raz-encrypt 2.1.0 → 2.4.0

package/dist/trust.js

@@ -4,12 +4,14 @@ import { hkdf } from "@noble/hashes/hkdf.js";
 import { hmac } from "@noble/hashes/hmac.js";
 import { sha384 } from "@noble/hashes/sha2.js";
 import { bytesToHex, concatBytes, hexToBytes, randomBytes, utf8ToBytes } from "@noble/hashes/utils.js";
-import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
-import { join } from "node:path";
+import { readFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
 import { canonicalize } from "./canonicalJson.js";
 import { isValidIsoInstant, signCore, verifyCore } from "./crypto/hybrid.js";
+import { writeFileAtomic } from "./fileCrypto.js";
 import { fingerprint } from "./fingerprint.js";
 import { exportPublicIdentity } from "./identity.js";
+import { appendLogEntry } from "./store.js";
 /**
  * Thrown when trust.json cannot be trusted: its MAC does not verify (edited,
  * truncated, copied from another identity), it is not valid JSON, or it is an
@@ -29,6 +31,8 @@ const TRUST_STORE_HMAC_INFO = utf8ToBytes("raz-encrypt-trust-store-v1|hmac-key")
 // separate from its entry key (ADR 0019) — independent HKDF outputs per use
 // (ADR 0027).
 const TRUST_STORE_ENC_INFO = utf8ToBytes("raz-encrypt-trust-store-v1|enc-key");
+// Third independent key, for the freshness sidecar (ADR 0030).
+const TRUST_STORE_SEQ_INFO = utf8ToBytes("raz-encrypt-trust-store-v1|seq-key");
 function trustFilePath(storageDir) {
     return join(storageDir, "trust.json");
 }
@@ -44,26 +48,29 @@ function deriveTrustStoreKey(identity) {
 function deriveTrustStoreEncKey(identity) {
     return hkdf(sha384, concatBytes(identity.classical.secretKey, identity.pqcSign.secretKey), undefined, TRUST_STORE_ENC_INFO, 32);
 }
-function computeMac(identity, entries) {
-    return bytesToHex(hmac(sha384, deriveTrustStoreKey(identity), utf8ToBytes(canonicalize({ version: 3, entries }))));
+// `seq` joins the MAC input only when present, so files written before ADR 0030 keep verifying unchanged.
+function computeMac(identity, entries, seq) {
+    const body = seq === undefined ? { version: 3, entries } : { version: 3, entries, seq };
+    return bytesToHex(hmac(sha384, deriveTrustStoreKey(identity), utf8ToBytes(canonicalize(body))));
 }
 /**
  * Exported (ADR 0026) so the timing-safety test can exercise this exact
  * compare in isolation, without the file I/O its only internal callers do.
  */
-export function macMatches(identity, entries, mac) {
+export function macMatches(identity, entries, mac, seq) {
     if (typeof mac !== "string" || !/^[0-9a-f]{96}$/.test(mac))
         return false;
-    return equalBytes(hexToBytes(mac), hexToBytes(computeMac(identity, entries)));
+    return equalBytes(hexToBytes(mac), hexToBytes(computeMac(identity, entries, seq)));
 }
 /** v4's MAC covers the ciphertext blob instead of the plaintext entries (ADR 0027) — same chain-authentication mechanism, different bytes underneath it. */
-function computeMacV4(identity, nonce, ciphertext) {
-    return bytesToHex(hmac(sha384, deriveTrustStoreKey(identity), utf8ToBytes(canonicalize({ version: 4, nonce, ciphertext }))));
+function computeMacV4(identity, nonce, ciphertext, seq) {
+    const body = seq === undefined ? { version: 4, nonce, ciphertext } : { version: 4, nonce, ciphertext, seq };
+    return bytesToHex(hmac(sha384, deriveTrustStoreKey(identity), utf8ToBytes(canonicalize(body))));
 }
-function macMatchesV4(identity, nonce, ciphertext, mac) {
+function macMatchesV4(identity, nonce, ciphertext, mac, seq) {
     if (typeof mac !== "string" || !/^[0-9a-f]{96}$/.test(mac))
         return false;
-    return equalBytes(hexToBytes(mac), hexToBytes(computeMacV4(identity, nonce, ciphertext)));
+    return equalBytes(hexToBytes(mac), hexToBytes(computeMacV4(identity, nonce, ciphertext, seq)));
 }
 /** Associated data for the entries AEAD: binds the ciphertext to the format version and its own nonce, same pattern as fileCrypto.ts's headerAad. */
 function entriesAad(version, nonce) {
@@ -92,7 +99,10 @@ function isV3(data) {
     if (typeof data !== "object" || data === null || data.version !== 3)
         return false;
     const entries = data.entries;
-    return typeof entries === "object" && entries !== null && !Array.isArray(entries);
+    return typeof entries === "object" && entries !== null && !Array.isArray(entries) && validSeq(data.seq);
+}
+function validSeq(seq) {
+    return seq === undefined || (typeof seq === "number" && Number.isSafeInteger(seq) && seq >= 1);
 }
 function isHex96(value) {
     return typeof value === "string" && /^[0-9a-f]{96}$/.test(value);
@@ -101,7 +111,7 @@ function isV4(data) {
     if (typeof data !== "object" || data === null || data.version !== 4)
         return false;
     const d = data;
-    return typeof d.nonce === "string" && /^[0-9a-f]{24}$/.test(d.nonce) && typeof d.ciphertext === "string" && /^[0-9a-f]*$/.test(d.ciphertext) && isHex96(d.mac);
