@proof-holdings/delegation-verifier 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 proof.holdings
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,273 @@
+# @proof-holdings/delegation-verifier
+
+Verify a **Proof of Delegation**: a signed statement that the controller of a domain authorized
+a specific agent artifact — an npm package, a container, an endpoint — for a set of capability
+scopes.
+
+You do not need an account with anyone to use this. It runs against public surfaces only, and
+it has **no built-in trust list**: you name the issuers you accept.
+
+```bash
+npm install @proof-holdings/delegation-verifier
+```
+
+Zero runtime dependencies. Node ≥ 18 (or any runtime with WebCrypto, `fetch` and
+`DecompressionStream` — Deno, Bun, Cloudflare Workers).
+
+## What a valid result means — and what it does not
+
+A verified delegation says exactly one thing:
+
+> The controller of `principal` authorized `delegate` for these scopes, and the issuer checked
+> that control when it signed.
+
+It is **not** a statement that the artifact is safe, audited, maintained, or endorsed, and it is
+not a review of the business behind the domain. Do not render it as a generic "verified" badge.
+
+## Usage
+
+```ts
+import { verifyPublishedDelegation } from '@proof-holdings/delegation-verifier';
+
+const result = await verifyPublishedDelegation(serverCard, {
+  // No defaults: you decide whose signature means anything to you.
+  trustedIssuers: [
+    {
+      issuer: 'proof.holdings',
+      jwksUri: 'https://api.proof.holdings/.well-known/jwks.json',
+      statusEndpoint: 'https://api.proof.holdings/api/v1/proofs/validate',
+    },
+  ],
+  // The artifact YOU resolved — the package you are installing, the endpoint you are calling.
+  delegate: { type: 'purl', value: 'pkg:npm/postmark-mcp' },
+  expectedPrincipal: 'postmarkapp.com',
+  requiredScopes: ['send-email'],
+});
+
+if (result.valid) {
+  // `result.principalChecked` / `result.statusChecked` say how much was actually asked.
+  console.log(`${result.delegation.principal} authorized ${result.delegation.delegate}`);
+} else {
+  console.warn(`not verified: ${result.reason} — ${result.message}`);
+}
+```
+
+`verifyDelegation(token, options)` is the same check when you already hold the token instead of
+a card.
+
+### `delegate` is required, and this is the point
+
+A published delegation token is a **bearer artifact**. Anyone can copy a genuine token out of
+one card and paste it into another. The check that defeats that is comparing the token's
+`delegate` claim against the artifact identity **you resolved independently** — the package
+name you are about to `npm install`, the URL you are about to call. Never pass a value you read
+out of the card being verified: a card describing itself is not evidence about itself.
+
+That is why `delegate` is a required argument rather than an optional one, and why omitting it
+is reported as `invalid_options` instead of quietly skipping the comparison.
+
+### `expectedPrincipal` closes the OTHER half
+
+An issuer binds `delegate` to nothing. The domain in `principal` is whatever the requester
+proved control of; the artifact is a value they chose. So anyone who can verify `evil.example`
+can mint a genuine, signature-valid, non-revoked delegation naming **someone else's** package.
+
+`delegate` stops a token being *copied*; only pinning `principal` stops one being *minted by
+the wrong party*. Pass `expectedPrincipal` whenever you know whose artifact you think this is —
+which is nearly always, since you know what you are installing.
+
+A result without it is still returned, because a directory or a lookup UI legitimately asks
+"who claims this artifact?" — but it carries `principalChecked: false`, and it must be
+presented as *"X says it authorized this"*, never as *verified*.
+
+## The chain
+
+1. **Trust policy** — the token's `iss` must be one you named. No trust list, no verification.
+2. **Signature** — RS256/ES256 against the issuer's JWKS. The algorithm is chosen by the
+   verifier, never read from the token, so `alg: none` and HMAC forgeries die before any key is
+   fetched. Key sets are cached; an unknown `kid` triggers at most one refetch per 30s.
+3. **Claims** — `token_type`, schema version, `exp`/`iat` (5s tolerance by default), and the
+   required claim set.
+4. **Principal** — pinned to the domain you expect, when you supply one. See above: without it
+   the answer says who *claims* the artifact, not that the right party did.
+5. **Delegate** — canonicalized and compared byte-for-byte with the identity you resolved.
+6. **Status** — two channels, both authenticated:
+   - the IETF Token Status List the token points at (`status.status_list`), whose uri is
+     refused unless it belongs to your trusted issuer, and whose signature is checked against
+     the same key set;
+   - the issuer's status endpoint, which is the only thing that can report the **cascade**: a
+     delegation is worth no more than the domain control proof beneath it, and a revoked domain
+     proof does not flip the delegation's own status-list bit.
