chit402-verify 0.3.5 → 0.4.1

package/dist/refusal.js

@@ -0,0 +1,249 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REFUSAL_DOES_NOT_PROVE = exports.REFUSAL_PROVES = exports.REFUSAL_PAYLOAD_VERSION = exports.REFUSAL_PAYLOAD_VERSIONS = exports.REFUSAL_SCHEMA_V2 = exports.REFUSAL_SCHEMA = void 0;
+exports.jwsPayloadSchema = jwsPayloadSchema;
+exports.isRefusalDocument = isRefusalDocument;
+exports.verifyRefusal = verifyRefusal;
+/**
+ * Offline check for a chit402.refusal.v1 document.
+ *
+ * Same ES256 issuer key and JWKS trust rules as a payment receipt.
+ * A refusal is not a payment. verifyReceipt refuses to treat one as spend.
+ */
+const jws_js_1 = require("./jws.js");
+const request_binding_js_1 = require("./request-binding.js");
+const receipt_version_js_1 = require("./receipt-version.js");
+exports.REFUSAL_SCHEMA = 'chit402.refusal.v1';
+exports.REFUSAL_SCHEMA_V2 = 'chit402.refusal.v2';
+/** Versions a verifier accepts. Version 1 has no history pin. Version 3 is refusal v2. */
+exports.REFUSAL_PAYLOAD_VERSIONS = [1, 2, 3];
+/** Current issuance version. Version 1 still verifies. */
+exports.REFUSAL_PAYLOAD_VERSION = 2;
+exports.REFUSAL_PROVES = [
+    'The issuer signed that it refused this spend.',
+    'refusal_code is the code the issuer recorded.',
+    'nonce identifies this refusal document.',
+    'chain_id and anchor are the Base observation at refusal time. status UNAVAILABLE means the issuer had no block.',
+    'When status is observed, block_number and block_hash are that block. state_root is copied only when the RPC returned one; otherwise it is null.',
+    'book_row.seq, task_id, and row_hash name the policy_blocked row this refusal joins.',
+    'charged is false and amount_charged is 0. This refusal took no USDC.',
+];
+exports.REFUSAL_DOES_NOT_PROVE = [
+    'It does not prove a payment, a settlement, or a balance change.',
+    'It does not prove the refused spend would have landed in that block.',
+    'It does not prove a later reorg left the block hash or state root in place.',
+    'UNAVAILABLE means the issuer did not have a block. It does not mean the chain was empty.',
+    'It does not prove the policy rule was the right rule. It proves the issuer refused under that code.',
+    'It does not prove amount_requested would have been the settled price.',
+    'It is not a payment receipt. A payment verifier must not treat it as proof of spend.',
+    'verify_url is not inside the signature.',
+];
+/** Schema inside the JWS payload. Unverified; callers still check the signature. */
+function jwsPayloadSchema(doc) {
+    if (!doc || typeof doc !== 'object')
+        return null;
+    const jws = doc.issuer_signature?.jws;
+    if (!jws || typeof jws !== 'string')
+        return null;
+    const payloadB64 = jws.split('.')[1];
+    if (!payloadB64)
+        return null;
+    try {
+        const payload = JSON.parse(Buffer.from(payloadB64, 'base64url').toString('utf8'));
+        return typeof payload.schema === 'string' ? payload.schema : null;
+    }
+    catch {
+        return null;
+    }
+}
+function isRefusalDocument(doc) {
+    if (!doc || typeof doc !== 'object')
+        return false;
+    const schema = doc.schema;
+    if (schema === exports.REFUSAL_SCHEMA || schema === exports.REFUSAL_SCHEMA_V2)
+        return true;
+    const signedSchema = jwsPayloadSchema(doc);
+    return signedSchema === exports.REFUSAL_SCHEMA || signedSchema === exports.REFUSAL_SCHEMA_V2;
+}
+function jwksCandidates(jwks, kid) {
+    if (!jwks?.keys?.length)
+        return [];
+    const es256 = jwks.keys.filter((key) => key.kty === 'EC' && key.crv === 'P-256' && key.x && key.y);
+    if (!kid)
+        return es256;
+    return es256.filter((key) => key.kid === kid);
+}
+function same(left, right) {
