@motebit/crypto 1.1.0 → 1.2.1

package/dist/artifacts.d.ts

@@ -480,7 +480,7 @@ export declare const SETTLEMENT_RECORD_SUITE: "motebit-jcs-ed25519-b64-v1";
  * Callers pass the record without `signature` or `suite`; the signer
  * owns both.
  *
- * Foundation Law (services/api/CLAUDE.md rule 6): every truth the
+ * Foundation Law (services/relay/CLAUDE.md rule 6): every truth the
  * relay asserts is independently verifiable. Per-agent settlements
  * deliver this through the signature; federation settlements
  * additionally get Merkle-batched and onchain-anchored.

package/dist/credential-anchor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-anchor.d.ts","sourceRoot":"","sources":["../src/credential-anchor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,oEAAoE;AACpE,eAAO,MAAM,uBAAuB,EAAG,4BAAqC,CAAC;AA2B7E;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAIhG;AA4CD,qDAAqD;AACrD,MAAM,WAAW,4BAA4B;IAC3C,wCAAwC;IACxC,KAAK,EAAE,OAAO,CAAC;IACf,+BAA+B;IAC/B,KAAK,EAAE;QACL,wDAAwD;QACxD,UAAU,EAAE,OAAO,CAAC;QACpB,6DAA6D;QAC7D,YAAY,EAAE,OAAO,CAAC;QACtB,yEAAyE;QACzE,qBAAqB,EAAE,OAAO,CAAC;QAC/B,6DAA6D;QAC7D,cAAc,EAAE,OAAO,GAAG,IAAI,CAAC;KAChC,CAAC;IACF,uCAAuC;IACvC,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEvB,uDAAuD;AACvD,MAAM,WAAW,2BAA2B;IAC1C,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,KAAK,EAAE,OAAO,uBAAuB,CAAC;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,IAAI,CAAC;CACV;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,WAAW,EAAE,2BAA2B,EACxC,aAAa,CAAC,EAAE,mBAAmB,GAClC,OAAO,CAAC,4BAA4B,CAAC,CA8FvC;AAID,wDAAwD;AACxD,MAAM,WAAW,4BAA4B;IAC3C,8CAA8C;IAC9C,KAAK,EAAE,OAAO,CAAC;IACf,+BAA+B;IAC/B,KAAK,EAAE;QACL,yEAAyE;QACzE,UAAU,EAAE,OAAO,CAAC;QACpB,8EAA8E;QAC9E,qBAAqB,EAAE,OAAO,CAAC;QAC/B,6DAA6D;QAC7D,cAAc,EAAE,OAAO,GAAG,IAAI,CAAC;KAChC,CAAC;IACF,uCAAuC;IACvC,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,EAAG,+BAAwC,CAAC;AAEhF,mDAAmD;AACnD,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,kBAAkB,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,KAAK,EAAE,OAAO,uBAAuB,CAAC;IACtC,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,gBAAgB,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;KACjB,GAAG,IAAI,CAAC;CACV;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,qBAAqB,EAC5B,iBAAiB,EAAE,MAAM,EACzB,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;CACvB,KAAK,OAAO,CAAC,OAAO,CAAC,GACrB,OAAO,CAAC,4BAA4B,CAAC,CAoEvC"}
+{"version":3,"file":"credential-anchor.d.ts","sourceRoot":"","sources":["../src/credential-anchor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,oEAAoE;AACpE,eAAO,MAAM,uBAAuB,EAAG,4BAAqC,CAAC;AAI7E;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAIhG;AAID,qDAAqD;AACrD,MAAM,WAAW,4BAA4B;IAC3C,wCAAwC;IACxC,KAAK,EAAE,OAAO,CAAC;IACf,+BAA+B;IAC/B,KAAK,EAAE;QACL,wDAAwD;QACxD,UAAU,EAAE,OAAO,CAAC;QACpB,6DAA6D;QAC7D,YAAY,EAAE,OAAO,CAAC;QACtB,yEAAyE;QACzE,qBAAqB,EAAE,OAAO,CAAC;QAC/B,6DAA6D;QAC7D,cAAc,EAAE,OAAO,GAAG,IAAI,CAAC;KAChC,CAAC;IACF,uCAAuC;IACvC,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEvB,uDAAuD;AACvD,MAAM,WAAW,2BAA2B;IAC1C,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,KAAK,EAAE,OAAO,uBAAuB,CAAC;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,IAAI,CAAC;CACV;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,WAAW,EAAE,2BAA2B,EACxC,aAAa,CAAC,EAAE,mBAAmB,GAClC,OAAO,CAAC,4BAA4B,CAAC,CA8FvC;AAID,wDAAwD;AACxD,MAAM,WAAW,4BAA4B;IAC3C,8CAA8C;IAC9C,KAAK,EAAE,OAAO,CAAC;IACf,+BAA+B;IAC/B,KAAK,EAAE;QACL,yEAAyE;QACzE,UAAU,EAAE,OAAO,CAAC;QACpB,8EAA8E;QAC9E,qBAAqB,EAAE,OAAO,CAAC;QAC/B,6DAA6D;QAC7D,cAAc,EAAE,OAAO,GAAG,IAAI,CAAC;KAChC,CAAC;IACF,uCAAuC;IACvC,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,EAAG,+BAAwC,CAAC;AAEhF,mDAAmD;AACnD,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,kBAAkB,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,KAAK,EAAE,OAAO,uBAAuB,CAAC;IACtC,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,gBAAgB,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;KACjB,GAAG,IAAI,CAAC;CACV;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,qBAAqB,EAC5B,iBAAiB,EAAE,MAAM,EACzB,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;CACvB,KAAK,OAAO,CAAC,OAAO,CAAC,GACrB,OAAO,CAAC,4BAA4B,CAAC,CAoEvC"}

package/dist/deletion-certificate.d.ts

@@ -0,0 +1,256 @@
+/**
+ * Deletion certificate — sign + verify for the three retention shapes.
