@xfuel/verify 0.2.1 → 0.3.1

package/dist/issuer-history.d.ts

@@ -0,0 +1,91 @@
+import { type Es256Jwk } from './jws.js';
+interface HistoryJwks {
+    keys: Es256Jwk[];
+}
+export declare const ISSUER_HISTORY_SCHEMA = "chit402.issuer_history.v1";
+export interface IssuerHistoryEntry {
+    kid: string;
+    jwk: Es256Jwk;
+    alg: string;
+    not_before: string;
+    not_after?: string | null;
+    status: 'active' | 'retired' | 'revoked' | string;
+    revoked_at?: string | null;
+    reason?: string | null;
+    custody?: string;
+    prev_hash?: string | null;
+    entry_hash?: string;
+}
+export interface IssuerHistoryPin {
+    hash: string;
+    version: number;
+    seq: number;
+}
+export interface IssuerHistoryDocument {
+    schema?: string;
+    version?: number;
+    seq?: number;
+    entries?: IssuerHistoryEntry[];
+    head_hash?: string;
+    issuer_signature?: {
+        jws?: string;
+        kid?: string;
+        issuer_jwk?: Es256Jwk;
+    };
+}
+export interface IssuerHistoryCheck {
+    checked: boolean;
+    ok: boolean;
+    unreachable: boolean;
+    warning: string | null;
+    reason: string | null;
+    kid: string | null;
+}
+export declare function issuerHistoryEntryBody(entry: IssuerHistoryEntry): Record<string, unknown>;
+export declare function issuerHistoryEntryHash(entry: IssuerHistoryEntry): string;
+export declare function verifyIssuerHistoryDocument(doc: IssuerHistoryDocument, { jwks, trustedKids }?: {
+    jwks?: HistoryJwks;
+    trustedKids?: readonly string[];
+}): {
+    valid: boolean;
+    reason?: string;
+};
+export declare function issuerKeyWindow(doc: IssuerHistoryDocument, kid: string, issuedAt: unknown): {
+    ok: boolean;
+    reason: string | null;
+};
+export declare function issuerHistoryDocumentHash(doc: unknown): string;
+/** Pin from verified JWS claims. An unsigned outer copy is not a pin. */
+export declare function readIssuerHistoryPin(claims: Record<string, unknown> | null | undefined): IssuerHistoryPin | null;
+export declare function checkReceiptIssuerHistory(receipt: {
+    verification?: {
+        jwks_uri?: string;
+    };
+    verify_url?: string;
+    created_at?: unknown;
+}, { document, fetchHistory, strict, historyUrl, jwks, trustedKids, fetchImpl, trustedHosts, issuedAt, kid, pin, requirePin, documentBytes, }?: {
+    document?: IssuerHistoryDocument | null;
+    fetchHistory?: boolean;
+    strict?: boolean;
+    historyUrl?: string | null;
+    jwks?: HistoryJwks;
+    trustedKids?: readonly string[];
+    fetchImpl?: typeof fetch;
+    trustedHosts?: readonly string[];
+    issuedAt?: unknown;
+    kid?: string | null;
+    /** From verified claims. When set, the fetched snapshot must match. */
+    pin?: IssuerHistoryPin | null;
+    /** Payload versions that sign a pin fail when the pin is absent. */
+    requirePin?: boolean;
+    /** Exact response or file bytes. SHA-256 of these must equal the pin. */
+    documentBytes?: string | null;
+}): Promise<IssuerHistoryCheck>;
+export declare function historyUrlFromReceipt(receipt: {
+    verification?: {
+        jwks_uri?: string;
+    };
+    verify_url?: string;
+}): string | null;
+export {};
+//# sourceMappingURL=issuer-history.d.ts.map