+    return typeof d.nonce === "string" && /^[0-9a-f]{24}$/.test(d.nonce) && typeof d.ciphertext === "string" && /^[0-9a-f]*$/.test(d.ciphertext) && isHex96(d.mac) && validSeq(data.seq);
 }
 function isV2(data) {
     return typeof data === "object" && data !== null && data.version === 2;
@@ -140,39 +150,128 @@ function parse(raw) {
         throw new TrustStoreIntegrityError("trust.json is not valid JSON; refusing to use it.");
     }
 }
-/** Reads and AUTHENTICATES the trust store, transparently decrypting a v4 (issue #43) file. Missing file = empty store. Anything unauthenticated throws TrustStoreIntegrityError. */
-async function readTrustStore(identity) {
+const ROLLBACK_MESSAGE = "trust.json is older than the last recorded trust change: it was rolled back (or its sequence file was removed). Refusing to use it. Restore the newest copy, or investigate before re-trusting anyone.";
+function seqFilePath(storageDir) {
+    return join(storageDir, "trust.seq.json");
+}
+function computeSeqMac(identity, seq, storeMac) {
+    const key = hkdf(sha384, concatBytes(identity.classical.secretKey, identity.pqcSign.secretKey), undefined, TRUST_STORE_SEQ_INFO, 32);
+    return bytesToHex(hmac(sha384, key, utf8ToBytes(canonicalize({ version: 1, seq, storeMac }))));
+}
+/** The sidecar's contents, or undefined if absent. Throws TrustStoreIntegrityError if it exists but is malformed or fails its MAC. */
+async function readSeqRecord(identity) {
+    let raw;
+    try {
+        raw = await readFile(seqFilePath(identity.storageDir), "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return undefined;
+        throw err;
+    }
+    const bad = () => new TrustStoreIntegrityError("trust.seq.json failed its integrity check: it was modified or belongs to a different identity.");
+    let data;
+    try {
+        data = JSON.parse(raw);
+    }
+    catch {
+        throw bad();
+    }
+    const d = data;
+    if (typeof d !== "object" || d === null || d.version !== 1 || !validSeq(d.seq) || d.seq === undefined || !isHex96(d.storeMac) || !isHex96(d.mac))
+        throw bad();
+    if (!equalBytes(hexToBytes(d.mac), hexToBytes(computeSeqMac(identity, d.seq, d.storeMac))))
+        throw bad();
+    return d;
+}
+/**
+ * Reads and AUTHENTICATES the trust store, transparently decrypting a v4 (issue #43) file, and
+ * checks its freshness against the sequence sidecar (ADR 0030): a store whose `seq` is below the
+ * sidecar's, or equal with a different MAC, is a rollback. A store AHEAD of the sidecar is a crash
+ * between the two writes and is accepted (the next write repairs it). Missing file = empty store.
+ */
+async function readStoreState(identity) {
     const raw = await readRaw(identity.storageDir);
     if (raw === undefined)
-        return {};
+        return { entries: {}, seq: 0, mac: "" };
     const data = parse(raw);
+    let state;
     if (isV4(data)) {
-        if (!macMatchesV4(identity, data.nonce, data.ciphertext, data.mac)) {
+        if (!macMatchesV4(identity, data.nonce, data.ciphertext, data.mac, data.seq)) {
             throw new TrustStoreIntegrityError("trust.json failed its integrity check: it was modified, truncated, or belongs to a different identity.");
         }
-        return decryptEntries(identity, data.nonce, data.ciphertext);
+        state = { entries: decryptEntries(identity, data.nonce, data.ciphertext), seq: data.seq ?? 0, mac: data.mac };
     }
-    if (!isV3(data)) {
+    else if (!isV3(data)) {
         throw new TrustStoreIntegrityError("trust.json is an unauthenticated legacy file (written before trust-store MACs). Review it, then call migrateLegacyTrustStore(identity) to adopt it.");
     }
-    if (!macMatches(identity, data.entries, data.mac)) {
-        throw new TrustStoreIntegrityError("trust.json failed its integrity check: it was modified, truncated, or belongs to a different identity.");
+    else {
+        if (!macMatches(identity, data.entries, data.mac, data.seq)) {
+            throw new TrustStoreIntegrityError("trust.json failed its integrity check: it was modified, truncated, or belongs to a different identity.");
+        }
+        state = { entries: data.entries, seq: data.seq ?? 0, mac: data.mac };
     }
-    return data.entries;
-}
-async function writeStoreFile(identity, store) {
-    await mkdir(identity.storageDir, { recursive: true, mode: 0o700 });
-    const finalPath = trustFilePath(identity.storageDir);
-    const tmpPath = `${finalPath}.${process.pid}.${Date.now()}.tmp`;
-    try {
-        await writeFile(tmpPath, JSON.stringify(store, null, 2), { mode: 0o600 });
-        await rename(tmpPath, finalPath);
+    const record = await readSeqRecord(identity);
+    if (record === undefined) {
+        // Only a first-ever write can legitimately leave a store with no sidecar (crash between the two writes).
