chit402-verify 0.3.4 → 0.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (108) hide show
  1. package/LICENSE +201 -201
  2. package/README.md +270 -82
  3. package/dist/anchor-trust.d.ts +144 -0
  4. package/dist/anchor-trust.d.ts.map +1 -0
  5. package/dist/anchor-trust.js +441 -0
  6. package/dist/anchor-trust.js.map +1 -0
  7. package/dist/anchor-witness.d.ts +265 -0
  8. package/dist/anchor-witness.d.ts.map +1 -0
  9. package/dist/anchor-witness.js +833 -0
  10. package/dist/anchor-witness.js.map +1 -0
  11. package/dist/base-payer.d.ts +65 -0
  12. package/dist/base-payer.d.ts.map +1 -0
  13. package/dist/base-payer.js +222 -0
  14. package/dist/base-payer.js.map +1 -0
  15. package/dist/binding.d.ts +52 -0
  16. package/dist/binding.d.ts.map +1 -0
  17. package/dist/binding.js +80 -0
  18. package/dist/binding.js.map +1 -0
  19. package/dist/canonical-preimage.d.ts +9 -0
  20. package/dist/canonical-preimage.d.ts.map +1 -0
  21. package/dist/canonical-preimage.js +25 -0
  22. package/dist/canonical-preimage.js.map +1 -0
  23. package/dist/carry-forward.d.ts +79 -0
  24. package/dist/carry-forward.d.ts.map +1 -0
  25. package/dist/carry-forward.js +184 -0
  26. package/dist/carry-forward.js.map +1 -0
  27. package/dist/cli.d.ts +18 -0
  28. package/dist/cli.d.ts.map +1 -0
  29. package/dist/cli.js +2090 -0
  30. package/dist/cli.js.map +1 -0
  31. package/dist/epoch.d.ts +143 -0
  32. package/dist/epoch.d.ts.map +1 -0
  33. package/dist/epoch.js +352 -0
  34. package/dist/epoch.js.map +1 -0
  35. package/dist/head-binding.d.ts +24 -0
  36. package/dist/head-binding.d.ts.map +1 -0
  37. package/dist/head-binding.js +61 -0
  38. package/dist/head-binding.js.map +1 -0
  39. package/dist/index.d.ts +585 -0
  40. package/dist/index.d.ts.map +1 -0
  41. package/dist/index.js +1648 -0
  42. package/dist/index.js.map +1 -0
  43. package/dist/issuer-history.d.ts +151 -0
  44. package/dist/issuer-history.d.ts.map +1 -0
  45. package/dist/issuer-history.js +595 -0
  46. package/dist/issuer-history.js.map +1 -0
  47. package/dist/issuer-pin.d.ts +126 -0
  48. package/dist/issuer-pin.d.ts.map +1 -0
  49. package/dist/issuer-pin.js +567 -0
  50. package/dist/issuer-pin.js.map +1 -0
  51. package/dist/jcs.d.ts +8 -0
  52. package/dist/jcs.d.ts.map +1 -0
  53. package/dist/jcs.js +64 -0
  54. package/dist/jcs.js.map +1 -0
  55. package/dist/jws.d.ts +46 -0
  56. package/dist/jws.d.ts.map +1 -0
  57. package/dist/jws.js +129 -0
  58. package/dist/jws.js.map +1 -0
  59. package/dist/payer.d.ts +65 -0
  60. package/dist/payer.d.ts.map +1 -0
  61. package/dist/payer.js +148 -0
  62. package/dist/payer.js.map +1 -0
  63. package/dist/preimage.d.ts +78 -0
  64. package/dist/preimage.d.ts.map +1 -0
  65. package/dist/preimage.js +363 -0
  66. package/dist/preimage.js.map +1 -0
  67. package/dist/receipt-lane.d.ts +235 -0
  68. package/dist/receipt-lane.d.ts.map +1 -0
  69. package/dist/receipt-lane.js +446 -0
  70. package/dist/receipt-lane.js.map +1 -0
  71. package/dist/receipt-version.d.ts +98 -0
  72. package/dist/receipt-version.d.ts.map +1 -0
  73. package/dist/receipt-version.js +364 -0
  74. package/dist/receipt-version.js.map +1 -0
  75. package/dist/refusal.d.ts +93 -0
  76. package/dist/refusal.d.ts.map +1 -0
  77. package/dist/refusal.js +249 -0
  78. package/dist/refusal.js.map +1 -0
  79. package/dist/request-binding.d.ts +7 -0
  80. package/dist/request-binding.d.ts.map +1 -0
  81. package/dist/request-binding.js +26 -0
  82. package/dist/request-binding.js.map +1 -0
  83. package/dist/row-hash.d.ts +22 -0
  84. package/dist/row-hash.d.ts.map +1 -0
  85. package/dist/row-hash.js +26 -0
  86. package/dist/row-hash.js.map +1 -0
  87. package/dist/shell.d.ts +65 -0
  88. package/dist/shell.d.ts.map +1 -0
  89. package/dist/shell.js +268 -0
  90. package/dist/shell.js.map +1 -0
  91. package/dist/solana-payer.d.ts +99 -0
  92. package/dist/solana-payer.d.ts.map +1 -0
  93. package/dist/solana-payer.js +258 -0
  94. package/dist/solana-payer.js.map +1 -0
  95. package/dist/v11-receipt.d.ts +23 -0
  96. package/dist/v11-receipt.d.ts.map +1 -0
  97. package/dist/v11-receipt.js +368 -0
  98. package/dist/v11-receipt.js.map +1 -0
  99. package/dist/verdict.d.ts +94 -0
  100. package/dist/verdict.d.ts.map +1 -0
  101. package/dist/verdict.js +381 -0
  102. package/dist/verdict.js.map +1 -0
  103. package/issuer-history.snapshot.json +1 -0
  104. package/package.json +70 -59
