chit402-verify 0.3.4 → 0.4.0

package/dist/epoch.js

@@ -0,0 +1,352 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EPOCH2_OPENING_ROOT = exports.EPOCH1_SIZE2_ROOT = exports.EPOCH1_SIZE1_ROOT = exports.EPOCH1_FINAL_SIZE = exports.EPOCH1_FINAL_ROOT = exports.EPOCH1_GENESIS_DIGEST = exports.TREE_HEAD_SCHEMA_V2 = exports.TREE_HEAD_SCHEMA_V1 = void 0;
+exports.epoch1PrefixRoot = epoch1PrefixRoot;
+exports.matchEpoch1Prefix = matchEpoch1Prefix;
+exports.canonicalUnloggedRows = canonicalUnloggedRows;
+exports.unloggedListHash = unloggedListHash;
+exports.verifyUnloggedSection = verifyUnloggedSection;
+exports.unloggedIdCommitment = unloggedIdCommitment;
+exports.verifyUnloggedCommitment = verifyUnloggedCommitment;
+exports.unloggedReasonForTask = unloggedReasonForTask;
+exports.acceptTreeHeadSchema = acceptTreeHeadSchema;
+exports.verifyEpochLink = verifyEpochLink;
+exports.verifyEpochRecord = verifyEpochRecord;
+exports.verifyEpochInclusion = verifyEpochInclusion;
+/**
+ * Epoch links for the receipt log.
+ *
+ * A version 1 head has no epoch claims and still verifies.
+ * Epoch 1 inclusion proofs stay valid on their own root.
+ * A later epoch must name the previous epoch's root and size.
+ */
+const node_crypto_1 = require("node:crypto");
+const anchor_witness_js_1 = require("./anchor-witness.js");
+exports.TREE_HEAD_SCHEMA_V1 = 'chit402.tree_head.v1';
+exports.TREE_HEAD_SCHEMA_V2 = 'chit402.tree_head.v2';
+/** Historical epoch 1. A self-consistent record with any other final root is forged. */
+exports.EPOCH1_GENESIS_DIGEST = '422cceb1be77114317043b0a00bc18cba6ca9cee34144cd23875c6dcf1b47368';
+exports.EPOCH1_FINAL_ROOT = 'dd20e39a39a225b7b3441bb7f61532c06562288b74ae5dc4dda015c48312f973';
+exports.EPOCH1_FINAL_SIZE = 4;
+/** SHA-256(0x00 || genesis bytes of digest 422cceb1). Single-leaf root. */
+exports.EPOCH1_SIZE1_ROOT = '8665a0fcb74c2cfeca3a356efe18fe878cf94c21cd38da6b19a2bb57629bc35c';
+/** Anchored size-2 head. The v9 tree_head_hash on xfuel-39af100b. */
+exports.EPOCH1_SIZE2_ROOT = 'ecf9a330a9e82d45e0887807261276fad2fbfb394189bb8f7f35b0e9163c70ae';
+exports.EPOCH2_OPENING_ROOT = 'f2043ee96b6e9f678b76bb3c512b5d911293dbb2a3bf198c98252c83802f3286';
+/** Size 3 has no anchored head and the leaf preimages are not in this repo. */
+const EPOCH1_PREFIX_ROOTS = {
+    1: exports.EPOCH1_SIZE1_ROOT,
+    2: exports.EPOCH1_SIZE2_ROOT,
+    4: exports.EPOCH1_FINAL_ROOT,
+};
+function epoch1PrefixRoot(treeSize) {
+    return EPOCH1_PREFIX_ROOTS[Number(treeSize)] || null;
+}
+function matchEpoch1Prefix(treeSize, root) {
+    const want = epoch1PrefixRoot(treeSize);
+    const got = String(root || '').replace(/^0x/, '').toLowerCase();
+    if (!want || got !== want)
+        return { ok: false, reason: 'epoch1_prefix' };
+    return { ok: true };
+}
+function isGenuineV1Head(head) {
+    if (!head)
+        return false;
+    if (head.schema === exports.TREE_HEAD_SCHEMA_V2 || Number(head.payload_version) === 2)
+        return false;
+    return head.schema === exports.TREE_HEAD_SCHEMA_V1 || Number(head.payload_version) === 1;
+}
+const ORPHAN_GENESIS_ONLY = '20d887917a4c32a49434e4b8f8db864cbf26a8e3a0daa6f5f89ab097282413f9';
+const ORPHAN_FF950E72 = 'ff950e7204762565751e1c7a6bfbdb167c15452f26259a97f63a2c90b2f61ec3';
+const UNLOGGED_REASONS = new Set(['missing_row_hash', 'forked', 'depends_on_refused']);
