@kya-os/mcp 1.6.1 → 1.9.0

package/dist/card/proof/types.d.ts

@@ -0,0 +1,219 @@
+/**
+ * KYA-OS Entity Card — stateless per-request holder-of-key proof: shapes + seams.
+ *
+ * `org.kya-os/proof@1` is the STATELESS, sender-constrained proof profile. It rides its OWN
+ * `_meta` key ({@link KYA_OS_CARD_PROOF_META_KEY} = `org.kya-os/proof@1`), DISTINCT from the legacy
+ * session-bound `ProofMeta` (which carries `sessionId` + a handshake nonce under
+ * `org.kya-os/proof`). Separate keys let the two regimes coexist on one server without either guard
+ * seeing — or rejecting — the other's proof. Every request self-proves; there is no session state.
+ *
+ * All crypto is INJECTED via seams ({@link ProofSigner} for minting, {@link VerifyProofDeps}
+ * for verifying) so no runtime (`mcp-i-core`) dependency leaks into `@kya-os/mcp`; the module
+ * uses only `jose` + `json-canonicalize`, already direct dependencies.
+ */
+import { z } from 'zod';
+import { type ProofPublicJwk } from '../schema.js';
+/** The stateless per-request proof profile tag (the `prf` discriminator). */
+export declare const PROOF_PROFILE_V1 = "org.kya-os/proof@1";
+/**
+ * The `_meta` key the STATELESS card proof rides under — DISTINCT from the legacy session proof's
+ * `org.kya-os/proof` (`KYA_OS_PROOF_META_KEY`). Sharing one key made the two regimes mutually
+ * exclusive on a server (a legacy proof failed the card schema and was 401'd; a card proof failed
+ * the legacy structure check). With separate keys each guard reads its OWN key and simply does not
+ * see the other's proof, so both can run on one server — genuinely additive, no legacy coupling. The
+ * key equals the `prf` profile id, so it is self-describing and versioned.
+ */
+export declare const KYA_OS_CARD_PROOF_META_KEY = "org.kya-os/proof@1";
+/** Default proof lifetime in seconds (SPEC §8: short-lived, ≤ 60s). */
+export declare const DEFAULT_TTL_SEC = 60;
+/** Maximum accepted proof lifetime in seconds — a longer window fails closed. */
+export declare const MAX_TTL_SEC = 60;
+/** Default accepted clock skew in seconds (±) for the created/expires window. */
+export declare const DEFAULT_SKEW_SEC = 5;
+/**
+ * Minimum time a consumed nonce MUST be retained by the replay cache: the FULL verifier
+ * acceptance window, PLUS one second of rounding headroom. A proof is accepted while
+ * `created - skew ≤ now ≤ expires + skew` (with `expires = created + ttl`) — a window `ttl + 2·skew`
+ * wide. But the verifier compares at SECOND granularity and is inclusive at the top, so the last
+ * accepting second is honoured in full (up to +999 ms), while a nonce first consumed at the very
+ * start of the `created - skew` second is retained from there. Retaining for exactly `ttl + 2·skew`
+ * therefore leaves a sub-second tail in which an evicted nonce lets a still-valid proof replay; the
+ * `+ 1` closes it. Retention is measured from FIRST use. If a verifier widens `skewSec` beyond
+ * {@link DEFAULT_SKEW_SEC}, widen the cache TTL to match.
+ */
+export declare const NONCE_RETENTION_SEC: number;
+/** RFC 7638 confirmation key thumbprint (`cnf.jkt`) — the sender-constraint fusion anchor. */
+export declare const CardProofCnfSchema: z.ZodObject<{
+    jkt: z.ZodString;
+}, z.core.$strip>;
+/**
+ * The `org.kya-os/proof@1` payload. Every field except the two signatures (`jws`, `httpSig`) is a
+ * COVERED claim: the detached EdDSA `jws` signs the RFC 8785 (JCS) canonicalization of the claims,
+ * so tampering any of them fails the signature. `cnf.jkt` is OPTIONAL — present it degrades to
+ * L3-minus rather than blocking when the authorization server does not emit an RFC 9449 `cnf`.
+ *
+ * `httpSig` is the OPTIONAL second signature of the DUAL carrier: a RAW EdDSA signature (base64url,
+ * NOT JWS-framed) made by the SAME DID key over the RFC 9421 signature base the HTTP Message
+ * Signature sibling exposes. Because it is a raw signature over the exact base a stock RFC 9421
+ * verifier reconstructs, that sibling is genuinely cross-verifiable against the resolved DID key
+ * (the `jws` framing prepends a protected header, so its bytes could never satisfy a 9421 verifier).
+ * It degrades gracefully: a signer without a `signRaw` seam mints a JWS-only proof (no sibling).