+        if (state.seq > 1)
+            throw new TrustStoreIntegrityError(ROLLBACK_MESSAGE);
     }
-    catch (err) {
-        await rm(tmpPath, { force: true });
-        throw err;
+    else if (state.seq < record.seq || (state.seq === record.seq && state.mac !== record.storeMac)) {
+        throw new TrustStoreIntegrityError(ROLLBACK_MESSAGE);
+    }
+    return state;
+}
+async function readTrustStore(identity) {
+    return (await readStoreState(identity)).entries;
+}
+/** The current `{ seq, mac }` of the trust store. Store it off-box after changes you care about. */
+export async function getTrustStoreAnchor(identity) {
+    const { seq, mac } = await readStoreState(identity);
+    return { seq, mac };
+}
+/**
+ * Throws TrustStoreIntegrityError if the local trust store is older than `anchor`, or has the
+ * same sequence number with different contents. Newer is fine. This is the only check that
+ * catches a rollback where trust.json and trust.seq.json were restored together (ADR 0030).
+ */
+export async function verifyTrustStoreAnchor(identity, anchor) {
+    const { seq, mac } = await readStoreState(identity);
+    if (seq < anchor.seq || (seq === anchor.seq && mac !== anchor.mac)) {
+        throw new TrustStoreIntegrityError("the trust store does not match the anchor you supplied: it was rolled back or replaced.");
     }
 }
+async function writeStoreFile(identity, store, seq) {
+    // Temp file with a unique name, fsync of file and directory, then rename (ADR 0028):
+    // a crash leaves the complete old file or the complete new one, never a torn one.
+    await writeFileAtomic(trustFilePath(identity.storageDir), JSON.stringify(store, null, 2));
+    // Then the freshness sidecar (ADR 0030). A crash between the two leaves the store one ahead, which reads accept.
+    const record = { version: 1, seq, storeMac: store.mac, mac: computeSeqMac(identity, seq, store.mac) };
+    await writeFileAtomic(seqFilePath(identity.storageDir), JSON.stringify(record));
+}
+/**
+ * Serializes every read-modify-write of one identity's trust store (ADR
+ * 0028, issue #56). Without this, two overlapping mutations each read the
+ * same snapshot and the later write erased the earlier one, so a revocation
+ * could be lost while the revoked party stayed trusted. In-process only, like
+ * the audit log's queue (ADR 0011): separate OS processes sharing one
+ * storageDir are not coordinated.
+ *
+ * A failure in one task never blocks the next. The map entry is removed once
+ * its chain drains, so it does not grow with every storageDir ever touched.
+ */
+const mutationQueues = new Map();
+function serialized(identity, task) {
+    const key = resolve(identity.storageDir);
+    const run = (mutationQueues.get(key) ?? Promise.resolve()).then(task);
+    const tail = run.then(() => undefined, () => undefined);
+    mutationQueues.set(key, tail);
+    void tail.then(() => {
+        if (mutationQueues.get(key) === tail)
+            mutationQueues.delete(key);
+    });
+    return run;
+}
 /**
  * Writes the store with a fresh MAC, atomically (temp file in the same
  * directory, then rename), mode 0o600. Preserves whatever format is
@@ -183,15 +282,22 @@ async function writeStoreFile(identity, store) {
 async function writeTrustStore(identity, entries) {
     const raw = await readRaw(identity.storageDir);
     const current = raw === undefined ? undefined : parse(raw);
+    const seq = (current?.seq ?? 0) + 1;
     if (isV4(current)) {
-        await writeTrustStore4(identity, entries);
+        await writeTrustStore4(identity, entries, seq);
         return;
     }
-    await writeStoreFile(identity, { version: 3, entries, mac: computeMac(identity, entries) });
+    await writeStoreFile(identity, { version: 3, entries, seq, mac: computeMac(identity, entries, seq) }, seq);
 }
-async function writeTrustStore4(identity, entries) {
+async function writeTrustStore4(identity, entries, seq) {
+    const next = seq ?? (await currentSeq(identity)) + 1;
     const { nonce, ciphertext } = encryptEntries(identity, entries);
-    await writeStoreFile(identity, { version: 4, nonce, ciphertext, mac: computeMacV4(identity, nonce, ciphertext) });
+    await writeStoreFile(identity, { version: 4, nonce, ciphertext, seq: next, mac: computeMacV4(identity, nonce, ciphertext, next) }, next);
+}
+async function currentSeq(identity) {
+    const raw = await readRaw(identity.storageDir);
+    const seq = raw === undefined ? undefined : parse(raw).seq;
+    return typeof seq === "number" ? seq : 0;
 }
 /**
  * One-time, explicit opt-in (issue #43/ADR 0027) to encrypt `trust.json`'s
@@ -200,13 +306,15 @@ async function writeTrustStore4(identity, entries) {
  * is not implicitly adopted here — call `migrateLegacyTrustStore` first, same
  * as reading it would require.