+function canonicalUnloggedRows(rows) {
+    return (Array.isArray(rows) ? rows : []).map((row) => ({
+        task_id: String(row?.task_id || ''),
+        agent_id: row?.agent_id == null || row.agent_id === '' ? null : Number(row.agent_id),
+        reason: String(row?.reason || ''),
+    }));
+}
+function unloggedListHash(rows) {
+    return (0, node_crypto_1.createHash)('sha256').update(JSON.stringify(rows)).digest('hex');
+}
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function verifyUnloggedSection(section) {
+    // `in` throws on a string, a number, or a boolean. A hostile value fails closed.
+    if (!isPlainObject(section) || !('rows' in section) || !Array.isArray(section.rows)) {
+        return { ok: false, reason: 'unlogged_missing' };
+    }
+    const list = canonicalUnloggedRows(section.rows);
+    if (JSON.stringify(list) !== JSON.stringify(section.rows))
+        return { ok: false, reason: 'unlogged_canonical' };
+    for (const row of list) {
+        if (!row.task_id)
+            return { ok: false, reason: 'unlogged_task' };
+        if (!UNLOGGED_REASONS.has(row.reason))
+            return { ok: false, reason: 'unlogged_reason' };
+    }
+    if (Number(section.count) !== list.length)
+        return { ok: false, reason: 'unlogged_count' };
+    if (section.hash !== unloggedListHash(list))
+        return { ok: false, reason: 'unlogged_hash' };
+    return { ok: true };
+}
+/**
+ * SHA-256 of `{"count":N,"ids":[...]}`. Ids are unique and sorted by UTF-16
+ * code unit. The same bytes the gateway signs into a version 3 epoch record.
+ */
+function unloggedIdCommitment(rows) {
+    const ids = [];
+    const seen = new Set();
+    for (const row of Array.isArray(rows) ? rows : []) {
+        const id = String(typeof row === 'string' ? row : (row?.task_id || ''));
+        if (!id || seen.has(id))
+            continue;
+        seen.add(id);
+        ids.push(id);
+    }
+    ids.sort();
+    const count = ids.length;
+    const commitment = (0, node_crypto_1.createHash)('sha256').update(JSON.stringify({ count, ids })).digest('hex');
+    return { count, commitment };
+}
+/**
+ * Version 3 shape. Extra keys are a disclosure. Pass `ids` to recompute
+ * the digest; without them only the shape is checked.
+ */
+function verifyUnloggedCommitment(section, ids) {
+    if (!section || typeof section !== 'object' || Array.isArray(section)) {
+        return { ok: false, reason: 'unlogged_missing' };
+    }
+    for (const key of Object.keys(section)) {
+        if (key !== 'count' && key !== 'commitment')
+            return { ok: false, reason: 'unlogged_disclosed' };
+    }
+    const commitment = section.commitment;
+    const count = section.count;
+    if (!Number.isInteger(count) || count < 0)
+        return { ok: false, reason: 'unlogged_count' };
+    if (typeof commitment !== 'string' || !/^[0-9a-f]{64}$/.test(commitment)) {
+        return { ok: false, reason: 'unlogged_commitment' };
+    }
+    if (ids != null) {
+        const expect = unloggedIdCommitment(ids);
+        if (expect.count !== count || expect.commitment !== commitment) {
+            return { ok: false, reason: 'unlogged_commitment' };
+        }
+    }
+    return { ok: true };
+}
+/**
+ * Reason for a task a version 2 record attested as outside the tree.