+ *
+ * Permissive floor (Apache-2.0). Zero monorepo dependencies — types
+ * mirror `@motebit/protocol`'s discriminated union; primitives route
+ * through `@motebit/crypto/suite-dispatch`.
+ *
+ * Three arms in one union (`@motebit/protocol :: DeletionCertificate`):
+ *
+ *   - `mutable_pruning` and `consolidation_flush` — multi-signature
+ *     certs (subject / operator / delegate / guardian, at-least-one
+ *     required by the reason-table). Each present signature covers the
+ *     same canonical bytes: `canonicalJson(cert minus all *_signature
+ *     fields)`. Pattern matches identity-v1 §3.8.1 dual-signature
+ *     succession (one canonical payload, multiple verifiable signers).
+ *
+ *   - `append_only_horizon` — single-issuer signature plus witness
+ *     signatures. Both the issuer and every witness sign the same
+ *     `canonicalJson(cert minus signature)`. Witness array is part of
+ *     the signed body — a forged witness fails verification.
+ *
+ * Verification dispatches by `kind`. Reason × signer × mode table
+ * (decision 5) gates which signer compositions are admissible. Each
+ * admissible signature is then cryptographically verified through
+ * `verifyBySuite`.
+ */
+import type { DeletionCertificate, HorizonWitness, HorizonWitnessRequestBody, SuiteId } from "@motebit/protocol";
+/** The cryptosuite every deletion certificate signs under today. */
+export declare const DELETION_CERTIFICATE_SUITE: SuiteId;
+/**
+ * Filing window for `WitnessOmissionDispute` (retention phase 4b-3).
+ * A dispute MUST be filed within 24h of the cert's `issued_at`;
+ * `verifyWitnessOmissionDispute` rejects beyond this window. Mirrors
+ * the 24h cadence of `spec/dispute-v1.md` §7.5 (filing / withdrawal /
+ * appeal windows).
+ */
+export declare const WITNESS_OMISSION_DISPUTE_WINDOW_MS: number;
+type DeploymentMode = "sovereign" | "mediated" | "enterprise";
+/** Result of verifying a deletion certificate. Fail-closed: any failure → `valid: false`. */
+export interface DeletionCertificateVerifyResult {
+    readonly valid: boolean;
+    readonly errors: string[];
+    /** Per-step breakdown — useful for debugging and audit display. */
+    readonly steps: {
+        readonly reason_table_satisfied: boolean;
+        readonly subject_signature_valid: boolean | null;
+        readonly operator_signature_valid: boolean | null;
+        readonly delegate_signature_valid: boolean | null;
+        readonly guardian_signature_valid: boolean | null;
+        /** Horizon-arm only: issuer signature on the cert body. */
+        readonly horizon_issuer_signature_valid: boolean | null;
+        /** Horizon-arm only: count of witness signatures that verified. */
+        readonly horizon_witnesses_valid_count: number | null;
+        /** Horizon-arm only: count of witness signatures present. */
+        readonly horizon_witnesses_present_count: number | null;
+    };
+}
+/**
+ * Resolver context for the verifier. Callers supply the public-key
+ * resolution paths the cert's signers reference. Resolvers return
+ * `null` when the key cannot be resolved (unknown id, registry miss);
+ * the verifier rejects fail-closed in that case.
+ *
+ * The guardian signature embeds its own public key (`guardian_public_key`),
+ * so no guardian resolver is needed — the verifier does cross-check that
+ * the embedded key matches the motebit's declared guardian via the
+ * `validateGuardianBinding` callback when supplied.
+ */
+export interface DeletionCertificateVerifyContext {
+    /** Resolve a motebit's identity Ed25519 public key (32 bytes). */
+    readonly resolveMotebitPublicKey: (motebitId: string) => Promise<Uint8Array | null>;
+    /** Resolve an operator's Ed25519 public key (32 bytes). */
+    readonly resolveOperatorPublicKey: (operatorId: string) => Promise<Uint8Array | null>;
+    /**
+     * Optional cross-check that an embedded `guardian_public_key` actually
+     * is the declared guardian for the cert's subject motebit. When
+     * absent, the verifier verifies the signature against the embedded
+     * key without checking the binding.
+     */
+    readonly validateGuardianBinding?: (targetMotebitId: string | undefined, guardianPublicKeyHex: string) => Promise<boolean>;
+    /**
+     * Optional declared deployment mode. When supplied, the verifier
+     * additionally checks the cert's reason against
+     * `REASON_TABLE[reason].modes`. When absent, mode-checking is skipped
+     * (the reason × signer table still applies).
