@solidus-network/auth 0.6.0 → 0.6.2

package/dist/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../src/envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,uFAAuF;AACvF,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,aAAa;IACb,YAAY;IACZ,iBAAiB;IACjB,aAAa;IACb,WAAW;IACX,SAAS;IACT,eAAe;IACf,eAAe;CACP,CAAA;AAEV;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAU,CAAA;AAE3D,MAAM,CAAC,MAAM,qBAAqB,GAAG,oCAAoC,CAAA;AA2BzE,MAAM,MAAM,GAAG,cAAc,CAAA;AAE7B,SAAS,KAAK,CAAC,CAAS;IACtB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAA;AAC7C,CAAC;AAYD,kEAAkE;AAClE,MAAM,UAAU,oBAAoB,CAClC,KAAgC;IAEhC,MAAM,QAAQ,GAAuC;QACnD,IAAI,EAAE,qBAAqB;QAC3B,CAAC,EAAE,QAAQ;QACX,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,QAAQ;QACrB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/E,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;KAC3C,CAAA;IACD,mBAAmB,CAAC,QAAQ,CAAC,CAAA;IAC7B,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,IAAI,GAAY,CAAA;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IACnD,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;IACvD,CAAC;IACD,MAAM,CAAC,GAAG,GAA8B,CAAA;IACxC,MAAM,QAAQ,GAAuC;QACnD,IAAI,EAAE,CAAC,CAAC,MAAM,CAAiC;QAC/C,CAAC,EAAE,CAAC,CAAC,GAAG,CAAa;QACrB,WAAW,EAAE,CAAC,CAAC,aAAa,CAAW;QACvC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAW;QAC3B,KAAK,EAAE,CAAC,CAAC,OAAO,CAAW;QAC3B,iBAAiB,EAAE,CAAC,CAAC,mBAAmB,CAAW;QACnD,SAAS,EAAE,CAAC,CAAC,WAAW,CAAuB;QAC/C,WAAW,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,IAAI,CAAkB;QACxD,aAAa,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,IAAI,CAAmC;KAC9E,CAAA;IACD,mBAAmB,CAAC,QAAQ,CAAC,CAAA;IAC7B,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,mBAAmB,CAAC,CAAqC;IAChE,IAAI,CAAC,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,6BAA6B,qBAAqB,EAAE,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IACzE,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;IACzD,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;IAChD,CAAC;IACD,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC;QACtC,CAAC,CAAC,iBAAiB,GAAG,CAAC;QACvB,CAAC,CAAC,iBAAiB,GAAG,EAAE,EACxB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IACnD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAC9E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAC5B,IACE,OAAO,CAAC,KAAK,QAAQ;YACrB,CAAC,KAAK,IAAI;YACV,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;YAC1B,CAAC,CAAC,KAAK,GAAG,CAAC;YACX,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,iBAAiB;YAC9B,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;YAC7B,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EACjB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;QAChF,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;QAC9E,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IACnB,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IACD,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QACxG,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,SAA6B;IAE7B,MAAM,GAAG,GAAiE,EAAE,CAAA;IAC5E,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,CAAC,KAAK;YAAE,SAAQ;QACpB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAC5D,CAAC;QACD,GAAG,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACpC,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/index.d.ts

@@ -1,5 +1,11 @@
-export { createChallenge } from './challenge.js';
-export type { Challenge } from './challenge.js';
-export { verifyPresentation } from './verify.js';
-export type { VerifiablePresentation, PresentationVerificationResult } from './verify.js';
+export { createChallenge, createBbsChallenge } from './challenge.js';
+export type { Challenge, BbsChallenge } from './challenge.js';
+export { verifyPresentation, verifyBbsPresentation } from './verify.js';
+export type { VerifiablePresentation, PresentationVerificationResult, BbsVerifyOptions, BbsPresentationVerificationResult, } from './verify.js';
+export { buildBbsPresentation, parseBbsPresentation, decodeDisclosedKycFields, KYC_MESSAGE_FIELDS, ALWAYS_HIDDEN_KYC_INDICES, BBS_PRESENTATION_TYPE, } from './envelope.js';
+export type { BbsSelectiveDisclosurePresentation, DisclosedMessage, BuildBbsPresentationInput, } from './envelope.js';
+export { buildPairwiseAttachment, buildPairwiseDid, pairwiseAddressFromPublicKey, asPairwiseAttachment, } from './pairwise.js';
+export type { PairwiseAttachment } from './pairwise.js';
+export { createIssuerKeyResolver } from './rp.js';
+export type { IssuerKeyResolverOptions } from './rp.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAChD,YAAY,EAAE,sBAAsB,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACpE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7D,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACvE,YAAY,EACV,sBAAsB,EACtB,8BAA8B,EAC9B,gBAAgB,EAChB,iCAAiC,GAClC,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,EAClB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,eAAe,CAAA;AACtB,YAAY,EACV,kCAAkC,EAClC,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,eAAe,CAAA;AACtB,YAAY,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAA;AACjD,YAAY,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAA"}

package/dist/index.js

@@ -1,3 +1,6 @@
-export { createChallenge } from './challenge.js';
-export { verifyPresentation } from './verify.js';
+export { createChallenge, createBbsChallenge } from './challenge.js';
+export { verifyPresentation, verifyBbsPresentation } from './verify.js';
+export { buildBbsPresentation, parseBbsPresentation, decodeDisclosedKycFields, KYC_MESSAGE_FIELDS, ALWAYS_HIDDEN_KYC_INDICES, BBS_PRESENTATION_TYPE, } from './envelope.js';
+export { buildPairwiseAttachment, buildPairwiseDid, pairwiseAddressFromPublicKey, asPairwiseAttachment, } from './pairwise.js';
+export { createIssuerKeyResolver } from './rp.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAEhD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAEpE,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAOvE,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,EAClB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,eAAe,CAAA;AAMtB,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,eAAe,CAAA;AAEtB,OAAO,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAA"}

