@proof-holdings/sdk 0.0.0-stage → 1.2.0

package/CHANGELOG.md

@@ -0,0 +1,54 @@
+# Changelog
+
+Notable changes to [`@proof-holdings/sdk`](https://www.npmjs.com/package/@proof-holdings/sdk).
+Source: [ProofHoldings/sdk-js](https://github.com/ProofHoldings/sdk-js).
+
+## 1.2.0 — 2026-10-26
+
+### Added
+
+- SMS sessions: `sessions.create({ channel: 'sms' })` now works, the same way as SMS sign-in. The
+  person texts a short code to one of our numbers; the session carries `sms_code`, `sms_message`
+  and `sms_dids` (`SessionSmsNumber` per region, each with its own QR), and `deep_link` is an `sms:`
+  link with the message pre-filled. An SMS proof carries `confidence: "standard"`.
+- `CreateSessionParams.profile_id` names the sub-account a session is for; `Session.qr_text`.
+
+- Message templates belong to a project (sub-account). Every `templates` method except `getDefaults`
+  takes an optional last argument `{ profileId }` (`TemplateProjectOptions`), sent as the `profile_id`
+  query parameter. Omitted, a project-bound API key uses its own project and any other key the
+  primary project; a project-bound key naming another project is refused with 403 `profile_mismatch`.
+- `email_theme` and `support_email` on `Profile`, `CreateProfileParams` and `UpdateProfileParams`:
+  email branding is set per project.
+- `TemplateGetResponse` carries `scope` (`project` or `default`) and `profile_id`;
+  `TemplateListResponse` and custom templates carry `profile_id`.
+
+### Deprecated
+
+- `CreateAuthorizationParams.business_name` and `CreateSessionParams.context` are marked
+  `@deprecated`. The server ignores both: messages name the sub-account (for a consent request, the
+  approval setup's).
+
+- `profiles.listTemplates`, `updateTemplate`, `deleteTemplate` and `previewTemplate`. The server
+  retired `/api/v1/me/profiles/{id}/templates` (410 `endpoint_retired`); use the `templates` methods
+  with `{ profileId }`.
+
+## 1.1.0 — 2026-10-14
+
+The first release on npm.
+
+### Added
+
+- `new Proof()` without a key resolves one: a non-empty `PROOF_API_KEY`, else the entry that
+  `npx @proof-holdings/mcp-server login` saved in `~/.proof-holdings/credentials` for the client's base
+  URL. The base URL is the `baseUrl` option, else `PROOF_BASE_URL`, else `https://api.proof.holdings`.
+  An explicit key behaves as before; an explicit empty key is an error.
+- `proof.verifications.deleteDomainVerification(id)` deletes a domain verification attempt that is not
+  verified (pending, verifying or failed). A verified domain is refused with 409 `domain_verified`.
+- Types for account deletion and export, identifier, domain and project removal, the artifact claim
+  lookup, and the Delegations section of a public profile.
+- API-key listings carry `replaced_key_ids`: a key's usage covers every key it replaced.
+
+### Changed
+
+- The README's runtime line: Node.js 18 or later. The SDK imports `node:fs`, `node:os`, `node:path`
+  and `node:zlib`, so it does not run in a browser.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Proof Holdings
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,240 @@
-# Temporary Holding Version
+# @proof-holdings/sdk
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Official JavaScript/TypeScript SDK for the [proof.holdings](https://proof.holdings) verification API.
+
+## Installation
+
+```bash
+npm install @proof-holdings/sdk
+```
+
+## Quick Start
+
+```typescript
+import Proof from '@proof-holdings/sdk';
+
+const proof = new Proof('pk_live_...');
+
+// Create a phone verification
+const verification = await proof.verifications.create({
+  type: 'phone',
+  channel: 'whatsapp',
+  identifier: '+37069199199',
+});
+
+console.log('Deep link:', verification.challenge?.deep_link);
+
+// Wait for user to verify
+const result = await proof.verifications.waitForCompletion(verification.id);
+
+if (result.status === 'verified') {
+  console.log('Proof token:', result.proof?.token);
+}
+```
+
+## Features
+
+- **Typed API client** covering all public endpoints
+- **Built-in polling** — `waitForCompletion()` with configurable interval/timeout
+- **Offline proof verification** — verify JWT proof tokens using JWKS public keys
+- **Automatic retries** with exponential backoff for network/server errors
+- **Error classes** with typed error codes from the API
+- **ESM + CJS** dual output — works everywhere
+
+## Resources
+
+### Verifications
+
+```typescript
+// Create
+const v = await proof.verifications.create({ type: 'phone', channel: 'telegram', identifier: '+1...' });
+
+// Retrieve
+const v = await proof.verifications.retrieve('verification_id');
+
+// List (paginated)
+const list = await proof.verifications.list({ status: 'verified', limit: 20 });
+
+// Trigger DNS/HTTP check
+await proof.verifications.verify('verification_id');
+
+// Submit OTP code
+await proof.verifications.submit('verification_id', 'A1B2C3');
+
+// Poll until complete — uses exponential backoff per POLLING_CONTRACT.md.