+     */
+    readonly deploymentMode?: DeploymentMode;
+}
+/**
+ * Compute the canonical signing bytes for a `mutable_pruning` or
+ * `consolidation_flush` cert. Strips every `*_signature` field so all
+ * present signers sign identical bytes — matches identity-v1 §3.8.1's
+ * dual-signature canonical payload.
+ */
+export declare function canonicalizeMultiSignatureCert(cert: Extract<DeletionCertificate, {
+    kind: "mutable_pruning" | "consolidation_flush";
+}>): Uint8Array;
+/**
+ * Compute the canonical signing bytes for an `append_only_horizon`
+ * cert's ISSUER signature. Strips only `signature`. The issuer commits
+ * to the full body — including every witness's signature in
+ * `witnessed_by` — so a forged witness fails verification at the
+ * issuer signature step (the body the issuer signed no longer matches
+ * the post-tampering body).
+ */
+export declare function canonicalizeHorizonCert(cert: Extract<DeletionCertificate, {
+    kind: "append_only_horizon";
+}>): Uint8Array;
+/**
+ * Compute the canonical signing bytes for a WITNESS signature on an
+ * `append_only_horizon` cert. Strips both `signature` and
+ * `witnessed_by` so witnesses can co-sign asynchronously without
+ * needing to know each other's signatures.
+ *
+ * Witness's identity is bound to the signature via the public key
+ * used at verification (resolved from `witnessed_by[i].motebit_id`).
+ * The cert body's other fields (subject, store_id, horizon_ts,
+ * issued_at, federation_graph_anchor) make two distinct horizon
+ * advances produce distinct signing bytes, so a witness signature
+ * cannot be relayed to a different cert.
+ *
+ * The issuer's separate signature commits to the assembled witness
+ * array — that's the binding that makes a forged or substituted
+ * witness detectable.
+ */
+export declare function canonicalizeHorizonCertForWitness(cert: Extract<DeletionCertificate, {
+    kind: "append_only_horizon";
+}>): Uint8Array;
+/**
+ * Sign a `mutable_pruning` or `consolidation_flush` cert as the
+ * subject (motebit identity key). Adds the `subject_signature` block.
+ *
+ * Callers compose: sign as subject → optionally sign as operator → emit.
+ * Each signing step appends a signature block; the canonical bytes are
+ * recomputed from the body each time, so signatures are commutative
+ * (any signing order produces identical bytes for every signer).
+ */
+export declare function signCertAsSubject<T extends Extract<DeletionCertificate, {
+    kind: "mutable_pruning" | "consolidation_flush";
+}>>(cert: T, motebitId: string, privateKey: Uint8Array): Promise<T>;
+/** Sign a multi-signature cert as the operator. */
+export declare function signCertAsOperator<T extends Extract<DeletionCertificate, {
+    kind: "mutable_pruning" | "consolidation_flush";
+}>>(cert: T, operatorId: string, privateKey: Uint8Array): Promise<T>;
+/** Sign a multi-signature cert as a delegate (multi-hop authorization). */
+export declare function signCertAsDelegate<T extends Extract<DeletionCertificate, {
+    kind: "mutable_pruning" | "consolidation_flush";
+}>>(cert: T, delegateMotebitId: string, delegationReceiptId: string, privateKey: Uint8Array): Promise<T>;
+/** Sign a multi-signature cert as the guardian (enterprise custody). */
+export declare function signCertAsGuardian<T extends Extract<DeletionCertificate, {
+    kind: "mutable_pruning" | "consolidation_flush";
+}>>(cert: T, guardianPublicKey: Uint8Array, privateKey: Uint8Array): Promise<T>;
+/**
+ * Sign an `append_only_horizon` cert as the issuer. The issuer is the
+ * subject named by the discriminator — motebit identity key for
+ * per-motebit horizons, operator key for operator-wide horizons.
+ */
+export declare function signHorizonCertAsIssuer(cert: Omit<Extract<DeletionCertificate, {
+    kind: "append_only_horizon";
+}>, "suite" | "signature">, privateKey: Uint8Array): Promise<Extract<DeletionCertificate, {
+    kind: "append_only_horizon";
+}>>;
+/**
+ * Add a witness signature to an `append_only_horizon` cert. Witness
+ * signs the same canonical body as the issuer; the witness array is
+ * part of the signed body, so once the issuer has signed, the witness
+ * additions are appended without re-signing the issuer side.
+ *
+ * Note: the issuer's signature is over the body INCLUDING the
+ * witness array as it stood when the issuer signed. Witnesses added
+ * after issuer-signing invalidate the issuer signature. Production
+ * flow: build the witness array first → issuer signs last. This
+ * function is here for tests and offline witness aggregation.
+ */
+export declare function signHorizonWitness(cert: Extract<DeletionCertificate, {
+    kind: "append_only_horizon";
+}>, witnessMotebitId: string, privateKey: Uint8Array, inclusionProof?: HorizonWitness["inclusion_proof"]): Promise<HorizonWitness>;
+/**
+ * Compute the canonical signing bytes for a `HorizonWitnessRequestBody`.
