capacity-attest 0.6.0 → 0.8.0

package/dist/http-source.js

@@ -0,0 +1,154 @@
+// http-source.ts — a ClaimSource over a plain HTTP endpoint: "another
+// installation's public endpoint", one of the substrate examples named in
+// discovery.ts's own header comment. This is WP1's second, non-EAS,
+// production-grade source: it proves discoverDeliveryHistory's aggregation
+// logic against a genuinely different SOURCE TYPE (plain HTTP, no chain, no
+// ethers), not just a second EAS deployment. Like every ClaimSource, this is
+// UNTRUSTED: discoverDeliveryHistory re-verifies every claim it returns,
+// regardless of what this module does or does not check first.
+//
+// Convention (deliberately the simplest defensible one, not a full
+// paginated/authenticated protocol): GET `${endpointUrl}?seller=<address>`
+// returns a JSON array of claims for that seller. DECISIONS.md D-005
+// explicitly defers designing a full decentralized-findability PROTOCOL
+// until a real second installation exists to standardize with; inventing
+// cursor-based pagination or auth here now would be protocol surface nobody
+// has agreed to yet. A single bounded JSON response, capped the same way any
+// other source is capped downstream, is the right-sized amount of protocol
+// for a substrate that has no live second party yet.
+//
+// Native fetch only (Node >=20 ships it as a global) — no new dependency,
+// same minimal-dependency stance eas.ts states for itself ("plain ethers
+// only, no eas-sdk dependency").
+import { ETH_ADDRESS_RE } from "./schema.js";
+export class HttpSourceError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "HttpSourceError";
+    }
+}
+// discoverDeliveryHistory's own MAX_CLAIMS_PER_SOURCE only bounds the claims
+// ARRAY, after it is already fully parsed into memory. A raw response body
+// far larger than any real claim set (an oversized or hostile response)
+// would pay the cost of buffering and JSON.parse BEFORE that cap gets a
+// chance to help. This bounds the raw bytes read, before parsing, closing
+// that gap specifically for this transport (EAS does not have this exposure:
+// its equivalent bound is the block-range windowing in eas.ts). 16 MiB is
+// generous for thousands of real claims (each a few hundred bytes) while
+// still refusing a source that tries to exhaust memory.
+const DEFAULT_MAX_RESPONSE_BYTES = 16 * 1024 * 1024;
+// Independent of discoverDeliveryHistory's own sourceTimeoutMs (default
+// 30s): this source is also usable standalone, outside discoverDeliveryHistory,
+// so it carries its own, tighter default rather than relying entirely on a
+// caller that may not exist.
+const DEFAULT_TIMEOUT_MS = 10_000;
+// Reuses schema.ts's own canonical address shape (the same one
+// DeliveryClaimSchema enforces on sellerAddress/buyerAddress) rather than a
+// separately invented, looser check. sellerAddress is caller-supplied here
+// (same trust level as every other source's argument), but validating its
+// shape before string-building a URL from it is nearly free, and matching
+// the one canonical format means a malformed address fails fast, right
+// here, with a clear message, instead of surfacing later as an opaque
+// low-level exception from whatever eventually tries to use it (e.g. an
+// ethers "invalid BytesLike value" a couple of layers downstream).
+const ADDRESS_SHAPE = ETH_ADDRESS_RE;
+/**
+ * Read a Response body up to maxBytes, throwing HttpSourceError the moment
+ * the limit is crossed instead of buffering the rest. Cancels the underlying
+ * stream on overflow so the connection is not left dangling.
+ */
+async function readBounded(response, maxBytes) {
+    const body = response.body;
+    if (!body)
+        return "";
+    const reader = body.getReader();
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        if (value) {
+            total += value.byteLength;
+            if (total > maxBytes) {
+                await reader.cancel().catch(() => { });
+                throw new HttpSourceError(`response exceeded ${maxBytes} bytes, refused before parsing`);
+            }
+            chunks.push(value);
+        }
+    }
+    return Buffer.concat(chunks.map((c) => Buffer.from(c))).toString("utf-8");
+}
+/**
+ * A ClaimSource over a plain HTTP endpoint. GETs
+ * `${endpointUrl}?seller=<sellerAddress>` and expects a JSON array back.