  105. package/cli.js +0 -27
  106. package/index.cjs +0 -8
  107. package/index.d.ts +0 -5
  108. package/index.js +0 -7
@@ -0,0 +1,441 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", { value: true });
3
+ exports.HEAD_TRUST_MESSAGES = exports.ANCHOR_WALLET_SOURCES_NOT_CONSULTED = exports.ANCHOR_WALLETS_JWT_TYP = exports.ANCHOR_WALLETS_SCHEMA = exports.LEGACY_HEAD_UNPINNED_SIGNER = exports.PINNED_SOLANA_ANCHOR_FEE_PAYER = exports.PINNED_BASE_ANCHOR_WALLET = void 0;
4
+ exports.headOmitsPinnedSigner = headOmitsPinnedSigner;
5
+ exports.headClaimsMatch = headClaimsMatch;
6
+ exports.verifyTreeHeadTrust = verifyTreeHeadTrust;
7
+ exports.headTrustedFromInclusion = headTrustedFromInclusion;
8
+ exports.verifyAnchorWalletDocument = verifyAnchorWalletDocument;
9
+ exports.compileAnchorWallets = compileAnchorWallets;
10
+ exports.walletListed = walletListed;
11
+ exports.sameBaseAddress = sameBaseAddress;
12
+ /**
13
+ * Bind an anchored tree head to the issuer.
14
+ *
15
+ * Anchor mode trusts a head only when its ES256 `issuer_signature` verifies
16
+ * under the same rules as a receipt: a JWKS key matched by kid, an embedded
17
+ * key whose RFC 7638 thumbprint is a pinned kid, or a kid in a verified
18
+ * issuer-history document. The signed payload must match the outer fields
19
+ * the anchor check uses.
20
+ *
21
+ * The Base sender and the Solana fee payer in that payload must be on the
22
+ * issuer's anchor-wallet list, and the transactions the RPC returns must
23
+ * have been sent by those wallets.
24
+ *
25
+ * The list is the package pin, plus wallets inside a verified
26
+ * `chit402.anchor_wallets.v1` document or a verified issuer-history
27
+ * payload's `anchor_wallets`. Two later sources are named and not read:
28
+ * the Base `ChitIssuerRoot` registry (draft #485) and the DNS TXT at
29
+ * `_issuer.chit402.com`. This module does not embed a registry address
30
+ * and does not resolve DNS.
31
+ */
32
+ const jws_js_1 = require("./jws.js");
33
+ const issuer_history_js_1 = require("./issuer-history.js");
34
+ /** Confirmed sender of Base tx 0x1d8d7ea255170c8d4b87bef9382e13555dded2072fd877ce35f995f1ab54ee09. */
35
+ exports.PINNED_BASE_ANCHOR_WALLET = '0x1844D1F5FE42aff1Cce6F776514Fd40374079582';
36
+ /** Fee payer of Solana memo 61RHMsPPseUc35v5oxDEtANEDCvXk5fmxZdrFDMknGWc5m7U8YhMfz4En1eFFj3z9n67ZtMiha1zkwnneL2LUiXk. */
37
+ exports.PINNED_SOLANA_ANCHOR_FEE_PAYER = 'BHTnbPu6UZ7zQZ7Qpkpz4LcUQbMN73YDsMtvaNXpEioD';
38
+ /** A head signed before `anchors.base.from` and `anchors.solana.fee_payer` existed. Never VERIFIED. */
39
+ exports.LEGACY_HEAD_UNPINNED_SIGNER = 'LEGACY_HEAD_UNPINNED_SIGNER';
40
+ exports.ANCHOR_WALLETS_SCHEMA = 'chit402.anchor_wallets.v1';
41
+ exports.ANCHOR_WALLETS_JWT_TYP = 'chit402-anchor-wallets+jwt';
42
+ /** Sources this version does not query. A later build can fill the same list. */
43
+ exports.ANCHOR_WALLET_SOURCES_NOT_CONSULTED = ['issuer_root', 'dns'];
44
+ exports.HEAD_TRUST_MESSAGES = {
45
+ head_signature_missing: 'Tree head has no issuer_signature. Anchor mode requires a valid ES256 signature from a trusted issuer key.',
46
+ head_signature_invalid: 'Tree head issuer_signature is not a valid ES256 signature.',
47
+ head_key_untrusted: 'Tree head kid is not trusted. Trust is the production pin, a verified issuer-history entry, or a JWKS key matched by kid.',
48
+ head_claims_mismatch: 'Signed tree head does not match the root, size, epoch, or anchors on the head.',
49
+ head_kid_window: 'Tree head kid is outside its issuer-history window.',
50
+ published_at_missing: 'Tree head has no published_at. The kid is revoked or has not_after, so the window cannot be checked.',
51
+ issuer_history_invalid: 'Issuer history did not verify, so the tree head key was not trusted from it.',
52
+ anchor_wallets_invalid: 'Issuer anchor-wallet list did not verify.',
53
+ anchor_sender_missing: 'Signed head does not name anchors.base.from. An anchored Base transaction must name its sender.',
54
+ fee_payer_missing: 'Signed head does not name anchors.solana.fee_payer. An anchored Solana memo must name its fee payer.',
55
+ LEGACY_HEAD_UNPINNED_SIGNER: 'This tree head was signed before anchor signer pinning. It does not name the Base sender or the Solana fee payer. Use a newer head.',
56
+ anchor_sender_unlisted: 'Base anchor wallet is not on the issuer anchor-wallet list.',
57
