@trustlayer-foundation/aria-sdk 0.0.0-stage → 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/API.md +207 -0
  2. package/LICENSE +202 -0
  3. package/MIGRATION.md +86 -0
  4. package/README.md +27 -2
  5. package/dist/index.d.ts +435 -0
  6. package/dist/index.js +1029 -0
  7. package/dist/index.js.map +1 -0
  8. package/package.json +54 -3
  9. package/schemas/aid-1.0.json +394 -0
package/dist/index.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"sources":["../src/errors.ts","../src/internal/canonical.ts","../src/internal/encoding.ts","../src/internal/composite.ts","../src/internal/fetch.ts","../src/internal/instant.ts","../src/internal/check-status.ts","../src/internal/provenance.ts","../src/internal/standing.ts","../src/internal/aid-1.0.schema.json","../src/internal/schema.ts","../src/internal/verify-credential.ts","../src/verifier.ts","../src/did.ts"],"names":["ed25519"],"mappings":";;;;;;;AAKO,IAAM,cAAA,GAAN,cAA6B,SAAA,CAAU;AAAA,EAC5C,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,gBAAA;AAAA,EACd;AACF;;;ACJO,SAAS,cAAc,KAAA,EAAwB;AACpD,EAAA,OAAO,IAAA,CAAK,SAAA,CAAU,KAAA,EAAO,CAAC,GAAG,CAAA,KAAM;AACrC,IAAA,IAAI,CAAA,IAAK,OAAO,CAAA,KAAM,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,EAAG;AACnD,MAAA,OAAO,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,MAAK,CAAE,MAAA,CAAO,CAAC,MAAA,EAAiC,GAAA,KAAQ;AAC5E,QAAA,MAAA,CAAO,GAAG,CAAA,GAAK,CAAA,CAA8B,GAAG,CAAA;AAChD,QAAA,OAAO,MAAA;AAAA,MACT,CAAA,EAAG,EAAE,CAAA;AAAA,IACP;AACA,IAAA,OAAO,CAAA;AAAA,EACT,CAAC,CAAA;AACH;;;AChBA,IAAM,MAAA,GAAS,4DAAA;AAGR,SAAS,cAAc,IAAA,EAAiC;AAC7D,EAAA,IAAI,CAAC,wBAAA,CAAyB,IAAA,CAAK,IAAI,GAAG,OAAO,IAAA;AACjD,EAAA,IAAI,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA;AACzE,EAAA,IAAI,MAAA,CAAO,MAAA,GAAS,CAAA,KAAM,CAAA,EAAG,OAAO,IAAA;AACpC,EAAA,OAAO,MAAA,CAAO,MAAA,GAAS,CAAA,KAAM,CAAA,EAAG,MAAA,IAAU,GAAA;AAC1C,EAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AAC1C,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,EAAA,EAAK,KAAA,CAAM,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AACtE,EAAA,OAAO,KAAA;AACT;AAGO,SAAS,cAAc,IAAA,EAAiC;AAC7D,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAC9B,EAAA,IAAI,CAAA,GAAI,EAAA;AACR,EAAA,KAAA,MAAW,MAAM,IAAA,EAAM;AACrB,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,OAAA,CAAQ,EAAE,CAAA;AAC/B,IAAA,IAAI,KAAA,GAAQ,GAAG,OAAO,IAAA;AACtB,IAAA,CAAA,GAAI,CAAA,GAAI,GAAA,GAAM,MAAA,CAAO,KAAK,CAAA;AAAA,EAC5B;AACA,EAAA,MAAM,OAAiB,EAAC;AACxB,EAAA,OAAO,IAAI,EAAA,EAAI;AACb,IAAA,IAAA,CAAK,OAAA,CAAQ,MAAA,CAAO,CAAA,GAAI,KAAK,CAAC,CAAA;AAC9B,IAAA,CAAA,KAAM,EAAA;AAAA,EACR;AACA,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,OAAO,QAAQ,IAAA,CAAK,MAAA,IAAU,IAAA,CAAK,KAAK,MAAM,GAAA,EAAK,KAAA,EAAA;AACnD,EAAA,OAAO,UAAA,CAAW,IAAA,CAAK,CAAC,GAAG,IAAI,KAAA,CAAc,KAAK,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,EAAG,GAAG,IAAI,CAAC,CAAA;AACvE;AAEO,SAAS,SAAS,KAAA,EAA2B;AAClD,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,CAAA,IAAK,KAAA,EAAO,MAAA,IAAU,MAAA,CAAO,aAAa,CAAC,CAAA;AACtD,EAAA,OAAO,KAAK,MAAM,CAAA;AACpB;;;AChCA,IAAM,MAAA,GAAS,CAAA;AACf,IAAM,mBAAA,GAAsB,IAAA;AAC5B,IAAM,iBAAA,GAAoB,EAAA;AAGnB,IAAM,KAAA,GAAQ,sBAAA;AAYrB,SAAS,OAAO,UAAA,EAAsE;AACpF,EAAA,MAAM,QAAA,GAAW,UAAA,CAAW,UAAA,CAAW,GAAG,CAAA,GAAI,CAAC,UAAA,CAAW,KAAA,CAAM,CAAC,CAAA,EAAG,UAAU,CAAA,GAAI,CAAC,UAAU,CAAA;AAC7F,EAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,IAAA,MAAM,KAAA,GAAQ,cAAc,OAAO,CAAA;AACnC,IAAA,IAAI,CAAC,KAAA,IAAS,KAAA,CAAM,MAAA,KAAW,MAAA,GAAS,sBAAsB,iBAAA,EAAmB;AACjF,IAAA,IAAI,IAAI,QAAA,CAAS,KAAA,CAAM,MAAA,EAAQ,KAAA,CAAM,UAAA,EAAY,KAAA,CAAM,UAAU,CAAA,CAAE,SAAA,CAAU,CAAA,EAAG,KAAK,MAAM,mBAAA,EAAqB;AAChH,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,CAAM,KAAA,CAAM,MAAA,EAAQ,MAAA,GAAS,mBAAmB,CAAA,EAAG,SAAA,EAAW,KAAA,CAAM,KAAA,CAAM,MAAA,GAAS,mBAAmB,CAAA,EAAE;AAAA,EACvH;AACA,EAAA,OAAO,IAAA;AACT;AAOO,SAAS,eAAA,CAAgB,QAAA,EAAmC,UAAA,EAAoB,IAAA,EAA2B;AAChH,EAAA,MAAM,UAAA,GAAa,OAAO,UAAU,CAAA;AACpC,EAAA,IAAI,CAAC,YAAY,OAAO,KAAA;AACxB,EAAA,MAAM,EAAE,KAAA,EAAO,CAAA,EAAG,GAAG,UAAS,GAAI,QAAA;AAClC,EAAA,MAAM,UAAU,IAAI,WAAA,GAAc,MAAA,CAAO,aAAA,CAAc,QAAQ,CAAC,CAAA;AAChE,EAAA,IAAI;AACF,IAAA,OAAO,QAAA,CAAS,MAAA,CAAO,UAAA,CAAW,EAAA,EAAI,SAAS,IAAA,CAAK,OAAO,CAAA,IAAK,OAAA,CAAQ,MAAA,CAAO,UAAA,CAAW,SAAA,EAAW,OAAA,EAAS,KAAK,OAAO,CAAA;AAAA,EAC5H,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;;;ACrCA,eAAsB,UAAA,CAAW,KAAa,MAAA,EAAkC;AAC9E,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAI,IAAI,GAAG,CAAA;AAAA,EACtB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,oBAAA,EAAqB;AAAA,EACnD;AACA,EAAA,IAAI,MAAA,CAAO,QAAA,KAAa,QAAA,IAAY,CAAC,OAAO,cAAA,CAAe,QAAA,CAAS,MAAA,CAAO,MAAM,GAAG,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,oBAAA,EAAqB;AACrI,EAAA,MAAM,KAAA,GAAQ,IAAI,eAAA,EAAgB;AAClC,EAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,MAAM,KAAA,EAAM,EAAG,OAAO,SAAS,CAAA;AAC9D,EAAA,IAAI;AACF,IAAA,MAAM,WAAW,MAAM,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,MAAM,EAAE,QAAA,EAAU,OAAA,EAAS,MAAA,EAAQ,MAAM,MAAA,EAAQ,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA,IAAsB,CAAA;AACrI,IAAA,IAAI,QAAA,CAAS,MAAA,KAAW,GAAA,IAAO,CAAC,QAAA,CAAS,IAAA,EAAM,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,cAAA,EAAe;AAC1F,IAAA,MAAM,WAAW,MAAA,CAAO,QAAA,CAAS,QAAQ,GAAA,CAAI,gBAAgB,KAAK,GAAG,CAAA;AACrE,IAAA,IAAI,QAAA,GAAW,OAAO,QAAA,EAAU,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,WAAA,EAAY;AACxE,IAAA,MAAM,SAAuB,EAAC;AAC9B,IAAA,IAAI,IAAA,GAAO,CAAA;AACX,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,CAAK,SAAA,EAAU;AACvC,IAAA,WAAS;AACP,MAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,MAAM,OAAO,IAAA,EAAK;AAC1C,MAAA,IAAI,IAAA,EAAM;AACV,MAAA,IAAA,IAAQ,KAAA,CAAM,UAAA;AACd,MAAA,IAAI,IAAA,GAAO,OAAO,QAAA,EAAU;AAC1B,QAAA,MAAM,OAAO,MAAA,EAAO;AACpB,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,MAC1C;AACA,MAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,IACnB;AACA,IAAA,MAAM,IAAA,GAAO,IAAI,UAAA,CAAW,IAAI,CAAA;AAChC,IAAA,IAAI,EAAA,GAAK,CAAA;AACT,IAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AACtB,MAAA,IAAA,CAAK,GAAA,CAAI,GAAG,EAAE,CAAA;AACd,MAAA,EAAA,IAAM,CAAA,CAAE,UAAA;AAAA,IACV;AACA,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,IAAA,EAAK;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,cAAA,EAAe;AAAA,EAC7C,CAAA,SAAE;AACA,IAAA,YAAA,CAAa,KAAK,CAAA;AAAA,EACpB;AACF;AAGA,eAAsB,aAAA,CAAc,MAAkB,QAAA,EAA8C;AAClG,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,IAAA,CAAK,CAAC,IAAI,CAAC,CAAA,CAAE,MAAA,EAAO,CAAE,WAAA,CAAY,IAAI,mBAAA,CAAoB,MAAM,CAAC,CAAA;AACpF,IAAA,MAAM,MAAA,GAAS,OAAO,SAAA,EAAU;AAChC,IAAA,MAAM,SAAuB,EAAC;AAC9B,IAAA,IAAI,IAAA,GAAO,CAAA;AACX,IAAA,WAAS;AACP,MAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,MAAM,OAAO,IAAA,EAAK;AAC1C,MAAA,IAAI,IAAA,EAAM;AACV,MAAA,IAAA,IAAQ,KAAA,CAAM,UAAA;AACd,MAAA,IAAI,OAAO,QAAA,EAAU;AACnB,QAAA,MAAM,OAAO,MAAA,EAAO;AACpB,QAAA,OAAO,IAAA;AAAA,MACT;AACA,MAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,IACnB;AACA,IAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,IAAI,CAAA;AAC/B,IAAA,IAAI,EAAA,GAAK,CAAA;AACT,IAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AACtB,MAAA,GAAA,CAAI,GAAA,CAAI,GAAG,EAAE,CAAA;AACb,MAAA,EAAA,IAAM,CAAA,CAAE,UAAA;AAAA,IACV;AACA,IAAA,OAAO,GAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;;;AC/EA,IAAM,OAAA,GAAU,kFAAA;AAGT,SAAS,QAAQ,KAAA,EAA+B;AACrD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,IAAA;AACtC,EAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA;AAC5B,EAAA,IAAI,CAAC,GAAG,OAAO,IAAA;AACf,EAAA,MAAM,GAAG,CAAA,EAAG,EAAA,EAAI,CAAA,EAAG,CAAA,EAAG,EAAA,EAAI,CAAC,CAAA,GAAI,CAAA,CAAE,GAAA,CAAI,MAAM,CAAA;AAC3C,EAAA,IAAI,EAAA,GAAK,CAAA,IAAK,EAAA,GAAK,EAAA,IAAM,IAAI,CAAA,IAAK,CAAA,GAAI,EAAA,IAAM,CAAA,GAAI,EAAA,IAAM,EAAA,GAAK,EAAA,IAAM,CAAA,GAAI,IAAI,OAAO,IAAA;AAChF,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,KAAA,CAAM,KAAK,CAAA;AAC3B,EAAA,IAAI,MAAA,CAAO,KAAA,CAAM,EAAE,CAAA,EAAG,OAAO,IAAA;AAE7B,EAAA,MAAM,MAAA,GAAS,CAAA,CAAE,CAAC,CAAA,KAAM,GAAA,GAAM,CAAA,GAAA,CAAK,CAAA,CAAE,CAAC,CAAA,CAAG,UAAA,CAAW,GAAG,CAAA,GAAI,KAAK,CAAA,KAAM,MAAA,CAAO,CAAA,CAAE,CAAC,CAAA,CAAG,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,GAAI,EAAA,GAAK,MAAA,CAAO,CAAA,CAAE,CAAC,CAAA,CAAG,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,CAAA;AAC/H,EAAA,MAAM,KAAA,GAAQ,IAAI,IAAA,CAAK,EAAA,GAAK,SAAS,GAAM,CAAA;AAC3C,EAAA,IAAI,KAAA,CAAM,cAAA,EAAe,KAAM,CAAA,IAAK,KAAA,CAAM,WAAA,EAAY,GAAI,CAAA,KAAM,EAAA,IAAM,KAAA,CAAM,UAAA,EAAW,KAAM,GAAG,OAAO,IAAA;AACvG,EAAA,OAAO,EAAA;AACT;AAEO,SAAS,IAAI,EAAA,EAAoB;AACtC,EAAA,OAAO,IAAI,KAAK,EAAE,CAAA,CAAE,aAAY,CAAE,OAAA,CAAQ,SAAS,GAAG,CAAA;AACxD;;;ACWO,IAAM,uBAAuB,EAAA,GAAK,IAAA;AACzC,IAAM,iBAAiB,MAAA,GAAU,CAAA;AACjC,IAAM,cAAA,GAAiB,IAAI,IAAA,GAAO,IAAA;AAUlC,IAAM,WAAA,GAAc,CAAC,MAAA,EAAkC,UAAA,EAAgC,QAA2B,SAAA,MAAuC;AAAA,EACvJ,MAAA;AAAA,EACA,KAAA,EAAO,aAAA;AAAA,EACP,UAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAA,CAAA;AAEA,SAAS,KAAK,IAAA,EAAkD;AAC9D,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAiB,IAAA,CAAK,KAAA,CAAM,IAAI,WAAA,CAAY,OAAA,EAAS,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA,CAAE,MAAA,CAAO,IAAI,CAAC,CAAA;AACxF,IAAA,OAAO,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,GAAK,KAAA,GAAoC,IAAA;AAAA,EAC5G,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAYA,eAAsB,QAAA,CAAS,YAAgC,IAAA,EAAqD;AAClH,EAAA,MAAM,UAAU,UAAA,CAAW,OAAA;AAC3B,EAAA,MAAM,QAAQ,IAAA,CAAK,KAAA;AACnB,EAAA,MAAM,QAAQ,IAAA,CAAK,IAAA;AACnB,EAAA,IAAI,IAAA,CAAK,WAAW,OAAA,CAAQ,MAAA,SAAe,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,cAAA,EAAe;AAC/E,EAAA;AAAA;AAAA,IAEE,KAAK,EAAA,KAAO,UAAA,CAAW,UAAA,IACvB,CAAC,MAAM,OAAA,CAAQ,KAAK,CAAA,IACpB,CAAC,MAAM,QAAA,CAAS,sBAAsB,CAAA,IACtC,CAAC,MAAM,QAAA,CAAS,+BAA+B,CAAA,IAC/C,CAAC,SACD,KAAA,CAAM,IAAA,KAAS,oBAAA,IACf,KAAA,CAAM,gBAAgB,KAAA,IACtB,KAAA,CAAM,YAAA,KAAiB,iBAAA,IACvB,MAAM,kBAAA,KAAuB,OAAA,CAAQ,kBAAA,IACrC,OAAO,MAAM,UAAA,KAAe;AAAA,IAC5B;AACA,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC1C;AACA,EAAA,IAAI,CAAC,eAAA,CAAgB,IAAA,EAAM,KAAA,CAAM,UAAA,EAAY,OAAA,CAAQ,IAAI,CAAA,EAAG,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,mBAAA,EAAoB;AAG5G,EAAA,MAAM,UAAU,IAAA,CAAK,iBAAA;AACrB,EAAA,MAAM,UAAU,OAAA,EAAS,WAAA;AACzB,EAAA,IACE,CAAC,WACD,OAAA,CAAQ,IAAA,KAAS,yBACjB,OAAA,CAAQ,aAAA,KAAkB,gBACzB,OAAA,CAAQ,UAAA,KAAe,UAAa,OAAA,CAAQ,UAAA,KAAe,KAC5D,OAAO,OAAA,KAAY,YACnB,CAAC,OAAA,CAAQ,UAAA,CAAW,GAAG,CAAA,EACvB;AACA,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC1C;AACA,EAAA,MAAM,MAAA,GAAS,aAAA,CAAc,OAAA,CAAQ,KAAA,CAAM,CAAC,CAAC,CAAA;AAC7C,EAAA,MAAM,IAAA,GAAO,MAAA,IAAW,MAAM,aAAA,CAAc,QAAQ,cAAc,CAAA;AAClE,EAAA,IAAI,CAAC,IAAA,IAAQ,IAAA,CAAK,MAAA,GAAS,kBAAkB,UAAA,CAAW,WAAA,IAAe,IAAA,CAAK,MAAA,GAAS,GAAG,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,WAAA,EAAY;AAEhI,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,IAAA,CAAK,SAAS,CAAA;AACxC,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA;AAC1C,EAAA,IAAI,SAAA,KAAc,IAAA,IAAQ,UAAA,KAAe,IAAA,IAAQ,cAAc,SAAA,IAAa,UAAA,GAAa,SAAA,GAAY,oBAAA,EAAsB,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,kBAAA,EAAmB;AAC1K,EAAA,MAAM,OAAA,GAAA,CAAY,IAAA,CAAK,UAAA,CAAW,WAAA,IAAe,CAAC,KAAO,CAAA,IAAK,UAAA,CAAW,WAAA,GAAc,CAAA,CAAA,GAAO,CAAA,MAAO,CAAA;AACrG,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,OAAA,EAAS,WAAW,UAAA,EAAW;AACpD;AAMA,eAAsB,cAAA,CAAe,YAAgC,OAAA,EAAiD;AACpH,EAAA,MAAM,EAAE,QAAO,GAAI,OAAA;AACnB,EAAA,IAAI,CAAC,QAAQ,OAAO,WAAA,CAAY,eAAe,UAAA,EAAY,SAAA,EAAW,OAAA,CAAQ,GAAA,EAAK,CAAA;AACnF,EAAA,MAAM,OAAA,GAAU,MAAM,UAAA,CAAW,UAAA,CAAW,YAAY,MAAM,CAAA;AAC9D,EAAA,IAAI,CAAC,OAAA,CAAQ,EAAA,EAAI,OAAO,WAAA,CAAY,aAAA,EAAe,UAAA,EAAY,OAAA,CAAQ,MAAA,EAAQ,OAAA,CAAQ,GAAA,EAAK,CAAA;AAC5F,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AAC9B,EAAA,IAAI,CAAC,MAAM,OAAO,WAAA,CAAY,eAAe,UAAA,EAAY,WAAA,EAAa,OAAA,CAAQ,GAAA,EAAK,CAAA;AACnF,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,UAAA,EAAY,IAAI,CAAA;AAG5C,EAAA,MAAM,GAAA,GAAM,QAAQ,GAAA,EAAI;AACxB,EAAA,IAAI,CAAC,IAAA,CAAK,EAAA,EAAI,OAAO,WAAA,CAAY,aAAA,EAAe,UAAA,EAAY,IAAA,CAAK,MAAA,KAAW,kBAAA,GAAqB,eAAA,GAAkB,IAAA,CAAK,QAAQ,GAAG,CAAA;AACnI,EAAA,MAAM,EAAE,SAAA,EAAW,UAAA,EAAW,GAAI,IAAA;AAClC,EAAA,IAAI,SAAA,GAAY,GAAA,GAAM,OAAA,CAAQ,MAAA,IAAU,UAAA,IAAc,GAAA,EAAK,OAAO,WAAA,CAAY,aAAA,EAAe,UAAA,EAAY,eAAA,EAAiB,GAAG,CAAA;AAC7H,EAAA,IAAI,GAAA,GAAM,YAAY,OAAA,CAAQ,QAAA,SAAiB,WAAA,CAAY,aAAA,EAAe,UAAA,EAAY,OAAA,EAAS,GAAG,CAAA;AAClG,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,aAAA;AAAA,IACR,KAAA,EAAO,IAAA,CAAK,OAAA,GAAU,SAAA,GAAY,QAAA;AAAA,IAClC,UAAA;AAAA,IACA,IAAA,EAAM,EAAE,GAAA,EAAK,UAAA,CAAW,YAAY,KAAA,EAAO,UAAA,CAAW,WAAA,EAAa,SAAA,EAAW,UAAA,EAAW;AAAA,IACzF,SAAA,EAAW;AAAA,GACb;AACF;AAOA,eAAsB,UAAA,CAAW,YAAgC,OAAA,EAAiD;AAChH,EAAA,MAAM,EAAE,QAAO,GAAI,OAAA;AACnB,EAAA,MAAM,QAAA,GAAW,WAAW,OAAA,CAAQ,YAAA;AACpC,EAAA,IAAI,CAAC,UAAU,OAAO,WAAA,CAAY,UAAU,UAAA,EAAY,oBAAA,EAAsB,OAAA,CAAQ,GAAA,EAAK,CAAA;AAC3F,EAAA,IAAI,CAAC,QAAQ,OAAO,WAAA,CAAY,UAAU,UAAA,EAAY,SAAA,EAAW,OAAA,CAAQ,GAAA,EAAK,CAAA;AAC9E,EAAA,MAAM,OAAA,GAAU,MAAM,UAAA,CAAW,CAAA,EAAG,QAAQ,CAAA,EAAG,UAAA,CAAW,GAAG,CAAA,CAAA,EAAI,MAAM,CAAA;AAEvE,EAAA,MAAM,GAAA,GAAM,QAAQ,GAAA,EAAI;AACxB,EAAA,IAAI,CAAC,QAAQ,EAAA,EAAI,OAAO,YAAY,QAAA,EAAU,UAAA,EAAY,OAAA,CAAQ,MAAA,EAAQ,GAAG,CAAA;AAC7E,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AAEhC,EAAA,IACE,CAAC,UACD,MAAA,CAAO,GAAA,KAAQ,WAAW,GAAA,IAC1B,OAAO,OAAO,YAAA,KAAiB,QAAA,IAC/B,CAAC,qBAAA,CAAsB,MAAA,CAAO,YAAY,CAAA,IACzC,MAAA,CAAO,WAAW,QAAA,IAAY,MAAA,CAAO,WAAW,SAAA,EACjD;AACA,IAAA,OAAO,WAAA,CAAY,QAAA,EAAU,UAAA,EAAY,WAAA,EAAa,GAAG,CAAA;AAAA,EAC3D;AACA,EAAA,IAAI,MAAA,CAAO,YAAA,KAAiB,UAAA,CAAW,YAAA,EAAc;AACnD,IAAA,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,KAAA,EAAO,YAAA,EAAc,YAAY,mBAAA,EAAqB,MAAA,CAAO,YAAA,EAAc,SAAA,EAAW,GAAA,EAAI;AAAA,EACvH;AACA,EAAA,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,KAAA,EAAO,MAAA,CAAO,QAAQ,UAAA,EAAY,mBAAA,EAAqB,IAAA,EAAM,SAAA,EAAW,GAAA,EAAI;AACzG;AAOA,SAAS,sBAAsB,KAAA,EAAwB;AACrD,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,KAAK,CAAA;AACzB,IAAA,OAAO,GAAA,CAAI,aAAa,QAAA,IAAY,GAAA,CAAI,aAAa,EAAA,IAAM,GAAA,CAAI,QAAA,CAAS,MAAA,GAAS,CAAA,IAAK,CAAC,IAAI,MAAA,IAAU,CAAC,GAAA,CAAI,IAAA,IAAQ,CAAC,GAAA,CAAI,YAAY,CAAC,GAAA,CAAI,QAAA,IAAY,GAAA,CAAI,IAAA,KAAS,KAAA;AAAA,EACnK,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;;;ACpLA,IAAM,OAAA,uBAAc,OAAA,EAA+F;AAG5G,SAAS,KAAA,CAAwB,KAAA,EAAe,IAAA,EAAc,IAAA,EAAS,QAAA,EAAsB;AAClG,EAAA,UAAA,CAAW,IAAI,CAAA;AACf,EAAA,OAAA,CAAQ,IAAI,IAAA,EAAM,EAAE,KAAA,EAAO,IAAA,EAAM,UAAU,CAAA;AAC3C,EAAA,OAAO,IAAA;AACT;AAGO,SAAS,MAAA,CAAU,KAAA,EAAe,IAAA,EAAc,KAAA,EAAmB;AACxE,EAAA,MAAM,MAAA,GAAS,OAAO,KAAA,KAAU,QAAA,IAAY,UAAU,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAA,GAAI,MAAA;AAClF,EAAA,IAAI,CAAC,MAAA,IAAU,MAAA,CAAO,IAAA,KAAS,IAAA,EAAM;AACnC,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,MAAA,EAAS,IAAI,CAAA,yDAAA,CAA2D,CAAA;AAAA,EACnG;AACA,EAAA,IAAI,MAAA,CAAO,UAAU,KAAA,EAAO;AAC1B,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,EAAA,EAAK,IAAI,CAAA,iDAAA,CAAmD,CAAA;AAAA,EACvF;AACA,EAAA,OAAO,MAAA,CAAO,QAAA;AAChB;AAEA,SAAS,WAAW,KAAA,EAAsB;AACxC,EAAA,IAAI,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,EAAG;AAC3E,EAAA,MAAA,CAAO,OAAO,KAAK,CAAA;AACnB,EAAA,KAAA,MAAW,GAAA,IAAO,QAAQ,OAAA,CAAQ,KAAK,GAAG,UAAA,CAAY,KAAA,CAAuC,GAAG,CAAC,CAAA;AACnG;;;ACjBO,SAAS,KAAA,CAAM,UAAA,EAAgC,MAAA,EAAwB,KAAA,EAAqC;AACjH,EAAA,MAAM,EAAE,KAAI,GAAI,KAAA;AAChB,EAAA,IAAI,UAAA,CAAW,UAAA,IAAc,GAAA,IAAO,UAAA,CAAW,SAAA,GAAY,GAAA,GAAM,KAAA,CAAM,MAAA,EAAQ,OAAO,EAAE,KAAA,EAAO,eAAA,EAAgB;AAC/G,EAAA,IAAI,MAAA,CAAO,eAAe,UAAA,EAAY,OAAO,EAAE,KAAA,EAAO,SAAA,EAAW,QAAQ,gBAAA,EAAiB;AAC1F,EAAA,IAAI,MAAA,CAAO,UAAU,aAAA,EAAe,OAAO,EAAE,KAAA,EAAO,SAAA,EAAW,QAAQ,aAAA,EAAc;AACrF,EAAA,IAAI,MAAA,CAAO,WAAW,aAAA,EAAe;AACnC,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,UAAA,IAAc,GAAA,IAAO,MAAM,MAAA,CAAO,IAAA,CAAK,SAAA,GAAY,KAAA,CAAM,gBAAgB,OAAO,EAAE,KAAA,EAAO,SAAA,EAAW,QAAQ,OAAA,EAAQ;AAAA,EACtI,CAAA,MAAA,IAAW,GAAA,GAAM,MAAA,CAAO,SAAA,GAAY,MAAM,cAAA,EAAgB;AACxD,IAAA,OAAO,EAAE,KAAA,EAAO,SAAA,EAAW,MAAA,EAAQ,OAAA,EAAQ;AAAA,EAC7C;AACA,EAAA,IAAI,OAAO,KAAA,KAAU,SAAA,EAAW,OAAO,EAAE,OAAO,SAAA,EAAU;AAC1D,EAAA,IAAI,OAAO,KAAA,KAAU,YAAA,EAAc,OAAO,EAAE,OAAO,YAAA,EAAa;AAChE,EAAA,OAAO,EAAE,KAAA,EAAO,MAAA,EAAQ,MAAA,EAAQ,OAAO,MAAA,EAAO;AAChD;;;AC7BA,IAAA,sBAAA,GAAA;AAAA,EACE,OAAA,EAAW,8CAAA;AAAA,EACX,GAAA,EAAO,sCAAA;AAAA,EACP,KAAA,EAAS,qEAAA;AAAA,EACT,WAAA,EAAe,qiBAAA;AAAA,EACf,IAAA,EAAQ,QAAA;AAAA,EACR,QAAA,EAAY;AAAA,IACV,UAAA;AAAA,IACA,MAAA;AAAA,IACA,IAAA;AAAA,IACA,QAAA;AAAA,IACA,WAAA;AAAA,IACA,YAAA;AAAA,IACA,mBAAA;AAAA,IACA,kBAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,UAAA,EAAc;AAAA,IACZ,UAAA,EAAY;AAAA,MACV,IAAA,EAAQ,OAAA;AAAA,MACR,KAAA,EAAS;AAAA,QACP,IAAA,EAAQ,QAAA;AAAA,QACR,MAAA,EAAU;AAAA,OACZ;AAAA,MACA,QAAA,EAAY,CAAA;AAAA,MACZ,WAAA,EAAe;AAAA,QACb;AAAA,UACE,KAAA,EAAS;AAAA,SACX;AAAA,QACA;AAAA,UACE,KAAA,EAAS;AAAA;AACX,OACF;AAAA,MACA,WAAA,EAAe;AAAA,KACjB;AAAA,IACA,IAAA,EAAQ;AAAA,MACN,IAAA,EAAQ,OAAA;AAAA,MACR,KAAA,EAAS;AAAA,QACP,IAAA,EAAQ;AAAA,OACV;AAAA,MACA,QAAA,EAAY,CAAA;AAAA,MACZ,QAAA,EAAY;AAAA,QACV,KAAA,EAAS;AAAA,OACX;AAAA,MACA,WAAA,EAAe;AAAA,QACb;AAAA,UACE,KAAA,EAAS;AAAA,SACX;AAAA,QACA;AAAA,UACE,KAAA,EAAS;AAAA;AACX,OACF;AAAA,MACA,WAAA,EAAe;AAAA,KACjB;AAAA,IACA,EAAA,EAAM;AAAA,MACJ,IAAA,EAAQ,QAAA;AAAA,MACR,MAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAW,+GAAA;AAAA,MACX,WAAA,EAAe;AAAA,KACjB;AAAA,IACA,MAAA,EAAU;AAAA,MACR,IAAA,EAAQ,QAAA;AAAA,MACR,OAAA,EAAW,eAAA;AAAA,MACX,WAAA,EAAe;AAAA,KACjB;AAAA,IACA,SAAA,EAAa;AAAA,MACX,IAAA,EAAQ,QAAA;AAAA,MACR,MAAA,EAAU,WAAA;AAAA,MACV,WAAA,EAAe;AAAA,KACjB;AAAA,IACA,UAAA,EAAc;AAAA,MACZ,IAAA,EAAQ,QAAA;AAAA,MACR,MAAA,EAAU,WAAA;AAAA,MACV,WAAA,EAAe;AAAA,KACjB;AAAA,IACA,gBAAA,EAAoB;AAAA,MAClB,IAAA,EAAQ,QAAA;AAAA,MACR,QAAA,EAAY;AAAA,QACV,IAAA;AAAA,QACA,MAAA;AAAA,QACA,eAAA;AAAA,QACA,iBAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA,UAAA,EAAc;AAAA,QACZ,EAAA,EAAM;AAAA,UACJ,IAAA,EAAQ,QAAA;AAAA,UACR,MAAA,EAAU,KAAA;AAAA,UACV,WAAA,EAAe;AAAA,SACjB;AAAA,QACA,IAAA,EAAQ;AAAA,UACN,IAAA,EAAQ,QAAA;AAAA,UACR,KAAA,EAAS,0BAAA;AAAA,UACT,WAAA,EAAe;AAAA,SACjB;AAAA,QACA,aAAA,EAAiB;AAAA,UACf,IAAA,EAAQ,QAAA;AAAA,UACR,KAAA,EAAS,YAAA;AAAA,UACT,WAAA,EAAe;AAAA,SACjB;AAAA,QACA,eAAA,EAAmB;AAAA,UACjB,IAAA,EAAQ,QAAA;AAAA,UACR,OAAA,EAAW,UAAA;AAAA,UACX,WAAA,EAAe;AAAA,SACjB;AAAA,QACA,oBAAA,EAAwB;AAAA,UACtB,IAAA,EAAQ,QAAA;AAAA,UACR,MAAA,EAAU,KAAA;AAAA,UACV,WAAA,EAAe;AAAA;AACjB,OACF;AAAA,MACA,oBAAA,EAAwB,KAAA;AAAA,MACxB,WAAA,EAAe;AAAA,KACjB;AAAA,IACA,iBAAA,EAAqB;AAAA,MACnB,IAAA,EAAQ,QAAA;AAAA,MACR,QAAA,EAAY;AAAA,QACV,IAAA;AAAA,QACA,WAAA;AAAA,QACA,SAAA;AAAA,QACA,YAAA;AAAA,QACA,OAAA;AAAA,QACA,iBAAA;AAAA,QACA,oBAAA;AAAA,QACA,cAAA;AAAA,QACA,WAAA;AAAA,QACA,WAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA,UAAA,EAAc;AAAA,QACZ,EAAA,EAAM;AAAA,UACJ,IAAA,EAAQ,QAAA;AAAA,UACR,OAAA,EAAW,0DAAA;AAAA,UACX,WAAA,EAAe;AAAA,SACjB;AAAA,QACA,oBAAA,EAAwB;AAAA,UACtB,IAAA,EAAQ,QAAA;AAAA,UACR,MAAA,EAAU,KAAA;AAAA,UACV,OAAA,EAAW,+GAAA;AAAA,UACX,WAAA,EAAe;AAAA,SACjB;AAAA,QACA,SAAA,EAAa;AAAA,UACX,IAAA,EAAQ,QAAA;AAAA,UACR,QAAA,EAAY;AAAA,YACV,IAAA;AAAA,YACA,MAAA;AAAA,YACA;AAAA,WACF;AAAA,UACA,UAAA,EAAc;AAAA,YACZ,EAAA,EAAM;AAAA,cACJ,IAAA,EAAQ,QAAA;AAAA,cACR,OAAA,EAAW,4EAAA;AAAA,cACX,WAAA,EAAe;AAAA,aACjB;AAAA,YACA,IAAA,EAAQ;AAAA,cACN,IAAA,EAAQ,QAAA;AAAA,cACR,KAAA,EAAS,4BAAA;AAAA,cACT,WAAA,EAAe;AAAA,aACjB;AAAA,YACA,kBAAA,EAAsB;AAAA,cACpB,IAAA,EAAQ,QAAA;AAAA,cACR,OAAA,EAAW,0BAAA;AAAA,cACX,WAAA,EAAe;AAAA;AACjB,WACF;AAAA,UACA,oBAAA,EAAwB,KAAA;AAAA,UACxB,WAAA,EAAe;AAAA,SACjB;AAAA,QACA,SAAA,EAAa;AAAA,UACX,IAAA,EAAQ,QAAA;AAAA,UACR,SAAA,EAAa,CAAA;AAAA,UACb,SAAA,EAAa,EAAA;AAAA,UACb,OAAA,EAAW,qDAAA;AAAA,UACX,WAAA,EAAe;AAAA,SACjB;AAAA,QACA,OAAA,EAAW;AAAA,UACT,IAAA,EAAQ,QAAA;AAAA,UACR,OAAA,EAAW,iMAAA;AAAA,UACX,WAAA,EAAe;AAAA,SACjB;AAAA,QACA,UAAA,EAAc;AAAA,UACZ,IAAA,EAAQ,QAAA;AAAA,UACR,IAAA,EAAQ;AAAA,YACN,IAAA;AAAA,YACA,IAAA;AAAA,YACA,IAAA;AAAA,YACA;AAAA,WACF;AAAA,UACA,WAAA,EAAe;AAAA,SACjB;AAAA,QACA,KAAA,EAAS;AAAA,UACP,IAAA,EAAQ,OAAA;AAAA,UACR,KAAA,EAAS;AAAA,YACP,IAAA,EAAQ,QAAA;AAAA,YACR,OAAA,EAAW,sDAAA;AAAA,YACX,WAAA,EAAe;AAAA,WACjB;AAAA,UACA,QAAA,EAAY,CAAA;AAAA,UACZ,WAAA,EAAe,IAAA;AAAA,UACf,WAAA,EAAe;AAAA,SACjB;AAAA,QACA,YAAA,EAAgB;AAAA,UACd,IAAA,EAAQ,OAAA;AAAA,UACR,KAAA,EAAS;AAAA,YACP,IAAA,EAAQ;AAAA,WACV;AAAA,UACA,WAAA,EAAe,IAAA;AAAA,UACf,WAAA,EAAe;AAAA,SACjB;AAAA,QACA,eAAA,EAAmB;AAAA,UACjB,IAAA,EAAQ,SAAA;AAAA,UACR,OAAA,EAAW,CAAA;AAAA,UACX,OAAA,EAAW,CAAA;AAAA,UACX,WAAA,EAAe;AAAA,SACjB;AAAA,QACA,kBAAA,EAAsB;AAAA,UACpB,IAAA,EAAQ,SAAA;AAAA,UACR,OAAA,EAAW,CAAA;AAAA,UACX,OAAA,EAAW,CAAA;AAAA,UACX,WAAA,EAAe;AAAA,SACjB;AAAA,QACA,YAAA,EAAgB;AAAA,UACd,IAAA,EAAQ,QAAA;AAAA,UACR,KAAA,EAAS,KAAA;AAAA,UACT,WAAA,EAAe;AAAA,SACjB;AAAA,QACA,SAAA,EAAa;AAAA,UACX,IAAA,EAAQ,QAAA;AAAA,UACR,QAAA,EAAY;AAAA,YACV,KAAA;AAAA,YACA,cAAA;AAAA,YACA;AAAA,WACF;AAAA,UACA,UAAA,EAAc;AAAA,YACZ,IAAA,EAAQ;AAAA,cACN,IAAA,EAAQ,QAAA;AAAA,cACR,IAAA,EAAQ;AAAA,gBACN,QAAA;AAAA,gBACA;AAAA,eACF;AAAA,cACA,WAAA,EAAe;AAAA,aACjB;AAAA,YACA,GAAA,EAAO;AAAA,cACL,IAAA,EAAQ,QAAA;AAAA,cACR,WAAA,EAAe;AAAA,aACjB;AAAA,YACA,SAAA,EAAa;AAAA,cACX,IAAA,EAAQ,QAAA;AAAA,cACR,SAAA,EAAa,CAAA;AAAA,cACb,SAAA,EAAa,GAAA;AAAA,cACb,WAAA,EAAe;AAAA,aACjB;AAAA,YACA,YAAA,EAAgB;AAAA,cACd,IAAA,EAAQ,QAAA;AAAA,cACR,OAAA,EAAW,YAAA;AAAA,cACX,WAAA,EAAe;AAAA,aACjB;AAAA,YACA,kBAAA,EAAsB;AAAA,cACpB,IAAA,EAAQ,QAAA;AAAA,cACR,IAAA,EAAQ;AAAA,gBACN,eAAA;AAAA,gBACA,oBAAA;AAAA,gBACA;AAAA,eACF;AAAA,cACA,WAAA,EAAe;AAAA;AACjB,WACF;AAAA,UACA,EAAA,EAAM;AAAA,YACJ,QAAA,EAAY;AAAA,cACV;AAAA,aACF;AAAA,YACA,UAAA,EAAc;AAAA,cACZ,IAAA,EAAQ;AAAA,gBACN,KAAA,EAAS;AAAA;AACX;AACF,WACF;AAAA,UACA,IAAA,EAAQ;AAAA,YACN,GAAA,EAAO;AAAA,cACL,QAAA,EAAY;AAAA,gBACV;AAAA;AACF;AACF,WACF;AAAA,UACA,IAAA,EAAQ;AAAA,YACN,QAAA,EAAY;AAAA,cACV;AAAA;AACF,WACF;AAAA,UACA,oBAAA,EAAwB,KAAA;AAAA,UACxB,WAAA,EAAe;AAAA,SACjB;AAAA,QACA,SAAA,EAAa;AAAA,UACX,IAAA,EAAQ,QAAA;AAAA,UACR,WAAA,EAAe;AAAA,SACjB;AAAA,QACA,WAAA,EAAe;AAAA,UACb,IAAA,EAAQ,OAAA;AAAA,UACR,KAAA,EAAS;AAAA,YACP,IAAA,EAAQ,QAAA;AAAA,YACR,MAAA,EAAU,KAAA;AAAA,YACV,OAAA,EAAW;AAAA,WACb;AAAA,UACA,WAAA,EAAe,IAAA;AAAA,UACf,QAAA,EAAY,CAAA;AAAA,UACZ,WAAA,EAAe;AAAA,SACjB;AAAA,QACA,qBAAA,EAAyB;AAAA,UACvB,IAAA,EAAQ,QAAA;AAAA,UACR,QAAA,EAAY;AAAA,YACV,oBAAA;AAAA,YACA,YAAA;AAAA,YACA,cAAA;AAAA,YACA;AAAA,WACF;AAAA,UACA,UAAA,EAAc;AAAA,YACZ,kBAAA,EAAsB;AAAA,cACpB,IAAA,EAAQ,SAAA;AAAA,cACR,KAAA,EAAS,IAAA;AAAA,cACT,WAAA,EAAe;AAAA,aACjB;AAAA,YACA,UAAA,EAAc;AAAA,cACZ,IAAA,EAAQ,QAAA;AAAA,cACR,MAAA,EAAU,WAAA;AAAA,cACV,WAAA,EAAe;AAAA,aACjB;AAAA,YACA,YAAA,EAAgB;AAAA,cACd,IAAA,EAAQ,QAAA;AAAA,cACR,OAAA,EAAW,4BAAA;AAAA,cACX,WAAA,EAAe;AAAA,aACjB;AAAA,YACA,cAAA,EAAkB;AAAA,cAChB,IAAA,EAAQ,QAAA;AAAA,cACR,OAAA,EAAW,4BAAA;AAAA,cACX,WAAA,EAAe;AAAA;AACjB,WACF;AAAA,UACA,oBAAA,EAAwB,KAAA;AAAA,UACxB,WAAA,EAAe;AAAA;AACjB,OACF;AAAA,MACA,oBAAA,EAAwB,KAAA;AAAA,MACxB,WAAA,EAAe;AAAA,KACjB;AAAA,IACA,KAAA,EAAS;AAAA,MACP,IAAA,EAAQ,QAAA;AAAA,MACR,QAAA,EAAY;AAAA,QACV,MAAA;AAAA,QACA,aAAA;AAAA,QACA,SAAA;AAAA,QACA,cAAA;AAAA,QACA,oBAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA,UAAA,EAAc;AAAA,QACZ,IAAA,EAAQ;AAAA,UACN,IAAA,EAAQ,QAAA;AAAA,UACR,KAAA,EAAS,oBAAA;AAAA,UACT,WAAA,EAAe;AAAA,SACjB;AAAA,QACA,WAAA,EAAe;AAAA,UACb,IAAA,EAAQ,QAAA;AAAA,UACR,KAAA,EAAS,sBAAA;AAAA,UACT,WAAA,EAAe;AAAA,SACjB;AAAA,QACA,OAAA,EAAW;AAAA,UACT,IAAA,EAAQ,QAAA;AAAA,UACR,MAAA,EAAU,WAAA;AAAA,UACV,WAAA,EAAe;AAAA,SACjB;AAAA,QACA,YAAA,EAAgB;AAAA,UACd,IAAA,EAAQ,QAAA;AAAA,UACR,KAAA,EAAS,iBAAA;AAAA,UACT,WAAA,EAAe;AAAA,SACjB;AAAA,QACA,kBAAA,EAAsB;AAAA,UACpB,IAAA,EAAQ,QAAA;AAAA,UACR,OAAA,EAAW,kBAAA;AAAA,UACX,WAAA,EAAe;AAAA,SACjB;AAAA,QACA,UAAA,EAAc;AAAA,UACZ,IAAA,EAAQ,QAAA;AAAA,UACR,WAAA,EAAe,ioBAAA;AAAA,UACf,OAAA,EAAW;AAAA;AACb,OACF;AAAA,MACA,oBAAA,EAAwB,KAAA;AAAA,MACxB,WAAA,EAAe;AAAA;AACjB,GACF;AAAA,EACA,oBAAA,EAAwB,KAAA;AAAA,EACxB,QAAA,EAAY,uQAAA;AAAA,EACZ,OAAA,EAAW;AACb,CAAA;;;ACpYA,IAAM,UAAA,GAAe,iBAAsE,OAAA,IAAW,gBAAA;AACtG,IAAM,GAAA,GAAM,IAAI,OAAA,CAAQ,EAAE,QAAQ,KAAA,EAAO,SAAA,EAAW,OAAO,CAAA;AAC3D,UAAA,CAAW,GAAG,CAAA;AACd,IAAM,QAAA,GAAW,GAAA,CAAI,OAAA,CAAQ,sBAAM,CAAA;AAG5B,SAAS,cAAc,QAAA,EAAkC;AAC9D,EAAA,IAAI,QAAA,CAAS,QAAQ,CAAA,EAAG,OAAO,IAAA;AAC/B,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,MAAA,GAAS,CAAC,CAAA;AACjC,EAAA,OAAO,KAAA,GAAQ,KAAA,CAAM,YAAA,IAAgB,GAAA,GAAM,GAAA;AAC7C;;;AC+BO,IAAM,MAAA,GAAgC,OAAO,MAAA,CAAO,CAAC,MAAM,IAAA,EAAM,IAAA,EAAM,IAAI,CAAC;AACnF,IAAM,qBAAqB,GAAA,GAAM,IAAA;AAK1B,SAAS,SAAA,CAAU,KAAA,EAAgB,QAAA,GAAW,kBAAA,EAAoD;AACvG,EAAA,IAAI;AACF,IAAA,MAAM,OAAO,OAAO,KAAA,KAAU,WAAW,KAAA,GAAQ,IAAA,CAAK,UAAU,KAAK,CAAA;AACrE,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAA,CAAE,MAAA,GAAS,QAAA,EAAU,OAAO,IAAA;AACzF,IAAA,MAAM,KAAA,GAAiB,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AACtC,IAAA,OAAO,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,GAAK,KAAA,GAAoC,IAAA;AAAA,EAC5G,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,IAAM,IAAA,GAAO,CAAC,MAAA,EAA2B,IAAA,KAA4B,SAAS,MAAA,GAAY,EAAE,EAAA,EAAI,KAAA,EAAO,QAAO,GAAI,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,IAAA,EAAK;AAQrI,SAAS,yBAAyB,KAAA,EAAgB,QAAA,EAAsC,GAAA,EAAa,MAAA,EAAgB,YAAY,IAAA,EAAe;AACrJ,EAAA,MAAM,GAAA,GAAM,UAAU,KAAK,CAAA;AAC3B,EAAA,IAAI,CAAC,GAAA,EAAK,OAAO,IAAA,CAAK,aAAa,GAAG,CAAA;AACtC,EAAA,MAAM,UAAU,GAAA,CAAI,iBAAA;AACpB,EAAA,IAAI,CAAC,WAAW,OAAO,OAAA,KAAY,UAAU,OAAO,IAAA,CAAK,aAAa,oBAAoB,CAAA;AAC1F,EAAA,IAAI,QAAQ,YAAA,KAAiB,KAAA,EAAO,OAAO,IAAA,CAAK,uBAAuB,iCAAiC,CAAA;AAExG,EAAA,MAAM,UAAA,GAAa,cAAc,GAAG,CAAA;AACpC,EAAA,IAAI,UAAA,KAAe,IAAA,EAAM,OAAO,IAAA,CAAK,aAAa,UAAU,CAAA;AAE5D,EAAA,MAAM,OAAA,GAAU,SAAS,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,MAAA,KAAW,IAAI,MAAM,CAAA;AAC5D,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,IAAA,CAAK,oBAAoB,SAAS,CAAA;AAEvD,EAAA,MAAM,QAAQ,GAAA,CAAI,KAAA;AAClB,EAAA,IACE,MAAM,IAAA,KAAS,oBAAA,IACf,KAAA,CAAM,WAAA,KAAgB,SACtB,KAAA,CAAM,YAAA,KAAiB,iBAAA,IACvB,KAAA,CAAM,uBAAuB,OAAA,CAAQ,kBAAA,IACrC,QAAQ,KAAA,CAAM,OAAO,MAAM,IAAA,EAC3B;AACA,IAAA,OAAO,IAAA,CAAK,qBAAqB,QAAQ,CAAA;AAAA,EAC3C;AACA,EAAA,IAAI,OAAO,KAAA,CAAM,UAAA,KAAe,QAAA,IAAY,CAAC,eAAA,CAAgB,GAAA,EAAK,KAAA,CAAM,UAAA,EAAY,QAAQ,IAAI,CAAA,EAAG,OAAO,IAAA,CAAK,qBAAqB,mBAAmB,CAAA;AAEvJ,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,GAAA,CAAI,SAAS,CAAA;AACvC,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AACzC,EAAA,IAAI,SAAA,KAAc,QAAQ,UAAA,KAAe,IAAA,IAAQ,aAAa,UAAA,EAAY,OAAO,IAAA,CAAK,kBAAA,EAAoB,YAAY,CAAA;AACtH,EAAA,IAAI,aAAa,SAAA,GAAY,GAAA,GAAM,QAAQ,OAAO,IAAA,CAAK,iBAAiB,YAAY,CAAA;AACpF,EAAA,IAAI,aAAa,UAAA,IAAc,GAAA,EAAK,OAAO,IAAA,CAAK,WAAW,aAAa,CAAA;AAExE,EAAA,MAAM,MAAM,OAAA,CAAQ,EAAA;AACpB,EAAA,MAAM,SAAS,OAAA,CAAQ,SAAA;AACvB,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,kBAAA,CAAmB,UAAA,CAAW,GAAG,CAAA,GAAI,aAAA,CAAc,MAAA,CAAO,kBAAA,CAAmB,KAAA,CAAM,CAAC,CAAC,CAAA,GAAI,IAAA;AAC5G,EAAA,IAAI,CAAC,OAAO,GAAA,CAAI,MAAA,KAAW,MAAM,CAAC,MAAA,CAAO,GAAG,UAAA,CAAW,CAAA,EAAG,GAAG,CAAA,YAAA,CAAc,CAAA,IAAK,CAAC,oBAAA,CAAqB,GAAG,GAAG,OAAO,IAAA,CAAK,sBAAsB,8BAA8B,CAAA;AAE5K,EAAA,MAAM,SAAS,OAAA,CAAQ,KAAA;AACvB,EAAA,MAAM,IAAA,GAAQ,OAAA,CAAQ,YAAA,IAAyC,EAAC;AAChE,EAAA,IAAI,CAAC,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA,KAAM,MAAA,CAAO,QAAA,CAAS,CAAC,CAAC,CAAA,EAAG,OAAO,IAAA,CAAK,oBAAoB,iCAAiC,CAAA;AAE7G,EAAA,MAAM,QAAQ,OAAA,CAAQ,UAAA;AACtB,EAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,GAAI,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,mBAAA,EAAqB,+BAA+B,CAAA;AAE9H,EAAA,MAAM,SAAS,GAAA,CAAI,gBAAA;AACnB,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,eAAe,CAAA;AAC3C,EAAA,IAAI,CAAC,OAAA,CAAQ,WAAA,CAAY,QAAA,CAAS,MAAA,CAAO,oBAAoB,CAAA,EAAG,OAAO,IAAA,CAAK,uBAAA,EAAyB,wCAAwC,CAAA;AAC7I,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,MAAA,CAAO,eAAe,CAAA,IAAK,CAAC,MAAA,CAAO,aAAA,CAAc,KAAK,CAAA,EAAG,OAAO,IAAA,CAAK,oBAAoB,mCAAmC,CAAA;AAEvJ,EAAA,MAAM,YAAY,OAAA,CAAQ,SAAA;AAC1B,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,IAAA;AAAA,IACJ,QAAA,EAAU;AAAA,MACR,OAAA;AAAA,MACA,cAAc,GAAA,CAAI,EAAA;AAAA,MAClB,MAAA,EAAQ,CAAA,SAAA,EAAY,QAAA,CAAS,MAAA,CAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,aAAA,CAAc,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA,CAAA,CAAA;AAAA,MAClF,GAAA;AAAA,MACA,QAAQ,GAAA,CAAI,MAAA;AAAA,MACZ,UAAA,EAAY,KAAA;AAAA,MACZ,MAAA,EAAQ,CAAC,GAAG,MAAM,CAAA;AAAA,MAClB,YAAA,EAAc,CAAC,GAAG,IAAI,CAAA;AAAA,MACtB,eAAA,EAAkB,QAAQ,eAAA,IAA0C,CAAA;AAAA,MACpE,SAAA,EAAW;AAAA,QACT,KAAK,SAAA,CAAU,GAAA;AAAA,QACf,IAAA,EAAM,SAAA,CAAU,IAAA,KAAS,QAAA,GAAW,YAAA,GAAe,cAAA;AAAA,QACnD,WAAW,OAAO,SAAA,CAAU,SAAA,KAAc,QAAA,GAAW,UAAU,SAAA,GAAY,IAAA;AAAA,QAC3E,cAAc,OAAO,SAAA,CAAU,YAAA,KAAiB,QAAA,GAAW,UAAU,YAAA,GAAe,IAAA;AAAA,QACpF,oBAAoB,SAAA,CAAU;AAAA,OAChC;AAAA,MACA,aAAa,MAAA,CAAO,EAAA;AAAA,MACpB,oBAAoB,MAAA,CAAO,kBAAA;AAAA,MAC3B,SAAA,EAAW,GAAA;AAAA,MACX,SAAA;AAAA,MACA,UAAA;AAAA,MACA,sBAAsB,OAAO,OAAA,CAAQ,oBAAA,KAAyB,QAAA,GAAW,QAAQ,oBAAA,GAAuB,IAAA;AAAA,MACxG,YAAY,MAAA,CAAO,oBAAA;AAAA,MACnB,WAAA,EAAa,KAAA;AAAA,MACb,UAAA,EAAY;AAAA;AACd,GACF;AACF;AAQO,SAAS,qBAAqB,GAAA,EAA0B;AAC7D,EAAA,IAAI,GAAA,CAAI,MAAA,KAAW,EAAA,EAAI,OAAO,KAAA;AAC9B,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQA,OAAAA,CAAQ,KAAA,CAAM,SAAA,CAAU,GAAG,CAAA;AACzC,IAAA,MAAM,SAAA,GAAY,MAAM,OAAA,EAAQ;AAChC,IAAA,OAAO,SAAA,CAAU,KAAA,CAAM,CAAC,CAAA,EAAG,MAAM,CAAA,KAAM,GAAA,CAAI,CAAC,CAAC,KAAK,CAAC,KAAA,CAAM,YAAA,EAAa,IAAK,MAAM,aAAA,EAAc;AAAA,EACjG,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;;;ACtEA,IAAM,oBAAA,GAAuB,IAAA;AAC7B,IAAM,kBAAA,GAAqB,EAAA;AAE3B,SAAS,iBAAiB,KAAA,EAA4D;AACpF,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,cAAA,CAAe,6CAA6C,CAAA;AACvH,EAAA,MAAM,QAAA,GAAW,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAuB;AACjD,IAAA,IAAI,EAAE,CAAA,CAAE,IAAA,EAAM,mBAAmB,UAAA,CAAA,IAAe,CAAA,CAAE,KAAK,OAAA,CAAQ,MAAA,KAAW,oBAAA,EAAsB,MAAM,IAAI,cAAA,CAAe,CAAA,QAAA,EAAW,EAAE,EAAE,CAAA,6BAAA,EAAgC,oBAAoB,CAAA,MAAA,CAAQ,CAAA;AACpM,IAAA,IAAI,EAAE,CAAA,CAAE,IAAA,EAAM,mBAAmB,UAAA,CAAA,IAAe,CAAA,CAAE,KAAK,OAAA,CAAQ,MAAA,KAAW,kBAAA,EAAoB,MAAM,IAAI,cAAA,CAAe,CAAA,QAAA,EAAW,EAAE,EAAE,CAAA,2BAAA,EAA8B,kBAAkB,CAAA,MAAA,CAAQ,CAAA;AAC9L,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,CAAA,CAAE,QAAQ,GAAG,MAAM,IAAI,cAAA,CAAe,CAAA,QAAA,EAAW,EAAE,EAAE,CAAA,gBAAA,EAAmB,OAAO,CAAA,CAAE,QAAQ,CAAC,CAAA,CAAE,CAAA;AACjH,IAAA,IAAI,CAAA,CAAE,YAAA,KAAiB,MAAA,IAAa,CAAC,EAAE,YAAA,CAAa,UAAA,CAAW,UAAU,CAAA,QAAS,IAAI,cAAA,CAAe,CAAA,QAAA,EAAW,CAAA,CAAE,EAAE,CAAA,0CAAA,CAA4C,CAAA;AAChK,IAAA,OAAO,OAAO,MAAA,CAAO;AAAA,MACnB,EAAA,EAAI,MAAA,CAAO,CAAA,CAAE,EAAE,CAAA;AAAA,MACf,MAAA,EAAQ,MAAA,CAAO,CAAA,CAAE,MAAM,CAAA;AAAA,MACvB,kBAAA,EAAoB,MAAA,CAAO,CAAA,CAAE,kBAAkB,CAAA;AAAA;AAAA,MAE/C,MAAM,MAAA,CAAO,MAAA,CAAO,EAAE,OAAA,EAAS,UAAA,CAAW,KAAK,CAAA,CAAE,IAAA,CAAK,OAAO,CAAA,EAAG,SAAS,UAAA,CAAW,IAAA,CAAK,EAAE,IAAA,CAAK,OAAO,GAAG,CAAA;AAAA,MAC1G,UAAU,CAAA,CAAE,QAAA;AAAA,MACZ,WAAA,EAAa,MAAA,CAAO,MAAA,CAAO,CAAC,GAAG,EAAE,WAAW,CAAA,CAAE,GAAA,CAAI,MAAM,CAAC,CAAA;AAAA,MACzD,YAAA,EAAc,EAAE,YAAA,IAAgB;AAAA,KACjC,CAAA;AAAA,EACH,CAAC,CAAA;AACD,EAAA,IAAI,IAAI,GAAA,CAAI,QAAA,CAAS,GAAA,CAAI,CAAC,MAAM,CAAA,CAAE,MAAM,CAAC,CAAA,CAAE,SAAS,QAAA,CAAS,MAAA,EAAQ,MAAM,IAAI,eAAe,yCAAyC,CAAA;AACvI,EAAA,OAAO,MAAA,CAAO,OAAO,QAAQ,CAAA;AAC/B;AAEA,IAAM,OAAA,GAAU,CAAC,KAAA,EAA2B,QAAA,EAAkB,IAAA,KAAyB;AACrF,EAAA,MAAM,IAAI,KAAA,IAAS,QAAA;AACnB,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA,IAAK,CAAA,GAAI,CAAA,EAAG,MAAM,IAAI,cAAA,CAAe,CAAA,EAAG,IAAI,CAAA,8BAAA,CAAgC,CAAA;AAClG,EAAA,OAAO,CAAA,GAAI,GAAA;AACb,CAAA;AAEA,SAAS,eAAe,CAAA,EAA2C;AACjE,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,qBAAA;AAAA,IACN,OAAA,EAAS,EAAE,YAAA,EAAc,CAAA,CAAE,YAAA,EAAc,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAQ,OAAA,EAAS,CAAA,CAAE,OAAA,CAAQ,EAAA,EAAG;AAAA,IACjF,KAAK,CAAA,CAAE,GAAA;AAAA,IACP,QAAQ,CAAA,CAAE,MAAA;AAAA,IACV,WAAA,EAAa,KAAA;AAAA,IACb,YAAY,CAAA,CAAE,UAAA;AAAA,IACd,MAAA,EAAQ,CAAC,GAAG,CAAA,CAAE,MAAM,CAAA;AAAA,IACpB,YAAA,EAAc,CAAC,GAAG,CAAA,CAAE,YAAY,CAAA;AAAA,IAChC,iBAAiB,CAAA,CAAE,eAAA;AAAA,IACnB,SAAA,EAAW,EAAE,GAAG,CAAA,CAAE,SAAA,EAAU;AAAA,IAC5B,WAAW,EAAE,EAAA,EAAI,EAAE,WAAA,EAAa,kBAAA,EAAoB,EAAE,kBAAA,EAAmB;AAAA,IACzE,SAAA,EAAW,GAAA,CAAI,CAAA,CAAE,SAAS,CAAA;AAAA,IAC1B,UAAA,EAAY,GAAA,CAAI,CAAA,CAAE,UAAU,CAAA;AAAA,IAC5B,sBAAsB,CAAA,CAAE,oBAAA;AAAA,IACxB,aAAa,EAAE,IAAA,EAAM,EAAE,UAAA,EAAY,KAAA,EAAO,EAAE,WAAA,EAAY;AAAA,IACxD,UAAA,EAAY,GAAA,CAAI,CAAA,CAAE,UAAU;AAAA,GAC9B;AACF;AAEA,SAAS,cAAc,CAAA,EAA4C;AACjE,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,sBAAA;AAAA,IACN,OAAA,EAAS,EAAE,YAAA,EAAc,CAAA,CAAE,YAAA,EAAc,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAQ,OAAA,EAAS,CAAA,CAAE,OAAA,CAAQ,EAAA,EAAG;AAAA,IACjF,KAAK,CAAA,CAAE,GAAA;AAAA,IACP,QAAQ,CAAA,CAAE,MAAA;AAAA,IACV,WAAW,EAAE,EAAA,EAAI,EAAE,WAAA,EAAa,kBAAA,EAAoB,EAAE,kBAAA,EAAmB;AAAA,IACzE,SAAA,EAAW,GAAA,CAAI,CAAA,CAAE,SAAS,CAAA;AAAA,IAC1B,UAAA,EAAY,GAAA,CAAI,CAAA,CAAE,UAAU,CAAA;AAAA,IAC5B,aAAa,EAAE,IAAA,EAAM,EAAE,UAAA,EAAY,KAAA,EAAO,EAAE,WAAA;AAAY,GAC1D;AACF;AAEA,IAAM,YAAY,CAAC,CAAA,KAA0B,MAAA,CAAO,MAAA,CAAO,EAAE,YAAA,EAAc,CAAA,CAAE,YAAA,EAAc,MAAA,EAAQ,EAAE,MAAA,EAAQ,OAAA,EAAS,CAAA,CAAE,OAAA,CAAQ,IAAI,CAAA;AAEpI,SAAS,WAAW,CAAA,EAAmC;AACrD,EAAA,MAAM,IAAA,GAAO;AAAA,IACX,IAAA,EAAM,iBAAA;AAAA,IACN,UAAA,EAAY,EAAE,YAAA,EAAc,CAAA,CAAE,WAAW,YAAA,EAAc,MAAA,EAAQ,CAAA,CAAE,UAAA,CAAW,MAAA,EAAQ,OAAA,EAAS,CAAA,CAAE,UAAA,CAAW,QAAQ,EAAA,EAAG;AAAA,IACrH,SAAA,EAAW,GAAA,CAAI,CAAA,CAAE,SAAS,CAAA;AAAA,IAC1B,QAAQ,CAAA,CAAE,MAAA;AAAA,IACV,OAAO,CAAA,CAAE;AAAA,GACX;AACA,EAAA,IAAI,CAAA,CAAE,UAAU,aAAA,EAAe,OAAO,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO;AAClE,EAAA,IAAI,CAAA,CAAE,WAAW,aAAA,EAAe;AAC9B,IAAA,OAAO,EAAE,GAAG,IAAA,EAAM,IAAA,EAAM,EAAE,KAAK,CAAA,CAAE,IAAA,CAAK,GAAA,EAAK,KAAA,EAAO,CAAA,CAAE,IAAA,CAAK,OAAO,SAAA,EAAW,GAAA,CAAI,CAAA,CAAE,IAAA,CAAK,SAAS,CAAA,EAAG,UAAA,EAAY,GAAA,CAAI,CAAA,CAAE,IAAA,CAAK,UAAU,CAAA,EAAE,EAAE;AAAA,EACzI;AACA,EAAA,OAAQ,CAAA,CAAE,sBAAsB,EAAE,GAAG,MAAM,mBAAA,EAAqB,CAAA,CAAE,qBAAoB,GAAI,IAAA;AAC5F;AAGO,SAAS,eAAe,MAAA,EAAkC;AAC/D,EAAA,MAAM,QAAA,GAAW,gBAAA,CAAiB,MAAA,CAAO,KAAK,CAAA;AAC9C,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,KAAU,0BAAU,IAAA,EAAK,CAAA;AAC9C,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,CAAO,WAAA,EAAa,GAAG,aAAa,CAAA;AAC3D,EAAA,MAAM,cAAA,GAAiB,OAAA,CAAQ,MAAA,CAAO,mBAAA,EAAqB,MAAM,qBAAqB,CAAA;AACtF,EAAA,MAAM,cAAA,GAAiB,OAAA,CAAQ,MAAA,CAAO,yBAAA,EAA2B,IAAI,2BAA2B,CAAA;AAChG,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,KAAA,GAClB,MAAA,CAAO,MAAA,CAAO;AAAA,IACZ,cAAA,EAAgB,MAAA,CAAO,MAAA,CAAO,CAAC,GAAG,MAAA,CAAO,KAAA,CAAM,cAAc,CAAA,CAAE,GAAA,CAAI,MAAM,CAAC,CAAA;AAAA,IAC1E,SAAA,EAAW,MAAA,CAAO,KAAA,CAAM,SAAA,IAAa,GAAA;AAAA,IACrC,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,QAAA,IAAY,MAAA;AAAA,IACnC,OAAO,MAAA,CAAO,KAAA,CAAM,SAAS,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU;AAAA,GAC9D,CAAA,GACD,IAAA;AACJ,EAAA,MAAM,MAAM,MAAc;AACxB,IAAA,MAAM,CAAA,GAAI,KAAA,EAAM,CAAE,OAAA,EAAQ;AAC1B,IAAA,IAAI,CAAC,OAAO,QAAA,CAAS,CAAC,GAAG,MAAM,IAAI,eAAe,oCAAoC,CAAA;AACtF,IAAA,OAAO,CAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,QAAA,GAAqB;AAAA,IACzB,iBAAiB,QAAA,EAAU;AACzB,MAAA,MAAM,UAAU,wBAAA,CAAyB,QAAA,EAAU,QAAA,EAAU,GAAA,IAAO,MAAM,CAAA;AAC1E,MAAA,IAAI,CAAC,OAAA,CAAQ,EAAA,EAAI,OAAO,MAAA,CAAO,OAAO,OAAA,CAAQ,IAAA,KAAS,MAAA,GAAY,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,OAAA,CAAQ,MAAA,EAAO,GAAI,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,IAAA,EAAM,OAAA,CAAQ,IAAA,EAAM,CAAA;AACpK,MAAA,OAAO,OAAO,MAAA,CAAO,EAAE,EAAA,EAAI,IAAA,EAAM,YAAY,KAAA,CAAM,QAAA,EAAU,YAAA,EAAc,cAAA,CAAe,QAAQ,QAAQ,CAAA,EAAG,OAAA,CAAQ,QAAQ,GAAG,CAAA;AAAA,IAClI,CAAA;AAAA,IAEA,MAAM,WAAA,CAAY,UAAA,EAAY,OAAA,EAAS;AACrC,MAAA,MAAM,QAAA,GAAW,MAAA,CAA2B,QAAA,EAAU,YAAA,EAAc,UAAU,CAAA;AAC9E,MAAA,MAAM,UAAU,EAAE,MAAA,EAAQ,GAAA,EAAK,MAAA,EAAQ,UAAU,cAAA,EAAe;AAChE,MAAA,MAAM,MAAA,GAAS,OAAA,EAAS,GAAA,KAAQ,QAAA,GAAW,MAAM,UAAA,CAAW,QAAA,EAAU,OAAO,CAAA,GAAI,MAAM,cAAA,CAAe,QAAA,EAAU,OAAO,CAAA;AACvH,MAAA,OAAO,MAAM,QAAA,EAAU,QAAA,EAAU,UAAA,CAAW,MAAM,GAAG,MAAM,CAAA;AAAA,IAC7D,CAAA;AAAA,IAEA,MAAM,UAAA,EAAY;AAChB,MAAA,MAAM,CAAA,GAAI,MAAA,CAA2B,QAAA,EAAU,YAAA,EAAc,UAAU,CAAA;AACvE,MAAA,OAAO,OAAO,MAAA,CAAO;AAAA,QACnB,OAAA,EAAS,MAAA,CAAO,MAAA,CAAO,EAAE,cAAc,CAAA,CAAE,YAAA,EAAc,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAQ,OAAA,EAAS,CAAA,CAAE,OAAA,CAAQ,IAAI,CAAA;AAAA,QAChG,KAAK,CAAA,CAAE,GAAA;AAAA,QACP,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,YAAY,CAAA,CAAE,UAAA;AAAA,QACd,QAAQ,MAAA,CAAO,MAAA,CAAO,CAAC,GAAG,CAAA,CAAE,MAAM,CAAC,CAAA;AAAA,QACnC,cAAc,MAAA,CAAO,MAAA,CAAO,CAAC,GAAG,CAAA,CAAE,YAAY,CAAC,CAAA;AAAA,QAC/C,iBAAiB,CAAA,CAAE,eAAA;AAAA;AAAA,QAEnB,SAAA,EAAW,MAAA,CAAO,MAAA,CAAO,EAAE,EAAA,EAAI,CAAA,CAAE,WAAA,EAAa,SAAA,EAAW,UAAA,CAAW,IAAA,CAAK,CAAA,CAAE,SAAS,GAAG,CAAA;AAAA,QACvF,SAAA,EAAW,GAAA,CAAI,CAAA,CAAE,SAAS,CAAA;AAAA,QAC1B,UAAA,EAAY,GAAA,CAAI,CAAA,CAAE,UAAU;AAAA,OAC7B,CAAA;AAAA,IACH,CAAA;AAAA,IAEA,QAAA,CAAS,YAAY,MAAA,EAAQ;AAC3B,MAAA,MAAM,CAAA,GAAI,MAAA,CAA2B,QAAA,EAAU,YAAA,EAAc,UAAU,CAAA;AACvE,MAAA,MAAM,EAAA,GAAK,MAAA,CAAuB,QAAA,EAAU,QAAA,EAAU,MAAM,CAAA;AAC5D,MAAA,MAAM,KAAK,GAAA,EAAI;AACf,MAAA,MAAM,MAAA,GAAS,KAAA,CAAM,CAAA,EAAG,EAAA,EAAI,EAAE,KAAK,EAAA,EAAI,MAAA,EAAQ,cAAA,EAAgB,cAAA,EAAgB,CAAA;AAC/E,MAAA,OAAO,MAAA,CAAO,MAAA,CAAO,EAAE,IAAA,EAAM,UAAA,EAAY,GAAG,MAAA,EAAQ,QAAA,EAAU,GAAA,CAAI,EAAE,CAAA,EAAG,CAAA;AAAA,IACzE,CAAA;AAAA,IAEA,mBAAmB,QAAA,EAAU;AAC3B,MAAA,MAAM,UAAU,wBAAA,CAAyB,QAAA,EAAU,UAAU,GAAA,EAAI,EAAG,QAAQ,KAAK,CAAA;AACjF,MAAA,IAAI,CAAC,QAAQ,EAAA,EAAI;AACf,QAAA,MAAM,SAAS,OAAA,CAAQ,MAAA;AACvB,QAAA,OAAO,OAAO,MAAA,CAAO,OAAA,CAAQ,IAAA,KAAS,MAAA,GAAY,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAO,GAAI,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,IAAA,EAAM,OAAA,CAAQ,MAAM,CAAA;AAAA,MACrH;AACA,MAAA,OAAO,OAAO,MAAA,CAAO,EAAE,EAAA,EAAI,IAAA,EAAM,YAAY,KAAA,CAAM,QAAA,EAAU,WAAA,EAAa,aAAA,CAAc,QAAQ,QAAQ,CAAA,EAAG,OAAA,CAAQ,QAAQ,GAAG,CAAA;AAAA,IAChI,CAAA;AAAA,IAEA,MAAM,kBAAA,CAAmB,UAAA,EAAY,IAAA,EAAM;AACzC,MAAA,MAAM,CAAA,GAAI,MAAA,CAA2B,QAAA,EAAU,WAAA,EAAa,UAAU,CAAA;AAEtE,MAAA,MAAM,QAAA,GAAW,SAAA,CAAU,IAAA,EAAM,MAAO,CAAA;AACxC,MAAA,IAAI,CAAC,QAAA,EAAU,OAAO,MAAA,CAAO,MAAA,CAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAa,CAAA;AACtE,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,CAAA,EAAG,QAAQ,CAAA;AACvC,MAAA,IAAI,CAAC,IAAA,CAAK,EAAA,EAAI,OAAO,MAAA,CAAO,MAAA,CAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,CAAA;AACrE,MAAA,MAAM,QAAA,GAA6B,EAAE,UAAA,EAAY,CAAA,EAAG,OAAO,IAAA,CAAK,OAAA,GAAU,SAAA,GAAY,QAAA,EAAU,SAAA,EAAW,IAAA,CAAK,SAAA,EAAW,UAAA,EAAY,KAAK,UAAA,EAAW;AACvJ,MAAA,MAAM,IAAA,GAAO;AAAA,QACX,IAAA,EAAM,iBAAA;AAAA,QACN,UAAA,EAAY,EAAE,YAAA,EAAc,CAAA,CAAE,YAAA,EAAc,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAQ,OAAA,EAAS,CAAA,CAAE,OAAA,CAAQ,EAAA,EAAG;AAAA,QACpF,OAAO,QAAA,CAAS,KAAA;AAAA,QAChB,MAAM,EAAE,GAAA,EAAK,CAAA,CAAE,UAAA,EAAY,OAAO,CAAA,CAAE,WAAA,EAAa,SAAA,EAAW,GAAA,CAAI,KAAK,SAAS,CAAA,EAAG,YAAY,GAAA,CAAI,IAAA,CAAK,UAAU,CAAA;AAAE,OACpH;AACA,MAAA,OAAO,MAAA,CAAO,MAAA,CAAO,EAAE,EAAA,EAAI,IAAA,EAAM,MAAA,EAAQ,KAAA,CAAM,QAAA,EAAU,UAAA,EAAY,IAAA,EAAM,QAAQ,CAAA,EAAG,CAAA;AAAA,IACxF,CAAA;AAAA,IAEA,eAAA,CAAgB,YAAY,MAAA,EAAQ;AAClC,MAAA,MAAM,CAAA,GAAI,MAAA,CAA2B,QAAA,EAAU,WAAA,EAAa,UAAU,CAAA;AACtE,MAAA,MAAM,KAAK,MAAA,KAAW,MAAA,GAAY,OAAO,MAAA,CAAyB,QAAA,EAAU,YAAY,MAAM,CAAA;AAC9F,MAAA,IAAI,EAAA,KAAO,EAAA,CAAG,UAAA,CAAW,YAAA,KAAiB,CAAA,CAAE,gBAAgB,EAAA,CAAG,UAAA,CAAW,MAAA,KAAW,CAAA,CAAE,MAAA,CAAA,EAAS;AAC9F,QAAA,MAAM,IAAI,eAAe,+CAA+C,CAAA;AAAA,MAC1E;AACA,MAAA,OAAO,OAAO,MAAA,CAAO;AAAA,QACnB,OAAA,EAAS,UAAU,CAAC,CAAA;AAAA,QACpB,KAAK,CAAA,CAAE,GAAA;AAAA,QACP,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,SAAA,EAAW,MAAA,CAAO,MAAA,CAAO,EAAE,EAAA,EAAI,CAAA,CAAE,WAAA,EAAa,SAAA,EAAW,UAAA,CAAW,IAAA,CAAK,CAAA,CAAE,SAAS,GAAG,CAAA;AAAA,QACvF,SAAA,EAAW,GAAA,CAAI,CAAA,CAAE,SAAS,CAAA;AAAA,QAC1B,UAAA,EAAY,GAAA,CAAI,CAAA,CAAE,UAAU,CAAA;AAAA,QAC5B,gBAAgB,EAAA,GAAK,MAAA,CAAO,OAAO,EAAE,KAAA,EAAO,GAAG,KAAA,EAAO,SAAA,EAAW,IAAI,EAAA,CAAG,SAAS,GAAG,UAAA,EAAY,GAAA,CAAI,GAAG,UAAU,CAAA,EAAG,CAAA,GAAI;AAAA,OACzH,CAAA;AAAA,IACH;AAAA,GACF;AACA,EAAA,OAAO,MAAA,CAAO,OAAO,QAAQ,CAAA;AAC/B;AAGO,SAAS,kBAAkB,QAAA,EAA+B;AAC/D,EAAA,MAAM,GAAA,GAAM,UAAU,QAAQ,CAAA;AAC9B,EAAA,MAAM,OAAO,CAAC,CAAA,KAA+B,OAAO,CAAA,KAAM,WAAW,CAAA,GAAI,IAAA;AACzE,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,OAAO,MAAA,CAAO,MAAA,CAAO,EAAE,IAAA,EAAM,YAAA,EAAc,QAAA,EAAU,KAAA,EAAO,GAAA,EAAK,IAAA,EAAM,YAAA,EAAc,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,WAAA,EAAa,IAAA,EAAM,UAAA,EAAY,IAAA,EAAM,MAAA,EAAQ,MAAA,CAAO,MAAA,CAAO,EAAE,CAAA,EAAG,SAAA,EAAW,IAAA,EAAM,UAAA,EAAY,IAAA,EAAM,OAAA,EAAS,YAAY,CAAA;AAAA,EACnO;AACA,EAAA,MAAM,OAAA,GAAU,IAAI,iBAAA,IAAqB,OAAO,IAAI,iBAAA,KAAsB,QAAA,GAAY,IAAI,iBAAA,GAAgD,IAAA;AAC1I,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,OAAA,CAAQ,OAAA,EAAS,KAAK,CAAA,GAAI,OAAA,CAAQ,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,KAAmB,OAAO,CAAA,KAAM,QAAQ,IAAI,EAAC;AAClH,EAAA,MAAM,UAAA,GAAyB;AAAA,IAC7B,IAAA,EAAM,YAAA;AAAA,IACN,QAAA,EAAU,KAAA;AAAA,IACV,GAAA,EAAK,IAAA,CAAK,OAAA,EAAS,EAAE,CAAA;AAAA,IACrB,YAAA,EAAc,IAAA,CAAK,GAAA,CAAI,EAAE,CAAA;AAAA,IACzB,MAAA,EAAQ,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA;AAAA,IACvB,WAAA,EAAa,IAAA,CAAK,OAAA,EAAS,YAAY,CAAA;AAAA,IACvC,UAAA,EAAY,IAAA,CAAK,OAAA,EAAS,UAAU,CAAA;AAAA,IACpC,MAAA,EAAQ,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA;AAAA,IAC5B,SAAA,EAAW,IAAA,CAAK,GAAA,CAAI,SAAS,CAAA;AAAA,IAC7B,UAAA,EAAY,IAAA,CAAK,GAAA,CAAI,UAAU,CAAA;AAAA,IAC/B,GAAI,OAAA,GAAU,EAAC,GAAI,EAAE,SAAS,kBAAA;AAA4B,GAC5D;AACA,EAAA,OAAO,MAAA,CAAO,OAAO,UAAU,CAAA;AACjC;;;AChSA,IAAM,KAAA,GAAQ,iDAAA;AACd,IAAM,OAAA,GAAU,oBAAA;AAChB,IAAM,IAAA,GAAO,wCAAA;AACb,IAAM,SAAA,GAAY,KAAA;AAElB,IAAM,MAAA,GAAS,CAAC,CAAA,KAAc,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,CAAE,KAAA,CAAM,CAAC,KAAA,KAAU,KAAA,CAAM,IAAA,CAAK,KAAK,CAAC,CAAA;AAC7E,IAAM,OAAO,CAAC,CAAA,KAAc,MAAM,SAAA,IAAa,IAAA,CAAK,KAAK,CAAC,CAAA;AAGnD,SAAS,SAAS,KAAA,EAAkC;AACzD,EAAA,IAAI,OAAO,UAAU,QAAA,IAAY,CAAC,MAAM,UAAA,CAAW,WAAW,GAAG,OAAO,IAAA;AACxE,EAAA,MAAM,GAAA,GAAM,KAAA;AACZ,EAAA,MAAM,QAAQ,KAAA,CAAM,KAAA,CAAM,YAAY,MAAM,CAAA,CAAE,MAAM,GAAG,CAAA;AACvD,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,MAAM,CAAC,KAAA,EAAO,MAAM,CAAA,GAAI,KAAA;AACxB,IAAA,IAAI,WAAW,SAAA,EAAW;AAExB,MAAA,IAAI,MAAM,UAAA,CAAW,IAAI,GAAG,OAAO,OAAA,CAAQ,KAAK,KAAK,CAAA,GAAI,MAAA,CAAO,MAAA,CAAO,EAAE,KAAA,EAAO,yBAAA,EAA2B,KAAK,OAAA,EAAS,KAAA,EAAO,CAAA,GAAI,IAAA;AACpI,MAAA,OAAO,MAAA,CAAO,KAAK,CAAA,GAAI,MAAA,CAAO,MAAA,CAAO,EAAE,KAAA,EAAO,uBAAA,EAAyB,GAAA,EAAK,MAAA,EAAQ,KAAA,EAAO,CAAA,GAAI,IAAA;AAAA,IACjG;AACA,IAAA,OAAO,OAAO,KAAK,CAAA,IAAK,IAAA,CAAK,MAAM,IAAI,MAAA,CAAO,MAAA,CAAO,EAAE,KAAA,EAAO,qBAAqB,GAAA,EAAK,MAAA,EAAQ,OAAO,IAAA,EAAM,MAAA,EAAQ,CAAA,GAAI,IAAA;AAAA,EAC3H;AACA,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,MAAM,CAAC,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA,GAAI,KAAA;AAC9B,IAAA,OAAO,MAAA,CAAO,IAAI,CAAA,IAAK,OAAA,CAAQ,KAAK,OAAO,CAAA,IAAK,KAAK,IAAI,CAAA,GAAI,OAAO,MAAA,CAAO,EAAE,OAAO,qBAAA,EAAuB,GAAA,EAAK,MAAM,OAAA,EAAS,IAAA,EAAM,IAAA,EAAM,CAAA,GAAI,IAAA;AAAA,EACjJ;AACA,EAAA,OAAO,IAAA;AACT","file":"index.js","sourcesContent":["/**\n * A value that this verifier did not produce was passed where one of its results\n * is required: a copy, an altered object, a result of another verifier, or a\n * hand-made one. A programming error, never a verification outcome.