package/dist/issuer-history.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issuer-history.d.ts","sourceRoot":"","sources":["../src/issuer-history.ts"],"names":[],"mappings":"AAOA,OAAO,EAKL,KAAK,QAAQ,EACd,MAAM,UAAU,CAAC;AAElB,UAAU,WAAW;IACnB,IAAI,EAAE,QAAQ,EAAE,CAAC;CAClB;AAED,eAAO,MAAM,qBAAqB,8BAA8B,CAAC;AAEjE,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;IAClD,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,QAAQ,CAAA;KAAE,CAAC;CAC1E;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAMD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAqBzF;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,CAExE;AASD,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,qBAAqB,EAC1B,EAAE,IAAI,EAAE,WAAW,EAAE,GAAE;IAAE,IAAI,CAAC,EAAE,WAAW,CAAC;IAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAO,GAClF;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA+CrC;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,qBAAqB,EAC1B,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,OAAO,GAChB;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAiBxC;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAE9D;AAED,yEAAyE;AACzE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,gBAAgB,GAAG,IAAI,CAUhH;AASD,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE;IAAE,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,EAC5F,EACE,QAAe,EACf,YAAoB,EACpB,MAAc,EACd,UAAiB,EACjB,IAAI,EACJ,WAAW,EACX,SAA4B,EAC5B,YAAkC,EAClC,QAAe,EACf,GAAU,EACV,GAAU,EACV,UAAkB,EAClB,aAAoB,GACrB,GAAE;IACD,QAAQ,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACxC,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,uEAAuE;IACvE,GAAG,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC9B,oEAAoE;IACpE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,GACL,OAAO,CAAC,kBAAkB,CAAC,CA4F7B;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAAE,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,CAe3H"}