+ fee_payer_unlisted: 'Solana fee payer is not on the issuer anchor-wallet list.',
58
+ sender_mismatch: 'Base transaction sender does not match the signed anchor wallet.',
59
+ fee_payer_mismatch: 'Solana fee payer does not match the signed fee payer.',
60
+ };
61
+ function jwksCandidates(jwks, kid) {
62
+ const keys = jwks?.keys || [];
63
+ const es256 = keys.filter((key) => (0, jws_js_1.isEs256PublicJwk)(key) && (key.alg == null || key.alg === 'ES256'));
64
+ if (!kid)
65
+ return es256;
66
+ return es256.filter((key) => key.kid === kid);
67
+ }
68
+ function decodePayload(jws) {
69
+ const part = jws.split('.')[1];
70
+ if (!part)
71
+ return null;
72
+ try {
73
+ return JSON.parse(Buffer.from(part, 'base64url').toString('utf8'));
74
+ }
75
+ catch {
76
+ return null;
77
+ }
78
+ }
79
+ /**
80
+ * Same ES256 trust order as `verifyIssuerSignatureWithJwks` for a compact JWS:
81
+ * JWKS by kid, then an embedded key whose thumbprint is a pinned kid.
82
+ */
83
+ function trustCompactJws(jws, embedded, jwks, trustedKids) {
84
+ const header = (0, jws_js_1.readJwsHeader)(jws);
85
+ const kid = header?.kid || embedded?.kid || null;
86
+ const fromJwks = jwksCandidates(jwks, kid || undefined);
87
+ for (const key of fromJwks) {
88
+ const verified = (0, jws_js_1.verifyIssuerJws)(jws, key);
89
+ if (verified.valid && verified.payload) {
90
+ return { ok: true, trust: 'jwks', kid: key.kid || kid, payload: verified.payload, reason: '' };
91
+ }
92
+ }
93
+ const pinned = !!(embedded && (0, jws_js_1.isPinnedTrustedJwk)(embedded, trustedKids));
94
+ if (pinned && embedded) {
95
+ const verified = (0, jws_js_1.verifyIssuerJws)(jws, embedded);
96
+ if (verified.valid && verified.payload) {
97
+ return {
98
+ ok: true,
99
+ trust: 'pinned_kid',
100
+ kid: embedded.kid || (0, jws_js_1.jwkThumbprint)(embedded),
101
+ payload: verified.payload,
102
+ reason: '',
103
+ };
104
+ }
105
+ return { ok: false, trust: 'pinned_kid', kid, payload: null, reason: verified.reason || 'head_signature_invalid' };
106
+ }
107
+ if (embedded && (0, jws_js_1.verifyIssuerJws)(jws, embedded).valid) {
108
+ return { ok: false, trust: null, kid: embedded.kid || kid, payload: null, reason: jws_js_1.KEY_UNTRUSTED };
109
+ }
110
+ if (fromJwks.length === 0 && !pinned) {
111
+ return { ok: false, trust: null, kid, payload: null, reason: jws_js_1.KEY_UNTRUSTED };
112
+ }
113
+ return { ok: false, trust: null, kid, payload: null, reason: 'head_signature_invalid' };
114
+ }
115
+ function historyEntryMatches(entry, kid) {
116
+ if (entry.kid === kid)
117
+ return true;
118
+ return Boolean(entry.jwk && (0, jws_js_1.isEs256PublicJwk)(entry.jwk) && (0, jws_js_1.jwkThumbprint)(entry.jwk) === kid);
119
+ }
120
+ function historyEntryKey(doc, kid) {
121
+ if (!kid)
122
+ return null;
123
+ for (const entry of doc.entries || []) {
124
+ if (!entry?.jwk || !(0, jws_js_1.isEs256PublicJwk)(entry.jwk))
125
+ continue;
126
+ if (historyEntryMatches(entry, kid))
127
+ return entry.jwk;
128
+ }
129
+ return null;
130
+ }
131
+ function historyEntriesForKid(doc, kid) {
132
+ return (doc.entries || []).filter((entry) => entry && historyEntryMatches(entry, kid));
133
+ }
134
+ function stable(value) {
135
+ if (Array.isArray(value))
136
+ return `[${value.map((item) => stable(item)).join(',')}]`;
137
+ if (value && typeof value === 'object') {
138
+ const obj = value;
139
+ const keys = Object.keys(obj).sort();
140
+ return `{${keys.map((key) => `${JSON.stringify(key)}:${stable(obj[key])}`).join(',')}}`;
141
+ }
142
+ return JSON.stringify(value ?? null);
143
+ }
144
+ function normalizeRoot(root) {
145
+ const hex = String(root || '').replace(/^0x/, '').toLowerCase();
146
+ return /^[0-9a-f]{64}$/.test(hex) ? hex : null;
147
+ }
148
+ const MATCHED_FIELDS = [
149
+ 'schema',
150
+ 'payload_version',
151
+ 'tree_size',
152
+ 'epoch',
153
+ 'prev_epoch_root',
154
+ 'prev_epoch_size',
155
+ 'published_at',
156
+ 'anchors',
157
+ ];
158
+ function signerNamed(value) {
159
+ return typeof value === 'string' && value.trim() !== '';
160
+ }
161
+ function anchoredSide(side, id) {
162
+ if (!side || side.status === 'pending')
163
+ return false;
164
+ return signerNamed(side[id]);
165
+ }
166
+ /**
167
+ * True when a verified head anchors a chain but the signature does not name
168
+ * that chain's signer. Those fields were added after the epoch-1 head and
169
+ * after the epoch-2 head signed at 07:43 ET on 2026-10-07. A pending side
170
+ * is not this case.