+ * Byte-equal to `canonicalizeHorizonCertForWitness` over the
+ * corresponding full cert (since the function strips
+ * `witnessed_by[]` + `signature`); exposed as a separate helper so
+ * call sites pass the wire-shaped request body directly without
+ * synthesizing a full cert.
+ */
+export declare function canonicalizeHorizonWitnessRequestBody(body: HorizonWitnessRequestBody): Uint8Array;
+/**
+ * Sign a `HorizonWitnessRequestBody` — produces a base64url-encoded
+ * Ed25519 signature over the canonical bytes. Used by BOTH:
+ *
+ *   - the issuer, for `WitnessSolicitationRequest.issuer_signature`
+ *     (attests authenticity of the solicitation request before any
+ *     peer signs as witness),
+ *   - each peer witness, for `WitnessSolicitationResponse.signature`
+ *     (the per-witness signature copied verbatim into
+ *     `cert.witnessed_by[].signature`).
+ *
+ * Both roles sign byte-equal canonical bytes by design (session-3
+ * sub-decision: issuer-signature payload IS witness-signature payload).
+ * The peer's verify-issuer + sign-as-witness paths share canonical-bytes
+ * derivation through this primitive — drift-impossible.
+ */
+export declare function signHorizonWitnessRequestBody(body: HorizonWitnessRequestBody, privateKey: Uint8Array): Promise<string>;
+/**
+ * Verify the issuer's `issuer_signature` on a
+ * `WitnessSolicitationRequest`. Peer-side fail-closed gate before the
+ * peer signs as a witness over the same bytes. Returns `false` on any
+ * malformed signature, suite mismatch, or hash failure — never throws.
+ */
+export declare function verifyHorizonWitnessRequestSignature(body: HorizonWitnessRequestBody, signatureBase64Url: string, issuerPublicKey: Uint8Array): Promise<boolean>;
+/**
+ * Verify a deletion certificate. Single entry point — dispatches by
+ * `kind` to the per-arm verifier. Fail-closed throughout: any
+ * verification step that errors or returns false → `valid: false`.
+ *
+ * The verifier checks, in order:
+ *   1. Reason × signer × mode table is satisfied (decision 5).
+ *   2. Each present signature is cryptographically valid against the
+ *      cert's canonical signing bytes.
+ *   3. (Horizon arm only) the issuer signature and each witness
+ *      signature verify.
+ *   4. (Optional, when `validateGuardianBinding` supplied) the
+ *      embedded guardian public key matches the subject motebit's
+ *      declared guardian.
+ */
+export declare function verifyDeletionCertificate(cert: DeletionCertificate, ctx: DeletionCertificateVerifyContext): Promise<DeletionCertificateVerifyResult>;
+import type { RetentionManifest } from "@motebit/protocol";
+/** Result of verifying a retention manifest. Fail-closed: any failure → `valid: false`. */
+export interface RetentionManifestVerifyResult {
+    readonly valid: boolean;
+    readonly errors: string[];
+    /** The parsed manifest if signature verified, else `null`. */
+    readonly manifest: RetentionManifest | null;
+}
+/**
+ * Verify a retention manifest published at
+ * `/.well-known/motebit-retention.json`. The manifest's signature
+ * covers `canonicalJson(manifest minus signature)`, signed by the
+ * operator's identity key under `motebit-jcs-ed25519-hex-v1` —
+ * sibling to the operator-transparency manifest's signing flow.
+ *
+ * Browser-side re-verifier per docs/doctrine/retention-policy.md
+ * §"Self-attesting transparency". Composes existing primitives —
+ * `canonicalJson` from signing.ts, `verifyBySuite` from
+ * suite-dispatch.ts. Same shape as the `verifySkillBundle`
+ * (87e2f174) browser primitive.
+ *
+ * The verifier accepts the operator's public key directly — callers
+ * resolve it from the operator-transparency manifest at
+ * `/.well-known/motebit-transparency.json` (its `relay_public_key`
+ * field), so a single manifest fetch + verify pair gives users a
+ * full retention claim audit.