package/dist/pairwise.d.ts

@@ -0,0 +1,36 @@
+import type { VerifiablePresentation } from './verify.js';
+/** The self-certifying attachment carried in the envelope's `pairwiseProof`. */
+export interface PairwiseAttachment {
+    /** Hex pairwise public key — the verifier binds this to the pairwise DID. */
+    publicKeyHex: string;
+    /** Standard W3C VP signed by the pairwise key, holder = the pairwise DID. */
+    vp: VerifiablePresentation;
+}
+declare function hexToBytes(hex: string): Uint8Array;
+/** `addr = base58(BLAKE3(pubkey)[0..20])` — mirrors the SDK `addressFromPublicKey`. */
+export declare function pairwiseAddressFromPublicKey(publicKey: Uint8Array): string;
+/** `did:solidus:{network}:{addr}` — the self-certifying pairwise DID (never on-chain). */
+export declare function buildPairwiseDid(network: string, publicKey: Uint8Array): string;
+/**
+ * Build the pairwise VP attachment. Takes the ALREADY-DERIVED pairwise key
+ * (the wallet derives it via `derivePairwiseKeyFromSeed` under the verifier's
+ * authenticated id) plus the challenge nonce it must sign over. The produced
+ * VP is byte-compatible with the shipped DID-bound `verifyPresentation`.
+ */
+export declare function buildPairwiseAttachment(opts: {
+    /** 32-byte pairwise private key, hex. */
+    pairwisePrivateKeyHex: string;
+    /** Verifier's network (goes into the DID). */
+    network: string;
+    /** The challenge nonce — the VP's `proof.challenge`. */
+    nonce: string;
+    /** ISO timestamp; defaults to now. */
+    created?: string;
+}): Promise<{
+    pairwiseDid: string;
+    attachment: PairwiseAttachment;
+}>;
+/** Narrow an unknown envelope `pairwiseProof` to a `PairwiseAttachment`. */
+export declare function asPairwiseAttachment(value: unknown): PairwiseAttachment | null;
+export { hexToBytes as _pairwiseHexToBytes };
+//# sourceMappingURL=pairwise.d.ts.map

package/dist/pairwise.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairwise.d.ts","sourceRoot":"","sources":["../src/pairwise.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAEzD,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IACjC,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAA;IACpB,6EAA6E;IAC7E,EAAE,EAAE,sBAAsB,CAAA;CAC3B;AAED,iBAAS,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAI3C;AAiBD,uFAAuF;AACvF,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,UAAU,GAAG,MAAM,CAE1E;AAED,0FAA0F;AAC1F,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,MAAM,CAG/E;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,yCAAyC;IACzC,qBAAqB,EAAE,MAAM,CAAA;IAC7B,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAA;IACf,wDAAwD;IACxD,KAAK,EAAE,MAAM,CAAA;IACb,sCAAsC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,kBAAkB,CAAA;CAAE,CAAC,CAgCnE;AAED,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,GAAG,IAAI,CAU9E;AAED,OAAO,EAAE,UAAU,IAAI,mBAAmB,EAAE,CAAA"}

