@ziffer-io/verify 0.1.0 → 0.2.0

package/dist/verify.js

@@ -19,7 +19,7 @@
  * | 5 | temporal position (9.3-5) and the L-14 window ceiling | yes |
  * | 6 | nonce WE-4 type and L-17 size | yes; the CL-2 single-use CLAIM is ledger state |
  * | 7 | TR-8 / RV-3 recomputation | NO -- needs the signed policy |
- * | 7b | the AT-* quorum, AB-1..AB-4 | NO -- needs the attester registry |
+ * | 7b | the AT-* quorum, AB-1..AB-4 | YES, when the anchor carries a `quorum` policy |
  * | 8 | tenant scoping | NO -- needs the bundle's tenant |
  * | 9-10 | capability recheck, delivery identity | NO -- absent in the engine too |
  *
@@ -28,6 +28,24 @@
  * here means "the stateless set found nothing", never "the receipt may be
  * consumed".
  *
+ * # Step 7b, and the one thing it still cannot answer (ACP-406 gap 1)
+ *
+ * Step 7b runs here when {@link TrustAnchor.quorum} is supplied from the
+ * caller's own signed bundle -- see `quorum.ts` for the full checklist and its
+ * R/B/T table. Two consequences belong in this header rather than only there:
+ *
+ * - A receipt that CARRIES attestations while the anchor carries no quorum
+ *   policy is **refused** (`AB-1`), not passed. A verifier that cannot
+ *   recompute an entry digest has no binding at all, and passing would be the
+ *   permissive default this package exists to refuse.
+ * - **This function still cannot tell that a quorum was REQUIRED.** That is
+ *   step 7's recomputed floor-only risk, which needs the bundle's grading rules
+ *   and is not here. A receipt carrying no attestations passes 7b vacuously and
+ *   {@link Verified.quorum} is `null`, which the caller can read; taking the
+ *   answer from the receipt's own `risk_level_floor_only` instead would be X1,
+ *   the defect where a compromised issuer asserting `LOW` suppressed
+ *   attestation entirely.
+ *
  * # R / B / T classification (suite 12) for the inputs this module reads
  *
  * | input | class | why |
@@ -39,13 +57,19 @@
  * | `nowUnixSeconds` | T | the caller's clock. Nothing here can check it; a stale or forward value silently voids the expiry and skew checks (the engine's residual 3, verbatim). Only L-14 survives such a caller, because it compares the receipt's two instants against each other |
  */
 import { createHash } from 'node:crypto';
-import { ml_dsa65 } from '@noble/post-quantum/ml-dsa.js';
 import { canon } from './canon.js';
-import { CLAUSE_BODY_SIZE, CLAUSE_CANONICAL, CLAUSE_DECISION, CLAUSE_PROPOSAL_BINDING, CLAUSE_RECEIPT_NONCE_SIZE, CLAUSE_SIGNATURE, CLAUSE_SUITE_FLOOR, CLAUSE_TEMPORAL, CLAUSE_UNKNOWN_SUITE, CLAUSE_VALIDITY_WINDOW, CLAUSE_VERSION, CLAUSE_WIRE_TYPE, } from './clauses.js';
-import { verifyEd25519Strict } from './ed25519.js';
+import { CLAUSE_BODY_SIZE, CLAUSE_MEMBERSHIP, CLAUSE_CANONICAL, CLAUSE_DECISION, CLAUSE_PROPOSAL_BINDING, CLAUSE_RECEIPT_NONCE_SIZE, CLAUSE_SIGNATURE, CLAUSE_SUITE_FLOOR, CLAUSE_TEMPORAL, CLAUSE_UNKNOWN_SUITE, CLAUSE_VALIDITY_WINDOW, CLAUSE_VERSION, CLAUSE_WIRE_TYPE, } from './clauses.js';
 import { parseInstant } from './instant.js';
+import { verifyQuorum, } from './quorum.js';
 import { Refusal } from './refusal.js';
-import { parseSuite, satisfiesFloor, suitePrimitives, verifyHybrid, } from './suite.js';
+import { hex, parseSig, verifyUnderSuite } from './sig.js';
+import { parseSuite, satisfiesFloor } from './suite.js';
+import { isRecord, isWe4B64, NONCE128_BYTES, NONCE128_LEN, strField } from './wire.js';
+// WE-4 and the nonce sizes moved to `wire.ts` so `quorum.ts` can apply the one
+// definition to `att_nonce`; re-exported here because they were this module's
+// published surface first and a move is not a removal.
