@motebit/crypto 0.8.0 → 1.1.0

package/dist/credential-anchor.d.ts

@@ -1,11 +1,14 @@
 /**
  * Credential anchor — leaf hashing and self-verification.
  *
- * MIT: these functions are part of the open protocol. Any implementation
- * can compute credential leaves and verify anchor proofs using this module.
+ * Permissive floor (Apache-2.0): these functions are part of the open protocol.
+ * Any implementation can compute credential leaves and verify anchor proofs
+ * using this module.
  *
  * motebit/credential-anchor@1.0 §3 (leaf hash) and §5.2 (verification).
  */
+/** The one suite CredentialAnchorBatch records sign under today. */
+export declare const CREDENTIAL_ANCHOR_SUITE: "motebit-jcs-ed25519-hex-v1";
 /**
  * Compute a credential leaf hash for Merkle anchoring.
  *
@@ -64,6 +67,13 @@ export interface CredentialAnchorProofFields {
     layer_sizes: number[];
     relay_id: string;
     relay_public_key: string;
+    /**
+     * Cryptosuite discriminator for `batch_signature`. Always
+     * `"motebit-jcs-ed25519-hex-v1"` — JCS canonicalization of the batch
+     * payload, Ed25519 primitive, hex signature encoding. Verifiers
+     * reject missing or unknown values fail-closed.
+     */
+    suite: typeof CREDENTIAL_ANCHOR_SUITE;
     batch_signature: string;
     anchor: {
         chain: string;
@@ -94,4 +104,68 @@ export interface CredentialAnchorProofFields {
  * ```
  */
 export declare function verifyCredentialAnchor(credential: Record<string, unknown>, anchorProof: CredentialAnchorProofFields, chainVerifier?: ChainAnchorVerifier): Promise<CredentialAnchorVerifyResult>;
+/** Result of verifying an onchain revocation anchor. */
+export interface RevocationAnchorVerifyResult {
+    /** Whether the revocation anchor is valid. */
+    valid: boolean;
+    /** Individual step results. */
+    steps: {
+        /** Step 1: memo format is valid and contains the expected public key. */
+        memo_valid: boolean;
+        /** Step 2: relay's Ed25519 signature over the revocation payload is valid. */
+        relay_signature_valid: boolean;
+        /** Step 3: onchain anchor verified (null if not checked). */
+        chain_verified: boolean | null;
+    };
+    /** Error messages for failed steps. */
+    errors: string[];
+}
+/** The one suite revocation anchor events sign under today (utf8-concat). */
+export declare const REVOCATION_ANCHOR_SUITE: "motebit-concat-ed25519-hex-v1";
+/** Fields needed to verify a revocation anchor. */
+export interface RevocationAnchorProof {
+    /** Hex-encoded public key that was revoked. */
+    revoked_public_key: string;
+    /** Millisecond timestamp of the revocation event. */
+    timestamp: number;
+    /**
+     * Cryptosuite discriminator. Always `"motebit-concat-ed25519-hex-v1"` —
+     * UTF-8 concatenation template + Ed25519 primitive + hex signature.
+     * Same suite as federation heartbeat.
+     */
+    suite: typeof REVOCATION_ANCHOR_SUITE;
+    /** Hex-encoded Ed25519 signature over the revocation payload by the relay. */
+    signature: string;
+    /** Hex-encoded Ed25519 public key of the relay that signed the revocation. */
+    relay_public_key: string;
+    /** Onchain anchor metadata, or null if not yet submitted. */
+    anchor: {
+        chain: string;
+        network: string;
+        tx_hash: string;
+    } | null;
+}
+/**
+ * Verify a revocation anchor — confirm a key was revoked.
+ *
+ * The revocation memo format is: "motebit:revocation:v1:{public_key_hex}:{timestamp}"
+ * The relay signs the payload "revocation:{type}:{motebit_id}:{timestamp}" with its
+ * identity key. This function verifies:
+ *
+ * 1. The relay's Ed25519 signature over the revocation event
+ * 2. Optionally, the onchain memo transaction via a callback
+ *
+ * Both steps are offline-verifiable given the relay's public key. The onchain
+ * step requires network access but ensures the relay cannot deny the revocation.