+ */
+export declare function verifyRetentionManifest(manifest: RetentionManifest, operatorPublicKey: Uint8Array): Promise<RetentionManifestVerifyResult>;
+export {};
+//# sourceMappingURL=deletion-certificate.d.ts.map

package/dist/deletion-certificate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deletion-certificate.d.ts","sourceRoot":"","sources":["../src/deletion-certificate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EACV,mBAAmB,EAEnB,cAAc,EACd,yBAAyB,EACzB,OAAO,EACR,MAAM,mBAAmB,CAAC;AAO3B,oEAAoE;AACpE,eAAO,MAAM,0BAA0B,EAAE,OAAsC,CAAC;AAEhF;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC,QAAsB,CAAC;AAgBtE,KAAK,cAAc,GAAG,WAAW,GAAG,UAAU,GAAG,YAAY,CAAC;AAgE9D,6FAA6F;AAC7F,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAC1B,mEAAmE;IACnE,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;QACzC,QAAQ,CAAC,uBAAuB,EAAE,OAAO,GAAG,IAAI,CAAC;QACjD,QAAQ,CAAC,wBAAwB,EAAE,OAAO,GAAG,IAAI,CAAC;QAClD,QAAQ,CAAC,wBAAwB,EAAE,OAAO,GAAG,IAAI,CAAC;QAClD,QAAQ,CAAC,wBAAwB,EAAE,OAAO,GAAG,IAAI,CAAC;QAClD,2DAA2D;QAC3D,QAAQ,CAAC,8BAA8B,EAAE,OAAO,GAAG,IAAI,CAAC;QACxD,mEAAmE;QACnE,QAAQ,CAAC,6BAA6B,EAAE,MAAM,GAAG,IAAI,CAAC;QACtD,6DAA6D;QAC7D,QAAQ,CAAC,+BAA+B,EAAE,MAAM,GAAG,IAAI,CAAC;KACzD,CAAC;CACH;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gCAAgC;IAC/C,kEAAkE;IAClE,QAAQ,CAAC,uBAAuB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACpF,2DAA2D;IAC3D,QAAQ,CAAC,wBAAwB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACtF;;;;;OAKG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CACjC,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,oBAAoB,EAAE,MAAM,KACzB,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;CAC1C;AAID;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,OAAO,CAAC,mBAAmB,EAAE;IAAE,IAAI,EAAE,iBAAiB,GAAG,qBAAqB,CAAA;CAAE,CAAC,GACtF,UAAU,CASZ;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,OAAO,CAAC,mBAAmB,EAAE;IAAE,IAAI,EAAE,qBAAqB,CAAA;CAAE,CAAC,GAClE,UAAU,CAIZ;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,OAAO,CAAC,mBAAmB,EAAE;IAAE,IAAI,EAAE,qBAAqB,CAAA;CAAE,CAAC,GAClE,UAAU,CAKZ;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,CAAC,SAAS,OAAO,CAAC,mBAAmB,EAAE;IAAE,IAAI,EAAE,iBAAiB,GAAG,qBAAqB,CAAA;CAAE,CAAC,EAC3F,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAWhE;AAED,mDAAmD;AACnD,wBAAsB,kBAAkB,CACtC,CAAC,SAAS,OAAO,CAAC,mBAAmB,EAAE;IAAE,IAAI,EAAE,iBAAiB,GAAG,qBAAqB,CAAA;CAAE,CAAC,EAC3F,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAWjE;AAED,2EAA2E;AAC3E,wBAAsB,kBAAkB,CACtC,CAAC,SAAS,OAAO,CAAC,mBAAmB,EAAE;IAAE,IAAI,EAAE,iBAAiB,GAAG,qBAAqB,CAAA;CAAE,CAAC,EAE3F,IAAI,EAAE,CAAC,EACP,iBAAiB,EAAE,MAAM,EACzB,mBAAmB,EAAE,MAAM,EAC3B,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,CAAC,CAAC,CAYZ;AAED,wEAAwE;AACxE,wBAAsB,kBAAkB,CACtC,CAAC,SAAS,OAAO,CAAC,mBAAmB,EAAE;IAAE,IAAI,EAAE,iBAAiB,GAAG,qBAAqB,CAAA;CAAE,CAAC,EAC3F,IAAI,EAAE,CAAC,EAAE,iBAAiB,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAW5E;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE;IAAE,IAAI,EAAE,qBAAqB,CAAA;CAAE,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC,EAChG,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE;IAAE,IAAI,EAAE,qBAAqB,CAAA;CAAE,CAAC,CAAC,CAKxE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,OAAO,CAAC,mBAAmB,EAAE;IAAE,IAAI,EAAE,qBAAqB,CAAA;CAAE,CAAC,EACnE,gBAAgB,EAAE,MAAM,EACxB,UAAU,EAAE,UAAU,EACtB,cAAc,CAAC,EAAE,cAAc,CAAC,iBAAiB,CAAC,GACjD,OAAO,CAAC,cAAc,CAAC,CASzB;AAmBD;;;;;;;GAOG;AACH,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,yBAAyB,GAAG,UAAU,CAMjG;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,yBAAyB,EAC/B,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED;;;;;GAKG;AACH,wBAAsB,oCAAoC,CACxD,IAAI,EAAE,yBAAyB,EAC/B,kBAAkB,EAAE,MAAM,EAC1B,eAAe,EAAE,UAAU,GAC1B,OAAO,CAAC,OAAO,CAAC,CAUlB;AAID;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,mBAAmB,EACzB,GAAG,EAAE,gCAAgC,GACpC,OAAO,CAAC,+BAA+B,CAAC,CAQ1C;AAiND,OAAO,KAAK,EAAE,iBAAiB,EAAa,MAAM,mBAAmB,CAAC;AAEtE,2FAA2F;AAC3F,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,iBAAiB,EAC3B,iBAAiB,EAAE,UAAU,GAC5B,OAAO,CAAC,6BAA6B,CAAC,CAiDxC"}

package/dist/index.d.ts

@@ -107,6 +107,8 @@ export interface ExecutionReceipt {
 }
 export type { DataIntegrityProof, VerifiableCredential, VerifiablePresentation, } from "./credentials.js";
 import type { VerifiableCredential, VerifiablePresentation } from "./credentials.js";
+import type { SkillEnvelope } from "@motebit/protocol";
+import type { SkillVerifyReason } from "./skills.js";
 export { verifyHardwareAttestationClaim, canonicalSecureEnclaveBodyForTest, encodeSecureEnclaveReceiptForTest, mintSecureEnclaveReceiptForTest, } from "./hardware-attestation.js";
 export type { AttestationPlatform, HardwareAttestationError, HardwareAttestationVerifyResult, HardwareAttestationVerifiers, DeviceCheckVerifierContext, } from "./hardware-attestation.js";
 import type { HardwareAttestationVerifiers, HardwareAttestationVerifyResult } from "./hardware-attestation.js";
@@ -158,7 +160,68 @@ export interface PresentationVerifyResult extends BaseResult {
     holder?: string;
     credentials?: CredentialVerifyResult[];
 }
-export type VerifyResult = IdentityVerifyResult | ReceiptVerifyResult | CredentialVerifyResult | PresentationVerifyResult;
+/**
+ * Per-file verification outcome inside a `SkillVerifyResult`. Each entry
+ * cross-checks `envelope.files[].hash` against `sha256(<file bytes>)`.