package/dist/issuer-history.js

@@ -0,0 +1,292 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ISSUER_HISTORY_SCHEMA = void 0;
+exports.issuerHistoryEntryBody = issuerHistoryEntryBody;
+exports.issuerHistoryEntryHash = issuerHistoryEntryHash;
+exports.verifyIssuerHistoryDocument = verifyIssuerHistoryDocument;
+exports.issuerKeyWindow = issuerKeyWindow;
+exports.issuerHistoryDocumentHash = issuerHistoryDocumentHash;
+exports.readIssuerHistoryPin = readIssuerHistoryPin;
+exports.checkReceiptIssuerHistory = checkReceiptIssuerHistory;
+exports.historyUrlFromReceipt = historyUrlFromReceipt;
+/**
+ * Public issuer key history.
+ * The document is signed by the current issuer key. Entries chain by
+ * SHA-256(JCS(entry without entry_hash)).
+ */
+const node_crypto_1 = require("node:crypto");
+const jcs_js_1 = require("./jcs.js");
+const jws_js_1 = require("./jws.js");
+exports.ISSUER_HISTORY_SCHEMA = 'chit402.issuer_history.v1';
+function sha256Hex(text) {
+    return (0, node_crypto_1.createHash)('sha256').update(text, 'utf8').digest('hex');
+}
+function issuerHistoryEntryBody(entry) {
+    return {
+        kid: entry.kid,
+        jwk: entry.jwk ? {
+            kty: entry.jwk.kty,
+            crv: entry.jwk.crv,
+            x: entry.jwk.x,
+            y: entry.jwk.y,
+            kid: entry.jwk.kid,
+            alg: entry.jwk.alg || 'ES256',
+            use: entry.jwk.use || 'sig',
+        } : null,
+        alg: entry.alg || 'ES256',
+        not_before: entry.not_before,
+        not_after: entry.not_after ?? null,
+        status: entry.status,
+        revoked_at: entry.revoked_at ?? null,
+        reason: entry.reason ?? null,
+        custody: entry.custody,
+        prev_hash: entry.prev_hash ?? null,
+    };
+}
+function issuerHistoryEntryHash(entry) {
+    return sha256Hex((0, jcs_js_1.jcsCanonicalize)(issuerHistoryEntryBody(entry)));
+}
+function parseTime(value) {
+    if (value == null || value === '')
+        return null;
+    if (typeof value === 'number' && Number.isFinite(value))
+        return value > 1e12 ? value : value * 1000;
+    const ms = Date.parse(String(value));
+    return Number.isFinite(ms) ? ms : null;
+}
+function verifyIssuerHistoryDocument(doc, { jwks, trustedKids } = {}) {
+    if (!doc || doc.schema !== exports.ISSUER_HISTORY_SCHEMA || !Array.isArray(doc.entries) || !doc.entries.length) {
+        return { valid: false, reason: 'not_issuer_history' };
+    }
+    let prev = null;
+    for (const entry of doc.entries) {
+        if ((entry.prev_hash ?? null) !== prev)
+            return { valid: false, reason: 'prev_hash_mismatch' };
+        if (issuerHistoryEntryHash(entry) !== entry.entry_hash)
+            return { valid: false, reason: 'entry_hash_mismatch' };
+        if (!['active', 'retired', 'revoked'].includes(entry.status))
+            return { valid: false, reason: 'bad_status' };
+        prev = entry.entry_hash || null;
+    }
+    const head = doc.entries[doc.entries.length - 1].entry_hash;
+    if (doc.head_hash !== head)
+        return { valid: false, reason: 'head_hash_mismatch' };
+    const jws = doc.issuer_signature?.jws;
+    if (!jws)
+        return { valid: false, reason: 'no_signature' };
+    const headerKid = doc.issuer_signature?.kid || null;
+    // Undefined matches verifyReceipt / verifyRefusal: the production pin.
+    // An explicit empty list (--no-trusted-kid) does not.
+    const pins = trustedKids ?? jws_js_1.DEFAULT_TRUSTED_ISSUER_KIDS;
+    const candidates = [];
+    if (jwks?.keys) {
+        for (const key of jwks.keys) {
+            if (!headerKid || key.kid === headerKid)
+                candidates.push(key);
+        }
+    }
+    const embedded = doc.issuer_signature?.issuer_jwk;
+    if (embedded && (0, jws_js_1.isPinnedTrustedJwk)(embedded, pins))
+        candidates.push(embedded);
+    if (!candidates.length && embedded && headerKid && pins.includes(headerKid)) {
+        if ((0, jws_js_1.jwkThumbprint)(embedded) === headerKid)
+            candidates.push(embedded);
+    }
+    if (!candidates.length)
+        return { valid: false, reason: 'key untrusted' };
+    for (const jwk of candidates) {
+        const result = (0, jws_js_1.verifyIssuerJws)(jws, jwk);
