@xfuel/verify 0.1.1 → 0.3.0

package/dist/jws.d.ts

@@ -14,7 +14,30 @@ export interface ReceiptWithIssuerJwk {
         issuer_jwk?: Es256Jwk;
     };
 }
+/**
+ * Production issuer kid (RFC 7638 thumbprint of the api.chit402.com ES256 key).
+ * Offline default pin. Override with `trustedKids` / `--trusted-kid`.
+ */
+export declare const DEFAULT_TRUSTED_ISSUER_KIDS: readonly ["IvFpmC-vPhkY_v0vidsrWVT9uzlE5XWKZgAEOeJTq1Q"];
+/** Hosts whose published JWKS may be fetched and treated as a trust root. */
+export declare const DEFAULT_TRUSTED_JWKS_HOSTS: readonly ["api.chit402.com"];
+export declare const KEY_UNTRUSTED = "key untrusted";
 export declare function resolvePinnedIssuerJwk(receipt: ReceiptWithIssuerJwk): Es256Jwk | null;
+/**
+ * RFC 7638 JWK thumbprint (SHA-256, base64url).
+ * EC required members in lexicographic order: crv, kty, x, y.
+ */
+export declare function jwkThumbprint(jwk: Pick<Es256Jwk, 'kty' | 'crv' | 'x' | 'y'>): string;
+export declare function isEs256PublicJwk(jwk: Es256Jwk | null | undefined): jwk is Es256Jwk;
+/** True when the key's RFC 7638 thumbprint is one of the pinned trusted kids. */
+export declare function isPinnedTrustedJwk(jwk: Es256Jwk | null | undefined, trustedKids: readonly string[]): boolean;
+export declare function sameEs256Key(a: Es256Jwk, b: Es256Jwk): boolean;
+export declare function readJwsHeader(jws: string): {
+    alg?: string;
+    kid?: string;
+    jku?: string;
+} | null;
+export declare function jwksHostAllowed(uri: string, hosts: readonly string[]): boolean;
 export declare function verifyIssuerJws(jws: string, jwk: Es256Jwk): {
     valid: boolean;
     payload?: Record<string, unknown>;

package/dist/jws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jws.d.ts","sourceRoot":"","sources":["../src/jws.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,OAAO,CAAC;IACb,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,gBAAgB,CAAC,EAAE;QACjB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,QAAQ,CAAC;KACvB,CAAC;CACH;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,oBAAoB,GAAG,QAAQ,GAAG,IAAI,CAMrF;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,QAAQ,GACZ;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAyCxE"}
+{"version":3,"file":"jws.d.ts","sourceRoot":"","sources":["../src/jws.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,OAAO,CAAC;IACb,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,gBAAgB,CAAC,EAAE;QACjB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,QAAQ,CAAC;KACvB,CAAC;CACH;AAED;;;GAGG;AACH,eAAO,MAAM,2BAA2B,0DAE9B,CAAC;AAEX,6EAA6E;AAC7E,eAAO,MAAM,0BAA0B,8BAA+B,CAAC;AAEvE,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAE7C,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,oBAAoB,GAAG,QAAQ,GAAG,IAAI,CAMrF;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,GAAG,KAAK,GAAG,GAAG,GAAG,GAAG,CAAC,GAAG,MAAM,CAQpF;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI,GAAG,SAAS,GAAG,GAAG,IAAI,QAAQ,CAElF;AAED,iFAAiF;AACjF,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,QAAQ,GAAG,IAAI,GAAG,SAAS,EAChC,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,OAAO,CAGT;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,GAAG,OAAO,CAE9D;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQ9F;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAQ9E;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,QAAQ,GACZ;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAyCxE"}