+ */
+export declare const CardProofMetaSchema: z.ZodObject<{
+    prf: z.ZodLiteral<"org.kya-os/proof@1">;
+    alg: z.ZodEnum<{
+        EdDSA: "EdDSA";
+        ES256: "ES256";
+    }>;
+    did: z.ZodString;
+    kid: z.ZodString;
+    audience: z.ZodString;
+    nonce: z.ZodString;
+    created: z.ZodNumber;
+    expires: z.ZodNumber;
+    requestHash: z.ZodString;
+    cnf: z.ZodOptional<z.ZodObject<{
+        jkt: z.ZodString;
+    }, z.core.$strip>>;
+    jws: z.ZodString;
+    httpSig: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type CardProofCnf = z.infer<typeof CardProofCnfSchema>;
+export type CardProofMeta = z.infer<typeof CardProofMetaSchema>;
+/** An Ed25519 private JWK (OKP, carries `d`) — the signer's key material, never serialized out. */
+export interface Ed25519PrivateJwk {
+    kty: 'OKP';
+    crv: 'Ed25519';
+    x: string;
+    d: string;
+    kid?: string;
+}
+/** A P-256 private JWK (EC, carries `d`) — the ES256 signer's key material. */
+export interface P256PrivateJwk {
+    kty: 'EC';
+    crv: 'P-256';
+    x: string;
+    y: string;
+    d: string;
+    kid?: string;
+}
+/** A proof-signing private JWK — Ed25519 (EdDSA) or P-256 (ES256). */
+export type ProofPrivateJwk = Ed25519PrivateJwk | P256PrivateJwk;
+/**
+ * The minting seam. Holds the entity's identity coordinates + an opaque detached-JWS signer;
+ * the module never touches raw key material. `jkt` is the RFC 7638 thumbprint of the signing
+ * key, embedded as `cnf.jkt` unless the build context overrides it.
+ */
+export interface ProofSigner {
+    readonly did: string;
+    readonly kid: string;
+    readonly jkt?: string;
+    /** The signing algorithm this signer produces — `EdDSA` (Ed25519) or `ES256` (P-256). Default `EdDSA`. */
+    readonly alg?: 'EdDSA' | 'ES256';
+    /** Produce a DETACHED JWS (`protectedHeader..signature`) over `payload`, signed with {@link alg}. */
+    sign(payload: Uint8Array): Promise<string>;
+    /**
+     * OPTIONAL: produce a RAW EdDSA signature (base64url, NOT JWS-framed) over `payload` with the
+     * SAME key as {@link sign}. Enables the dual-carrier RFC 9421 sibling — the raw signature over
+     * the 9421 base is what a stock 9421 verifier reconstructs and checks against the DID key. A
+     * signer that omits this mints a JWS-only proof (the sibling degrades away, never breaks).
+     */
+    signRaw?(payload: Uint8Array): Promise<string>;
+}
+/** Per-request minting context: who the proof is for, its nonce, lifetime, and cnf override. */
+export interface BuildProofContext {
+    /** Recipient DID (anti-confused-deputy / anti-relay binding). */
+    audience: string;
+    /** 128-bit nonce (client-random or server-issued). */
+    nonce: string;
+    /** Proof lifetime in seconds (default {@link DEFAULT_TTL_SEC}). */
+    ttlSec?: number;
+    /** Explicit `cnf.jkt` (e.g. the token's RFC 9449 thumbprint); default: the signer's `jkt`. */
+    cnfJkt?: string;
+    /** Injectable clock returning epoch MILLISECONDS (deterministic tests). */
+    now?: () => number;
+}
+/**
+ * Resolve the Ed25519 public key registered for a `kid`.
+ *
+ * CONTRACT (this seam is a SECURITY BOUNDARY): the resolver MUST resolve the EXACT `did#fragment`
+ * from the AUTHORITATIVE DID document and return ONLY the key genuinely published at that
+ * verificationMethod — never a key that merely shares the DID prefix, and never a caller-supplied
+ * key taken on trust. A secure verifier supplies {@link ResolveDidKeys} for an independent RFC 7638
+ * membership proof; without it the verifier FAILS CLOSED unless you attest THIS resolver is
+ * authoritative via `trustResolveKeyAuthority` (in which case this contract is the sole binding).
+ *
+ * Fail-closed: throw when the `kid` is unresolvable (the verifier records `key_unresolvable`).
+ */
+export type ResolveKey = (kid: string) => ProofPublicJwk | Promise<ProofPublicJwk>;
+/** List the Ed25519 verification keys published by a DID document — the DID-membership seam. */
+export type ResolveDidKeys = (did: string) => ProofPublicJwk[] | Promise<ProofPublicJwk[]>;
+/**
+ * Replay seam — the ATOMIC test-AND-set (SPEC §12.2). It MUST atomically RECORD `nonce` for `did`
+ * and return `true` iff the nonce was NOT already recorded (still unexpired); on a replay it MUST
+ * return `false` and leave the prior record intact. The record-AND-check MUST be one atomic step:
+ * the verifier treats a `true` return as proof the nonce is single-use, so a pure read that never
+ * persists the nonce (e.g. `(n) => !seen.has(n)` where `seen` is never written) is a replay HOLE —
+ * it compiles and provides ZERO protection. Scope the record by `did` to prevent cross-DID replay.
+ * Reach for the batteries-included {@link InMemoryNonceCache} (race-free) or
+ * {@link consumeFromNonceCacheProvider} rather than hand-rolling this.