+        if (!result.valid)
+            continue;
+        const payload = result.payload || {};
+        if (payload.schema !== exports.ISSUER_HISTORY_SCHEMA)
+            return { valid: false, reason: 'schema_mismatch' };
+        if (Number(payload.entry_count) !== doc.entries.length)
+            return { valid: false, reason: 'entry_count_mismatch' };
+        if (payload.head_hash !== head)
+            return { valid: false, reason: 'signed_head_mismatch' };
+        if (payload.version != null && Number(payload.version) !== Number(doc.version)) {
+            return { valid: false, reason: 'version_mismatch' };
+        }
+        if (payload.seq != null && Number(payload.seq) !== Number(doc.seq)) {
+            return { valid: false, reason: 'seq_mismatch' };
+        }
+        return { valid: true };
+    }
+    return { valid: false, reason: 'signature_invalid' };
+}
+function issuerKeyWindow(doc, kid, issuedAt) {
+    const entry = (doc.entries || []).find((row) => row.kid === kid);
+    if (!entry)
+        return { ok: false, reason: 'kid_not_in_history' };
+    const issued = parseTime(issuedAt);
+    if (issued == null)
+        return { ok: false, reason: 'issued_at_missing' };
+    const notBefore = parseTime(entry.not_before);
+    if (notBefore == null)
+        return { ok: false, reason: 'not_before_missing' };
+    if (issued < notBefore)
+        return { ok: false, reason: 'issued_before_not_before' };
+    const notAfter = parseTime(entry.not_after);
+    if (entry.not_after != null && notAfter == null)
+        return { ok: false, reason: 'not_after_invalid' };
+    if (notAfter != null && issued > notAfter)
+        return { ok: false, reason: 'issued_after_not_after' };
+    if (entry.status === 'revoked') {
+        const revoked = parseTime(entry.revoked_at);
+        if (revoked == null)
+            return { ok: false, reason: 'revoked_at_missing' };
+        if (issued >= revoked)
+            return { ok: false, reason: 'kid_revoked_before_issuance' };
+    }
+    return { ok: true, reason: null };
+}
+function issuerHistoryDocumentHash(doc) {
+    return sha256Hex((0, jcs_js_1.jcsCanonicalize)(doc));
+}
+/** Pin from verified JWS claims. An unsigned outer copy is not a pin. */
+function readIssuerHistoryPin(claims) {
+    const pin = claims?.issuer_history;
+    if (!pin || typeof pin !== 'object')
+        return null;
+    const row = pin;
+    if (typeof row.hash !== 'string' || !/^[0-9a-f]{64}$/.test(row.hash))
+        return null;
+    const version = Number(row.version);
+    const seq = Number(row.seq);
+    if (!Number.isInteger(version) || version < 1)
+        return null;
+    if (!Number.isInteger(seq) || seq < 1)
+        return null;
+    return { hash: row.hash, version, seq };
+}
+function historyUrlWithPin(url, pin) {
+    if (!pin)
+        return url;
+    const parsed = new URL(url);
+    parsed.searchParams.set('version', String(pin.version));
+    return parsed.toString();
+}
+async function checkReceiptIssuerHistory(receipt, { document = null, fetchHistory = false, strict = false, historyUrl = null, jwks, trustedKids, fetchImpl = globalThis.fetch, trustedHosts = ['api.chit402.com'], issuedAt = null, kid = null, pin = null, requirePin = false, documentBytes = null, } = {}) {
+    const base = {
+        checked: false,
+        ok: true,
+        unreachable: false,
+        warning: null,
+        reason: null,
+        kid,
+    };
+    const pinned = !!(pin && pin.hash);
+    const failClosed = strict || pinned || requirePin;
+    if (requirePin && !pinned) {
+        return { ...base, checked: true, ok: false, reason: 'issuer_history_pin_missing' };
+    }
+    if (!kid) {
+        const warning = 'issuer history not checked: receipt has no kid';
+        if (failClosed)
+            return { ...base, checked: true, ok: false, reason: warning };
+        return { ...base, warning };
+    }
+    let doc = document;
+    let raw = documentBytes;
+    if (!doc && (fetchHistory || historyUrl || strict || pinned)) {
+        const baseUrl = historyUrl || historyUrlFromReceipt(receipt);
+        if (!baseUrl) {
+            const warning = 'issuer history unreachable: no history url on the receipt';