+
+   Status checking is **fail-closed**: if either channel cannot answer, the result is
+   `status_unavailable`, not "valid". Pass `statusCheck: 'skip'` to check signature and claims
+   only — the result then carries `statusChecked: false`, which means *revocation was not
+   checked*, never *not revoked*.
+
+### What happens when the domain proof underneath is renewed for a shorter period
+
+A delegation's own `exp` can never exceed its control (domain) proof's remaining lifetime at
+issuance — the issuer rejects a longer request rather than truncating it. proof.holdings applies
+the same rule on the OTHER side, at every later renewal of the domain proof itself: the renewal
+call still succeeds, but if the requested duration would shorten the domain proof's expiry below
+an already-issued delegation's own `exp`, the requested value is not honoured — the domain proof
+is kept at (at least) the longest-lived delegation's expiry instead, with no error returned. A
+delegate's token therefore never silently outlives the domain proof it depends on — you do not
+need to re-check more often just because the domain owner renewed their proof for a shorter term
+than before.
+
+### Issuer status endpoint contract
+
+`POST <statusEndpoint>` with `{"proof_token": "<jwt>"}` answering JSON with at least
+`{"valid": boolean}` and optionally `{"reason": "revoked" | "suspended" | ...}`.
+
+## Failure reasons
+
+Every failure carries an `outcome: 'invalid' | 'unconfirmed'` beside `reason` —
+`classifyFailureReason(reason)` if you need it standalone. `unconfirmed` means the revocation
+check itself could not run; treat it as "not checked", never as "checked and fine". Everything
+else is `invalid`: a completed check with a negative verdict, including a call-shape error (those
+are unreachable once your own call is well-formed, and are classified for completeness, not
+because they occur in practice).
+
+| `reason` | `outcome` | Meaning |
+| --- | --- | --- |
+| `invalid_options` | `invalid` | The call is wrong — usually a missing or uncanonicalizable `delegate`. |
+| `no_trust_policy` | `invalid` | `trustedIssuers` was empty. There is no default. |
+| `malformed_token` | `invalid` | Not a decodable JWT. |
+| `untrusted_issuer` | `invalid` | Signed by someone you did not name. |
+| `unsupported_algorithm` | `invalid` | The token asked for an algorithm this verifier does not accept. |
+| `unknown_key` / `bad_signature` | `invalid` | No matching key, or the signature does not hold. |
+| `jwks_unavailable` | `unconfirmed` | Could not read the key set — "I could not check", not "it is bad". |
+| `not_a_delegation` / `unsupported_schema` | `invalid` | Wrong token type or a schema major this version does not understand. |
+| `expired` / `not_yet_valid` / `malformed_claims` | `invalid` | Claim-level rejections. |
+| `principal_mismatch` | `invalid` | Issued by a different domain than you expected. |
+| `delegate_mismatch` | `invalid` | **Attests a different artifact than the one you resolved.** |
+| `scope_not_granted` | `invalid` | Does not grant a scope you required. |
+| `status_uri_untrusted` | `unconfirmed` | The status-list uri in the token is not the issuer's. Not fetched. |
+| `status_unavailable` | `unconfirmed` | Revocation could not be checked. Fail closed. |
+| `revoked` / `suspended` | `invalid` | Withdrawn, or reversibly paused. |
+| `unknown_delegation` | `invalid` | The issuer has no record of it — distinct from "could not answer". |
+| `no_publication` / `multiple_publications` | `invalid` | The card carries no delegation, or several different ones. |
+
+### Why the status endpoint is not always called, and what that leaves uncovered
+
+A `valid`/`revoked`/`suspended` read from the token's status list ends the revocation check right
+there — no request to the issuer's status endpoint. That is safe **for any issuer that adopts a
+status list at all**: the IETF draft's premise is that the list is the issuer's authoritative
+revocation channel, so an issuer publishing one is committing to encode everything relevant to
+that token's validity in it. An issuer that keeps a side-channel revocation reason out of its own
+published list is not honoring the channel it chose to publish — a fact about that issuer, not
+something a generic verifier can special-case.
+
+The endpoint still fires for the cases the bit structurally cannot answer: a token with no
+status-list claim at all, `unknown_delegation` ("no record of this handle" is distinguishable
+from "a record that is dead" only by a live call), and — for issuers whose validity cascades
+through something else, like a domain control proof underneath a delegation — an EXPIRY driven by
+that something else, which a status-list bit never encodes (only revoked/suspended are, by the
+same draft's own vocabulary). For proof.holdings specifically, that cascade-expiry gap is bounded,
+not eliminated: a delegation can no longer be minted longer than its underlying control proof, and
+a control cannot be re-issued shorter than an outstanding delegation without capping the
+reissue to cover it — but a control shortened before that guarantee existed, or a reissue that hit
+its own rare fail-open path, can still leave a delegation whose list bit and own `exp` claim both
+read fine while its issuer would answer `expired`. This is a known, accepted trade-off — not
+silently assumed away.