171
+ */
172
+ function headOmitsPinnedSigner(payload) {
173
+ const anchors = payload?.anchors;
174
+ if (!anchors || typeof anchors !== 'object')
175
+ return false;
176
+ const base = anchors.base;
177
+ const solana = anchors.solana;
178
+ if (anchoredSide(base, 'tx') && !signerNamed(base?.from))
179
+ return true;
180
+ if (anchoredSide(solana, 'signature') && !signerNamed(solana?.fee_payer))
181
+ return true;
182
+ return false;
183
+ }
184
+ /** Signed payload must carry the same root, size, epoch, and anchors the check uses. */
185
+ function headClaimsMatch(outer, payload) {
186
+ const outerRoot = normalizeRoot(outer.root);
187
+ const signedRoot = normalizeRoot(payload.root);
188
+ if (!outerRoot || outerRoot !== signedRoot)
189
+ return 'root';
190
+ for (const field of MATCHED_FIELDS) {
191
+ const hasPayload = Object.prototype.hasOwnProperty.call(payload, field);
192
+ const hasOuter = Object.prototype.hasOwnProperty.call(outer, field);
193
+ if (!hasPayload && !hasOuter)
194
+ continue;
195
+ if (hasPayload !== hasOuter)
196
+ return field;
197
+ const signed = payload[field];
198
+ const claimed = outer[field];
199
+ if (field === 'tree_size' || field === 'epoch' || field === 'prev_epoch_size' || field === 'payload_version') {
200
+ if (Number(signed) !== Number(claimed))
201
+ return field;
202
+ continue;
203
+ }
204
+ if (stable(signed) !== stable(claimed))
205
+ return field;
206
+ }
207
+ return null;
208
+ }
209
+ function fail(reason, detail) {
210
+ const base = exports.HEAD_TRUST_MESSAGES[reason] || reason;
211
+ return {
212
+ ok: false,
213
+ reason,
214
+ message: detail ? `${base} (${detail})` : base,
215
+ kid: null,
216
+ trust: null,
217
+ payload: null,
218
+ };
219
+ }
220
+ function verifyTreeHeadTrust(head, { jwks, trustedKids, issuerHistory = null, strictIssuerHistory = false, } = {}) {
221
+ const jws = head?.issuer_signature?.jws;
222
+ if (!jws)
223
+ return fail('head_signature_missing');
224
+ const pins = trustedKids ?? jws_js_1.DEFAULT_TRUSTED_ISSUER_KIDS;
225
+ const embedded = head?.issuer_signature?.issuer_jwk;
226
+ const direct = trustCompactJws(jws, embedded, jwks, pins);
227
+ let trust = direct.trust;
228
+ let payload = direct.payload;
229
+ let kid = direct.kid;
230
+ const historyKeys = jwks?.keys ? { keys: jwks.keys } : undefined;
231
+ let historyOk = false;
232
+ if (issuerHistory) {
233
+ const verified = (0, issuer_history_js_1.verifyIssuerHistoryDocument)(issuerHistory, { jwks: historyKeys, trustedKids: pins });
234
+ if (!verified.valid) {
235
+ return { ...fail('issuer_history_invalid', verified.reason), kid };
236
+ }
237
+ historyOk = true;
238
+ if (!payload) {
239
+ const headerKid = (0, jws_js_1.readJwsHeader)(jws)?.kid || head?.issuer_signature?.kid || null;
240
+ const entryKey = historyEntryKey(issuerHistory, headerKid);
241
+ if (entryKey) {
242
+ const checked = (0, jws_js_1.verifyIssuerJws)(jws, entryKey);
243
+ if (checked.valid && checked.payload) {
244
+ trust = 'issuer_history';
245
+ payload = checked.payload;
246
+ kid = headerKid;
247
+ }
248
+ }
249
+ }
250
+ }
251
+ else if (strictIssuerHistory) {
252
+ return { ...fail('issuer_history_invalid', 'issuer history was required and was not loaded'), kid };
253
+ }
254
+ if (!payload || !trust) {
255
+ if (direct.reason === jws_js_1.KEY_UNTRUSTED)
256
+ return { ...fail('head_key_untrusted'), kid };
257
+ return { ...fail('head_signature_invalid', direct.reason === 'head_signature_invalid' ? undefined : direct.reason), kid };
258
+ }
259
+ const mismatch = headClaimsMatch(head || {}, payload);
260
+ if (mismatch) {
261
+ return { ...fail('head_claims_mismatch', mismatch), kid, payload };
262
+ }
263
+ if (historyOk && issuerHistory && kid) {
264
+ const publishedAt = Object.prototype.hasOwnProperty.call(head || {}, 'published_at')
265
+ ? head?.published_at
266
+ : payload.published_at;
267
+ const window = headHistoryWindow(issuerHistory, kid, publishedAt);
268
+ if (!window.ok) {
269
+ const reason = window.reason === 'published_at_missing' ? 'published_at_missing' : 'head_kid_window';
270
+ const detail = reason === 'head_kid_window' ? (window.reason || undefined) : undefined;
271
+ return { ...fail(reason, detail), kid, trust, payload };
272
+ }
273
+ }
274
+ return { ok: true, reason: null, message: null, kid, trust, payload };
275
+ }
276
+ /**
277
+ * Named inclusion head. The gateway summary is `{ root, tree_size, signature }`
278
+ * and is not a tree-head document, so `headClaimsMatch` cannot run on it.