+export { isWe4B64, NONCE128_BYTES, NONCE128_LEN } from './wire.js';
+export { MLDSA65_PK_LEN, MLDSA65_SIG_LEN } from './sig.js';
 /** AB-0 (§8.6b): version 3, the digest-bound form, and NO other. A verifier
  * accepting both 2 and 3 lets an attacker present the weaker one -- the CR-4
  * downgrade shape with the format negotiated by the party under verification. */
@@ -60,127 +84,6 @@ export const RECEIPT_MAX_SIGNED_BYTES = 4096;
 export const CLOCK_SKEW_SECS = 5;
 /** L-14's ceiling on a receipt's validity window, seconds. */
 export const MAX_VALIDITY_WINDOW_SECS = 120;
-/** FIPS 204 ML-DSA-65 public key length. */
-export const MLDSA65_PK_LEN = 1952;
-/** FIPS 204 ML-DSA-65 signature length. */
-export const MLDSA65_SIG_LEN = 3309;
-/** The one wire nonce size, 128-bit (`Nonce128`, cited by AT-1 and L-17). */
-export const NONCE128_BYTES = 16;
-/** `"b64:"` plus base64 of 16 bytes: 4 + 24. Counted, never decoded -- a rule
- * whose behaviour on bad input is "throw" is not a refusal. */
-export const NONCE128_LEN = 4 + Math.ceil(NONCE128_BYTES / 3) * 4;
-function isRecord(v) {
-    return typeof v === 'object' && v !== null && !Array.isArray(v);
-}
-function strField(v, key) {
-    const raw = v[key];
-    return typeof raw === 'string' ? raw : null;
-}
-function hex(bytes) {
-    let out = '';
-    for (const b of bytes)
-        out += b.toString(16).padStart(2, '0');
-    return out;
-}
-/** Decode a hex signature leg, refusing exactly as decide.rs's `unhex`. */
-function unhex(s) {
-    if (s.length % 2 !== 0) {
-        throw new Refusal(CLAUSE_SIGNATURE, 'signature hex has odd length');
-    }
-    const out = new Uint8Array(s.length / 2);
-    for (let i = 0; i < s.length; i += 2) {
-        const byte = Number.parseInt(s.slice(i, i + 2), 16);
-        // parseInt would tolerate "0x", whitespace and a lone valid first digit;
-        // requiring both chars to be hex keeps this as strict as Rust's
-        // from_str_radix over a 2-char slice.
-        if (Number.isNaN(byte) || !/^[0-9a-fA-F]{2}$/.test(s.slice(i, i + 2))) {
-            throw new Refusal(CLAUSE_SIGNATURE, 'signature is not hex');
-        }
-        out[i / 2] = byte;
-    }
-    return out;
-}
-/**
- * WE-4: is this the ASCII string `b64:` followed by RFC 4648 §4 base64, WITH
- * padding? Ported from `quorum.rs::is_we4_b64` -- the body is whole
- * four-character groups, the alphabet is §4's (`+` and `/`, never §5's `-` and
- * `_`), and `=` appears only as one or two characters at the very end.
- * Rejected, never normalised: normalising would make this verifier accept two
- * spellings of one nonce, which is how one nonce comes to hold two ledger
- * slots (ACP-87).
- */
-export function isWe4B64(s) {
-    if (!s.startsWith('b64:'))
-        return false;
-    const body = s.slice(4);
-    if (body.length % 4 !== 0)
-        return false;
-    let pad = 0;
-    for (let i = body.length - 1; i >= 0 && body[i] === '='; i -= 1)
-        pad += 1;
-    if (pad > 2)
-        return false;
-    for (let i = 0; i < body.length - pad; i += 1) {
-        const c = body.charCodeAt(i);
-        const alnum = (c >= 0x30 && c <= 0x39) || (c >= 0x41 && c <= 0x5a) || (c >= 0x61 && c <= 0x7a);
-        if (!alnum && c !== 0x2b /* + */ && c !== 0x2f /* / */)
-            return false;
-    }
-    return true;
-}
-/**
- * Parse a wire `sig` object into the parts the CR-3 combiner verifies --
- * `decide.rs::parse_sig`, including its rule that the key set must be EXACTLY
- * the suite's. Three attacks live in the difference: a scalar `sig` (format
- * confusion is a downgrade in disguise), a missing primitive (the stripped
- * leg), and an extra undeclared primitive (an accepted code path the attacker
- * chose). An unknown primitive name is refused rather than dropped -- a
- * dropped part would let a suite be satisfied by the parts that remain.