+ * `actual === null` means the verifier had no on-disk bytes to compare —
+ * either the bundle didn't ship the file or a directory walker couldn't
+ * locate it. Distinct shape from envelope-signature failure: a missing
+ * file is an unverifiable claim, not a forged one.
+ */
+export interface SkillFileVerifyResult {
+    readonly path: string;
+    readonly valid: boolean;
+    readonly expected: string;
+    readonly actual: string | null;
+    /** `"ok" | "hash_mismatch" | "missing"`. */
+    readonly reason: "ok" | "hash_mismatch" | "missing";
+}
+/**
+ * Verification outcome for a `SkillEnvelope` (per `spec/skills-v1.md` §5)
+ * with optional on-disk body + file cross-checks.
+ *
+ * Three independent verification axes:
+ *   - `steps.envelope` — Ed25519 signature over canonical envelope bytes.
+ *     Always populated; the primitive lives in this package.
+ *   - `steps.body_hash` — `sha256(LF-normalized SKILL.md bytes)` cross-
+ *     checked against `envelope.body_hash`. Populated by callers that
+ *     read the body from disk (the `@motebit/verifier` directory walker
+ *     does this); `null` when this layer was called with bare envelope
+ *     JSON and had no body bytes to compare.
+ *   - `steps.files` — per-file `sha256` cross-checks. Empty array when
+ *     no file bytes were provided to compare; otherwise one entry per
+ *     `envelope.files[]` declaration.
+ *
+ * `valid` reflects "every attempted axis passed AND every declared
+ * cross-check was attempted." Calling crypto's `verify(envelope)`
+ * directly returns `valid: false` with `body_hash: null` and `files:
+ * []` because the bare envelope can only be sig-verified — full
+ * verification requires the on-disk bytes. The
+ * `@motebit/verifier::verifySkillDirectory` library completes the
+ * other two axes; that's the canonical full-verify entry point for
+ * skills.
+ */
+export interface SkillVerifyResult extends BaseResult {
+    type: "skill";
+    envelope: SkillEnvelope | null;
+    /** Compact identifier — `<name>@<version>` from `envelope.skill`. */
+    skill?: string;
+    /** Echoed from `envelope.signature.public_key`. */
+    signer?: string;
+    steps: {
+        envelope: {
+            valid: boolean;
+            reason: SkillVerifyReason;
+        };
+        body_hash: {
+            valid: boolean;
+            expected: string;
+            actual: string;
+        } | null;
+        files: ReadonlyArray<SkillFileVerifyResult>;
+    };
+}
+export type VerifyResult = IdentityVerifyResult | ReceiptVerifyResult | CredentialVerifyResult | PresentationVerifyResult | SkillVerifyResult;
 export type ArtifactType = VerifyResult["type"];
 export interface VerifyOptions {
     expectedType?: ArtifactType;
@@ -205,6 +268,58 @@ export declare function parse(content: string): {
     signature: string;
     rawFrontmatter: string;
 };
+/**
+ * Bundle-shape input for `verifySkillBundle`. The full-verify
+ * primitive — envelope signature + body hash + per-file hashes — runs
+ * pure on these bytes, no I/O, no environment-specific shape.
+ *
+ * Body bytes are LF-normalized SKILL.md content (the exact bytes the
+ * envelope's `body_hash` was computed over at sign time). Files map
+ * each path declared in `envelope.files[]` to its raw bytes. Callers
+ * with base64-encoded inputs (relay-served `SkillRegistryBundle`,
+ * tarball decoders) decode to `Uint8Array` before calling.
+ *
+ * Single canonical primitive across surfaces:
+ *   - `motebit-verify` CLI / `@motebit/verifier::verifySkillDirectory`
+ *     reads from disk → builds this shape → calls `verifySkillBundle`.
+ *   - Browser consumers (`motebit.com/skills`, third-party registries,
+ *     CI pipelines) decode from base64 → builds this shape → calls
+ *     `verifySkillBundle`.
+ *
+ * Both paths produce the same `SkillVerifyResult` with the same step
+ * semantics. Same primitive, swap the I/O.