\n */\nexport class AriaUsageError extends TypeError {\n constructor(message: string) {\n super(message);\n this.name = 'AriaUsageError';\n }\n}\n","/**\n * ARIA canonical JSON (INVARIANTS §3): keys sorted at every level, no whitespace,\n * `JSON.stringify` escaping. The same function as `@aria-registry/verify`'s, so the\n * bytes match what the authority signs. It is not generic JCS; the closed AID\n * schema keeps it out of the cases where the two differ.\n */\nexport function canonicalJson(value: unknown): string {\n return JSON.stringify(value, (_, v) => {\n if (v && typeof v === 'object' && !Array.isArray(v)) {\n return Object.keys(v).sort().reduce((sorted: Record<string, unknown>, key) => {\n sorted[key] = (v as Record<string, unknown>)[key];\n return sorted;\n }, {});\n }\n return v;\n });\n}\n","const BASE58 = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';\n\n/** Unpadded or padded base64url to bytes; `null` for anything else. */\nexport function fromBase64url(text: string): Uint8Array | null {\n if (!/^[A-Za-z0-9_-]*={0,2}$/.test(text)) return null;\n let base64 = text.replace(/=+$/, '').replace(/-/g, '+').replace(/_/g, '/');\n if (base64.length % 4 === 1) return null;\n while (base64.length % 4 !== 0) base64 += '=';\n const binary = atob(base64);\n const bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);\n return bytes;\n}\n\n/** Base58btc (Bitcoin alphabet) to bytes, keeping leading zero bytes; `null` for anything else. */\nexport function fromBase58btc(text: string): Uint8Array | null {\n if (text.length === 0) return null;\n let n = 0n;\n for (const ch of text) {\n const digit = BASE58.indexOf(ch);\n if (digit < 0) return null;\n n = n * 58n + BigInt(digit);\n }\n const body: number[] = [];\n while (n > 0n) {\n body.unshift(Number(n & 0xffn));\n n >>= 8n;\n }\n let zeros = 0;\n while (zeros < text.length && text[zeros] === '1') zeros++;\n return Uint8Array.from([...new Array<number>(zeros).fill(0), ...body]);\n}\n\nexport function toBase64(bytes: Uint8Array): string {\n let binary = '';\n for (const b of bytes) binary += String.fromCharCode(b);\n return btoa(binary);\n}\n","import { ed25519 } from '@noble/curves/ed25519.js';\nimport { ml_dsa65 } from '@noble/post-quantum/ml-dsa.js';\nimport { canonicalJson } from './canonical';\nimport { fromBase64url } from './encoding';\n\nconst HEADER = 4;\nconst ML_DSA_65_SIGNATURE = 3309;\nconst ED25519_SIGNATURE = 64;\n\n/** The composite suite every issuer signature in profile 1 uses. */\nexport const SUITE = 'mldsa65-ed25519-2026';\n\nexport interface IssuerKeys {\n readonly mldsa65: Uint8Array;\n readonly ed25519: Uint8Array;\n}\n\n/**\n * Splits a composite `proofValue` (multibase `u` + base64url, or the bare form of\n * earlier issuance) into its two signatures. The length header decides between the\n * readings, not the first character.\n */\nfunction decode(proofValue: string): { pq: Uint8Array; classical: Uint8Array } | null {\n const readings = proofValue.startsWith('u') ? [proofValue.slice(1), proofValue] : [proofValue];\n for (const reading of readings) {\n const bytes = fromBase64url(reading);\n if (!bytes || bytes.length !== HEADER + ML_DSA_65_SIGNATURE + ED25519_SIGNATURE) continue;\n if (new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength).getUint32(0, false) !== ML_DSA_65_SIGNATURE) continue;\n return { pq: bytes.slice(HEADER, HEADER + ML_DSA_65_SIGNATURE), classical: bytes.slice(HEADER + ML_DSA_65_SIGNATURE) };\n }\n return null;\n}\n\n/**\n * True only when both halves verify under `keys` over the canonical JSON of\n * `document` without its `proof`. The proof object itself is outside the signed\n * bytes in this suite.\n */\nexport function verifyComposite(document: Record<string, unknown>, proofValue: string, keys: IssuerKeys): boolean {\n const signatures = decode(proofValue);\n if (!signatures) return false;\n const { proof: _, ...unsigned } = document;\n const payload = new TextEncoder().encode(canonicalJson(unsigned));\n try {\n return ml_dsa65.verify(signatures.pq, payload, keys.mldsa65) && ed25519.verify(signatures.classical, payload, keys.ed25519);\n } catch {\n return false;\n }\n}\n","/** Bounds on one fetch: an exact origin from the trusted configuration, no redirects, a time and a size. */\nexport interface Bounds {\n readonly allowedOrigins: readonly string[];\n readonly timeoutMs: number;\n readonly maxBytes: number;\n readonly fetch: typeof fetch;\n}\n\nexport type Fetched = { readonly ok: true; readonly body: Uint8Array } | { readonly ok: false; readonly reason: 'origin_not_allowed' | 'fetch_failed' | 'too_large' };\n\n/** GETs `url` over HTTPS from an allowed origin, refusing redirects and bodies over the bound. */\nexport async function boundedGet(url: string, bounds: Bounds): Promise<Fetched> {\n let target: URL;\n try {\n target = new URL(url);\n } catch {\n return { ok: false, reason: 'origin_not_allowed' };\n }\n if (target.protocol !== 'https:' || !bounds.allowedOrigins.includes(target.origin)) return { ok: false, reason: 'origin_not_allowed' };\n const abort = new AbortController();\n const timer = setTimeout(() => abort.abort(), bounds.timeoutMs);\n try {\n const response = await bounds.fetch(target.href, { redirect: 'error', signal: abort.signal, headers: { accept: 'application/json' } });\n if (response.status !== 200 || !response.body) return { ok: false, reason: 'fetch_failed' };\n const declared = Number(response.headers.get('content-length') ?? '0');\n if (declared > bounds.maxBytes) return { ok: false, reason: 'too_large' };\n const chunks: Uint8Array[] = [];\n let size = 0;\n const reader = response.body.getReader();\n for (;;) {\n const { done, value } = await reader.read();\n if (done) break;\n size += value.byteLength;\n if (size > bounds.maxBytes) {\n await reader.cancel();\n return { ok: false, reason: 'too_large' };\n }\n chunks.push(value);\n }\n const body = new Uint8Array(size);\n let at = 0;\n for (const c of chunks) {\n body.set(c, at);\n at += c.byteLength;\n }\n return { ok: true, body };\n } catch {\n return { ok: false, reason: 'fetch_failed' };\n } finally {\n clearTimeout(timer);\n }\n}\n\n/** Gunzips at most `maxBytes`; `null` if the data is not GZIP or decompresses to more. */\nexport async function gunzipBounded(data: Uint8Array, maxBytes: number): Promise<Uint8Array | null> {\n try {\n const stream = new Blob([data]).stream().pipeThrough(new DecompressionStream('gzip'));\n const reader = stream.getReader();\n const chunks: Uint8Array[] = [];\n let size = 0;\n for (;;) {\n const { done, value } = await reader.read();\n if (done) break;\n size += value.byteLength;\n if (size > maxBytes) {\n await reader.cancel();\n return null;\n }\n chunks.push(value);\n }\n const out = new Uint8Array(size);\n let at = 0;\n for (const c of chunks) {\n out.set(c, at);\n at += c.byteLength;\n }\n return out;\n } catch {\n return null;\n }\n}\n","// RFC 3339 date-time in UTC or with an offset; seconds required, fraction optional.\nconst RFC3339 = /^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(\\.\\d{1,9})?(Z|[+-]\\d{2}:\\d{2})$/;\n\n/** Milliseconds since the epoch for a strict RFC 3339 instant; `null` for anything else, including impossible dates. */\nexport function instant(value: unknown): number | null {\n if (typeof value !== 'string') return null;\n const m = RFC3339.exec(value);\n if (!m) return null;\n const [, y, mo, d, h, mi, s] = m.map(Number) as [number, number, number, number, number, number, number];\n if (mo < 1 || mo > 12 || d < 1 || d > 31 || h > 23 || mi > 59 || s > 59) return null;\n const ms = Date.parse(value);\n if (Number.isNaN(ms)) return null;\n // Date.parse rolls 2026-02-31 over to March; the calendar day must survive.\n const offset = m[8] === 'Z' ? 0 : (m[8]!.startsWith('-') ? -1 : 1) * (Number(m[8]!.slice(1, 3)) * 60 + Number(m[8]!.slice(4, 6)));\n const local = new Date(ms + offset * 60_000);\n if (local.getUTCFullYear() !== y || local.getUTCMonth() + 1 !== mo || local.getUTCDate() !== d) return null;\n return ms;\n}\n\nexport function iso(ms: number): string {\n return new Date(ms).toISOString().replace('.000Z', 'Z');\n}\n","import type { StatusUnavailable } from '../status';\nimport { SUITE, verifyComposite } from './composite';\nimport { fromBase64url } from './encoding';\nimport { boundedGet, gunzipBounded, type Bounds } from './fetch';\nimport { instant } from './instant';\nimport type { CredentialSnapshot } from './verify-credential';\n\n/** Status evidence as the verifier holds it. */\nexport type StatusSnapshot =\n | {\n readonly source: 'status-list';\n readonly state: 'active' | 'revoked';\n readonly credential: CredentialSnapshot;\n readonly list: { readonly url: string; readonly index: number; readonly validFrom: number; readonly validUntil: number };\n readonly fetchedAt: number;\n }\n | {\n readonly source: 'online';\n readonly state: 'active' | 'revoked' | 'superseded';\n readonly credential: CredentialSnapshot;\n readonly currentCredentialId: string | null;\n readonly fetchedAt: number;\n }\n | {\n readonly source: 'status-list' | 'online';\n readonly state: 'unavailable';\n readonly credential: CredentialSnapshot;\n readonly reason: StatusUnavailable;\n readonly fetchedAt: number;\n };\n\n/** The longest validity a status list may state: 24 hours, re-signed hourly (owner decision of 2026-10-02). */\nexport const MAX_LIST_VALIDITY_MS = 24 * 3_600_000;\nconst MIN_LIST_BYTES = 131_072 / 8;\nconst MAX_LIST_BYTES = 2 * 1024 * 1024;\n\nexport interface StatusContext {\n readonly bounds: Bounds | null;\n /** The verifier's clock, read when the evidence is complete, not when the request started. */\n readonly now: () => number;\n readonly skewMs: number;\n readonly maxAgeMs: number;\n}\n\nconst unavailable = (source: 'status-list' | 'online', credential: CredentialSnapshot, reason: StatusUnavailable, fetchedAt: number): StatusSnapshot => ({\n source,\n state: 'unavailable',\n credential,\n reason,\n fetchedAt,\n});\n\nfunction json(body: Uint8Array): Record<string, unknown> | null {\n try {\n const value: unknown = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(body));\n return value && typeof value === 'object' && !Array.isArray(value) ? (value as Record<string, unknown>) : null;\n } catch {\n return null;\n }\n}\n\nexport type ListReading =\n | { readonly ok: true; readonly revoked: boolean; readonly validFrom: number; readonly validUntil: number }\n | { readonly ok: false; readonly reason: 'malformed' | 'signature_invalid' | 'wrong_issuer' | 'invalid_validity' };\n\n/**\n * The credential's own bit in `list`, read only after the list verifies under the\n * same issuer and is the exact list the credential names, in the supported profile\n * (one revocation bit per entry). Its validity bounds are checked as data; whether\n * they hold now is the caller's judgment.\n */\nexport async function readList(credential: CredentialSnapshot, list: Record<string, unknown>): Promise<ListReading> {\n const profile = credential.profile;\n const proof = list.proof as Record<string, unknown> | undefined;\n const types = list.type;\n if (list.issuer !== profile.issuer) return { ok: false, reason: 'wrong_issuer' };\n if (\n // Another genuine list of the same issuer is not this credential's list.\n list.id !== credential.statusList ||\n !Array.isArray(types) ||\n !types.includes('VerifiableCredential') ||\n !types.includes('BitstringStatusListCredential') ||\n !proof ||\n proof.type !== 'DataIntegrityProof' ||\n proof.cryptosuite !== SUITE ||\n proof.proofPurpose !== 'assertionMethod' ||\n proof.verificationMethod !== profile.verificationMethod ||\n typeof proof.proofValue !== 'string'\n ) {\n return { ok: false, reason: 'malformed' };\n }\n if (!verifyComposite(list, proof.proofValue, profile.keys)) return { ok: false, reason: 'signature_invalid' };\n\n // The supported subject: a revocation list of one bit per entry, as W3C Bitstring Status List defines by default.\n const subject = list.credentialSubject as Record<string, unknown> | undefined;\n const encoded = subject?.encodedList;\n if (\n !subject ||\n subject.type !== 'BitstringStatusList' ||\n subject.statusPurpose !== 'revocation' ||\n (subject.statusSize !== undefined && subject.statusSize !== 1) ||\n typeof encoded !