+ */
+export type ConsumeNonceIfFresh = (nonce: string, did: string) => boolean | Promise<boolean>;
+/**
+ * The verification seams. `resolveKey` resolves the signing key by `kid`. `resolveDidKeys` is the
+ * INDEPENDENT RFC 7638 DID-membership proof (the signing key MUST be a verificationMethod the proof's
+ * `did` publishes) — it closes the forgeable-principal gap and is what a secure verifier binds on.
+ * `tokenCnfJkt` is the OAuth token's RFC 9449 sender-constraint for the cnf fusion; omit for L3-minus.
+ */
+export interface VerifyProofDeps {
+    resolveKey: ResolveKey;
+    /**
+     * The DID-membership seam: returns every Ed25519 verificationMethod the proof's `did` publishes,
+     * so the verifier can PROVE (RFC 7638 thumbprint) the signing key really belongs to that principal.
+     * SUPPLY THIS for any production verifier — it is the only independent binding of key → principal.
+     */
+    resolveDidKeys?: ResolveDidKeys;
+    /**
+     * INSECURE escape hatch — default `false` (secure). With no {@link ResolveDidKeys} seam there is no
+     * independent membership proof, so the verifier FAILS CLOSED (`did_membership_unverifiable`) by
+     * default rather than trust an unbound key. Set `true` ONLY when you attest that your
+     * {@link ResolveKey} is itself AUTHORITATIVE — it resolves the exact `did#fragment` from the DID
+     * document and returns ONLY that published key (dev/test, or a trusted internal resolver). In that
+     * mode binding rests on the `kid`-prefix check plus your resolveKey contract. Prefer `resolveDidKeys`.
+     */
+    trustResolveKeyAuthority?: boolean;
+    /** The verifier's own DID — the proof's `audience` MUST equal this (anti-relay). */
+    expectedAudience: string;
+    /** The access token's RFC 9449 `cnf.jkt` (enables L3 fusion); omit for L3-minus. */
+    tokenCnfJkt?: string;
+    /**
+     * Replay defense — the ATOMIC test-AND-set that records the nonce and returns `false` on a replay
+     * (SPEC §12.2). Wire {@link InMemoryNonceCache}'s `consume` (single-process, race-free) or
+     * {@link consumeFromNonceCacheProvider} (over a shared store). When it is omitted the verifier
+     * FAILS CLOSED (`nonce_seam_missing`) rather than skipping replay defense.
+     */
+    consumeNonceIfFresh?: ConsumeNonceIfFresh;
+    /** Injectable clock returning epoch MILLISECONDS (deterministic tests). */
+    now?: () => number;
+    /** Accepted clock skew in seconds (default {@link DEFAULT_SKEW_SEC}). */
+    skewSec?: number;
+}
+/** Assurance a valid proof carries: L3 on full cnf fusion, L3-minus without an AS `cnf`. */
+export type ProofAssurance = 'L3' | 'L3-minus';
+/** The result of {@link verifyCardProof} — `ok` iff there are no `reasons` (fail-closed). */
+export interface ProofVerifyResult {
+    ok: boolean;
+    reasons: string[];
+    /** Present only when `ok`: the derived assurance and the accountable principal DID. */
+    level?: ProofAssurance;
+    did?: string;
+    /**
+     * Non-fatal diagnostics. Unlike `reasons`, these do NOT affect `ok` — the proof is valid — but
+     * flag a configuration state a caller should be able to observe. Currently:
+     * `cnf_present_but_token_unfused` — the proof carried a sender-constraint (`cnf`) that could not be
+     * fused because the verifier was given no token `cnf.jkt` (`tokenCnfJkt`), so assurance is L3-minus,
+     * not L3. Surfaced so an integrator who intended L3 sees the downgrade instead of it passing silently.
+     */
+    warnings?: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/card/proof/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/card/proof/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAyB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAE1E,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,uBAAmB,CAAC;AAEjD;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,uBAAmB,CAAC;AAE3D,uEAAuE;AACvE,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC,iFAAiF;AACjF,eAAO,MAAM,WAAW,KAAK,CAAC;AAE9B,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,QAAyC,CAAC;AAY1E,8FAA8F;AAC9F,eAAO,MAAM,kBAAkB;;iBAE7B,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;kBAerB,CAAC;AAEZ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,mGAAmG;AACnG,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,KAAK,CAAC;IACX,GAAG,EAAE,SAAS,CAAC;IACf,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,OAAO,CAAC;IACb,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,sEAAsE;AACtE,MAAM,MAAM,eAAe,GAAG,iBAAiB,GAAG,cAAc,CAAC;AAEjE;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,0GAA0G;IAC1G,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IACjC,qGAAqG;IACrG,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C;;;;;OAKG;IACH,OAAO,CAAC,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAChD;AAED,gGAAgG;AAChG,MAAM,WAAW,iBAAiB;IAChC,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;AAEnF,gGAAgG;AAChG,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,cAAc,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;AAE3F;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAE7F;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,UAAU,CAAC;IACvB;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;;;;OAOG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,oFAAoF;IACpF,gBAAgB,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,UAAU,CAAC;AAE/C,6FAA6F;AAC7F,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,uFAAuF;IACvF,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB"}

package/dist/card/proof/types.js

@@ -0,0 +1,87 @@
+/**
+ * KYA-OS Entity Card — stateless per-request holder-of-key proof: shapes + seams.