package/dist/pairwise.js

@@ -0,0 +1,115 @@
+/**
+ * Pairwise-DID re-recognition (privacy rebuild §5.4 — mechanism B).
+ *
+ * "Remember me at THIS verifier" without two verifiers colluding. Beside the
+ * one-shot SD proof, the wallet attaches a standard W3C VP signed by a
+ * per-verifier pairwise key (derived via `derivePairwiseKeyFromSeed`, §5.1).
+ * The pairwise DID is a SELF-CERTIFYING string — `did:solidus:{network}:{addr}`
+ * where `addr = base58(BLAKE3(pubkey)[0..20])` — and is NEVER registered
+ * on-chain (an on-chain anchor would itself be a correlation handle, BD-7).
+ *
+ * The verifier recognizes a returning user because the same (seed, verifier)
+ * always yields the same pairwise DID; two verifiers get independent HKDF
+ * outputs, so they cannot link the same person.
+ *
+ * Authenticity caveat (§5.4): the WALLET must derive the pairwise key under
+ * the verifier's OWN authenticated identity (its TLS origin = the challenge
+ * `domain`), never a `verifier_id` copied blindly from an untrusted channel —
+ * else verifier A can request B's pseudonym and collude. This module verifies
+ * the binding + signature; the wallet owns the "derive under the right id" step.
+ *
+ * Weakness (surfaced, not buried): mechanism B proves two things SIDE BY SIDE,
+ * not jointly — "holds a valid Solidus KYC credential" (the b.1 proof) and
+ * "controls this pairwise key" (the VP) — nothing cryptographically binds them
+ * to the SAME seed. Assurance tops out at "a returning controller of this key
+ * who can also show some valid Solidus credential," fine for cooperative
+ * re-recognition. Access-control-grade "provably the same KYC holder" needs
+ * mechanism C — swapped in later behind the same verifier_id→handle contract.
+ */
+import * as ed from '@noble/ed25519';
+import { blake3 } from '@noble/hashes/blake3';
+import bs58 from 'bs58';
+function hexToBytes(hex) {
+    const bytes = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < bytes.length; i++)
+        bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    return bytes;
+}
+function bytesToHex(bytes) {
+    let out = '';
+    for (let i = 0; i < bytes.length; i++)
+        out += bytes[i].toString(16).padStart(2, '0');
+    return out;
+}
+function base64url(bytes) {
+    // Browser-safe base64url (no node Buffer) so this module can move into the
+    // wallet later without change.
+    let bin = '';
+    for (let i = 0; i < bytes.length; i++)
+        bin += String.fromCharCode(bytes[i]);
+    const b64 = typeof btoa === 'function' ? btoa(bin) : Buffer.from(bytes).toString('base64');
+    return b64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/** `addr = base58(BLAKE3(pubkey)[0..20])` — mirrors the SDK `addressFromPublicKey`. */
+export function pairwiseAddressFromPublicKey(publicKey) {
+    return bs58.encode(blake3(publicKey).slice(0, 20));
+}
+/** `did:solidus:{network}:{addr}` — the self-certifying pairwise DID (never on-chain). */
+export function buildPairwiseDid(network, publicKey) {
+    if (!network)
+        throw new Error('network must be non-empty');
+    return `did:solidus:${network}:${pairwiseAddressFromPublicKey(publicKey)}`;
+}
+/**
+ * Build the pairwise VP attachment. Takes the ALREADY-DERIVED pairwise key
+ * (the wallet derives it via `derivePairwiseKeyFromSeed` under the verifier's
+ * authenticated id) plus the challenge nonce it must sign over. The produced
+ * VP is byte-compatible with the shipped DID-bound `verifyPresentation`.
+ */
+export async function buildPairwiseAttachment(opts) {
+    const priv = hexToBytes(opts.pairwisePrivateKeyHex);
+    const pub = await ed.getPublicKeyAsync(priv);
+    const pairwiseDid = buildPairwiseDid(opts.network, pub);
+    // Presentation (proof added after signing) — key order MUST match what
+    // `verifyPresentation` reconstructs (it strips `proof` and stringifies).
+    const presentation = {
+        '@context': ['https://www.w3.org/2018/credentials/v1'],
+        type: ['VerifiablePresentation'],
+        holder: pairwiseDid,
+    };
+    const header = { alg: 'EdDSA', b64: false, crit: ['b64'] };
+    const headerB64 = base64url(new TextEncoder().encode(JSON.stringify(header)));
+    const payloadB64 = base64url(new TextEncoder().encode(JSON.stringify(presentation)));
+    const signingInput = `${headerB64}.${payloadB64}`;
+    const signature = await ed.signAsync(new TextEncoder().encode(signingInput), priv);
+    const jws = `${headerB64}..${base64url(signature)}`;
+    const vp = {
+        ...presentation,
+        proof: {
+            type: 'Ed25519Signature2020',
+            created: opts.created ?? new Date().toISOString(),
+            challenge: opts.nonce,
+            proofPurpose: 'authentication',
+            verificationMethod: `${pairwiseDid}#key-0`,
+            jws,
+        },
+    };
+    return { pairwiseDid, attachment: { publicKeyHex: bytesToHex(pub), vp } };
+}
+/** Narrow an unknown envelope `pairwiseProof` to a `PairwiseAttachment`. */
+export function asPairwiseAttachment(value) {
+    if (typeof value !== 'object' || value === null)
+        return null;
+    const a = value;
+    if (typeof a['publicKeyHex'] !== 'string')
+        return null;
+    if (typeof a['vp'] !== 'object' || a['vp'] === null)
+        return null;
+    const vp = a['vp'];
+    if (typeof vp['holder'] !== 'string' || typeof vp['proof'] !== 'object' || vp['proof'] === null) {
+        return null;
+    }
+    return value;
+}
+export { hexToBytes as _pairwiseHexToBytes };
+//# sourceMappingURL=pairwise.js.map

package/dist/pairwise.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairwise.js","sourceRoot":"","sources":["../src/pairwise.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,IAAI,MAAM,MAAM,CAAA;AAWvB,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC3F,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACrF,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,2EAA2E;IAC3E,+BAA+B;IAC/B,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAA;IAC5E,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC1F,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACvE,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,4BAA4B,CAAC,SAAqB;IAChE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;AACpD,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,SAAqB;IACrE,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;IAC1D,OAAO,eAAe,OAAO,IAAI,4BAA4B,CAAC,SAAS,CAAC,EAAE,CAAA;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAS7C;IACC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;IACnD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAA;IAC5C,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAEvD,uEAAuE;IACvE,yEAAyE;IACzE,MAAM,YAAY,GAAG;QACnB,UAAU,EAAE,CAAC,wCAAwC,CAAC;QACtD,IAAI,EAAE,CAAC,wBAAwB,CAAC;QAChC,MAAM,EAAE,WAAW;KACpB,CAAA;IACD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAA;IAC1D,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IAC7E,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACpF,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAA;IACjD,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,CAAA;IAClF,MAAM,GAAG,GAAG,GAAG,SAAS,KAAK,SAAS,CAAC,SAAS,CAAC,EAAE,CAAA;IAEnD,MAAM,EAAE,GAA2B;QACjC,GAAG,YAAY;QACf,KAAK,EAAE;YACL,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACjD,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,YAAY,EAAE,gBAAgB;YAC9B,kBAAkB,EAAE,GAAG,WAAW,QAAQ;YAC1C,GAAG;SACJ;KACF,CAAA;IAED,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,CAAA;AAC3E,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC5D,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,IAAI,OAAO,CAAC,CAAC,cAAc,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACtD,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAChE,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAA4B,CAAA;IAC7C,IAAI,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QAChG,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,KAA2B,CAAA;AACpC,CAAC;AAED,OAAO,EAAE,UAAU,IAAI,mBAAmB,EAAE,CAAA"}