- */
-function parseSig(sig, alg) {
-    // CR-1 first: an unparseable suite has no primitive set at all, so asking
-    // which primitives it requires would be a category error.
-    const suite = parseSuite(alg);
-    if (suite === null) {
-        throw new Refusal(CLAUSE_UNKNOWN_SUITE, 'unknown signature suite');
-    }
-    if (!isRecord(sig)) {
-        throw new Refusal(CLAUSE_SIGNATURE, 'receipt signature is not a per-primitive object');
-    }
-    const required = suitePrimitives(suite);
-    const keys = Object.keys(sig);
-    if (keys.length !== required.length || !required.every((p) => keys.includes(p))) {
-        throw new Refusal(CLAUSE_SIGNATURE, 'signature primitives are not exactly those the declared suite requires');
-    }
-    const parts = [];
-    for (const primitive of required) {
-        const value = sig[primitive];
-        if (typeof value !== 'string') {
-            throw new Refusal(CLAUSE_SIGNATURE, 'signature value is not a hex string');
-        }
-        parts.push({ primitive, bytes: unhex(value) });
-    }
-    return parts;
-}
-/**
- * Verify one ML-DSA-65 signature. Never throws; length checks first, exactly
- * as `primitives.rs` -- a malformed input is `invalid`, never `unsupported`:
- * one is a statement about the signature, the other about this build, and
- * reporting one as the other sends the investigation to the wrong place.
- */
-function verifyMlDsa65(publicKey, message, signature) {
-    if (publicKey.length !== MLDSA65_PK_LEN || signature.length !== MLDSA65_SIG_LEN) {
-        return 'invalid';
-    }
-    try {
-        // Empty FIPS 204 context, matching both engine sides (MLDSA_CTX = &[]):
-        // a context the signer did not use is a different message.
-        return ml_dsa65.verify(signature, message, publicKey) ? 'valid' : 'invalid';
-    }
-    catch {
-        return 'invalid';
-    }
-}
 /**
  * The §9.3 gate steps 1-2 with CR-1/CR-4/CR-3 -- `receipt.rs::verify_receipt`.
  *
@@ -198,23 +101,7 @@ function verifyReceiptGate(alg, floor, identity, signedBytes, parts, decision) {
     if (!satisfiesFloor(suite, floor)) {
         throw new Refusal(CLAUSE_SUITE_FLOOR, 'signature suite does not contain every primitive of the bundle floor');
     }
-    const verdicts = parts.map((part) => {
-        switch (part.primitive) {
-            case 'classical':
-                return [
-                    part.primitive,
-                    verifyEd25519Strict(identity.classical, signedBytes, part.bytes) ? 'valid' : 'invalid',
-                ];
-            case 'pq':
-                return [part.primitive, verifyMlDsa65(identity.pq, signedBytes, part.bytes)];
-            case 'pq-slh':
-                // Declared, not implemented. Never a pass, and never silently dropped
-                // from the set either -- dropping it would let a suite naming it be
-                // satisfied by the primitives that remain.
-                return [part.primitive, 'unsupported'];
-        }
-    });
-    const err = verifyHybrid(suite, verdicts);
+    const err = verifyUnderSuite(suite, identity, signedBytes, parts);
     if (err !== null) {
         throw new Refusal(CLAUSE_SIGNATURE, err);
     }
@@ -331,8 +218,30 @@ export function verifyReceipt(receiptJson, proposalBytes, identity, opts) {
     if (nonce.length !== NONCE128_LEN) {
         throw new Refusal(CLAUSE_RECEIPT_NONCE_SIZE, `receipt nonce is not ${NONCE128_BYTES * 8}-bit`);
     }
-    // Steps 7/7b/8 (grading, quorum, tenant) need the signed policy, registry
-    // and bundle tenant -- outside the stateless set; see the module doc.