+    return left === right;
+}
+function anchorSame(outer, signed) {
+    if (!outer || !signed)
+        return false;
+    return same(outer.status, signed.status)
+        && same(outer.rail, signed.rail)
+        && same(outer.chain_id ?? null, signed.chain_id ?? null)
+        && same(outer.block_number ?? null, signed.block_number ?? null)
+        && same(outer.block_hash ?? null, signed.block_hash ?? null)
+        && same(outer.state_root ?? null, signed.state_root ?? null);
+}
+function bookRowSame(outer, signed) {
+    if (!outer || !signed)
+        return false;
+    return same(outer.task_id, signed.task_id)
+        && Number(outer.seq) === Number(signed.seq)
+        && same(outer.prev_hash || null, signed.prev_hash || null)
+        && same(outer.row_hash, signed.row_hash)
+        && same(outer.event, signed.event);
+}
+function requestPreimageOf(doc) {
+    if (typeof doc.request_preimage === 'string' && doc.request_preimage)
+        return doc.request_preimage;
+    const published = doc.preimages?.fields?.request_digest?.preimage_utf8;
+    return typeof published === 'string' && published ? published : null;
+}
+function failed(reason, extra = {}) {
+    return {
+        schema: exports.REFUSAL_SCHEMA,
+        checked: extra.checked ?? true,
+        reason,
+        charged: false,
+        proves: exports.REFUSAL_PROVES,
+        does_not_prove: exports.REFUSAL_DOES_NOT_PROVE,
+        errors: [reason],
+        kid: extra.kid,
+        valid: false,
+    };
+}
+/**
+ * Verify the issuer signature and that the outer refusal fields match it.
+ * Trust is a JWKS key matched by kid, or an embedded key whose thumbprint
+ * is a pinned trusted kid. The embedded key alone is not a trust root.
+ */
+function verifyRefusal(doc, options = {}) {
+    if (!isRefusalDocument(doc)) {
+        return failed('not_a_refusal', { checked: false });
+    }
+    const jws = doc.issuer_signature?.jws;
+    if (!jws)
+        return failed('no_signature', { checked: false });
+    const trustedKids = options.trustedKids ?? jws_js_1.DEFAULT_TRUSTED_ISSUER_KIDS;
+    const header = (0, jws_js_1.readJwsHeader)(jws);
+    const kid = header?.kid || doc.issuer_signature?.kid;
+    const embedded = (0, jws_js_1.resolvePinnedIssuerJwk)(doc);
+    const pinned = !!(embedded && (0, jws_js_1.isPinnedTrustedJwk)(embedded, trustedKids));
+    const fromJwks = jwksCandidates(options.jwks, kid);
+    let payload = null;
+    let trusted = false;
+    let reason = 'signature_invalid';
+    for (const jwk of fromJwks) {
+        const result = (0, jws_js_1.verifyIssuerJws)(jws, jwk);
+        if (result.valid && result.payload) {
+            payload = result.payload;
+            trusted = true;
+            break;
+        }
+        reason = result.reason || 'signature_invalid';
+    }
+    if (!payload && pinned && embedded) {
+        const result = (0, jws_js_1.verifyIssuerJws)(jws, embedded);
+        if (result.valid && result.payload) {
+            payload = result.payload;
+            trusted = true;
+        }
+        else {
+            reason = result.reason || 'signature_invalid';
+        }
+    }
+    if (!payload && embedded && (0, jws_js_1.verifyIssuerJws)(jws, embedded).valid && !pinned && fromJwks.length === 0) {
+        return failed(jws_js_1.KEY_UNTRUSTED, { kid: kid || null });
+    }
+    if (!payload) {
+        if (fromJwks.length === 0 && !pinned)
+            return failed(jws_js_1.KEY_UNTRUSTED, { kid: kid || null });
+        return failed(reason, { kid: kid || null });
+    }
+    if (!trusted)
+        return failed(jws_js_1.KEY_UNTRUSTED, { kid: kid || null });
+    const signed = payload;
+    const versionCheck = (0, receipt_version_js_1.refusalPayloadVersion)(payload);
+    if (!versionCheck.ok)