+ *
+ * @param proof - The revocation anchor proof fields
+ * @param revocationPayload - The exact signed payload string (e.g., "revocation:key_rotated:mid-xxx:1712345678")
+ * @param chainVerifier - Optional callback: given tx_hash + expected memo, verify onchain
+ */
+export declare function verifyRevocationAnchor(proof: RevocationAnchorProof, revocationPayload: string, chainVerifier?: (anchor: {
+    chain: string;
+    network: string;
+    tx_hash: string;
+    expected_memo: string;
+}) => Promise<boolean>): Promise<RevocationAnchorVerifyResult>;
 //# sourceMappingURL=credential-anchor.d.ts.map

package/dist/credential-anchor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-anchor.d.ts","sourceRoot":"","sources":["../src/credential-anchor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA6BH;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAIhG;AA4CD,qDAAqD;AACrD,MAAM,WAAW,4BAA4B;IAC3C,wCAAwC;IACxC,KAAK,EAAE,OAAO,CAAC;IACf,+BAA+B;IAC/B,KAAK,EAAE;QACL,wDAAwD;QACxD,UAAU,EAAE,OAAO,CAAC;QACpB,6DAA6D;QAC7D,YAAY,EAAE,OAAO,CAAC;QACtB,yEAAyE;QACzE,qBAAqB,EAAE,OAAO,CAAC;QAC/B,6DAA6D;QAC7D,cAAc,EAAE,OAAO,GAAG,IAAI,CAAC;KAChC,CAAC;IACF,uCAAuC;IACvC,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEvB,uDAAuD;AACvD,MAAM,WAAW,2BAA2B;IAC1C,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,IAAI,CAAC;CACV;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,WAAW,EAAE,2BAA2B,EACxC,aAAa,CAAC,EAAE,mBAAmB,GAClC,OAAO,CAAC,4BAA4B,CAAC,CAgFvC"}
+{"version":3,"file":"credential-anchor.d.ts","sourceRoot":"","sources":["../src/credential-anchor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,oEAAoE;AACpE,eAAO,MAAM,uBAAuB,EAAG,4BAAqC,CAAC;AA2B7E;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAIhG;AA4CD,qDAAqD;AACrD,MAAM,WAAW,4BAA4B;IAC3C,wCAAwC;IACxC,KAAK,EAAE,OAAO,CAAC;IACf,+BAA+B;IAC/B,KAAK,EAAE;QACL,wDAAwD;QACxD,UAAU,EAAE,OAAO,CAAC;QACpB,6DAA6D;QAC7D,YAAY,EAAE,OAAO,CAAC;QACtB,yEAAyE;QACzE,qBAAqB,EAAE,OAAO,CAAC;QAC/B,6DAA6D;QAC7D,cAAc,EAAE,OAAO,GAAG,IAAI,CAAC;KAChC,CAAC;IACF,uCAAuC;IACvC,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEvB,uDAAuD;AACvD,MAAM,WAAW,2BAA2B;IAC1C,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,KAAK,EAAE,OAAO,uBAAuB,CAAC;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,IAAI,CAAC;CACV;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,WAAW,EAAE,2BAA2B,EACxC,aAAa,CAAC,EAAE,mBAAmB,GAClC,OAAO,CAAC,4BAA4B,CAAC,CA8FvC;AAID,wDAAwD;AACxD,MAAM,WAAW,4BAA4B;IAC3C,8CAA8C;IAC9C,KAAK,EAAE,OAAO,CAAC;IACf,+BAA+B;IAC/B,KAAK,EAAE;QACL,yEAAyE;QACzE,UAAU,EAAE,OAAO,CAAC;QACpB,8EAA8E;QAC9E,qBAAqB,EAAE,OAAO,CAAC;QAC/B,6DAA6D;QAC7D,cAAc,EAAE,OAAO,GAAG,IAAI,CAAC;KAChC,CAAC;IACF,uCAAuC;IACvC,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,EAAG,+BAAwC,CAAC;AAEhF,mDAAmD;AACnD,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,kBAAkB,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,KAAK,EAAE,OAAO,uBAAuB,CAAC;IACtC,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,gBAAgB,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;KACjB,GAAG,IAAI,CAAC;CACV;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,qBAAqB,EAC5B,iBAAiB,EAAE,MAAM,EACzB,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;CACvB,KAAK,OAAO,CAAC,OAAO,CAAC,GACrB,OAAO,CAAC,4BAA4B,CAAC,CAoEvC"}

package/dist/credentials.d.ts

@@ -4,7 +4,7 @@
  * Signing and verification of W3C Verifiable Credentials and Presentations
  * using the protocol's canonical Ed25519 + JCS pipeline.
  *
- * Moved from BSL @motebit/crypto to MIT @motebit/crypto.
+ * Moved from BSL @motebit/encryption to the permissive floor in @motebit/crypto (Apache-2.0).
  */
 export interface DataIntegrityProof {
     type: "DataIntegrityProof";
@@ -67,6 +67,21 @@ export interface TrustCredentialSubject {
     failed_tasks: number;
     first_seen_at: number;
     last_seen_at: number;
+    /**
+     * Optional hardware-attestation claim. Mirror of the same-named
+     * field on `TrustCredentialSubject` in `@motebit/protocol`. Set when
+     * a peer issuer has verified the subject's self-published
+     * hardware-attestation credential and is folding the verified claim
+     * into a peer credential about the subject. See
+     * `spec/credential-v1.md` §3.4.
+     */
+    hardware_attestation?: HardwareAttestationClaim;
+}
+/** Mirror of `HardwareAttestationClaim` in `@motebit/protocol`. */
+export interface HardwareAttestationClaim {
+    platform: "secure_enclave" | "tpm" | "play_integrity" | "android_keystore" | "device_check" | "webauthn" | "software";
+    key_exported?: boolean;
+    attestation_receipt?: string;
 }
 export declare function signVerifiableCredential<T = Record<string, unknown>>(unsignedVC: Omit<VerifiableCredential<T>, "proof">, privateKey: Uint8Array, publicKey: Uint8Array): Promise<VerifiableCredential<T>>;
 export declare function verifyVerifiableCredential<T = Record<string, unknown>>(vc: VerifiableCredential<T>): Promise<boolean>;
@@ -102,6 +117,16 @@ export declare function issueTrustCredential(trustRecord: {
     failed_tasks?: number;
     first_seen_at: number;
     last_seen_at: number;
+    /**
+     * Optional verified `HardwareAttestationClaim` to embed in the
+     * subject. Phase 1 of the hardware-attestation peer flow: the
+     * issuer (delegator that consumed the worker's receipt) verifies
+     * the worker's self-published claim via
+     * `verifyHardwareAttestationClaim` and includes the verified claim
+     * here. Routing aggregation reads this via
+     * `aggregateHardwareAttestation`. Spec credential-v1 §3.4.