-    return { proposalHash, receiptExpiresAt: exp };
+    // ----------------------------------------------------------- step 7b
+    // The AT-* quorum and §8.6b's AB-*, LAST, because every value it is checked
+    // against was established above: `proposalHash` at step 3 and `iat` at step
+    // 5. Steps 7 (grading) and 8 (tenant) are still absent -- see the module
+    // doc's table -- so `floor_only_risk` is the one 7b(iii) comparison this
+    // package cannot make, and `quorum.ts` says so rather than approximating it.
+    const entries = receiptJson['attestations'];
+    const digests = receiptJson['attestation_digests'];
+    const carriesQuorum = (Array.isArray(entries) && entries.length > 0) ||
+        (Array.isArray(digests) && digests.length > 0) ||
+        (entries !== undefined && !Array.isArray(entries)) ||
+        (digests !== undefined && !Array.isArray(digests));
+    if (identity.quorum === undefined) {
+        if (carriesQuorum) {
+            // FAIL CLOSED. A verifier with no registry cannot recompute an entry
+            // digest, so it has no binding to the attestations at all; passing here
+            // would be exactly the permissive-by-omission default RES-8 keeps
+            // producing. AB-1 is the clause because it is the obligation that cannot
+            // be discharged.
+            throw new Refusal(CLAUSE_MEMBERSHIP, 'the receipt carries attestations and this trust anchor names no attester registry: step 7b cannot be discharged');
+        }
+        return { proposalHash, receiptExpiresAt: exp, quorum: null };
+    }
+    const quorum = verifyQuorum(identity.quorum, { proposalHash, receiptIssuedAt: iat, floor }, entries, digests);
+    return { proposalHash, receiptExpiresAt: exp, quorum };
 }
 //# sourceMappingURL=verify.js.map

package/dist/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAEzD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,yBAAyB,EACzB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,cAAc,EACd,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EACL,UAAU,EACV,cAAc,EACd,eAAe,EACf,YAAY,GAIb,MAAM,YAAY,CAAC;AAEpB;;iFAEiF;AACjF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC;AAEjC;gFACgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAsB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;AAEzE;6EAC6E;AAC7E,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C,iFAAiF;AACjF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC;AAEjC,8DAA8D;AAC9D,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAE5C,4CAA4C;AAC5C,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AACnC,2CAA2C;AAC3C,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAEpC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AACjC;+DAC+D;AAC/D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;AA0ClE,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,QAAQ,CAAC,CAA0B,EAAE,GAAW;IACvD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,GAAG,CAAC,KAAiB;IAC5B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2EAA2E;AAC3E,SAAS,KAAK,CAAC,CAAS;IACtB,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,OAAO,CAAC,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpD,yEAAyE;QACzE,gEAAgE;QAChE,sCAAsC;QACtC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,OAAO,CAAC,gBAAgB,EAAE,sBAAsB,CAAC,CAAC;QAC9D,CAAC;QACD,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;IACpB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,CAAS;IAChC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC;QAAE,GAAG,IAAI,CAAC,CAAC;IAC1E,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,KAAK,GACT,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;QACnF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD;;;;;;;;GAQG;AACH,SAAS,QAAQ,CAAC,GAAY,EAAE,GAAW;IACzC,0EAA0E;IAC1E,0DAA0D;IAC1D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,OAAO,CAAC,oBAAoB,EAAE,yBAAyB,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,OAAO,CAAC,gBAAgB,EAAE,iDAAiD,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,OAAO,CACf,gBAAgB,EAChB,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,OAAO,CAAC,gBAAgB,EAAE,qCAAqC,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CACpB,SAAqB,EACrB,OAAmB,EACnB,SAAqB;IAErB,IAAI,SAAS,CAAC,MAAM,KAAK,cAAc,IAAI,SAAS,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QAChF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,wEAAwE;QACxE,2DAA2D;QAC3D,OAAO,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CACxB,GAAW,EACX,KAAY,EACZ,QAAqB,EACrB,WAAuB,EACvB,KAA+B,EAC/B,QAAgB;IAEhB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,OAAO,CAAC,oBAAoB,EAAE,yBAAyB,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,OAAO,CACf,