+        return failed('unsupported_version', { kid });
+    const version = versionCheck.version;
+    const boundRefusal = signed.schema === exports.REFUSAL_SCHEMA_V2 || version === 3;
+    if (boundRefusal) {
+        const digest = signed.request_digest;
+        const preimage = requestPreimageOf(doc);
+        if (typeof digest !== 'string' || !/^[0-9a-f]{64}$/.test(digest) || !preimage) {
+            return { ...failed('REQUEST_UNBOUND', { kid }), request_binding: 'REQUEST_UNBOUND' };
+        }
+        const recomputed = (0, request_binding_js_1.verifyRequestDigest)(digest, preimage);
+        if (!recomputed.ok) {
+            return { ...failed('request_digest_mismatch', { kid }), request_binding: 'request_digest_mismatch' };
+        }
+    }
+    if (signed.schema !== exports.REFUSAL_SCHEMA && signed.schema !== exports.REFUSAL_SCHEMA_V2)
+        return failed('schema_mismatch', { kid });
+    // The outer schema is unsigned. A present value that disagrees with the
+    // signed schema fails. An omitted outer schema still follows the JWS.
+    if (doc.schema != null && doc.schema !== signed.schema)
+        return failed('schema_mismatch', { kid });
+    if (doc.payload_version != null && doc.payload_version !== version) {
+        return failed('payload_version_mismatch', { kid });
+    }
+    if (version >= 2) {
+        const pin = signed.issuer_history;
+        if (!pin || typeof pin.hash !== 'string' || pin.version == null || pin.seq == null) {
+            return failed('issuer_history_pin_missing', { kid });
+        }
+        const payloadHash = signed.payload_hash;
+        if (typeof payloadHash !== 'string' || !/^[0-9a-f]{64}$/.test(payloadHash)) {
+            return failed('payload_hash_missing', { kid });
+        }
+    }
+    if (signed.kind !== 'refusal')
+        return failed('kind_mismatch', { kid });
+    if (signed.charged !== false || signed.amount_charged !== '0'
+        || doc.charged !== false || doc.amount_charged !== '0') {
+        return failed('charged_not_zero', { kid });
+    }
+    if (!same(doc.refusal_code, signed.refusal_code))
+        return failed('refusal_code_mismatch', { kid });
+    if (!same(doc.nonce, signed.nonce))
+        return failed('nonce_mismatch', { kid });
+    if (!same(doc.refusal_id, signed.refusal_id))
+        return failed('refusal_id_mismatch', { kid });
+    if (!same(doc.chain_id ?? null, signed.chain_id ?? null))
+        return failed('chain_id_mismatch', { kid });
+    if (!same(doc.task_id, signed.task_id)
+        || Number(doc.agent_id) !== Number(signed.agent_id)
+        || Number(doc.book_id) !== Number(signed.book_id)) {
+        return failed('identity_mismatch', { kid });
+    }
+    if (!same(doc.issued_at, signed.issued_at))
+        return failed('issued_at_mismatch', { kid });
+    if (!same(doc.amount_requested ?? null, signed.amount_requested ?? null)) {
+        return failed('amount_mismatch', { kid });
+    }
+    if (!anchorSame(doc.anchor, signed.anchor))
+        return failed('anchor_mismatch', { kid });
+    if (!bookRowSame(doc.book_row, signed.book_row))
+        return failed('book_row_mismatch', { kid });
+    return {
+        schema: exports.REFUSAL_SCHEMA,
+        valid: true,
+        checked: true,
+        kid: kid || null,
+        refusal_id: signed.refusal_id || null,
+        refusal_code: signed.refusal_code || null,
+        nonce: signed.nonce || null,
+        chain_id: signed.chain_id ?? null,
+        charged: false,
+        proves: exports.REFUSAL_PROVES,
+        does_not_prove: exports.REFUSAL_DOES_NOT_PROVE,
+        errors: [],
+        payload_version: version,
+        issuer_history: signed.issuer_history ?? null,
+        payload_hash: signed.payload_hash ?? null,
+    };
+}
+//# sourceMappingURL=refusal.js.map