279
+ * Trust the JWS under JWKS or a pinned kid first, then use the verified
280
+ * payload as the head. A key carried on the summary is ignored unless that
281
+ * key is pinned. The summary root and size, when present, must match the payload.
282
+ * Returns null when the JWS is missing or untrusted: the caller must not
283
+ * treat the summary as a head.
284
+ */
285
+ function headTrustedFromInclusion(inclusion, { jwks, trustedKids, } = {}) {
286
+ const summary = inclusion?.head;
287
+ if (!summary || typeof summary !== 'object')
288
+ return null;
289
+ const row = summary;
290
+ const sig = typeof row.issuer_signature?.jws === 'string' ? row.issuer_signature : row.signature;
291
+ const jws = typeof sig?.jws === 'string' ? sig.jws : '';
292
+ if (jws.split('.').length !== 3)
293
+ return null;
294
+ const pins = trustedKids ?? jws_js_1.DEFAULT_TRUSTED_ISSUER_KIDS;
295
+ const embedded = sig?.issuer_jwk;
296
+ const pinnedJwk = embedded && (0, jws_js_1.isPinnedTrustedJwk)(embedded, pins) ? embedded : undefined;
297
+ const trusted = trustCompactJws(jws, pinnedJwk, jwks, pins);
298
+ if (!trusted.ok || !trusted.payload)
299
+ return null;
300
+ const payload = trusted.payload;
301
+ const summaryRoot = normalizeRoot(row.root);
302
+ const payloadRoot = normalizeRoot(payload.root);
303
+ if (summaryRoot && payloadRoot !== summaryRoot)
304
+ return null;
305
+ if (row.tree_size != null && payload.tree_size != null
306
+ && Number(row.tree_size) !== Number(payload.tree_size))
307
+ return null;
308
+ const kid = trusted.kid || (typeof sig?.kid === 'string' ? sig.kid : null);
309
+ const document = {
310
+ ...payload,
311
+ issuer_signature: {
312
+ jws,
313
+ ...(kid ? { kid } : {}),
314
+ ...(pinnedJwk ? { issuer_jwk: pinnedJwk } : {}),
315
+ },
316
+ };
317
+ if (payloadRoot)
318
+ document.root = payloadRoot;
319
+ return document;
320
+ }
321
+ /**
322
+ * A signed published_at is checked with the receipt window rules.
323
+ * v1 heads omit the field, and a closed head with no observed chain time
324
+ * signs null. That is not issued_at_missing. An active kid with an open
325
+ * window still verifies. A revoked kid, or one with not_after, fails closed
326
+ * because the missing time cannot show the head was signed inside the window.