+ *
+ * `org.kya-os/proof@1` is the STATELESS, sender-constrained proof profile. It rides its OWN
+ * `_meta` key ({@link KYA_OS_CARD_PROOF_META_KEY} = `org.kya-os/proof@1`), DISTINCT from the legacy
+ * session-bound `ProofMeta` (which carries `sessionId` + a handshake nonce under
+ * `org.kya-os/proof`). Separate keys let the two regimes coexist on one server without either guard
+ * seeing — or rejecting — the other's proof. Every request self-proves; there is no session state.
+ *
+ * All crypto is INJECTED via seams ({@link ProofSigner} for minting, {@link VerifyProofDeps}
+ * for verifying) so no runtime (`mcp-i-core`) dependency leaks into `@kya-os/mcp`; the module
+ * uses only `jose` + `json-canonicalize`, already direct dependencies.
+ */
+import { z } from 'zod';
+import { Did, PROOF_PROFILE_ID } from '../schema.js';
+/** The stateless per-request proof profile tag (the `prf` discriminator). */
+export const PROOF_PROFILE_V1 = PROOF_PROFILE_ID;
+/**
+ * The `_meta` key the STATELESS card proof rides under — DISTINCT from the legacy session proof's
+ * `org.kya-os/proof` (`KYA_OS_PROOF_META_KEY`). Sharing one key made the two regimes mutually
+ * exclusive on a server (a legacy proof failed the card schema and was 401'd; a card proof failed
+ * the legacy structure check). With separate keys each guard reads its OWN key and simply does not
+ * see the other's proof, so both can run on one server — genuinely additive, no legacy coupling. The
+ * key equals the `prf` profile id, so it is self-describing and versioned.
+ */
+export const KYA_OS_CARD_PROOF_META_KEY = PROOF_PROFILE_V1;
+/** Default proof lifetime in seconds (SPEC §8: short-lived, ≤ 60s). */
+export const DEFAULT_TTL_SEC = 60;
+/** Maximum accepted proof lifetime in seconds — a longer window fails closed. */
+export const MAX_TTL_SEC = 60;
+/** Default accepted clock skew in seconds (±) for the created/expires window. */
+export const DEFAULT_SKEW_SEC = 5;
+/**
+ * Minimum time a consumed nonce MUST be retained by the replay cache: the FULL verifier
+ * acceptance window, PLUS one second of rounding headroom. A proof is accepted while
+ * `created - skew ≤ now ≤ expires + skew` (with `expires = created + ttl`) — a window `ttl + 2·skew`
+ * wide. But the verifier compares at SECOND granularity and is inclusive at the top, so the last
+ * accepting second is honoured in full (up to +999 ms), while a nonce first consumed at the very
+ * start of the `created - skew` second is retained from there. Retaining for exactly `ttl + 2·skew`
+ * therefore leaves a sub-second tail in which an evicted nonce lets a still-valid proof replay; the
+ * `+ 1` closes it. Retention is measured from FIRST use. If a verifier widens `skewSec` beyond
+ * {@link DEFAULT_SKEW_SEC}, widen the cache TTL to match.
+ */
+export const NONCE_RETENTION_SEC = MAX_TTL_SEC + 2 * DEFAULT_SKEW_SEC + 1;
+/**
+ * base64url charset (RFC 4648 §5, no padding). `nonce` and `cnf.jkt` are embedded VERBATIM into the
+ * line-oriented RFC 9421 signature base (see `http-sig.ts`: `"kya-nonce": ${nonce}` / `"kya-cnf":
+ * ${jkt}`), so a newline — or any non-base64url byte — would corrupt that base. RFC 7638 thumbprints
+ * are base64url by definition, and a 128-bit nonce is CSPRNG base64url/hex, so we reject anything
+ * else EARLY at build/parse rather than leaning on the downstream verifier's base reconstruction to
+ * fail closed. (`did`/`audience` are DIDs, guarded by {@link Did}; `kid` is guarded below.)
+ */
+const BASE64URL = /^[A-Za-z0-9_-]+$/;
+/** RFC 7638 confirmation key thumbprint (`cnf.jkt`) — the sender-constraint fusion anchor. */
+export const CardProofCnfSchema = z.object({
+    jkt: z.string().min(1).regex(BASE64URL, 'cnf.jkt must be a base64url RFC 7638 thumbprint'),
+});
+/**
+ * The `org.kya-os/proof@1` payload. Every field except the two signatures (`jws`, `httpSig`) is a
+ * COVERED claim: the detached EdDSA `jws` signs the RFC 8785 (JCS) canonicalization of the claims,
+ * so tampering any of them fails the signature. `cnf.jkt` is OPTIONAL — present it degrades to
+ * L3-minus rather than blocking when the authorization server does not emit an RFC 9449 `cnf`.