+     */
+    hardware_attestation?: HardwareAttestationClaim;
 }, privateKey: Uint8Array, publicKey: Uint8Array, subjectDid: string, validForMs?: number, statusEndpoint?: string): Promise<VerifiableCredential<TrustCredentialSubject>>;
 export declare function createPresentation(credentials: VerifiableCredential[], privateKey: Uint8Array, publicKey: Uint8Array): Promise<VerifiablePresentation>;
 //# sourceMappingURL=credentials.d.ts.map

package/dist/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAeH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,iBAAiB,GAAG,gBAAgB,CAAC;IACnD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC/D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,CAAC,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD,KAAK,EAAE,kBAAkB,CAAC;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB,EAAE,oBAAoB,EAAE,CAAC;IAC7C,KAAK,EAAE,kBAAkB,CAAC;CAC3B;AAKD,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB;AAgGD,wBAAsB,wBAAwB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxE,UAAU,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAClD,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAQlC;AAED,wBAAsB,0BAA0B,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1E,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,OAAO,CAAC,CAMlB;AAID,wBAAsB,0BAA0B,CAC9C,UAAU,EAAE,IAAI,CAAC,sBAAsB,EAAE,OAAO,CAAC,EACjD,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,sBAAsB,CAAC,CAQjC;AAED,wBAAsB,4BAA4B,CAChD,EAAE,EAAE,sBAAsB,GACzB,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAoB/C;AAUD,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE;IACR,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;CACnB,EACD,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,UAAU,EACrB,UAAU,CAAC,EAAE,MAAM,EACnB,UAAU,SAAc,EACxB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,oBAAoB,CAAC,yBAAyB,CAAC,CAAC,CA8B1D;AAED,wBAAsB,yBAAyB,CAC7C,QAAQ,EAAE;IACR,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB,EACD,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,UAAU,EACrB,UAAU,EAAE,MAAM,EAClB,UAAU,SAAc,EACxB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,oBAAoB,CAAC,2BAA2B,CAAC,CAAC,CA2B5D;AAED,wBAAsB,oBAAoB,CACxC,WAAW,EAAE;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB,EACD,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,UAAU,EACrB,UAAU,EAAE,MAAM,EAClB,UAAU,SAAc,EACxB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CA0BvD;AAED,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,oBAAoB,EAAE,EACnC,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,sBAAsB,CAAC,CAUjC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAeH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,iBAAiB,GAAG,gBAAgB,CAAC;IACnD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC/D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,CAAC,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD,KAAK,EAAE,kBAAkB,CAAC;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB,EAAE,oBAAoB,EAAE,CAAC;IAC7C,KAAK,EAAE,kBAAkB,CAAC;CAC3B;AAKD,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,wBAAwB,CAAC;CACjD;AAED,mEAAmE;AACnE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EACJ,gBAAgB,GAChB,KAAK,GACL,gBAAgB,GAChB,kBAAkB,GAClB,cAAc,GACd,UAAU,GACV,UAAU,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAgGD,wBAAsB,wBAAwB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxE,UAAU,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAClD,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAQlC;AAED,wBAAsB,0BAA0B,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1E,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,OAAO,CAAC,CAMlB;AAID,wBAAsB,0BAA0B,CAC9C,UAAU,EAAE,IAAI,CAAC,sBAAsB,EAAE,OAAO,CAAC,EACjD,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,sBAAsB,CAAC,CAQjC;AAED,wBAAsB,4BAA4B,CAChD,EAAE,EAAE,sBAAsB,GACzB,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAoB/C;AAUD,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE;IACR,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;CACnB,EACD,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,UAAU,EACrB,UAAU,CAAC,EAAE,MAAM,EACnB,UAAU,SAAc,EACxB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,oBAAoB,CAAC,yBAAyB,CAAC,CAAC,CA8B1D;AAED,wBAAsB,yBAAyB,CAC7C,QAAQ,EAAE;IACR,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB,EACD,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,UAAU,EACrB,UAAU,EAAE,MAAM,EAClB,UAAU,SAAc,EACxB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,oBAAoB,CAAC,2BAA2B,CAAC,CAAC,CA2B5D;AAED,wBAAsB,oBAAoB,CACxC,WAAW,EAAE;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,wBAAwB,CAAC;CACjD,EACD,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,UAAU,EACrB,UAAU,EAAE,MAAM,EAClB,UAAU,SAAc,EACxB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CA6BvD;AAED,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,oBAAoB,EAAE,EACnC,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,sBAAsB,CAAC,CAUjC"}

package/dist/hardware-attestation.d.ts

@@ -0,0 +1,268 @@
+/**
+ * Hardware attestation — verify that a motebit's Ed25519 identity key
+ * is bound to a hardware-backed ECDSA P-256 key held in a platform
+ * trust anchor (Apple Secure Enclave today; TPM / Play Integrity /
+ * DeviceCheck as future additive adapters).