+ * Null when the list does not verify. A version 3 commitment has no reason.
+ */
+function unloggedReasonForTask(record, taskId) {
+    if (Number(record?.payload_version) !== 2)
+        return null;
+    const section = record?.unlogged;
+    if (!isPlainObject(section) || !('rows' in section) || !Array.isArray(section.rows))
+        return null;
+    const checked = verifyUnloggedSection(section);
+    if (!checked.ok)
+        return null;
+    const id = String(taskId || '');
+    const rows = section.rows;
+    return rows.find((row) => row.task_id === id) || null;
+}
+function acceptTreeHeadSchema(head) {
+    if (!head || typeof head !== 'object')
+        return { ok: false, reason: 'no_head' };
+    const schema = head.schema;
+    const version = head.payload_version;
+    if (schema == null && version == null)
+        return { ok: true };
+    if (schema === exports.TREE_HEAD_SCHEMA_V1 || schema === exports.TREE_HEAD_SCHEMA_V2 || schema == null) {
+        if (version == null || version === 1 || version === 2)
+            return { ok: true };
+    }
+    return { ok: false, reason: 'unknown_head_schema' };
+}
+/**
+ * Epoch 1 (and a head with no epoch, the v1 shape) has no predecessor.
+ * A later epoch must point at the previous epoch's root and size.
+ */
+function verifyEpochLink(head, previous) {
+    const schema = acceptTreeHeadSchema(head);
+    if (!schema.ok)
+        return schema;
+    const explicitEpoch = head?.epoch == null ? null : Number(head.epoch);
+    if (explicitEpoch == null) {
+        if (!isGenuineV1Head(head))
+            return { ok: false, reason: 'epoch_missing' };
+        if (head?.prev_epoch_root)
+            return { ok: false, reason: 'epoch1_has_prev' };
+        return { ok: true };
+    }
+    const epoch = explicitEpoch;
+    if (!Number.isInteger(epoch) || epoch < 1)
+        return { ok: false, reason: 'bad_epoch' };
+    if (epoch === 1) {
+        if (head?.prev_epoch_root)
+            return { ok: false, reason: 'epoch1_has_prev' };
+        const sizeRaw = head?.tree_size ?? head?.final_size;
+        const size = sizeRaw == null ? null : Number(sizeRaw);
+        const rootRaw = head?.root ?? head?.final_root;
+        const root = typeof rootRaw === 'string' ? rootRaw.replace(/^0x/, '').toLowerCase() : '';
+        if (size !== exports.EPOCH1_FINAL_SIZE || root !== exports.EPOCH1_FINAL_ROOT) {
+            return { ok: false, reason: 'epoch1_root' };
+        }
+        const recordShape = head?.final_size != null || head?.genesis_digest != null;
+        if (recordShape && head?.genesis_digest !== exports.EPOCH1_GENESIS_DIGEST) {
+            return { ok: false, reason: 'epoch1_genesis' };
+        }
+        return { ok: true };
+    }
+    if (!previous?.root)
+        return { ok: false, reason: 'missing_previous_epoch' };
+    if (head?.prev_epoch_root !== previous.root)
+        return { ok: false, reason: 'prev_epoch_root' };
+    if (Number(head?.prev_epoch_size) !== Number(previous.tree_size))
+        return { ok: false, reason: 'prev_epoch_size' };
+    return { ok: true };
+}
+/**
+ * Epoch 1 is pinned to dd20e39a, size 4, genesis 422cceb1.
+ * A self-consistent chain with another root does not verify.
+ * The issuer signature is required. d7f6c548 must be present, root null,
+ * and marked unrecoverable.