+ * Deliberately does NO verification and NO per-entry shape checking itself
+ * (same division of responsibility as staticSource/easSource):
+ * discoverDeliveryHistory re-verifies every claim from every source
+ * uniformly. A malformed sellerAddress, a non-2xx status, a request that
+ * times out or fails at the network level, a body over the size cap, or a
+ * body that is not JSON or not a JSON array, all become a thrown
+ * HttpSourceError — which discoverDeliveryHistory's existing per-source
+ * try/catch already turns into a SourceReport.error, never a crash of the
+ * whole aggregation.
+ */
+export function httpClaimSource(endpointUrl, opts = {}) {
+    const name = opts.name ?? "http";
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const maxResponseBytes = opts.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    return {
+        name,
+        fetchForSeller: async (sellerAddress) => {
+            if (!ADDRESS_SHAPE.test(sellerAddress)) {
+                throw new HttpSourceError(`refusing to build a URL from a malformed sellerAddress: ${JSON.stringify(sellerAddress)}`);
+            }
+            const url = new URL(endpointUrl);
+            url.searchParams.set("seller", sellerAddress);
+            let response;
+            try {
+                response = await fetchImpl(url, { signal: AbortSignal.timeout(timeoutMs) });
+            }
+            catch (e) {
+                throw new HttpSourceError(`request to ${url} failed: ${e.message}`);
+            }
+            if (!response.ok) {
+                throw new HttpSourceError(`${url} responded ${response.status} ${response.statusText}`);
+            }
+            // A stall DURING body streaming (headers already arrived, response.ok
+            // already true, but the body never finishes within timeoutMs) is a
+            // SEPARATE failure moment from the connect-phase catch above: the same
+            // AbortSignal also governs the body read, so it rejects too, but with
+            // a raw DOMException (name "TimeoutError"), not HttpSourceError. Wrap
+            // it here so every documented failure mode really does surface as
+            // HttpSourceError, matching this function's own doc comment.
+            let text;
+            try {
+                text = await readBounded(response, maxResponseBytes);
+            }
+            catch (e) {
+                if (e instanceof HttpSourceError)
+                    throw e; // already correct: the byte-cap-exceeded case
+                throw new HttpSourceError(`reading response body from ${url} failed: ${e.message}`);
+            }
+            let parsed;
+            try {
+                parsed = JSON.parse(text);
+            }
+            catch (e) {
+                throw new HttpSourceError(`response from ${url} was not valid JSON: ${e.message}`);
+            }
+            if (!Array.isArray(parsed)) {
+                throw new HttpSourceError(`response from ${url} was valid JSON but not an array`);
+            }
+            // Untyped cast is deliberate: every entry is untrusted input regardless
+            // of shape, exactly like staticSource's fixed list and easSource's
+            // decoded attestations. discoverDeliveryHistory's own per-entry
+            // computeClaimId/verifyClaim/DeliveryClaimSchema.parse chain is what
+            // actually validates each one; duplicating that here would just be a
+            // second, redundant copy of logic that already lives in one place.
+            return parsed;
+        },
+    };
+}
+//# sourceMappingURL=http-source.js.map

package/dist/http-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-source.js","sourceRoot":"","sources":["../src/http-source.