+ *
+ * `httpSig` is the OPTIONAL second signature of the DUAL carrier: a RAW EdDSA signature (base64url,
+ * NOT JWS-framed) made by the SAME DID key over the RFC 9421 signature base the HTTP Message
+ * Signature sibling exposes. Because it is a raw signature over the exact base a stock RFC 9421
+ * verifier reconstructs, that sibling is genuinely cross-verifiable against the resolved DID key
+ * (the `jws` framing prepends a protected header, so its bytes could never satisfy a 9421 verifier).
+ * It degrades gracefully: a signer without a `signRaw` seam mints a JWS-only proof (no sibling).
+ */
+export const CardProofMetaSchema = z.object({
+    prf: z.literal(PROOF_PROFILE_V1),
+    alg: z.enum(['EdDSA', 'ES256']),
+    did: Did,
+    // The signing key reference MUST carry a `#fragment` (a verificationMethod id); the runtime also
+    // binds `kid.split('#')[0] === did`. did:key is base58btc, so the fragment is case-SENSITIVE.
+    kid: z.string().regex(/^did:(key|web):.+#.+$/, 'kid must be a DID with a #fragment (e.g. did:web:host#key-1)'),
+    audience: Did,
+    nonce: z.string().min(1).regex(BASE64URL, 'nonce must be base64url-safe (it is embedded verbatim in the RFC 9421 signature base)'),
+    created: z.number().int().nonnegative(),
+    expires: z.number().int().nonnegative(),
+    requestHash: z.string().min(1),
+    cnf: CardProofCnfSchema.optional(),
+    jws: z.string().min(1),
+    httpSig: z.string().min(1).optional(),
+}).strict(); // no unknown fields: the covered-claims set IS the signed contract (matches schema.ts)
+//# sourceMappingURL=types.js.map

package/dist/card/proof/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/card/proof/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAuB,MAAM,cAAc,CAAC;AAE1E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAEjD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,gBAAgB,CAAC;AAE3D,uEAAuE;AACvE,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAElC,iFAAiF;AACjF,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAE9B,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAElC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,GAAG,CAAC,GAAG,gBAAgB,GAAG,CAAC,CAAC;AAE1E;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAErC,8FAA8F;AAC9F,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,iDAAiD,CAAC;CAC3F,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IAChC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/B,GAAG,EAAE,GAAG;IACR,iGAAiG;IACjG,8FAA8F;IAC9F,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,EAAE,8DAA8D,CAAC;IAC9G,QAAQ,EAAE,GAAG;IACb,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,uFAAuF,CAAC;IAClI,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACvC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,GAAG,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,uFAAuF"}

package/dist/card/proof/verify.d.ts

@@ -0,0 +1,27 @@
+/**
+ * KYA-OS Entity Card proof — VERIFY (`verifyCardProof`), fail-closed.
+ *
+ * Recompute EVERY binding a stateless `org.kya-os/proof@1` asserts and reject on the first thing
+ * that does not hold. The signature only proves the proof is AUTHENTIC (signed by the holder of
+ * `kid`); accountability requires binding that key to the accountable principal `did`:
+ *
+ *   1. `kid`'s DID part MUST equal `proof.did` (`kid.split('#')[0] === did`) — closes the
+ *      forgeable-principal gap where a proof claims a victim `did` while `kid` points elsewhere;
+ *   2. the resolved signing key MUST be a verificationMethod of `proof.did`, via the injected
+ *      `resolveDidKeys` seam (RFC 7638 thumbprint membership) — closes a key that merely shares
+ *      the DID's `kid` prefix but is not actually published by that DID.
+ *
+ * Plus: `audience` → the verifier, `requestHash` → THIS body, `nonce` → unseen, `created`/`expires`
+ * → NOW (±skew), the detached JWS → the covered claims, and the `cnf.jkt` fusion
+ * (`token.cnf.jkt === proof.cnf.jkt === thumbprint(resolve(kid))`). Any failure appends a reason;
+ * `ok` is true iff there are none.
+ */
+import type { ToolRequest } from '../../proof/generator.js';
+import { type ProofVerifyResult, type VerifyProofDeps } from './types.js';
+/**
+ * Verify an `org.kya-os/proof@1` against the request it should bind and the injected seams.
+ * Fail-closed: returns `{ ok:false, reasons }` on any broken binding; on success returns the
+ * derived assurance (`L3` on full cnf fusion, `L3-minus` without an AS `cnf`) and the principal.
+ */
+export declare function verifyCardProof(proof: unknown, req: ToolRequest, deps: VerifyProofDeps): Promise<ProofVerifyResult>;
+//# sourceMappingURL=verify.d.ts.map

package/dist/card/proof/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/card/proof/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAG5D,OAAO,EAML,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACrB,MAAM,YAAY,CAAC;AAEpB;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,OAAO,EACd,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,iBAAiB,CAAC,CAmC5B"}

package/dist/card/proof/verify.js

@@ -0,0 +1,236 @@
+/**
+ * KYA-OS Entity Card proof — VERIFY (`verifyCardProof`), fail-closed.