+
+### One thing a failure reason is not
+
+Claims are checked before the signature (cheap rejections first, and no `valid: true` is
+reachable without a verified signature). A consequence: on a *forged* token the `reason` is
+attacker-chosen — anyone can produce `delegate_mismatch` or `principal_mismatch` with an
+unsigned JWT. Read a failure as "this did not verify", never as attested evidence about who
+tried.
+
+### A reason reports the FIRST failure, not the only one
+
+The checks are ordered, and the first one to fail returns. `expired` in particular is decided
+*before* `expectedPrincipal` and `delegate` are compared, so an expired token yields `expired`
+whatever the pins are — an expired delegation genuinely issued for your artifact and an expired
+token copied into a stranger's card are indistinguishable in the reason alone. The same holds
+upward: `untrusted_issuer` supersedes everything after it.
+
+So a failure reason tells you where the walk stopped, not what the remaining checks would have
+said: they never ran. Do not build policy on the assumption that a reason implies the later
+checks were evaluated — only `valid: true` means every check passed.
+
+## Where delegations are published
+
+Three sanctioned carriers live INSIDE a card and are all read by `verifyPublishedDelegation`:
+
+- MCP server card — `_meta["holdings.proof/delegation"]`
+- MCP official registry — the same key nested under
+  `_meta["io.modelcontextprotocol.registry/publisher-provided"]`
+- A2A agent card — an entry in `capabilities.extensions[]` with
+  `uri: "https://proof.holdings/delegation"`
+
+Each carries `{ "token": "<jwt>", "docs"?: "<url>" }`.
+
+### The fourth carrier: a DNS pointer
+
+`_mcp.<domain>` may hold a TXT record naming the card that carries the delegation:
+
+```
+_mcp.example.com.  IN TXT  "v=proofdlg1; card=https://example.com/.well-known/mcp/server.json"
+```
+
+It holds **no token** — DNS is a channel with no confidentiality and cached copies at resolvers
+nobody controls. It exists so a reader can start from a DOMAIN rather than from an artifact, which
+is the only route open to an owner who cannot publish a file on their own host: the card it names
+may live anywhere.
+
+Resolving it means a DNS query and an HTTP fetch, and this package has no dependencies, so it ships
+only the pure half. Do the lookup with whatever resolver you already have and hand the TXT values
+in:
+
+```ts
+import { parseDelegationPointer, pointerRecordName, verifyPublishedDelegation } from '@proof-holdings/delegation-verifier';
+import { resolveTxt } from 'node:dns/promises';
+
+// `resolveTxt` THROWS on NXDOMAIN, and "the domain publishes nothing" is a different fact from
+// "the lookup failed" — collapsing them reports a network blip as "not delegated".
+let records: string[][] = [];
+try {
+  records = await resolveTxt(pointerRecordName('example.com')); // '_mcp.example.com'
+} catch (error) {
+  // ENOTFOUND is "no such name", ENODATA is "the name exists with no TXT" — both mean the domain
+  // publishes no pointer. Anything else is a lookup FAILURE, which is a different fact.
+  const code = (error as NodeJS.ErrnoException).code;
+  if (code !== 'ENOTFOUND' && code !== 'ENODATA') throw error;
+}
+
+const pointer = parseDelegationPointer(records.map((chunks) => chunks.join('')));
+if (!pointer.ok) throw new Error(pointer.reason);
+
+// `redirect: 'error'` matters: the grammar guarantees https at the START of the fetch, not at the
+// end of a redirect chain, and the card is the thing carrying the delegation.
+const response = await fetch(pointer.card, { redirect: 'error' });
+if (!response.ok) throw new Error(`card fetch failed: ${response.status}`);
+const card = await response.json();
+const result = await verifyPublishedDelegation(card, {
+  trustedIssuers,
+  delegate: { type: 'purl', value: 'pkg:npm/example-mcp' }, // resolved by YOU, not read from the card
+  expectedPrincipal: 'example.com',                          // the domain whose pointer you followed
+});
+```
+
+`parseDelegationPointer` answers `{ ok: true, card }` or `{ ok: false, reason }`, where `reason` is
+one of `no_pointer`, `version_not_first`, `missing_card`, `duplicate_field`, `invalid_card_url`,
+`ambiguous_pointer`, `token_in_dns`. Two behaviours worth knowing:
+
+- A record whose first field is not `v=proofdlg1` is **not ours** and is skipped silently. The MCP
+  discovery draft (`draft-morrison-mcp-dns-discovery`) publishes `v=mcp1` at the same name, and the
+  two coexist by ignoring each other.