  */
-export async function migrateTrustStoreToEncrypted(identity) {
-    const raw = await readRaw(identity.storageDir);
-    const current = raw === undefined ? undefined : parse(raw);
-    const entries = await readTrustStore(identity); // verifies/decrypts whichever format; throws on a legacy or tampered file
-    if (isV4(current))
-        return; // already encrypted — true no-op, same spirit as migrateLegacyTrustStore's
-    await writeTrustStore4(identity, entries);
+export function migrateTrustStoreToEncrypted(identity) {
+    return serialized(identity, async () => {
+        const raw = await readRaw(identity.storageDir);
+        const current = raw === undefined ? undefined : parse(raw);
+        const entries = await readTrustStore(identity); // verifies/decrypts whichever format; throws on a legacy or tampered file
+        if (isV4(current))
+            return; // already encrypted — true no-op, same spirit as migrateLegacyTrustStore's
+        await writeTrustStore4(identity, entries);
+    });
 }
 /**
  * One-time, explicit adoption of a trust.json written before trust-store
@@ -218,18 +326,20 @@ export async function migrateTrustStoreToEncrypted(identity) {
  * adopted; returns 0 and changes nothing if the file is missing or already
  * authenticated (a modified authenticated file still throws).
  */
-export async function migrateLegacyTrustStore(identity) {
-    const raw = await readRaw(identity.storageDir);
-    if (raw === undefined)
-        return 0;
-    const data = parse(raw);
-    if (isV3(data) || isV4(data)) {
-        await readTrustStore(identity); // verifies (and decrypts, for v4); throws if tampered
-        return 0;
-    }
-    const entries = legacyEntries(data);
-    await writeTrustStore(identity, entries);
-    return Object.keys(entries).length;
+export function migrateLegacyTrustStore(identity) {
+    return serialized(identity, async () => {
+        const raw = await readRaw(identity.storageDir);
+        if (raw === undefined)
+            return 0;
+        const data = parse(raw);
+        if (isV3(data) || isV4(data)) {
+            await readTrustStore(identity); // verifies (and decrypts, for v4); throws if tampered
+            return 0;
+        }
+        const entries = legacyEntries(data);
+        await writeTrustStore(identity, entries);
+        return Object.keys(entries).length;
+    });
 }
 /**
  * Records another party's public card as trusted, keyed by the card's
@@ -241,10 +351,13 @@ export async function migrateLegacyTrustStore(identity) {
  *
  * Trusting a card again after it was revoked reinstates it (clears revokedAt).
  */
-export async function trustParty(identity, card) {
-    const entries = await readTrustStore(identity);
-    entries[fingerprint(card)] = { card, trustedAt: new Date().toISOString() };
-    await writeTrustStore(identity, entries);
+export function trustParty(identity, card) {
+    return serialized(identity, async () => {
+        const entries = await readTrustStore(identity);
+        entries[fingerprint(card)] = { card, trustedAt: new Date().toISOString() };
+        await writeTrustStore(identity, entries);
+        await appendLogEntry(identity, { action: "trust", counterpartAlias: card.alias });
+    });
 }
 /**
  * Revokes every currently-trusted card recorded under `alias` — e.g. after a
@@ -253,14 +366,17 @@ export async function trustParty(identity, card) {
  * lost, and so verify() can report "revoked-signer" distinctly from
  * "untrusted-signer" (never trusted at all).
  */
-export async function untrustParty(identity, alias) {
-    const entries = await readTrustStore(identity);
-    const revokedAt = new Date().toISOString();
-    for (const record of Object.values(entries)) {
-        if (record.card.alias === alias && !record.revokedAt)
-            record.revokedAt = revokedAt;
-    }
-    await writeTrustStore(identity, entries);
+export function untrustParty(identity, alias) {
+    return serialized(identity, async () => {
+        const entries = await readTrustStore(identity);
+        const revokedAt = new Date().toISOString();
+        for (const record of Object.values(entries)) {
+            if (record.card.alias === alias && !record.revokedAt)
+                record.revokedAt = revokedAt;
+        }
+        await writeTrustStore(identity, entries);
+        await appendLogEntry(identity, { action: "untrust", counterpartAlias: alias });
+    });
 }
 /**
  * Revokes exactly one card, identified by its `fingerprint(card)` string
@@ -269,16 +385,19 @@ export async function untrustParty(identity, alias) {
  * Returns true if a currently-trusted record was revoked, false if no such
  * trusted record exists (a typo'd fingerprint is reported, not ignored).