package/dist/jws.js

@@ -1,20 +1,90 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.KEY_UNTRUSTED = exports.DEFAULT_TRUSTED_JWKS_HOSTS = exports.DEFAULT_TRUSTED_ISSUER_KIDS = void 0;
 exports.resolvePinnedIssuerJwk = resolvePinnedIssuerJwk;
+exports.jwkThumbprint = jwkThumbprint;
+exports.isEs256PublicJwk = isEs256PublicJwk;
+exports.isPinnedTrustedJwk = isPinnedTrustedJwk;
+exports.sameEs256Key = sameEs256Key;
+exports.readJwsHeader = readJwsHeader;
+exports.jwksHostAllowed = jwksHostAllowed;
 exports.verifyIssuerJws = verifyIssuerJws;
 /**
  * Compact JWS (ES256) verification for Chit402 receipts.
+ *
+ * A signature is only valid when the verifying key is trusted:
+ *   - it is the JWKS entry for the JWS `kid` (caller-supplied file, or a JWKS
+ *     fetched from an allowlisted issuer `jwks_uri`), or
+ *   - its RFC 7638 thumbprint equals a pinned trusted kid.
+ * The receipt's embedded `issuer_jwk` is not a trust root by itself.
  */
 const node_crypto_1 = require("node:crypto");
+/**
+ * Production issuer kid (RFC 7638 thumbprint of the api.chit402.com ES256 key).
+ * Offline default pin. Override with `trustedKids` / `--trusted-kid`.
+ */
+exports.DEFAULT_TRUSTED_ISSUER_KIDS = [
+    'IvFpmC-vPhkY_v0vidsrWVT9uzlE5XWKZgAEOeJTq1Q',
+];
+/** Hosts whose published JWKS may be fetched and treated as a trust root. */
+exports.DEFAULT_TRUSTED_JWKS_HOSTS = ['api.chit402.com'];
+exports.KEY_UNTRUSTED = 'key untrusted';
 function resolvePinnedIssuerJwk(receipt) {
     const jwk = receipt.issuer_signature?.issuer_jwk;
-    if (!jwk || jwk.kty !== 'EC' || jwk.crv !== 'P-256')
+    if (!jwk || jwk.kty !== 'EC' || jwk.crv !== 'P-256' || !jwk.x || !jwk.y)
         return null;
     const kid = receipt.issuer_signature?.kid;
     if (kid && jwk.kid && kid !== jwk.kid)
         return null;
     return jwk;
 }
+/**
+ * RFC 7638 JWK thumbprint (SHA-256, base64url).
+ * EC required members in lexicographic order: crv, kty, x, y.
+ */
+function jwkThumbprint(jwk) {
+    const canonical = JSON.stringify({
+        crv: jwk.crv,
+        kty: jwk.kty,
+        x: jwk.x,
+        y: jwk.y,
+    });
+    return (0, node_crypto_1.createHash)('sha256').update(canonical).digest('base64url');
+}
+function isEs256PublicJwk(jwk) {
+    return !!jwk && jwk.kty === 'EC' && jwk.crv === 'P-256' && !!jwk.x && !!jwk.y;
+}
+/** True when the key's RFC 7638 thumbprint is one of the pinned trusted kids. */
+function isPinnedTrustedJwk(jwk, trustedKids) {
+    if (!isEs256PublicJwk(jwk) || trustedKids.length === 0)
+        return false;
+    return trustedKids.includes(jwkThumbprint(jwk));
+}
+function sameEs256Key(a, b) {
+    return a.x === b.x && a.y === b.y && a.crv === b.crv && a.kty === b.kty;
+}
+function readJwsHeader(jws) {
+    const headerB64 = jws.split('.')[0];
+    if (!headerB64)
+        return null;
+    try {
+        return JSON.parse(Buffer.from(headerB64, 'base64url').toString('utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function jwksHostAllowed(uri, hosts) {
+    try {
+        const url = new URL(uri);
+        if (url.protocol !== 'https:')
+            return false;
+        return hosts.some((host) => host.toLowerCase() === url.hostname.toLowerCase());
+    }
+    catch {
+        return false;
+    }
+}
 function verifyIssuerJws(jws, jwk) {
     if (!jws || typeof jws !== 'string') {
         return { valid: false, reason: 'invalid_jws' };