+ *
+ * ## Why this exists
+ *
+ * Motebit's identity key is Ed25519, stored in the OS keyring on
+ * desktop and in equivalent app-sandboxed stores on mobile/web. That
+ * key is *software-custody*: the private bytes are readable by any
+ * process running as the user. The moat thesis — "accumulated trust
+ * that a third party can verify" — is categorically weaker without a
+ * hardware root. Hardware attestation bridges the gap without forcing
+ * a cryptosuite migration: a separate hardware-native keypair (Apple
+ * Secure Enclave generates ECDSA P-256) signs a canonical claim that
+ * binds itself to the Ed25519 identity. The identity stays where it
+ * is; the hardware signature is *additional* evidence a verifier can
+ * rank against.
+ *
+ * Same shape as FIDO / WebAuthn attestation — the platform root key
+ * is distinct from the user-facing identity, and one attests the
+ * other.
+ *
+ * ## Receipt format (`platform: "secure_enclave"`)
+ *
+ *   attestation_receipt = base64url(canonical_body_json) + "." +
+ *                         base64url(ecdsa_p256_signature_der)
+ *
+ *   canonical_body_json = JCS-canonicalized JSON of:
+ *     {
+ *       version: "1",
+ *       algorithm: "ecdsa-p256-sha256",
+ *       motebit_id: string,
+ *       device_id: string,
+ *       identity_public_key: Ed25519 hex lowercase,
+ *       se_public_key: P-256 compressed-point hex lowercase,
+ *       attested_at: unix ms,
+ *     }
+ *
+ * The P-256 signature is over `SHA-256(canonical_body_json)` — standard
+ * ECDSA-on-SHA256. The verifier recovers the SE public key from
+ * `body.se_public_key` (self-contained; zero relay contact), verifies
+ * the signature, then checks that `body.identity_public_key` equals the
+ * Ed25519 key the credential subject is claimed for.
+ *
+ * ## Non-goals in v1
+ *
+ *   - Other platforms (TPM / DeviceCheck / Play Integrity) — each
+ *     returns `valid: false` + a named-missing-adapter error. Additive
+ *     platform adapters plug in behind the same result shape.
+ *   - Revocation — claims expire with their parent credential's
+ *     expiry. No separate revocation channel.
+ *   - Chain-of-trust verification — the SE public key is the
+ *     self-asserted root in v1. Future platform adapters verify the
+ *     platform's own attestation chain (Apple's root CA, Google's
+ *     verified-boot chain, etc.) as glucose per the metabolic
+ *     principle.
+ *
+ * Permissive floor (Apache-2.0), no I/O, deterministic. Safe to run in any
+ * environment that can parse UTF-8 JSON.
+ */
+import type { HardwareAttestationClaim } from "@motebit/protocol";
+/**
+ * Platform identifier mirrored from `HardwareAttestationClaim.platform`.
+ * Declared locally so hardware-attestation.ts isn't coupled to whether
+ * protocol exports it as a named type — the union literal is the
+ * contract.
+ */
+export type AttestationPlatform = HardwareAttestationClaim["platform"];
+/**
+ * One verification error in the result. Matches the shape used by the
+ * other `@motebit/crypto` verify functions so callers can surface
+ * errors uniformly.
+ */
+export interface HardwareAttestationError {
+    readonly message: string;
+}
+/**
+ * Result of verifying one `HardwareAttestationClaim`. `valid` reflects
+ * only the platform-verification outcome for the receipt — identity-key
+ * binding is checked separately via `expectedIdentityPublicKeyHex`.
+ *
+ * For the `secure_enclave` platform, a `valid: true` result asserts:
+ *   1. The receipt is well-formed JWS-shape (body . signature).
+ *   2. The body's algorithm field is `ecdsa-p256-sha256`.
+ *   3. The P-256 signature verifies against the body bytes + the
+ *      SE public key carried inside the body.
+ *   4. The body's `identity_public_key` equals the expected Ed25519
+ *      key the caller provided.
+ *
+ * Other platforms are not implemented in v1 and return
+ * `valid: false, errors: [{message: "...adapter not shipped..."}]`.
+ * Adapters plug in behind this same result shape; a verifier that
+ * ignores the `se_public_key` field stays forward-compatible.
+ */
+export interface HardwareAttestationVerifyResult {
+    readonly valid: boolean;
+    readonly platform: AttestationPlatform | null;
+    /** P-256 pubkey (compressed hex) recovered from a verified SE receipt. */
+    readonly se_public_key?: string;
+    /** Unix ms timestamp from a verified body, if any. */
+    readonly attested_at?: number;
+    readonly errors: readonly HardwareAttestationError[];
+}
+/**
+ * Context fields the dispatcher lifts out of the VC subject and hands
+ * to the `deviceCheck` arm so it can re-derive the JCS body Apple
+ * signed over. motebit_id / device_id / attested_at participate in
+ * that body alongside identity_public_key; without them the verifier
+ * cannot bind the receipt to the caller's identity. Each field is
+ * optional at the type level so an older credential subject that
+ * doesn't carry them flows through with `identity_bound: false`
+ * rather than crashing the verifier.
+ */
+export interface DeviceCheckVerifierContext {
+    readonly expectedMotebitId?: string;
+    readonly expectedDeviceId?: string;
+    readonly expectedAttestedAt?: number;
+}
+/**
+ * Optional platform-verifier dispatch injected at call site by the
+ * consumer. Each slot takes the claim + the expected Ed25519 identity
+ * key (lowercase hex) and returns a verification result matching the
+ * canonical shape.