  */
-export async function untrustFingerprint(identity, fingerprintValue) {
+export function untrustFingerprint(identity, fingerprintValue) {
     const normalize = (value) => value.replace(/\s+/g, "").toUpperCase();
     const wanted = normalize(fingerprintValue);
-    const entries = await readTrustStore(identity);
-    const key = Object.keys(entries).find((candidate) => normalize(candidate) === wanted);
-    if (key === undefined || entries[key].revokedAt)
-        return false;
-    entries[key].revokedAt = new Date().toISOString();
-    await writeTrustStore(identity, entries);
-    return true;
+    return serialized(identity, async () => {
+        const entries = await readTrustStore(identity);
+        const key = Object.keys(entries).find((candidate) => normalize(candidate) === wanted);
+        if (key === undefined || entries[key].revokedAt)
+            return false;
+        entries[key].revokedAt = new Date().toISOString();
+        await writeTrustStore(identity, entries);
+        await appendLogEntry(identity, { action: "untrust", counterpartAlias: entries[key].card.alias });
+        return true;
+    });
 }
 /** Every currently-trusted (non-revoked) card. */
 export async function listTrustedParties(identity) {
@@ -346,7 +465,8 @@ export async function trustSignedCard(identity, card, certificate) {
  * NEW identity, to get a complete, dual-signed RotationStatement — a single
  * signature from the old key alone is never enough to redirect a peer's
  * trust (see `applyRotation`), so this function's output is not yet usable
- * on its own.
+ * on its own. Even a dual-signed statement is only as trustworthy as the new
+ * fingerprint the receiver confirms out of band (`applyRotation`).
  */
 export async function beginRotation(oldIdentity, newCard, options = {}) {
     const rotatedAt = options.rotatedAt ?? new Date().toISOString();
@@ -359,8 +479,11 @@ export async function beginRotation(oldIdentity, newCard, options = {}) {
 /**
  * Finishes a key rotation: the NEW identity signs the SAME document
  * `beginRotation` produced, proving the new key exists and agrees to be
- * named as successor — not just asserted unilaterally by whoever holds the
- * old key (which could be an attacker who compromised it alone).
+ * named as successor. This proves the statement's author controls the new
+ * key; it does NOT prove the new key belongs to the real owner — an attacker
+ * who stole the old key can mint their own "new" identity and complete the
+ * statement themselves. Receivers close that gap with `applyRotation`'s
+ * out-of-band `confirmNewFingerprint`.
  */
 export async function completeRotation(newIdentity, draft) {
     const newCertificate = await signCore(newIdentity, draft.document);
@@ -374,8 +497,19 @@ export async function completeRotation(newIdentity, draft) {
  * fingerprint). A statement for a card you never trusted is a no-op — this
  * is not a way to seed your trust store with a card you never decided to
  * trust in the first place.
+ *
+ * `options.confirmNewFingerprint` is REQUIRED: the new card's fingerprint as
+ * the real owner gave it to you over a channel the statement did not travel
+ * on (phone call, in person). Dual signatures alone only prove the author
+ * holds both keys; an attacker with a stolen old key supplies their own
+ * "new" key and signs both. Spacing and case are ignored when comparing.
+ * A mismatch returns `{ valid: false, reason: "fingerprint-mismatch" }` and
+ * changes nothing; a missing value throws (ADR 0029).
  */
-export async function applyRotation(identity, statement) {
+export async function applyRotation(identity, statement, options) {
+    if (typeof options?.confirmNewFingerprint !== "string" || options.confirmNewFingerprint.trim() === "") {
+        throw new Error("applyRotation requires options.confirmNewFingerprint: the new card's fingerprint, confirmed with its owner out of band (ADR 0029).");
+    }
     const { document, oldCertificate, newCertificate } = statement;
     const oldResult = await verifyCore(identity, document, oldCertificate, {
         checkTrust: async (signer) => (cardMatchesSigner(document.oldCard, signer) ? "trusted" : "untrusted"),
@@ -387,16 +521,24 @@ export async function applyRotation(identity, statement) {
     });
     if (!newResult.valid)
         return newResult;
-    const entries = await readTrustStore(identity);
-    const oldKey = fingerprint(document.oldCard);
-    const existing = entries[oldKey];
-    if (!existing || existing.revokedAt)
-        return { valid: true }; // nothing trusted to migrate from — no-op
-    const revokedAt = new Date().toISOString();
-    entries[oldKey] = { ...existing, revokedAt, rotatedTo: fingerprint(document.newCard) };
-    entries[fingerprint(document.newCard)] = { card: document.newCard, trustedAt: revokedAt };
-    await writeTrustStore(identity, entries);
-    return { valid: true };
+    const normalize = (value) => value.replace(/\s+/g, "").toUpperCase();
+    if (normalize(fingerprint(document.newCard)) !== normalize(options.confirmNewFingerprint)) {
+        return { valid: false, reason: "fingerprint-mismatch" };
+    }
+    // Signature checks above need no store access; only the read-modify-write is serialized.