package/dist/jws.js.map

@@ -1 +1 @@
-{"version":3,"file":"jws.js","sourceRoot":"","sources":["../src/jws.ts"],"names":[],"mappings":";;AAuBA,wDAMC;AAED,0CA4CC;AA3ED;;GAEG;AACH,6CAAsE;AAoBtE,SAAgB,sBAAsB,CAAC,OAA6B;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,gBAAgB,EAAE,UAAkC,CAAC;IACzE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,GAAG,GAAG,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;IAC1C,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,eAAe,CAC7B,GAAW,EACX,GAAa;IAEb,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;IACpD,IAAI,MAAsC,CAAC;IAC3C,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1E,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACtD,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAClD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,SAAS,GAAc,IAAA,6BAAe,EAAC;YAC3C,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE;YACvD,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACzD,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,IAAA,oBAAM,EAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE;YAChE,GAAG,EAAE,SAAS;YACd,WAAW,EAAE,YAAY;SAC1B,EAAE,SAAS,CAAC,CAAC;QACd,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC1F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAwB,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IACnF,CAAC;AACH,CAAC"}
+{"version":3,"file":"jws.js","sourceRoot":"","sources":["../src/jws.ts"],"names":[],"mappings":";;;AA0CA,wDAMC;AAMD,sCAQC;AAED,4CAEC;AAGD,gDAMC;AAED,oCAEC;AAED,sCAQC;AAED,0CAQC;AAED,0CA4CC;AAjJD;;;;;;;;GAQG;AACH,6CAAkF;AAoBlF;;;GAGG;AACU,QAAA,2BAA2B,GAAG;IACzC,6CAA6C;CACrC,CAAC;AAEX,6EAA6E;AAChE,QAAA,0BAA0B,GAAG,CAAC,iBAAiB,CAAU,CAAC;AAE1D,QAAA,aAAa,GAAG,eAAe,CAAC;AAE7C,SAAgB,sBAAsB,CAAC,OAA6B;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,gBAAgB,EAAE,UAAkC,CAAC;IACzE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,MAAM,GAAG,GAAG,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;IAC1C,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAgB,aAAa,CAAC,GAA8C;IAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,CAAC,EAAE,GAAG,CAAC,CAAC;QACR,CAAC,EAAE,GAAG,CAAC,CAAC;KACT,CAAC,CAAC;IACH,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACpE,CAAC;AAED,SAAgB,gBAAgB,CAAC,GAAgC;IAC/D,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,iFAAiF;AACjF,SAAgB,kBAAkB,CAChC,GAAgC,EAChC,WAA8B;IAE9B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrE,OAAO,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAgB,YAAY,CAAC,CAAW,EAAE,CAAW;IACnD,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC;AAC1E,CAAC;AAED,SAAgB,aAAa,CAAC,GAAW;IACvC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,eAAe,CAAC,GAAW,EAAE,KAAwB;IACnE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAgB,eAAe,CAC7B,GAAW,EACX,GAAa;IAEb,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;IACpD,IAAI,MAAsC,CAAC;IAC3C,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1E,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACtD,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAClD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,SAAS,GAAc,IAAA,6BAAe,EAAC;YAC3C,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE;YACvD,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACzD,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,IAAA,oBAAM,EAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE;YAChE,GAAG,EAAE,SAAS;YACd,WAAW,EAAE,YAAY;SAC1B,EAAE,SAAS,CAAC,CAAC;QACd,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC1F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAwB,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IACnF,CAAC;AACH,CAAC"}

package/dist/payer.d.ts

@@ -19,6 +19,9 @@ export interface ReceiptPayerClaims {
     payment?: {
         ref?: string | null;
         gross_amount?: string | null;
+        payee?: string | null;
+        asset?: string | null;
+        rail?: string | null;
     } | null;
     caller_binding?: {
         payer_wallet?: string | null;
@@ -32,14 +35,21 @@ export interface VerifyPayerBindingOptions {
 }
 /** Decode the payload segment of a compact JWS (no signature check). */
 export declare function decodeJwsPayload(jws: string): Record<string, unknown> | null;
+interface PaymentClaim {
+    ref?: string | null;
+    gross_amount?: string | null;
+    payee?: string | null;
+    asset?: string | null;
+    rail?: string | null;
+}
 /**
- * Extract payer claims from a receipt envelope (top-level or JWS payload).
+ * Payer facts from the JWS payload when one is present.
+ * The outer `payment` / `caller_binding` copies are unsigned and are used only
+ * when the receipt has no JWS. Callers that need verified facts must check the
+ * issuer signature first; this decode does not itself prove the signature.
  */
 export declare function receiptPayerClaimsFromEnvelope(receipt: {
-    payment?: {
-        ref?: string | null;
-        gross_amount?: string | null;
-    } | null;
+    payment?: PaymentClaim | null;
     caller_binding?: {
         payer_wallet?: string | null;
     } | null;
@@ -51,4 +61,5 @@ export declare function receiptPayerClaimsFromEnvelope(receipt: {
  * Verify caller_binding.payer_wallet against on-chain settlement in payment.ref.
  */
 export declare function verifyPayerBinding(claims: ReceiptPayerClaims, options?: VerifyPayerBindingOptions): Promise<PayerBindingVerification>;
+export {};
 //# sourceMappingURL=payer.d.ts.map

