@openauditmodel/cli 0.1.1 → 0.2.1

package/README.md

@@ -157,6 +157,50 @@ changes, privileged operations, data access, data modification, configuration ch
 approvals, delegation, impersonation, administrative actions, security-relevant actions, external
 data sharing, resource lifecycle operations, and deployment and operational changes.
 
+## Has this been tried before?
+
+Yes, several times, and by serious people. This project is not the first attempt to give audit
+events a common shape, and the reason for another one is narrower than "there wasn't a standard".
+
+**XDAS** (The Open Group, 1998) defined a set of generic events and a portable audit record format
+so that records from different components of a distributed system could be merged and analysed
+together. It remained a Preliminary Specification.
+
+**CEE** (MITRE) is the closest predecessor in shape. It defined an Event Taxonomy, a Field
+Dictionary, an Event Schema with extensions, and Event Profiles — customizable extensions of the
+schema for a particular need — together with JSON and XML encodings and a transport layer that
+covered secure logging and verifiable record logs. That is close enough to this project's structure
+that it should be said plainly rather than discovered. MITRE stopped all work on CEE in 2014 when
+its sponsor's funding ended, and keeps the site as an archive. It stopped for want of funding, not
+because the idea was wrong.
+
+**CADF** (DMTF DSP0262) is a full audit event model: schema definitions, extensible taxonomies, and
+interfaces for federating event records between providers. Its framing — initiator, action, target,
+outcome, observer — is reflected here. Its target is cloud and service-provider auditing.
+
+**OCSF** is the active one, describing itself as an extensible framework for developing schemas with
+a vendor-agnostic core security schema, initially focused on cybersecurity events. It has real
+adoption across security vendors.
+
+### So why another one?
+
+Not because those are wrong, and not because a schema is a novel idea. The differences are of focus:
+
+- **The subject is a business operation, not security telemetry or a control-plane action.** The
+  questions this model insists on — who authorized it, who approved it, on whose behalf it was done,
+  why, and what the record looked like before and after — are the ones that come up when a business
+  application is audited, and they are peripheral in models built for other domains.
+- **Conformance is testable rather than asserted.** A canonical JSON Schema, published fixtures and a
+  validator mean a producer can be shown to conform, or shown not to, before the data is retained for
+  years. Profiles add requirements for a domain and are structurally unable to relax the core.
+- **The specification is reachable by the tooling that writes the code.** Much of this instrumentation
+  is now written with a coding agent in the loop, and an agent that can query the model, generate an
+  event against it, validate the result and check it for leaked credentials is a different proposition
+  from a specification document it has to be told about.
+
+None of those parts is individually novel. The combination, and the narrowness of the target, are the
+bet this project is making.
+
 ## Why is an audit event different from an application debug log?
 
 An application log line says:
@@ -215,7 +259,7 @@ OpenAuditModel complements existing standards rather than reinventing them. None
 | **OpenTelemetry**             | MAY be used for telemetry transport, collection and trace correlation.           |
 | **ECS**                       | Supported through an informative export mapping.                                 |
 | **OCSF**                      | Supported through an informative security-event mapping.                         |
-| **CADF**                      | A conceptual reference for audit semantics.                                      |
+| **CADF**                      | A DMTF audit event standard. Prior art; not an export target in v0.1.            |
 | **OSCAL**                     | May later be used for control and assessment mappings. Not addressed in v0.1.    |
 | **JSON Schema Draft 2020-12** | Defines the canonical machine-verifiable structure.                              |
 
@@ -238,9 +282,11 @@ event is valid standalone. See [mappings/cloudevents.md](mappings/cloudevents.md
 
 ### Specifically, ECS, OCSF and CADF
 
-ECS is a field vocabulary for search; OCSF is a schema for security telemetry; CADF is a conceptual
-model for cloud audit. OpenAuditModel exports to the first two and takes conceptual framing from the
-third. All three mappings are informative, one-directional, and honest about what does not map — see
+ECS is a field vocabulary for search; OCSF is a schema for security telemetry; CADF (DMTF DSP0262) is
+a complete audit event model with its own schema definitions, taxonomies and federation interfaces,
+aimed at cloud and service-provider auditing. OpenAuditModel exports to the first two and takes
+conceptual framing from the third — the difference there is domain, not completeness. All three
+mappings are informative, one-directional, and honest about what does not map — see
 [mappings/](mappings/).
 
 ## Why is the model backend-independent?
@@ -263,7 +309,7 @@ See [ADR 0003](decisions/0003-backend-and-transport-independence.md).
 specification/         15 normative documents defining the model
 schemas/v0.1/          the canonical JSON Schema (Draft 2020-12)
 semantic-conventions/  recommended event names and vocabularies
-profiles/              ten enforceable domain profiles, 127 rules
+profiles/              ten enforceable domain profiles, 127 rules (113 error-severity, 14 advisory)
 mappings/              informative mappings to CloudEvents, OTel, ECS, OCSF, CADF
 examples/              11 valid and 7 invalid conformance fixtures
 examples/integrity/    generated tamper-evidence fixtures, valid and invalid
@@ -272,7 +318,7 @@ examples/profiles/     conforming, violating and out-of-scope profile fixtures
 conformance/           the `auditmodel` CLI and its test suite
 mcp/                   the remote MCP server, distributed as a container image
 deploy/                Docker Compose and reverse-proxy examples
-decisions/             11 architecture decision records
+decisions/             12 architecture decision records
 ```
 
 The core model requires seven fields — `specVersion`, `id`, `time`, `event`, `actor`, `resource`,
@@ -393,10 +439,11 @@ canonicalization and hash algorithm are ones the verifier implements; that recal
 reproduces `integrity.hash`; and, for chains, that every event links to its predecessor, that
 sequences are unique and orderable, and that one algorithm is used throughout.
 
-**What is not verified.** Signatures, keys and certificates — none of which v0.1 touches. Nor whether
-the events you supplied are all the events that existed: chain verification proves consistency of the
-supplied set, and an attacker who removes the _end_ of a chain leaves something internally consistent.
-Detecting that needs an external checkpoint, which is out of scope.
+**What is not verified.** Whether the events you supplied are all the events that existed: chain
+verification proves consistency of the supplied set, and an attacker who removes the _end_ of a chain
+leaves something internally consistent. Detecting that needs an external checkpoint, which is out of
+scope. Key generation, storage, rotation, revocation and certificate parsing are likewise out of scope,
+regardless of whether a signature is present.
 
 **How the digest is calculated.** Deep-clone the event, remove exactly `/integrity/hash` and
 `/integrity/signature`, serialize with **RFC 8785** (the JSON Canonicalization Scheme), encode as
@@ -411,6 +458,19 @@ attacker could re-link and re-order events freely while every hash still verifie
 keeps the vocabulary open so a future algorithm needs no schema change — but acceptance by the schema
 is not support, and an event declaring anything else is reported as unverifiable rather than verified.
 
+**Signature verification.** `integrity.signature` can additionally be checked with `--public-key
+<path>`, a PEM-encoded Ed25519 public key — `ECDSA-P256-SHA256` and `RSA-PSS-SHA256` are
+schema-recommended but not yet implemented. It verifies over the same digest input as the hash, so a
+signed chain is exactly as tamper-evident as a hashed one. Without the flag, a declared signature is
+neither checked nor mentioned, and a signature currently requires an accompanying `hash` to be checked
+at all. There is no key registry: `keyId` is never dereferenced, and a verifying party supplies the key
+it already trusts. See [ADR 0012](decisions/0012-ed25519-signature-verification.md).
+
+```bash
+auditmodel verify-integrity examples/integrity/valid/signed-event-ed25519.json \
+  --public-key examples/integrity/keys/ed25519-test-public.pem
+```
+
 **Tamper-evident, not tamper-proof.** Verification detects modification of the events it is given. It
 does not prevent deletion, does not provide storage immutability, and creates no legal evidentiary
 status. See [specification/integrity.md](specification/integrity.md) §8 and

package/dist/conformance/src/cli.js

@@ -1,26 +1,4 @@
 #!/usr/bin/env node
-/**
- * `auditmodel` — the OpenAuditModel conformance command line interface.
- *
- * v0.1 implements three commands:
- *   validate          check events against the canonical schema
- *   verify-integrity  recalculate and compare each event's own digest
- *   verify-chain      verify previous-hash chains across a set of events
- *
- * Exit codes:
- *   0  a verdict was produced and it passed
- *   1  a verdict was produced and it failed
- *   2  the tool could not run: usage error, or a file could not be read or parsed
- *   3  NO VERDICT was produced — nothing was evaluated
- *
- * 3 is the code that matters most, because it is the one that is easy to misread
- * as success. `check-profile` returns it when no rule governs the event, and
- * `lint-privacy` returns it when the input is not an audit event and was
- * therefore never scanned. Neither is an approval of anything.
- *
- * The tooling is offline: it resolves no remote reference, fetches no evidence
- * URL and executes nothing contained in an event.
- */
 import { readFileSync, realpathSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -30,6 +8,7 @@ import { loadEventDocuments } from "./sources.js";
 import { formatIssues } from "./format-errors.js";
 import { verifyEventIntegrity } from "./integrity/verify-event.js";
 import { verifyChains } from "./integrity/verify-chain.js";
+import { loadPublicKey } from "./integrity/signature.js";
 import { lintEvent } from "./privacy/lint-event.js";
 import { summarise } from "./privacy/types.js";
 import { availableProfiles, loadProfile } from "./profiles/load-profile.js";
@@ -75,6 +54,9 @@ Options:
   -q, --quiet                            Only report failures
       --format <text|json>               Output format for lint-privacy and check-profile
       --profile <name>                   Profile to check against (check-profile)
+      --public-key <path>                PEM public key to verify integrity.signature against
+                                          (verify-integrity, verify-chain). Ed25519 only in v0.1.