== 'string' ||\n !encoded.startsWith('u')\n ) {\n return { ok: false, reason: 'malformed' };\n }\n const packed = fromBase64url(encoded.slice(1));\n const bits = packed && (await gunzipBounded(packed, MAX_LIST_BYTES));\n if (!bits || bits.length < MIN_LIST_BYTES || credential.statusIndex >= bits.length * 8) return { ok: false, reason: 'malformed' };\n\n const validFrom = instant(list.validFrom);\n const validUntil = instant(list.validUntil);\n if (validFrom === null || validUntil === null || validUntil <= validFrom || validUntil - validFrom > MAX_LIST_VALIDITY_MS) return { ok: false, reason: 'invalid_validity' };\n const revoked = ((bits[credential.statusIndex >> 3]! >> (7 - (credential.statusIndex & 7))) & 1) === 1;\n return { ok: true, revoked, validFrom, validUntil };\n}\n\n/**\n * The credential's status from the signed list it names, fetched now. Times are\n * judged once the list is processed.\n */\nexport async function fromStatusList(credential: CredentialSnapshot, context: StatusContext): Promise<StatusSnapshot> {\n const { bounds } = context;\n if (!bounds) return unavailable('status-list', credential, 'offline', context.now());\n const fetched = await boundedGet(credential.statusList, bounds);\n if (!fetched.ok) return unavailable('status-list', credential, fetched.reason, context.now());\n const list = json(fetched.body);\n if (!list) return unavailable('status-list', credential, 'malformed', context.now());\n const read = await readList(credential, list);\n\n // Judged now, after retrieval, signature and decompression: a list may have expired meanwhile.\n const now = context.now();\n if (!read.ok) return unavailable('status-list', credential, read.reason === 'invalid_validity' ? 'not_valid_now' : read.reason, now);\n const { validFrom, validUntil } = read;\n if (validFrom > now + context.skewMs || validUntil <= now) return unavailable('status-list', credential, 'not_valid_now', now);\n if (now - validFrom > context.maxAgeMs) return unavailable('status-list', credential, 'stale', now);\n return {\n source: 'status-list',\n state: read.revoked ? 'revoked' : 'active',\n credential,\n list: { url: credential.statusList, index: credential.statusIndex, validFrom, validUntil },\n fetchedAt: now,\n };\n}\n\n/**\n * The issuer's online answer for the DID's current credential. An answer naming\n * another document makes the presented one `superseded`; the answer carries no\n * signed time.\n */\nexport async function fromOnline(credential: CredentialSnapshot, context: StatusContext): Promise<StatusSnapshot> {\n const { bounds } = context;\n const endpoint = credential.profile.onlineStatus;\n if (!endpoint) return unavailable('online', credential, 'no_online_endpoint', context.now());\n if (!bounds) return unavailable('online', credential, 'offline', context.now());\n const fetched = await boundedGet(`${endpoint}${credential.did}`, bounds);\n // The time the answer was observed, not when it was requested.\n const now = context.now();\n if (!fetched.ok) return unavailable('online', credential, fetched.reason, now);\n const answer = json(fetched.body);\n // A complete answer first: the DID, an exact document reference and a status. Only then can another reference mean superseded.\n if (\n !answer ||\n answer.did !== credential.did ||\n typeof answer.credentialId !== 'string' ||\n !isCredentialReference(answer.credentialId) ||\n (answer.status !== 'active' && answer.status !== 'revoked')\n ) {\n return unavailable('online', credential, 'malformed', now);\n }\n if (answer.credentialId !== credential.credentialId) {\n return { source: 'online', state: 'superseded', credential, currentCredentialId: answer.credentialId, fetchedAt: now };\n }\n return { source: 'online', state: answer.status, credential, currentCredentialId: null, fetchedAt: now };\n}\n\n/**\n * An exact credential document reference: an absolute https URL that the URL\n * parser accepts, with a host and a path, no query, fragment or credentials, and\n * already in its serialized form. Compared afterwards as the exact string.\n */\nfunction isCredentialReference(value: string): boolean {\n try {\n const url = new URL(value);\n return url.protocol === 'https:' && url.hostname !== '' && url.pathname.length > 1 && !url.search && !url.hash && !url.username && !url.password && url.href === value;\n } catch {\n return false;\n }\n}\n","import { AriaUsageError } from '../errors';\n\n/**\n * Where the SDK keeps what it established. A result object is only a frozen view;\n * the authoritative snapshot lives here, keyed by the object's identity and owned\n * by the verifier that produced it. A spread copy, a mutated object, a cast or a\n * result of another verifier has no entry, so it is refused rather than trusted.\n */\nconst records = new WeakMap<object, { readonly owner: object; readonly kind: string; readonly snapshot: unknown }>();\n\n/** Freezes `view`, records its snapshot for `owner`, and returns the view. */\nexport function issue<T extends object>(owner: object, kind: string, view: T, snapshot: unknown): T {\n deepFreeze(view);\n records.set(view, { owner, kind, snapshot });\n return view;\n}\n\n/** The snapshot `owner` recorded for `value` as `kind`; throws for anything else. */\nexport function recall<S>(owner: object, kind: string, value: unknown): S {\n const record = typeof value === 'object' && value !== null ? records.get(value) : undefined;\n if (!record || record.kind !== kind) {\n throw new AriaUsageError(`not a ${kind} this SDK produced: copies and altered values are refused`);\n }\n if (record.owner !== owner) {\n throw new AriaUsageError(`a ${kind} produced by another verifier is not trusted here`);\n }\n return record.snapshot as S;\n}\n\nfunction deepFreeze(value: unknown): void {\n if (typeof value !== 'object' || value === null || Object.isFrozen(value)) return;\n Object.freeze(value);\n for (const key of Reflect.ownKeys(value)) deepFreeze((value as Record<PropertyKey, unknown>)[key]);\n}\n","import type { StandingState } from '../status';\nimport type { StatusSnapshot } from './check-status';\nimport type { CredentialSnapshot } from './verify-credential';\n\nexport interface StandingRules {\n readonly now: number;\n readonly skewMs: number;\n readonly statusMaxAgeMs: number;\n readonly onlineMaxAgeMs: number;\n}\n\n/**\n * Whether one exact credential stands at `now`, in a fixed order: its signed\n * validity, then status evidence about that same verified result, its\n * availability and freshness, then its state. Pure; judged at every call.\n */\nexport function judge(credential: CredentialSnapshot, status: StatusSnapshot, rules: StandingRules): StandingState {\n const { now } = rules;\n if (credential.validUntil <= now || credential.validFrom > now + rules.skewMs) return { state: 'not_valid_now' };\n if (status.credential !== credential) return { state: 'unknown', reason: 'other_document' };\n if (status.state === 'unavailable') return { state: 'unknown', reason: 'unavailable' };\n if (status.source === 'status-list') {\n if (status.list.validUntil <= now || now - status.list.validFrom > rules.statusMaxAgeMs) return { state: 'unknown', reason: 'stale' };\n } else if (now - status.fetchedAt > rules.onlineMaxAgeMs) {\n return { state: 'unknown', reason: 'stale' };\n }\n if (status.state === 'revoked') return { state: 'revoked' };\n if (status.state === 'superseded') return { state: 'superseded' };\n return { state: 'good', source: status.source };\n}\n","{\n \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n \"$id\": \"https://aria.bar/schema/aid-1.0.json\",\n \"title\": \"ARIA Identity Document (AID) 1.0 (draft until the issuance cutover)\",\n \"description\": \"JSON Schema for the ARIA Identity Document (AID) \\u2014 a W3C Verifiable Credential (VC Data Model 2.0) that serves as the cryptographically signed identity document of an AI agent, anchored to DNS from L1. ARIA 1.0. The credential carries the agent's holder key (Ed25519, generated by the controller; the registry never holds the private half), a principal reference, the derived trust level and the scopes, and is secured by the composite mldsa65-ed25519-2026 proof. The schema is the authority: where prose and schema disagree, the schema wins.\",\n \"type\": \"object\",\n \"required\": [\n \"@context\",\n \"type\",\n \"id\",\n \"issuer\",\n \"validFrom\",\n \"validUntil\",\n \"credentialSubject\",\n \"credentialStatus\",\n \"proof\"\n ],\n \"properties\": {\n \"@context\": {\n \"type\": \"array\",\n \"items\": {\n \"type\": \"string\",\n \"format\": \"uri\"\n },\n \"minItems\": 2,\n \"prefixItems\": [\n {\n \"const\": \"https://www.w3.org/ns/credentials/v2\"\n },\n {\n \"const\": \"https://aria.bar/ns/v1\"\n }\n ],\n \"description\": \"JSON-LD context. Must include the W3C VC v2 context and the ARIA v1 context.\"\n },\n \"type\": {\n \"type\": \"array\",\n \"items\": {\n \"type\": \"string\"\n },\n \"minItems\": 2,\n \"contains\": {\n \"const\": \"VerifiableCredential\"\n },\n \"prefixItems\": [\n {\n \"const\": \"VerifiableCredential\"\n },\n {\n \"const\": \"ARIAIdentityDocument\"\n }\n ],\n \"description\": \"Credential type. Must include VerifiableCredential and ARIAIdentityDocument.\"\n },\n \"id\": {\n \"type\": \"string\",\n \"format\": \"uri\",\n \"pattern\": \"^https://api\\\\.aria\\\\.bar/v1/credentials/[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$\",\n \"description\": \"Unique credential-instance identifier per W3C VC 2.0 \\u00a74.4 \\u2014 a dereferenceable URL containing a UUIDv7 (RFC 9562). NOT the agent DID (the DID lives in credentialSubject.id). Each issuance produces a new id; the URL resolves to that specific signed instance, active or revoked. Equivalent to a TLS certificate serial number.\"\n },\n \"issuer\": {\n \"type\": \"string\",\n \"pattern\": \"^did:aria:.+$\",\n \"description\": \"The DID of the issuing registry. Typically did:aria:registry.aria.bar.\"\n },\n \"validFrom\": {\n \"type\": \"string\",\n \"format\": \"date-time\",\n \"description\": \"ISO 8601 datetime when the credential becomes valid.\"\n },\n \"validUntil\": {\n \"type\": \"string\",\n \"format\": \"date-time\",\n \"description\": \"ISO 8601 datetime when the credential expires. Maximum 1-year validity from issuance.\"\n },\n \"credentialStatus\": {\n \"type\": \"object\",\n \"required\": [\n \"id\",\n \"type\",\n \"statusPurpose\",\n \"statusListIndex\",\n \"statusListCredential\"\n ],\n \"properties\": {\n \"id\": {\n \"type\": \"string\",\n \"format\": \"uri\",\n \"description\": \"URI identifying the status entry. Format: <statusListCredential>#<index>.\"\n },\n \"type\": {\n \"type\": \"string\",\n \"const\": \"BitstringStatusListEntry\",\n \"description\": \"W3C Bitstring Status List v1.0 entry type.\"\n },\n \"statusPurpose\": {\n \"type\": \"string\",\n \"const\": \"revocation\",\n \"description\": \"Purpose of the status check. Always 'revocation' for AID documents.\"\n },\n \"statusListIndex\": {\n \"type\": \"string\",\n \"pattern\": \"^[0-9]+$\",\n \"description\": \"Index position in the status list bitstring.\"\n },\n \"statusListCredential\": {\n \"type\": \"string\",\n \"format\": \"uri\",\n \"description\": \"URI of the StatusList credential containing the bitstring.\"\n }\n },\n \"additionalProperties\": false,\n \"description\": \"W3C Bitstring Status List v1.0 revocation entry.\"\n },\n \"credentialSubject\": {\n \"type\": \"object\",\n \"required\": [\n \"id\",\n \"agentName\",\n \"version\",\n \"trustLevel\",\n \"scope\",\n \"delegationDepth\",\n \"maxDelegationDepth\",\n \"spec_version\",\n \"principal\",\n \"holderKey\",\n \"enrollmentAttestation\"\n ],\n \"properties\": {\n \"id\": {\n \"type\": \"string\",\n \"pattern\": \"^did:aria:[a-zA-Z0-9.-]+:[a-zA-Z0-9-]+(:[a-zA-Z0-9-]+)?$\",\n \"description\": \"The DID of the agent. Stable across reissuances. Two acceptable formats: did:aria:{verified-domain}:{agent-name} when the principal organization has DNS-verified its own domain, OR did:aria:{registry-host}:{principal-short-id}:{agent-name} when the agent lives under the registry-namespaced fallback (e.g. did:aria:aria.bar:u-abc12345:ordering-agent). The unique per-issuance identifier lives at the top-level 'id' field per W3C VC 2.0.\"\n },\n \"previousCredentialId\": {\n \"type\": \"string\",\n \"format\": \"uri\",\n \"pattern\": \"^https://api\\\\.aria\\\\.bar/v1/credentials/[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$\",\n \"description\": \"Optional. URL of the previous credential instance for this DID \\u2014 set when this AID supersedes an earlier one. Enables chain-of-issuance traceability. Omitted on first issuance. The URL resolves to the predecessor's signed AID document (which by then is revoked in the StatusList).\"\n },\n \"holderKey\": {\n \"type\": \"object\",\n \"required\": [\n \"id\",\n \"type\",\n \"publicKeyMultibase\"\n ],\n \"properties\": {\n \"id\": {\n \"type\": \"string\",\n \"pattern\": \"^did:aria:[a-zA-Z0-9.-]+:[a-zA-Z0-9-]+(:[a-zA-Z0-9-]+)?#holder-key-[0-9]+$\",\n \"description\": \"DID URL identifying this holder key. Format: <agentDID>#holder-key-<n> where n is monotonically increasing per re-issuance.\"\n },\n \"type\": {\n \"type\": \"string\",\n \"const\": \"Ed25519VerificationKey2020\",\n \"description\": \"W3C verification method type. Always Ed25519VerificationKey2020 for ARIA 1.0.\"\n },\n \"publicKeyMultibase\": {\n \"type\": \"string\",\n \"pattern\": \"^z[1-9A-HJ-NP-Za-km-z]+$\",\n \"description\": \"'z' + base58btc of the raw 32-byte Ed25519 public key. This is ARIA's own encoding, not Multikey (whose form of the same key adds the 0xed01 prefix). The agent generates the key pair and submits only the public key; no registry or authority ever holds the private key.