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,0EAA0E;AAC1E,oEAAoE;AACpE,2EAA2E;AAC3E,4EAA4E;AAC5E,6EAA6E;AAC7E,yEAAyE;AACzE,+DAA+D;AAC/D,EAAE;AACF,mEAAmE;AACnE,2EAA2E;AAC3E,qEAAqE;AACrE,wEAAwE;AACxE,yEAAyE;AACzE,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAC3E,qDAAqD;AACrD,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,iCAAiC;AAGjC,OAAO,EAAE,cAAc,EAAsB,MAAM,aAAa,CAAC;AAEjE,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,6EAA6E;AAC7E,2EAA2E;AAC3E,wEAAwE;AACxE,wEAAwE;AACxE,0EAA0E;AAC1E,6EAA6E;AAC7E,0EAA0E;AAC1E,yEAAyE;AACzE,wDAAwD;AACxD,MAAM,0BAA0B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEpD,wEAAwE;AACxE,gFAAgF;AAChF,2EAA2E;AAC3E,6BAA6B;AAC7B,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,+DAA+D;AAC/D,4EAA4E;AAC5E,2EAA2E;AAC3E,0EAA0E;AAC1E,0EAA0E;AAC1E,uEAAuE;AACvE,sEAAsE;AACtE,wEAAwE;AACxE,mEAAmE;AACnE,MAAM,aAAa,GAAG,cAAc,CAAC;AAYrC;;;;GAIG;AACH,KAAK,UAAU,WAAW,CAAC,QAAkB,EAAE,QAAgB;IAC7D,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,SAAS,CAAC;QACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACtC,MAAM,IAAI,eAAe,CAAC,qBAAqB,QAAQ,gCAAgC,CAAC,CAAC;YAC3F,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB,EAAE,OAA+B,EAAE;IACpF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;IAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,OAAO;QACL,IAAI;QACJ,cAAc,EAAE,KAAK,EAAE,aAAqB,EAA4B,EAAE;YACxE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,eAAe,CAAC,2DAA2D,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YACxH,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;YACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YAE9C,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC9E,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,eAAe,CAAC,cAAc,GAAG,YAAa,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YACjF,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,eAAe,CAAC,GAAG,GAAG,cAAc,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;YAC1F,CAAC;YAED,sEAAsE;YACtE,mEAAmE;YACnE,uEAAuE;YACvE,sEAAsE;YACtE,sEAAsE;YACtE,kEAAkE;YAClE,6DAA6D;YAC7D,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,eAAe;oBAAE,MAAM,CAAC,CAAC,CAAC,8CAA8C;gBACzF,MAAM,IAAI,eAAe,CAAC,8BAA8B,GAAG,YAAa,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YACjG,CAAC;YACD,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,eAAe,CAAC,iBAAiB,GAAG,wBAAyB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YAChG,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,eAAe,CAAC,iBAAiB,GAAG,kCAAkC,CAAC,CAAC;YACpF,CAAC;YACD,wEAAwE;YACxE,mEAAmE;YACnE,gEAAgE;YAChE,qEAAqE;YACrE,qEAAqE;YACrE,mEAAmE;YACnE,OAAO,MAAyB,CAAC;QACnC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/receipt-authorization.d.ts

@@ -0,0 +1,77 @@
+/**
+ * §5.6.2's table. Each method fixes the byte length of `asset` and `authorizer`;
+ * `identifier` and `salt` are 32 bytes for every method. Fixed lengths are what
+ * make the preimage unambiguous without any separators, so they are enforced
+ * rather than assumed: a field of the wrong length would hash to a commitment
+ * that opens to nothing, and would do so silently.
+ */
+export declare const AUTHORIZATION_METHODS: {
+    readonly eip3009: {
+        readonly asset: 20;
+        readonly authorizer: 20;
+    };
+};
+export type AuthorizationMethod = keyof typeof AUTHORIZATION_METHODS;
+export interface CommitmentInput {
+    /** Currently only "eip3009". Equals the receipt's `authorizationMethod`. */
+    method: AuthorizationMethod;
+    /** Token contract of the accepts entry that was paid. Not carried by the receipt. */
+    asset: string;
+    /** `from` of the authorization. §5.6.4 step 1 takes this from the receipt's signed payer. */
+    authorizer: string;
+    /** The ERC-3009 nonce, 32 bytes. */
+    identifier: string;
+    /** 32 bytes of CSPRNG output, per payment. Never signed, never in the receipt. */
+    salt: string;
+}
+/** §5.6.3: 32 bytes from a CSPRNG, independent per payment, never derived from anything. */
+export declare function generateAuthorizationSalt(): string;
+/** §5.6.2, the whole construction. Hex inputs are case-insensitive; bytes are hashed. */
+export declare function computeAuthorizationCommitment(input: CommitmentInput): string;
+export type OpenResult = {
+    linked: true;
+    identifier: string;
+} | {
+    linked: false;
+    reason: string;
+};
+export interface OpenInput {
+    /** The signed receipt payload. `payer` is the authorizer; nothing else is trusted. */
+    payload: {
+        payer: string;
+        authorizationMethod?: string;
+        authorizationCommitment?: string;
+    };
+    salt: string;
+    /** The asset of the accepts entry that was paid. §5.6.4: salt alone cannot link. */
+    asset: string;
+    /** Nonces from AuthorizationUsed(authorizer, nonce) logs on that asset. */
+    candidateIdentifiers: readonly string[];
+}
+/**
+ * §5.6.4 steps 1 and 3. Fails closed on both nothing and ambiguity.