package/dist/refusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refusal.js","sourceRoot":"","sources":["../src/refusal.ts"],"names":[],"mappings":";;;AAgHA,4CAYC;AAED,8CAMC;AAyDD,sCAsHC;AAnTD;;;;;GAKG;AACH,qCAQkB;AAClB,6DAAsF;AACtF,6DAA6D;AAEhD,QAAA,cAAc,GAAG,oBAAoB,CAAC;AACtC,QAAA,iBAAiB,GAAG,oBAAoB,CAAC;AACtD,0FAA0F;AAC7E,QAAA,wBAAwB,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAU,CAAC;AAC3D,0DAA0D;AAC7C,QAAA,uBAAuB,GAAG,CAAC,CAAC;AAE5B,QAAA,cAAc,GAAG;IAC5B,+CAA+C;IAC/C,+CAA+C;IAC/C,yCAAyC;IACzC,iHAAiH;IACjH,iJAAiJ;IACjJ,qFAAqF;IACrF,sEAAsE;CACvE,CAAC;AAEW,QAAA,sBAAsB,GAAG;IACpC,iEAAiE;IACjE,sEAAsE;IACtE,6EAA6E;IAC7E,0FAA0F;IAC1F,qGAAqG;IACrG,uEAAuE;IACvE,sFAAsF;IACtF,yCAAyC;CAC1C,CAAC;AAmEF,oFAAoF;AACpF,SAAgB,gBAAgB,CAAC,GAAY;IAC3C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,GAAG,GAAI,GAAuB,CAAC,gBAAgB,EAAE,GAAG,CAAC;IAC3D,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAyB,CAAC;QAC1G,OAAO,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,iBAAiB,CAAC,GAAY;IAC5C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,MAAM,GAAI,GAA4B,CAAC,MAAM,CAAC;IACpD,IAAI,MAAM,KAAK,sBAAc,IAAI,MAAM,KAAK,yBAAiB;QAAE,OAAO,IAAI,CAAC;IAC3E,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,YAAY,KAAK,sBAAc,IAAI,YAAY,KAAK,yBAAiB,CAAC;AAC/E,CAAC;AAED,SAAS,cAAc,CAAC,IAA6B,EAAE,GAAuB;IAC5E,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,IAAI,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACnG,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,IAAI,CAAC,IAAa,EAAE,KAAc;IACzC,OAAO,IAAI,KAAK,KAAK,CAAC;AACxB,CAAC;AAED,SAAS,UAAU,CAAC,KAAuC,EAAE,MAAwC;IACnG,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;WACnC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;WAC7B,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC;WACrD,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,IAAI,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC;WAC7D,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC;WACzD,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,WAAW,CAAC,KAAwC,EAAE,MAAyC;IACtG,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC;WACrC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;WACxC,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC;WACvD,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;WACrC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,iBAAiB,CAAC,GAA2H;IACpJ,IAAI,OAAO,GAAG,CAAC,gBAAgB,KAAK,QAAQ,IAAI,GAAG,CAAC,gBAAgB;QAAE,OAAO,GAAG,CAAC,gBAAgB,CAAC;IAClG,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,aAAa,CAAC;IACvE,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,QAAsC,EAAE;IACtE,OAAO;QACL,MAAM,EAAE,sBAAc;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;QAC9B,MAAM;QACN,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,sBAAc;QACtB,cAAc,EAAE,8BAAsB;QACtC,MAAM,EAAE,CAAC,MAAM,CAAC;QAChB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,KAAK,EAAE,KAAK;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAC3B,GAAoB,EACpB,UAAmE,EAAE;IAErE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,gBAAgB,EAAE,GAAG,CAAC;IACtC,IAAI,CAAC,GAAG;QAAE,OAAO,MAAM,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAE5D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oCAA2B,CAAC;IACvE,MAAM,MAAM,GAAG,IAAA,sBAAa,EAAC,GAAG,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,gBAAgB,EAAE,GAAG,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAA,+BAAsB,EAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAA,2BAAkB,EAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAEnD,IAAI,OAAO,GAAmC,IAAI,CAAC;IACnD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,GAAG,mBAAmB,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAA,wBAAe,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YACzB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM;QACR,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,mBAAmB,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