+// Defaults: 2s initial interval, 1.5× backoff, 30s max, 0–500ms jitter, 10min timeout.
+const result = await proof.verifications.waitForCompletion('verification_id', {
+  interval: 2000,     // initial poll interval in ms (default)
+  timeout: 600000,    // 10 min timeout (default)
+  // backoff: 1.5, maxInterval: 30000, jitter: 500 — contract defaults
+  // signal: abortController.signal — optional AbortSignal for cancellation
+});
+
+// WABA (WhatsApp Business) verification
+const waba = await proof.verifications.create({
+  type: 'waba',
+  channel: 'waba_otp',
+  identifier: '+37069199199',
+});
+// OTP is sent via WhatsApp — submit with proof.verifications.submit(waba.id, code)
+
+// Telegram Bot verification
+const bot = await proof.verifications.create({
+  type: 'telegram_bot',
+  channel: 'telegram_bot_token',
+  identifier: '@mybusinessbot',
+});
+// Submit bot token with proof.verifications.submit(bot.id, botToken)
+```
+
+### Verification Requests (Multi-Asset)
+
+```typescript
+const request = await proof.verificationRequests.create({
+  assets: [
+    { type: 'phone', required: true },
+    { type: 'email', required: true },
+    { type: 'domain', identifier: 'example.com', required: false },
+  ],
+  redirect_url: 'https://yourapp.com/done',
+  callback_url: 'https://yourapp.com/webhooks',
+});
+
+console.log('Send user to:', request.verification_url);
+
+const completed = await proof.verificationRequests.waitForCompletion(request.id);
+```
+
+### Proofs
+
+```typescript
+// Online validation (checks revocation)
+const result = await proof.proofs.validate(proofToken);
+
+// Offline verification — no API call with your key. Reads two public documents: the JWKS for
+// the signature, and the issuer's status list for revocation (checked by default).
+const offline = await proof.proofs.verifyOffline(proofToken);
+if (offline.valid) {
+  console.log('Verified:', offline.payload?.type, offline.payload?.verified_at);
+} else {
+  // 'revoked' | 'suspended' | 'expired' | 'invalid' | 'status_unavailable'
+  // | 'key_revoked' | 'jwks_stale' | 'wrong_key_purpose' | 'outside_key_window'
+  // | 'token_lifetime_exceeded' | 'unknown_key' — see "Signing-key rotation" below
+  console.log('Refused:', offline.reason);
+}
+
+// `status_unavailable` means the revocation status could NOT be read — an unreachable list, one
+// that failed its own checks, or a slot the list does not cover. It is a refusal to guess, not a
+// claim that the proof is withdrawn. A token minted without a status-list slot stays valid and
+// reports `revocation_checked: false`, exactly as the issuer's own `validate` answers for it.
+
+// Signature only, for an air-gapped check against a warm key cache:
+const signatureOnly = await proof.proofs.verifyOffline(proofToken, { checkRevocation: false });
+console.log(signatureOnly.revocation_checked); // false — never assume it was checked
+
+// Revoke a proof
+await proof.proofs.revoke('verification_id', 'user_request');
+
+// Get revocation list
+const { revoked } = await proof.proofs.listRevoked();
+```
+
+### Signing-key rotation
+
+`verifyOffline` fetches and caches the issuer's key set (JWKS) itself and follows its rotation rules.
+The cached set is reused for 10 minutes; a `kid` it does not know triggers one refetch, at most
+once every 30 seconds.