package/dist/rp.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Relying-party surface (privacy rebuild §5.7).
+ *
+ * The verifier primitives — `createBbsChallenge` (issue a DID-less challenge)
+ * and `verifyBbsPresentation` (stateless verify) — are the RP SDK. This module
+ * adds the batteries a third-party verifier would otherwise hand-roll: an
+ * issuer-key resolver that fetches `/.well-known/solidus-bbs-issuer.json`,
+ * caches the current + grace epoch pubkeys, and returns exactly the
+ * `resolveIssuerKey(epoch)` function `verifyBbsPresentation` expects.
+ *
+ * FAIL-CLOSED by design: an unknown/lapsed epoch, an unreachable issuer, a
+ * non-200, or a malformed doc all resolve to `null` — never a key — so the
+ * verify path rejects rather than accepting on error. That is also the
+ * bounded-lifetime enforcement point (a lapsed epoch is simply absent from the
+ * doc → null → reject; §5.5).
+ *
+ * Browser-safe (fetch only); works in an RP backend or a browser verifier.
+ */
+export interface IssuerKeyResolverOptions {
+    /** The issuer's base URL, e.g. `https://verify.solidus.network`. */
+    issuerBaseUrl: string;
+    /** Injectable for tests / custom transports. */
+    fetchImpl?: typeof fetch;
+    /** How long to cache the fetched doc. Default 5 min (matches its Cache-Control). */
+    cacheTtlMs?: number;
+    /** Clock injection for tests. */
+    now?: () => number;
+}
+/**
+ * Build a caching, fail-closed `resolveIssuerKey(epoch) => Promise<string|null>`
+ * suitable to pass straight into `verifyBbsPresentation`'s options.
+ */
+export declare function createIssuerKeyResolver(opts: IssuerKeyResolverOptions): (epoch: number) => Promise<string | null>;
+//# sourceMappingURL=rp.d.ts.map

package/dist/rp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rp.d.ts","sourceRoot":"","sources":["../src/rp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAcH,MAAM,WAAW,wBAAwB;IACvC,oEAAoE;IACpE,aAAa,EAAE,MAAM,CAAA;IACrB,gDAAgD;IAChD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,iCAAiC;IACjC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,wBAAwB,GAC7B,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmC3C"}

package/dist/rp.js

@@ -0,0 +1,59 @@
+/**
+ * Relying-party surface (privacy rebuild §5.7).
+ *
+ * The verifier primitives — `createBbsChallenge` (issue a DID-less challenge)
+ * and `verifyBbsPresentation` (stateless verify) — are the RP SDK. This module
+ * adds the batteries a third-party verifier would otherwise hand-roll: an
+ * issuer-key resolver that fetches `/.well-known/solidus-bbs-issuer.json`,
+ * caches the current + grace epoch pubkeys, and returns exactly the
+ * `resolveIssuerKey(epoch)` function `verifyBbsPresentation` expects.
+ *
+ * FAIL-CLOSED by design: an unknown/lapsed epoch, an unreachable issuer, a
+ * non-200, or a malformed doc all resolve to `null` — never a key — so the
+ * verify path rejects rather than accepting on error. That is also the
+ * bounded-lifetime enforcement point (a lapsed epoch is simply absent from the
+ * doc → null → reject; §5.5).
+ *
+ * Browser-safe (fetch only); works in an RP backend or a browser verifier.
+ */
+/**
+ * Build a caching, fail-closed `resolveIssuerKey(epoch) => Promise<string|null>`
+ * suitable to pass straight into `verifyBbsPresentation`'s options.
+ */
+export function createIssuerKeyResolver(opts) {
+    const doFetch = opts.fetchImpl ?? globalThis.fetch;
+    const now = opts.now ?? (() => Date.now());
+    const ttl = opts.cacheTtlMs ?? 300_000;
+    const url = `${opts.issuerBaseUrl.replace(/\/$/, '')}/.well-known/solidus-bbs-issuer.json`;
+    let cache = null;
+    async function loadDoc() {
+        if (cache && now() - cache.fetchedAt < ttl)
+            return cache.byEpoch;
+        const byEpoch = new Map();
+        try {
+            const res = await doFetch(url, { method: 'GET' });
+            if (res.ok) {
+                const doc = (await res.json());
+                if (doc?.current && typeof doc.current.pubkeyHex === 'string') {
+                    byEpoch.set(doc.current.epoch, doc.current.pubkeyHex);
+                    for (const g of doc.grace ?? []) {
+                        if (typeof g?.pubkeyHex === 'string')
+                            byEpoch.set(g.epoch, g.pubkeyHex);
+                    }
+                }
+            }
+        }
+        catch {
+            // Fail-closed: leave byEpoch empty → every resolve returns null → reject.
+        }
+        // Cache even an empty result briefly so a hard-down issuer doesn't get
+        // hammered on every presentation; the short TTL bounds staleness.
+        cache = { byEpoch, fetchedAt: now() };
+        return byEpoch;
+    }
+    return async function resolveIssuerKey(epoch) {
+        const byEpoch = await loadDoc();
+        return byEpoch.get(epoch) ?? null;
+    };
+}
+//# sourceMappingURL=rp.js.map

package/dist/rp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rp.js","sourceRoot":"","sources":["../src/rp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAyBH;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAA8B;IAE9B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAK,UAAU,CAAC,KAAsB,CAAA;IACpE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,IAAI,OAAO,CAAA;IACtC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,sCAAsC,CAAA;IAE1F,IAAI,KAAK,GAA+D,IAAI,CAAA;IAE5E,KAAK,UAAU,OAAO;QACpB,IAAI,KAAK,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC,OAAO,CAAA;QAChE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAA;QACzC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;YACjD,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsB,CAAA;gBACnD,IAAI,GAAG,EAAE,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;oBAC9D,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;oBACrD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;wBAChC,IAAI,OAAO,CAAC,EAAE,SAAS,KAAK,QAAQ;4BAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC,CAAA;oBACzE,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;QACD,uEAAuE;QACvE,kEAAkE;QAClE,KAAK,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAA;QACrC,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,OAAO,KAAK,UAAU,gBAAgB,CAAC,KAAa;QAClD,MAAM,OAAO,GAAG,MAAM,OAAO,EAAE,CAAA;QAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAA;IACnC,CAAC,CAAA;AACH,CAAC"}