+ *
+ * Two matches is not "probably the first one": if an identifier can repeat across
+ * settlements the commitment genuinely opens to several, and the spec says that
+ * case does not link. Reporting a guess there would turn a fail-closed design into
+ * a false link, which is the one outcome the whole construction exists to avoid.
+ */
+export declare function openAuthorizationCommitment(input: OpenInput): OpenResult;
+/**
+ * The vector published with the spec, kept here so our own test has an external
+ * anchor. The independent verifier in agent-receipt-verify asserts the same
+ * constant from its own implementation: two implementations anchored to the same
+ * published number cannot drift silently, two anchored to each other can.
+ */
+export declare const SPEC_VECTOR: {
+    readonly source: "x402-foundation/x402 PR #3827, specs/extensions/extension-offer-and-receipt.md §5.6.2, commit 0e492d6730bef14b9c722428386c114f3475a914";
+    readonly input: {
+        readonly method: "eip3009";
+        readonly asset: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913";
+        readonly authorizer: "0x857b06519E91e3A54538791bDbb0E22373e36b66";
+        readonly identifier: "0x5135a00b531830a13a751f3c48944d7a5fdfde7a3b87f73493591cd77efdef4f";
+        readonly salt: "0x10d2ae5f0c8536e82d882bf3d2c31a663597e890ca6c3fede0d278fd2a78f655";
+    };
+    readonly expected: "0x5d905bbf08a97e04ab551d276d8e94b1abaff7d0737324d360e983c2796af23b";
+};
+//# sourceMappingURL=receipt-authorization.d.ts.map

package/dist/receipt-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt-authorization.d.ts","sourceRoot":"","sources":["../src/receipt-authorization.ts"],"names":[],"mappings":"AA0BA;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;CAExB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,MAAM,OAAO,qBAAqB,CAAC;AAErE,MAAM,WAAW,eAAe;IAC9B,4EAA4E;IAC5E,MAAM,EAAE,mBAAmB,CAAC;IAC5B,qFAAqF;IACrF,KAAK,EAAE,MAAM,CAAC;IACd,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAC;CACd;AAaD,4FAA4F;AAC5F,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED,yFAAyF;AACzF,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAc7E;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtC,MAAM,WAAW,SAAS;IACxB,sFAAsF;IACtF,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,uBAAuB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,SAAS,GAAG,UAAU,CAgCxE;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;CAWd,CAAC"}

package/dist/receipt-authorization.js

@@ -0,0 +1,128 @@
+// receipt-authorization.ts — the salted commitment that ties a receipt to one settlement.
+//
+// Written against specs/extensions/extension-offer-and-receipt.md §5.6 at commit
+// 0e492d6730bef14b9c722428386c114f3475a914 of the receipt-authorization-commitment
+// branch. That PR is open, so the preimage can still change: the commit is pinned
+// here on purpose, and the test asserts the vector published with it. If the spec
+// moves, the test fails rather than the signature quietly changing meaning.
+//
+// WHY A COMMITMENT AND NOT THE TRANSACTION HASH. A receipt with an empty
+// `transaction` can be matched to a settlement only by payer, payee, amount and
+// time. Two payments with the same terms in the same block cannot be ordered at
+// all. The ERC-3009 authorization already carries a nonce that is unique per
+// settlement and that the server holds before settlement runs, so a salted hash of
+// it lets whoever holds the salt recompute the link to exactly one settlement, and
+// tells everyone else nothing.
+//
+// AND WHY IT MATTERS TO US SPECIFICALLY: §5.6.5 says a consumer that counts
+// settlements MUST count opened commitments only. A receipt whose commitment
+// nobody can open does not count. That is the category our own receipts were in.
+import { createHash, randomBytes } from "node:crypto";
+/** §5.6.2. ASCII, and the trailing /0 is the preimage version, not the payload version. */
+const DOMAIN_TAG = Buffer.from("x402-receipt-authorization/0", "ascii");
+const NUL = Buffer.from([0]);
+/**
+ * §5.6.2's table. Each method fixes the byte length of `asset` and `authorizer`;
+ * `identifier` and `salt` are 32 bytes for every method. Fixed lengths are what
+ * make the preimage unambiguous without any separators, so they are enforced
+ * rather than assumed: a field of the wrong length would hash to a commitment
+ * that opens to nothing, and would do so silently.