\"\n }\n },\n \"additionalProperties\": false,\n \"description\": \"Holder verification key (Ed25519) bound to this AID. Possession is proved by signing with the corresponding private key: under ARIA AP, every request is signed with it. Verifiers MUST extract this key from the SIGNED credentialSubject \\u2014 never from external sources such as the registry database \\u2014 to preserve the PQC integrity guarantee. Re-issuance uses the key pair the agent submits for it; old holder proofs remain verifiable against superseded AIDs but not against the current one.\"\n },\n \"agentName\": {\n \"type\": \"string\",\n \"minLength\": 1,\n \"maxLength\": 64,\n \"pattern\": \"^[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]$|^[a-zA-Z0-9]$\",\n \"description\": \"Human-readable agent name. 1-64 characters, alphanumeric and hyphens only. Must start and end with an alphanumeric character.\"\n },\n \"version\": {\n \"type\": \"string\",\n \"pattern\": \"^(0|[1-9]\\\\d*)\\\\.(0|[1-9]\\\\d*)\\\\.(0|[1-9]\\\\d*)(?:-((?:0|[1-9]\\\\d*|\\\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\\\.(?:0|[1-9]\\\\d*|\\\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\\\+([0-9a-zA-Z-]+(?:\\\\.[0-9a-zA-Z-]+)*))?$\",\n \"description\": \"Semantic version of the agent software.\"\n },\n \"trustLevel\": {\n \"type\": \"string\",\n \"enum\": [\n \"L0\",\n \"L1\",\n \"L2\",\n \"L3\"\n ],\n \"description\": \"Trust level assigned to the agent. L0=Anchored, L1=Identified, L2=Certified, L3=Sovereign.\"\n },\n \"scope\": {\n \"type\": \"array\",\n \"items\": {\n \"type\": \"string\",\n \"pattern\": \"^[a-z][a-z0-9_]*:[a-z][a-z0-9_]*(:[a-z][a-z0-9_]*)*$\",\n \"description\": \"Scope in ARIA namespace format: namespace:resource:action.\"\n },\n \"minItems\": 1,\n \"uniqueItems\": true,\n \"description\": \"The scopes the agent declared at enrollment: what it intends to do. Each receiver decides whether to admit them; a scope here grants nothing by itself.\"\n },\n \"hitlRequired\": {\n \"type\": \"array\",\n \"items\": {\n \"type\": \"string\"\n },\n \"uniqueItems\": true,\n \"description\": \"Scopes, among those declared, whose operations need a person's approval. Under ARIA AP a receiver refuses such an operation when no valid approval accompanies it; it does not hold the operation waiting.\"\n },\n \"delegationDepth\": {\n \"type\": \"integer\",\n \"minimum\": 0,\n \"maximum\": 4,\n \"description\": \"Current delegation depth. 0 means directly issued by the principal.\"\n },\n \"maxDelegationDepth\": {\n \"type\": \"integer\",\n \"minimum\": 0,\n \"maximum\": 4,\n \"description\": \"Maximum allowed delegation depth for further sub-delegations.\"\n },\n \"spec_version\": {\n \"type\": \"string\",\n \"const\": \"1.0\",\n \"description\": \"ARIA specification version. Must be '1.0' for credentials issued under ARIA 1.0. The issuance regime is distinguished by the issuer DID, not by this value.\"\n },\n \"principal\": {\n \"type\": \"object\",\n \"required\": [\n \"did\",\n \"jurisdiction\",\n \"verificationStatus\"\n ],\n \"properties\": {\n \"type\": {\n \"type\": \"string\",\n \"enum\": [\n \"Person\",\n \"Organization\"\n ],\n \"description\": \"Kind of principal, as a schema.org type: Person for a natural person, Organization for any legal entity. A Person principal carries no legalName, because the public AID never carries a natural person's name (COM-09). When absent \\u2014 credentials issued before this field existed \\u2014 legalName is required, as it always was.\"\n },\n \"did\": {\n \"type\": \"string\",\n \"description\": \"DID of the principal (legal entity or person) on whose behalf the agent operates.\"\n },\n \"legalName\": {\n \"type\": \"string\",\n \"minLength\": 1,\n \"maxLength\": 256,\n \"description\": \"Legal name of the principal ORGANIZATION. Required when type is Organization or absent; MUST be absent when type is Person, because the public AID never carries a natural person's name (COM-09, L0-03). At L0 the name is registrant-asserted and verificationStatus says so. A natural-person principal whose document carries its name here is non-conformant, and a validator now rejects it once type is set.\"\n },\n \"jurisdiction\": {\n \"type\": \"string\",\n \"pattern\": \"^[A-Z]{2}$\",\n \"description\": \"ISO 3166-1 alpha-2 country code of the principal's legal jurisdiction.\"\n },\n \"verificationStatus\": {\n \"type\": \"string\",\n \"enum\": [\n \"self-declared\",\n \"registry-confirmed\",\n \"legal-verified\"\n ],\n \"description\": \"Machine-readable provenance of the principal's declared identity \\u2014 of legalName, for an Organization. self-declared: registrant-asserted, no external check (L0, L1). registry-confirmed: confirmed against the Authoritative Source of the jurisdiction of incorporation (L2). legal-verified: backed by government-issued legal documents and admin review (L3). Verifiers MUST consult this field before treating legalName as authoritative.\"\n }\n },\n \"if\": {\n \"required\": [\n \"type\"\n ],\n \"properties\": {\n \"type\": {\n \"const\": \"Person\"\n }\n }\n },\n \"then\": {\n \"not\": {\n \"required\": [\n \"legalName\"\n ]\n }\n },\n \"else\": {\n \"required\": [\n \"legalName\"\n ]\n },\n \"additionalProperties\": false,\n \"description\": \"The legal principal (organization or person) responsible for the agent.\"\n },\n \"dnsAnchor\": {\n \"type\": \"string\",\n \"description\": \"DNS TXT record content anchoring this AID to the principal's domain. Format: v=ARIA1;id=<did>;h=sha256:<hash>;r=<resolution-url>.\"\n },\n \"alsoKnownAs\": {\n \"type\": \"array\",\n \"items\": {\n \"type\": \"string\",\n \"format\": \"uri\",\n \"pattern\": \"^did:[a-z0-9]+:.+$\"\n },\n \"uniqueItems\": true,\n \"maxItems\": 5,\n \"description\": \"Optional. External DIDs the agent declared at enrollment as alternative identifiers, per W3C DID Core \\u00a75.1.2. In ARIA 1.0 each entry was syntactically validated AND verified for proof-of-control at enrollment time (the principal signed a session-bound challenge from the external DID's key). However, this field is DORMANT for trust decisions in ARIA 1.0: verifiers MUST NOT treat alsoKnownAs entries as authoritative when evaluating trust level, scope authority, or principal identity. The field is preserved in the AID for forward compatibility \\u2014 activation of cross-method interop and the DID-method allow-list is on the roadmap of a later revision.\"\n },\n \"enrollmentAttestation\": {\n \"type\": \"object\",\n \"required\": [\n \"userAgentAgreement\",\n \"attestedAt\",\n \"termsVersion\",\n \"privacyVersion\"\n ],\n \"properties\": {\n \"userAgentAgreement\": {\n \"type\": \"boolean\",\n \"const\": true,\n \"description\": \"Always true in a valid AID. Confirms that issuance occurred through the authenticated enrollment flow defined in ARIA Spec ARIA 1.0 \\u00a7Enrollment: (a) the principal initiated the enrollment from an authenticated registry session, (b) an SDK on the agent's infrastructure generated a composite keypair locally and self-signed an enrollment manifest, (c) DNS proof-of-control was verified for trust levels L1+, (d) the principal confirmed the manifest contents and authorized issuance with a fresh second factor. Implicit acceptance of the Terms of Service and Privacy Policy versions referenced below.\"\n },\n \"attestedAt\": {\n \"type\": \"string\",\n \"format\": \"date-time\",\n \"description\": \"ISO 8601 timestamp of the admin's second-factor confirmation that authorized signing this AID. Anchors the contractual moment of issuance. Must equal or precede the top-level validFrom timestamp; registry rejects on inversion.\"\n },\n \"termsVersion\": {\n \"type\": \"string\",\n \"pattern\": \"^[0-9]+\\\\.[0-9]+\\\\.[0-9]+$\",\n \"description\": \"Semantic version of the Terms of Service the principal accepted at enrollment. Resolves to the immutable document at https://aria.bar/terms/{termsVersion}. CRITICAL: this is the version the principal LAST ACCEPTED, NOT the registry's current version at issuance time. Preserves legal traceability across non-breaking ToS updates: if the registry advances to a newer minor/patch version without forcing re-acceptance, AIDs continue to embed the version the principal actually saw and accepted.\"\n },\n \"privacyVersion\": {\n \"type\": \"string\",\n \"pattern\": \"^[0-9]+\\\\.[0-9]+\\\\.[0-9]+$\",\n \"description\": \"Semantic version of the Privacy Policy the principal accepted at enrollment. Same last-accepted semantics as termsVersion. Resolves to https://aria.bar/privacy/{privacyVersion}.\"\n }\n },\n \"additionalProperties\": false,\n \"description\": \"Declarative attestation embedded in the AID confirming that issuance occurred through the authenticated enrollment flow. Constitutes the documentary evidence of the bilateral contract between the principal and TrustLayer Foundation under applicable electronic-signature law (Mexico CCF Art. 1834-bis, EU eIDAS Regulation 910/2014, US E-SIGN Act / UETA, UK Electronic Communications Act 2000, and equivalents). Does NOT duplicate or replace the authoritative audit log; it surfaces the legally-relevant facts (terms version, privacy version, attestation timestamp) in-band so verifiers can resolve them without registry round-trips.\"\n }\n },\n \"additionalProperties\": false,\n \"description\": \"The subject of the credential \\u2014 the AI agent and its attributes, including the holder verification key required for proof-of-possession and the enrollment attestation establishing the legal frame of issuance.\"\n },\n \"proof\": {\n \"type\": \"object\",\n \"required\": [\n \"type\",\n \"cryptosuite\",\n \"created\",\n \"proofPurpose\",\n \"verificationMethod\",\n \"proofValue\"\n ],\n \"properties\": {\n \"type\": {\n \"type\": \"string\",\n \"const\": \"DataIntegrityProof\",\n \"description\": \"W3C Data Integrity proof type.\"\n },\n \"cryptosuite\": {\n \"type\": \"string\",\n \"const\": \"mldsa65-ed25519-2026\",\n \"description\": \"Composite cryptographic suite: ML-DSA-65 (post-quantum, FIPS 204) + Ed25519 (classical).\"\n },\n \"created\": {\n \"type\": \"string\",\n \"format\": \"date-time\",\n \"description\": \"ISO 8601 datetime when the proof was created.\"\n },\n \"proofPurpose\": {\n \"type\": \"string\",\n \"const\": \"assertionMethod\",\n \"description\": \"The purpose of the proof. Always 'assertionMethod' for AID issuance.\"\n },\n \"verificationMethod\": {\n \"type\": \"string\",\n \"pattern\": \"^did:aria:.+#.+$\",\n \"description\": \"DID URL of the verification key used to create the proof.\"\n },\n \"proofValue\": {\n \"type\": \"string\",\n \"description\": \"Composite signature (ML-DSA-65 + Ed25519) over the canonicalized credential (with proof stripped), as multibase base64url: the prefix \\\"u\\\" then unpadded base64url of u32be(pq_len) then the ML-DSA-65 signature then the Ed25519 one. The VC v2 context types this property as sec:multibase, so the prefix is part of the value. Credentials issued before the 1.0 cutover carry the same bytes with no prefix and remain valid; a verifier accepts both and decides between them by the length header, not the first character. Critically, the signature covers credentialSubject.holderKey, which is what stops anyone but the registry substituting a key.\",\n \"pattern\": \"^u?[A-Za-z0-9_-]+$\"\n }\n },\n \"additionalProperties\": false,\n \"description\": \"W3C Data Integrity proof containing the composite post-quantum + classical signature.\"\n }\n },\n \"additionalProperties\": false,\n \"_comment\": \"Illustrative and normative for shape only. The legalName rule above is enforced at issuance, not by this file. Credentials issued before the cutover declare their own spec_version and validate against the schema they were issued under; see schema/aid-v1.2.json.\",\n \"_status\": \"DRAFT until the issuance cutover. No credential declares spec_version 1.0 yet, and the Verification Requirements this shape serves are still v1.3-draft, pending adoption by TrustLayer Foundation with ten decisions open. Fields already planned \\u2014 a designated successor principal among them \\u2014 have no place here. Because credentialSubject declares additionalProperties false, adding one later means a new schema file and a new spec_version, so this file is published to be reviewed and implemented against, not to be frozen. It freezes on the day the first credential declares 1.0.\"\n}\n","import Ajv2020 from 'ajv/dist/2020.js';\nimport addFormatsModule from 'ajv-formats';\nimport schema from './aid-1.0.schema.json' with { type: 'json' };\n\n// A byte-identical copy of `schema/aid-1.0.json`; a test compares the two.\nconst addFormats = ((addFormatsModule as unknown as { default?: typeof addFormatsModule }).default ?? addFormatsModule);\nconst ajv = new Ajv2020({ strict: false, allErrors: false });\naddFormats(ajv);\nconst validate = ajv.compile(schema);\n\n/** `null` when `document` conforms to the ARIA 1.0 AID schema; otherwise the JSON pointer of the first failure. */\nexport function schemaFailure(document: unknown): string | null {\n if (validate(document)) return null;\n const first = validate.errors?.[0];\n return first ? first.instancePath || '/' : '/';\n}\n","import { ed25519 } from '@noble/curves/ed25519.js';\nimport { sha256 } from '@noble/hashes/sha2.js';\nimport type { CredentialFailure, Principal } from '../credential';\nimport type { Did, TrustLevel } from '../types';\nimport { canonicalJson } from './canonical';\nimport { SUITE, verifyComposite, type IssuerKeys } from './composite';\nimport { fromBase58btc, toBase64 } from './encoding';\nimport { instant } from './instant';\nimport { schemaFailure } from './schema';\n\n/** A trust profile as the verifier keeps it: copied and frozen at construction. */\nexport interface ProfileSnapshot {\n readonly id: string;\n readonly issuer: string;\n readonly verificationMethod: string;\n readonly keys: IssuerKeys;\n readonly maxLevel: TrustLevel;\n readonly statusLists: readonly string[];\n readonly onlineStatus: string | null;\n}\n\n/** What a verified credential is, as the verifier holds it. */\nexport interface CredentialSnapshot {\n readonly profile: ProfileSnapshot;\n readonly credentialId: string;\n readonly digest: string;\n readonly did: Did;\n readonly issuer: Did;\n readonly trustLevel: TrustLevel;\n readonly scopes: readonly string[];\n readonly hitlRequired: readonly string[];\n readonly delegationDepth: number;\n readonly principal: Principal;\n readonly holderKeyId: string;\n readonly holderKeyMultibase: string;\n readonly holderKey: Uint8Array;\n readonly validFrom: number;\n readonly validUntil: number;\n readonly previousCredentialId: string | null;\n readonly statusList: string;\n readonly statusIndex: number;\n readonly verifiedAt: number;\n}\n\n// Lowest first. Exported as TRUST_LEVELS and ranked by this verifier and by ARIA AP:\n// frozen, so no consumer can reorder the ranking they apply.\nexport const LEVELS: readonly TrustLevel[] = Object.freeze(['L0', 'L1', 'L2', 'L3']);\nconst MAX_DOCUMENT_BYTES = 100 * 1024;\n\ntype Outcome = { readonly ok: true; readonly snapshot: CredentialSnapshot } | { readonly ok: false; readonly reason: CredentialFailure; readonly path?: string };\n\n/** A private, plain-data copy of the input, or `null` when it is not a JSON object within the size bound. */\nexport function plainCopy(input: unknown, maxBytes = MAX_DOCUMENT_BYTES): Record<string, unknown> | null {\n try {\n const text = typeof input === 'string' ? input : JSON.stringify(input);\n if (typeof text !== 'string' || new TextEncoder().encode(text).length > maxBytes) return null;\n const value: unknown = JSON.parse(text);\n return value && typeof value === 'object' && !Array.isArray(value) ? (value as Record<string, unknown>) : null;\n } catch {\n return null;\n }\n}\n\nconst fail = (reason: CredentialFailure, path?: string): Outcome => (path === undefined ? { ok: false, reason } : { ok: false, reason, path });\n\n/**\n * Verifies one AID 1.0 document against the trust profiles, in a fixed order:\n * shape, version, schema, issuer, proof profile, both signatures, validity,\n * holder key, rules, level, status list. The first failure decides. Without\n * `judgeTime` the validity bounds are checked as data but not against `now`.\n */\nexport function verifyCredentialDocument(input: unknown, profiles: readonly ProfileSnapshot[], now: number, skewMs: number, judgeTime = true): Outcome {\n const doc = plainCopy(input);\n if (!doc) return fail('malformed', '/');\n const subject = doc.credentialSubject as Record<string, unknown> | undefined;\n if (!subject || typeof subject !== 'object') return fail('malformed', '/credentialSubject');\n if (subject.spec_version !== '1.0') return fail('unsupported_version', '/credentialSubject/spec_version');\n\n const schemaPath = schemaFailure(doc);\n if (schemaPath !== null) return fail('malformed', schemaPath);\n\n const profile = profiles.find((p) => p.issuer === doc.issuer);\n if (!profile) return fail('untrusted_issuer', '/issuer');\n\n const proof = doc.proof as Record<string, unknown>;\n if (\n proof.type !== 'DataIntegrityProof' ||\n proof.cryptosuite !== SUITE ||\n proof.proofPurpose !== 'assertionMethod' ||\n proof.verificationMethod !== profile.verificationMethod ||\n instant(proof.created) === null\n ) {\n return fail('unsupported_proof', '/proof');\n }\n if (typeof proof.proofValue !== 'string' || !verifyComposite(doc, proof.proofValue, profile.keys)) return fail('signature_invalid', '/proof/proofValue');\n\n const validFrom = instant(doc.validFrom);\n const validUntil = instant(doc.validUntil);\n if (validFrom === null || validUntil === null || validFrom >= validUntil) return fail('invalid_validity', '/validFrom');\n if (judgeTime && validFrom > now + skewMs) return fail('not_yet_valid', '/validFrom');\n if (judgeTime && validUntil <= now) return fail('expired', '/validUntil');\n\n const did = subject.id as Did;\n const holder = subject.holderKey as { id: string; publicKeyMultibase: string };\n const key = holder.publicKeyMultibase.startsWith('z') ? fromBase58btc(holder.publicKeyMultibase.slice(1)) : null;\n if (!key || key.length !== 32 || !holder.id.startsWith(`${did}#holder-key-`) || !acceptableEd25519Key(key)) return fail('holder_key_invalid', '/credentialSubject/holderKey');\n\n const scopes = subject.scope as string[];\n const hitl = (subject.hitlRequired as string[] | undefined) ?? [];\n if (!hitl.every((s) => scopes.includes(s))) return fail('semantic_invalid', '/credentialSubject/hitlRequired');\n\n const level = subject.trustLevel as TrustLevel;\n if (LEVELS.indexOf(level) > LEVELS.indexOf(profile.maxLevel)) return fail('level_not_trusted', '/credentialSubject/trustLevel');\n\n const status = doc.credentialStatus as { statusListCredential: string; statusListIndex: string };\n const index = Number(status.statusListIndex);\n if (!profile.statusLists.includes(status.statusListCredential)) return fail('status_list_untrusted', '/credentialStatus/statusListCredential');\n if (!/^(0|[1-9]\\d*)$/.test(status.statusListIndex) || !Number.isSafeInteger(index)) return fail('semantic_invalid', '/credentialStatus/statusListIndex');\n\n const principal = subject.principal as Record<string, unknown>;\n return {\n ok: true,\n snapshot: {\n profile,\n credentialId: doc.id as string,\n digest: `sha-256=:${toBase64(sha256(new TextEncoder().encode(canonicalJson(doc))))}:`,\n did,\n issuer: doc.issuer as Did,\n trustLevel: level,\n scopes: [...scopes],\n hitlRequired: [...hitl],\n delegationDepth: (subject.delegationDepth as number | undefined) ?? 0,\n principal: {\n did: principal.did as string,\n type: principal.type === 'Person' ? 'individual' : 'organization',\n legalName: typeof principal.legalName === 'string' ? principal.legalName : null,\n jurisdiction: typeof principal.jurisdiction === 'string' ? principal.jurisdiction : null,\n verificationStatus: principal.verificationStatus as Principal['verificationStatus'],\n },\n holderKeyId: holder.id,\n holderKeyMultibase: holder.publicKeyMultibase,\n holderKey: key,\n validFrom,\n validUntil,\n previousCredentialId: typeof subject.previousCredentialId === 'string' ? subject.previousCredentialId : null,\n statusList: status.statusListCredential,\n statusIndex: index,\n verifiedAt: now,\n },\n };\n}\n\n/**\n * The authority's rule for a party's Ed25519 key (`ed25519_key_is_acceptable`):\n * the canonical encoding of a point, not of small order, without a torsion\n * component. An honestly generated key meets all of these; the identity point, a\n * second spelling of a key or a mixed-torsion key does not.\n */\nexport function acceptableEd25519Key(key: Uint8Array): boolean {\n if (key.length !== 32) return false;\n try {\n const point = ed25519.Point.fromBytes(key);\n const canonical = point.toBytes();\n return canonical.every((b, i) => b === key[i]) && !point.isSmallOrder() && point.isTorsionFree();\n } catch {\n return false;\n }\n}\n","import type { AuthenticCredential, AuthenticityResult, CredentialFacts, CredentialResult, HistoricalFacts, Inspection, VerifiedCredential } from './credential';\nimport { AriaUsageError } from './errors';\nimport { fromOnline, fromStatusList, readList, type StatusSnapshot } from './internal/check-status';\nimport { iso } from './internal/instant';\nimport { issue, recall } from './internal/provenance';\nimport { judge } from './internal/standing';\nimport { LEVELS, plainCopy, verifyCredentialDocument, type CredentialSnapshot, type ProfileSnapshot } from './internal/verify-credential';\nimport type { RetainedStatus, RetainedStatusResult, Standing, StatusEvidence, StatusOptions } from './status';\nimport type { Did, TrustLevel } from './types';\n\n/** One issuer the verifier trusts. Its `id` is a label for results, never a trust identity. */\nexport interface TrustProfile {\n /** E.g. `demo` or `production`. */\n readonly id: string;\n readonly issuer: Did;\n /** The DID URL the issuer's proofs name, e.g. `did:aria:registry.aria.bar#key-1`. */\n readonly verificationMethod: string;\n readonly keys: { readonly mldsa65: Uint8Array; readonly ed25519: Uint8Array };\n /** Highest level this profile may assert; a credential claiming more fails. */\n readonly maxLevel: TrustLevel;\n /** Status lists this issuer publishes; a credential naming another fails. */\n readonly statusLists: readonly string[];\n /** The issuer's online status endpoint, to which the DID is appended, e.g. `https://api.aria.bar/v1/verify/`. */\n readonly onlineStatus?: string;\n}\n\n/** Bounds on everything the SDK fetches. Without it the verifier is offline and status is `unavailable`. */\nexport interface FetchPolicy {\n /** Exact origins it may fetch from; redirects are never followed. */\n readonly allowedOrigins: readonly string[];\n /** Default 5000. */\n readonly timeoutMs?: number;\n /** Default 262144; the decompressed status list is bounded separately. */\n readonly maxBytes?: number;\n /** The fetch implementation; the global one by default. */\n readonly fetch?: typeof fetch;\n}\n\n/** Trusted configuration: everything here comes from the adopter, never from a message. It is copied when the verifier is created. */\nexport interface VerifierConfig {\n readonly trust: readonly TrustProfile[];\n readonly fetch?: FetchPolicy;\n readonly clock?: () => Date;\n /** Maximum age of signed status-list evidence, from the list's own `validFrom`. Default 3600. */\n readonly statusMaxAgeSeconds?: number;\n /** Maximum age of an online status answer when admission uses it, from when it was fetched. Default 60. */\n readonly onlineStatusMaxAgeSeconds?: number;\n /** Tolerated clock skew on validity bounds. Default 5. */\n readonly skewSeconds?: number;\n}\n\n/**\n * A verifier with its own, fixed trust. Two verifiers never affect each other;\n * nothing in the package is configured globally. Results are accepted only by the\n * verifier that produced them, as the exact objects it returned.\n */\nexport interface Verifier {\n /** Verifies one document. Says nothing about who presents it or its status. */\n verifyCredential(document: unknown): CredentialResult;\n /** Status of the credential's exact document. */\n checkStatus(credential: VerifiedCredential, options?: StatusOptions): Promise<StatusEvidence>;\n /**\n * What this verifier established about `credential`, from its own record: a\n * fresh copy, holder key bytes included. This is how packages built on this one\n * (ARIA AP) read a credential. Throws `AriaUsageError` for anything this verifier\n * did not produce: a copy, an altered or hand-made object, another verifier's result.\n */\n facts(credential: VerifiedCredential): CredentialFacts;\n /**\n * Whether `credential` stands now: inside its signed validity, with `status`\n * being this verifier's evidence about that same result, still fresh under its\n * rules. Judged at every call with this verifier's clock. Throws like `facts`.\n */\n standing(credential: VerifiedCredential, status: StatusEvidence): Standing;\n /**\n * Verifies a retained document as `verifyCredential` does, except against the\n * current time: an expired document can be authentic. The result is not a\n * verified credential, and nothing that authorizes accepts it.\n */\n verifyAuthenticity(document: unknown): AuthenticityResult;\n /**\n * What a retained, signed status list (as a parsed object or JSON text) said about\n * `credential`, offline: same issuer, the exact list it names, both signatures.\n * The list's validity is reported, never judged against the current time.\n */\n readRetainedStatus(credential: AuthenticCredential, list: unknown): Promise<RetainedStatusResult>;\n /**\n * What this verifier established about an authentic credential and, when given,\n * what a retained list said about it: a fresh copy, holder key bytes included.\n * Throws `AriaUsageError` for anything this verifier did not produce, and for a\n * retained status about another document.\n */\n historicalFacts(credential: AuthenticCredential, status?: RetainedStatus): HistoricalFacts;\n}\n\ntype RetainedSnapshot = { readonly credential: CredentialSnapshot; readonly state: 'active' | 'revoked'; readonly validFrom: number; readonly validUntil: number };\n\nconst ML_DSA_65_PUBLIC_KEY = 1952;\nconst ED25519_PUBLIC_KEY = 32;\n\nfunction snapshotProfiles(trust: readonly TrustProfile[]): readonly ProfileSnapshot[] {\n if (!Array.isArray(trust) || trust.length === 0) throw new AriaUsageError('a verifier needs at least one trust profile');\n const profiles = trust.map((p): ProfileSnapshot => {\n if (!(p.keys?.mldsa65 instanceof Uint8Array) || p.keys.mldsa65.length !== ML_DSA_65_PUBLIC_KEY) throw new AriaUsageError(`profile ${p.id}: an ML-DSA-65 public key is ${ML_DSA_65_PUBLIC_KEY} bytes`);\n if (!(p.keys?.ed25519 instanceof Uint8Array) || p.keys.ed25519.length !== ED25519_PUBLIC_KEY) throw new AriaUsageError(`profile ${p.id}: an Ed25519 public key is ${ED25519_PUBLIC_KEY} bytes`);\n if (!LEVELS.includes(p.maxLevel)) throw new AriaUsageError(`profile ${p.id}: unknown level ${String(p.maxLevel)}`);\n if (p.onlineStatus !== undefined && !p.onlineStatus.startsWith('https://')) throw new AriaUsageError(`profile ${p.id}: the online status endpoint must be https`);\n return Object.freeze({\n id: String(p.id),\n issuer: String(p.issuer),\n verificationMethod: String(p.verificationMethod),\n // Uint8Array.from always allocates: a Buffer's slice() would alias the caller's bytes.