+- A record of ours that is malformed is a refusal **even when a well-formed one sits beside it**, and
+  two well-formed records naming different cards are `ambiguous_pointer`. A zone in a contradictory
+  state is not a zone to guess about — the same reason `verifyPublishedDelegation` refuses a card
+  that publishes two different tokens.
+
+A pointer is discovery, never evidence. Following one tells you where to look; whether the delegation
+is real is still decided by `verifyPublishedDelegation` against the issuer's keys and status.
+
+## License
+
+MIT

package/dist/carriers.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Where a delegation may be published, and how to read it back.
+ *
+ * ⚠️ SECOND LOCKSTEP COPY of two issuer-side pieces: the extraction half of
+ * `scripts/delegation-publication-shared.ts`, and the pointer parser in
+ * `src/services/delegationPointer/pointer.ts`. Both are pinned by the drift suite
+ * `src/__tests__/drift/delegation-verifier.test.ts` in that repository — a carrier the
+ * publisher writes to and the verifier does not read makes a real delegation invisible.
+ *
+ * FOUR sanctioned carriers, and the fourth is shaped unlike the others. Three are LOCATIONS
+ * INSIDE A CARD, each holding the publication itself, because three registries reserve
+ * different keys:
+ *   - MCP server card: `_meta["holdings.proof/delegation"]`
+ *   - MCP official registry: nested under `_meta["io.modelcontextprotocol.registry/publisher-provided"]`
+ *   - A2A agent card: `capabilities.extensions[]` with `uri: "https://proof.holdings/delegation"`
+ *     (A2A cards have no `_meta`)
+ * The fourth is a DNS record — `_mcp.<domain>` TXT — which holds NO publication at all: it holds
+ * the ADDRESS of a card that does. The first three are read from an artifact one already has; the
+ * pointer is read from a domain, and leads to the card. Format:
+ * `docs/delegation-dns-pointer.md` in the issuer repository.
+ *
+ * Deliberately free of any crypto import: a consumer that only wants to know whether a card
+ * claims a delegation at all pays nothing for the verification machinery. For the same reason
+ * pointer RESOLUTION — the DNS query and the card fetch — is not here: it is Node-only I/O and
+ * lives in the issuer repository, while the parsing below stays pure.
+ */
+export declare const DELEGATION_META_KEY = "holdings.proof/delegation";
+export declare const DELEGATION_EXTENSION_URI = "https://proof.holdings/delegation";
+export declare const REGISTRY_PUBLISHER_PROVIDED_KEY = "io.modelcontextprotocol.registry/publisher-provided";
+export interface FoundPublication {
+    location: string;
+    value: unknown;
+}
+/** Every delegation publication a card carries, across all sanctioned locations. */
+export declare function extractDelegationPublications(card: unknown): FoundPublication[];
+export declare const POINTER_VERSION = "proofdlg1";
+export declare const POINTER_RECORD_PREFIX = "_mcp";
+export type PointerRejection = 'no_pointer' | 'version_not_first' | 'missing_card' | 'duplicate_field' | 'invalid_card_url' | 'ambiguous_pointer' | 'token_in_dns';
+export type PointerParseResult = {
+    ok: true;
+    card: string;
+} | {
+    ok: false;
+    reason: PointerRejection;
+};
+/** The DNS name a domain publishes its pointer at. */
+export declare function pointerRecordName(domain: string): string;
+/**
+ * How much of a segment is decoded once the probe matches, and therefore the LONGEST header this
+ * scan can recognise. It is a real, documented boundary rather than an implementation detail: a
+ * token whose header exceeds it is not detected. 4096 characters is ~3 KB of decoded JSON, which
+ * covers an ordinary header (~40-80 characters) and one carrying an `x5c` certificate chain, while
+ * keeping the walk linear — without it, decoding "the rest of the segment" at every offset is
+ * O(L²), and a review measured 4193 ms of blocked processing on one 64 KB value an attacker
+ * chooses. See `docs/delegation-dns-pointer.md` for the boundary as published.
+ */
+export declare const MAX_HEADER_CHARS = 4096;
+/** Does this text carry a JWT anywhere inside it? */
+export declare function carriesJwt(text: string): boolean;
+/**
+ * Read the pointer out of the TXT values published at `_mcp.<domain>`.