+ */
+export const AUTHORIZATION_METHODS = {
+    eip3009: { asset: 20, authorizer: 20 },
+};
+function fixedBytes(value, name, expected) {
+    if (typeof value !== "string")
+        throw new Error(`${name} must be a hex string`);
+    const hex = value.startsWith("0x") || value.startsWith("0X") ? value.slice(2) : value;
+    if (!/^[0-9a-fA-F]*$/.test(hex))
+        throw new Error(`${name} is not hex: ${JSON.stringify(value)}`);
+    const buf = Buffer.from(hex, "hex");
+    if (buf.length !== expected) {
+        throw new Error(`${name} must be ${expected} bytes per section 5.6.2, got ${buf.length}`);
+    }
+    return buf;
+}
+/** §5.6.3: 32 bytes from a CSPRNG, independent per payment, never derived from anything. */
+export function generateAuthorizationSalt() {
+    return "0x" + randomBytes(32).toString("hex");
+}
+/** §5.6.2, the whole construction. Hex inputs are case-insensitive; bytes are hashed. */
+export function computeAuthorizationCommitment(input) {
+    const lengths = AUTHORIZATION_METHODS[input.method];
+    if (!lengths)
+        throw new Error(`unknown authorizationMethod: ${String(input.method)}`);
+    const preimage = Buffer.concat([
+        DOMAIN_TAG,
+        NUL,
+        Buffer.from(input.method, "ascii"),
+        NUL,
+        fixedBytes(input.asset, "asset", lengths.asset),
+        fixedBytes(input.authorizer, "authorizer", lengths.authorizer),
+        fixedBytes(input.identifier, "identifier", 32),
+        fixedBytes(input.salt, "salt", 32),
+    ]);
+    return "0x" + createHash("sha256").update(preimage).digest("hex");
+}
+/**
+ * §5.6.4 steps 1 and 3. Fails closed on both nothing and ambiguity.
+ *
+ * Two matches is not "probably the first one": if an identifier can repeat across
+ * settlements the commitment genuinely opens to several, and the spec says that
+ * case does not link. Reporting a guess there would turn a fail-closed design into
+ * a false link, which is the one outcome the whole construction exists to avoid.
+ */
+export function openAuthorizationCommitment(input) {
+    const { payload, salt, asset, candidateIdentifiers } = input;
+    const method = payload?.authorizationMethod;
+    const commitment = payload?.authorizationCommitment;
+    if (!method || !commitment)
+        return { linked: false, reason: "receipt carries no commitment" };
+    if (!(method in AUTHORIZATION_METHODS)) {
+        return { linked: false, reason: `unknown authorizationMethod: ${method}` };
+    }
+    const hits = [];
+    for (const identifier of candidateIdentifiers ?? []) {
+        let computed;
+        try {
+            computed = computeAuthorizationCommitment({
+                method: method,
+                asset,
+                // §5.6.4 step 1: the authorizer comes from the SIGNED payer field, never
+                // from a value handed over next to the salt. Otherwise a commitment can be
+                // opened against someone else's settlement.
+                authorizer: payload.payer,
+                identifier,
+                salt,
+            });
+        }
+        catch {
+            continue;
+        }
+        if (computed.toLowerCase() === String(commitment).toLowerCase())
+            hits.push(identifier);
+    }
+    if (hits.length === 1)
+        return { linked: true, identifier: hits[0] };
+    if (hits.length === 0)
+        return { linked: false, reason: "no candidate opens this commitment" };
+    return { linked: false, reason: `${hits.length} candidates open the same commitment, ambiguous` };
+}
+/**
+ * The vector published with the spec, kept here so our own test has an external
+ * anchor. The independent verifier in agent-receipt-verify asserts the same
+ * constant from its own implementation: two implementations anchored to the same
+ * published number cannot drift silently, two anchored to each other can.