+ *
+ * `@motebit/crypto` stays permissive-floor-pure and dep-thin — it never imports a
+ * platform adapter. Consumers (CLI, mobile, desktop, relay) wire the
+ * leaf packages (`@motebit/crypto-appattest` for device_check;
+ * future `@motebit/crypto-tpm`, `@motebit/crypto-play-integrity`) into
+ * this object so that dispatch remains explicit, auditable, and
+ * tree-shakable: a verifier that doesn't care about App Attest ships
+ * zero App Attest code.
+ *
+ * `deviceCheck` takes an optional third `context` argument carrying
+ * the VC-subject fields that participate in the JCS body the Swift
+ * mint path signs over (motebit_id / device_id / attested_at). The
+ * dispatcher populates this from the credential subject; direct
+ * callers threading their own context can too. Older injected
+ * verifiers that ignore the third argument still satisfy the type.
+ */
+export interface HardwareAttestationVerifiers {
+    readonly deviceCheck?: (claim: HardwareAttestationClaim, expectedIdentityPublicKeyHex: string, context?: DeviceCheckVerifierContext) => HardwareAttestationVerifyResult | PromiseLike<HardwareAttestationVerifyResult> | {
+        readonly valid: boolean;
+        readonly errors: ReadonlyArray<{
+            readonly message: string;
+        }>;
+    } | PromiseLike<{
+        readonly valid: boolean;
+        readonly errors: ReadonlyArray<{
+            readonly message: string;
+        }>;
+    }>;
+    readonly tpm?: (claim: HardwareAttestationClaim, expectedIdentityPublicKeyHex: string, context?: DeviceCheckVerifierContext) => HardwareAttestationVerifyResult | PromiseLike<HardwareAttestationVerifyResult> | {
+        readonly valid: boolean;
+        readonly errors: ReadonlyArray<{
+            readonly message: string;
+        }>;
+    } | PromiseLike<{
+        readonly valid: boolean;
+        readonly errors: ReadonlyArray<{
+            readonly message: string;
+        }>;
+    }>;
+    readonly playIntegrity?: (claim: HardwareAttestationClaim, expectedIdentityPublicKeyHex: string, context?: DeviceCheckVerifierContext) => HardwareAttestationVerifyResult | PromiseLike<HardwareAttestationVerifyResult> | {
+        readonly valid: boolean;
+        readonly errors: ReadonlyArray<{
+            readonly message: string;
+        }>;
+    } | PromiseLike<{
+        readonly valid: boolean;
+        readonly errors: ReadonlyArray<{
+            readonly message: string;
+        }>;
+    }>;
+    readonly webauthn?: (claim: HardwareAttestationClaim, expectedIdentityPublicKeyHex: string, context?: DeviceCheckVerifierContext) => HardwareAttestationVerifyResult | PromiseLike<HardwareAttestationVerifyResult> | {
+        readonly valid: boolean;
+        readonly errors: ReadonlyArray<{
+            readonly message: string;
+        }>;
+    } | PromiseLike<{
+        readonly valid: boolean;
+        readonly errors: ReadonlyArray<{
+            readonly message: string;
+        }>;
+    }>;
+    readonly androidKeystore?: (claim: HardwareAttestationClaim, expectedIdentityPublicKeyHex: string, context?: DeviceCheckVerifierContext) => HardwareAttestationVerifyResult | PromiseLike<HardwareAttestationVerifyResult> | {
+        readonly valid: boolean;
+        readonly errors: ReadonlyArray<{
+            readonly message: string;
+        }>;
+    } | PromiseLike<{
+        readonly valid: boolean;
+        readonly errors: ReadonlyArray<{
+            readonly message: string;
+        }>;
+    }>;
+}
+/**
+ * Verify a hardware-attestation claim.
+ *
+ * - `claim` — the `HardwareAttestationClaim` taken from a credential's
+ *   `credentialSubject.hardware_attestation`.
+ * - `expectedIdentityPublicKeyHex` — the Ed25519 public key (hex) the
+ *   verifier believes owns the credential. Comes from the credential
+ *   issuance path (typically the subject's DID pubkey).
+ * - `verifiers` — optional injection of platform-specific verifiers for
+ *   claims other than `secure_enclave`. Consumers pass
+ *   `{ deviceCheck: deviceCheckVerifier(...) }` from
+ *   `@motebit/crypto-appattest` to enable App Attest verification. When
+ *   a claim's platform has no verifier wired, the dispatcher returns a
+ *   stub `valid: false, errors: [{message:"adapter not yet shipped"}]`
+ *   so verification remains fail-closed by default.
+ * - `deviceCheckContext` — VC-subject fields (motebit_id / device_id /
+ *   attested_at) lifted from the credential subject; threaded to the
+ *   injected `deviceCheck` verifier so it can re-derive the JCS body
+ *   Apple signed over. Ignored for every other platform.
+ *
+ * Zero throws — every failure lands as `valid: false` with a structured
+ * reason so callers can render consistent audit output. The
+ * secure_enclave path remains synchronous; device_check (and any other
+ * injected adapter) may return a Promise, so callers that dispatch
+ * through the `verify()` entrypoint get `await`ed results.