+                                          Without it, a declared signature is not checked.
 
 Exit codes:
   0  a verdict was produced and it passed
@@ -220,7 +202,7 @@ function runValidate(inputs, quiet) {
     }
     return invalid > 0 ? EXIT_INVALID : EXIT_OK;
 }
-function runVerifyIntegrity(inputs, quiet) {
+function runVerifyIntegrity(inputs, quiet, publicKey) {
     const loaded = loadInput(inputs, "verify-integrity", quiet);
     if (typeof loaded === "number") {
         return loaded;
@@ -230,7 +212,7 @@ function runVerifyIntegrity(inputs, quiet) {
     let failed = 0;
     for (const document of loaded.documents) {
         const label = displayLabel(document);
-        const result = verifyEventIntegrity(document.event, label, loaded.validator);
+        const result = verifyEventIntegrity(document.event, label, loaded.validator, { publicKey });
         if (result.verified) {
             verified += 1;
             if (!quiet) {
@@ -261,7 +243,7 @@ function runVerifyIntegrity(inputs, quiet) {
     }
     return failed > 0 ? EXIT_INVALID : EXIT_OK;
 }
-function runVerifyChain(inputs, quiet) {
+function runVerifyChain(inputs, quiet, publicKey) {
     const loaded = loadInput(inputs, "verify-chain", quiet);
     if (typeof loaded === "number") {
         return loaded;
@@ -271,7 +253,7 @@ function runVerifyChain(inputs, quiet) {
         label: displayLabel(document),
         event: document.event,
     }));
-    const report = verifyChains(events, loaded.validator);
+    const report = verifyChains(events, loaded.validator, publicKey);
     if (report.unassigned.length > 0) {
         write("events that could not be assigned to a chain\n");
         writeFindings(report.unassigned, "  ");
@@ -489,6 +471,7 @@ export function run(argv) {
                 quiet: { type: "boolean", short: "q", default: false },
                 format: { type: "string", default: "text" },
                 profile: { type: "string" },
+                "public-key": { type: "string" },
             },
         });
     }
@@ -515,14 +498,34 @@ export function run(argv) {
         process.stderr.write(`auditmodel: unknown output format "${format}"; expected ${[...OUTPUT_FORMATS].join(" or ")}\n`);
         return EXIT_ERROR;
     }
+    let publicKey;
+    if (typeof values["public-key"] === "string" &&
+        (command === "verify-integrity" || command === "verify-chain")) {
+        const keyPath = values["public-key"];
+        let pemText;
+        try {
+            pemText = readFileSync(keyPath, "utf8");
+        }
+        catch (cause) {
+            process.stderr.write(`auditmodel: cannot read --public-key "${keyPath}": ${cause.message}\n`);
+            return EXIT_ERROR;
+        }
+        try {
+            publicKey = loadPublicKey(pemText);
+        }
+        catch (cause) {
+            process.stderr.write(`auditmodel: --public-key "${keyPath}" ${cause.message}\n`);
+            return EXIT_ERROR;
+        }
+    }
     if (command === "validate") {
         return runValidate(rest, quiet);
     }
     if (command === "verify-integrity") {
-        return runVerifyIntegrity(rest, quiet);
+        return runVerifyIntegrity(rest, quiet, publicKey);
     }
     if (command === "verify-chain") {
-        return runVerifyChain(rest, quiet);
+        return runVerifyChain(rest, quiet, publicKey);
     }
     if (command === "lint-privacy") {
         return runLintPrivacy(rest, quiet, format);

package/dist/conformance/src/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../../conformance/src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAkB,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAA+C,MAAM,cAAc,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,YAAY,EAAwB,MAAM,6BAA6B,CAAC;AAEjF,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAuB,MAAM,qBAAqB,CAAC;AAEnF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC;AACzB,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAC9B,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC;AAC5B;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC;AAEjC,gFAAgF;AAChF,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAEnD,2FAA2F;AAC3F,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAErD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjD,MAAM,KAAK,GAAG,kEAAkE,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4C3F,CAAC;AAEF,SAAS,WAAW,CAAC,UAAkB;IACrC,qEAAqE;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAEhF,CAAC;QACF,OAAO,QAAQ,CAAC,OAAO,IAAI,YAAY,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,YAAY,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AAC5F,CAAC;AAED,2FAA2F;AAC3F,SAAS,YAAY,CAAC,QAAuB;IAC3C,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,aAAa,CAAC,QAA4B,EAAE,MAAc;IACjE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC;QACtE,KAAK,CAAC,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,CAAC,OAAO,MAAM,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC;QAClE,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACxC,KAAK,CAAC,GAAG,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAmC,EAAE,MAAc;IAC/E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,CACH,GAAG,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,KAAK,MAAM,KAAK,OAAO,CAAC,OAAO,IAAI,CAClH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAA8B,EAAE,MAAc;IACjE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAsB,EAAE,MAAc;IACxD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,CAAC,GAAG,MAAM,SAAS,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACrC,KAAK,CAAC,GAAG,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;AACH,CAAC;AAQD;;;GAGG;AACH,SAAS,SAAS,CAChB,MAAyB,EACzB,OAAe,EACf,KAAc;IAEd,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,OAAO,8CAA8C,CAAC,CAAC;QAC3F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAgB,KAAe,CAAC,OAAO,IAAI,CAAC,CAAC;QAClE,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACzE,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,SAAoB,CAAC;IACzB,IAAI,CAAC;QACH,SAAS,GAAG,eAAe,EAAE,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAgB,KAAe,CAAC,OAAO,IAAI,CAAC,CAAC;QAClE,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,CAAC,WAAW,SAAS,CAAC,QAAQ,KAAK,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACpF,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAwC;IAClE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,CAAC,SAAS,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAyB,EAAE,KAAc;IAC5D,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IACpD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEpC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE9D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,CAAC,CAAC;YACb,KAAK,CAAC,SAAS,KAAK,KAAK,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;IACtC,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC9C,KAAK,CACH,KAAK,KAAK,IAAI,IAAI,aAAa,KAAK,WAAW,OAAO,aAAa,MAAM,CAAC,QAAQ,CAAC,MAAM,eAAe,CACzG,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC;AAC9C,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAyB,EAAE,KAAc;IACnE,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC;IAC5D,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEpC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAE7E,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,QAAQ,IAAI,CAAC,CAAC;YACd,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;gBAC1B,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,CAAC;YACZ,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACzC,CAAC;YACD,sEAAsE;YACtE,wBAAwB;YACxB,aAAa,CACX,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAChC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;aACpE,CAAC,CAAC,EACH,UAAU,CACX,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;IACtC,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC9C,KAAK,CAAC,KAAK,KAAK,IAAI,IAAI,aAAa,QAAQ,cAAc,MAAM,WAAW,CAAC,CAAC;IAE9E,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,MAAyB,EAAE,KAAc;IAC/D,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;IACxD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEpC,MAAM,MAAM,GAAsB,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACpE,KAAK,EAAE,YAAY,CAAC,QAAQ,CAAC;QAC7B,KAAK,EAAE,QAAQ,CAAC,KAAK;KACtB,CAAC,CAAC,CAAC;IAEJ,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAEtD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACxD,aAAa,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,KAAK,GACT,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;YACnE,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,GAAG,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;QAEtD,KAAK,CAAC,SAAS,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QAClC,KAAK,CAAC,gBAAgB,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC;QAC5C,KAAK,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC;QAEjC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,WAAW,CACT,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EACpE,IAAI,CACL,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,KAAK,CAAC,UAAU,CAAC,CAAC;YAClB,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAC7C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClE,KAAK,CACH,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,SAAS,aAAa,MAAM,YAAY,MAAM,YAAY,MAAM,CAAC,UAAU,YAAY,CACnH,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACzE,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;AAChD,CAAC;AAED,SAAS,cAAc,CAAC,MAAyB,EAAE,KAAc,EAAE,MAAc;IAC/E,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC;IAC7E,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAChD,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CACpE,CAAC;IACF,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAEnC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG;YACb,IAAI,EAAE,yBAAyB;YAC/B,WAAW,EAAE,YAAY;YACzB,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ;YACnC,OAAO;YACP,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC5C,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;gBAC/B,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAChC,IAAI,EAAE,MAAM,CAAC,KAAK;gBAClB,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpE,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,qDAAqD;gBACrD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACxC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,cAAc,EAAE,KAAK,CAAC,cAAc;iBACrC,CAAC,CAAC;aACJ,CAAC,CAAC;SACJ,CAAC;QACF,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;SAAM,CAAC;QACN,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEpC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,KAAK,CAAC,SAAS,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;gBACnC,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;gBACvC,KAAK,CAAC,SAAS,MAAM,CAAC,KAAK,gDAAgD,CAAC,CAAC;gBAC7E,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;oBACxC,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC;gBAC9B,CAAC;gBACD,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;YACnE,KAAK,CAAC,SAAS,MAAM,CAAC,KAAK,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,IAAI,KAAK,CAAC,CAAC;YACtE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpC,KAAK,CACH,WAAW,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,MAAM,gBAAgB,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,IAAI,IAAI,CAC5G,CAAC;gBACF,KAAK,CAAC,aAAa,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;gBACtC,