+ */
+function verifyEpochRecord(record, options = {}) {
+    const jws = record?.issuer_signature?.jws;
+    if (!jws)
+        return { ok: false, reason: 'epoch_signature_missing' };
+    if (typeof options.verifySignature !== 'function') {
+        return { ok: false, reason: 'epoch_signature_unverified' };
+    }
+    if (!options.verifySignature(jws))
+        return { ok: false, reason: 'epoch_signature_invalid' };
+    const epochs = record?.epochs;
+    if (!Array.isArray(epochs) || epochs.length === 0)
+        return { ok: false, reason: 'no_epochs' };
+    for (let i = 0; i < epochs.length; i += 1) {
+        const row = epochs[i];
+        if (Number(row.epoch) !== i + 1)
+            return { ok: false, reason: 'epoch_index' };
+        if (i === 0) {
+            if (row.prev_epoch_root != null)
+                return { ok: false, reason: 'epoch1_has_prev' };
+            if (Number(row.prev_epoch_size || 0) !== 0)
+                return { ok: false, reason: 'epoch1_size' };
+            continue;
+        }
+        const prev = epochs[i - 1];
+        const prevRoot = prev.final_root || prev.opening_root;
+        const prevSize = prev.final_size ?? prev.opening_size;
+        if (row.prev_epoch_root !== prevRoot)
+            return { ok: false, reason: 'prev_epoch_root' };
+        if (Number(row.prev_epoch_size) !== Number(prevSize))
+            return { ok: false, reason: 'prev_epoch_size' };
+    }
+    if (!Array.isArray(record?.orphans))
+        return { ok: false, reason: 'orphans_missing' };
+    const epoch1 = epochs.find((row) => Number(row.epoch) === 1);
+    if (!epoch1)
+        return { ok: false, reason: 'epoch1_missing' };
+    if (epoch1.final_root !== exports.EPOCH1_FINAL_ROOT || Number(epoch1.final_size) !== exports.EPOCH1_FINAL_SIZE) {
+        return { ok: false, reason: 'epoch1_root' };
+    }
+    if (epoch1.genesis_digest !== exports.EPOCH1_GENESIS_DIGEST)
+        return { ok: false, reason: 'epoch1_genesis' };
+    const epoch2 = epochs.find((row) => Number(row.epoch) === 2);
+    if (epoch2) {
+        if (epoch2.prev_epoch_root !== exports.EPOCH1_FINAL_ROOT || Number(epoch2.prev_epoch_size) !== exports.EPOCH1_FINAL_SIZE) {
+            return { ok: false, reason: 'prev_epoch_root' };
+        }
+        if (epoch2.opening_root && epoch2.opening_root !== exports.EPOCH2_OPENING_ROOT) {
+            return { ok: false, reason: 'epoch2_opening' };
+        }
+    }
+    const orphans = record.orphans;
+    const lost = orphans.find((row) => row?.root_prefix === 'd7f6c548');
+    if (!lost)
+        return { ok: false, reason: 'orphan_d7f6c548_missing' };
+    if (lost.root != null)
+        return { ok: false, reason: 'orphan_d7f6c548_root_invented' };
+    if (lost.unrecoverable !== true)
+        return { ok: false, reason: 'orphan_d7f6c548_unmarked' };
+    if (!orphans.some((row) => row?.root === ORPHAN_GENESIS_ONLY))
+        return { ok: false, reason: 'orphans_incomplete' };
+    if (!orphans.some((row) => row?.root === exports.EPOCH2_OPENING_ROOT))
+        return { ok: false, reason: 'orphans_incomplete' };
+    const version = Number(record.payload_version) || 1;
+    if (version === 1) {
+        if (record.unlogged != null)
+            return { ok: false, reason: 'unlogged_unexpected' };
+    }
+    else if (version === 2) {
+        const listed = verifyUnloggedSection(record.unlogged);
+        if (!listed.ok)
+            return listed;
+        const chains = v2OrphanChains(orphans);
+        if (!chains.ok)
+            return chains;
+    }
+    else if (version === 3) {
+        const listed = verifyUnloggedCommitment(record.unlogged);
+        if (!listed.ok)
+            return listed;
+        const chains = v2OrphanChains(orphans);
+        if (!chains.ok)
+            return chains;
+    }
+    else {
+        return { ok: false, reason: 'epoch_record_version' };
+    }
+    return { ok: true };
+}
+function v2OrphanChains(orphans) {
+    const early = orphans.find((row) => row?.root === ORPHAN_FF950E72);
+    if (!early)
+        return { ok: false, reason: 'orphan_ff950e72_missing' };