+ */
+export declare function verifyHardwareAttestationClaim(claim: HardwareAttestationClaim, expectedIdentityPublicKeyHex: string, verifiers?: HardwareAttestationVerifiers, deviceCheckContext?: DeviceCheckVerifierContext): HardwareAttestationVerifyResult | Promise<HardwareAttestationVerifyResult>;
+/**
+ * Test-only helper — encode a canonical body + signature into the
+ * receipt format. Tests that have a P-256 private key (via
+ * `@noble/curves/p256`) can call `signBytes` themselves, then hand the
+ * resulting body + signature to this helper to produce a well-formed
+ * receipt that `verifyHardwareAttestationClaim` will accept. Production
+ * callers MUST mint receipts via the Rust Secure Enclave bridge —
+ * never through this function.
+ */
+export declare function encodeSecureEnclaveReceiptForTest(bodyBytes: Uint8Array, sigBytes: Uint8Array): string;
+/**
+ * Test-only helper — build a canonical body JSON's bytes. Use with
+ * `encodeSecureEnclaveReceiptForTest` to produce a full receipt for
+ * verification tests. Canonicalization matches what production would
+ * emit.
+ */
+export declare function canonicalSecureEnclaveBodyForTest(body: {
+    readonly motebit_id: string;
+    readonly device_id: string;
+    readonly identity_public_key: string;
+    readonly se_public_key: string;
+    readonly attested_at: number;
+}): Uint8Array;
+/**
+ * Test-only convenience — generate a fresh P-256 keypair, sign the
+ * canonical body bytes with it, and assemble a `HardwareAttestationClaim`
+ * that `verifyHardwareAttestationClaim` accepts. Lets cross-workspace
+ * tests exercise the SE verification path without each caller pulling
+ * `@noble/curves` into their own dep tree.
+ *
+ * Production callers MUST mint receipts via the Rust Secure Enclave
+ * bridge — never through this function.
+ */
+export declare function mintSecureEnclaveReceiptForTest(input: {
+    readonly motebit_id: string;
+    readonly device_id: string;
+    readonly identity_public_key: string;
+    readonly attested_at: number;
+}): Promise<{
+    claim: HardwareAttestationClaim;
+    sePublicKeyHex: string;
+}>;
+//# sourceMappingURL=hardware-attestation.d.ts.map

package/dist/hardware-attestation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardware-attestation.d.ts","sourceRoot":"","sources":["../src/hardware-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAKlE;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;AAEvE;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAC9C,0EAA0E;IAC1E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,sDAAsD;IACtD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,wBAAwB,EAAE,CAAC;CACtD;AAiBD;;;;;;;;;GASG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,CACrB,KAAK,EAAE,wBAAwB,EAC/B,4BAA4B,EAAE,MAAM,EACpC,OAAO,CAAC,EAAE,0BAA0B,KAElC,+BAA+B,GAC/B,WAAW,CAAC,+BAA+B,CAAC,GAC5C;QAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;YAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,GACzF,WAAW,CAAC;QACV,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;YAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC9D,CAAC,CAAC;IACP,QAAQ,CAAC,GAAG,CAAC,EAAE,CACb,KAAK,EAAE,wBAAwB,EAC/B,4BAA4B,EAAE,MAAM,EACpC,OAAO,CAAC,EAAE,0BAA0B,KAElC,+BAA+B,GAC/B,WAAW,CAAC,+BAA+B,CAAC,GAC5C;QAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;YAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,GACzF,WAAW,CAAC;QACV,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;YAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC9D,CAAC,CAAC;IACP,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,KAAK,EAAE,wBAAwB,EAC/B,4BAA4B,EAAE,MAAM,EACpC,OAAO,CAAC,EAAE,0BAA0B,KAElC,+BAA+B,GAC/B,WAAW,CAAC,+BAA+B,CAAC,GAC5C;QAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;YAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,GACzF,WAAW,CAAC;QACV,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;YAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC9D,CAAC,CAAC;IACP,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAClB,KAAK,EAAE,wBAAwB,EAC/B,4BAA4B,EAAE,MAAM,EACpC,OAAO,CAAC,EAAE,0BAA0B,KAElC,+BAA+B,GAC/B,WAAW,CAAC,+BAA+B,CAAC,GAC5C;QAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;YAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,GACzF,WAAW,CAAC;QACV,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;YAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC9D,CAAC,CAAC;IACP,QAAQ,CAAC,eAAe,CAAC,EAAE,CACzB,KAAK,EAAE,wBAAwB,EAC/B,4BAA4B,EAAE,MAAM,EACpC,OAAO,CAAC,EAAE,0BAA0B,KAElC,+BAA+B,GAC/B,WAAW,CAAC,+BAA+B,CAAC,GAC5C;QAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;YAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,GACzF,WAAW,CAAC;QACV,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;YAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC9D,CAAC,CAAC;CACR;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,wBAAwB,EAC/B,4BAA4B,EAAE,MAAM,EACpC,SAAS,CAAC,EAAE,4BAA4B,EACxC,kBAAkB,CAAC,EAAE,0BAA0B,GAC9C,+BAA+B,GAAG,OAAO,CAAC,+BAA+B,CAAC,CA+E5E;AAoMD;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAC/C,SAAS,EAAE,UAAU,EACrB,QAAQ,EAAE,UAAU,GACnB,MAAM,CAER;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAAC,IAAI,EAAE;IACtD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GAAG,UAAU,CAOb;AAED;;;;;;;;;GASG;AACH,wBAAsB,+BAA+B,CAAC,KAAK,EAAE;IAC3D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,wBAAwB,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAyBvE"}

package/dist/index.d.ts

@@ -75,6 +75,11 @@ export interface SuccessionRecord {
     new_public_key: string;
     timestamp: number;
     reason?: string;
+    /**
+     * Cryptosuite discriminator. Always `"motebit-jcs-ed25519-hex-v1"`
+     * for this artifact today — same suite as the identity frontmatter.