\n keys: Object.freeze({ mldsa65: Uint8Array.from(p.keys.mldsa65), ed25519: Uint8Array.from(p.keys.ed25519) }),\n maxLevel: p.maxLevel,\n statusLists: Object.freeze([...p.statusLists].map(String)),\n onlineStatus: p.onlineStatus ?? null,\n });\n });\n if (new Set(profiles.map((p) => p.issuer)).size !== profiles.length) throw new AriaUsageError('two trust profiles name the same issuer');\n return Object.freeze(profiles);\n}\n\nconst seconds = (value: number | undefined, fallback: number, name: string): number => {\n const v = value ?? fallback;\n if (!Number.isFinite(v) || v < 0) throw new AriaUsageError(`${name} must be a non-negative number`);\n return v * 1000;\n};\n\nfunction credentialView(s: CredentialSnapshot): VerifiedCredential {\n return {\n kind: 'verified-credential',\n binding: { credentialId: s.credentialId, digest: s.digest, profile: s.profile.id },\n did: s.did,\n issuer: s.issuer,\n specVersion: '1.0',\n trustLevel: s.trustLevel,\n scopes: [...s.scopes],\n hitlRequired: [...s.hitlRequired],\n delegationDepth: s.delegationDepth,\n principal: { ...s.principal },\n holderKey: { id: s.holderKeyId, publicKeyMultibase: s.holderKeyMultibase },\n validFrom: iso(s.validFrom),\n validUntil: iso(s.validUntil),\n previousCredentialId: s.previousCredentialId,\n statusEntry: { list: s.statusList, index: s.statusIndex },\n verifiedAt: iso(s.verifiedAt),\n } as unknown as VerifiedCredential;\n}\n\nfunction authenticView(s: CredentialSnapshot): AuthenticCredential {\n return {\n kind: 'authentic-credential',\n binding: { credentialId: s.credentialId, digest: s.digest, profile: s.profile.id },\n did: s.did,\n issuer: s.issuer,\n holderKey: { id: s.holderKeyId, publicKeyMultibase: s.holderKeyMultibase },\n validFrom: iso(s.validFrom),\n validUntil: iso(s.validUntil),\n statusEntry: { list: s.statusList, index: s.statusIndex },\n } as unknown as AuthenticCredential;\n}\n\nconst bindingOf = (s: CredentialSnapshot) => Object.freeze({ credentialId: s.credentialId, digest: s.digest, profile: s.profile.id });\n\nfunction statusView(s: StatusSnapshot): StatusEvidence {\n const base = {\n kind: 'status-evidence',\n credential: { credentialId: s.credential.credentialId, digest: s.credential.digest, profile: s.credential.profile.id },\n fetchedAt: iso(s.fetchedAt),\n source: s.source,\n state: s.state,\n };\n if (s.state === 'unavailable') return { ...base, reason: s.reason } as unknown as StatusEvidence;\n if (s.source === 'status-list') {\n return { ...base, list: { url: s.list.url, index: s.list.index, validFrom: iso(s.list.validFrom), validUntil: iso(s.list.validUntil) } } as unknown as StatusEvidence;\n }\n return (s.currentCredentialId ? { ...base, currentCredentialId: s.currentCredentialId } : base) as unknown as StatusEvidence;\n}\n\n/** Creates a verifier from a copy of `config`; later changes to `config` or its keys do not reach it. */\nexport function createVerifier(config: VerifierConfig): Verifier {\n const profiles = snapshotProfiles(config.trust);\n const clock = config.clock ?? (() => new Date());\n const skewMs = seconds(config.skewSeconds, 5, 'skewSeconds');\n const statusMaxAgeMs = seconds(config.statusMaxAgeSeconds, 3600, 'statusMaxAgeSeconds');\n const onlineMaxAgeMs = seconds(config.onlineStatusMaxAgeSeconds, 60, 'onlineStatusMaxAgeSeconds');\n const bounds = config.fetch\n ? Object.freeze({\n allowedOrigins: Object.freeze([...config.fetch.allowedOrigins].map(String)),\n timeoutMs: config.fetch.timeoutMs ?? 5000,\n maxBytes: config.fetch.maxBytes ?? 262_144,\n fetch: config.fetch.fetch ?? globalThis.fetch.bind(globalThis),\n })\n : null;\n const now = (): number => {\n const t = clock().getTime();\n if (!Number.isFinite(t)) throw new AriaUsageError('the clock returned an invalid time');\n return t;\n };\n\n const verifier: Verifier = {\n verifyCredential(document) {\n const outcome = verifyCredentialDocument(document, profiles, now(), skewMs);\n if (!outcome.ok) return Object.freeze(outcome.path === undefined ? { ok: false, reason: outcome.reason } : { ok: false, reason: outcome.reason, path: outcome.path });\n return Object.freeze({ ok: true, credential: issue(verifier, 'credential', credentialView(outcome.snapshot), outcome.snapshot) });\n },\n\n async checkStatus(credential, options) {\n const snapshot = recall<CredentialSnapshot>(verifier, 'credential', credential);\n const context = { bounds, now, skewMs, maxAgeMs: statusMaxAgeMs };\n const status = options?.via === 'online' ? await fromOnline(snapshot, context) : await fromStatusList(snapshot, context);\n return issue(verifier, 'status', statusView(status), status);\n },\n\n facts(credential) {\n const s = recall<CredentialSnapshot>(verifier, 'credential', credential);\n return Object.freeze({\n binding: Object.freeze({ credentialId: s.credentialId, digest: s.digest, profile: s.profile.id }),\n did: s.did,\n issuer: s.issuer,\n trustLevel: s.trustLevel,\n scopes: Object.freeze([...s.scopes]),\n hitlRequired: Object.freeze([...s.hitlRequired]),\n delegationDepth: s.delegationDepth,\n // A typed array with elements cannot be frozen: each call returns a new copy instead.\n holderKey: Object.freeze({ id: s.holderKeyId, publicKey: Uint8Array.from(s.holderKey) }),\n validFrom: iso(s.validFrom),\n validUntil: iso(s.validUntil),\n });\n },\n\n standing(credential, status) {\n const c = recall<CredentialSnapshot>(verifier, 'credential', credential);\n const st = recall<StatusSnapshot>(verifier, 'status', status);\n const at = now();\n const judged = judge(c, st, { now: at, skewMs, statusMaxAgeMs, onlineMaxAgeMs });\n return Object.freeze({ kind: 'standing', ...judged, judgedAt: iso(at) }) as Standing;\n },\n\n verifyAuthenticity(document) {\n const outcome = verifyCredentialDocument(document, profiles, now(), skewMs, false);\n if (!outcome.ok) {\n const reason = outcome.reason as Exclude<typeof outcome.reason, 'not_yet_valid' | 'expired'>;\n return Object.freeze(outcome.path === undefined ? { ok: false, reason } : { ok: false, reason, path: outcome.path });\n }\n return Object.freeze({ ok: true, credential: issue(verifier, 'authentic', authenticView(outcome.snapshot), outcome.snapshot) });\n },\n\n async readRetainedStatus(credential, list) {\n const c = recall<CredentialSnapshot>(verifier, 'authentic', credential);\n // The same bound as a fetched list.\n const document = plainCopy(list, 262_144);\n if (!document) return Object.freeze({ ok: false, reason: 'malformed' });\n const read = await readList(c, document);\n if (!read.ok) return Object.freeze({ ok: false, reason: read.reason });\n const snapshot: RetainedSnapshot = { credential: c, state: read.revoked ? 'revoked' : 'active', validFrom: read.validFrom, validUntil: read.validUntil };\n const view = {\n kind: 'retained-status',\n credential: { credentialId: c.credentialId, digest: c.digest, profile: c.profile.id },\n state: snapshot.state,\n list: { url: c.statusList, index: c.statusIndex, validFrom: iso(read.validFrom), validUntil: iso(read.validUntil) },\n } as unknown as RetainedStatus;\n return Object.freeze({ ok: true, status: issue(verifier, 'retained', view, snapshot) });\n },\n\n historicalFacts(credential, status) {\n const c = recall<CredentialSnapshot>(verifier, 'authentic', credential);\n const st = status === undefined ? null : recall<RetainedSnapshot>(verifier, 'retained', status);\n if (st && (st.credential.credentialId !== c.credentialId || st.credential.digest !== c.digest)) {\n throw new AriaUsageError('the retained status is about another document');\n }\n return Object.freeze({\n binding: bindingOf(c),\n did: c.did,\n issuer: c.issuer,\n holderKey: Object.freeze({ id: c.holderKeyId, publicKey: Uint8Array.from(c.holderKey) }),\n validFrom: iso(c.validFrom),\n validUntil: iso(c.validUntil),\n retainedStatus: st ? Object.freeze({ state: st.state, validFrom: iso(st.validFrom), validUntil: iso(st.validUntil) }) : null,\n });\n },\n };\n return Object.freeze(verifier);\n}\n\n/** Parses a credential without verifying anything. Its result cannot be passed where verification is required. */\nexport function inspectCredential(document: unknown): Inspection {\n const doc = plainCopy(document);\n const text = (v: unknown): string | null => (typeof v === 'string' ? v : null);\n if (!doc) {\n return Object.freeze({ kind: 'inspection', verified: false, did: null, credentialId: null, issuer: null, specVersion: null, trustLevel: null, scopes: Object.freeze([]), validFrom: null, validUntil: null, problem: 'not_json' });\n }\n const subject = doc.credentialSubject && typeof doc.credentialSubject === 'object' ? (doc.credentialSubject as Record<string, unknown>) : null;\n const scopes = Array.isArray(subject?.scope) ? subject.scope.filter((s): s is string => typeof s === 'string') : [];\n const inspection: Inspection = {\n kind: 'inspection',\n verified: false,\n did: text(subject?.id),\n credentialId: text(doc.id),\n issuer: text(doc.issuer),\n specVersion: text(subject?.spec_version),\n trustLevel: text(subject?.trustLevel),\n scopes: Object.freeze(scopes),\n validFrom: text(doc.validFrom),\n validUntil: text(doc.validUntil),\n ...(subject ? {} : { problem: 'not_a_credential' as const }),\n };\n return Object.freeze(inspection);\n}\n","import type { Did } from './types';\n\n/**\n * The `did:aria` identifier grammar (specification §3.1): four shapes, two subject\n * kinds crossed with two anchoring modes. The same rules as the authority's parser\n * and the shared vectors (`conformance/vectors/abnf-cases.json`).\n *\n * Verifying a credential does not apply it: a signed 1.0 document is read under its\n * own schema. Use it for identifiers being created or compared.\n */\nexport type ParsedDid =\n /** An agent under a domain its principal has verified. */\n | { readonly shape: 'agent-domain-form'; readonly did: Did; readonly domain: string; readonly slug: string }\n /** An agent under a registry namespace. */\n | { readonly shape: 'agent-registry-form'; readonly did: Did; readonly host: string; readonly account: string; readonly slug: string }\n /** An organization that has verified a domain. */\n | { readonly shape: 'principal-domain-form'; readonly did: Did; readonly domain: string }\n /** An organization without a verified domain: no host, so it survives a registry move. */\n | { readonly shape: 'principal-registry-form'; readonly did: Did; readonly account: string };\n\nconst LABEL = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;\nconst ACCOUNT = /^u-[A-Za-z0-9]{8}$/;\nconst SLUG = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/;\nconst PRINCIPAL = 'org';\n\nconst domain = (s: string) => s.split('.').every((label) => LABEL.test(label));\nconst slug = (s: string) => s !== PRINCIPAL && SLUG.test(s);\n\n/** The parts of a `did:aria` identifier, or `null` when it is not one. */\nexport function parseDid(value: unknown): ParsedDid | null {\n if (typeof value !== 'string' || !value.startsWith('did:aria:')) return null;\n const did = value as Did;\n const parts = value.slice('did:aria:'.length).split(':');\n if (parts.length === 2) {\n const [first, second] = parts as [string, string];\n if (second === PRINCIPAL) {\n // A first part that starts with `u-` is a registry account, or nothing.\n if (first.startsWith('u-')) return ACCOUNT.test(first) ? Object.freeze({ shape: 'principal-registry-form', did, account: first }) : null;\n return domain(first) ? Object.freeze({ shape: 'principal-domain-form', did, domain: first }) : null;\n }\n return domain(first) && slug(second) ? Object.freeze({ shape: 'agent-domain-form', did, domain: first, slug: second }) : null;\n }\n if (parts.length === 3) {\n const [host, account, name] = parts as [string, string, string];\n return domain(host) && ACCOUNT.test(account) && slug(name) ? Object.freeze({ shape: 'agent-registry-form', did, host, account, slug: name }) : null;\n }\n return null;\n}\n"]}
package/package.json CHANGED
@@ -1,6 +1,57 @@
1
1
  {
2
2
  "name": "@trustlayer-foundation/aria-sdk",
3
- "version": "0.0.0-stage",
4
- "stub": true,
5
- "description": "Temporary package placeholder for staged publishing"
3
+ "version": "1.0.0",
4
+ "description": "The ARIA SDK: inspect and verify an agent's credential and establish the status of that exact document. ARIA AP is the separate package built on it.",
5
+ "license": "Apache-2.0",
6
+ "author": "TrustLayer Foundation",
7
+ "homepage": "https://aria.bar",
8
+ "repository": {
9
+ "type": "git",
10
+ "url": "git+https://github.com/trustlayer-foundation/aria-protocol.git",
11
+ "directory": "sdk/aria-ts"
12
+ },
13
+ "type": "module",
14
+ "main": "./dist/index.js",
15
+ "types": "./dist/index.d.ts",
16
+ "exports": {
17
+ ".": {
18
+ "types": "./dist/index.d.ts",
19
+ "import": "./dist/index.js"
20
+ },
21
+ "./schemas/aid-1.0.json": "./schemas/aid-1.0.json",
22
+ "./package.json": "./package.json"
23
+ },
24
+ "files": [
25
+ "dist",
26
+ "schemas",
27
+ "README.md",
28
+ "API.md",
29
+ "MIGRATION.md",
30
+ "LICENSE"
31
+ ],
32
+ "publishConfig": {
33
+ "access": "public"
34
+ },
35
+ "engines": {
36
+ "node": ">=20"
37
+ },
38
+ "sideEffects": false,
39
+ "devDependencies": {
40
+ "@types/node": "^22.20.5",
41
+ "tsup": "8.5.1",
42
+ "typescript": "^5.9.0",
43
+ "vitest": "^3.2.7"
44
+ },
45
+ "dependencies": {
46
+ "@noble/curves": "^2.4.0",
47
+ "@noble/hashes": "^2.4.0",
48
+ "@noble/post-quantum": "^0.5.4",
49
+ "ajv": "^8.20.0",
50
+ "ajv-formats": "^3.0.1"
51
+ },
52
+ "scripts": {
53
+ "build": "tsup",
54
+ "typecheck": "tsc -p tsconfig.json",
55
+ "test": "vitest run"
56
+ }
6
57
  }