+ *
+ * Several records may share that name — the MCP discovery draft permits it, so a zone may hold a
+ * `v=mcp1` record beside ours. Records that are not ours are skipped silently. Any record of ours
+ * that is malformed is a refusal even when another of ours is fine: a zone holding a broken proof
+ * record is in an unknown state, and reading the other one is guessing which the owner meant. Two
+ * well-formed records of ours naming DIFFERENT cards is `ambiguous_pointer`, for the same reason
+ * `verifyPublishedDelegation` refuses a card publishing two different tokens.
+ */
+export declare function parseDelegationPointer(txtValues: string[]): PointerParseResult;
+/** The distinct delegation tokens a card publishes. */
+export declare function collectPublishedTokens(card: unknown): string[];
+//# sourceMappingURL=carriers.d.ts.map

package/dist/carriers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"carriers.d.ts","sourceRoot":"","sources":["../src/carriers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAC/D,eAAO,MAAM,wBAAwB,sCAAsC,CAAC;AAC5E,eAAO,MAAM,+BAA+B,wDAAwD,CAAC;AAErG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;CAChB;AAMD,oFAAoF;AACpF,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,OAAO,GAAG,gBAAgB,EAAE,CA4B/E;AAQD,eAAO,MAAM,eAAe,cAAc,CAAC;AAC3C,eAAO,MAAM,qBAAqB,SAAS,CAAC;AAE5C,MAAM,MAAM,gBAAgB,GACxB,YAAY,GACZ,mBAAmB,GACnB,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,mBAAmB,GACnB,cAAc,CAAC;AAEnB,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAEtG,sDAAsD;AACtD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD;AAwED;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,OAAO,CAAC;AAErC,qDAAqD;AACrD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAmChD;AAoCD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAyB9E;AAED,uDAAuD;AACvD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,CAQ9D"}

package/dist/carriers.js

@@ -0,0 +1,265 @@
+/**
+ * Where a delegation may be published, and how to read it back.
+ *
+ * ⚠️ SECOND LOCKSTEP COPY of two issuer-side pieces: the extraction half of
+ * `scripts/delegation-publication-shared.ts`, and the pointer parser in
+ * `src/services/delegationPointer/pointer.ts`. Both are pinned by the drift suite
+ * `src/__tests__/drift/delegation-verifier.test.ts` in that repository — a carrier the
+ * publisher writes to and the verifier does not read makes a real delegation invisible.
+ *
+ * FOUR sanctioned carriers, and the fourth is shaped unlike the others. Three are LOCATIONS
+ * INSIDE A CARD, each holding the publication itself, because three registries reserve
+ * different keys:
+ *   - MCP server card: `_meta["holdings.proof/delegation"]`
+ *   - MCP official registry: nested under `_meta["io.modelcontextprotocol.registry/publisher-provided"]`
+ *   - A2A agent card: `capabilities.extensions[]` with `uri: "https://proof.holdings/delegation"`
+ *     (A2A cards have no `_meta`)
+ * The fourth is a DNS record — `_mcp.<domain>` TXT — which holds NO publication at all: it holds
+ * the ADDRESS of a card that does. The first three are read from an artifact one already has; the
+ * pointer is read from a domain, and leads to the card. Format:
+ * `docs/delegation-dns-pointer.md` in the issuer repository.
+ *
+ * Deliberately free of any crypto import: a consumer that only wants to know whether a card
+ * claims a delegation at all pays nothing for the verification machinery. For the same reason
+ * pointer RESOLUTION — the DNS query and the card fetch — is not here: it is Node-only I/O and
+ * lives in the issuer repository, while the parsing below stays pure.
+ */
+export const DELEGATION_META_KEY = 'holdings.proof/delegation';
+export const DELEGATION_EXTENSION_URI = 'https://proof.holdings/delegation';
+export const REGISTRY_PUBLISHER_PROVIDED_KEY = 'io.modelcontextprotocol.registry/publisher-provided';
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Every delegation publication a card carries, across all sanctioned locations. */
+export function extractDelegationPublications(card) {
+    if (!isRecord(card))
+        return [];
+    const found = [];
+    const meta = card._meta;
+    if (isRecord(meta)) {
+        if (meta[DELEGATION_META_KEY] !== undefined) {
+            found.push({ location: `_meta["${DELEGATION_META_KEY}"]`, value: meta[DELEGATION_META_KEY] });
+        }
+        const publisherProvided = meta[REGISTRY_PUBLISHER_PROVIDED_KEY];
+        if (isRecord(publisherProvided) && publisherProvided[DELEGATION_META_KEY] !== undefined) {
+            found.push({
+                location: `_meta["${REGISTRY_PUBLISHER_PROVIDED_KEY}"]["${DELEGATION_META_KEY}"]`,
+                value: publisherProvided[DELEGATION_META_KEY],
+            });
+        }
+    }
+    const capabilities = card.capabilities;
+    if (isRecord(capabilities) && Array.isArray(capabilities.extensions)) {
+        capabilities.extensions.forEach((extension, index) => {
+            if (isRecord(extension) && extension.uri === DELEGATION_EXTENSION_URI) {
+                found.push({ location: `capabilities.extensions[${index}]`, value: extension.params });
+            }
+        });
+    }
+    return found;
+}
+// ---------------------------------------------------------------------------------------------
+// The DNS pointer (fourth carrier). LOCKSTEP COPY of `src/services/delegationPointer/pointer.ts`
+// in the issuer repository; the build half is deliberately absent, since a verifier never
+// publishes. Format and rejection vocabulary: `docs/delegation-dns-pointer.md`.