+    return serialized(identity, async () => {
+        const entries = await readTrustStore(identity);
+        const oldKey = fingerprint(document.oldCard);
+        const existing = entries[oldKey];
+        if (!existing || existing.revokedAt)
+            return { valid: true }; // nothing trusted to migrate from — no-op
+        const revokedAt = new Date().toISOString();
+        entries[oldKey] = { ...existing, revokedAt, rotatedTo: fingerprint(document.newCard) };
+        entries[fingerprint(document.newCard)] = { card: document.newCard, trustedAt: revokedAt };
+        await writeTrustStore(identity, entries);
+        await appendLogEntry(identity, { action: "rotate", counterpartAlias: document.oldCard.alias });
+        return { valid: true };
+    });
 }
 /**
  * Produces a self-signed, portable revocation notice for `identity`'s own
@@ -435,13 +577,16 @@ export async function applyRevocationNotice(identity, notice) {
     });
     if (!result.valid)
         return result;
-    const entries = await readTrustStore(identity);
-    const key = fingerprint(document.revokedCard);
-    const existing = entries[key];
-    if (!existing || existing.revokedAt)
-        return { valid: true }; // nothing trusted to revoke — no-op
-    entries[key] = { ...existing, revokedAt: document.revokedAt };
-    await writeTrustStore(identity, entries);
-    return { valid: true };
+    return serialized(identity, async () => {
+        const entries = await readTrustStore(identity);
+        const key = fingerprint(document.revokedCard);
+        const existing = entries[key];
+        if (!existing || existing.revokedAt)
+            return { valid: true }; // nothing trusted to revoke — no-op
+        entries[key] = { ...existing, revokedAt: document.revokedAt };
+        await writeTrustStore(identity, entries);
+        await appendLogEntry(identity, { action: "revoke", counterpartAlias: document.revokedCard.alias });
+        return { valid: true };
+    });
 }
 //# sourceMappingURL=trust.js.map

package/dist/trust.js.map

@@ -1 +1 @@
-{"version":3,"file":"trust.js","sourceRoot":"","sources":["../src/trust.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACvG,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAuC,MAAM,oBAAoB,CAAC;AAClH,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAkC,MAAM,eAAe,CAAC;AAwCrF;;;;;;;GAOG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,qBAAqB,GAAG,WAAW,CAAC,qCAAqC,CAAC,CAAC;AACjF,2EAA2E;AAC3E,4EAA4E;AAC5E,cAAc;AACd,MAAM,oBAAoB,GAAG,WAAW,CAAC,oCAAoC,CAAC,CAAC;AAE/E,SAAS,aAAa,CAAC,UAAkB;IACvC,OAAO,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,QAAkB;IAC7C,OAAO,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAC;AACnI,CAAC;AAED,gLAAgL;AAChL,SAAS,sBAAsB,CAAC,QAAkB;IAChD,OAAO,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;AAClI,CAAC;AAED,SAAS,UAAU,CAAC,QAAkB,EAAE,OAAgB;IACtD,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACrH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,QAAkB,EAAE,OAAgB,EAAE,GAAY;IAC3E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzE,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,4JAA4J;AAC5J,SAAS,YAAY,CAAC,QAAkB,EAAE,KAAa,EAAE,UAAkB;IACzE,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/H,CAAC;AAED,SAAS,YAAY,CAAC,QAAkB,EAAE,KAAa,EAAE,UAAkB,EAAE,GAAY;IACvF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzE,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,qJAAqJ;AACrJ,SAAS,UAAU,CAAC,OAAU,EAAE,KAAa;IAC3C,OAAO,WAAW,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,cAAc,CAAC,QAAkB,EAAE,OAAgB;IAC1D,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,GAAG,CAAC,sBAAsB,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrI,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,oIAAoI;AACpI,SAAS,cAAc,CAAC,QAAkB,EAAE,KAAa,EAAE,UAAkB;IAC3E,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,GAAG,CAAC,sBAAsB,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QACjI,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAY,CAAC;QAC3E,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACjJ,OAAO,OAAkB,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,wBAAwB,CAAC,wGAAwG,CAAC,CAAC;IAC/I,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,IAAa;IACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAK,IAA8B,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7G,MAAM,OAAO,GAAI,IAA8B,CAAC,OAAO,CAAC;IACxD,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,IAAI,CAAC,IAAa;IACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAK,IAA8B,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7G,MAAM,CAAC,GAAG,IAAgE,CAAC;IAC3E,OAAO,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACjK,CAAC;AAED,SAAS,IAAI,CAAC,IAAa;IACzB,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAK,IAA8B,CAAC,OAAO,KAAK,CAAC,CAAC;AACpG,CAAC;AAED,gHAAgH;AAChH,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IACpC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9C,wEAAwE;QACxE,mEAAmE;QACnE,iEAAiE;QACjE,MAAM,IAAI,wBAAwB,CAAC,0EAA0E,CAAC,CAAC;IACjH,CAAC;IACD,MAAM,OAAO,GAAY,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAkC,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAC7E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,UAAkB;IACvC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACvE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,GAAW;IACxB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,wBAAwB,CAAC,mDAAmD,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AAED,qLAAqL;AACrL,KAAK,UAAU,cAAc,CAAC,QAAkB;IAC9C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAEjC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACf,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,wBAAwB,CAAC,wGAAwG,CAAC,CAAC;QAC/I,CAAC;QACD,OAAO,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChB,MAAM,IAAI,wBAAwB,CAChC,qJAAqJ,CACtJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,wBAAwB,CAAC,wGAAwG,CAAC,CAAC;IAC/I,