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;oBACvC,KAAK,CAAC,6BAA6B,KAAK,CAAC,cAAc,IAAI,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5D,KAAK,CACH,KAAK,OAAO,CAAC,MAAM,IAAI,SAAS,aAAa,OAAO,CAAC,KAAK,WAAW,OAAO,CAAC,YAAY,mBAAmB,OAAO,CAAC,aAAa,oBAAoB,MAAM,CAAC,QAAQ,CAAC,MAAM,eAAe,CAC3L,CAAC;QACF,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC;QACjE,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;QACpE,KAAK,CACH,GAAG,OAAO,CAAC,QAAQ,YAAY,WAAW,KAAK,QAAQ,cAAc,IAAI,UAAU,MAAM,YAAY,GAAG,SAAS,IAAI,SAAS,CAC/H,CAAC;QAEF,IAAI,OAAO,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC9D,KAAK,CACH,8CAA8C,OAAO,CAAC,aAAa,IAAI,IAAI,qGAAqG,CACjL,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,0EAA0E;IAC1E,2EAA2E;IAC3E,oEAAoE;IACpE,IAAI,OAAO,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,OAAO,OAAO,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC;AAC/D,CAAC;AAED,SAAS,eAAe,CACtB,MAAyB,EACzB,KAAc,EACd,MAAc,EACd,WAA+B;IAE/B,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;QACpD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4EAA4E,iBAAiB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAC/G,CAAC;QACF,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QACtD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC;IAC7E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC/C,YAAY,CAAC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAC/E,CAAC;IACF,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAEjD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,KAAK,CACH,GAAG,IAAI,CAAC,SAAS,CACf;YACE,IAAI,EAAE,0BAA0B;YAChC,WAAW,EAAE,YAAY;YACzB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,QAAQ;YAClC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;YACjF,OAAO;YACP,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC3C,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;gBAC/B,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB,CAAC,CAAC;YACH,OAAO;SACR,EACD,IAAI,EACJ,CAAC,CACF,IAAI,CACN,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,CAAC,YAAY,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,MAAM,OAAO,CAAC,CAAC;QAC/E,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBACnC,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,KAAK,CAAC,SAAS,MAAM,CAAC,KAAK,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACtE,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;gBACpD,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;gBACvC,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,KAAK,CAAC,SAAS,MAAM,CAAC,KAAK,kDAAkD,CAAC,CAAC;gBACjF,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;gBACrC,KAAK,CAAC,SAAS,MAAM,CAAC,KAAK,iDAAiD,CAAC,CAAC;gBAC9E,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;oBACtC,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC;gBAC9B,CAAC;gBACD,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC;YACrE,KAAK,CAAC,SAAS,MAAM,CAAC,KAAK,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,KAAK,CAAC,CAAC;YACpE,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7C,KAAK,CAAC,0BAA0B,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtE,CAAC;YACD,oBAAoB,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAChD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvD,KAAK,CACH,KAAK,OAAO,CAAC,MAAM,IAAI,IAAI,aAAa,OAAO,CAAC,UAAU,gBAAgB,OAAO,CAAC,UAAU,qBAAqB,OAAO,CAAC,aAAa,oBAAoB,OAAO,CAAC,WAAW,kBAAkB,KAAK,CAAC,QAAQ,CAAC,MAAM,eAAe,CACpO,CAAC;QACF,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,wBAAwB,OAAO,CAAC,QAAQ,oBAAoB,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,iEAAiE;IACjE,mCAAmC;IACnC,OAAO,OAAO,CAAC,UAAU,KAAK,CAAC,IAAI,OAAO,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,IAAuB;IACzC,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC;YACjB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;YACf,gBAAgB,EAAE,IAAI;YACtB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE;gBACP,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE;gBACrD,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;gBAC5C,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE;gBACtD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE;gBAC3C,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aAC5B;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAgB,KAAe,CAAC,OAAO,MAAM,CAAC,CAAC;QACpE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IAEvC,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;QACpC,KAAK,CACH,cAAc,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC,mBAAmB,YAAY,mBAAmB,CAClG,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAE/B,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACxE,KAAK,CAAC,KAAK,CAAC,CAAC;QACb,OAAO,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9E,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC;IACpC,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IAE1E,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sCAAsC,MAAM,eAAe,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAChG,CAAC;QACF,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,OAAO,KAAK,kBAAkB,EAAE,CAAC;QACnC,OAAO,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QAC/B,OAAO,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QAC/B,OAAO,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,OAAO,eAAe,CACpB,IAAI,EACJ,KAAK,EACL,MAAM,EACN,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAChE,CAAC;IACJ,CAAC;IAED,IAAI,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gBAAgB,OAAO,8EAA8E,YAAY,IAAI,CACtH,CAAC;QACF,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,OAAO,OAAO,CAAC,CAAC;IACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB;IACzB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,IAAI,kBAAkB,EAAE,EAAE,CAAC;IACzB,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../../conformance/src/cli.ts"],"names":[],"mappings":";AAwBA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAkB,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAA+C,MAAM,cAAc,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,YAAY,EAAwB,MAAM,6BAA6B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAuB,MAAM,qBAAqB,CAAC;AAEnF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC;AACzB,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAC9B,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC;AAC5B;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC;AAEjC,gFAAgF;AAChF,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAEnD,2FAA2F;AAC3F,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAErD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjD,MAAM,KAAK,GAAG,kEAAkE,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+C3F,CAAC;AAEF,SAAS,WAAW,CAAC,UAAkB;IACrC,qEAAqE;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAEhF,CAAC;QACF,OAAO,QAAQ,CAAC,OAAO,IAAI,YAAY,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,YAAY,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AAC5F,CAAC;AAED,2FAA2F;AAC3F,SAAS,YAAY,CAAC,QAAuB;IAC3C,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,aAAa,CAAC,QAA4B,EAAE,MAAc;IACjE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC;QACtE,KAAK,CAAC,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,CAAC,OAAO,MAAM,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC;QAClE,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACxC,KAAK,CAAC,GAAG,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAmC,EAAE,MAAc;IAC/E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,CACH,GAAG,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,KAAK,MAAM,KAAK,OAAO,CAAC,OAAO,IAAI,CAClH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAA8B,EAAE,MAAc;IACjE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAsB,EAAE,MAAc;IACxD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,CAAC,GAAG,MAAM,SAAS,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACrC,KAAK,CAAC,GAAG,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;AACH,CAAC;AAQD;;;GAGG;AACH,SAAS,SAAS,CAChB,MAAyB,EACzB,OAAe,EACf,KAAc;IAEd,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,OAAO,8CAA8C,CAAC,CAAC;QAC3F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAgB,KAAe,CAAC,OAAO,IAAI,CAAC,CAAC;QAClE,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACzE,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,SAAoB,CAAC;IACzB,IAAI,CAAC;QACH,SAAS,GAAG,eAAe,EAAE,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAgB,KAAe,CAAC,OAAO,IAAI,CAAC,CAAC;QAClE,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,CAAC,WAAW,SAAS,CAAC,QAAQ,KAAK,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACpF,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAwC;IAClE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,CAAC,SAAS,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAyB,EAAE,KAAc;IAC5D,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IACpD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEpC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE9D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,CAAC,CAAC;YACb,KAAK,CAAC,SAAS,KAAK,KAAK,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;IACtC,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC9C,KAAK,CACH,KAAK,KAAK,IAAI,IAAI,aAAa,KAAK,WAAW,OAAO,aAAa,MAAM,CAAC,QAAQ,CAAC,MAAM,eAAe,CACzG,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC;AAC9C,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAyB,EACzB,KAAc,EACd,SAAgC;IAEhC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC;IAC5D,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEpC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAE5F,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,QAAQ,IAAI,CAAC,CAAC;YACd,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;gBAC1B,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,CAAC;YACZ,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACzC,CAAC;YACD,sEAAsE;YACtE,wBAAwB;YACxB,aAAa,CACX,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAChC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;aACpE,CAAC,CAAC,EACH,UAAU,CACX,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;IACtC,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC9C,KAAK,CAAC,KAAK,KAAK,IAAI,IAAI,aAAa,QAAQ,cAAc,MAAM,WAAW,CAAC,CAAC;IAE9E,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CACrB,MAAyB,EACzB,KAAc,EACd,SAAgC;IAEhC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;IACxD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEpC,MAAM,MAAM,GAAsB,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACpE,KAAK,EAAE,YAAY,CAAC,QAAQ,CAAC;QAC7B,KAAK,EAAE,QAAQ,CAAC,KAAK;KACtB,CAAC,CAAC,CAAC;IAEJ,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAEjE,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACxD,aAAa,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,KAAK,GACT,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;YACnE,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,GAAG,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;QAEtD,KAAK,CAAC,SAAS,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QAClC,KAAK,CAAC,gBAAgB,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC;QAC5C,KAAK,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC;QAEjC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,WAAW,CACT,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EACpE,IAAI,CACL,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,KAAK,CAAC,UAAU,CAAC,CAAC;YAClB,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAC7C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClE,KAAK,CACH,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,SAAS,aAAa,MAAM,YAAY,MAAM,YAAY,MAAM,CAAC,UAAU,YAAY,CACnH,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACzE,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;AAChD,CAAC;AAED,SAAS,cAAc,CAAC,MAAyB,EAAE,KAAc,EAAE,MAAc;IAC/E,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC;IAC7E,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAChD,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CACpE,CAAC;IACF,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAEnC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG;YACb,IAAI,EAAE,yBAAyB;YAC/B,WAAW,EAAE,YAAY;YACzB,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ;YACnC,OAAO;YACP,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC5C,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;gBAC/B,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAChC,IAAI,EAAE,MAAM,CAAC,KAAK;gBAClB,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpE,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,qDAAqD;gBACrD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACxC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,cAAc,EAAE,KAAK,CAAC,cAAc;iBACrC,CAAC,CAAC;aACJ,CAAC,CAAC;SACJ,CAAC;QACF,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;SAAM,CAAC;QACN,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEpC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,KAAK,CAAC,SAAS,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;gBACnC,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;gBACvC,KAAK,CAAC,SAAS,MAAM,CAAC,KAAK,gDAAgD,CAAC,CAAC;gBAC7E,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;oBACxC,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC;gBAC9B,CAAC;gBACD,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;YACnE,KAAK,CAAC,SAAS,MAAM,CAAC,KAAK,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,IAAI,KAAK,CAAC,CAAC;YACtE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpC,KAAK,CACH,WAAW,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,MAAM,gBAAgB,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,IAAI,IAAI,CAC5G,CAAC;gBACF,KAAK,CAAC,aAAa,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;gBACtC,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;oBACvC,KAAK,CAAC,6BAA6B,KAAK,CAAC,cAAc,IAAI,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5D,KAAK,CACH,KAAK,OAAO,CAAC,MAAM,IAAI,SAAS,aAAa,OAAO,CAAC,KAAK,WAAW,OAAO,CAAC,YAAY,mBAAmB,OAAO,CAAC,aAAa,oBAAoB,MAAM,CAAC,QAAQ,CAAC,MAAM,eAAe,CAC3L,CAAC;QACF,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC;QACjE,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;QACpE,KAAK,CACH,GAAG,OAAO,CAAC,QAAQ,YAAY,WAAW,KAAK,QAAQ,cAAc,IAAI,UAAU,MAAM,YAAY,GAAG,SAAS,IAAI,SAAS,CAC/H,CAAC;QAEF,IAAI,OAAO,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC9D,KAAK,CACH,8CAA8C,OAAO,CAAC,aAAa,IAAI,IAAI,qGAAqG,CACjL,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,0EAA0E;IAC1E,2EAA2E;IAC3E,oEAAoE;IACpE,IAAI,OAAO,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,OAAO,OAAO,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC;AAC/D,CAAC;AAED,SAAS,eAAe,CACtB,MAAyB,EACzB,KAAc,EACd,MAAc,EACd,WAA+B;IAE/B,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;QACpD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4EAA4E,iBAAiB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAC/G,CAAC;QACF,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QACtD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC;IAC7E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC/C,YAAY,CAAC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAC/E,CAAC;IACF,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAEjD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,KAAK,CACH,GAAG,IAAI,CAAC,SAAS,CACf;YACE,IAAI,EAAE,0BAA0B;YAChC,WAAW,EAAE,YAAY;YACzB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,QAAQ;YAClC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;YACjF,OAAO;YACP,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC3C,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;gBAC/B,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB,CAAC,CAAC;YACH,OAAO;SACR,EACD,IAAI,EACJ,CAAC,CACF,IAAI,CACN,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,CAAC,YAAY,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,MAAM,OAAO,CAAC,CAAC;QAC/E,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBACnC,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,KAAK,CAAC,SAAS,MAAM,CAAC,KAAK,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACtE,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;gBACpD,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;gBACvC,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,KAAK,CAAC,SAAS,MAAM,CAAC,KAAK,kDAAkD,CAAC,CAAC;gBACjF,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;gBACrC,KAAK,CAAC,SAAS,MAAM,CAAC,KAAK,iDAAiD,CAAC,CAAC;gBAC9E,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;oBACtC,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC;gBAC9B,CAAC;gBACD,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC;YACrE,KAAK,CAAC,SAAS,MAAM,CAAC,KAAK,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,KAAK,CAAC,CAAC;YACpE,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7C,KAAK,CAAC,0BAA0B,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtE,CAAC;YACD,oBAAoB,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAChD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvD,KAAK,CACH,KAAK,OAAO,CAAC,MAAM,IAAI,IAAI,aAAa,OAAO,CAAC,UAAU,gBAAgB,OAAO,CAAC,UAAU,qBAAqB,OAAO,CAAC,aAAa,oBAAoB,OAAO,CAAC,WAAW,kBAAkB,KAAK,CAAC,QAAQ,CAAC,MAAM,eAAe,CACpO,CAAC;QACF,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,wBAAwB,OAAO,CAAC,QAAQ,oBAAoB,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,iEAAiE;IACjE,mCAAmC;IACnC,OAAO,OAAO,CAAC,UAAU,KAAK,CAAC,IAAI,OAAO,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,IAAuB;IACzC,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC;YACjB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;YACf,gBAAgB,EAAE,IAAI;YACtB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE;gBACP,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE;gBACrD,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;gBAC5C,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE;gBACtD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE;gBAC3C,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC3B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aACjC;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAgB,KAAe,CAAC,OAAO,MAAM,CAAC,CAAC;QACpE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IAEvC,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;QACpC,KAAK,CACH,cAAc,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC,mBAAmB,YAAY,mBAAmB,CAClG,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAE/B,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACxE,KAAK,CAAC,KAAK,CAAC,CAAC;QACb,OAAO,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9E,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC;IACpC,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IAE1E,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sCAAsC,MAAM,eAAe,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAChG,CAAC;QACF,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,SAAgC,CAAC;IACrC,IACE,OAAO,MAAM,CAAC,YAAY,CAAC,KAAK,QAAQ;QACxC,CAAC,OAAO,KAAK,kBAAkB,IAAI,OAAO,KAAK,cAAc,CAAC,EAC9D,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;QACrC,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yCAAyC,OAAO,MAAO,KAAe,CAAC,OAAO,IAAI,CACnF,CAAC;YACF,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,IAAI,CAAC;YACH,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,OAAO,KAAM,KAAe,CAAC,OAAO,IAAI,CAAC,CAAC;YAC5F,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,OAAO,KAAK,kBAAkB,EAAE,CAAC;QACnC,OAAO,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QAC/B,OAAO,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QAC/B,OAAO,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,OAAO,eAAe,CACpB,IAAI,EACJ,KAAK,EACL,MAAM,EACN,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAChE,CAAC;IACJ,CAAC;IAED,IAAI,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gBAAgB,OAAO,8EAA8E,YAAY,IAAI,CACtH,CAAC;QACF,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,OAAO,OAAO,CAAC,CAAC;IACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB;IACzB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,IAAI,kBAAkB,EAAE,EAAE,CAAC;IACzB,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC"}

package/dist/conformance/src/integrity/signature.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Signature verification.
+ *
+ * Verifies `integrity.signature.value` against the same canonicalized digest
+ * input used for `integrity.hash` (specification/integrity.md §4), using a
+ * public key supplied out of band. v0.1 defines no key registry or trust
+ * store: `integrity.signature.keyId` identifies a key for a human or an
+ * external system to resolve, and is never dereferenced by this verifier.
+ */
+import { type KeyObject } from "node:crypto";
+import { SUPPORTED_SIGNATURE_ALGORITHMS, type SupportedSignatureAlgorithm } from "./types.js";
+/** True when this verifier implements the declared signature algorithm. */
+export declare function isSupportedSignatureAlgorithm(algorithm: string): algorithm is SupportedSignatureAlgorithm;
+/**
+ * Parses a public key from PEM text (SPKI, the format Node's own
+ * `KeyObject.export({ type: "spki", format: "pem" })` produces).
+ *
+ * Node's `createPublicKey` also accepts a private key and derives its public
+ * half — pointing `--public-key` at a private key file by mistake therefore
+ * still verifies correctly rather than failing loudly, since the derived key
+ * is the genuine public counterpart. That is Node's behaviour to rely on, not
+ * a gap to work around: there is no reliable way to tell "this PEM was a
+ * public key" from "this PEM was a private key whose public half was just
+ * derived" after the fact, and the derived key is never wrong.
+ */
+export declare function loadPublicKey(pemText: string): KeyObject;
+export type SignatureCheckResult = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly kind: "unsupported-signature-algorithm" | "malformed-signature" | "signature-invalid";
+    readonly message: string;
+};
+/**
+ * Verifies `integrity.signature` against `event`, canonicalized the same way
+ * `integrity.hash` is: `/integrity/hash` and `/integrity/signature` excluded,
+ * everything else — including `sequence`, `previousHash` and `chainId` —
+ * included. A chain's links are therefore covered by the signature too, not
+ * only by the hash.
+ */
+export declare function verifyEventSignature(event: unknown, algorithm: string, value: string, publicKey: KeyObject): SignatureCheckResult;
+export { SUPPORTED_SIGNATURE_ALGORITHMS, type SupportedSignatureAlgorithm };

package/dist/conformance/src/integrity/signature.js

@@ -0,0 +1,109 @@
+/**
+ * Signature verification.
+ *
+ * Verifies `integrity.signature.value` against the same canonicalized digest
+ * input used for `integrity.hash` (specification/integrity.md §4), using a
+ * public key supplied out of band. v0.1 defines no key registry or trust
+ * store: `integrity.signature.keyId` identifies a key for a human or an
+ * external system to resolve, and is never dereferenced by this verifier.