package/dist/payer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payer.d.ts","sourceRoot":"","sources":["../src/payer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAmB,KAAK,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACvG,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEtD,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,SAAS,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,IAAI,CAAC,EAAE,qBAAqB,CAAC;IAC7B,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE;QACR,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC9B,GAAG,IAAI,CAAC;IACT,cAAc,CAAC,EAAE;QACf,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC9B,GAAG,IAAI,CAAC;CACV;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sBAAsB,CAAC,EAAE,gBAAgB,CAAC;IAC1C,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;CACvC;AAED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAQ5E;AAED;;GAEG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE;IACtD,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACvE,cAAc,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACzD,gBAAgB,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC5C,GAAG,kBAAkB,CAqCrB;AAYD;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,wBAAwB,CAAC,CAiEnC"}
+{"version":3,"file":"payer.d.ts","sourceRoot":"","sources":["../src/payer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAmB,KAAK,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACvG,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEtD,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,SAAS,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,IAAI,CAAC,EAAE,qBAAqB,CAAC;IAC7B,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE;QACR,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACtB,GAAG,IAAI,CAAC;IACT,cAAc,CAAC,EAAE;QACf,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC9B,GAAG,IAAI,CAAC;CACV;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sBAAsB,CAAC,EAAE,gBAAgB,CAAC;IAC1C,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;CACvC;AAED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAQ5E;AAED,UAAU,YAAY;IACpB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAYD;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE;IACtD,OAAO,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC9B,cAAc,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACzD,gBAAgB,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC5C,GAAG,kBAAkB,CAyBrB;AAYD;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,wBAAwB,CAAC,CA2EnC"}

package/dist/payer.js

@@ -20,41 +20,43 @@ function decodeJwsPayload(jws) {
         return null;
     }
 }
+function paymentClaims(payment) {
+    return {
+        ref: payment?.ref ?? null,
+        gross_amount: payment?.gross_amount != null ? String(payment.gross_amount) : null,
+        payee: payment?.payee ?? null,
+        asset: payment?.asset ?? null,
+        rail: payment?.rail ?? null,
+    };
+}
 /**
- * Extract payer claims from a receipt envelope (top-level or JWS payload).
+ * Payer facts from the JWS payload when one is present.
+ * The outer `payment` / `caller_binding` copies are unsigned and are used only
+ * when the receipt has no JWS. Callers that need verified facts must check the
+ * issuer signature first; this decode does not itself prove the signature.
  */
 function receiptPayerClaimsFromEnvelope(receipt) {
-    if (receipt.payment?.ref || receipt.caller_binding?.payer_wallet) {
-        return {
-            payment: {
-                ref: receipt.payment?.ref ?? null,
-                gross_amount: receipt.payment?.gross_amount ?? null,
-            },
-            caller_binding: receipt.caller_binding ?? null,
-        };
-    }
     const jws = receipt.issuer_signature?.jws;
-    if (!jws) {
-        return {
-            payment: { ref: null, gross_amount: null },
-            caller_binding: null,
-        };
+    if (jws) {
+        const claims = decodeJwsPayload(jws);
+        if (claims) {
+            const payment = claims.payment;
+            const callerBinding = claims.caller_binding;
+            return {
+                payment: paymentClaims(payment),
+                caller_binding: callerBinding ?? null,
+            };
+        }
     }
-    const claims = decodeJwsPayload(jws);
-    if (!claims) {
+    if (receipt.payment?.ref || receipt.caller_binding?.payer_wallet) {
         return {
-            payment: { ref: null, gross_amount: null },
-            caller_binding: null,
+            payment: paymentClaims(receipt.payment),
+            caller_binding: receipt.caller_binding ?? null,
         };
     }
-    const payment = claims.payment;
-    const callerBinding = claims.caller_binding;
     return {
-        payment: {
-            ref: payment?.ref ?? null,
-            gross_amount: payment?.gross_amount ?? null,
-        },
-        caller_binding: callerBinding ?? null,
+        payment: { ref: null, gross_amount: null, payee: null, asset: null, rail: null },
+        caller_binding: null,
     };
 }
 function detectRail(paymentRef) {
@@ -75,6 +77,8 @@ async function verifyPayerBinding(claims, options = {}) {
     const paymentRef = claims.payment?.ref ?? null;
     const payerWallet = claims.caller_binding?.payer_wallet ?? null;
     const grossAmount = claims.payment?.gross_amount ?? null;
+    const payee = claims.payment?.payee ?? null;
+    const asset = claims.payment?.asset ?? null;
     const rail = detectRail(paymentRef);
     if (!paymentRef) {
         return { checked: false, valid: false, rail, reason: 'no_payment_ref' };
@@ -105,10 +109,18 @@ async function verifyPayerBinding(claims, options = {}) {
         };
     }
     if (rail === 'base') {
+        if (!payee) {
+            return { checked: false, valid: false, rail, paymentRef, payerWallet, expectedAmount: grossAmount, reason: 'no_payee' };
+        }
+        if (!asset) {
+            return { checked: false, valid: false, rail, paymentRef, payerWallet, expectedAmount: grossAmount, reason: 'no_asset' };
+        }
         const base = await (0, base_payer_js_1.verifyBasePayer)({
             paymentRef,
             payerWallet,
             grossAmount,
+            payee,
+            asset,
             rpcUrl: options.rpcUrl,
             fetchReceipt: options.fetchBaseReceipt,
         });