+ */
+export interface SkillBundleInput {
+    readonly envelope: SkillEnvelope;
+    /** LF-normalized SKILL.md body bytes — the exact bytes signed at envelope-sign time. */
+    readonly body: Uint8Array;
+    /** Per-path raw bytes for every entry in `envelope.files[]`. Omit a path to mark it missing. */
+    readonly files?: Readonly<Record<string, Uint8Array>>;
+}
+/**
+ * Verify a skill bundle end-to-end. Pure function — no I/O. Performs
+ * the three independent verification axes:
+ *
+ *   1. Envelope signature — Ed25519 over the canonical envelope bytes.
+ *   2. Body hash — `sha256(body)` cross-checked against `envelope.body_hash`.
+ *   3. Per-file hashes — for each entry in `envelope.files[]`,
+ *      `sha256(files[path])` cross-checked against `entry.hash`. A
+ *      missing path (envelope declared it; bundle didn't ship bytes)
+ *      surfaces as `valid: false` with `reason: "missing"`.
+ *
+ * `valid: true` iff every axis passed AND every declared file was
+ * provided. The detailed step shape lets callers render per-axis
+ * outcomes — the canonical doctrine is "every routing-input claim
+ * MUST be visible to the user", and the same applies to verification:
+ * a one-bit valid/invalid throws away which axis failed.
+ *
+ * Faithful to `services/relay/CLAUDE.md` rule 6 ("relay is a
+ * convenience layer, not a trust root"): any consumer with a bundle
+ * — from any source, motebit-served or not — answers "is this signed
+ * AND do the bytes match what the publisher signed?" using only this
+ * primitive, no relay or runtime contact required.
+ */
+export declare function verifySkillBundle(input: SkillBundleInput): Promise<SkillVerifyResult>;
 /**
  * Verify any Motebit artifact: identity file, execution receipt,
  * verifiable credential, or verifiable presentation.
@@ -262,4 +377,8 @@ export * from "./signing.js";
 export * from "./artifacts.js";
 export { signVerifiableCredential, verifyVerifiableCredential, signVerifiablePresentation, verifyVerifiablePresentation, issueGradientCredential, issueReputationCredential, issueTrustCredential, createPresentation, type GradientCredentialSubject, type ReputationCredentialSubject, type TrustCredentialSubject, } from "./credentials.js";
 export { computeCredentialLeaf, verifyCredentialAnchor, verifyRevocationAnchor, type CredentialAnchorVerifyResult, type CredentialAnchorProofFields, type ChainAnchorVerifier, type RevocationAnchorVerifyResult, type RevocationAnchorProof, } from "./credential-anchor.js";
+export { SKILL_SIGNATURE_SUITE, canonicalizeSkillManifestBytes, canonicalizeSkillEnvelopeBytes, signSkillManifest, signSkillEnvelope, verifySkillManifest, verifySkillManifestDetailed, verifySkillEnvelope, verifySkillEnvelopeDetailed, decodeSkillSignaturePublicKey, type SkillVerifyReason, type SkillVerifyDetail, } from "./skills.js";
+export { DELETION_CERTIFICATE_SUITE, WITNESS_OMISSION_DISPUTE_WINDOW_MS, canonicalizeMultiSignatureCert, canonicalizeHorizonCert, canonicalizeHorizonCertForWitness, signCertAsSubject, signCertAsOperator, signCertAsDelegate, signCertAsGuardian, signHorizonCertAsIssuer, signHorizonWitness, canonicalizeHorizonWitnessRequestBody, signHorizonWitnessRequestBody, verifyHorizonWitnessRequestSignature, verifyDeletionCertificate, verifyRetentionManifest, type DeletionCertificateVerifyResult, type DeletionCertificateVerifyContext, type RetentionManifestVerifyResult, } from "./deletion-certificate.js";
+export { canonicalizeWitnessOmissionDispute, signWitnessOmissionDispute, verifyWitnessOmissionDispute, type WitnessOmissionDisputeVerifyResult, type WitnessOmissionDisputeVerifyContext, } from "./witness-omission-dispute.js";
+export { verifyMerkleInclusion } from "./merkle.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAYH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IAGjB,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,eAAe,CAAC;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,QAAQ,EAAE;QACR,SAAS,EAAE,SAAS,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IAEF,UAAU,EAAE;QACV,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;QAC3C,aAAa,EAAE,MAAM,CAAC;QACtB,sBAAsB,EAAE,MAAM,CAAC;QAC/B,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IAEF,OAAO,EAAE;QACP,mBAAmB,EAAE,MAAM,CAAC;QAC5B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvC,WAAW,EAAE,OAAO,CAAC;KACtB,CAAC;IAEF,MAAM,EAAE;QACN,cAAc,EAAE,MAAM,CAAC;QACvB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF,8EAA8E;IAC9E,QAAQ,CAAC,EAAE;QACT,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,cAAc,EAAE,MAAM,CAAC;QACvB,6DAA6D;QAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF,OAAO,EAAE,KAAK,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC,CAAC;IAEH,UAAU,CAAC,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,KAAK,EAAE,4BAA4B,CAAC;IACpC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAMD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACzC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAOD,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAEV,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EACL,8BAA8B,EAC9B,iCAAiC,EACjC,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,mBAAmB,EACnB,wBAAwB,EACxB,+BAA+B,EAC/B,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EACV,4BAA4B,EAC5B,+BAA+B,EAChC,MAAM,2BAA2B,CAAC;AAMnC,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,UAAU,UAAU;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAqB,SAAQ,UAAU;IACtD,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,OAAO,CAAC;QACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACrD,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,sBAAuB,SAAQ,UAAU