+// ---------------------------------------------------------------------------------------------
+export const POINTER_VERSION = 'proofdlg1';
+export const POINTER_RECORD_PREFIX = '_mcp';
+/** The DNS name a domain publishes its pointer at. */
+export function pointerRecordName(domain) {
+    return `${POINTER_RECORD_PREFIX}.${domain}`;
+}
+/**
+ * A card URL is an absolute https URL with no userinfo, no query and no fragment — the same
+ * restrictions `canonicalizeDelegate` places on a url-typed delegate.
+ */
+function isValidCardUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return false;
+    }
+    return (url.protocol === 'https:' &&
+        url.username === '' &&
+        url.password === '' &&
+        url.search === '' &&
+        url.hash === '');
+}
+/**
+ * Three base64url runs separated by dots is only a CANDIDATE — `discovery.mcp-servers.engineering`
+ * matches that shape too. What settles it is decoding: a JWT's first segment is a JSON object
+ * carrying `alg`, and a hostname label is not.
+ *
+ * Every CONSECUTIVE triple is examined, deliberately. A scan over non-overlapping regex matches
+ * misses a token whenever anything dotted precedes it, because the earlier match consumes the
+ * token's header as its own third run — `abcd.efgh.<token>` then reads as clean. A code review
+ * found that live, and the fixtures meant to prove the rule all happened to place the token where
+ * nothing preceded it.
+ */
+const RUN_SEPARATOR = /[^A-Za-z0-9_.-]+/;
+const MIN_HEADER_RUN = 4;
+const MIN_PAYLOAD_RUN = 4;
+const MIN_SIGNATURE_RUN = 2;
+function decodeBase64Url(segment) {
+    const padded = segment.replace(/-/g, '+').replace(/_/g, '/');
+    const remainder = padded.length % 4;
+    if (remainder === 1)
+        return null;
+    try {
+        return atob(remainder === 0 ? padded : padded + '='.repeat(4 - remainder));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Two facts about text that base64url-decodes to a JSON object whose FIRST BYTE is `{`, both
+ * checked numerically rather than assumed (an earlier attempt anchored on the prefix `ey`, which
+ * is wrong: `{\n` encodes to `ewo`):
+ *
+ *   - its first character is always `e` — the high six bits of `0x7B` are `011110`, index 30;
+ *   - its first FOUR characters decode to three bytes whose first byte is `{`.
+ *
+ * The `{`-first qualifier is the honest statement of the limit, not a technicality: a header that
+ * begins with LEGAL JSON whitespace (` {"alg":…}`) is not seen. That is unreachable for a genuine
+ * token — the header is signing input, so it cannot be re-spaced without breaking the signature —
+ * and it fails CLOSED for a reader implementing this spec, but the rule has to say what it checks.
+ *
+ * The four-character probe is what keeps the offset walk linear with a small constant. Anchoring
+ * on `e` alone is not enough: a value made of 65 000 `e`s passes that filter at every offset, and a
+ * review's cost case measured 242 ms against this version's 6.6 ms on exactly that shape — a 37x
+ * gap, not the ~3x an average across mixed shapes suggested. The probe costs
+ * one 4-character decode per offset and rejects it immediately.
+ */
+const HEADER_FIRST_CHAR = 'e';
+const HEADER_PROBE_CHARS = 4;
+const JSON_OBJECT_OPEN = '{';
+/**
+ * How much of a segment is decoded once the probe matches, and therefore the LONGEST header this
+ * scan can recognise. It is a real, documented boundary rather than an implementation detail: a
+ * token whose header exceeds it is not detected. 4096 characters is ~3 KB of decoded JSON, which
+ * covers an ordinary header (~40-80 characters) and one carrying an `x5c` certificate chain, while
+ * keeping the walk linear — without it, decoding "the rest of the segment" at every offset is
+ * O(L²), and a review measured 4193 ms of blocked processing on one 64 KB value an attacker
+ * chooses. See `docs/delegation-dns-pointer.md` for the boundary as published.