package/dist/payer.js.map

@@ -1 +1 @@
-{"version":3,"file":"payer.js","sourceRoot":"","sources":["../src/payer.ts"],"names":[],"mappings":";AAAA;;GAEG;;AAyCH,4CAQC;AAKD,wEAyCC;AAeD,gDAoEC;AAhLD,mDAAuG;AACvG,uDAI2B;AAiC3B,wEAAwE;AACxE,SAAgB,gBAAgB,CAAC,GAAW;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC;IACpG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,8BAA8B,CAAC,OAI9C;IACC,IAAI,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,cAAc,EAAE,YAAY,EAAE,CAAC;QACjE,OAAO;YACL,OAAO,EAAE;gBACP,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI;gBACjC,YAAY,EAAE,OAAO,CAAC,OAAO,EAAE,YAAY,IAAI,IAAI;aACpD;YACD,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI;SAC/C,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;IAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;YAC1C,cAAc,EAAE,IAAI;SACrB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;YAC1C,cAAc,EAAE,IAAI;SACrB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAA8D,CAAC;IACtF,MAAM,aAAa,GAAG,MAAM,CAAC,cAAuD,CAAC;IAErF,OAAO;QACL,OAAO,EAAE;YACP,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,IAAI;YACzB,YAAY,EAAE,OAAO,EAAE,YAAY,IAAI,IAAI;SAC5C;QACD,cAAc,EAAE,aAAa,IAAI,IAAI;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,UAAqC;IACvD,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,QAAQ,CAAC;IACjD,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClG,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,kBAAkB,CACtC,MAA0B,EAC1B,UAAqC,EAAE;IAEvC,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC;IAC/C,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,EAAE,YAAY,IAAI,IAAI,CAAC;IAChE,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,EAAE,YAAY,IAAI,IAAI,CAAC;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAEpC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,WAAW,IAAI,IAAI,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACpG,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAiB,EAAC;YACrC,UAAU;YACV,WAAW;YACX,WAAW;YACX,MAAM,EAAE,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,MAAM;YAC9C,gBAAgB,EAAE,OAAO,CAAC,sBAAsB;SACjD,CAAC,CAAC;QACH,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,QAAQ;YACd,WAAW;YACX,UAAU;YACV,cAAc,EAAE,WAAW;YAC3B,MAAM;YACN,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,MAAM,IAAA,+BAAe,EAAC;YACjC,UAAU;YACV,WAAW;YACX,WAAW;YACX,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,YAAY,EAAE,OAAO,CAAC,gBAAgB;SACvC,CAAC,CAAC;QACH,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,MAAM;YACZ,WAAW;YACX,UAAU;YACV,cAAc,EAAE,WAAW;YAC3B,IAAI;YACJ,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,KAAK;QACZ,IAAI,EAAE,SAAS;QACf,WAAW;QACX,UAAU;QACV,cAAc,EAAE,WAAW;QAC3B,MAAM,EAAE,4BAA4B,UAAU,EAAE;KACjD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"payer.js","sourceRoot":"","sources":["../src/payer.ts"],"names":[],"mappings":";AAAA;;GAEG;;AA4CH,4CAQC;AA0BD,wEA6BC;AAeD,gDA8EC;AAtMD,mDAAuG;AACvG,uDAI2B;AAoC3B,wEAAwE;AACxE,SAAgB,gBAAgB,CAAC,GAAW;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC;IACpG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAUD,SAAS,aAAa,CAAC,OAAwC;IAC7D,OAAO;QACL,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,IAAI;QACzB,YAAY,EAAE,OAAO,EAAE,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI;QACjF,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI;QAC7B,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI;QAC7B,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,IAAI;KAC5B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,8BAA8B,CAAC,OAI9C;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;IAC1C,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,CAAC,OAAmC,CAAC;YAC3D,MAAM,aAAa,GAAG,MAAM,CAAC,cAAuD,CAAC;YACrF,OAAO;gBACL,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC;gBAC/B,cAAc,EAAE,aAAa,IAAI,IAAI;aACtC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,cAAc,EAAE,YAAY,EAAE,CAAC;QACjE,OAAO;YACL,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC;YACvC,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI;SAC/C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;QAChF,cAAc,EAAE,IAAI;KACrB,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,UAAqC;IACvD,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,QAAQ,CAAC;IACjD,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClG,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,kBAAkB,CACtC,MAA0B,EAC1B,UAAqC,EAAE;IAEvC,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC;IAC/C,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,EAAE,YAAY,IAAI,IAAI,CAAC;IAChE,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,EAAE,YAAY,IAAI,IAAI,CAAC;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAEpC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,WAAW,IAAI,IAAI,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACpG,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAiB,EAAC;YACrC,UAAU;YACV,WAAW;YACX,WAAW;YACX,MAAM,EAAE,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,MAAM;YAC9C,gBAAgB,EAAE,OAAO,CAAC,sBAAsB;SACjD,CAAC,CAAC;QACH,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,QAAQ;YACd,WAAW;YACX,UAAU;YACV,cAAc,EAAE,WAAW;YAC3B,MAAM;YACN,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAC1H,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAC1H,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAA,+BAAe,EAAC;YACjC,UAAU;YACV,WAAW;YACX,WAAW;YACX,KAAK;YACL,KAAK;YACL,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,YAAY,EAAE,OAAO,CAAC,gBAAgB;SACvC,CAAC,CAAC;QACH,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,MAAM;YACZ,WAAW;YACX,UAAU;YACV,cAAc,EAAE,WAAW;YAC3B,IAAI;YACJ,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,KAAK;QACZ,IAAI,EAAE,SAAS;QACf,WAAW;QACX,UAAU;QACV,cAAc,EAAE,WAAW;QAC3B,MAAM,EAAE,4BAA4B,UAAU,EAAE;KACjD,CAAC;AACJ,CAAC"}