,IAAA,wBAAe,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YACzB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,mBAAmB,CAAC;QAChD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,QAAQ,IAAI,IAAA,wBAAe,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrG,OAAO,MAAM,CAAC,sBAAa,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC,sBAAa,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;QACzF,OAAO,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,sBAAa,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;IAEjE,MAAM,MAAM,GAAG,OAAoE,CAAC;IACpF,MAAM,YAAY,GAAG,IAAA,0CAAqB,EAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,YAAY,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,qBAAqB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;IACrC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,KAAK,yBAAiB,IAAI,OAAO,KAAK,CAAC,CAAC;IAC1E,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC;QACrC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9E,OAAO,EAAE,GAAG,MAAM,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,eAAe,EAAE,iBAAiB,EAAE,CAAC;QACvF,CAAC;QACD,MAAM,UAAU,GAAG,IAAA,wCAAmB,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,OAAO,EAAE,GAAG,MAAM,CAAC,yBAAyB,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,eAAe,EAAE,yBAAyB,EAAE,CAAC;QACvG,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,sBAAc,IAAI,MAAM,CAAC,MAAM,KAAK,yBAAiB;QAAE,OAAO,MAAM,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACvH,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAClG,IAAI,GAAG,CAAC,eAAe,IAAI,IAAI,IAAI,GAAG,CAAC,eAAe,KAAK,OAAO,EAAE,CAAC;QACnE,OAAO,MAAM,CAAC,0BAA0B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACjB,MAAM,GAAG,GAAI,MAAoF,CAAC,cAAc,CAAC;QACjH,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,IAAI,GAAG,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;YACnF,OAAO,MAAM,CAAC,4BAA4B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,WAAW,GAAI,MAAqC,CAAC,YAAY,CAAC;QACxE,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3E,OAAO,MAAM,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACvE,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,IAAI,MAAM,CAAC,cAAc,KAAK,GAAG;WACxD,GAAG,CAAC,OAAO,KAAK,KAAK,IAAI,GAAG,CAAC,cAAc,KAAK,GAAG,EAAE,CAAC;QACzD,OAAO,MAAM,CAAC,kBAAkB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC;QAAE,OAAO,MAAM,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAClG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;QAAE,OAAO,MAAM,CAAC,qBAAqB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5F,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,IAAI,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,mBAAmB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACtG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC;WACjC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;WAChD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC,mBAAmB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC,oBAAoB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,EAAE,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC,EAAE,CAAC;QACzE,OAAO,MAAM,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAuB,CAAC;QAAE,OAAO,MAAM,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACvG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,QAA0B,CAAC;QAAE,OAAO,MAAM,CAAC,mBAAmB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAE/G,OAAO;QACL,MAAM,EAAE,sBAAc;QACtB,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,GAAG,IAAI,IAAI;QAChB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;QACrC,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;QACzC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI;QACjC,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,sBAAc;QACtB,cAAc,EAAE,8BAAsB;QACtC,MAAM,EAAE,EAAE;QACV,eAAe,EAAE,OAAO;QACxB,cAAc,EAAG,MAAqE,CAAC,cAAc,IAAI,IAAI;QAC7G,YAAY,EAAG,MAA2C,CAAC,YAAY,IAAI,IAAI;KAChF,CAAC;AACJ,CAAC"}