+ */
+export const MAX_HEADER_CHARS = 4096;
+/** Does this text carry a JWT anywhere inside it? */
+export function carriesJwt(text) {
+    for (const run of text.split(RUN_SEPARATOR)) {
+        const segments = run.split('.');
+        for (let index = 0; index + 2 < segments.length; index++) {
+            if (segments[index + 1].length < MIN_PAYLOAD_RUN ||
+                segments[index + 2].length < MIN_SIGNATURE_RUN) {
+                continue;
+            }
+            // The header may START anywhere inside its segment, not only at a run boundary: `-`, `_`
+            // and alphanumerics are all base64url-legal, so `delegation-<jwt>` puts the prefix and the
+            // header in ONE segment and decoding the whole thing fails. A review found that after the
+            // first fix, on fixtures that all happened to place a `/` or `=` immediately before the
+            // token.
+            const header = segments[index];
+            for (let start = 0; header.length - start >= MIN_HEADER_RUN; start++) {
+                if (header[start] !== HEADER_FIRST_CHAR)
+                    continue;
+                const probe = decodeBase64Url(header.slice(start, start + HEADER_PROBE_CHARS));
+                if (probe === null || probe[0] !== JSON_OBJECT_OPEN)
+                    continue;
+                const decoded = decodeBase64Url(header.slice(start, start + MAX_HEADER_CHARS));
+                if (decoded === null)
+                    continue;
+                try {
+                    const parsed = JSON.parse(decoded);
+                    if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed) && 'alg' in parsed) {
+                        return true;
+                    }
+                }
+                catch {
+                    // Not a JWT header; keep looking.
+                }
+            }
+        }
+    }
+    return false;
+}
+function parseOneRecord(raw) {
+    const fields = raw
+        .split(';')
+        .map((field) => field.trim())
+        .filter((field) => field.length > 0);
+    const versionIndex = fields.indexOf(`v=${POINTER_VERSION}`);
+    if (versionIndex === -1)
+        return { kind: 'not_ours' };
+    if (versionIndex !== 0)
+        return { kind: 'bad', reason: 'version_not_first' };
+    const seen = new Set(['v']);
+    let card;
+    for (const field of fields.slice(1)) {
+        const separator = field.indexOf('=');
+        if (separator <= 0)
+            continue;
+        const key = field.slice(0, separator);
+        if (!/^[a-z0-9-]+$/.test(key))
+            continue;
+        if (key !== 'card' && key !== 'v')
+            continue;
+        if (seen.has(key))
+            return { kind: 'bad', reason: 'duplicate_field' };
+        seen.add(key);
+        card = field.slice(separator + 1);
+    }
+    if (card === undefined)
+        return { kind: 'bad', reason: 'missing_card' };
+    if (!isValidCardUrl(card))
+        return { kind: 'bad', reason: 'invalid_card_url' };
+    return { kind: 'ok', card };
+}
+/**
+ * Read the pointer out of the TXT values published at `_mcp.<domain>`.
+ *
+ * Several records may share that name — the MCP discovery draft permits it, so a zone may hold a
+ * `v=mcp1` record beside ours. Records that are not ours are skipped silently. Any record of ours
+ * that is malformed is a refusal even when another of ours is fine: a zone holding a broken proof
+ * record is in an unknown state, and reading the other one is guessing which the owner meant. Two
+ * well-formed records of ours naming DIFFERENT cards is `ambiguous_pointer`, for the same reason
+ * `verifyPublishedDelegation` refuses a card publishing two different tokens.
+ */
+export function parseDelegationPointer(txtValues) {
+    // Checked across the whole set BEFORE anything is believed about any record: a token in this
+    // zone's `_mcp` name is a bearer artifact loose in a channel with cached copies nobody controls,
+    // whoever put it there.
+    if (txtValues.some((value) => carriesJwt(value)))
+        return { ok: false, reason: 'token_in_dns' };
+    const ours = [];
+    for (const value of txtValues) {
+        const parsed = parseOneRecord(value);
+        if (parsed.kind !== 'not_ours')
+            ours.push(parsed);
+    }
+    if (ours.length === 0)
+        return { ok: false, reason: 'no_pointer' };
+    // With two malformed records of ours, the FIRST in the array decides which reason is reported,
+    // and resolvers rotate RRsets — so two runs against one zone can name different reasons. Both
+    // copies agree for any given input (which is what the lockstep suite pins) and both answers are
+    // refusals; only the diagnostic label moves.