327
+ */
328
+ function headHistoryWindow(doc, kid, publishedAt) {
329
+ const matches = historyEntriesForKid(doc, kid);
330
+ if (matches.length === 0)
331
+ return { ok: false, reason: 'kid_not_in_history' };
332
+ if (matches.length !== 1)
333
+ return { ok: false, reason: 'kid_ambiguous' };
334
+ const entry = matches[0];
335
+ const hasTime = publishedAt != null && publishedAt !== '';
336
+ if (hasTime)
337
+ return (0, issuer_history_js_1.issuerEntryWindow)(entry, publishedAt);
338
+ const notBefore = entry.not_before ? Date.parse(entry.not_before) : NaN;
339
+ if (!Number.isFinite(notBefore))
340
+ return { ok: false, reason: 'not_before_missing' };
341
+ if (notBefore > Date.now())
342
+ return { ok: false, reason: 'issued_before_not_before' };
343
+ if (entry.status === 'revoked' || entry.not_after != null) {
344
+ return { ok: false, reason: 'published_at_missing' };
345
+ }
346
+ return { ok: true, reason: null };
347
+ }
348
+ function asAddressList(value, chain) {
349
+ if (!Array.isArray(value))
350
+ return [];
351
+ const out = [];
352
+ for (const item of value) {
353
+ if (typeof item !== 'string')
354
+ continue;
355
+ if (chain === 'base') {
356
+ if (/^0x[0-9a-fA-F]{40}$/.test(item))
357
+ out.push(item);
358
+ }
359
+ else if (/^[1-9A-HJ-NP-Za-km-z]{32,44}$/.test(item)) {
360
+ out.push(item);
361
+ }
362
+ }
363
+ return out;
364
+ }
365
+ function verifyAnchorWalletDocument(doc, { jwks, trustedKids } = {}) {
366
+ const jws = doc?.issuer_signature?.jws;
367
+ if (!doc || doc.schema !== exports.ANCHOR_WALLETS_SCHEMA || !jws) {
368
+ return { ok: false, reason: 'anchor_wallets_invalid' };
369
+ }
370
+ const pins = trustedKids ?? jws_js_1.DEFAULT_TRUSTED_ISSUER_KIDS;
371
+ const trusted = trustCompactJws(jws, doc.issuer_signature?.issuer_jwk, jwks, pins);
372
+ if (!trusted.ok || !trusted.payload)
373
+ return { ok: false, reason: 'anchor_wallets_invalid' };
374
+ if (trusted.payload.schema !== exports.ANCHOR_WALLETS_SCHEMA)
375
+ return { ok: false, reason: 'anchor_wallets_invalid' };
376
+ const base = asAddressList(trusted.payload.base, 'base');
377
+ const solana = asAddressList(trusted.payload.solana, 'solana');
378
+ if (stable(base) !== stable(asAddressList(doc.base, 'base')))
379
+ return { ok: false, reason: 'anchor_wallets_invalid' };
380
+ if (stable(solana) !== stable(asAddressList(doc.solana, 'solana')))
381
+ return { ok: false, reason: 'anchor_wallets_invalid' };
382
+ return { ok: true, base, solana };
383
+ }
384
+ function walletsFromHistory(doc, jwks, trustedKids) {
385
+ if (!doc?.issuer_signature?.jws)
386
+ return null;
387
+ const verified = (0, issuer_history_js_1.verifyIssuerHistoryDocument)(doc, { jwks: jwks?.keys ? { keys: jwks.keys } : undefined, trustedKids });
388
+ if (!verified.valid)
389
+ return null;
390
+ const payload = decodePayload(doc.issuer_signature.jws);
391
+ const listed = payload?.anchor_wallets;
392
+ if (!listed || typeof listed !== 'object')
393
+ return { base: [], solana: [] };
394
+ const row = listed;
395
+ return { base: asAddressList(row.base, 'base'), solana: asAddressList(row.solana, 'solana') };
396
+ }
397
+ function unique(values, chain) {
398
+ const seen = new Set();
399
+ const out = [];
400
+ for (const value of values) {
401
+ const key = chain === 'base' ? value.toLowerCase() : value;
402
+ if (seen.has(key))
403
+ continue;
404
+ seen.add(key);
405
+ out.push(value);
406
+ }
407
+ return out;
408
+ }
409
+ function compileAnchorWallets({ jwks, trustedKids, issuerHistory = null, published = null, } = {}) {
410
+ const base = [exports.PINNED_BASE_ANCHOR_WALLET];
411
+ const solana = [exports.PINNED_SOLANA_ANCHOR_FEE_PAYER];
412
+ const sources = ['pin'];
413
+ const fromHistory = walletsFromHistory(issuerHistory, jwks, trustedKids);
414
+ if (fromHistory && (fromHistory.base.length || fromHistory.solana.length)) {
415
+ base.push(...fromHistory.base);
416
+ solana.push(...fromHistory.solana);
417
+ sources.push('issuer_history');
418
+ }
419
+ if (published) {
420
+ base.push(...published.base);
421
+ solana.push(...published.solana);
422
+ sources.push('well_known');
423
+ }
424
+ return {
425
+ base: unique(base, 'base'),
426
+ solana: unique(solana, 'solana'),
427
+ sources,
428
+ not_consulted: exports.ANCHOR_WALLET_SOURCES_NOT_CONSULTED,
429
+ };
430
+ }
431
+ function walletListed(list, value, chain) {
432
+ if (chain === 'base') {
433
+ const needle = value.toLowerCase();
434
+ return list.some((item) => item.toLowerCase() === needle);
435
+ }
436
+ return list.includes(value);
437
+ }
438
+ function sameBaseAddress(left, right) {
439
+ return left.toLowerCase() === right.toLowerCase();
440
+ }
441