+     */
+    suite: "motebit-jcs-ed25519-hex-v1";
     old_key_signature?: string;
     new_key_signature: string;
     /** True when succession was authorized by guardian, not old key. */
@@ -102,6 +107,9 @@ export interface ExecutionReceipt {
 }
 export type { DataIntegrityProof, VerifiableCredential, VerifiablePresentation, } from "./credentials.js";
 import type { VerifiableCredential, VerifiablePresentation } from "./credentials.js";
+export { verifyHardwareAttestationClaim, canonicalSecureEnclaveBodyForTest, encodeSecureEnclaveReceiptForTest, mintSecureEnclaveReceiptForTest, } from "./hardware-attestation.js";
+export type { AttestationPlatform, HardwareAttestationError, HardwareAttestationVerifyResult, HardwareAttestationVerifiers, DeviceCheckVerifierContext, } from "./hardware-attestation.js";
+import type { HardwareAttestationVerifiers, HardwareAttestationVerifyResult } from "./hardware-attestation.js";
 export interface VerificationError {
     message: string;
     path?: string;
@@ -135,6 +143,14 @@ export interface CredentialVerifyResult extends BaseResult {
     issuer?: string;
     subject?: string;
     expired?: boolean;
+    /**
+     * Hardware-attestation verification outcome. Present only when the
+     * credential's subject declared a `hardware_attestation` claim. Absent
+     * means "no claim" (not "fails closed" — the credential's own
+     * signature is independent of the attestation). Populated by the
+     * unified `verify()` dispatcher via `verifyHardwareAttestationClaim`.
+     */
+    hardware_attestation?: HardwareAttestationVerifyResult;
 }
 export interface PresentationVerifyResult extends BaseResult {
     type: "presentation";
@@ -148,8 +164,26 @@ export interface VerifyOptions {
     expectedType?: ArtifactType;
     /** Clock skew tolerance in seconds for credential expiry checks. Default: 60. */
     clockSkewSeconds?: number;
+    /**
+     * Optional injection of platform-specific hardware-attestation
+     * verifiers. Consumers that need `device_check` / `tpm` /
+     * `play_integrity` verification pass the corresponding leaf package's
+     * verifier function here (e.g. `deviceCheckVerifier(...)` from
+     * `@motebit/crypto-appattest`). Absence keeps the permissive-floor `@motebit/crypto`
+     * path pure: unknown platforms fail-closed with a named-missing-adapter
+     * error. See `hardware-attestation.ts::HardwareAttestationVerifiers`.
+     */
+    hardwareAttestation?: HardwareAttestationVerifiers;
 }
-/** @deprecated Use VerifyResult instead. Kept for backward compatibility. */
+/**
+ * @deprecated since 1.0.0, removed in 2.0.0. Use {@link VerifyResult} instead.
+ *
+ * Reason: pre-0.4.0 return shape with a flat `error: string` field and no
+ * type discriminator. The modern {@link VerifyResult} is a discriminated
+ * union (`type: "identity" | "receipt" | "credential" | "presentation"`)
+ * with a structured `errors: Array<{ message: string }>` — one shape covers
+ * every artifact type motebit verifies.
+ */
 export interface LegacyVerifyResult {
     valid: boolean;
     identity: MotebitIdentityFile | null;
@@ -202,11 +236,30 @@ export declare function verify(artifact: unknown, options?: VerifyOptions): Prom
 /**
  * Verify a motebit.md identity file. Backward-compatible with pre-0.4.0.
  *
- * @deprecated Use `verify(content)` instead — it handles all artifact types.
+ * @deprecated since 1.0.0, removed in 2.0.0. Use `verify(content, { expectedType: "identity" })` instead.
+ *
+ * Reason: `verify()` is the unified dispatcher for every signed artifact
+ * type (identity, receipt, credential, presentation) and returns a typed
+ * {@link VerifyResult} discriminated union. `verifyIdentityFile` is the
+ * pre-0.4.0 identity-only wrapper kept alive for the deprecation window —
+ * it reshapes `verify()`'s output into the legacy flat-`error` format.