;IACxD,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,+BAA+B,CAAC;CACxD;AAED,MAAM,WAAW,wBAAyB,SAAQ,UAAU;IAC1D,IAAI,EAAE,cAAc,CAAC;IACrB,YAAY,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,sBAAsB,EAAE,CAAC;CACxC;AAED,MAAM,MAAM,YAAY,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,sBAAsB,GACtB,wBAAwB,CAAC;AAE7B,MAAM,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;AAEhD,MAAM,WAAW,aAAa;IAC5B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,mBAAmB,CAAC,EAAE,4BAA4B,CAAC;CACpD;AAMD;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,OAAO,CAAC;QACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AA+TD;;;GAGG;AACH,wBAAgB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG;IACtC,WAAW,EAAE,mBAAmB,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB,CAgCA;AA0jBD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAgE9F;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CASrF;AAOD,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,yBAAyB,EACzB,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,mBAAmB,EACxB,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,GAC3B,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAYH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IAGjB,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,eAAe,CAAC;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,QAAQ,EAAE;QACR,SAAS,EAAE,SAAS,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IAEF,UAAU,EAAE;QACV,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;QAC3C,aAAa,EAAE,MAAM,CAAC;QACtB,sBAAsB,EAAE,MAAM,CAAC;QAC/B,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IAEF,OAAO,EAAE;QACP,mBAAmB,EAAE,MAAM,CAAC;QAC5B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvC,WAAW,EAAE,OAAO,CAAC;KACtB,CAAC;IAEF,MAAM,EAAE;QACN,cAAc,EAAE,MAAM,CAAC;QACvB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF,8EAA8E;IAC9E,QAAQ,CAAC,EAAE;QACT,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,cAAc,EAAE,MAAM,CAAC;QACvB,6DAA6D;QAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF,OAAO,EAAE,KAAK,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC,CAAC;IAEH,UAAU,CAAC,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,KAAK,EAAE,4BAA4B,CAAC;IACpC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAMD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACzC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAOD,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAEV,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAKrD,OAAO,EACL,8BAA8B,EAC9B,iCAAiC,EACjC,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,mBAAmB,EACnB,wBAAwB,EACxB,+BAA+B,EAC/B,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EACV,4BAA4B,EAC5B,+BAA+B,EAChC,MAAM,2BAA2B,CAAC;AAMnC,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,UAAU,UAAU;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAqB,SAAQ,UAAU;IACtD,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,OAAO,CAAC;QACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACrD,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,sBAAuB,SAAQ,UAAU;IACxD,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,+BAA+B,CAAC;CACxD;AAED,MAAM,WAAW,wBAAyB,SAAQ,UAAU;IAC1D,IAAI,EAAE,cAAc,CAAC;IACrB,YAAY,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,sBAAsB,EAAE,CAAC;CACxC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,EAAE,IAAI,GAAG,eAAe,GAAG,SAAS,CAAC;CACrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,iBAAkB,SAAQ,UAAU;IACnD,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,aAAa,GAAG,IAAI,CAAC;IAC/B,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE;QACL,QAAQ,EAAE;YAAE,KAAK,EAAE,OAAO,CAAC;YAAC,MAAM,EAAE,iBAAiB,CAAA;SAAE,CAAC;QACxD,SAAS,EAAE;YAAE,KAAK,EAAE,OAAO,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC;QACvE,KAAK,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;KAC7C,CAAC;CACH;AAED,MAAM,MAAM,YAAY,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,sBAAsB,GACtB,wBAAwB,GACxB,iBAAiB,CAAC;AAEtB,MAAM,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;AAEhD,MAAM,WAAW,aAAa;IAC5B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,mBAAmB,CAAC,EAAE,4BAA4B,CAAC;CACpD;AAMD;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,OAAO,CAAC;QACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAqVD;;;GAGG;AACH,wBAAgB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG;IACtC,WAAW,EAAE,mBAAmB,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB,CAgCA;AA8aD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,wFAAwF;IACxF,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,gGAAgG;IAChG,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;CACvD;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA+F3F;AAgND;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAgG9F;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CASrF;AAOD,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,yBAAyB,EACzB,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,mBAAmB,EACxB,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,GAC3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,qBAAqB,EACrB,8BAA8B,EAC9B,8BAA8B,EAC9B,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,2BAA2B,EAC3B,mBAAmB,EACnB,2BAA2B,EAC3B,6BAA6B,EAC7B,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,EAClC,8BAA8B,EAC9B,uBAAuB,EACvB,iCAAiC,EACjC,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EAClB,qCAAqC,EACrC,6BAA6B,EAC7B,oCAAoC,EACpC,yBAAyB,EACzB,uBAAuB,EACvB,KAAK,+BAA+B,EACpC,KAAK,gCAAgC,EACrC,KAAK,6BAA6B,GACnC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kCAAkC,EAClC,0BAA0B,EAC1B,4BAA4B,EAC5B,KAAK,kCAAkC,EACvC,KAAK,mCAAmC,GACzC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC"}