package/dist/verify.d.ts

@@ -1,4 +1,5 @@
-import type { Challenge } from './challenge.js';
+import type { Challenge, BbsChallenge } from './challenge.js';
+import { type BbsSelectiveDisclosurePresentation } from './envelope.js';
 export interface VerifiablePresentation {
     '@context': string[];
     /** Must include 'VerifiablePresentation' */
@@ -42,4 +43,78 @@ export interface PresentationVerificationResult {
  * @param getPublicKey - Async resolver: given a verificationMethod ID, return the Ed25519 public key (32 bytes)
  */
 export declare function verifyPresentation(challenge: Challenge, presentation: VerifiablePresentation, getPublicKey: (verificationMethodId: string) => Promise<Uint8Array>): Promise<PresentationVerificationResult>;
+export interface BbsVerifyOptions {
+    /** The trusted issuer DID (from the verifier's own policy, never the envelope). */
+    issuerDid: string;
+    /**
+     * Resolve the issuer's BBS pubkey (hex) for an epoch — typically from
+     * `/.well-known/solidus-bbs-issuer.json` (current + grace), cached.
+     * Return null for unknown/lapsed epochs.
+     */
+    resolveIssuerKey: (epoch: number) => Promise<string | null>;
+    /**
+     * Whether this challenge was already answered (storage-side single-use
+     * bookkeeping — the caller tracks it; this library only enforces it).
+     */
+    used?: boolean;
+    /**
+     * The verifier's network (e.g. 'testnet'). REQUIRED when the presentation
+     * carries a pairwise attachment — the pairwise DID binds to it. A pairwise
+     * attachment presented without a configured network fails closed.
+     */
+    network?: string;
+    /** Clock injection for tests. */
+    now?: () => Date;
+}
+export interface BbsPresentationVerificationResult {
+    valid: boolean;
+    error?: string;
+    /**
+     * DID-less by construction for the one-shot proof: no holder check of any
+     * kind. A presentation proves "a valid credential from the trusted issuer's
+     * (type, epoch) cohort, disclosing exactly these claims" — never who.
+     *
+     * The pairwise checks run ONLY when a re-recognition attachment is present
+     * (§5.4). They verify the self-certifying pairwise DID + its VP signature;
+     * they still reveal nothing that links the user across verifiers.
+     */
+    checks: {
+        notExpired: boolean;
+        notUsed: boolean;
+        challengeIdMatches: boolean;
+        noForbiddenDisclosure: boolean;
+        requiredDisclosed: boolean;
+        epochKeyResolved: boolean;
+        proofValid: boolean;
+        /** Present only when a pairwise attachment is included. */
+        pairwiseBindingValid?: boolean;
+        pairwiseSignatureValid?: boolean;
+    };
+    /**
+     * The verified pairwise DID (re-recognition handle) when the presentation
+     * carried a valid pairwise attachment. The verifier stores/matches this
+     * keyed by its own verifier id — the seam mechanism C swaps into later
+     * without the RP re-integrating.
+     */
+    pairwiseDid?: string;
+}
+/**
+ * Verify a DID-less selective-disclosure presentation against a challenge.
+ *
+ * Checks (fail-fast):
+ *  1. challenge not expired, not already used
+ *  2. envelope answers THIS challenge
+ *  3. no always-hidden index is disclosed (subject_did / verification_id /
+ *     document_hash) — enforced even when the proof itself is valid
+ *  4. every required index is disclosed
+ *  5. the issuer key for the envelope's epoch resolves (current or grace)
+ *  6. the BBS proof verifies under the RECONSTRUCTED header
+ *     (issuerDid + challenge.credentialType + envelope.epoch — never a
+ *     header taken from the envelope) and the ph recomputed from the
+ *     verifier's own domain + stored nonce
+ *
+ * Uses ONLY the stateless issuer-key check — never a per-credential
+ * chain lookup (`verifyCredentialProof` leaks subject_did; BD-5).
+ */
+export declare function verifyBbsPresentation(challenge: BbsChallenge, presentation: BbsSelectiveDisclosurePresentation, opts: BbsVerifyOptions): Promise<BbsPresentationVerificationResult>;
 //# sourceMappingURL=verify.d.ts.map