+ */
+import { createPublicKey, verify as cryptoVerify } from "node:crypto";
+import { canonicalBytes } from "./canonicalize.js";
+import { buildDigestInput } from "./digest.js";
+import { SIGNATURE_BYTE_LENGTHS, SUPPORTED_SIGNATURE_ALGORITHMS, } from "./types.js";
+/**
+ * Signature value encoding this verifier accepts: standard base64, padded.
+ * The schema's `digest` type also permits hexadecimal and base64url, because
+ * `signature.value` is often echoed from whatever system produced it — but a
+ * value this verifier claims to check must be decoded unambiguously, so it
+ * narrows to the one encoding it expects rather than guessing among three.
+ */
+const BASE64_SIGNATURE = /^[A-Za-z0-9+/]+=*$/;
+/** True when this verifier implements the declared signature algorithm. */
+export function isSupportedSignatureAlgorithm(algorithm) {
+    return SUPPORTED_SIGNATURE_ALGORITHMS.includes(algorithm);
+}
+/**
+ * Parses a public key from PEM text (SPKI, the format Node's own
+ * `KeyObject.export({ type: "spki", format: "pem" })` produces).
+ *
+ * Node's `createPublicKey` also accepts a private key and derives its public
+ * half — pointing `--public-key` at a private key file by mistake therefore
+ * still verifies correctly rather than failing loudly, since the derived key
+ * is the genuine public counterpart. That is Node's behaviour to rely on, not
+ * a gap to work around: there is no reliable way to tell "this PEM was a
+ * public key" from "this PEM was a private key whose public half was just
+ * derived" after the fact, and the derived key is never wrong.
+ */
+export function loadPublicKey(pemText) {
+    try {
+        return createPublicKey(pemText);
+    }
+    catch (cause) {
+        throw new Error(`not a readable public key: ${cause.message}`, { cause });
+    }
+}
+/**
+ * Verifies `integrity.signature` against `event`, canonicalized the same way
+ * `integrity.hash` is: `/integrity/hash` and `/integrity/signature` excluded,
+ * everything else — including `sequence`, `previousHash` and `chainId` —
+ * included. A chain's links are therefore covered by the signature too, not
+ * only by the hash.
+ */
+export function verifyEventSignature(event, algorithm, value, publicKey) {
+    if (!isSupportedSignatureAlgorithm(algorithm)) {
+        return {
+            ok: false,
+            kind: "unsupported-signature-algorithm",
+            message: `signature algorithm "${algorithm}" is not implemented by this verifier`,
+        };
+    }
+    if (publicKey.asymmetricKeyType !== "ed25519") {
+        return {
+            ok: false,
+            kind: "signature-invalid",
+            message: `the supplied public key is ${publicKey.asymmetricKeyType ?? "of an unrecognised type"}, not ed25519`,
+        };
+    }
+    if (!BASE64_SIGNATURE.test(value)) {
+        return {
+            ok: false,
+            kind: "malformed-signature",
+            message: "declared signature value is not base64, the encoding this verifier expects",
+        };
+    }
+    const signatureBytes = Buffer.from(value, "base64");
+    const expectedLength = SIGNATURE_BYTE_LENGTHS[algorithm];
+    if (signatureBytes.length !== expectedLength) {
+        return {
+            ok: false,
+            kind: "malformed-signature",
+            message: `declared signature is ${signatureBytes.length} bytes, but ${algorithm} produces ${expectedLength}`,
+        };
+    }
+    const data = canonicalBytes(buildDigestInput(event));
+    let valid;
+    try {
+        // The algorithm argument must be null for Ed25519/Ed448: the digest
+        // algorithm is fixed by the signature scheme itself, not selectable per
+        // call, and Node rejects a non-null value here.
+        valid = cryptoVerify(null, data, publicKey, signatureBytes);
+    }
+    catch {
+        // A degenerate or non-canonical encoded point can make the underlying
+        // primitive fail rather than cleanly return false. The message is fixed,
+        // never the library's own, for the same reason loadPublicKey's caller
+        // does not forward its parse error: an MCP caller receives this Finding
+        // directly, and nothing an external decoder writes should reach them.
+        return {
+            ok: false,
+            kind: "signature-invalid",
+            message: "signature could not be verified: the supplied key or signature is malformed",
+        };
+    }
+    return valid
+        ? { ok: true }
+        : { ok: false, kind: "signature-invalid", message: "signature does not match" };
+}
+export { SUPPORTED_SIGNATURE_ALGORITHMS };
+//# sourceMappingURL=signature.js.map

package/dist/conformance/src/integrity/signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.js","sourceRoot":"","sources":["../../../../conformance/src/integrity/signature.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,YAAY,EAAkB,MAAM,aAAa,CAAC;AACtF,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAE/B,MAAM,YAAY,CAAC;AAEpB;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAE9C,2EAA2E;AAC3E,MAAM,UAAU,6BAA6B,CAC3C,SAAiB;IAEjB,OAAQ,8BAAoD,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,8BAA+B,KAAe,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAWD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAc,EACd,SAAiB,EACjB,KAAa,EACb,SAAoB;IAEpB,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,iCAAiC;YACvC,OAAO,EAAE,wBAAwB,SAAS,uCAAuC;SAClF,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,8BAA8B,SAAS,CAAC,iBAAiB,IAAI,yBAAyB,eAAe;SAC/G,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,4EAA4E;SACtF,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACpD,MAAM,cAAc,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,cAAc,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QAC7C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,yBAAyB,cAAc,CAAC,MAAM,eAAe,SAAS,aAAa,cAAc,EAAE;SAC7G,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,cAAc,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IAErD,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,oEAAoE;QACpE,wEAAwE;QACxE,gDAAgD;QAChD,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,yEAAyE;QACzE,sEAAsE;QACtE,wEAAwE;QACxE,sEAAsE;QACtE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,6EAA6E;SACvF,CAAC;IACJ,CAAC;IAED,OAAO,KAAK;QACV,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;QACd,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;AACpF,CAAC;AAED,OAAO,EAAE,8BAA8B,EAAoC,CAAC"}

package/dist/conformance/src/integrity/types.d.ts

@@ -22,6 +22,20 @@ export declare const SUPPORTED_HASH_ALGORITHMS: readonly ["SHA-256", "SHA-384",
 export type SupportedHashAlgorithm = (typeof SUPPORTED_HASH_ALGORITHMS)[number];
 /** Digest length in bytes for each supported algorithm. */
 export declare const DIGEST_BYTE_LENGTHS: Readonly<Record<SupportedHashAlgorithm, number>>;
+/**
+ * Signature algorithms this verifier can execute, as normative identifiers.
+ *
+ * `integrity.signature.algorithm` is an open vocabulary for the same reason
+ * `hashAlgorithm` is: schema acceptance is not verifier support. Ed25519 is
+ * the only algorithm implemented in v0.1 — it needs no key-size parameter, no
+ * hash-algorithm choice, and is natively supported by Node's `crypto` module,
+ * so it introduces no new dependency. ECDSA-P256-SHA256 and RSA-PSS-SHA256
+ * are recommended by the schema's own description but not yet implemented.
+ */
+export declare const SUPPORTED_SIGNATURE_ALGORITHMS: readonly ["Ed25519"];
+export type SupportedSignatureAlgorithm = (typeof SUPPORTED_SIGNATURE_ALGORITHMS)[number];
+/** Signature length in bytes for each supported algorithm. */
+export declare const SIGNATURE_BYTE_LENGTHS: Readonly<Record<SupportedSignatureAlgorithm, number>>;
 /**
  * JSON Pointers removed from an event before its digest is calculated.
  *
@@ -31,7 +45,7 @@ export declare const DIGEST_BYTE_LENGTHS: Readonly<Record<SupportedHashAlgorithm
  */
 export declare const DIGEST_EXCLUDED_POINTERS: readonly ["/integrity/hash", "/integrity/signature"];
 /** Why a single event failed verification. */
-export type EventFindingKind = "schema-invalid" | "integrity-missing" | "hash-missing" | "hash-algorithm-missing" | "canonicalization-missing" | "unsupported-canonicalization" | "unsupported-algorithm" | "malformed-hash" | "digest-length-mismatch" | "hash-mismatch" | "canonicalization-failed";
+export type EventFindingKind = "schema-invalid" | "integrity-missing" | "hash-missing" | "hash-algorithm-missing" | "canonicalization-missing" | "unsupported-canonicalization" | "unsupported-algorithm" | "malformed-hash" | "digest-length-mismatch" | "hash-mismatch" | "canonicalization-failed" | "unsupported-signature-algorithm" | "malformed-signature" | "signature-invalid";
 /** Why a chain failed verification. */
 export type ChainFindingKind = "chain-id-missing" | "sequence-missing" | "duplicate-sequence" | "previous-hash-missing" | "broken-link" | "algorithm-mismatch";
 export type FindingKind = EventFindingKind | ChainFindingKind;

package/dist/conformance/src/integrity/types.js

@@ -25,6 +25,21 @@ export const DIGEST_BYTE_LENGTHS = {
     "SHA-384": 48,
     "SHA-512": 64,
 };
+/**
+ * Signature algorithms this verifier can execute, as normative identifiers.
+ *
+ * `integrity.signature.algorithm` is an open vocabulary for the same reason
+ * `hashAlgorithm` is: schema acceptance is not verifier support. Ed25519 is
+ * the only algorithm implemented in v0.1 — it needs no key-size parameter, no
+ * hash-algorithm choice, and is natively supported by Node's `crypto` module,
+ * so it introduces no new dependency. ECDSA-P256-SHA256 and RSA-PSS-SHA256
+ * are recommended by the schema's own description but not yet implemented.