+    if (early.chain !== 'base' || early.solana !== 'absent')
+        return { ok: false, reason: 'orphan_ff950e72_chain' };
+    const genesis = orphans.find((row) => row?.root === ORPHAN_GENESIS_ONLY);
+    if (genesis?.chain !== 'base_and_solana')
+        return { ok: false, reason: 'orphan_20d88791_chain' };
+    const lost = orphans.find((row) => row?.root_prefix === 'd7f6c548');
+    if (lost?.chain !== 'base_and_solana')
+        return { ok: false, reason: 'orphan_d7f6c548_chain' };
+    return { ok: true };
+}
+/**
+ * Inclusion against the epoch the proof names. Epoch 1 proofs with no epoch
+ * field stay valid. A later epoch also has to link to the previous epoch.
+ */
+function verifyEpochInclusion(input) {
+    const epoch = input.epoch == null ? 1 : Number(input.epoch);
+    if (epoch === 1) {
+        const prefix = matchEpoch1Prefix(input.treeSize, input.root);
+        if (!prefix.ok)
+            return prefix;
+    }
+    let leaf = input.leaf ? new Uint8Array(input.leaf) : null;
+    if (!leaf && input.taskId) {
+        leaf = (0, anchor_witness_js_1.leafHash)(Buffer.from(`${input.taskId}|${input.rowHash || ''}`));
+    }
+    if (!leaf)
+        return { ok: false, reason: 'no_leaf' };
+    const included = (0, anchor_witness_js_1.verifyMerkleInclusion)(Buffer.from(leaf), input.index, input.treeSize, input.root, input.proof);
+    if (!included)
+        return { ok: false, reason: 'inclusion_failed' };
+    if (epoch === 1)
+        return { ok: true };
+    return verifyEpochLink({
+        schema: exports.TREE_HEAD_SCHEMA_V2,
+        payload_version: 2,
+        epoch,
+        prev_epoch_root: input.prevEpochRoot,
+        prev_epoch_size: input.prevEpochSize,
+    }, input.previous);
+}
+//# sourceMappingURL=epoch.js.map

package/dist/epoch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"epoch.js","sourceRoot":"","sources":["../src/epoch.ts"],"names":[],"mappings":";;;AA8BA,4CAEC;AAED,8CAKC;AAkED,sDAMC;AAED,4CAEC;AAMD,sDAcC;AAMD,oDAaC;AAMD,4DAuBC;AAMD,sDAYC;AAMD,oDASC;AAMD,0CAiCC;AAQD,8CAkEC;AAiBD,oDAiCC;AA3XD;;;;;;GAMG;AACH,6CAAyC;AACzC,2DAA0F;AAE7E,QAAA,mBAAmB,GAAG,sBAAsB,CAAC;AAC7C,QAAA,mBAAmB,GAAG,sBAAsB,CAAC;AAE1D,wFAAwF;AAC3E,QAAA,qBAAqB,GAAG,kEAAkE,CAAC;AAC3F,QAAA,iBAAiB,GAAG,kEAAkE,CAAC;AACvF,QAAA,iBAAiB,GAAG,CAAC,CAAC;AACnC,2EAA2E;AAC9D,QAAA,iBAAiB,GAAG,kEAAkE,CAAC;AACpG,qEAAqE;AACxD,QAAA,iBAAiB,GAAG,kEAAkE,CAAC;AACvF,QAAA,mBAAmB,GAAG,kEAAkE,CAAC;AAEtG,+EAA+E;AAC/E,MAAM,mBAAmB,GAA2B;IAClD,CAAC,EAAE,yBAAiB;IACpB,CAAC,EAAE,yBAAiB;IACpB,CAAC,EAAE,yBAAiB;CACrB,CAAC;AAEF,SAAgB,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC;AACvD,CAAC;AAED,SAAgB,iBAAiB,CAAC,QAAgB,EAAE,IAA+B;IACjF,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAChE,IAAI,CAAC,IAAI,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACzE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,eAAe,CAAC,IAAsC;IAC7D,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,IAAI,CAAC,MAAM,KAAK,2BAAmB,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5F,OAAO,IAAI,CAAC,MAAM,KAAK,2BAAmB,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;AACnF,CAAC;AACD,MAAM,mBAAmB,GAAG,kEAAkE,CAAC;AAC/F,MAAM,eAAe,GAAG,kEAAkE,CAAC;AAwD3F,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAEvF,SAAgB,qBAAqB,CAAC,IAAoD;IACxF,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACrD,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC;QACnC,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,IAAI,IAAK,GAAG,CAAC,QAAoB,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACjG,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,CAAC;KAClC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAgB,gBAAgB,CAAC,IAAmB;IAClD,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAAgB;IACpD,iFAAiF;IACjF,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACpF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,IAAmC,CAAC,CAAC;IAChF,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC9G,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAChE,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC1F,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,IAA6D;IAChG,