+ */
+export const SPEC_VECTOR = {
+    source: "x402-foundation/x402 PR #3827, specs/extensions/extension-offer-and-receipt.md §5.6.2, commit 0e492d6730bef14b9c722428386c114f3475a914",
+    input: {
+        method: "eip3009",
+        asset: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
+        authorizer: "0x857b06519E91e3A54538791bDbb0E22373e36b66",
+        identifier: "0x5135a00b531830a13a751f3c48944d7a5fdfde7a3b87f73493591cd77efdef4f",
+        salt: "0x10d2ae5f0c8536e82d882bf3d2c31a663597e890ca6c3fede0d278fd2a78f655",
+    },
+    expected: "0x5d905bbf08a97e04ab551d276d8e94b1abaff7d0737324d360e983c2796af23b",
+};
+//# sourceMappingURL=receipt-authorization.js.map

package/dist/receipt-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt-authorization.js","sourceRoot":"","sources":["../src/receipt-authorization.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,EAAE;AACF,iFAAiF;AACjF,mFAAmF;AACnF,kFAAkF;AAClF,kFAAkF;AAClF,4EAA4E;AAC5E,EAAE;AACF,yEAAyE;AACzE,gFAAgF;AAChF,gFAAgF;AAChF,6EAA6E;AAC7E,mFAAmF;AACnF,mFAAmF;AACnF,+BAA+B;AAC/B,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,iFAAiF;AAEjF,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,2FAA2F;AAC3F,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,OAAO,CAAC,CAAC;AACxE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;CAC9B,CAAC;AAiBX,SAAS,UAAU,CAAC,KAAa,EAAE,IAAY,EAAE,QAAgB;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACtF,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,gBAAgB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjG,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,YAAY,QAAQ,iCAAiC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,yBAAyB;IACvC,OAAO,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,8BAA8B,CAAC,KAAsB;IACnE,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,UAAU;QACV,GAAG;QACH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC;QAClC,GAAG;QACH,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC;QAC/C,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC;QAC9D,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,EAAE,CAAC;QAC9C,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;KACnC,CAAC,CAAC;IACH,OAAO,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAgBD;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAgB;IAC1D,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,oBAAoB,EAAE,GAAG,KAAK,CAAC;IAC7D,MAAM,MAAM,GAAG,OAAO,EAAE,mBAAmB,CAAC;IAC5C,MAAM,UAAU,GAAG,OAAO,EAAE,uBAAuB,CAAC;IACpD,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IAC9F,IAAI,CAAC,CAAC,MAAM,IAAI,qBAAqB,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,MAAM,EAAE,EAAE,CAAC;IAC7E,CAAC;IAED,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,UAAU,IAAI,oBAAoB,IAAI,EAAE,EAAE,CAAC;QACpD,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,8BAA8B,CAAC;gBACxC,MAAM,EAAE,MAA6B;gBACrC,KAAK;gBACL,yEAAyE;gBACzE,2EAA2E;gBAC3E,4CAA4C;gBAC5C,UAAU,EAAE,OAAO,CAAC,KAAK;gBACzB,UAAU;gBACV,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzF,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,CAAC;IACrE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;IAC9F,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,iDAAiD,EAAE,CAAC;AACpG,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,MAAM,EACJ,wIAAwI;IAC1I,KAAK,EAAE;QACL,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,4CAA4C;QACnD,UAAU,EAAE,4CAA4C;QACxD,UAAU,EAAE,oEAAoE;QAChF,IAAI,EAAE,oEAAoE;KAC3E;IACD,QAAQ,EAAE,oEAAoE;CACtE,CAAC"}

package/dist/receipt-check.d.ts

@@ -0,0 +1,58 @@
+/** Fields the caller extracted from a receipt payload. Every one is optional: a comparison is skipped rather than guessed. */
+export interface ReceiptFields {
+    /** The paying party, per the receipt. Compared case-insensitively against the claim's buyerAddress. */
+    payer?: string;
+    /** The settlement this receipt is about. Compared case-insensitively against the claim's settlementRef. */
+    transaction?: string;
+    /**
+     * When the seller issued the receipt. The x402 offer-and-receipt extension defines this as a
+     * unix timestamp in SECONDS (§5.2), which is why a number is accepted and treated as such.
+     * A string is accepted too, parsed as a date, because a caller may already have normalised it.
+     * A receipt issued after the buyer's claim is a disagreement about ordering.