package/dist/request-binding.d.ts

@@ -0,0 +1,7 @@
+export type RequestBindingStatus = 'REQUEST_UNBOUND' | 'request_digest_mismatch' | 'recomputed';
+export declare function requestDigestOfPreimage(preimageUtf8: string): string;
+export declare function verifyRequestDigest(digest: string, preimageUtf8: string): {
+    ok: boolean;
+    reason: RequestBindingStatus;
+};
+//# sourceMappingURL=request-binding.d.ts.map

package/dist/request-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-binding.d.ts","sourceRoot":"","sources":["../src/request-binding.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,oBAAoB,GAAG,iBAAiB,GAAG,yBAAyB,GAAG,YAAY,CAAC;AAEhG,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GACnB;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAW/C"}

package/dist/request-binding.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requestDigestOfPreimage = requestDigestOfPreimage;
+exports.verifyRequestDigest = verifyRequestDigest;
+/**
+ * Recompute request_digest from the published RFC 8785 preimage.
+ * The preimage is the exact UTF-8 string. This function does not rebuild it.
+ * Gateway field order is body_sha256, idempotency_key, method, nonce, path.
+ */
+const node_crypto_1 = require("node:crypto");
+function requestDigestOfPreimage(preimageUtf8) {
+    return (0, node_crypto_1.createHash)('sha256').update(preimageUtf8, 'utf8').digest('hex');
+}
+function verifyRequestDigest(digest, preimageUtf8) {
+    if (typeof digest !== 'string' || !/^[0-9a-f]{64}$/.test(digest)) {
+        return { ok: false, reason: 'REQUEST_UNBOUND' };
+    }
+    if (typeof preimageUtf8 !== 'string' || preimageUtf8 === '') {
+        return { ok: false, reason: 'REQUEST_UNBOUND' };
+    }
+    if (requestDigestOfPreimage(preimageUtf8) !== digest) {
+        return { ok: false, reason: 'request_digest_mismatch' };
+    }
+    return { ok: true, reason: 'recomputed' };
+}
+//# sourceMappingURL=request-binding.js.map

package/dist/request-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-binding.js","sourceRoot":"","sources":["../src/request-binding.ts"],"names":[],"mappings":";;AASA,0DAEC;AAED,kDAcC;AA3BD;;;;GAIG;AACH,6CAAyC;AAIzC,SAAgB,uBAAuB,CAAC,YAAoB;IAC1D,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,SAAgB,mBAAmB,CACjC,MAAc,EACd,YAAoB;IAEpB,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;QAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,uBAAuB,CAAC,YAAY,CAAC,KAAK,MAAM,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAC5C,CAAC"}

package/dist/row-hash.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Leaf input for `task_id|row_hash`.
+ * Same order as verifyAnchoredRoot: top-level row_hash, then book_chain, then
+ * the inclusion or carry document. One source is enough. Two or three that
+ * differ fail closed. The value used for the leaf is the one they agree on.
+ * No string at all is `row: null`. An empty string is a present source.
+ */
+export declare function boundRowHash(receipt: {
+    row_hash?: string | null;
+    book_chain?: {
+        row_hash?: string | null;
+    } | null;
+}, extra?: {
+    row_hash?: string | null;
+} | null): {
+    ok: true;
+    row: string | null;
+} | {
+    ok: false;
+    reason: 'row_hash_mismatch';
+};
+//# sourceMappingURL=row-hash.d.ts.map

package/dist/row-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"row-hash.d.ts","sourceRoot":"","sources":["../src/row-hash.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAA;CAAE,EACvF,KAAK,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,GAC1C;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,CAS/E"}

package/dist/row-hash.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.boundRowHash = boundRowHash;
+/**
+ * Leaf input for `task_id|row_hash`.
+ * Same order as verifyAnchoredRoot: top-level row_hash, then book_chain, then
+ * the inclusion or carry document. One source is enough. Two or three that
+ * differ fail closed. The value used for the leaf is the one they agree on.
+ * No string at all is `row: null`. An empty string is a present source.
+ */
+function boundRowHash(receipt, extra) {
+    const present = [];
+    if (typeof receipt.row_hash === 'string')
+        present.push(receipt.row_hash);
+    if (typeof receipt.book_chain?.row_hash === 'string')
+        present.push(receipt.book_chain.row_hash);
+    if (typeof extra?.row_hash === 'string')
+        present.push(extra.row_hash);
+    if (present.length === 0)
+        return { ok: true, row: null };
+    const agreed = present[0];
+    if (present.some((value) => value !== agreed))
+        return { ok: false, reason: 'row_hash_mismatch' };
+    return { ok: true, row: agreed };
+}
+//# sourceMappingURL=row-hash.js.map