+ */
+export const SUPPORTED_SIGNATURE_ALGORITHMS = ["Ed25519"];
+/** Signature length in bytes for each supported algorithm. */
+export const SIGNATURE_BYTE_LENGTHS = {
+    Ed25519: 64,
+};
 /**
  * JSON Pointers removed from an event before its digest is calculated.
  *

package/dist/conformance/src/integrity/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../conformance/src/integrity/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,wBAAwB,GAAG,SAAS,CAAC;AAElD,0FAA0F;AAC1F,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,wBAAwB,CAAU,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAU,CAAC;AAIpF,2DAA2D;AAC3D,MAAM,CAAC,MAAM,mBAAmB,GAAqD;IACnF,SAAS,EAAE,EAAE;IACb,SAAS,EAAE,EAAE;IACb,SAAS,EAAE,EAAE;CACd,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,iBAAiB,EAAE,sBAAsB,CAAU,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../conformance/src/integrity/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,wBAAwB,GAAG,SAAS,CAAC;AAElD,0FAA0F;AAC1F,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,wBAAwB,CAAU,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAU,CAAC;AAIpF,2DAA2D;AAC3D,MAAM,CAAC,MAAM,mBAAmB,GAAqD;IACnF,SAAS,EAAE,EAAE;IACb,SAAS,EAAE,EAAE;IACb,SAAS,EAAE,EAAE;CACd,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,SAAS,CAAU,CAAC;AAInE,8DAA8D;AAC9D,MAAM,CAAC,MAAM,sBAAsB,GAA0D;IAC3F,OAAO,EAAE,EAAE;CACZ,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,iBAAiB,EAAE,sBAAsB,CAAU,CAAC"}

package/dist/conformance/src/integrity/verify-chain.d.ts

@@ -6,6 +6,7 @@
  * who removes the tail of a chain, or who never let an event be produced,
  * leaves nothing for a verifier to find. See specification/integrity.md §8.
  */
+import type { KeyObject } from "node:crypto";
 import type { EventValidator } from "../validate-core.js";
 import type { ChainReport } from "./types.js";
 /** One event offered for chain verification. */
@@ -20,4 +21,4 @@ export interface ChainEventInput {
  * verified as several independent chains, which is the intended model — a
  * single global chain is never required.
  */
-export declare function verifyChains(inputs: readonly ChainEventInput[], validator: EventValidator): ChainReport;
+export declare function verifyChains(inputs: readonly ChainEventInput[], validator: EventValidator, publicKey?: KeyObject | undefined): ChainReport;

package/dist/conformance/src/integrity/verify-chain.js

@@ -15,15 +15,19 @@ function compareMembers(left, right) {
     }
     return left.label.localeCompare(right.label, "en");
 }
-function verifyOneChain(chainId, members, validator) {
+function verifyOneChain(chainId, members, validator, publicKey) {
     const findings = [];
     const notes = [];
     const checks = [];
-    // Every event's own digest must hold before its links mean anything.
+    // Every event's own digest must hold before its links mean anything. A
+    // signature, when a key was supplied to check it, is verified alongside:
+    // it covers the same canonicalized input as the hash, chain metadata
+    // included, so a signed link is exactly as tamper-evident as a hashed one.
     let digestsValid = true;
     for (const member of members) {
         const result = verifyEventIntegrity(member.event, member.label, validator, {
             validateSchema: false,
+            publicKey,
         });
         if (!result.verified) {
             digestsValid = false;
@@ -165,7 +169,7 @@ function verifyOneChain(chainId, members, validator) {
  * verified as several independent chains, which is the intended model — a
  * single global chain is never required.
  */
-export function verifyChains(inputs, validator) {
+export function verifyChains(inputs, validator, publicKey) {
     const unassigned = [];
     const groups = new Map();
     for (const input of inputs) {
@@ -224,7 +228,7 @@ export function verifyChains(inputs, validator) {
     }
     const chains = [...groups.entries()]
         .sort((left, right) => left[0].localeCompare(right[0], "en"))
-        .map(([chainId, members]) => verifyOneChain(chainId, members, validator));
+        .map(([chainId, members]) => verifyOneChain(chainId, members, validator, publicKey));
     return {
         chains,
         unassigned,

package/dist/conformance/src/integrity/verify-chain.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify-chain.js","sourceRoot":"","sources":["../../../../conformance/src/integrity/verify-chain.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAmBxE,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAChG,CAAC;AAED,wFAAwF;AACxF,SAAS,cAAc,CAAC,IAAiB,EAAE,KAAkB;IAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,gBAAgB,CAAC;IAC9D,MAAM,aAAa,GAAG,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,gBAAgB,CAAC;IAChE,IAAI,YAAY,KAAK,aAAa,EAAE,CAAC;QACnC,OAAO,YAAY,GAAG,aAAa,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,cAAc,CACrB,OAAe,EACf,OAA+B,EAC/B,SAAyB;IAEzB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,qEAAqE;IACrE,IAAI,YAAY,GAAG,IAAI,CAAC;IACxB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE;YACzE,cAAc,EAAE,KAAK;SACtB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,YAAY,GAAG,KAAK,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,IAAI,YAAY,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,OAAO,CAAC,MAAM,sBAAsB,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,wBAAwB;IACxB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,IAAI,QAAQ,CAAC,CAAC,CAAC;IACtF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,gBAAgB,IAAI,QAAQ,CAAC,CAAC,CAAC;IAChG,IAAI,UAAU,CAAC,IAAI,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACtD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,2EAA2E;YACpF,MAAM,EAAE;gBACN,oBAAoB,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACvD,sBAAsB,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACjE;SACF,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IAClF,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACrC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,sEAAsE;SAChF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAElD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAC;IACpD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,YAAY,QAAQ,mBAAmB,MAAM,CAAC,MAAM,SAAS;gBACtE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,6EAA6E;IAC7E,sEAAsE;IACtE,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IAC3E,IAAI,UAAU,GAAG,IAAI,CAAC;IAEtB,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAChB,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACtC,KAAK,CAAC,IAAI,CAAC;oBACT,OAAO,EAAE,yCAAyC;oBAClD,MAAM,EAAE;wBACN,wBAAwB,MAAM,CAAC,KAAK,wBAAwB;wBAC5D,uEAAuE;qBACxE;iBACF,CAAC,CAAC;YACL,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACxC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACtC,UAAU,GAAG,KAAK,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,uBAAuB;gBAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,wEAAwE;aAClF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3F,UAAU,GAAG,KAAK,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa;gBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,iDAAiD;gBAC1D,MAAM,EAAE;oBACN,0BAA0B,WAAW,CAAC,KAAK,EAAE;oBAC7C,0BAA0B,MAAM,CAAC,YAAY,EAAE;oBAC/C,0BAA0B,WAAW,CAAC,IAAI,IAAI,iBAAiB,EAAE;iBAClE;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,UAAU,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,4BAA4B,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;QACnE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CACtF,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAChB,CAAC;IACF,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,GAAG,KAAK,GAAG,CAAC,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;QACvF,KAAK,CAAC,IAAI,CAAC;YACT,OAAO,EAAE,qCAAqC;YAC9C,MAAM,EAAE;gBACN,aAAa,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACnC,sEAAsE;aACvE;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,OAAO;QACP,UAAU,EAAE,OAAO,CAAC,MAAM;QAC1B,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACrD,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC7B,MAAM;QACN,QAAQ;QACR,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAkC,EAClC,SAAyB;IAEzB,MAAM,UAAU,GAAc,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEhD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACnF,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,gBAAgB;gBACtB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,gDAAgD;gBACzD,MAAM,EACJ,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;oBAC1B,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,OAAO,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,wBAAwB,CAAC;oBACzE,CAAC,CAAC,KAAK;aACZ,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,mBAAmB;gBACzB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,gEAAgE;aAC1E,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,kBAAkB;gBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,0EAA0E;aACpF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,CAAE,KAAK,CAAC,KAAiC,CAAC,UAAU,CAAC,CAAC,CAAC;QAClF,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACtD,MAAM,aAAa,GAAG,QAAQ,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACxD,MAAM,gBAAgB,GAAG,QAAQ,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAE9D,MAAM,MAAM,GAAgB;YAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACvC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;YACvD,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;YACzD,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC;SAChE,CAAC;QAEF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SACjC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;SAC5D,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IAE5E,OAAO;QACL,MAAM;QACN,UAAU;QACV,UAAU,EAAE,MAAM,CAAC,MAAM;QACzB,MAAM,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;KACzE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"verify-chain.js","sourceRoot":"","sources":["../../../../conformance/src/integrity/verify-chain.