+            if (failClosed)
+                return { ...base, checked: true, ok: false, unreachable: true, reason: warning, warning };
+            return { ...base, unreachable: true, warning };
+        }
+        let url = baseUrl;
+        try {
+            url = historyUrlWithPin(baseUrl, pin);
+        }
+        catch {
+            const warning = 'issuer history unreachable: bad history url';
+            if (failClosed)
+                return { ...base, checked: true, ok: false, unreachable: true, reason: warning, warning };
+            return { ...base, unreachable: true, warning };
+        }
+        let parsed;
+        try {
+            parsed = new URL(url);
+        }
+        catch {
+            const warning = 'issuer history unreachable: bad history url';
+            if (failClosed)
+                return { ...base, checked: true, ok: false, unreachable: true, reason: warning, warning };
+            return { ...base, unreachable: true, warning };
+        }
+        const explicit = !!historyUrl;
+        const hostOk = explicit
+            ? parsed.protocol === 'https:'
+            : parsed.protocol === 'https:' && trustedHosts.some((host) => host.toLowerCase() === parsed.hostname.toLowerCase());
+        if (!hostOk) {
+            const warning = 'issuer history unreachable: history host is not allowed';
+            if (failClosed)
+                return { ...base, checked: true, ok: false, unreachable: true, reason: warning, warning };
+            return { ...base, unreachable: true, warning };
+        }
+        try {
+            const res = await fetchImpl(url, { signal: AbortSignal.timeout(4000) });
+            if (!res.ok)
+                throw new Error(`HTTP ${res.status}`);
+            raw = await res.text();
+            doc = JSON.parse(raw);
+        }
+        catch (err) {
+            const warning = `issuer history unreachable: ${err instanceof Error ? err.message : String(err)}`;
+            if (failClosed)
+                return { ...base, checked: true, ok: false, unreachable: true, reason: warning, warning };
+            return { ...base, unreachable: true, warning };
+        }
+    }
+    if (!doc) {
+        const warning = 'issuer history not checked';
+        if (failClosed)
+            return { ...base, checked: true, ok: false, unreachable: true, reason: warning, warning };
+        return { ...base, warning };
+    }
+    if (pinned && pin) {
+        if (raw != null && sha256Hex(raw) !== pin.hash) {
+            return { ...base, checked: true, ok: false, reason: 'issuer_history_pin_mismatch' };
+        }
+        if (issuerHistoryDocumentHash(doc) !== pin.hash) {
+            return { ...base, checked: true, ok: false, reason: 'issuer_history_pin_mismatch' };
+        }
+        if (Number(doc.version) !== pin.version) {
+            return { ...base, checked: true, ok: false, reason: 'issuer_history_version_mismatch' };
+        }
+        if (Number(doc.seq) !== pin.seq) {
+            return { ...base, checked: true, ok: false, reason: 'issuer_history_seq_mismatch' };
+        }
+    }
+    const signed = verifyIssuerHistoryDocument(doc, { jwks, trustedKids });
+    if (!signed.valid) {
+        return { ...base, checked: true, ok: false, reason: signed.reason || 'issuer_history_invalid' };
+    }
+    const window = issuerKeyWindow(doc, kid, issuedAt);
+    if (!window.ok) {
+        return { ...base, checked: true, ok: false, reason: window.reason };
+    }
+    return { ...base, checked: true, ok: true };
+}
+function historyUrlFromReceipt(receipt) {
+    const jwks = receipt.verification?.jwks_uri;
+    if (jwks && jwks.includes('/.well-known/jwks.json')) {
+        return jwks.replace('/.well-known/jwks.json', '/.well-known/issuer-history.json');
+    }
+    if (receipt.verify_url) {
+        try {
+            const url = new URL(receipt.verify_url);
+            if (url.protocol !== 'https:' && url.protocol !== 'http:')
+                return null;
+            return `${url.origin}/.well-known/issuer-history.json`;
+        }
+        catch {
+            return null;
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=issuer-history.js.map