+ //# sourceMappingURL=anchor-trust.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"anchor-trust.js","sourceRoot":"","sources":["../src/anchor-trust.ts"],"names":[],"mappings":";;;AAgPA,sDAWC;AAGD,0CAkBC;AAcD,kDAsEC;AAWD,4DA2CC;AA2CD,gEAiBC;AA6BD,oDA+BC;AAED,oCAMC;AAED,0CAEC;AA9hBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qCASkB;AAClB,2DAI6B;AAE7B,sGAAsG;AACzF,QAAA,yBAAyB,GAAG,4CAA4C,CAAC;AAEtF,yHAAyH;AAC5G,QAAA,8BAA8B,GAAG,8CAA8C,CAAC;AAE7F,uGAAuG;AAC1F,QAAA,2BAA2B,GAAG,6BAA6B,CAAC;AAE5D,QAAA,qBAAqB,GAAG,2BAA2B,CAAC;AACpD,QAAA,sBAAsB,GAAG,4BAA4B,CAAC;AAEnE,iFAAiF;AACpE,QAAA,mCAAmC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAU,CAAC;AAEtE,QAAA,mBAAmB,GAA2B;IACzD,sBAAsB,EAAE,4GAA4G;IACpI,sBAAsB,EAAE,4DAA4D;IACpF,kBAAkB,EAAE,2HAA2H;IAC/I,oBAAoB,EAAE,gFAAgF;IACtG,eAAe,EAAE,qDAAqD;IACtE,oBAAoB,EAAE,sGAAsG;IAC5H,sBAAsB,EAAE,8EAA8E;IACtG,sBAAsB,EAAE,2CAA2C;IACnE,qBAAqB,EAAE,iGAAiG;IACxH,iBAAiB,EAAE,sGAAsG;IACzH,2BAA2B,EAAE,qIAAqI;IAClK,sBAAsB,EAAE,6DAA6D;IACrF,kBAAkB,EAAE,2DAA2D;IAC/E,eAAe,EAAE,kEAAkE;IACnF,kBAAkB,EAAE,uDAAuD;CAC5E,CAAC;AAuDF,SAAS,cAAc,CAAC,IAA0B,EAAE,GAAuB;IACzE,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,yBAAgB,EAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC;IACtG,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC;IAChG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,GAAW,EACX,QAA8B,EAC9B,IAA0B,EAC1B,WAA8B;IAE9B,MAAM,MAAM,GAAG,IAAA,sBAAa,EAAC,GAAG,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,EAAE,GAAG,IAAI,QAAQ,EAAE,GAAG,IAAI,IAAI,CAAC;IACjD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,IAAI,SAAS,CAAC,CAAC;IACxD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAA,wBAAe,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACvC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACjG,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAA,2BAAkB,EAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IACzE,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAA,wBAAe,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAChD,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACvC,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE,YAAY;gBACnB,GAAG,EAAE,QAAQ,CAAC,GAAG,IAAI,IAAA,sBAAa,EAAC,QAAQ,CAAC;gBAC5C,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,MAAM,EAAE,EAAE;aACX,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,wBAAwB,EAAE,CAAC;IACrH,CAAC;IACD,IAAI,QAAQ,IAAI,IAAA,wBAAe,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAa,EAAE,CAAC;IACpG,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAa,EAAE,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;AAC1F,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAuC,EAAE,GAAW;IAC/E,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,IAAA,yBAAgB,EAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAA,sBAAa,EAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,eAAe,CAAC,GAA0B,EAAE,GAAkB;IACrE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,IAAA,yBAAgB,EAAC,KAAK,CAAC,GAAG,CAAC;YAAE,SAAS;QAC1D,IAAI,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,GAA0B,EAAE,GAAW;IACnE,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACpF,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1F,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IAClC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAChE,OAAO,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,MAAM,cAAc,GAAG;IACrB,QAAQ;IACR,iBAAiB;IACjB,WAAW;IACX,OAAO;IACP,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;IACd,SAAS;CACD,CAAC;AAEX,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,YAAY,CAAC,IAAsF,EAAE,EAAsB;IAClI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrD,OAAO,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB,CAAC,OAAmD;IACvF,MAAM,OAAO,GAAG,OAAO,EAAE,OAGL,CAAC;IACrB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,IAAI,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACtF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wFAAwF;AACxF,SAAgB,eAAe,CAAC,KAAuB,EAAE,OAAgC;IACvF,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC;IAC1D,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpE,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ;YAAE,SAAS;QACvC,IAAI,UAAU,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAI,KAA4C,CAAC,KAAK,CAAC,CAAC;QACrE,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,iBAAiB,IAAI,KAAK,KAAK,iBAAiB,EAAE,CAAC;YAC7G,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAC;YACrD,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,MAAe;IAC3C,MAAM,IAAI,GAAG,2BAAmB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;IACnD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM;QACN,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI;QAC9C,GAAG,EAAE,IAAI;QACT,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,SAAgB,mBAAmB,CACjC,IAAyC,EACzC,EACE,IAAI,EACJ,WAAW,EACX,aAAa,GAAG,IAAI,EACpB,mBAAmB,GAAG,KAAK,MAMzB,EAAE;IAEN,MAAM,GAAG,GAAG,IAAI,EAAE,gBAAgB,EAAE,GAAG,CAAC;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,WAAW,IAAI,oCAA2B,CAAC;IACxD,MAAM,QAAQ,GAAG,IAAI,EAAE,gBAAgB,EAAE,UAAU,CAAC;IACpD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1D,IAAI,KAAK,GAA6B,MAAM,CAAC,KAAK,CAAC;IACnD,IAAI,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC7B,IAAI,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACrB,MAAM,WAAW,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjE,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,IAAA,+CAA2B,EAAC,aAAa,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACtG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,OAAO,EAAE,GAAG,IAAI,CAAC,wBAAwB,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;QACrE,CAAC;QACD,SAAS,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,IAAA,sBAAa,EAAC,GAAG,CAAC,EAAE,GAAG,IAAI,IAAI,EAAE,gBAAgB,EAAE,GAAG,IAAI,IAAI