+    const broken = ours.find((entry) => entry.kind === 'bad');
+    if (broken)
+        return { ok: false, reason: broken.reason };
+    const cards = new Set(ours.map((entry) => entry.card));
+    if (cards.size > 1)
+        return { ok: false, reason: 'ambiguous_pointer' };
+    return { ok: true, card: [...cards][0] };
+}
+/** The distinct delegation tokens a card publishes. */
+export function collectPublishedTokens(card) {
+    const tokens = new Set();
+    for (const publication of extractDelegationPublications(card)) {
+        if (isRecord(publication.value) && typeof publication.value.token === 'string' && publication.value.token) {
+            tokens.add(publication.value.token);
+        }
+    }
+    return [...tokens];
+}
+//# sourceMappingURL=carriers.js.map

package/dist/carriers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"carriers.js","sourceRoot":"","sources":["../src/carriers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAC/D,MAAM,CAAC,MAAM,wBAAwB,GAAG,mCAAmC,CAAC;AAC5E,MAAM,CAAC,MAAM,+BAA+B,GAAG,qDAAqD,CAAC;AAOrG,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,6BAA6B,CAAC,IAAa;IACzD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAuB,EAAE,CAAC;IAErC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;IACxB,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,IAAI,CAAC,mBAAmB,CAAC,KAAK,SAAS,EAAE,CAAC;YAC5C,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,mBAAmB,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,iBAAiB,GAAG,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAChE,IAAI,QAAQ,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,CAAC,mBAAmB,CAAC,KAAK,SAAS,EAAE,CAAC;YACxF,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,UAAU,+BAA+B,OAAO,mBAAmB,IAAI;gBACjF,KAAK,EAAE,iBAAiB,CAAC,mBAAmB,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACvC,IAAI,QAAQ,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;QACrE,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE;YACnD,IAAI,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,GAAG,KAAK,wBAAwB,EAAE,CAAC;gBACtE,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,2BAA2B,KAAK,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;YACzF,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gGAAgG;AAChG,iGAAiG;AACjG,0FAA0F;AAC1F,gFAAgF;AAChF,gGAAgG;AAEhG,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAC3C,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAa5C,sDAAsD;AACtD,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,GAAG,qBAAqB,IAAI,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,MAAM,KAAK,EAAE;QACjB,GAAG,CAAC,IAAI,KAAK,EAAE,CAChB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,aAAa,GAAG,kBAAkB,CAAC;AACzC,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IACpC,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAErC,qDAAqD;AACrD,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;YACzD,IACE,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,eAAe;gBAC5C,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,iBAAiB,EAC9C,CAAC;gBACD,SAAS;YACX,CAAC;YACD,yFAAyF;YACzF,2FAA2F;YAC3F,0FAA0F;YAC1F,wFAAwF;YACxF,SAAS;YACT,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC/B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,KAAK,IAAI,cAAc,EAAE,KAAK,EAAE,EAAE,CAAC;gBACrE,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,iBAAiB;oBAAE,SAAS;gBAClD,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,kBAAkB,CAAC,CAAC,CAAC;gBAC/E,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,gBAAgB;oBAAE,SAAS;gBAE9D,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,gBAAgB,CAAC,CAAC,CAAC;gBAC/E,IAAI,OAAO,KAAK,IAAI;oBAAE,SAAS;gBAC/B,IAAI,CAAC;oBACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBAC5C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;wBAC/F,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,kCAAkC;gBACpC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAOD,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,MAAM,GAAG,GAAG;SACf,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAEvC,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,eAAe,EAAE,CAAC,CAAC;IAC5D,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACrD,IAAI,YAAY,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAE5E,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,IAAI,IAAwB,CAAC;IAE7B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,SAAS,IAAI,CAAC;YAAE,SAAS;QAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACxC,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG;YAAE,SAAS;QAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QACrE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACvE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC9E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAmB;IACxD,6FAA6F;IAC7F,iGAAiG;IACjG,wBAAwB;IACxB,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAE/F,MAAM,IAAI,GAAoB,EAAE,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAElE,+FAA+F;IAC/F,8FAA8F;IAC9F,gGAAgG;IAChG,6CAA6C;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAsD,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;IAC9G,IAAI,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAExD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAE,KAAsC,CAAC,IAAI,CAAC,CAAC,CAAC;IACzF,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAEtE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,sBAAsB,CAAC,IAAa;IAClD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,WAAW,IAAI,6BAA6B,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,IAAI,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,OAAO,WAAW,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YAC1G,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;AACrB,CAAC"}