package/dist/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,4CAA4C;IAC5C,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,oBAAoB,CAAC,EAAE,OAAO,EAAE,GAAG,SAAS,CAAA;IAC5C,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,iCAAiC;QACjC,SAAS,EAAE,MAAM,CAAA;QACjB,YAAY,EAAE,MAAM,CAAA;QACpB,0CAA0C;QAC1C,kBAAkB,EAAE,MAAM,CAAA;QAC1B,4DAA4D;QAC5D,GAAG,EAAE,MAAM,CAAA;KACZ,CAAA;CACF;AAED,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,OAAO,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,EAAE;QACN,UAAU,EAAE,OAAO,CAAA;QACnB,aAAa,EAAE,OAAO,CAAA;QACtB,YAAY,EAAE,OAAO,CAAA;QACrB,cAAc,EAAE,OAAO,CAAA;KACxB,CAAA;CACF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,SAAS,EACpB,YAAY,EAAE,sBAAsB,EACpC,YAAY,EAAE,CAAC,oBAAoB,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,GAClE,OAAO,CAAC,8BAA8B,CAAC,CA8DzC"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7D,OAAO,EAEL,KAAK,kCAAkC,EACxC,MAAM,eAAe,CAAA;AAGtB,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,4CAA4C;IAC5C,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,oBAAoB,CAAC,EAAE,OAAO,EAAE,GAAG,SAAS,CAAA;IAC5C,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,iCAAiC;QACjC,SAAS,EAAE,MAAM,CAAA;QACjB,YAAY,EAAE,MAAM,CAAA;QACpB,0CAA0C;QAC1C,kBAAkB,EAAE,MAAM,CAAA;QAC1B,4DAA4D;QAC5D,GAAG,EAAE,MAAM,CAAA;KACZ,CAAA;CACF;AAED,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,OAAO,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,EAAE;QACN,UAAU,EAAE,OAAO,CAAA;QACnB,aAAa,EAAE,OAAO,CAAA;QACtB,YAAY,EAAE,OAAO,CAAA;QACrB,cAAc,EAAE,OAAO,CAAA;KACxB,CAAA;CACF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,SAAS,EACpB,YAAY,EAAE,sBAAsB,EACpC,YAAY,EAAE,CAAC,oBAAoB,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,GAClE,OAAO,CAAC,8BAA8B,CAAC,CA8DzC;AAOD,MAAM,WAAW,gBAAgB;IAC/B,mFAAmF;IACnF,SAAS,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAC3D;;;OAGG;IACH,IAAI,CAAC,EAAE,OAAO,CAAA;IACd;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,iCAAiC;IACjC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CACjB;AAED,MAAM,WAAW,iCAAiC;IAChD,KAAK,EAAE,OAAO,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;;;OAQG;IACH,MAAM,EAAE;QACN,UAAU,EAAE,OAAO,CAAA;QACnB,OAAO,EAAE,OAAO,CAAA;QAChB,kBAAkB,EAAE,OAAO,CAAA;QAC3B,qBAAqB,EAAE,OAAO,CAAA;QAC9B,iBAAiB,EAAE,OAAO,CAAA;QAC1B,gBAAgB,EAAE,OAAO,CAAA;QACzB,UAAU,EAAE,OAAO,CAAA;QACnB,2DAA2D;QAC3D,oBAAoB,CAAC,EAAE,OAAO,CAAA;QAC9B,sBAAsB,CAAC,EAAE,OAAO,CAAA;KACjC,CAAA;IACD;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAUD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,YAAY,EACvB,YAAY,EAAE,kCAAkC,EAChD,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,iCAAiC,CAAC,CA4H5C"}

package/dist/verify.js

@@ -1,4 +1,7 @@
 import * as ed from '@noble/ed25519';
+import { BbsProof, BbsPublicKey, buildV2Header, derivePresentationHeader } from '@solidus-network/bbs';
+import { ALWAYS_HIDDEN_KYC_INDICES, } from './envelope.js';
+import { asPairwiseAttachment, buildPairwiseDid } from './pairwise.js';
 /**
  * Verify a W3C Verifiable Presentation against a challenge.
  *
@@ -60,4 +63,138 @@ export async function verifyPresentation(challenge, presentation, getPublicKey)
     }
     return { valid: true, checks };
 }
+function hexToBytes(hex) {
+    const bytes = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < bytes.length; i++) {
+        bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    }
+    return bytes;
+}
+/**
+ * Verify a DID-less selective-disclosure presentation against a challenge.
+ *
+ * Checks (fail-fast):
+ *  1. challenge not expired, not already used
+ *  2. envelope answers THIS challenge
+ *  3. no always-hidden index is disclosed (subject_did / verification_id /
+ *     document_hash) — enforced even when the proof itself is valid
+ *  4. every required index is disclosed
+ *  5. the issuer key for the envelope's epoch resolves (current or grace)
+ *  6. the BBS proof verifies under the RECONSTRUCTED header
+ *     (issuerDid + challenge.credentialType + envelope.epoch — never a
+ *     header taken from the envelope) and the ph recomputed from the
+ *     verifier's own domain + stored nonce
+ *
+ * Uses ONLY the stateless issuer-key check — never a per-credential
+ * chain lookup (`verifyCredentialProof` leaks subject_did; BD-5).
+ */
+export async function verifyBbsPresentation(challenge, presentation, opts) {
+    const checks = {
+        notExpired: false,
+        notUsed: false,
+        challengeIdMatches: false,
+        noForbiddenDisclosure: false,
+        requiredDisclosed: false,
+        epochKeyResolved: false,
+        proofValid: false,
+    };
+    const now = opts.now?.() ?? new Date();
+    checks.notExpired = now < new Date(challenge.expiresAt);
+    if (!checks.notExpired) {
+        return { valid: false, error: 'Challenge expired', checks };
+    }