+
+- **`key_revoked`** — the issuer revoked the key that signed the token. The result carries
+  `pull_hint: { issuer_origin, handle }`: where to fetch the re-signed token (`handle` is the proof's
+  `proof_id`, or a delegation's `sub`). The handle is read from the token itself, whose signature a
+  revoked key no longer vouches for: URL-encode it before building a request from it. A revocation
+  takes effect only after two key-set fetches at least 5 minutes apart both carry it, and is then kept
+  for a year.
+- **`jwks_stale`** — the key set could not be refreshed and the cached copy is older than
+  `maxJwksAgeMs` (default 24 hours, at most 25 days; `new Proof(key, { maxJwksAgeMs })`). The result
+  carries `cache_age_seconds`. Call `refreshJWKS()` once the issuer is reachable.
+- **`wrong_key_purpose`**, **`outside_key_window`**, **`token_lifetime_exceeded`** — the key belongs
+  to another token family, the token was signed outside the key's validity window, or it lives longer
+  than the key allows. **`unknown_key`** — no published key matches the token's `kid`.
+
+Revoked-key tombstones are kept in memory only — they are not persisted, so a restarted process
+learns them again from the issuer. `clearTombstones()` forgets them on purpose. `refreshJWKS()` makes
+the next verification refetch the key set (and drops the cached status list); it does not forget
+tombstones.
+
+### Sessions (Phone-First Flow)
+
+```typescript
+const session = await proof.sessions.create({ channel: 'telegram' });
+console.log('QR code:', session.qr_code);
+
+const completed = await proof.sessions.waitForCompletion(session.id);
+console.log('Phone:', completed.phone_number);
+```
+
+### Webhook Deliveries
+
+```typescript
+const deliveries = await proof.webhookDeliveries.list({ status: 'failed' });
+await proof.webhookDeliveries.retry(deliveries.data[0].id);
+```
+
+## Error Handling
+
+```typescript
+import { Proof, ValidationError, RateLimitError, AuthenticationError } from '@proof-holdings/sdk';
+
+try {
+  await proof.verifications.create({ ... });
+} catch (error) {
+  if (error instanceof ValidationError) {
+    console.error('Invalid params:', error.code, error.details);
+  } else if (error instanceof RateLimitError) {
+    console.error('Rate limited');
+  } else if (error instanceof AuthenticationError) {
+    console.error('Invalid API key');
+  }
+}
+```
+
+## Configuration
+
+```typescript
+const proof = new Proof('pk_live_...', {
+  baseUrl: 'https://api.proof.holdings', // default
+  timeout: 30000,                         // 30s request timeout (default)
+  maxRetries: 2,                          // retry failed requests (default)
+  maxJwksAgeMs: 86_400_000,               // offline verification: 24h stale bound (default)
+});
+```
+
+## Credentials
+
+Sign in once with `npx @proof-holdings/mcp-server login` and construct the client with no key:
+
+```typescript
+const proof = new Proof();                        // or new Proof({ baseUrl: '...' })
+```
+
+When the key argument is omitted it is resolved in this order:
+
+1. `PROOF_API_KEY`, when set and non-empty.
+2. The entry for this client's base URL in `~/.proof-holdings/credentials`, the file the login
+   command writes. The file is keyed by base URL, so a key saved against staging is never sent
+   to production.
+3. Otherwise construction throws, naming the three roads: pass the key, set `PROOF_API_KEY`, or
+   run `npx @proof-holdings/mcp-server login`.
+
+The base URL is the `baseUrl` option, else a non-empty `PROOF_BASE_URL`, else
+`https://api.proof.holdings`. An explicit key is used as given, and an explicit empty key
+(`new Proof('')`) is an error — neither reads the environment or the file.
