime,
+            };
+        }
+        const publicKeyJwk = verificationMethod.publicKeyJwk;
+        if (!publicKeyJwk) {
+            return {
+                valid: false,
+                reason: "Verification method missing publicKeyJwk",
+                durationMs: Date.now() - startTime,
+            };
+        }
+        const verificationResult = await signatureVerifier(vc, publicKeyJwk);
+        return {
+            valid: verificationResult.valid,
+            reason: verificationResult.reason,
+            durationMs: Date.now() - startTime,
+        };
+    }
+    catch (error) {
+        return {
+            valid: false,
+            reason: `Signature verification error: ${error instanceof Error ? error.message : "Unknown error"}`,
+            durationMs: Date.now() - startTime,
+        };
+    }
+}
+/**
+ * Stage 2b: resolve a credential's revocation status, fail-closed. Every deny is
+ * labelled with a {@link StatusOutcome} so consumers can tell a settled
+ * `revoked` (re-consent) from a transient `status_unresolvable` (retry):
+ * a missing resolver or a resolver that throws both DENY as
+ * `status_unresolvable`; a set status bit DENIES as `revoked`.
+ */
+export async function checkCredentialStatus(status, statusListResolver) {
+    const startTime = Date.now();
+    try {
+        if (!statusListResolver) {
+            return {
+                valid: false,
+                reason: "Credential has credentialStatus but no status list resolver is configured — cannot verify revocation status",
+                outcome: "status_unresolvable",
+                durationMs: Date.now() - startTime,
+            };
+        }
+        const isRevoked = await statusListResolver.checkStatus(status);
+        if (isRevoked) {
+            return {
+                valid: false,
+                reason: `Credential revoked via StatusList2021 (${status.statusPurpose})`,
+                outcome: "revoked",
+                durationMs: Date.now() - startTime,
+            };
+        }
+        return {
+            valid: true,
+            durationMs: Date.now() - startTime,
+        };
+    }
+    catch (error) {
+        return {
+            valid: false,
+            reason: `Status check error: ${error instanceof Error ? error.message : "Unknown error"}`,
+            outcome: "status_unresolvable",
+            durationMs: Date.now() - startTime,
+        };
+    }
+}
+//# sourceMappingURL=vc-verification-checks.js.map

package/dist/delegation/vc-verification-checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vc-verification-checks.js","sourceRoot":"","sources":["../../src/delegation/vc-verification-checks.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EACL,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;AAW9B;;;;GAIG;AACH,MAAM,uBAAuB,GAAsB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;AAExE;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,EAAwB,EACxB,UAA8C,EAAE;IAKhD,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,6BAA6B,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE;SACvE,CAAC;IACJ,CAAC;IAED,IAAI,6BAA6B,CAAC,EAAE,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,iCAAiC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IACzE,CAAC;IAED,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC;IACnD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,oBAAoB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QACxD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,YAAY,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,EAAwB;IAIpD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,MAAM,CACzD,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAChD,CAAC;IAEF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,MAAM,EACJ,uDAAuD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAChF,sFAAsF;KACzF,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,MAAmB,EACnB,oBAA4B;IAE5B,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,CACpC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,oBAAoB,CACvC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,eAAyE,EACzE,YAA+B,EAC/B,YAAoB,EACpB,SAAiB;IAEjB,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC;IAC7D,OAAO;QACL,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,CAAC,QAAQ;YACf,CAAC,CAAC,eAAe,CAAC,MAAM,IAAI,YAAY,CAAC,MAAM,IAAI,iBAAiB;YACpE,CAAC,CAAC,SAAS;QACb,aAAa,EAAE,YAAY,CAAC,OAAO;QACnC,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE;YACP,YAAY;YACZ,gBAAgB,EAAE,eAAe,CAAC,UAAU,IAAI,CAAC;YACjD,aAAa,EAAE,YAAY,CAAC,UAAU,IAAI,CAAC;YAC3C,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SAChC;QACD,MAAM,EAAE;YACN,UAAU,EAAE,IAAI;YAChB,cAAc,EAAE,eAAe,CAAC,KAAK;YACrC,WAAW,EAAE,YAAY,CAAC,KAAK;SAChC;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAwB,EACxB,WAAoC,EACpC,iBAA4D;IAE5D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,SAAS,GACb,OAAO,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QAE3D,IAAI,CAAC,WAAW,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EACJ,iFAAiF;gBACnF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,iCAAiC,SAAS,EAAE;gBACpD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YACd,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,MAAM,oBAAoB,GAAG,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC5D,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,kCAAkC;gBAC1C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,MAAM,kBAAkB,GAAG,sBAAsB,CAC/C,MAAM,EACN,oBAA8B,CAC/B,CAAC;QACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,uBAAuB,oBAAoB,YAAY;gBAC/D,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,kBAAkB,CAAC,YAAY,CAAC;QACrD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,0CAA0C;gBAClD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,MAAM,kBAAkB,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QAErE,OAAO;YACL,KAAK,EAAE,kBAAkB,CAAC,KAAK;YAC/B,MAAM,EAAE,kBAAkB,CAAC,MAAM;YACjC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;YACnG,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAwB,EACxB,kBAAkD;IAElD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EACJ,6GAA6G;gBAC/G,OAAO,EAAE,qBAAqB;gBAC9B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAE/D,IAAI,SAAS,EAAE,CAAC;YACd,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,0CAA0C,MAAM,CAAC,aAAa,GAAG;gBACzE,OAAO,EAAE,SAAS;gBAClB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,OAAO;YACL,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uBAAuB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;YACzF,OAAO,EAAE,qBAAqB;YAC9B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC;IACJ,CAAC;AACH,CAAC"}