kBAAkB,EAClB,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAA+C,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC9E,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;YACvB,KAAK,WAAW;gBACd,OAAO;oBACL,IAAI,CAAC,SAAS;oBACd,mBAAmB,CAAC,QAAQ,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;iBACvF,CAAC;YACJ,KAAK,IAAI;gBACP,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/E,KAAK,QAAQ;gBACX,sEAAsE;gBACtE,oEAAoE;gBACpE,2CAA2C;gBAC3C,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1C,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,IAAI,OAAO,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAC3B,WAAoB,EACpB,aAAyB,EACzB,QAAqB,EACrB,IAAoB;IAEpB,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,wEAAwE;QACxE,uEAAuE;QACvE,uEAAuE;QACvE,MAAM,IAAI,OAAO,CAAC,oBAAoB,EAAE,2CAA2C,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,EAAE,cAAc,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAEtD,qEAAqE;IACrE,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,yDAAyD;IACzD,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,OAAO,CACf,cAAc,EACd,mBAAmB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,eAAe,EAAE,CACvE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3B,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,IAAI,OAAO,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;IAClE,CAAC;IAED,uEAAuE;IACvE,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAEhC,wEAAwE;IACxE,+BAA+B;IAC/B,IAAI,WAAW,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;QAClD,MAAM,IAAI,OAAO,CACf,gBAAgB,EAChB,kBAAkB,WAAW,CAAC,MAAM,oBAAoB,wBAAwB,qBAAqB,CACtG,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACzC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,OAAO,CAAC,oBAAoB,EAAE,2BAA2B,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;IAChD,iBAAiB,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAErG,sEAAsE;IACtE,wEAAwE;IACxE,4EAA4E;IAC5E,uEAAuE;IACvE,uCAAuC;IACvC,IAAI,aAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,OAAO,CAAC,gBAAgB,EAAE,mCAAmC,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,YAAY,GAAG,UAAU,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;IACjG,IAAI,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC,KAAK,YAAY,EAAE,CAAC;QAC5D,MAAM,IAAI,OAAO,CAAC,uBAAuB,EAAE,oCAAoC,CAAC,CAAC;IACnF,CAAC;IAED,yEAAyE;IACzE,wEAAwE;IACxE,8EAA8E;IAE9E,sEAAsE;IACtE,yEAAyE;IACzE,sCAAsC;IACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACnD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACvC,MAAM,IAAI,OAAO,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,OAAO,CAAC,eAAe,EAAE,+CAA+C,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,OAAO,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,GAAG,GAAG,GAAG,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,OAAO,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;IACzE,CAAC;IACD,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,GAAG,GAAG,GAAG,GAAG,wBAAwB,EAAE,CAAC;QACzC,MAAM,IAAI,OAAO,CACf,sBAAsB,EACtB,mBAAmB,GAAG,GAAG,GAAG,aAAa,wBAAwB,GAAG,CACrE,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,2EAA2E;IAC3E,oEAAoE;IACpE,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,OAAO,CACf,gBAAgB,EAChB,iBAAiB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,mDAAmD,CACzG,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,OAAO,CACf,yBAAyB,EACzB,wBAAwB,cAAc,GAAG,CAAC,MAAM,CACjD,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,sEAAsE;IAEtE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC;AACjD,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,yBAAyB,EACzB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,cAAc,EACd,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACL,YAAY,GAGb,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,gBAAgB,EAAsB,MAAM,UAAU,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAE,cAAc,EAAc,MAAM,YAAY,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEvF,+EAA+E;AAC/E,8EAA8E;AAC9E,uDAAuD;AACvD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAE3D;;iFAEiF;AACjF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC;AAEjC;gFACgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAsB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;AAEzE;6EAC6E;AAC7E,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C,iFAAiF;AACjF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC;AAEjC,8DAA8D;AAC9D,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAgE5C;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CACxB,GAAW,EACX,KAAY,EACZ,QAAqB,EACrB,WAAuB,EACvB,KAA+B,EAC/B,QAAgB;IAEhB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,OAAO,CAAC,oBAAoB,EAAE,yBAAyB,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,OAAO,CACf,kBAAkB,EAClB,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IAClE,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,IAAI,OAAO,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAC3B,WAAoB,EACpB,aAAyB,EACzB,QAAqB,EACrB,IAAoB;IAEpB,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,wEAAwE;QACxE,uEAAuE;QACvE,uEAAuE;QACvE,MAAM,IAAI,OAAO,CAAC,oBAAoB,EAAE,2CAA2C,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,EAAE,cAAc,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAEtD,qEAAqE;IACrE,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,yDAAyD;IACzD,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,OAAO,CACf,cAAc,EACd,mBAAmB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,eAAe,EAAE,CACvE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3B,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,IAAI,OAAO,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;IAClE,CAAC;IAED,uEAAuE;IACvE,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAEhC,wEAAwE;IACxE,+BAA+B;IAC/B,IAAI,WAAW,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;QAClD,MAAM,IAAI,OAAO,CACf,gBAAgB,EAChB,kBAAkB,WAAW,CAAC,MAAM,oBAAoB,wBAAwB,qBAAqB,CACtG,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACzC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,OAAO,CAAC,oBAAoB,EAAE,2BAA2B,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;IAChD,iBAAiB,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAErG,sEAAsE;IACtE,wEAAwE;IACxE,4EAA4E;IAC5E,uEAAuE;IACvE,uCAAuC;IACvC,IAAI,aAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,OAAO,CAAC,gBAAgB,EAAE,mCAAmC,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,YAAY,GAAG,UAAU,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;IACjG,IAAI,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC,KAAK,YAAY,EAAE,CAAC;QAC5D,MAAM,IAAI,OAAO,CAAC,uBAAuB,EAAE,oCAAoC,CAAC,CAAC;IACnF,CAAC;IAED,yEAAyE;IACzE,wEAAwE;IACxE,8EAA8E;IAE9E,sEAAsE;IACtE,yEAAyE;IACzE,sCAAsC;IACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACnD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACvC,MAAM,IAAI,OAAO,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,OAAO,CAAC,eAAe,EAAE,+CAA+C,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,OAAO,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,GAAG,GAAG,GAAG,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,OAAO,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;IACzE,CAAC;IACD,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,GAAG,GAAG,GAAG,GAAG,wBAAwB,EAAE,CAAC;QACzC,MAAM,IAAI,OAAO,CACf,sBAAsB,EACtB,mBAAmB,GAAG,GAAG,GAAG,aAAa,wBAAwB,GAAG,CACrE,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,2EAA2E;IAC3E,oEAAoE;IACpE,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,OAAO,CACf,gBAAgB,EAChB,iBAAiB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,mDAAmD,CACzG,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,OAAO,CACf,yBAAyB,EACzB,wBAAwB,cAAc,GAAG,CAAC,MAAM,CACjD,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,yEAAyE;IACzE,6EAA6E;IAC7E,MAAM,OAAO,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACnD,MAAM,aAAa,GACjB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9C,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9C,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACrD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,aAAa,EAAE,CAAC;YAClB,qEAAqE;YACrE,wEAAwE;YACxE,kEAAkE;YAClE,yEAAyE;YACzE,iBAAiB;YACjB,MAAM,IAAI,OAAO,CACf,iBAAiB,EACjB,iHAAiH,CAClH,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CACzB,QAAQ,CAAC,MAAM,EACf,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,EAAE,KAAK,EAAE,EAC7C,OAAO,EACP,OAAO,CACR,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACzD,CAAC"}

package/dist/webauthn.d.ts

@@ -0,0 +1,148 @@
+/**
+ * §8.6c HM-1..HM-7 -- a human attester's WebAuthn assertion, verified in the
+ * customer's own process.
+ *
+ * The third writing of `crates/acp-crypto/src/webauthn.rs` and
+ * `reference/src/acp_crypto.py`, and the mirrored corpus
+ * `fixtures/refused_webauthn.json` is what holds the three to one rule: 18
+ * vectors, two ACCEPT and one refusal per HM-4 step, replayed by
+ * `webauthn.test.ts` against this file.
+ *
+ * # What a human leg is NOT (HM-6, CR-8)
+ *
+ * **CLASSICAL, and this function must never be read as though it were more.**
+ * No passkey, platform authenticator or security key in existence produces a
+ * post-quantum signature, so a `webauthn` entry is never compared against the
+ * bundle's `min_suite` (CR-8) -- the absence of a floor check here IS the
+ * clause, not an omission. The post-quantum binding of a human's decision is
+ * the receipt AB-1 digests the whole entry into and the §11 anchor over it.