+     */
+    issuedAt?: string | number;
+}
+export interface ClaimSide {
+    buyerAddress: string;
+    settlementRef: string;
+    timestamp: string;
+    offerReceiptHash?: string | undefined;
+}
+export type BindingResult = {
+    bound: true;
+    digest: string;
+} | {
+    bound: false;
+    reason: "claim_names_no_receipt";
+    digest: string;
+} | {
+    bound: false;
+    reason: "digest_mismatch";
+    digest: string;
+    named: string;
+};
+/** sha256 of the artifact exactly as given, lower-case hex, no prefix. No normalisation of any kind. */
+export declare function receiptDigest(artifact: string | Uint8Array): string;
+/** Does this claim actually name this artifact? Recomputes the digest rather than trusting the field. */
+export declare function checkReceiptBinding(claim: ClaimSide, artifact: string | Uint8Array): BindingResult;
+export interface Disagreement {
+    field: "payer" | "transaction" | "issuedAt";
+    claim: string;
+    receipt: string;
+    note: string;
+}
+export interface ComparisonResult {
+    /** True only when at least one field was comparable and none disagreed. */
+    agrees: boolean;
+    /** Fields present on both sides that tell different stories. */
+    disagreements: Disagreement[];
+    /** Fields that could not be compared because the receipt side was absent. Never counted as agreement. */
+    notCompared: Array<"payer" | "transaction" | "issuedAt">;
+}
+/**
+ * Compare the two accounts field by field. Only fields both sides describe are
+ * compared; a missing receipt field is reported as not compared, never as
+ * agreement.
+ */
+export declare function compareClaimToReceipt(claim: ClaimSide, receipt: ReceiptFields): ComparisonResult;
+//# sourceMappingURL=receipt-check.d.ts.map

package/dist/receipt-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt-check.d.ts","sourceRoot":"","sources":["../src/receipt-check.ts"],"names":[],"mappings":"AAwBA,8HAA8H;AAC9H,MAAM,WAAW,aAAa;IAC5B,uGAAuG;IACvG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2GAA2G;IAC3G,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,wBAAwB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClE;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/E,wGAAwG;AACxG,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAEnE;AAED,yGAAyG;AACzG,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,aAAa,CAOlG;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,OAAO,GAAG,aAAa,GAAG,UAAU,CAAC;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,MAAM,EAAE,OAAO,CAAC;IAChB,gEAAgE;IAChE,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B,yGAAyG;IACzG,WAAW,EAAE,KAAK,CAAC,OAAO,GAAG,aAAa,GAAG,UAAU,CAAC,CAAC;CAC1D;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,GAAG,gBAAgB,CA6ChG"}

package/dist/receipt-check.js

@@ -0,0 +1,88 @@
+// receipt-check.ts — compute whether a buyer's claim and the seller's receipt
+// it names actually agree.
+//
+// The claim already carries `offerReceiptHash`, the sha256 of the seller's
+// x402 offer-receipt artifact exactly as transmitted. That binds the two halves
+// by name. It does not say whether they tell the same story: nothing here or
+// anywhere else recomputed the digest against a real artifact, or compared the
+// fields the two sides both describe. Until it does, a contradiction between a
+// buyer's account and the seller's own receipt stays a matter of reading rather
+// than of arithmetic.
+//
+// Deliberately NOT in here: any verdict about who is right. A disagreement is
+// reported as a disagreement. Adjudication belongs to whatever protocol the
+// claim's `externalRefs.disputeContext` names, exactly as that field already
+// states.
+//
+// The receipt is never re-canonicalised, parsed, or re-serialised by us. The
+// caller passes the raw artifact for the digest, and separately passes whatever
+// fields it extracted with its own x402 tooling. That split is the point: this
+// module cannot silently disagree with the spec about wire shape, because it
+// never interprets the wire shape.
+import { createHash } from "node:crypto";
+/** sha256 of the artifact exactly as given, lower-case hex, no prefix. No normalisation of any kind. */
+export function receiptDigest(artifact) {
+    return createHash("sha256").update(artifact).digest("hex");
+}
+/** Does this claim actually name this artifact? Recomputes the digest rather than trusting the field. */
+export function checkReceiptBinding(claim, artifact) {
+    const digest = receiptDigest(artifact);
+    if (claim.offerReceiptHash === undefined)
+        return { bound: false, reason: "claim_names_no_receipt", digest };
+    if (claim.offerReceiptHash !== digest) {
+        return { bound: false, reason: "digest_mismatch", digest, named: claim.offerReceiptHash };
+    }
+    return { bound: true, digest };
+}
+/**
+ * Compare the two accounts field by field. Only fields both sides describe are
+ * compared; a missing receipt field is reported as not compared, never as
+ * agreement.