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAmBxE,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAChG,CAAC;AAED,wFAAwF;AACxF,SAAS,cAAc,CAAC,IAAiB,EAAE,KAAkB;IAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,gBAAgB,CAAC;IAC9D,MAAM,aAAa,GAAG,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,gBAAgB,CAAC;IAChE,IAAI,YAAY,KAAK,aAAa,EAAE,CAAC;QACnC,OAAO,YAAY,GAAG,aAAa,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,cAAc,CACrB,OAAe,EACf,OAA+B,EAC/B,SAAyB,EACzB,SAAgC;IAEhC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,uEAAuE;IACvE,yEAAyE;IACzE,qEAAqE;IACrE,2EAA2E;IAC3E,IAAI,YAAY,GAAG,IAAI,CAAC;IACxB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE;YACzE,cAAc,EAAE,KAAK;YACrB,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,YAAY,GAAG,KAAK,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,IAAI,YAAY,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,OAAO,CAAC,MAAM,sBAAsB,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,wBAAwB;IACxB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,IAAI,QAAQ,CAAC,CAAC,CAAC;IACtF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,gBAAgB,IAAI,QAAQ,CAAC,CAAC,CAAC;IAChG,IAAI,UAAU,CAAC,IAAI,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACtD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,2EAA2E;YACpF,MAAM,EAAE;gBACN,oBAAoB,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACvD,sBAAsB,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACjE;SACF,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IAClF,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACrC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,sEAAsE;SAChF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAElD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAC;IACpD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,YAAY,QAAQ,mBAAmB,MAAM,CAAC,MAAM,SAAS;gBACtE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,6EAA6E;IAC7E,sEAAsE;IACtE,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IAC3E,IAAI,UAAU,GAAG,IAAI,CAAC;IAEtB,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAChB,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACtC,KAAK,CAAC,IAAI,CAAC;oBACT,OAAO,EAAE,yCAAyC;oBAClD,MAAM,EAAE;wBACN,wBAAwB,MAAM,CAAC,KAAK,wBAAwB;wBAC5D,uEAAuE;qBACxE;iBACF,CAAC,CAAC;YACL,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACxC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACtC,UAAU,GAAG,KAAK,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,uBAAuB;gBAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,wEAAwE;aAClF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3F,UAAU,GAAG,KAAK,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa;gBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,iDAAiD;gBAC1D,MAAM,EAAE;oBACN,0BAA0B,WAAW,CAAC,KAAK,EAAE;oBAC7C,0BAA0B,MAAM,CAAC,YAAY,EAAE;oBAC/C,0BAA0B,WAAW,CAAC,IAAI,IAAI,iBAAiB,EAAE;iBAClE;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,UAAU,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,4BAA4B,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;QACnE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CACtF,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAChB,CAAC;IACF,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,GAAG,KAAK,GAAG,CAAC,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;QACvF,KAAK,CAAC,IAAI,CAAC;YACT,OAAO,EAAE,qCAAqC;YAC9C,MAAM,EAAE;gBACN,aAAa,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACnC,sEAAsE;aACvE;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,OAAO;QACP,UAAU,EAAE,OAAO,CAAC,MAAM;QAC1B,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACrD,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC7B,MAAM;QACN,QAAQ;QACR,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAkC,EAClC,SAAyB,EACzB,SAAiC;IAEjC,MAAM,UAAU,GAAc,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEhD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACnF,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,gBAAgB;gBACtB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,gDAAgD;gBACzD,MAAM,EACJ,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;oBAC1B,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,OAAO,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,wBAAwB,CAAC;oBACzE,CAAC,CAAC,KAAK;aACZ,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,mBAAmB;gBACzB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,gEAAgE;aAC1E,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,kBAAkB;gBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,0EAA0E;aACpF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,CAAE,KAAK,CAAC,KAAiC,CAAC,UAAU,CAAC,CAAC,CAAC;QAClF,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACtD,MAAM,aAAa,GAAG,QAAQ,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACxD,MAAM,gBAAgB,GAAG,QAAQ,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAE9D,MAAM,MAAM,GAAgB;YAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACvC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;YACvD,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;YACzD,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC;SAChE,CAAC;QAEF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SACjC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;SAC5D,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IAEvF,OAAO;QACL,MAAM;QACN,UAAU;QACV,UAAU,EAAE,MAAM,CAAC,MAAM;QACzB,MAAM,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;KACzE,CAAC;AACJ,CAAC"}

package/dist/conformance/src/integrity/verify-event.d.ts

@@ -5,11 +5,19 @@
  * calculated. It proves nothing about whether the event was ever stored, is
  * still stored, or belongs to a complete chain.
  */
+import type { KeyObject } from "node:crypto";
 import type { EventValidator } from "../validate-core.js";
 import { type EventVerificationResult } from "./types.js";
 export interface VerifyEventOptions {
     /** Validate against the canonical schema first. Defaults to true. */
     readonly validateSchema?: boolean;
+    /**
+     * Key to verify `integrity.signature` against, when present. Without it, a
+     * declared signature is neither checked nor reported on: v0.1 defines no
+     * key registry, so there is no key to try by default, and a signature this
+     * verifier was not asked to check is not evidence of anything.
+     */
+    readonly publicKey?: KeyObject | undefined;
 }
 /** The integrity object of an event, once it is known to be an object. */
 interface IntegrityObject {
@@ -18,6 +26,7 @@ interface IntegrityObject {
     readonly hash?: unknown;
     readonly previousHash?: unknown;
     readonly chainId?: unknown;
+    readonly signature?: unknown;
 }
 /** Reads the integrity object of an event, or `undefined` when there is none. */
 export declare function readIntegrity(event: unknown): IntegrityObject | undefined;

package/dist/conformance/src/integrity/verify-event.js

@@ -1,6 +1,23 @@
 import { CanonicalizationError, isSupportedCanonicalization } from "./canonicalize.js";
 import { calculateDigest, digestByteLength, digestsEqual, isHexDigest, isSupportedHashAlgorithm, } from "./digest.js";
+import { verifyEventSignature } from "./signature.js";
 import { SUPPORTED_CANONICALIZATIONS, SUPPORTED_HASH_ALGORITHMS, } from "./types.js";
+/** `integrity.signature`, once it is known to be an object. Schema validation
+ * (when not bypassed) already guarantees `algorithm` and `value` are strings;
+ * this is read defensively regardless, because chain verification bypasses
+ * schema validation on the assumption it already ran once for the same event. */
+function readSignature(signature) {
+    if (signature === null || typeof signature !== "object" || Array.isArray(signature)) {
+        return undefined;
+    }
+    const record = signature;
+    const algorithm = record["algorithm"];
+    const value = record["value"];
+    if (typeof algorithm !== "string" || typeof value !== "string") {
+        return undefined;
+    }
+    return { algorithm, value };
+}
 function failure(label, finding, checks = []) {
     return { label, verified: false, checks, findings: [{ ...finding, label }] };
 }
@@ -126,6 +143,24 @@ export function verifyEventIntegrity(event, label, validator, options = {}) {
         };
     }
     checks.push({ message: "integrity hash valid" });
+    const signatureResult = checkSignature(event, integrity.signature, options.publicKey);
+    if (signatureResult !== undefined) {
+        if (signatureResult.ok) {
+            checks.push({ message: signatureResult.message });
+        }
+        else {
+            return {
+                label,
+                verified: false,
+                checks,
+                findings: [{ kind: signatureResult.kind, label, message: signatureResult.message }],
+                canonicalization,
+                hashAlgorithm,
+                declaredHash: hash,
+                calculatedHash: calculated,
+            };
+        }
+    }
     return {
         label,
         verified: true,
@@ -137,4 +172,21 @@ export function verifyEventIntegrity(event, label, validator, options = {}) {
         calculatedHash: calculated,
     };
 }
+/**
+ * Checks `integrity.signature` when both a signature is declared and a public
+ * key was supplied to verify it against. Returns `undefined` when there is
+ * nothing to check — no signature, or no key to check it with — which the
+ * caller treats as "does not change the verdict", not as a pass.