+ *
+ * Recompute EVERY binding a stateless `org.kya-os/proof@1` asserts and reject on the first thing
+ * that does not hold. The signature only proves the proof is AUTHENTIC (signed by the holder of
+ * `kid`); accountability requires binding that key to the accountable principal `did`:
+ *
+ *   1. `kid`'s DID part MUST equal `proof.did` (`kid.split('#')[0] === did`) — closes the
+ *      forgeable-principal gap where a proof claims a victim `did` while `kid` points elsewhere;
+ *   2. the resolved signing key MUST be a verificationMethod of `proof.did`, via the injected
+ *      `resolveDidKeys` seam (RFC 7638 thumbprint membership) — closes a key that merely shares
+ *      the DID's `kid` prefix but is not actually published by that DID.
+ *
+ * Plus: `audience` → the verifier, `requestHash` → THIS body, `nonce` → unseen, `created`/`expires`
+ * → NOW (±skew), the detached JWS → the covered claims, and the `cnf.jkt` fusion
+ * (`token.cnf.jkt === proof.cnf.jkt === thumbprint(resolve(kid))`). Any failure appends a reason;
+ * `ok` is true iff there are none.
+ */
+import { calculateJwkThumbprint, flattenedVerify, importJWK } from 'jose';
+import { base64urlDecodeToString, base64urlEncodeFromBytes } from '../../utils/base64.js';
+import { canonicalPayloadBytes, computeRequestHash } from './canonical.js';
+import { CardProofMetaSchema, DEFAULT_SKEW_SEC, MAX_TTL_SEC, } from './types.js';
+/**
+ * Verify an `org.kya-os/proof@1` against the request it should bind and the injected seams.
+ * Fail-closed: returns `{ ok:false, reasons }` on any broken binding; on success returns the
+ * derived assurance (`L3` on full cnf fusion, `L3-minus` without an AS `cnf`) and the principal.
+ */
+export async function verifyCardProof(proof, req, deps) {
+    const reasons = [];
+    const parsed = CardProofMetaSchema.safeParse(proof);
+    if (!parsed.success)
+        return { ok: false, reasons: ['malformed_proof'] };
+    const meta = parsed.data;
+    if (meta.kid.split('#')[0] !== meta.did)
+        reasons.push('kid_did_mismatch');
+    // `resolveKey` (DID-key resolution, possibly a network fetch) and `computeRequestHash` (local JCS +
+    // SHA-256) are INDEPENDENT — run them concurrently. Fail-closed semantics are unchanged: each still
+    // appends its own reason. Caching the resolved key belongs at the injected `resolveKey` seam (the
+    // consumer owns it); verifyCardProof stays a pure, stateless function — no cross-tenant global cache.
+    const [key, computedHash] = await Promise.all([resolveKey(meta.kid, deps, reasons), computeRequestHash(req)]);
+    if (key)
+        await assertDidMembership(key, meta.did, deps, reasons);
+    // Bind the declared alg to the resolved key type: an ES256 claim MUST carry a P-256 key, an EdDSA
+    // claim an Ed25519 key. `alg` is a signed covered claim, but the KEY type is authoritative here —
+    // this closes alg/key confusion. Gate the signature check on it so import always uses a matching alg.
+    const algOk = key !== undefined && keyMatchesAlg(key, meta.alg);
+    if (key && !algOk)
+        reasons.push('alg_key_mismatch');
+    if (meta.audience !== deps.expectedAudience)
+        reasons.push('audience_mismatch');
+    if (meta.requestHash !== computedHash)
+        reasons.push('request_hash_mismatch');
+    checkWindow(meta, deps, reasons);
+    await consumeNonce(meta, deps, reasons);
+    if (key && algOk && !(await verifyDetachedJws(meta, key)))
+        reasons.push('invalid_signature');
+    const warnings = [];
+    let level = 'L3-minus';
+    if (key)
+        level = await checkCnfFusion(meta, key, deps, reasons, warnings);
+    const ok = reasons.length === 0;
+    const withWarnings = warnings.length > 0 ? { warnings } : {};
+    return ok
+        ? { ok, reasons, level, did: meta.did, ...withWarnings }
+        : { ok, reasons, ...withWarnings };
+}
+/** Resolve the signing key for `kid`; fail-closed (records `key_unresolvable`) on throw. */
+async function resolveKey(kid, deps, reasons) {
+    try {
+        return await deps.resolveKey(kid);
+    }
+    catch {
+        reasons.push('key_unresolvable');
+        return undefined;
+    }
+}
+/**
+ * Cryptographically bind the signing key to `did`: it MUST be one of the DID document's
+ * verification keys (RFC 7638 thumbprint membership), via the injected `resolveDidKeys` seam.
+ * SECURE BY DEFAULT:
+ *   - `resolveDidKeys` PRESENT → run the independent membership proof (always);
+ *   - `resolveDidKeys` ABSENT → there is NO independent proof, so FAIL CLOSED
+ *     (`did_membership_unverifiable`) unless the caller explicitly attests its `resolveKey` is
+ *     authoritative via `trustResolveKeyAuthority` (dev/test or a trusted internal resolver).
+ * Fail-closed on an unresolvable document.
+ */
+async function assertDidMembership(key, did, deps, reasons) {
+    if (!deps.resolveDidKeys) {
+        // No membership seam: a minimal verifier must not silently trust an unbound key.