package/dist/row-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"row-hash.js","sourceRoot":"","sources":["../src/row-hash.ts"],"names":[],"mappings":";;AAOA,oCAYC;AAnBD;;;;;;GAMG;AACH,SAAgB,YAAY,CAC1B,OAAuF,EACvF,KAA2C;IAE3C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzE,IAAI,OAAO,OAAO,CAAC,UAAU,EAAE,QAAQ,KAAK,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAChG,IAAI,OAAO,KAAK,EAAE,QAAQ,KAAK,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACjG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACnC,CAAC"}

package/dist/shell.d.ts

@@ -0,0 +1,65 @@
+export declare const SHELL_SCHEMA = "chit402.receipt_shell.v1";
+export declare const INCLUDED_SHELL_LINE = "INCLUDED_SHELL: signature requires owner view";
+export declare function isReceiptShell(doc: unknown): doc is Record<string, unknown>;
+export declare function decodeJwsPayload(jws: unknown): Record<string, unknown> | null;
+/** Project the public shell from a holder receipt. Leaf proof is not invented. */
+export declare function shellFromHolder(receipt: Record<string, unknown>): Record<string, unknown>;
+/**
+ * The owner view returns `{ jws, salt, private_fields }`. A saved holder
+ * receipt has `issuer_signature`. Either can be the `--jws` file.
+ * An `issuer_jwk` on the owner-view body is ignored. Trust is a pinned
+ * kid or a JWKS entry, not a key the response carries.
+ */
+export declare function holderDocumentFromOwnerView(doc: Record<string, unknown> | string): Record<string, unknown>;
+export interface ShellHolderCheck {
+    signatureValid: boolean;
+    keyTrusted: boolean;
+    signatureReason?: string | null;
+    inclusionSupplied: boolean;
+    inclusionOk: boolean;
+    inclusionReason?: string | null;
+    paymentRef?: string | null;
+    bindingExpected?: boolean;
+    bindingMatches?: boolean;
+    shellLeaf?: string | null;
+    provedLeaf?: string | null;
+    /** The supplied head carries an issuer JWS (checked by verifyReceipt). */
+    headSigned?: boolean;
+}
+/**
+ * VERIFIED requires a trusted issuer key, a passing inclusion proof, and a
+ * signed payment. A shell alone, a missing proof, or a key that only
+ * verifies because it is embedded in the holder is not VERIFIED.
+ */
+export declare function shellHolderVerdict(check: ShellHolderCheck): {
+    verified: boolean;
+    reason: string | null;
+};
+/**
+ * Expected shell from the signed JWS claims only. Outer holder fields
+ * (payment.settled_amount, payment.network, payment_meta, task_id) are
+ * not signed and are not used, so they cannot ride along under VERIFIED.
+ */
+export declare function signedShellFromHolder(holder: Record<string, unknown> | string): Record<string, unknown>;
+export declare function compareShellToJws(shell: Record<string, unknown>, holder: Record<string, unknown> | string): {
+    ok: boolean;
+    field?: string;
+};
+/**
+ * v11: body_commitment = HMAC-SHA256(salt, raw body),
+ * request_digest = SHA-256 of the JCS object
+ * {body_commitment, idempotency_key, method, nonce, path}.
+ */
+export declare function openV11Commitment(input: {
+    payload: Record<string, unknown> | null;
+    saltHex: string;
+    body: Buffer | string;
+    method?: string;
+    path?: string;
+    nonce?: string;
+    idempotencyKey?: string;
+}): {
+    ok: boolean;
+    reason?: string;
+};
+//# sourceMappingURL=shell.d.ts.map

package/dist/shell.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../src/shell.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,YAAY,6BAA6B,CAAC;AACvD,eAAO,MAAM,mBAAmB,kDAAkD,CAAC;AAEnF,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE3E;AAoBD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAS7E;AAuBD,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAqCzF;AAcD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoC1G;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,OAAO,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,EAAE,OAAO,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,0EAA0E;IAC1E,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAyBxG;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMvG;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAc3I;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAiBnC"}