+ */
+function checkSignature(event, signature, publicKey) {
+    const declared = readSignature(signature);
+    if (declared === undefined || publicKey === undefined) {
+        return undefined;
+    }
+    const result = verifyEventSignature(event, declared.algorithm, declared.value, publicKey);
+    if (result.ok) {
+        return { ok: true, message: `signature valid (${declared.algorithm})` };
+    }
+    return { ok: false, kind: result.kind, message: result.message };
+}
 //# sourceMappingURL=verify-event.js.map

package/dist/conformance/src/integrity/verify-event.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify-event.js","sourceRoot":"","sources":["../../../../conformance/src/integrity/verify-event.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,GAI1B,MAAM,YAAY,CAAC;AAgBpB,SAAS,OAAO,CACd,KAAa,EACb,OAAgB,EAChB,SAAiC,EAAE;IAEnC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAI,KAAiC,CAAC,WAAW,CAAC,CAAC;IAClE,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAA4B,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAc,EACd,KAAa,EACb,SAAyB,EACzB,UAA8B,EAAE;IAEhC,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACnF,MAAM,MAAM,GACV,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;gBAC1B,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,OAAO,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,wBAAwB,CAAC;gBACzE,CAAC,CAAC,KAAK,CAAC;YACZ,OAAO,OAAO,CAAC,KAAK,EAAE;gBACpB,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,gDAAgD;gBACzD,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,kEAAkE;YAC3E,MAAM,EAAE,CAAC,mEAAmE,CAAC;SAC9E,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC;IAE5D,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,mCAAmC;SAC7C,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QACzC,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,0DAA0D;SACpE,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACnD,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,qBAAqB,gBAAgB,uCAAuC;YACrF,MAAM,EAAE,CAAC,gBAAgB,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SACnE,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,qBAAqB,gBAAgB,EAAE,EAAE,CAAC,CAAC;IAElE,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,wDAAwD;SAClE,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7C,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,mBAAmB,aAAa,uCAAuC;YAChF,MAAM,EAAE;gBACN,gBAAgB,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACtD,gFAAgF;aACjF;SACF,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,mBAAmB,aAAa,EAAE,EAAE,CAAC,CAAC;IAE7D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,4CAA4C;YACrD,MAAM,EAAE,CAAC,iFAAiF,CAAC;SAC5F,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,gBAAgB,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACnC,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,oBAAoB,IAAI,CAAC,MAAM,oBAAoB,aAAa,aAAa,cAAc,EAAE;SACvG,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,eAAe,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GACX,KAAK,YAAY,qBAAqB;YACpC,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,mCAAoC,KAAe,CAAC,OAAO,EAAE,CAAC;QACpE,OAAO,OAAO,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,KAAK;YACL,QAAQ,EAAE,KAAK;YACf,MAAM;YACN,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,eAAe;oBACrB,KAAK;oBACL,OAAO,EAAE,yBAAyB;oBAClC,MAAM,EAAE,CAAC,eAAe,IAAI,EAAE,EAAE,eAAe,UAAU,EAAE,CAAC;iBAC7D;aACF;YACD,gBAAgB;YAChB,aAAa;YACb,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,UAAU;SAC3B,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;IAEjD,OAAO;QACL,KAAK;QACL,QAAQ,EAAE,IAAI;QACd,MAAM;QACN,QAAQ,EAAE,EAAE;QACZ,gBAAgB;QAChB,aAAa;QACb,YAAY,EAAE,IAAI;QAClB,cAAc,EAAE,UAAU;KAC3B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"verify-event.js","sourceRoot":"","sources":["../../../../conformance/src/integrity/verify-event.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,GAI1B,MAAM,YAAY,CAAC;AAwBpB;;;iFAGiF;AACjF,SAAS,aAAa,CAAC,SAAkB;IACvC,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,SAAoC,CAAC;IACpD,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,OAAO,CACd,KAAa,EACb,OAAgB,EAChB,SAAiC,EAAE;IAEnC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAI,KAAiC,CAAC,WAAW,CAAC,CAAC;IAClE,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAA4B,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAc,EACd,KAAa,EACb,SAAyB,EACzB,UAA8B,EAAE;IAEhC,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACnF,MAAM,MAAM,GACV,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;gBAC1B,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,OAAO,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,wBAAwB,CAAC;gBACzE,CAAC,CAAC,KAAK,CAAC;YACZ,OAAO,OAAO,CAAC,KAAK,EAAE;gBACpB,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,gDAAgD;gBACzD,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,kEAAkE;YAC3E,MAAM,EAAE,CAAC,mEAAmE,CAAC;SAC9E,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC;IAE5D,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,mCAAmC;SAC7C,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QACzC,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,0DAA0D;SACpE,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACnD,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,qBAAqB,gBAAgB,uCAAuC;YACrF,MAAM,EAAE,CAAC,gBAAgB,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SACnE,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,qBAAqB,gBAAgB,EAAE,EAAE,CAAC,CAAC;IAElE,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,wDAAwD;SAClE,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7C,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,mBAAmB,aAAa,uCAAuC;YAChF,MAAM,EAAE;gBACN,gBAAgB,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACtD,gFAAgF;aACjF;SACF,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,mBAAmB,aAAa,EAAE,EAAE,CAAC,CAAC;IAE7D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,4CAA4C;YACrD,MAAM,EAAE,CAAC,iFAAiF,CAAC;SAC5F,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,gBAAgB,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACnC,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,oBAAoB,IAAI,CAAC,MAAM,oBAAoB,aAAa,aAAa,cAAc,EAAE;SACvG,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,eAAe,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GACX,KAAK,YAAY,qBAAqB;YACpC,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,mCAAoC,KAAe,CAAC,OAAO,EAAE,CAAC;QACpE,OAAO,OAAO,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,KAAK;YACL,QAAQ,EAAE,KAAK;YACf,MAAM;YACN,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,eAAe;oBACrB,KAAK;oBACL,OAAO,EAAE,yBAAyB;oBAClC,MAAM,EAAE,CAAC,eAAe,IAAI,EAAE,EAAE,eAAe,UAAU,EAAE,CAAC;iBAC7D;aACF;YACD,gBAAgB;YAChB,aAAa;YACb,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,UAAU;SAC3B,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;IAEjD,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACtF,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,eAAe,CAAC,EAAE,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,KAAK;gBACf,MAAM;gBACN,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,EAAE,CAAC;gBACnF,gBAAgB;gBAChB,aAAa;gBACb,YAAY,EAAE,IAAI;gBAClB,cAAc,EAAE,UAAU;aAC3B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK;QACL,QAAQ,EAAE,IAAI;QACd,MAAM;QACN,QAAQ,EAAE,EAAE;QACZ,gBAAgB;QAChB,aAAa;QACb,YAAY,EAAE,IAAI;QAClB,cAAc,EAAE,UAAU;KAC3B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CACrB,KAAc,EACd,SAAkB,EAClB,SAAgC;IAKhC,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QACtD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,oBAAoB,QAAQ,CAAC,SAAS,GAAG,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;AACnE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openauditmodel/cli",
-  "version": "0.1.1",
+  "version": "0.2.1",
   "description": "Conformance toolchain for OpenAuditModel: validate audit events against the canonical JSON Schema, verify tamper-evidence, lint for leaked secrets and check domain profiles. Offline and deterministic.",
   "keywords": [
     "audit",

package/specification/integrity.md

@@ -31,7 +31,8 @@ without it is fully conforming. When the object is present it MUST contain at le
 | `signature`        | Digital signature over the canonicalized event.                                |
 
 `signature` is an object requiring `algorithm` and `value`, and optionally `keyId`. `keyId` MUST NOT
-contain key material. Signature verification is **not** part of v0.1; see §9.
+contain key material. v0.1 tooling verifies Ed25519 signatures when a public key is supplied out of
+band; signing and key management are not part of v0.1. See §6.1 and §9.
 
 ### 2.1 What `batchId` is not
 
@@ -158,6 +159,32 @@ present it as one.
 
 A verifier MUST reject a declared hash whose length disagrees with the declared algorithm.
 
+### 6.1 Signature algorithms
+
+`integrity.signature.algorithm` is likewise an open vocabulary, matched case-sensitively.
+
+Conforming v0.1 tooling MUST implement:
+
+```text
+Ed25519
+```
+
+`ECDSA-P256-SHA256` and `RSA-PSS-SHA256` are recommended identifiers a producer MAY use; a verifier
+that does not implement them MUST report the signature as unverifiable rather than as verified, for
+the same reason an unimplemented hash algorithm is reported and not silently accepted.
+
+A signature is calculated and verified over the same digest input as `hash` — the canonicalized event
+with `/integrity/hash` and `/integrity/signature` removed (§4) — so it covers `sequence`,
+`previousHash` and `chainId` exactly as the hash does; a signed chain is exactly as tamper-evident as a
+hashed one. `integrity.signature.value` MUST be base64-encoded for a v0.1 verifier to check it. The
+schema's `digest` type also permits hexadecimal and base64url, because the field is often echoed
+verbatim from whatever system produced it, but a v0.1 verifier implements one encoding, not three, and
+reports a value in another encoding as unverifiable.
+
+`integrity.signature.keyId` is never dereferenced. v0.1 defines no key registry, trust store or
+certificate parsing: a verifying party obtains the public key out of band, by whatever means it
+already trusts, and supplies it directly.
+
 ## 7. Chains
 
 `previousHash` links an event to its predecessor, so that removing or altering a member of the
@@ -256,12 +283,25 @@ canonicalization and algorithm are implemented, recalculates the digest and comp
 link. It detects broken links, modified events, reordering, duplicate sequences, missing sequences,
 mixed algorithms and unsupported algorithms.
 
+Both commands accept `--public-key <path>`, a PEM-encoded Ed25519 public key. When it is supplied and
+an event declares `integrity.signature`, the signature is verified against the same digest input as
+the hash; without it, a declared signature is neither checked nor reported on, which keeps every
+example above byte-for-byte the same whether or not an event happens to carry one:
+
+```bash
+auditmodel verify-integrity examples/integrity/valid/signed-event-ed25519.json \
+  --public-key examples/integrity/keys/ed25519-test-public.pem
+```
+
 Exit codes are `0` verified, `1` a verification failed, `2` a usage, read or parse error.
 
+**Implemented in v0.1:** Ed25519 signature verification, given a public key supplied out of band —
+there is no key registry to resolve `keyId` against.
+
 **Not implemented in v0.1**, and not to be inferred from the presence of the fields that would support
-them: signing, signature verification, key generation, key storage, key management integrations,
-certificate parsing, trust stores, transparency logs, timestamp authorities, WORM storage and remote
-verification services.
+them: signing, ECDSA-P256-SHA256 and RSA-PSS-SHA256 signature verification, key generation, key
+storage, key management integrations, certificate parsing, trust stores, transparency logs, timestamp
+authorities, WORM storage and remote verification services.
 
 ## 10. Practical guidance
 
@@ -295,7 +335,12 @@ An event in an instance-level chain:
 }
 ```
 
-A signed event with no chain. The signature is recorded but is not verified by v0.1 tooling:
+A signed event with no hash and no chain. This one is illustrative only, not verifiable: v0.1's
+`verify-integrity` requires a hash before it checks anything at all, so a signature with no
+accompanying `hash` is reported `hash-missing` even though the tooling implements Ed25519 signature
+verification. A signature MUST currently accompany a hash to be checked; see
+[examples/integrity/valid/signed-event-ed25519.json](../examples/integrity/valid/signed-event-ed25519.json)
+for the combination `verify-integrity --public-key` actually verifies.
 
 ```json
 {