+ *
+ * # The order is normative and the NAMES are the product (HM-4)
+ *
+ * HM-4 states six checks in order and says no step is skipped for a smaller one
+ * that already failed. What the implementations must agree on is not "refused"
+ * but WHICH step refused: `WebauthnOrigin` is a phishing finding and
+ * `WebauthnChallenge` is a replay, and one name for both would make them one
+ * event in an audit record. That is why this throws a named
+ * {@link WebauthnRefusal} rather than returning a boolean.
+ *
+ * Step (f), the signature counter, is NOT here: comparing it needs the stored
+ * value for the credential, which is Consumption Ledger state. What this
+ * returns is the counter the assertion carried; `quorum.ts` compares it against
+ * what the caller stored, and discloses that this package holds no ledger.
+ */
+/**
+ * HM-1 / CR-8: the two names an entry's `alg` may take.
+ *
+ * ATTESTATION-ENTRY SUITES ONLY. `suite.ts`'s table is the machine one and
+ * these are deliberately absent from it, because CR-8 forbids either as a
+ * bundle, receipt or door suite -- a name present in both tables is a name
+ * whose meaning depends on where it was read.
+ */
+export declare const WEBAUTHN_ALGS: readonly string[];
+/** The one primitive name a human entry's `sig` map carries (HM-3). */
+export declare const WEBAUTHN_PRIMITIVE = "webauthn";
+/**
+ * HM-3's three fields.
+ *
+ * **This is not their canonical ORDER**, and the difference looks like one.
+ * RFC 8949 §4.2.1 sorts map keys by their ENCODED bytes and a text key's head
+ * carries its length, so the wire order is by length first: `signature` (9),
+ * `client_data_json` (16), `authenticator_data` (18). The decoder gets that
+ * right by construction; a reader who assumed this array's order was the wire
+ * order would write a decoder that refuses every real assertion.
+ */
+export declare const ASSERTION_FIELDS: readonly string[];
+/** The registry entry, the COSE_Key or the assertion is not the declared shape. */
+export declare const MALFORMED = "Malformed";
+/** PB-9 / HM-5, at enrolment: an off-curve ES256 key or a small-order Ed25519 one. */
+export declare const REGISTRY_KEY_WEAK = "RegistryKeyWeak";
+/** HM-4 (a). */
+export declare const WEBAUTHN_TYPE = "WebauthnType";
+/** HM-4 (b). */
+export declare const WEBAUTHN_CHALLENGE = "WebauthnChallenge";
+/** HM-4 (c). */
+export declare const WEBAUTHN_ORIGIN = "WebauthnOrigin";
+/** HM-4 (d). */
+export declare const WEBAUTHN_AUTHENTICATOR_DATA = "WebauthnAuthenticatorData";
+/** HM-4 (e). */
+export declare const WEBAUTHN_SIGNATURE = "WebauthnSignature";
+/**
+ * One HM-4 step refused, named.
+ *
+ * `name` is the STEP and is what the cross-implementation comparison is on; the
+ * clause is HM-4 for all of them, and six failures under one clause id would be
+ * one name for six objects. Deliberately NOT a {@link import('./refusal.js').Refusal}:
+ * `quorum.ts` maps these to §9.3's vocabulary at its own boundary, and a type
+ * that could travel straight out would let an unmapped name reach a caller.
+ */
+export declare class WebauthnRefusal extends Error {
+    readonly refusalName: string;
+    readonly detail: string;
+    constructor(refusalName: string, detail: string);
+}
+/** A credential's public key, decoded and already known to be a usable point. */
+export type CredentialKey = {
+    readonly kind: 'es256';
+    readonly sec1: Uint8Array;
+} | {
+    readonly kind: 'ed25519';
+    readonly raw: Uint8Array;
+};
+/**
+ * HM-1 / HM-5: decode a credential's COSE_Key.
+ *
+ * The decode is CANONICAL AND VALIDATING (AT-8a) because the registry entry is
+ * signed policy: a key that decodes from two different byte strings is a
+ * credential with two names.