package/dist/issuer-history.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issuer-history.js","sourceRoot":"","sources":["../src/issuer-history.ts"],"names":[],"mappings":";;;AA+DA,wDAqBC;AAED,wDAEC;AASD,kEAkDC;AAED,0CAqBC;AAED,8DAEC;AAGD,oDAUC;AASD,8DA8HC;AAED,sDAeC;AAnVD;;;;GAIG;AACH,6CAAyC;AACzC,qCAA2C;AAC3C,qCAMkB;AAML,QAAA,qBAAqB,GAAG,2BAA2B,CAAC;AAwCjE,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,SAAgB,sBAAsB,CAAC,KAAyB;IAC9D,OAAO;QACL,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YACf,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG;YAClB,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG;YAClB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YACd,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG;YAClB,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,OAAO;YAC7B,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,KAAK;SAC5B,CAAC,CAAC,CAAC,IAAI;QACR,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,OAAO;QACzB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;KACnC,CAAC;AACJ,CAAC;AAED,SAAgB,sBAAsB,CAAC,KAAyB;IAC9D,OAAO,SAAS,CAAC,IAAA,wBAAe,EAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC;IACpG,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAED,SAAgB,2BAA2B,CACzC,GAA0B,EAC1B,EAAE,IAAI,EAAE,WAAW,KAA8D,EAAE;IAEnF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,6BAAqB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACvG,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QAC9F,IAAI,sBAAsB,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,UAAU;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QAC/G,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QAC5G,IAAI,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC;IAClC,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;IAC5D,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAClF,MAAM,GAAG,GAAG,GAAG,CAAC,gBAAgB,EAAE,GAAG,CAAC;IACtC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC1D,MAAM,SAAS,GAAG,GAAG,CAAC,gBAAgB,EAAE,GAAG,IAAI,IAAI,CAAC;IACpD,uEAAuE;IACvE,sDAAsD;IACtD,MAAM,IAAI,GAAG,WAAW,IAAI,oCAA2B,CAAC;IACxD,MAAM,UAAU,GAAe,EAAE,CAAC;IAClC,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC;QACf,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS;gBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,gBAAgB,EAAE,UAAU,CAAC;IAClD,IAAI,QAAQ,IAAI,IAAA,2BAAkB,EAAC,QAAQ,EAAE,IAAI,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9E,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,QAAQ,IAAI,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,IAAI,IAAA,sBAAa,EAAC,QAAQ,CAAC,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACzE,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAA,wBAAe,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,SAAS;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,MAAM,KAAK,6BAAqB;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QACjG,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QAChH,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QACxF,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClD,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;AACvD,CAAC;AAED,SAAgB,eAAe,CAC7B,GAA0B,EAC1B,GAAW,EACX,QAAiB;IAEjB,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACjE,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC/D,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACtE,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAI,SAAS,IAAI,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC1E,IAAI,MAAM,GAAG,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IACjF,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,QAAQ,IAAI,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACnG,IAAI,QAAQ,IAAI,IAAI,IAAI,MAAM,GAAG,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAClG,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,OAAO,IAAI,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACxE,IAAI,MAAM,IAAI,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IACrF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,SAAgB,yBAAyB,CAAC,GAAY;IACpD,OAAO,SAAS,CAAC,IAAA,wBAAe,EAAC,GAAG,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,yEAAyE;AACzE,SAAgB,oBAAoB,CAAC,MAAkD;IACrF,MAAM,GAAG,GAAG,MAAM,EAAE,cAAc,CAAC;IACnC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,GAAG,GAAG,GAA2D,CAAC;IACxE,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClF,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW,EAAE,GAA4B;IAClE,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAC7C,OAA4F,EAC5F,EACE,QAAQ,GAAG,IAAI,EACf,YAAY,GAAG,KAAK,EACpB,MAAM,GAAG,KAAK,EACd,UAAU,GAAG,IAAI,EACjB,IAAI,EACJ,WAAW,EACX,SAAS,GAAG,UAAU,CAAC,KAAK,EAC5B,YAAY,GAAG,CAAC,iBAAiB,CAAC,EAClC,QAAQ,GAAG,IAAI,EACf,GAAG,GAAG,IAAI,EACV,GAAG,GAAG,IAAI,EACV,UAAU,GAAG,KAAK,EAClB,aAAa,GAAG,IAAI,MAkBlB,EAAE;IAEN,MAAM,IAAI,GAAuB;QAC/B,OAAO,EAAE,KAAK;QACd,EAAE,EAAE,IAAI;QACR,WAAW,EAAE,KAAK;QAClB,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,IAAI;QACZ,GAAG;KACJ,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,MAAM,IAAI,MAAM,IAAI,UAAU,CAAC;IAClD,IAAI,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,OAAO,GAAG,gDAAgD,CAAC;QACjE,IAAI,UAAU;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC9E,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,IAAI,GAAG,GAAG,aAAa,CAAC;IACxB,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,IAAI,UAAU,IAAI,MAAM,IAAI,MAAM,CAAC,EAAE,CAAC;QAC7D,MAAM,OAAO,GAAG,UAAU,IAAI,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC7D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,2DAA2D,CAAC;YAC5E,IAAI,UAAU;gBAAE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAC1G,OAAO,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACjD,CAAC;QACD,IAAI,GAAG,GAAG,OAAO,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,OAAO,GAAG,6CAA6C,CAAC;YAC9D,IAAI,UAAU;gBAAE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAC1G,OAAO,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACjD,CAAC;QACD,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,OAAO,GAAG,6CAA6C,CAAC;YAC9D,IAAI,UAAU;gBAAE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAC1G,OAAO,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACjD,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC;QAC9B,MAAM,MAAM,GAAG,QAAQ;YACrB,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAC9B,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QACtH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,yDAAyD,CAAC;YAC1E,IAAI,UAAU;gBAAE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAC1G,OAAO,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACjD,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACnD,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YACvB,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,+BAA+B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAClG,IAAI,UAAU;gBAAE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAC1G,OAAO,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,OAAO,GAAG,4BAA4B,CAAC;QAC7C,IAAI,UAAU;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAC1G,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAClB,IAAI,GAAG,IAAI,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;YAC/C,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;QACtF,CAAC;QACD,IAAI,yBAAyB,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;YAChD,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;QACtF,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC;YACxC,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;QAC1F,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;YAChC,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;QACtF,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,2BAA2B,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,wBAAwB,EAAE,CAAC;IAClG,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAAsE;IAC1G,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC;IAC5C,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,kCAAkC,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACxC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;gBAAE,OAAO,IAAI,CAAC;YACvE,OAAO,GAAG,GAAG,CAAC,MAAM,kCAAkC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/jcs.d.ts