+
+## Requirements
+
+- Node.js 18+ (uses native `fetch`)
+- Not for browsers: the SDK imports `node:fs`, `node:os`, `node:path` and `node:zlib`
+
+## License
+
+MIT

package/dist/cjs/client.d.ts

@@ -0,0 +1,48 @@
+import { Verifications } from './resources/verifications.js';
+import { VerificationRequests } from './resources/verification-requests.js';
+import { Proofs } from './resources/proofs.js';
+import { Sessions } from './resources/sessions.js';
+import { WebhookDeliveries } from './resources/webhook-deliveries.js';
+import { Confirmations } from './resources/confirmations.js';
+import { AuthSessions } from './resources/auth-sessions.js';
+import { Me } from './resources/me.js';
+import { Hitl } from './resources/hitl.js';
+import { HitlChatIdDiscovery } from './resources/hitl-chat-id.js';
+import { HitlKeys } from './resources/hitl-keys.js';
+import { Authorizations } from './resources/authorizations.js';
+import { Templates } from './resources/templates.js';
+import { Profiles } from './resources/profiles.js';
+import { PublicProfiles } from './resources/public-profiles.js';
+import { ProofMe } from './resources/proof-me.js';
+import { Circles } from './resources/circles.js';
+import { Delegations } from './resources/delegations.js';
+import type { ProofOptions } from './types.js';
+export declare class Proof {
+    readonly verifications: Verifications;
+    readonly verificationRequests: VerificationRequests;
+    readonly proofs: Proofs;
+    readonly sessions: Sessions;
+    readonly webhookDeliveries: WebhookDeliveries;
+    readonly confirmations: Confirmations;
+    readonly authSessions: AuthSessions;
+    readonly me: Me;
+    readonly hitl: Hitl;
+    readonly hitlChatIdDiscovery: HitlChatIdDiscovery;
+    readonly hitlKeys: HitlKeys;
+    readonly authorizations: Authorizations;
+    readonly templates: Templates;
+    readonly profiles: Profiles;
+    readonly publicProfiles: PublicProfiles;
+    readonly proofMe: ProofMe;
+    readonly circles: Circles;
+    readonly delegations: Delegations;
+    /**
+     * With a key: `new Proof('pk_live_…', options?)`, used as given. Without one — `new Proof()` or
+     * `new Proof(options)` — the key is resolved the way `npx @proof-holdings/mcp-server login`
+     * expects: a non-empty `PROOF_API_KEY`, else the entry saved for this client's base URL in
+     * `~/.proof-holdings/credentials`. An explicit empty key is an error and never reads either.
+     */
+    constructor(apiKey?: string, options?: ProofOptions);
+    constructor(options?: ProofOptions);
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/cjs/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAM/C,qBAAa,KAAK;IAChB,SAAgB,aAAa,EAAE,aAAa,CAAC;IAC7C,SAAgB,oBAAoB,EAAE,oBAAoB,CAAC;IAC3D,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,QAAQ,EAAE,QAAQ,CAAC;IACnC,SAAgB,iBAAiB,EAAE,iBAAiB,CAAC;IACrD,SAAgB,aAAa,EAAE,aAAa,CAAC;IAC7C,SAAgB,YAAY,EAAE,YAAY,CAAC;IAC3C,SAAgB,EAAE,EAAE,EAAE,CAAC;IACvB,SAAgB,IAAI,EAAE,IAAI,CAAC;IAC3B,SAAgB,mBAAmB,EAAE,mBAAmB,CAAC;IACzD,SAAgB,QAAQ,EAAE,QAAQ,CAAC;IACnC,SAAgB,cAAc,EAAE,cAAc,CAAC;IAC/C,SAAgB,SAAS,EAAE,SAAS,CAAC;IACrC,SAAgB,QAAQ,EAAE,QAAQ,CAAC;IACnC,SAAgB,cAAc,EAAE,cAAc,CAAC;IAC/C,SAAgB,OAAO,EAAE,OAAO,CAAC;IACjC,SAAgB,OAAO,EAAE,OAAO,CAAC;IACjC,SAAgB,WAAW,EAAE,WAAW,CAAC;IAEzC;;;;;OAKG;gBACS,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;gBACvC,OAAO,CAAC,EAAE,YAAY;CAkDnC"}

package/dist/cjs/client.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Proof = void 0;
+const http_js_1 = require("./http.js");
+const verifications_js_1 = require("./resources/verifications.js");
+const verification_requests_js_1 = require("./resources/verification-requests.js");
+const proofs_js_1 = require("./resources/proofs.js");
+const sessions_js_1 = require("./resources/sessions.js");
+const webhook_deliveries_js_1 = require("./resources/webhook-deliveries.js");
+const confirmations_js_1 = require("./resources/confirmations.js");
+const auth_sessions_js_1 = require("./resources/auth-sessions.js");
+const me_js_1 = require("./resources/me.js");