+ *
+ * WEAKNESS IS REFUSED HERE, at enrolment, not left to the verifier: an ES256
+ * point off the curve and an Ed25519 point of small order are both
+ * `RegistryKeyWeak` (HM-5, PB-9). The curve-membership question is asked of
+ * `p256`'s own construction -- the same one the verifier will use -- rather than
+ * of a second copy of the curve equation, which would be a second definition of
+ * the curve. {@link ed25519IsSmallOrder} is the predicate `verifyEd25519Strict`
+ * already applies: one rule, two callers (ACP-109).
+ */
+export declare function coseKeyParse(alg: string, raw: Uint8Array): CredentialKey;
+/** HM-3's three fields, decoded. */
+export interface Assertion {
+    readonly authenticatorData: Uint8Array;
+    readonly clientDataJson: Uint8Array;
+    readonly signature: Uint8Array;
+}
+/**
+ * HM-3: the `webauthn` primitive's value, decoded under a FIXED SHAPE.
+ *
+ * A general CBOR decoder is the wrong tool and is deliberately not offered.
+ * What arrives here is attacker-supplied on the transport path, so the decoder
+ * must accept exactly one shape -- three text keys, each a byte string -- and
+ * refuse everything else as `Malformed`. A tag, a float, a nested map, an extra
+ * key and a missing key are all the same answer, because a decoder that reports
+ * them differently is a parser an attacker can interrogate.
+ */
+export declare function decodeAssertion(raw: Uint8Array): Assertion;
+/**
+ * HM-2: the challenge is base64url WITHOUT padding of the message's bytes.
+ *
+ * ONE definition, so "the challenge encoding" cannot mean two things. Note what
+ * the verifier does with it: it RECOMPUTES this from an id it derived itself and
+ * compares (RES-8). It never decodes the challenge the assertion carries and
+ * treats the result as an identifier -- a transmitted id is a name for a
+ * binding, not evidence of one.
+ */
+export declare function webauthnChallenge(messageIdBytes: Uint8Array): string;
+/**
+ * HM-4 (a)-(e), IN ORDER, returning the assertion's 32-bit signature counter.
+ *
+ * `messageIdBytes` is the UTF-8 bytes of a **recomputed** id -- the attestation
+ * id at §9.3 step 7b(v). Never an id read off the message being verified
+ * (HM-2, RES-8). `rpId` is the entry's SIGNED relying-party id: signed policy,
+ * never a value the assertion supplies, which is the whole of HM-4 (c).
+ *
+ * NO STEP IS SKIPPED FOR AN EARLIER ONE, and the order is normative: an
+ * assertion wrong in two ways must produce the same refusal name in every
+ * implementation, or the corpus is comparing luck.
+ */
+export declare function verifyWebauthn(alg: string, coseKey: Uint8Array, messageIdBytes: Uint8Array, rpId: string, assertion: Uint8Array): number;
+//# sourceMappingURL=webauthn.d.ts.map

package/dist/webauthn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../src/webauthn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AASH;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAA2C,CAAC;AAEvF,uEAAuE;AACvE,eAAO,MAAM,kBAAkB,aAAa,CAAC;AAE7C;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAI7C,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,SAAS,cAAc,CAAC;AACrC,sFAAsF;AACtF,eAAO,MAAM,iBAAiB,oBAAoB,CAAC;AACnD,gBAAgB;AAChB,eAAO,MAAM,aAAa,iBAAiB,CAAC;AAC5C,gBAAgB;AAChB,eAAO,MAAM,kBAAkB,sBAAsB,CAAC;AACtD,gBAAgB;AAChB,eAAO,MAAM,eAAe,mBAAmB,CAAC;AAChD,gBAAgB;AAChB,eAAO,MAAM,2BAA2B,8BAA8B,CAAC;AACvE,gBAAgB;AAChB,eAAO,MAAM,kBAAkB,sBAAsB,CAAC;AAEtD;;;;;;;;GAQG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAMhD;AAmBD,iFAAiF;AACjF,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GACrD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAA;CAAE,CAAC;AAsC3D;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,aAAa,CA8DxE;AAED,oCAAoC;AACpC,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,iBAAiB,EAAE,UAAU,CAAC;IACvC,QAAQ,CAAC,cAAc,EAAE,UAAU,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;CAChC;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAuB1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,UAAU,GAAG,MAAM,CAcpE;AAkBD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,UAAU,EACnB,cAAc,EAAE,UAAU,EAC1B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,UAAU,GACpB,MAAM,CA+IR"}