+ */
+export function compareClaimToReceipt(claim, receipt) {
+    const disagreements = [];
+    const notCompared = [];
+    if (receipt.payer === undefined) {
+        notCompared.push("payer");
+    }
+    else if (receipt.payer.toLowerCase() !== claim.buyerAddress.toLowerCase()) {
+        disagreements.push({
+            field: "payer",
+            claim: claim.buyerAddress,
+            receipt: receipt.payer,
+            note: "the receipt names a different paying party than the claim was signed for",
+        });
+    }
+    if (receipt.transaction === undefined) {
+        notCompared.push("transaction");
+    }
+    else if (receipt.transaction.toLowerCase() !== claim.settlementRef.toLowerCase()) {
+        disagreements.push({
+            field: "transaction",
+            claim: claim.settlementRef,
+            receipt: receipt.transaction,
+            note: "the two halves are about different settlements",
+        });
+    }
+    if (receipt.issuedAt === undefined) {
+        notCompared.push("issuedAt");
+    }
+    else {
+        const r = typeof receipt.issuedAt === "number" ? receipt.issuedAt * 1000 : Date.parse(receipt.issuedAt);
+        const c = Date.parse(claim.timestamp);
+        if (!Number.isFinite(r) || Number.isNaN(c)) {
+            notCompared.push("issuedAt");
+        }
+        else if (r > c) {
+            disagreements.push({
+                field: "issuedAt",
+                claim: claim.timestamp,
+                receipt: String(receipt.issuedAt),
+                note: "the seller issued the receipt after the buyer signed the claim about it",
+            });
+        }
+    }
+    const compared = 3 - notCompared.length;
+    return { agrees: compared > 0 && disagreements.length === 0, disagreements, notCompared };
+}
+//# sourceMappingURL=receipt-check.js.map

package/dist/receipt-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt-check.js","sourceRoot":"","sources":["../src/receipt-check.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,2BAA2B;AAC3B,EAAE;AACF,2EAA2E;AAC3E,gFAAgF;AAChF,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,sBAAsB;AACtB,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,UAAU;AACV,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,+EAA+E;AAC/E,6EAA6E;AAC7E,mCAAmC;AAEnC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA6BzC,wGAAwG;AACxG,MAAM,UAAU,aAAa,CAAC,QAA6B;IACzD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,mBAAmB,CAAC,KAAgB,EAAE,QAA6B;IACjF,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,EAAE,CAAC;IAC5G,IAAI,KAAK,CAAC,gBAAgB,KAAK,MAAM,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC;IAC5F,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACjC,CAAC;AAkBD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAgB,EAAE,OAAsB;IAC5E,MAAM,aAAa,GAAmB,EAAE,CAAC;IACzC,MAAM,WAAW,GAAoC,EAAE,CAAC;IAExD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;SAAM,IAAI,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;QAC5E,aAAa,CAAC,IAAI,CAAC;YACjB,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,KAAK,CAAC,YAAY;YACzB,OAAO,EAAE,OAAO,CAAC,KAAK;YACtB,IAAI,EAAE,0EAA0E;SACjF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtC,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAClC,CAAC;SAAM,IAAI,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;QACnF,aAAa,CAAC,IAAI,CAAC;YACjB,KAAK,EAAE,aAAa;YACpB,KAAK,EAAE,KAAK,CAAC,aAAa;YAC1B,OAAO,EAAE,OAAO,CAAC,WAAW;YAC5B,IAAI,EAAE,gDAAgD;SACvD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxG,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/B,CAAC;aAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjB,aAAa,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,UAAU;gBACjB,KAAK,EAAE,KAAK,CAAC,SAAS;gBACtB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACjC,IAAI,EAAE,yEAAyE;aAChF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC;IACxC,OAAO,EAAE,MAAM,EAAE,QAAQ,GAAG,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC;AAC5F,CAAC"}