+        if (!deps.trustResolveKeyAuthority)
+            reasons.push('did_membership_unverifiable');
+        return;
+    }
+    let didKeys;
+    try {
+        didKeys = await deps.resolveDidKeys(did);
+    }
+    catch {
+        reasons.push('did_keys_unresolvable');
+        return;
+    }
+    let keyJkt;
+    let published;
+    try {
+        keyJkt = await thumbprint(key);
+        published = await Promise.all(didKeys.map(thumbprint));
+    }
+    catch {
+        // A structurally-typed but invalid JWK from the seam (jose throws) must fail CLOSED with a
+        // reason, never as an unhandled rejection out of verifyCardProof — matches the seam-catch above.
+        reasons.push('thumbprint_computation_failed');
+        return;
+    }
+    if (!published.includes(keyJkt))
+        reasons.push('kid_not_in_did_document');
+}
+/**
+ * Atomically CONSUME the nonce via the injected `consumeNonceIfFresh` replay seam (test-AND-set —
+ * SPEC §12.2). A `false` return is a replay (`nonce_replayed`). When the seam is not supplied there
+ * is no replay defense to run, so we FAIL CLOSED (`nonce_seam_missing`) rather than skip the check.
+ */
+async function consumeNonce(meta, deps, reasons) {
+    const consume = deps.consumeNonceIfFresh;
+    if (!consume) {
+        reasons.push('nonce_seam_missing');
+        return;
+    }
+    if (!(await consume(meta.nonce, meta.did)))
+        reasons.push('nonce_replayed');
+}
+/** Enforce the created/expires window: sane bounds, capped TTL, and ±skew freshness. */
+function checkWindow(meta, deps, reasons) {
+    const skew = deps.skewSec ?? DEFAULT_SKEW_SEC;
+    const now = Math.floor((deps.now?.() ?? Date.now()) / 1000);
+    if (meta.expires <= meta.created)
+        reasons.push('invalid_window');
+    if (meta.expires - meta.created > MAX_TTL_SEC)
+        reasons.push('ttl_too_long');
+    if (meta.created > now + skew)
+        reasons.push('created_in_future');
+    if (meta.expires < now - skew)
+        reasons.push('expired');
+}
+/**
+ * Verify the DETACHED JWS over the reconstructed covered claims. The header is NOT trusted: its `alg`
+ * MUST equal the (schema-allow-listed `EdDSA`|`ES256`, and signed) `meta.alg`, and its `kid` MUST equal
+ * `meta.kid`. Verification is PINNED to that single alg — never negotiated. The payload is recomputed
+ * from the meta (JCS), so any tampered covered field (including `alg`) yields a different signing input.
+ */
+async function verifyDetachedJws(meta, key) {
+    const parts = meta.jws.split('.');
+    if (parts.length !== 3 || parts[1] !== '')
+        return false;
+    const [protectedB64, , signatureB64] = parts;
+    const header = decodeHeader(protectedB64);
+    if (!header || header.alg !== meta.alg || header.kid !== meta.kid)
+        return false;
+    try {
+        const pub = await importJWK(toJwk(key), meta.alg);
+        await flattenedVerify({
+            protected: protectedB64,
+            payload: base64urlEncodeFromBytes(canonicalPayloadBytes(meta)),
+            signature: signatureB64,
+        }, pub, { algorithms: [meta.alg] });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** True iff the resolved key's type is the one the declared `alg` requires (anti-confusion). */
+function keyMatchesAlg(key, alg) {
+    return alg === 'ES256'
+        ? key.kty === 'EC' && key.crv === 'P-256'
+        : key.kty === 'OKP' && key.crv === 'Ed25519';
+}
+/**
+ * The `cnf.jkt` fusion (SPEC §8): a present `cnf.jkt` MUST equal the signing key's thumbprint,
+ * and when the AS supplies a token `cnf.jkt` the three MUST fuse
+ * (`token.cnf.jkt === proof.cnf.jkt === thumbprint(resolve(kid))`) for L3. No token `cnf` degrades
+ * to L3-minus; a token `cnf` with no proof `cnf` is a downgrade attack and fails closed.
+ */
+async function checkCnfFusion(meta, key, deps, reasons, warnings) {
+    let keyJkt;
+    try {
+        keyJkt = await thumbprint(key);
+    }
+    catch {
+        // Same fail-closed contract as assertDidMembership: an invalid JWK denies with a reason.
+        reasons.push('thumbprint_computation_failed');
+        return 'L3-minus';
+    }
+    if (meta.cnf && meta.cnf.jkt !== keyJkt)
+        reasons.push('cnf_key_mismatch');
+    if (deps.tokenCnfJkt === undefined) {
+        // No token cnf.jkt was supplied, so there is nothing to fuse against and assurance is L3-minus.
+        // If the client nonetheless PRESENTED a sender-constraint (`cnf`), the proof was capable of L3 —
+        // it degraded only because `tokenCnfJkt` was not wired. That is a valid L3-minus proof, not a
+        // failure, so it is a warning (not a reason): it lets an integrator who intended L3 notice the
+        // silent downgrade rather than assume token-theft resistance they are not actually getting.