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAClD,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAClC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;IACD,GAAG,CAAC,IAAI,EAAE,CAAC;IACX,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC;IACzB,MAAM,UAAU,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7F,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,SAAgB,wBAAwB,CACtC,OAAgE,EAChE,GAAqB;IAErB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,YAAY;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAClG,CAAC;IACD,MAAM,UAAU,GAAI,OAA8B,CAAC,UAAU,CAAC;IAC9D,MAAM,KAAK,GAAI,OAA8B,CAAC,KAAK,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC1F,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,SAAgB,qBAAqB,CACnC,MAAsC,EACtC,MAAiC;IAEjC,IAAI,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,EAAE,QAAQ,CAAC;IACjC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjG,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAqB,CAAC;IAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;AACxD,CAAC;AAMD,SAAgB,oBAAoB,CAAC,IAAsC;IACzE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC;IACrC,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC3D,IAAI,MAAM,KAAK,2BAAmB,IAAI,MAAM,KAAK,2BAAmB,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACvF,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC7E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAC7B,IAAsC,EACtC,QAAqE;IAErE,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC9B,MAAM,aAAa,GAAG,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtE,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAC1E,IAAI,IAAI,EAAE,eAAe;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QAC3E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACrF,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,IAAI,IAAI,EAAE,eAAe;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QAC3E,MAAM,OAAO,GAAG,IAAI,EAAE,SAAS,IAAI,IAAI,EAAE,UAAU,CAAC;QACpD,MAAM,IAAI,GAAG,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,UAAU,CAAC;QAC/C,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,IAAI,IAAI,KAAK,yBAAiB,IAAI,IAAI,KAAK,yBAAiB,EAAE,CAAC;YAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QAC9C,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,EAAE,UAAU,IAAI,IAAI,IAAI,IAAI,EAAE,cAAc,IAAI,IAAI,CAAC;QAC7E,IAAI,WAAW,IAAI,IAAI,EAAE,cAAc,KAAK,6BAAqB,EAAE,CAAC;YAClE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACjD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAC5E,IAAI,IAAI,EAAE,eAAe,KAAK,QAAQ,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC7F,IAAI,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAClH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,iBAAiB,CAC/B,MAAsC,EACtC,UAA8B,EAAE;IAEhC,MAAM,GAAG,GAAG,MAAM,EAAE,gBAAgB,EAAE,GAAG,CAAC;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAClE,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC3F,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC7F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QAC7E,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACZ,IAAI,GAAG,CAAC,eAAe,IAAI,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;YACjF,IAAI,MAAM,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YACxF,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,YAAY,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,YAAY,CAAC;QACtD,IAAI,GAAG,CAAC,eAAe,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QACtF,IAAI,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACxG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACrF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC5D,IAAI,MAAM,CAAC,UAAU,KAAK,yBAAiB,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,yBAAiB,EAAE,CAAC;QAC/F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,6BAAqB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACpG,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7D,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,MAAM,CAAC,eAAe,KAAK,yBAAiB,IAAI,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,yBAAiB,EAAE,CAAC;YACzG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QAClD,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