package/dist/preimage.d.ts

@@ -0,0 +1,49 @@
+export interface PreimageLeaf {
+    preimage_utf8?: string;
+    preimage_hex?: string;
+}
+export interface PreimageEntry {
+    field?: string;
+    alg?: string;
+    recomputable?: boolean;
+    preimage_utf8?: string;
+    preimage_hex?: string;
+    hash?: string;
+    merkle?: string;
+    leaves?: PreimageLeaf[];
+    url?: string;
+}
+export interface PreimageBlock {
+    schema?: string;
+    fields?: Record<string, PreimageEntry>;
+    not_recomputable?: {
+        field?: string;
+        hash?: string | null;
+        reason?: string;
+    }[];
+    links?: {
+        preimage?: string;
+    };
+}
+export interface PreimageCheck {
+    checked: boolean;
+    ok: boolean;
+    errors: string[];
+    fields: {
+        field: string;
+        ok: boolean;
+        reason?: string;
+    }[];
+}
+/**
+ * Fields a stranger is expected to recompute when they are present.
+ * Coverage and tree_head_hash count only when the issuer published a preimage.
+ * Output, HMAC, and book-row universe hashes do not.
+ */
+export declare function requiredPreimageFields(receipt: Record<string, unknown>): string[];
+export declare function verifyPublishedPreimages(receipt: Record<string, unknown>, { requirePreimages, fetchImpl, trustedHosts, }?: {
+    requirePreimages?: boolean;
+    fetchImpl?: typeof fetch;
+    trustedHosts?: readonly string[];
+}): Promise<PreimageCheck>;
+//# sourceMappingURL=preimage.d.ts.map

package/dist/preimage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preimage.d.ts","sourceRoot":"","sources":["../src/preimage.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,YAAY;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACvC,gBAAgB,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC/E,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC3D;AAkGD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAUjF;AAmBD,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,EACE,gBAAwB,EACxB,SAA4B,EAC5B,YAAkC,GACnC,GAAE;IACD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B,GACL,OAAO,CAAC,aAAa,CAAC,CAoDxB"}

package/dist/preimage.js

@@ -0,0 +1,203 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requiredPreimageFields = requiredPreimageFields;
+exports.verifyPublishedPreimages = verifyPublishedPreimages;
+/**
+ * Recompute published receipt preimages.
+ * A missing or mismatched preimage fails closed when the caller requires it,
+ * and whenever a `preimages` block is present.
+ */
+const node_crypto_1 = require("node:crypto");
+const ethers_1 = require("ethers");
+const ALWAYS_REQUIRED = [
+    'book_chain.row_hash',
+    'book_row.row_hash',
+    'inclusion.leaf',
+    'binding.expected_commitment',
+    'job_spec_hash',
+    'response_hash',
+];
+function sha256(buf) {
+    return (0, node_crypto_1.createHash)('sha256').update(buf).digest();
+}
+function bytesOf(entry) {
+    if (!entry)
+        return null;
+    if (typeof entry.preimage_hex === 'string' && entry.preimage_hex !== '') {
+        const hex = entry.preimage_hex.replace(/^0x/, '');
+        if (!/^[0-9a-fA-F]*$/.test(hex) || hex.length % 2)
+            return null;
+        return Buffer.from(hex, 'hex');
+    }
+    if (typeof entry.preimage_utf8 === 'string')
+        return Buffer.from(entry.preimage_utf8, 'utf8');
+    return null;
+}
+function leafInput(leaf) {
+    if (typeof leaf.preimage_hex === 'string' && leaf.preimage_hex !== '') {
+        return bytesOf(leaf);
+    }
+    if (typeof leaf.preimage_utf8 === 'string') {
+        return Buffer.concat([Buffer.from([0x00]), Buffer.from(leaf.preimage_utf8, 'utf8')]);
+    }
+    return null;
+}
+function merkleRoot(leaves) {
+    const level = [];
+    for (const leaf of leaves) {
+        const input = leafInput(leaf);
+        if (!input)
+            return null;
+        level.push(sha256(input));
+    }
+    if (!level.length)
+        return null;
+    let nodes = level;
+    while (nodes.length > 1) {
+        const next = [];
+        for (let i = 0; i < nodes.length; i += 2) {
+            if (i + 1 === nodes.length)
+                next.push(nodes[i]);
+            else
+                next.push(sha256(Buffer.concat([Buffer.from([0x01]), nodes[i], nodes[i + 1]])));
+        }
+        nodes = next;
+    }
+    return nodes[0].toString('hex');
+}
+function digestHex(entry) {
+    if (entry.merkle === 'rfc6962' && Array.isArray(entry.leaves)) {
+        return merkleRoot(entry.leaves);
+    }
+    const bytes = bytesOf(entry);
+    if (!bytes)
+        return null;
+    if (entry.alg === 'keccak256')
+        return (0, ethers_1.keccak256)(bytes).toLowerCase();
+    if (entry.alg === 'sha256') {
+        const hex = sha256(bytes).toString('hex');
+        const published = String(entry.hash || '');
+        if (published.startsWith('0x') || published.startsWith('sha256:'))
+            return `0x${hex}`;
+        return hex;
+    }
+    return null;
+}
+function sameHash(left, right) {
+    const norm = (value) => value.trim().toLowerCase().replace(/^sha256=/, '');
+    return norm(left) === norm(right);
+}
+function readPath(receipt, field) {
+    if (field === 'job_spec_hash') {
+        return receipt.job_spec_hash
+            ?? receipt.board?.job_spec_hash
+            ?? receipt.a2a_escrow?.job_spec_hash
+            ?? null;
+    }
+    return field.split('.').reduce((obj, key) => {
+        if (obj == null || typeof obj !== 'object')
+            return undefined;
+        return obj[key];
+    }, receipt);
+}
+function hasHash(value) {
+    return value != null && value !== '';
+}
+function withheld(block, field) {
+    return (block?.not_recomputable || []).some((row) => row.field === field);
+}
+/**
+ * Fields a stranger is expected to recompute when they are present.
+ * Coverage and tree_head_hash count only when the issuer published a preimage.
+ * Output, HMAC, and book-row universe hashes do not.
+ */
+function requiredPreimageFields(receipt) {
+    const block = (receipt.preimages || null);
+    const fields = [];
+    for (const field of ALWAYS_REQUIRED) {
+        if (hasHash(readPath(receipt, field)) && !withheld(block, field))
+            fields.push(field);
+    }
+    for (const field of ['tree_head_hash', 'coverage.universe_hash', 'coverage.enumerated_hash']) {
+        if (block?.fields?.[field])
+            fields.push(field);
+    }
+    return [...new Set(fields)];
+}
+async function loadRemote(entry, fetchImpl, hosts) {
+    if (!entry.url)
+        return null;
+    let url;
+    try {
+        url = new URL(entry.url);
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== 'https:' || !hosts.some((host) => host.toLowerCase() === url.hostname.toLowerCase())) {
+        return null;
+    }
+    const res = await fetchImpl(entry.url);
+    if (!res.ok)
+        return null;
+    const body = await res.json();
+    return body && typeof body === 'object' ? { ...entry, ...body } : null;
+}
+async function verifyPublishedPreimages(receipt, { requirePreimages = false, fetchImpl = globalThis.fetch, trustedHosts = ['api.chit402.com'], } = {}) {
+    const block = (receipt.preimages || null);
+    const required = requiredPreimageFields(receipt);
+    if (!block && !requirePreimages) {
+        return { checked: false, ok: true, errors: [], fields: [] };
+    }
+    if (!block && required.length === 0) {
+        return { checked: true, ok: true, errors: [], fields: [] };
+    }
+    const errors = [];
+    const fields = [];
+    const published = block?.fields || {};
+    const targets = new Set([...required, ...Object.keys(published)]);
+    for (const field of targets) {
+        if (withheld(block, field) && !published[field])
+            continue;
+        let entry = published[field];
+        if (!entry) {
+            const message = `preimage missing for ${field}`;
+            errors.push(message);
+            fields.push({ field, ok: false, reason: 'preimage_missing' });
+            continue;
+        }
+        if (entry.recomputable === false)
+            continue;
+        if (!bytesOf(entry) && !(entry.leaves && entry.leaves.length) && entry.url && fetchImpl) {
+            try {
+                const remote = await loadRemote(entry, fetchImpl, trustedHosts);
+                if (remote)
+                    entry = remote;
+            }
+            catch {
+                /* fall through to missing */
+            }
+        }
+        const digest = digestHex(entry);
+        const expected = entry.hash != null ? String(entry.hash) : '';
+        const onReceipt = readPath(receipt, field);
+        if (digest == null) {
+            errors.push(`preimage missing for ${field}`);
+            fields.push({ field, ok: false, reason: 'preimage_missing' });
+            continue;
+        }
+        if (!sameHash(digest, expected)) {
+            errors.push(`preimage mismatch for ${field}: hash does not match the published bytes`);
+            fields.push({ field, ok: false, reason: 'preimage_mismatch' });
+            continue;
+        }
+        if (hasHash(onReceipt) && !sameHash(digest, String(onReceipt))) {
+            errors.push(`preimage mismatch for ${field}: recomputed hash does not match the receipt`);
+            fields.push({ field, ok: false, reason: 'preimage_mismatch' });
+            continue;
+        }
+        fields.push({ field, ok: true });
+    }
+    return { checked: true, ok: errors.length === 0, errors, fields };
+}
+//# sourceMappingURL=preimage.js.map