+const hitl_js_1 = require("./resources/hitl.js");
+const hitl_chat_id_js_1 = require("./resources/hitl-chat-id.js");
+const hitl_keys_js_1 = require("./resources/hitl-keys.js");
+const authorizations_js_1 = require("./resources/authorizations.js");
+const templates_js_1 = require("./resources/templates.js");
+const profiles_js_1 = require("./resources/profiles.js");
+const public_profiles_js_1 = require("./resources/public-profiles.js");
+const proof_me_js_1 = require("./resources/proof-me.js");
+const circles_js_1 = require("./resources/circles.js");
+const delegations_js_1 = require("./resources/delegations.js");
+const credentials_js_1 = require("./credentials.js");
+const DEFAULT_TIMEOUT = 30000;
+const DEFAULT_MAX_RETRIES = 2;
+class Proof {
+    constructor(apiKeyOrOptions, maybeOptions) {
+        const options = typeof apiKeyOrOptions === 'object' && apiKeyOrOptions !== null ? apiKeyOrOptions : maybeOptions;
+        const explicit = typeof apiKeyOrOptions === 'string' ? apiKeyOrOptions : options?.apiKey;
+        const baseUrl = (0, credentials_js_1.resolveBaseUrl)(options?.baseUrl);
+        if (explicit === '') {
+            throw new Error('API key is required. Pass your key as the first argument: new Proof("pk_live_...")');
+        }
+        const resolved = (0, credentials_js_1.resolveApiKey)({ explicit, baseUrl });
+        if (!resolved.apiKey) {
+            throw new Error((0, credentials_js_1.missingKeyMessage)(baseUrl, resolved.notice));
+        }
+        const apiKey = resolved.apiKey;
+        const fetchFn = options?.fetch ?? globalThis.fetch;
+        if (!fetchFn) {
+            throw new Error('fetch is not available in this environment. ' +
+                'Provide a custom fetch implementation via options.fetch, ' +
+                'or use Node.js 18+ which includes native fetch.');
+        }
+        const http = new http_js_1.HttpClient({
+            apiKey,
+            baseUrl,
+            timeout: options?.timeout ?? DEFAULT_TIMEOUT,
+            maxRetries: options?.maxRetries ?? DEFAULT_MAX_RETRIES,
+            fetch: fetchFn,
+        });
+        this.verifications = new verifications_js_1.Verifications(http);
+        this.verificationRequests = new verification_requests_js_1.VerificationRequests(http);
+        this.proofs = new proofs_js_1.Proofs(http, { maxJwksAgeMs: options?.maxJwksAgeMs });
+        this.sessions = new sessions_js_1.Sessions(http);
+        this.webhookDeliveries = new webhook_deliveries_js_1.WebhookDeliveries(http);
+        this.confirmations = new confirmations_js_1.Confirmations(http);
+        this.authSessions = new auth_sessions_js_1.AuthSessions(http);
+        this.me = new me_js_1.Me(http);
+        this.hitl = new hitl_js_1.Hitl(http);
+        this.hitlChatIdDiscovery = new hitl_chat_id_js_1.HitlChatIdDiscovery(http);
+        this.hitlKeys = new hitl_keys_js_1.HitlKeys(http);
+        this.authorizations = new authorizations_js_1.Authorizations(http);
+        this.templates = new templates_js_1.Templates(http);
+        this.profiles = new profiles_js_1.Profiles(http);
+        this.publicProfiles = new public_profiles_js_1.PublicProfiles(http);
+        this.proofMe = new proof_me_js_1.ProofMe(http);
+        this.circles = new circles_js_1.Circles(http);
+        this.delegations = new delegations_js_1.Delegations(http);
+    }
+}
+exports.Proof = Proof;
+//# sourceMappingURL=client.js.map

package/dist/cjs/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":";;;AAAA,uCAAuC;AACvC,mEAA6D;AAC7D,mFAA4E;AAC5E,qDAA+C;AAC/C,yDAAmD;AACnD,6EAAsE;AACtE,mEAA6D;AAC7D,mEAA4D;AAC5D,6CAAuC;AACvC,iDAA2C;AAC3C,iEAAkE;AAClE,2DAAoD;AACpD,qEAA+D;AAC/D,2DAAqD;AACrD,yDAAmD;AACnD,uEAAgE;AAChE,yDAAkD;AAClD,uDAAiD;AACjD,+DAAyD;AAEzD,qDAAoF;AAEpF,MAAM,eAAe,GAAG,KAAM,CAAC;AAC/B,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAE9B,MAAa,KAAK;IA4BhB,YAAY,eAAuC,EAAE,YAA2B;QAC9E,MAAM,OAAO,GAAG,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC;QACjH,MAAM,QAAQ,GAAG,OAAO,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC;QACzF,MAAM,OAAO,GAAG,IAAA,+BAAc,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACjD,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAC;QACxG,CAAC;QACD,MAAM,QAAQ,GAAG,IAAA,8BAAa,EAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,IAAA,kCAAiB,EAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QAE/B,MAAM,OAAO,GAAG,OAAO,EAAE,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;QACnD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,8CAA8C;gBAC9C,2DAA2D;gBAC3D,iDAAiD,CAClD,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,oBAAU,CAAC;YAC1B,MAAM;YACN,OAAO;YACP,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,eAAe;YAC5C,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,mBAAmB;YACtD,KAAK,EAAE,OAAO;SACf,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,GAAG,IAAI,gCAAa,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,oBAAoB,GAAG,IAAI,+CAAoB,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,GAAG,IAAI,kBAAM,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,GAAG,IAAI,sBAAQ,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,iBAAiB,GAAG,IAAI,yCAAiB,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,aAAa,GAAG,IAAI,gCAAa,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,YAAY,GAAG,IAAI,+BAAY,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,EAAE,GAAG,IAAI,UAAE,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,cAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,mBAAmB,GAAG,IAAI,qCAAmB,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,GAAG,IAAI,uBAAQ,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,cAAc,GAAG,IAAI,kCAAc,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,GAAG,IAAI,wBAAS,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ,GAAG,IAAI,sBAAQ,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,cAAc,GAAG,IAAI,mCAAc,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,GAAG,IAAI,qBAAO,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO,GAAG,IAAI,oBAAO,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,WAAW,GAAG,IAAI,4BAAW,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;CACF;AA7ED,sBA6EC"}

package/dist/cjs/credentials.d.ts

@@ -0,0 +1,46 @@
+/** The scoped command, never the bare bin name: through npx the unscoped name resolves to a package somebody else publishes. */
+export declare const LOGIN_COMMAND = "npx @proof-holdings/mcp-server login";
+export declare const DEFAULT_BASE_URL = "https://api.proof.holdings";
+export interface StoredCredential {
+    api_key: string;
+    key_id: string;
+    name: string;
+    environment: 'production' | 'test';
+    created_at: string;
+}
+export interface CredentialsFile {
+    version: 1;
+    credentials: Record<string, StoredCredential>;
+}
+export type KeySource = 'explicit' | 'env' | 'file' | 'none';
+export interface ResolvedKey {
+    apiKey?: string;
+    source: KeySource;
+    /** Why the file could not be used, when it exists but was not read — never a key. */
+    notice?: string;
+}
+/** The file exists but cannot be read or is not a credentials file this version understands. */
+export declare class CredentialsFileError extends Error {
+    constructor(message: string);
+}
+export declare function defaultCredentialsPath(): string;
+/** Origin plus path, no trailing slash — the entry name `npx @proof-holdings/mcp-server login` saves under. */
+export declare function credentialKey(baseUrl: string): string;
+/** Explicit, else a non-empty PROOF_BASE_URL, else the default. */
+export declare function resolveBaseUrl(explicit?: string, env?: NodeJS.ProcessEnv): string;
+/** The parsed file, `null` when there is none, `CredentialsFileError` when it is unreadable or malformed. */
+export declare function readCredentialsFile(file: string): CredentialsFile | null;
+/**
+ * The chain: an explicit key as given (the constructor decides whether `''` is acceptable), else a
+ * non-empty `PROOF_API_KEY`, else the saved entry for exactly `baseUrl`, else none. A broken file or
+ * a base URL that is not a URL never throws here — it becomes a notice on the `none` answer.