+ *
+ * Migration:
+ * ```ts
+ * // Before:
+ * const r = await verifyIdentityFile(content);
+ * if (r.valid) console.log(r.did);
+ * else console.log(r.error);
+ *
+ * // After:
+ * const r = await verify(content, { expectedType: "identity" });
+ * if (r.type === "identity" && r.valid) console.log(r.did);
+ * else console.log(r.errors?.[0]?.message);
+ * ```
  */
 export declare function verifyIdentityFile(content: string): Promise<LegacyVerifyResult>;
 export * from "./signing.js";
 export * from "./artifacts.js";
 export { signVerifiableCredential, verifyVerifiableCredential, signVerifiablePresentation, verifyVerifiablePresentation, issueGradientCredential, issueReputationCredential, issueTrustCredential, createPresentation, type GradientCredentialSubject, type ReputationCredentialSubject, type TrustCredentialSubject, } from "./credentials.js";
-export { computeCredentialLeaf, verifyCredentialAnchor, type CredentialAnchorVerifyResult, type CredentialAnchorProofFields, type ChainAnchorVerifier, } from "./credential-anchor.js";
+export { computeCredentialLeaf, verifyCredentialAnchor, verifyRevocationAnchor, type CredentialAnchorVerifyResult, type CredentialAnchorProofFields, type ChainAnchorVerifier, type RevocationAnchorVerifyResult, type RevocationAnchorProof, } from "./credential-anchor.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAcH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IAGjB,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,eAAe,CAAC;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,QAAQ,EAAE;QACR,SAAS,EAAE,SAAS,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IAEF,UAAU,EAAE;QACV,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;QAC3C,aAAa,EAAE,MAAM,CAAC;QACtB,sBAAsB,EAAE,MAAM,CAAC;QAC/B,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IAEF,OAAO,EAAE;QACP,mBAAmB,EAAE,MAAM,CAAC;QAC5B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvC,WAAW,EAAE,OAAO,CAAC;KACtB,CAAC;IAEF,MAAM,EAAE;QACN,cAAc,EAAE,MAAM,CAAC;QACvB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF,8EAA8E;IAC9E,QAAQ,CAAC,EAAE;QACT,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,cAAc,EAAE,MAAM,CAAC;QACvB,6DAA6D;QAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF,OAAO,EAAE,KAAK,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC,CAAC;IAEH,UAAU,CAAC,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAMD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACzC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAOD,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAEV,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,kBAAkB,CAAC;AAM1B,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,UAAU,UAAU;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAqB,SAAQ,UAAU;IACtD,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,OAAO,CAAC;QACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACrD,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,sBAAuB,SAAQ,UAAU;IACxD,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,wBAAyB,SAAQ,UAAU;IAC1D,IAAI,EAAE,cAAc,CAAC;IACrB,YAAY,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,sBAAsB,EAAE,CAAC;CACxC;AAED,MAAM,MAAM,YAAY,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,sBAAsB,GACtB,wBAAwB,CAAC;AAE7B,MAAM,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;AAEhD,MAAM,WAAW,aAAa;IAC5B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAMD,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,OAAO,CAAC;QACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAyTD;;;GAGG;AACH,wBAAgB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG;IACtC,WAAW,EAAE,mBAAmB,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB,CAqBA;AAieD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAwD9F;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CASrF;AAOD,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,yBAAyB,EACzB,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,mBAAmB,GACzB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAYH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IAGjB,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,eAAe,CAAC;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,QAAQ,EAAE;QACR,SAAS,EAAE,SAAS,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IAEF,UAAU,EAAE;QACV,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;QAC3C,aAAa,EAAE,MAAM,CAAC;QACtB,sBAAsB,EAAE,MAAM,CAAC;QAC/B,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IAEF,OAAO,EAAE;QACP,mBAAmB,EAAE,MAAM,CAAC;QAC5B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvC,WAAW,EAAE,OAAO,CAAC;KACtB,CAAC;IAEF,MAAM,EAAE;QACN,cAAc,EAAE,MAAM,CAAC;QACvB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF,8EAA8E;IAC9E,QAAQ,CAAC,EAAE;QACT,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,cAAc,EAAE,MAAM,CAAC;QACvB,6DAA6D;QAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF,OAAO,EAAE,KAAK,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC,CAAC;IAEH,UAAU,CAAC,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,KAAK,EAAE,4BAA4B,CAAC;IACpC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAMD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACzC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAOD,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAEV,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EACL,8BAA8B,EAC9B,iCAAiC,EACjC,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,mBAAmB,EACnB,wBAAwB,EACxB,+BAA+B,EAC/B,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EACV,4BAA4B,EAC5B,+BAA+B,EAChC,MAAM,2BAA2B,CAAC;AAMnC,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,UAAU,UAAU;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAqB,SAAQ,UAAU;IACtD,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,OAAO,CAAC;QACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACrD,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,sBAAuB,SAAQ,UAAU;IACxD,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,+BAA+B,CAAC;CACxD;AAED,MAAM,WAAW,wBAAyB,SAAQ,UAAU;IAC1D,IAAI,EAAE,cAAc,CAAC;IACrB,YAAY,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,sBAAsB,EAAE,CAAC;CACxC;AAED,MAAM,MAAM,YAAY,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,sBAAsB,GACtB,wBAAwB,CAAC;AAE7B,MAAM,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;AAEhD,MAAM,WAAW,aAAa;IAC5B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,mBAAmB,CAAC,EAAE,4BAA4B,CAAC;CACpD;AAMD;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,OAAO,CAAC;QACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AA+TD;;;GAGG;AACH,wBAAgB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG;IACtC,WAAW,EAAE,mBAAmB,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB,CAgCA;AA0jBD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAgE9F;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CASrF;AAOD,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,yBAAyB,EACzB,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,mBAAmB,EACxB,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,GAC3B,MAAM,wBAAwB,CAAC"}