+    checks.notUsed = opts.used !== true;
+    if (!checks.notUsed) {
+        return { valid: false, error: 'Challenge already used', checks };
+    }
+    checks.challengeIdMatches = presentation.challengeId === challenge.id;
+    if (!checks.challengeIdMatches) {
+        return { valid: false, error: 'Presentation answers a different challenge', checks };
+    }
+    const disclosedIndices = presentation.disclosed.map((d) => d.index);
+    checks.noForbiddenDisclosure = !disclosedIndices.some((i) => ALWAYS_HIDDEN_KYC_INDICES.includes(i));
+    if (!checks.noForbiddenDisclosure) {
+        return {
+            valid: false,
+            error: 'Presentation discloses an always-hidden field',
+            checks,
+        };
+    }
+    checks.requiredDisclosed = challenge.requiredIndices.every((i) => disclosedIndices.includes(i));
+    if (!checks.requiredDisclosed) {
+        return { valid: false, error: 'A required claim was not disclosed', checks };
+    }
+    const issuerKeyHex = await opts.resolveIssuerKey(presentation.epoch);
+    checks.epochKeyResolved = typeof issuerKeyHex === 'string' && issuerKeyHex.length === 192;
+    if (!checks.epochKeyResolved || !issuerKeyHex) {
+        return { valid: false, error: 'No issuer key for this epoch (unknown or lapsed)', checks };
+    }
+    try {
+        // Reconstruct — never trust — the header and the presentation header.
+        const header = buildV2Header(opts.issuerDid, challenge.credentialType, presentation.epoch);
+        const ph = derivePresentationHeader(challenge.domain, hexToBytes(challenge.nonce));
+        const sorted = [...presentation.disclosed].sort((a, b) => a.index - b.index);
+        checks.proofValid = await BbsProof.fromHex(presentation.proof).verify({
+            pk: BbsPublicKey.fromHex(issuerKeyHex),
+            header,
+            presentationHeader: ph,
+            disclosedIndices: sorted.map((d) => d.index),
+            disclosedMessages: sorted.map((d) => hexToBytes(d.message)),
+        });
+    }
+    catch {
+        checks.proofValid = false;
+    }
+    if (!checks.proofValid) {
+        return { valid: false, error: 'Proof verification failed', checks };
+    }
+    // ---- Re-recognition (mechanism B) — only when a pairwise attachment rides
+    //      the envelope. The one-shot proof above already passed; this adds the
+    //      "same returning user at this verifier" binding without any on-chain
+    //      anchor and without leaking a cross-verifier handle.
+    if (presentation.pairwiseDid !== null) {
+        checks.pairwiseBindingValid = false;
+        checks.pairwiseSignatureValid = false;
+        if (!opts.network) {
+            return { valid: false, error: 'Pairwise attachment requires a configured verifier network', checks };
+        }
+        const attachment = asPairwiseAttachment(presentation.pairwiseProof);
+        if (!attachment) {
+            return { valid: false, error: 'Malformed pairwise attachment', checks };
+        }
+        // 1. Binding: the claimed pairwise DID must be the self-certifying DID of
+        //    the attached public key (under the verifier's own network), and the
+        //    VP's holder must equal it. A stolen/forged DID fails here.
+        let pubkey;
+        try {
+            pubkey = hexToBytes(attachment.publicKeyHex);
+        }
+        catch {
+            return { valid: false, error: 'Pairwise public key is not valid hex', checks };
+        }
+        const recomputedDid = buildPairwiseDid(opts.network, pubkey);
+        checks.pairwiseBindingValid =
+            recomputedDid === presentation.pairwiseDid && attachment.vp.holder === presentation.pairwiseDid;
+        if (!checks.pairwiseBindingValid) {
+            return { valid: false, error: 'Pairwise DID does not bind to its public key', checks };
+        }
+        // 2. Signature: reuse the shipped DID-bound `verifyPresentation` verbatim,
+        //    resolving the self-certified key. holderMatches + nonceMatches +
+        //    signatureValid all run inside it.
+        const pairwiseChallenge = {
+            id: challenge.id,
+            did: presentation.pairwiseDid,
+            nonce: challenge.nonce,
+            issuedAt: challenge.issuedAt,
+            expiresAt: challenge.expiresAt,
+        };
+        const vpResult = await verifyPresentation(pairwiseChallenge, attachment.vp, async () => pubkey);
+        checks.pairwiseSignatureValid = vpResult.valid;
+        if (!checks.pairwiseSignatureValid) {
+            return { valid: false, error: `Pairwise VP invalid: ${vpResult.error ?? 'signature'}`, checks };
+        }
+        return { valid: true, checks, pairwiseDid: presentation.pairwiseDid };
+    }
+    return { valid: true, checks };
+}
 //# sourceMappingURL=verify.js.map