+ */
+export declare function resolveApiKey(opts: {
+    explicit?: string;
+    baseUrl: string;
+    file?: string;
+    env?: NodeJS.ProcessEnv;
+}): ResolvedKey;
+/** The one message a missing key produces, whatever road the caller tried. */
+export declare function missingKeyMessage(baseUrl: string, notice?: string): string;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/cjs/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/credentials.ts"],"names":[],"mappings":"AAiBA,gIAAgI;AAChI,eAAO,MAAM,aAAa,yCAAyC,CAAC;AACpE,eAAO,MAAM,gBAAgB,+BAA+B,CAAC;AAE7D,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,YAAY,GAAG,MAAM,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC/C;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAE7D,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,SAAS,CAAC;IAClB,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,gGAAgG;AAChG,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED,+GAA+G;AAC/G,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED,mEAAmE;AACnE,wBAAgB,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE9F;AAcD,6GAA6G;AAC7G,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAsBxE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,GAAG,WAAW,CAgC/H;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAM1E"}

package/dist/cjs/credentials.js

@@ -0,0 +1,137 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialsFileError = exports.DEFAULT_BASE_URL = exports.LOGIN_COMMAND = void 0;
+exports.defaultCredentialsPath = defaultCredentialsPath;
+exports.credentialKey = credentialKey;
+exports.resolveBaseUrl = resolveBaseUrl;
+exports.readCredentialsFile = readCredentialsFile;
+exports.resolveApiKey = resolveApiKey;
+exports.missingKeyMessage = missingKeyMessage;
+/**
+ * Where the key comes from when `new Proof()` is given none.
+ *
+ * The chain is the MCP server's (`mcp/src/credentials.ts`, the reference): a non-empty
+ * `PROOF_API_KEY`, else the entry `npx @proof-holdings/mcp-server login` saved for exactly this
+ * base URL in `~/.proof-holdings/credentials`, else none. It runs ONLY when the key argument is
+ * omitted — an explicit key is used as given, and an explicit empty one is the caller's error and
+ * never reads the environment or the file (a multi-tenant host passing a tenant's key must not
+ * fall through to its own). The shared cases in `sdks/shared/fixtures/credentials/cases.json`
+ * hold this module and the other three SDKs to the reference.
+ *
+ * Node built-ins only, like the reference: the client imports this on every construction.
+ */
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+/** The scoped command, never the bare bin name: through npx the unscoped name resolves to a package somebody else publishes. */
+exports.LOGIN_COMMAND = 'npx @proof-holdings/mcp-server login';
+exports.DEFAULT_BASE_URL = 'https://api.proof.holdings';
+/** The file exists but cannot be read or is not a credentials file this version understands. */
+class CredentialsFileError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CredentialsFileError';
+    }
+}
+exports.CredentialsFileError = CredentialsFileError;
+function defaultCredentialsPath() {
+    return (0, node_path_1.join)((0, node_os_1.homedir)(), '.proof-holdings', 'credentials');
+}
+/** Origin plus path, no trailing slash — the entry name `npx @proof-holdings/mcp-server login` saves under. */
+function credentialKey(baseUrl) {
+    const url = new URL(baseUrl);
+    return url.origin + url.pathname.replace(/\/+$/, '');
+}
+/** Explicit, else a non-empty PROOF_BASE_URL, else the default. */
+function resolveBaseUrl(explicit, env = process.env) {
+    return explicit ?? (env.PROOF_BASE_URL || exports.DEFAULT_BASE_URL);
+}
+function isStoredCredential(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const v = value;
+    return (typeof v.api_key === 'string' && v.api_key.startsWith('pk_') &&
+        typeof v.key_id === 'string' &&
+        typeof v.name === 'string' &&
+        typeof v.created_at === 'string' &&
+        (v.environment === 'production' || v.environment === 'test'));
+}
+/** The parsed file, `null` when there is none, `CredentialsFileError` when it is unreadable or malformed. */
+function readCredentialsFile(file) {
+    let raw;
+    try {
+        raw = (0, node_fs_1.readFileSync)(file, 'utf8');
+    }
+    catch (e) {
+        if (e.code === 'ENOENT')
+            return null;
+        throw new CredentialsFileError(`cannot read ${file}: ${e.message}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new CredentialsFileError(`${file} is not valid JSON`);
+    }
+    const p = parsed;
+    if (!p || typeof p !== 'object' || p.version !== 1 || !p.credentials || typeof p.credentials !== 'object' || Array.isArray(p.credentials)) {
+        throw new CredentialsFileError(`${file} is not a version 1 Proof credentials file`);
+    }
+    for (const [key, value] of Object.entries(p.credentials)) {
+        if (!isStoredCredential(value))
+            throw new CredentialsFileError(`${file} has a malformed entry for ${key}`);
+    }
+    return p;
+}
+/**
+ * The chain: an explicit key as given (the constructor decides whether `''` is acceptable), else a
+ * non-empty `PROOF_API_KEY`, else the saved entry for exactly `baseUrl`, else none. A broken file or
+ * a base URL that is not a URL never throws here — it becomes a notice on the `none` answer.