@@ -0,0 +1,8 @@
+/**
+ * RFC 8785 JSON Canonicalization.
+ * Same rules as `jcsCanonicalize` in services/gateway/src/offer-receipt.js.
+ * Issuer-history entry hashes and the receipt canonical object use this form.
+ * Per-field receipt hashes keep the encoding they were signed with.
+ */
+export declare function jcsCanonicalize(value: unknown): string;
+//# sourceMappingURL=jcs.d.ts.map

package/dist/jcs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jcs.d.ts","sourceRoot":"","sources":["../src/jcs.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEtD"}

package/dist/jcs.js

@@ -0,0 +1,64 @@
+"use strict";
+/**
+ * RFC 8785 JSON Canonicalization.
+ * Same rules as `jcsCanonicalize` in services/gateway/src/offer-receipt.js.
+ * Issuer-history entry hashes and the receipt canonical object use this form.
+ * Per-field receipt hashes keep the encoding they were signed with.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.jcsCanonicalize = jcsCanonicalize;
+function jcsCanonicalize(value) {
+    return jcsValue(value);
+}
+function jcsValue(value) {
+    if (value === null || value === undefined)
+        return 'null';
+    const type = typeof value;
+    if (type === 'boolean')
+        return value ? 'true' : 'false';
+    if (type === 'number') {
+        if (!Number.isFinite(value))
+            throw new Error('Cannot canonicalize Infinity or NaN');
+        if (Object.is(value, -0))
+            return '0';
+        return String(value);
+    }
+    if (type === 'string')
+        return jcsString(value);
+    if (Array.isArray(value))
+        return `[${value.map(jcsValue).join(',')}]`;
+    if (type === 'object')
+        return jcsObject(value);
+    throw new Error(`Cannot canonicalize value of type ${type}`);
+}
+function jcsString(str) {
+    let result = '"';
+    for (let i = 0; i < str.length; i += 1) {
+        const char = str[i];
+        const code = str.charCodeAt(i);
+        if (code < 32) {
+            result += `\\u${code.toString(16).padStart(4, '0')}`;
+        }
+        else if (char === '"') {
+            result += '\\"';
+        }
+        else if (char === '\\') {
+            result += '\\\\';
+        }
+        else {
+            result += char;
+        }
+    }
+    return `${result}"`;
+}
+function jcsObject(obj) {
+    const keys = Object.keys(obj).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+    const pairs = [];
+    for (const key of keys) {
+        const value = obj[key];
+        if (value !== undefined)
+            pairs.push(`${jcsString(key)}:${jcsValue(value)}`);
+    }
+    return `{${pairs.join(',')}}`;
+}
+//# sourceMappingURL=jcs.js.map

package/dist/jcs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jcs.js","sourceRoot":"","sources":["../src/jcs.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAEH,0CAEC;AAFD,SAAgB,eAAe,CAAC,KAAc;IAC5C,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACzD,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC;IAC1B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IACxD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAe,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC9F,IAAI,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QACrC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC,KAAe,CAAC,CAAC;IACzD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACtE,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC,KAAgC,CAAC,CAAC;IAC1E,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;YACd,MAAM,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QACvD,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC;QAClB,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,MAAM,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,MAAM,GAAG,CAAC;AACtB,CAAC;AAED,SAAS,SAAS,CAAC,GAA4B;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAChC,CAAC"}

package/dist/preimage.d.ts

@@ -0,0 +1,49 @@
+export interface PreimageLeaf {
+    preimage_utf8?: string;
+    preimage_hex?: string;
+}
+export interface PreimageEntry {
+    field?: string;
+    alg?: string;
+    recomputable?: boolean;
+    preimage_utf8?: string;
+    preimage_hex?: string;
+    hash?: string;
+    merkle?: string;
+    leaves?: PreimageLeaf[];
+    url?: string;
+}
+export interface PreimageBlock {
+    schema?: string;
+    fields?: Record<string, PreimageEntry>;
+    not_recomputable?: {
+        field?: string;
+        hash?: string | null;
+        reason?: string;
+    }[];
+    links?: {
+        preimage?: string;
+    };
+}
+export interface PreimageCheck {
+    checked: boolean;
+    ok: boolean;
+    errors: string[];
+    fields: {
+        field: string;
+        ok: boolean;
+        reason?: string;
+    }[];
+}
+/**
+ * Fields a stranger is expected to recompute when they are present.
+ * Coverage and tree_head_hash count only when the issuer published a preimage.
+ * Output, HMAC, and book-row universe hashes do not.
+ */
+export declare function requiredPreimageFields(receipt: Record<string, unknown>): string[];
+export declare function verifyPublishedPreimages(receipt: Record<string, unknown>, { requirePreimages, fetchImpl, trustedHosts, }?: {
+    requirePreimages?: boolean;
+    fetchImpl?: typeof fetch;
+    trustedHosts?: readonly string[];
+}): Promise<PreimageCheck>;
+//# sourceMappingURL=preimage.d.ts.map

package/dist/preimage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preimage.d.ts","sourceRoot":"","sources":["../src/preimage.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,YAAY;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACvC,gBAAgB,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC/E,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC3D;AAkGD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAUjF;AAmBD,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,EACE,gBAAwB,EACxB,SAA4B,EAC5B,YAAkC,GACnC,GAAE;IACD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B,GACL,OAAO,CAAC,aAAa,CAAC,CAoDxB"}