,CAAC;YACjF,MAAM,QAAQ,GAAG,eAAe,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;YAC3D,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,IAAA,wBAAe,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAC/C,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;oBACrC,KAAK,GAAG,gBAAgB,CAAC;oBACzB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;oBAC1B,GAAG,GAAG,SAAS,CAAC;gBAClB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,mBAAmB,EAAE,CAAC;QAC/B,OAAO,EAAE,GAAG,IAAI,CAAC,wBAAwB,EAAE,gDAAgD,CAAC,EAAE,GAAG,EAAE,CAAC;IACtG,CAAC;IAED,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,MAAM,CAAC,MAAM,KAAK,sBAAa;YAAE,OAAO,EAAE,GAAG,IAAI,CAAC,oBAAoB,CAAC,EAAE,GAAG,EAAE,CAAC;QACnF,OAAO,EAAE,GAAG,IAAI,CAAC,wBAAwB,EAAE,MAAM,CAAC,MAAM,KAAK,wBAAwB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;IAC5H,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;IACtD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,GAAG,IAAI,CAAC,sBAAsB,EAAE,QAAQ,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IAED,IAAI,SAAS,IAAI,aAAa,IAAI,GAAG,EAAE,CAAC;QACtC,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,cAAc,CAAC;YAClF,CAAC,CAAC,IAAI,EAAE,YAAY;YACpB,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;QACzB,MAAM,MAAM,GAAG,iBAAiB,CAAC,aAAa,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,sBAAsB,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,iBAAiB,CAAC;YACrG,MAAM,MAAM,GAAG,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACvF,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACxE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,wBAAwB,CACtC,SAAgD,EAChD,EACE,IAAI,EACJ,WAAW,MAIT,EAAE;IAEN,MAAM,OAAO,GAAG,SAAS,EAAE,IAAI,CAAC;IAChC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,GAAG,GAAG,OAKX,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,gBAAgB,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;IACjG,MAAM,GAAG,GAAG,OAAO,GAAG,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,IAAI,GAAG,WAAW,IAAI,oCAA2B,CAAC;IACxD,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,CAAC;IACjC,MAAM,SAAS,GAAG,QAAQ,IAAI,IAAA,2BAAkB,EAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,WAAW,IAAI,WAAW,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI;WACjD,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAqB;QACjC,GAAI,OAA4B;QAChC,gBAAgB,EAAE;YAChB,GAAG;YACH,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD;KACF,CAAC;IACF,IAAI,WAAW;QAAE,QAAQ,CAAC,IAAI,GAAG,WAAW,CAAC;IAC7C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CACxB,GAA0B,EAC1B,GAAW,EACX,WAAoB;IAEpB,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC7E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACxE,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,OAAO,GAAG,WAAW,IAAI,IAAI,IAAI,WAAW,KAAK,EAAE,CAAC;IAC1D,IAAI,OAAO;QAAE,OAAO,IAAA,qCAAiB,EAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACpF,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IACrF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAwB;IAC7D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS;QACvC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;aAAM,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,0BAA0B,CACxC,GAAyI,EACzI,EAAE,IAAI,EAAE,WAAW,KAA2D,EAAE;IAEhF,MAAM,GAAG,GAAG,GAAG,EAAE,gBAAgB,EAAE,GAAG,CAAC;IACvC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,6BAAqB,IAAI,CAAC,GAAG,EAAE,CAAC;QACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,IAAI,oCAA2B,CAAC;IACxD,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,gBAAgB,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACnF,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAC5F,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,6BAAqB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAC7G,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IACrH,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAC3H,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,kBAAkB,CACzB,GAA6C,EAC7C,IAA0B,EAC1B,WAA0C;IAE1C,IAAI,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAA,+CAA2B,EAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;IACvH,IAAI,CAAC,QAAQ,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,OAAO,EAAE,cAAc,CAAC;IACvC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC3E,MAAM,GAAG,GAAG,MAA8C,CAAC;IAC3D,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;AAChG,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB,EAAE,KAAwB;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3D,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,oBAAoB,CAAC,EACnC,IAAI,EACJ,WAAW,EACX,aAAa,GAAG,IAAI,EACpB,SAAS,GAAG,IAAI,MAMd,EAAE;IACJ,MAAM,IAAI,GAAG,CAAC,iCAAyB,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,CAAC,sCAA8B,CAAC,CAAC;IAChD,MAAM,OAAO,GAAgC,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,kBAAkB,CAAC,aAAa,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IACzE,IAAI,WAAW,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;QAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC;QAChC,OAAO;QACP,aAAa,EAAE,2CAAmC;KACnD,CAAC;AACJ,CAAC;AAED,SAAgB,YAAY,CAAC,IAAuB,EAAE,KAAa,EAAE,KAAwB;IAC3F,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,SAAgB,eAAe,CAAC,IAAY,EAAE,KAAa;IACzD,OAAO,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;AACpD,CAAC"}