+ */
+function resolveApiKey(opts) {
+    if (typeof opts.explicit === 'string')
+        return { apiKey: opts.explicit, source: 'explicit' };
+    const env = opts.env ?? process.env;
+    if (env.PROOF_API_KEY)
+        return { apiKey: env.PROOF_API_KEY, source: 'env' };
+    let file;
+    try {
+        file = opts.file ?? defaultCredentialsPath();
+    }
+    catch {
+        // No home directory to look in (a sandbox without one): the same answer as no file.
+        return { source: 'none' };
+    }
+    let contents;
+    try {
+        contents = readCredentialsFile(file);
+    }
+    catch (e) {
+        return {
+            source: 'none',
+            notice: `ignoring the saved credentials — ${e.message}. Fix or delete ${file}, then run ${exports.LOGIN_COMMAND}.`,
+        };
+    }
+    if (!contents)
+        return { source: 'none' };
+    let key;
+    try {
+        key = credentialKey(opts.baseUrl);
+    }
+    catch {
+        return {
+            source: 'none',
+            notice: `the base URL ${JSON.stringify(opts.baseUrl)} is not a URL, so the saved credentials in ${file} were not read.`,
+        };
+    }
+    const entry = contents.credentials[key];
+    return entry ? { apiKey: entry.api_key, source: 'file' } : { source: 'none' };
+}
+/** The one message a missing key produces, whatever road the caller tried. */
+function missingKeyMessage(baseUrl, notice) {
+    return (`API key is required. Pass your key as the first argument: new Proof("pk_live_..."), ` +
+        `set PROOF_API_KEY, or run \`${exports.LOGIN_COMMAND}\` to save one for ${baseUrl}.` +
+        (notice ? ` ${notice}` : ''));
+}
+//# sourceMappingURL=credentials.js.map

package/dist/cjs/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/credentials.ts"],"names":[],"mappings":";;;AAmDA,wDAEC;AAGD,sCAGC;AAGD,wCAEC;AAeD,kDAsBC;AAOD,sCAgCC;AAGD,8CAMC;AArJD;;;;;;;;;;;;GAYG;AACH,qCAAuC;AACvC,qCAAkC;AAClC,yCAAiC;AAEjC,gIAAgI;AACnH,QAAA,aAAa,GAAG,sCAAsC,CAAC;AACvD,QAAA,gBAAgB,GAAG,4BAA4B,CAAC;AAwB7D,gGAAgG;AAChG,MAAa,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AALD,oDAKC;AAED,SAAgB,sBAAsB;IACpC,OAAO,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;AAC3D,CAAC;AAED,+GAA+G;AAC/G,SAAgB,aAAa,CAAC,OAAe;IAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,mEAAmE;AACnE,SAAgB,cAAc,CAAC,QAAiB,EAAE,MAAyB,OAAO,CAAC,GAAG;IACpF,OAAO,QAAQ,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,wBAAgB,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CACL,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;QAC5D,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAChC,CAAC,CAAC,CAAC,WAAW,KAAK,YAAY,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,6GAA6G;AAC7G,SAAgB,mBAAmB,CAAC,IAAY;IAC9C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAChE,MAAM,IAAI,oBAAoB,CAAC,eAAe,IAAI,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,CAAC,GAAG,MAAyC,CAAC;IACpD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1I,MAAM,IAAI,oBAAoB,CAAC,GAAG,IAAI,4CAA4C,CAAC,CAAC;IACtF,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,oBAAoB,CAAC,GAAG,IAAI,8BAA8B,GAAG,EAAE,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,CAAoB,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,IAAoF;IAChH,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC5F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,IAAI,GAAG,CAAC,aAAa;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3E,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,sBAAsB,EAAE,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,oFAAoF;QACpF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,QAAgC,CAAC;IACrC,IAAI,CAAC;QACH,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,oCAAqC,CAAW,CAAC,OAAO,mBAAmB,IAAI,cAAc,qBAAa,GAAG;SACtH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACzC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,gBAAgB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,8CAA8C,IAAI,iBAAiB;SACxH,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAChF,CAAC;AAED,8EAA8E;AAC9E,SAAgB,iBAAiB,CAAC,OAAe,EAAE,MAAe;IAChE,OAAO,CACL,sFAAsF;QACtF,+BAA+B,qBAAa,sBAAsB,OAAO,GAAG;QAC5E,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC7B,CAAC;AACJ,CAAC"}