,KAAK,2BAAmB,EAAE,CAAC;YACvE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAyF,CAAC;IACjH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,UAAU,CAAC,CAAC;IACpE,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IACnE,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IACrF,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC1F,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,mBAAmB,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAClH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,2BAAmB,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAClH,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACnF,CAAC;SAAM,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;IAChC,CAAC;SAAM,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,cAAc,CAAC,OAA+F;IACrH,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,eAAe,CAAC,CAAC;IACnE,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IACpE,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAC/G,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,mBAAmB,CAAC,CAAC;IACzE,IAAI,OAAO,EAAE,KAAK,KAAK,iBAAiB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAChG,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,UAAU,CAAC,CAAC;IACpE,IAAI,IAAI,EAAE,KAAK,KAAK,iBAAiB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAC7F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,KAYpC;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;IAChC,CAAC;IACD,IAAI,IAAI,GAAsB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,GAAG,IAAA,4BAAQ,EAAC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAA,yCAAqB,EAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAChH,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAChE,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACrC,OAAO,eAAe,CAAC;QACrB,MAAM,EAAE,2BAAmB;QAC3B,eAAe,EAAE,CAAC;QAClB,KAAK;QACL,eAAe,EAAE,KAAK,CAAC,aAAa;QACpC,eAAe,EAAE,KAAK,CAAC,aAAa;KACrC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;AACrB,CAAC"}

package/dist/head-binding.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Payload v9 binds `(tree_head_hash, tolerance)` inside the issuer JWS.
+ * v8 and earlier omit the pair and keep their current verification path.
+ *
+ * The pair is read only from claims the caller has already verified.
+ * An unsigned outer copy that disagrees fails the check. Lockstep with
+ * `services/gateway/src/receipt-head-binding.js`.
+ */
+export declare const HEAD_BINDING_PAYLOAD_VERSION = 9;
+export type HeadBindingVerdict = 'not_present_legacy' | 'missing' | 'ok';
+export interface SignedHeadBinding {
+    verdict: HeadBindingVerdict;
+    tree_head_hash: string | null;
+    tolerance: unknown;
+}
+export declare function headBindingVerdict(claims: Record<string, unknown> | null | undefined): HeadBindingVerdict;
+/** Pair from verified claims. Does not read the unsigned receipt. */
+export declare function signedHeadBinding(claims: Record<string, unknown> | null | undefined): SignedHeadBinding;
+/** Which unsigned field disagrees, or null. v8 claims are not compared. */
+export declare function outerHeadDisagrees(receipt: {
+    tree_head_hash?: unknown;
+    tolerance?: unknown;
+} | null | undefined, claims: Record<string, unknown> | null | undefined): 'tree_head_hash' | 'tolerance' | null;
+//# sourceMappingURL=head-binding.d.ts.map

package/dist/head-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"head-binding.d.ts","sourceRoot":"","sources":["../src/head-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAE9C,MAAM,MAAM,kBAAkB,GAAG,oBAAoB,GAAG,SAAS,GAAG,IAAI,CAAC;AAEzE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GACjD,kBAAkB,CASpB;AAED,qEAAqE;AACrE,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GACjD,iBAAiB,CAWnB;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAChC,OAAO,EAAE;IAAE,cAAc,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,EAC7E,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GACjD,gBAAgB,GAAG,WAAW,GAAG,IAAI,CAevC"}

package/dist/head-binding.js

@@ -0,0 +1,61 @@
+"use strict";
+/**
+ * Payload v9 binds `(tree_head_hash, tolerance)` inside the issuer JWS.