+        if (meta.cnf)
+            warnings.push('cnf_present_but_token_unfused');
+        return 'L3-minus';
+    }
+    if (!meta.cnf) {
+        reasons.push('cnf_required_by_token');
+        return 'L3-minus';
+    }
+    if (meta.cnf.jkt !== deps.tokenCnfJkt) {
+        reasons.push('cnf_token_mismatch');
+        return 'L3-minus';
+    }
+    return meta.cnf.jkt === keyJkt ? 'L3' : 'L3-minus';
+}
+/** Decode a base64url JWS protected header to `{ alg, kid }`, or null on malformed input. */
+function decodeHeader(b64) {
+    if (!b64)
+        return null;
+    try {
+        return JSON.parse(base64urlDecodeToString(b64));
+    }
+    catch {
+        return null;
+    }
+}
+/** The RFC 7638 thumbprint of an Ed25519 public JWK (canonical `{crv,kty,x}` only). */
+function thumbprint(key) {
+    return calculateJwkThumbprint(toJwk(key), 'sha256');
+}
+/** Project a proof public JWK to the canonical `jose` JWK (drop `kid`/`use`; EC carries `x`+`y`). */
+function toJwk(key) {
+    return key.kty === 'EC'
+        ? { kty: 'EC', crv: 'P-256', x: key.x, y: key.y }
+        : { kty: 'OKP', crv: 'Ed25519', x: key.x };
+}
+//# sourceMappingURL=verify.js.map

package/dist/card/proof/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/card/proof/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1E,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAG1F,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,WAAW,GAKZ,MAAM,YAAY,CAAC;AAEpB;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAc,EACd,GAAgB,EAChB,IAAqB;IAErB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAEzB,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAE1E,oGAAoG;IACpG,oGAAoG;IACpG,kGAAkG;IAClG,sGAAsG;IACtG,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9G,IAAI,GAAG;QAAE,MAAM,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACjE,kGAAkG;IAClG,kGAAkG;IAClG,sGAAsG;IACtG,MAAM,KAAK,GAAG,GAAG,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAChE,IAAI,GAAG,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAEpD,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,gBAAgB;QAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC/E,IAAI,IAAI,CAAC,WAAW,KAAK,YAAY;QAAE,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC7E,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAE7F,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,KAAK,GAAmB,UAAU,CAAC;IACvC,IAAI,GAAG;QAAE,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAE1E,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;IAChC,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,OAAO,EAAE;QACP,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE;QACxD,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,EAAE,CAAC;AACvC,CAAC;AAED,4FAA4F;AAC5F,KAAK,UAAU,UAAU,CACvB,GAAW,EACX,IAAqB,EACrB,OAAiB;IAEjB,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,mBAAmB,CAChC,GAAmB,EACnB,GAAW,EACX,IAAqB,EACrB,OAAiB;IAEjB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACzB,iFAAiF;QACjF,IAAI,CAAC,IAAI,CAAC,wBAAwB;YAAE,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAChF,OAAO;IACT,CAAC;IACD,IAAI,OAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IACD,IAAI,MAAc,CAAC;IACnB,IAAI,SAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;QAC/B,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,2FAA2F;QAC3F,iGAAiG;QACjG,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,IAAmB,EACnB,IAAqB,EACrB,OAAiB;IAEjB,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC;IACzC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAC7E,CAAC;AAED,wFAAwF;AACxF,SAAS,WAAW,CAAC,IAAmB,EAAE,IAAqB,EAAE,OAAiB;IAChF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,GAAG,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC5E,IAAI,IAAI,CAAC,OAAO,GAAG,GAAG,GAAG,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,OAAO,GAAG,GAAG,GAAG,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAAC,IAAmB,EAAE,GAAmB;IACvE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,CAAC,YAAY,EAAE,AAAD,EAAG,YAAY,CAAC,GAAG,KAAK,CAAC;IAC7C,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAChF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,eAAe,CACnB;YACE,SAAS,EAAE,YAAY;YACvB,OAAO,EAAE,wBAAwB,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC9D,SAAS,EAAE,YAAa;SACzB,EACD,GAAG,EACH,EAAE,UAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC3B,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,SAAS,aAAa,CAAC,GAAmB,EAAE,GAAsB;IAChE,OAAO,GAAG,KAAK,OAAO;QACpB,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO;QACzC,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAC3B,IAAmB,EACnB,GAAmB,EACnB,IAAqB,EACrB,OAAiB,EACjB,QAAkB;IAElB,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,yFAAyF;QACzF,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC9C,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnC,gGAAgG;QAChG,iGAAiG;QACjG,8FAA8F;QAC9F,+FAA+F;QAC/F,4FAA4F;QAC5F,IAAI,IAAI,CAAC,GAAG;YAAE,QAAQ,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC7D,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACtC,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACnC,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;AACrD,CAAC;AAED,6FAA6F;AAC7F,SAAS,YAAY,CAAC,GAAuB;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAmC,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,UAAU,CAAC,GAAmB;IACrC,OAAO,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;AACtD,CAAC;AAED,qGAAqG;AACrG,SAAS,KAAK,CAAC,GAAmB;IAChC,OAAO,GAAG,CAAC,GAAG,KAAK,IAAI;QACrB,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE;QACjD,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC"}