package/dist/preimage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preimage.js","sourceRoot":"","sources":["../src/preimage.ts"],"names":[],"mappings":";;AA4IA,wDAUC;AAmBD,4DA+DC;AAxOD;;;;GAIG;AACH,6CAAyC;AACzC,mCAAmC;AAiCnC,MAAM,eAAe,GAAG;IACtB,qBAAqB;IACrB,mBAAmB;IACnB,gBAAgB;IAChB,6BAA6B;IAC7B,eAAe;IACf,eAAe;CAChB,CAAC;AAEF,SAAS,MAAM,CAAC,GAAW;IACzB,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,OAAO,CAAC,KAA2E;IAC1F,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;QACxE,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/D,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC7F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,IAAkB;IACnC,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;QACtE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;QAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,MAAsB;IACxC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,MAAM;gBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;;gBAC3C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;QACD,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,SAAS,CAAC,KAAoB;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9D,OAAO,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,KAAK,CAAC,GAAG,KAAK,WAAW;QAAE,OAAO,IAAA,kBAAS,EAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,IAAI,KAAK,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,GAAG,EAAE,CAAC;QACrF,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAa;IAC3C,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACnF,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,QAAQ,CAAC,OAAgC,EAAE,KAAa;IAC/D,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAC9B,OAAO,OAAO,CAAC,aAAa;eACtB,OAAO,CAAC,KAAiD,EAAE,aAAa;eACxE,OAAO,CAAC,UAAsD,EAAE,aAAa;eAC9E,IAAI,CAAC;IACZ,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAU,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACnD,IAAI,GAAG,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC7D,OAAQ,GAA+B,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC,EAAE,OAAO,CAAC,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,QAAQ,CAAC,KAA2B,EAAE,KAAa;IAC1D,OAAO,CAAC,KAAK,EAAE,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,OAAgC;IACrE,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAyB,CAAC;IAClE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvF,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,gBAAgB,EAAE,wBAAwB,EAAE,0BAA0B,CAAC,EAAE,CAAC;QAC7F,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,KAAoB,EAAE,SAAuB,EAAE,KAAwB;IAC/F,IAAI,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC1G,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAmB,CAAC;IAC/C,OAAO,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzE,CAAC;AAEM,KAAK,UAAU,wBAAwB,CAC5C,OAAgC,EAChC,EACE,gBAAgB,GAAG,KAAK,EACxB,SAAS,GAAG,UAAU,CAAC,KAAK,EAC5B,YAAY,GAAG,CAAC,iBAAiB,CAAC,MAKhC,EAAE;IAEN,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAyB,CAAC;IAClE,MAAM,QAAQ,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC7D,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC1E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,SAAS;QAC1D,IAAI,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,wBAAwB,KAAK,EAAE,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC9D,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,YAAY,KAAK,KAAK;YAAE,SAAS;QAC3C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,SAAS,EAAE,CAAC;YACxF,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;gBAChE,IAAI,MAAM;oBAAE,KAAK,GAAG,MAAM,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,6BAA6B;YAC/B,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3C,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC9D,SAAS;QACX,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,yBAAyB,KAAK,2CAA2C,CAAC,CAAC;YACvF,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC/D,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAC/D,MAAM,CAAC,IAAI,CAAC,yBAAyB,KAAK,8CAA8C,CAAC,CAAC;YAC1F,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC/D,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACpE,CAAC"}