package/dist/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAkCpC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAoB,EACpB,YAAoC,EACpC,YAAmE;IAEnE,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,KAAK;QACjB,aAAa,EAAE,KAAK;QACpB,YAAY,EAAE,KAAK;QACnB,cAAc,EAAE,KAAK;KACtB,CAAA;IAED,iBAAiB;IACjB,MAAM,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;IAC9D,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,CAAA;IAC7D,CAAC;IAED,oBAAoB;IACpB,MAAM,CAAC,aAAa,GAAG,YAAY,CAAC,MAAM,KAAK,SAAS,CAAC,GAAG,CAAA;IAC5D,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,yCAAyC,EAAE,MAAM,EAAE,CAAA;IACnF,CAAC;IAED,mBAAmB;IACnB,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,KAAK,CAAA;IACtE,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1D,CAAC;IAED,qBAAqB;IACrB,iEAAiE;IACjE,oFAAoF;IACpF,iFAAiF;IACjF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oDAAoD,EAAE,MAAM,EAAE,CAAA;QAC9F,CAAC;QACD,MAAM,CAAC,SAAS,EAAE,AAAD,EAAG,MAAM,CAAC,GAAG,QAAoC,CAAA;QAElE,oEAAoE;QACpE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,wBAAwB,EAAE,GAAG,YAAY,CAAA;QACnE,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAClC,IAAI,CAAC,SAAS,CAAC,wBAAwB,CAAC,CACzC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QAEvB,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,gBAAgB,EAAE,CAAA;QACvD,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAA;QAElE,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;QAE3E,MAAM,CAAC,cAAc,GAAG,MAAM,EAAE,CAAC,WAAW,CAC1C,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EACtC,SAAS,CACV,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,cAAc,GAAG,KAAK,CAAA;IAC/B,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,CAAA;IAC7D,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AAChC,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AAE9F,OAAO,EACL,yBAAyB,GAE1B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAiCtE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAoB,EACpB,YAAoC,EACpC,YAAmE;IAEnE,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,KAAK;QACjB,aAAa,EAAE,KAAK;QACpB,YAAY,EAAE,KAAK;QACnB,cAAc,EAAE,KAAK;KACtB,CAAA;IAED,iBAAiB;IACjB,MAAM,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;IAC9D,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,CAAA;IAC7D,CAAC;IAED,oBAAoB;IACpB,MAAM,CAAC,aAAa,GAAG,YAAY,CAAC,MAAM,KAAK,SAAS,CAAC,GAAG,CAAA;IAC5D,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,yCAAyC,EAAE,MAAM,EAAE,CAAA;IACnF,CAAC;IAED,mBAAmB;IACnB,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,KAAK,CAAA;IACtE,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1D,CAAC;IAED,qBAAqB;IACrB,iEAAiE;IACjE,oFAAoF;IACpF,iFAAiF;IACjF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oDAAoD,EAAE,MAAM,EAAE,CAAA;QAC9F,CAAC;QACD,MAAM,CAAC,SAAS,EAAE,AAAD,EAAG,MAAM,CAAC,GAAG,QAAoC,CAAA;QAElE,oEAAoE;QACpE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,wBAAwB,EAAE,GAAG,YAAY,CAAA;QACnE,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAClC,IAAI,CAAC,SAAS,CAAC,wBAAwB,CAAC,CACzC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QAEvB,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,gBAAgB,EAAE,CAAA;QACvD,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAA;QAElE,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;QAE3E,MAAM,CAAC,cAAc,GAAG,MAAM,EAAE,CAAC,WAAW,CAC1C,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EACtC,SAAS,CACV,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,cAAc,GAAG,KAAK,CAAA;IAC/B,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,CAAA;IAC7D,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AAChC,CAAC;AAgED,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACtD,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAuB,EACvB,YAAgD,EAChD,IAAsB;IAEtB,MAAM,MAAM,GAAgD;QAC1D,UAAU,EAAE,KAAK;QACjB,OAAO,EAAE,KAAK;QACd,kBAAkB,EAAE,KAAK;QACzB,qBAAqB,EAAE,KAAK;QAC5B,iBAAiB,EAAE,KAAK;QACxB,gBAAgB,EAAE,KAAK;QACvB,UAAU,EAAE,KAAK;KAClB,CAAA;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAA;IAEtC,MAAM,CAAC,UAAU,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;IACvD,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,CAAA;IAC7D,CAAC;IAED,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAA;IACnC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,MAAM,EAAE,CAAA;IAClE,CAAC;IAED,MAAM,CAAC,kBAAkB,GAAG,YAAY,CAAC,WAAW,KAAK,SAAS,CAAC,EAAE,CAAA;IACrE,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,4CAA4C,EAAE,MAAM,EAAE,CAAA;IACtF,CAAC;IAED,MAAM,gBAAgB,GAAG,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IACnE,MAAM,CAAC,qBAAqB,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACzD,yBAA+C,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC7D,CAAA;IACD,IAAI,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;QAClC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,+CAA+C;YACtD,MAAM;SACP,CAAA;IACH,CAAC;IAED,MAAM,CAAC,iBAAiB,GAAG,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/D,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC7B,CAAA;IACD,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oCAAoC,EAAE,MAAM,EAAE,CAAA;IAC9E,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;IACpE,MAAM,CAAC,gBAAgB,GAAG,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG,CAAA;IACzF,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,YAAY,EAAE,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kDAAkD,EAAE,MAAM,EAAE,CAAA;IAC5F,CAAC;IAED,IAAI,CAAC;QACH,sEAAsE;QACtE,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;QAC1F,MAAM,EAAE,GAAG,wBAAwB,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;QAClF,MAAM,MAAM,GAAG,CAAC,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAA;QAC5E,MAAM,CAAC,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;YACpE,EAAE,EAAE,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC;YACtC,MAAM;YACN,kBAAkB,EAAE,EAAE;YACtB,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YAC5C,iBAAiB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;SAC5D,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,UAAU,GAAG,KAAK,CAAA;IAC3B,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,CAAA;IACrE,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,2DAA2D;IAC3D,IAAI,YAAY,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,CAAC,oBAAoB,GAAG,KAAK,CAAA;QACnC,MAAM,CAAC,sBAAsB,GAAG,KAAK,CAAA;QAErC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,4DAA4D,EAAE,MAAM,EAAE,CAAA;QACtG,CAAC;QACD,MAAM,UAAU,GAAG,oBAAoB,CAAC,YAAY,CAAC,aAAa,CAAC,CAAA;QACnE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,MAAM,EAAE,CAAA;QACzE,CAAC;QAED,0EAA0E;QAC1E,yEAAyE;QACzE,gEAAgE;QAChE,IAAI,MAAkB,CAAA;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,EAAE,MAAM,EAAE,CAAA;QAChF,CAAC;QACD,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC5D,MAAM,CAAC,oBAAoB;YACzB,aAAa,KAAK,YAAY,CAAC,WAAW,IAAI,UAAU,CAAC,EAAE,CAAC,MAAM,KAAK,YAAY,CAAC,WAAW,CAAA;QACjG,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;YACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,8CAA8C,EAAE,MAAM,EAAE,CAAA;QACxF,CAAC;QAED,2EAA2E;QAC3E,sEAAsE;QACtE,uCAAuC;QACvC,MAAM,iBAAiB,GAAc;YACnC,EAAE,EAAE,SAAS,CAAC,EAAE;YAChB,GAAG,EAAE,YAAY,CAAC,WAAW;YAC7B,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,SAAS,EAAE,SAAS,CAAC,SAAS;SAC/B,CAAA;QACD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,EAAE,UAAU,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,CAAA;QAC/F,MAAM,CAAC,sBAAsB,GAAG,QAAQ,CAAC,KAAK,CAAA;QAC9C,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;YACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,QAAQ,CAAC,KAAK,IAAI,WAAW,EAAE,EAAE,MAAM,EAAE,CAAA;QACjG,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,CAAC,WAAW,EAAE,CAAA;IACvE,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AAChC,CAAC"}