+ * v8 and earlier omit the pair and keep their current verification path.
+ *
+ * The pair is read only from claims the caller has already verified.
+ * An unsigned outer copy that disagrees fails the check. Lockstep with
+ * `services/gateway/src/receipt-head-binding.js`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HEAD_BINDING_PAYLOAD_VERSION = void 0;
+exports.headBindingVerdict = headBindingVerdict;
+exports.signedHeadBinding = signedHeadBinding;
+exports.outerHeadDisagrees = outerHeadDisagrees;
+exports.HEAD_BINDING_PAYLOAD_VERSION = 9;
+function headBindingVerdict(claims) {
+    if (!claims || typeof claims !== 'object')
+        return 'not_present_legacy';
+    const version = Number(claims.payload_version);
+    if (!Number.isFinite(version) || version < exports.HEAD_BINDING_PAYLOAD_VERSION) {
+        return 'not_present_legacy';
+    }
+    if (!Object.prototype.hasOwnProperty.call(claims, 'tree_head_hash'))
+        return 'missing';
+    if (!Object.prototype.hasOwnProperty.call(claims, 'tolerance'))
+        return 'missing';
+    return 'ok';
+}
+/** Pair from verified claims. Does not read the unsigned receipt. */
+function signedHeadBinding(claims) {
+    const verdict = headBindingVerdict(claims);
+    if (verdict !== 'ok' || !claims) {
+        return { verdict: verdict === 'ok' ? 'missing' : verdict, tree_head_hash: null, tolerance: null };
+    }
+    const hash = claims.tree_head_hash;
+    return {
+        verdict,
+        tree_head_hash: hash == null || hash === '' ? null : String(hash),
+        tolerance: claims.tolerance ?? null,
+    };
+}
+/** Which unsigned field disagrees, or null. v8 claims are not compared. */
+function outerHeadDisagrees(receipt, claims) {
+    const signed = signedHeadBinding(claims);
+    if (signed.verdict !== 'ok' || !receipt || typeof receipt !== 'object')
+        return null;
+    if (Object.prototype.hasOwnProperty.call(receipt, 'tree_head_hash')) {
+        const outer = receipt.tree_head_hash == null || receipt.tree_head_hash === ''
+            ? null
+            : String(receipt.tree_head_hash);
+        if (outer !== signed.tree_head_hash)
+            return 'tree_head_hash';
+    }
+    if (Object.prototype.hasOwnProperty.call(receipt, 'tolerance')) {
+        if (JSON.stringify(receipt.tolerance ?? null) !== JSON.stringify(signed.tolerance ?? null)) {
+            return 'tolerance';
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=head-binding.js.map

package/dist/head-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"head-binding.js","sourceRoot":"","sources":["../src/head-binding.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAYH,gDAWC;AAGD,8CAaC;AAGD,gDAkBC;AA1DY,QAAA,4BAA4B,GAAG,CAAC,CAAC;AAU9C,SAAgB,kBAAkB,CAChC,MAAkD;IAElD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,oBAAoB,CAAC;IACvE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,oCAA4B,EAAE,CAAC;QACxE,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC;QAAE,OAAO,SAAS,CAAC;IACtF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IACjF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qEAAqE;AACrE,SAAgB,iBAAiB,CAC/B,MAAkD;IAElD,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACpG,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAC;IACnC,OAAO;QACL,OAAO;QACP,cAAc,EAAE,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;QACjE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;KACpC,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAgB,kBAAkB,CAChC,OAA6E,EAC7E,MAAkD;IAElD,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpF,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,IAAI,OAAO,CAAC,cAAc,KAAK,EAAE;YAC3E,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,MAAM,CAAC,cAAc;YAAE,OAAO,gBAAgB,CAAC;IAC/D,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;QAC/D,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,EAAE,CAAC;YAC3F,OAAO,WAAW,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}