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAkB,EAAE,KAAkC;IAClF,MAAM,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1E,MAAM,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAAC,QAAkB,EAAE,OAAgB;IACjE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAClB,MAAM,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1C,OAAO;IACT,CAAC;IACD,MAAM,cAAc,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,QAAkB,EAAE,OAAgB;IAClE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChE,MAAM,cAAc,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;AACpH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,QAAkB;IACnE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,0EAA0E;IAC1H,IAAI,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,2EAA2E;IACtG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,QAAkB;IAC9D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,sDAAsD;QACtF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAkB,EAAE,IAAgB;IACnE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC/C,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAC3E,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAkB,EAAE,KAAa;IAClE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IACrF,CAAC;IACD,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAkB,EAAE,gBAAwB;IACnF,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7E,MAAM,MAAM,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,CAAC;IACtF,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kDAAkD;AAClD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAkB;IACzD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;SAC1B,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;SACrC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAkB;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAkB,EAAE,KAAa;IACrE,OAAO,CAAC,MAAM,wBAAwB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,QAAkB,EAAE,KAAa;IAC9E,OAAO,CAAC,MAAM,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;SACnD,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;SACrC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAAkB,EAAE,KAAa;IAC5E,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AACvG,CAAC;AAED,2EAA2E;AAC3E,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,4EAA4E;AAC5E,2EAA2E;AAC3E,0EAA0E;AAC1E,0EAA0E;AAE1E,oJAAoJ;AACpJ,SAAS,iBAAiB,CAAC,IAAgB,EAAE,MAA+E;IAC1H,OAAO,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,kBAAkB,KAAK,MAAM,CAAC,kBAAkB,IAAI,IAAI,CAAC,gBAAgB,KAAK,MAAM,CAAC,gBAAgB,CAAC;AACnJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAkB,EAAE,IAAgB,EAAE,WAAwB;IAClG,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE;QAC3D,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;KAC1F,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,KAAK;QAAE,MAAM,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC;AAChB,CAAC;AAcD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,WAAqB,EACrB,OAAmB,EACnB,UAAkC,EAAE;IAEpC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChE,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yGAAyG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAE1L,MAAM,QAAQ,GAAqB,EAAE,OAAO,EAAE,oBAAoB,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACtG,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC7D,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAqB,EACrB,KAAkE;IAElE,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,cAAc,EAAE,CAAC;AAC5F,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAkB,EAAE,SAA4B;IAClF,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,SAAS,CAAC;IAE/D,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE;QACrE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;KACtG,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE;QACrE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;KACtG,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,0CAA0C;IAEvG,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;IACvF,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAC1F,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAcD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAAkB,EAAE,UAA+B,EAAE;IAChG,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAuB;QACnC,WAAW,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QAC3C,SAAS;QACT,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACvD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,QAAkB,EAAE,MAAwB;IACtF,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IACzC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAErG,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE;QAC/D,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;KAC1G,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC;IAEjC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,oCAAoC;IAEjG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;IAC9D,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC"}
+{"version":3,"file":"trust.js","sourceRoot":"","sources":["../src/trust.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACvG,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAuC,MAAM,oBAAoB,CAAC;AAClH,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAkC,MAAM,eAAe,CAAC;AACrF,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA2C5C;;;;;;;GAOG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,qBAAqB,GAAG,WAAW,CAAC,qCAAqC,CAAC,CAAC;AACjF,2EAA2E;AAC3E,4EAA4E;AAC5E,cAAc;AACd,MAAM,oBAAoB,GAAG,WAAW,CAAC,oCAAoC,CAAC,CAAC;AAC/E,+DAA+D;AAC/D,MAAM,oBAAoB,GAAG,WAAW,CAAC,oCAAoC,CAAC,CAAC;AAE/E,SAAS,aAAa,CAAC,UAAkB;IACvC,OAAO,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,QAAkB;IAC7C,OAAO,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAC;AACnI,CAAC;AAED,gLAAgL;AAChL,SAAS,sBAAsB,CAAC,QAAkB;IAChD,OAAO,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;AAClI,CAAC;AAED,0GAA0G;AAC1G,SAAS,UAAU,CAAC,QAAkB,EAAE,OAAgB,EAAE,GAAY;IACpE,MAAM,IAAI,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IACxF,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAClG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,QAAkB,EAAE,OAAgB,EAAE,GAAY,EAAE,GAAY;IACzF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzE,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AACrF,CAAC;AAED,4JAA4J;AAC5J,SAAS,YAAY,CAAC,QAAkB,EAAE,KAAa,EAAE,UAAkB,EAAE,GAAY;IACvF,MAAM,IAAI,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAC5G,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,YAAY,CAAC,QAAkB,EAAE,KAAa,EAAE,UAAkB,EAAE,GAAY,EAAE,GAAY;IACrG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzE,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,qJAAqJ;AACrJ,SAAS,UAAU,CAAC,OAAU,EAAE,KAAa;IAC3C,OAAO,WAAW,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,cAAc,CAAC,QAAkB,EAAE,OAAgB;IAC1D,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,GAAG,CAAC,sBAAsB,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrI,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,oIAAoI;AACpI,SAAS,cAAc,CAAC,QAAkB,EAAE,KAAa,EAAE,UAAkB;IAC3E,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,GAAG,CAAC,sBAAsB,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QACjI,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAY,CAAC;QAC3E,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACjJ,OAAO,OAAkB,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,wBAAwB,CAAC,wGAAwG,CAAC,CAAC;IAC/I,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,IAAa;IACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAK,IAA8B,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7G,MAAM,OAAO,GAAI,IAA8B,CAAC,OAAO,CAAC;IACxD,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAE,IAA0B,CAAC,GAAG,CAAC,CAAC;AACjI,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY;IAC5B,OAAO,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,IAAI,CAAC,IAAa;IACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAK,IAA8B,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7G,MAAM,CAAC,GAAG,IAAgE,CAAC;IAC3E,OAAO,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAE,IAA0B,CAAC,GAAG,CAAC,CAAC;AAC9M,CAAC;AAED,SAAS,IAAI,CAAC,IAAa;IACzB,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAK,IAA8B,CAAC,OAAO,KAAK,CAAC,CAAC;AACpG,CAAC;AAED,gHAAgH;AAChH,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IACpC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9C,wEAAwE;QACxE,mEAAmE;QACnE,iEAAiE;QACjE,MAAM,IAAI,wBAAwB,CAAC,0EAA0E,CAAC,CAAC;IACjH,CAAC;IACD,MAAM,OAAO,GAAY,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAkC,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAC7E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,UAAkB;IACvC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACvE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,GAAW;IACxB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,wBAAwB,CAAC,mDAAmD,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,GACpB,wMAAwM,CAAC;AAE3M,SAAS,WAAW,CAAC,UAAkB;IACrC,OAAO,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;AAC5C,CAAC;AASD,SAAS,aAAa,CAAC,QAAkB,EAAE,GAAW,EAAE,QAAgB;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;IACrI,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,sIAAsI;AACtI,KAAK,UAAU,aAAa,CAAC,QAAkB;IAC7C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACvE,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,wBAAwB,CAAC,gGAAgG,CAAC,CAAC;IACjJ,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,EAAE,CAAC;IACd,CAAC;IACD,MAAM,CAAC,GAAG,IAAiC,CAAC;IAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,MAAM,GAAG,EAAE,CAAC;IAC9J,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,MAAM,GAAG,EAAE,CAAC;IACxG,OAAO,CAAc,CAAC;AACxB,CAAC;AAUD;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAAC,QAAkB;IAC9C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IAE/D,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,KAAiB,CAAC;IACtB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACf,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,wBAAwB,CAAC,wGAAwG,CAAC,CAAC;QAC/I,CAAC;QACD,KAAK,GAAG,EAAE,OAAO,EAAE,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IAChH,CAAC;SAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,wBAAwB,CAChC,qJAAqJ,CACtJ,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,wBAAwB,CAAC,wGAAwG,CAAC,CAAC;QAC/I,CAAC;QACD,KAAK,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,yGAAyG;QACzG,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC;YAAE,MAAM,IAAI,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;IAC1E,CAAC;SAAM,IAAI,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjG,MAAM,IAAI,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAkB;IAC9C,OAAO,CAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;AAClD,CAAC;AAQD,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAkB;IAC1D,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IACpD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAAkB,EAAE,MAAwB;IACvF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,wBAAwB,CAAC,yFAAyF,CAAC,CAAC;IAChI,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAkB,EAAE,KAAkC,EAAE,GAAW;IAC/F,qFAAqF;IACrF,kFAAkF;IAClF,MAAM,eAAe,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1F,iHAAiH;IACjH,MAAM,MAAM,GAAc,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;IACjH,MAAM,eAAe,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,EAAyB,CAAC;AAExD,SAAS,UAAU,CAAI,QAAkB,EAAE,IAAsB;IAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CACnB,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;IACF,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9B,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;QAClB,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI;YAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAAC,QAAkB,EAAE,OAAgB;IACjE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,CAAE,OAAyC,EAAE,GAAyB,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7F,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAClB,MAAM,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IACD,MAAM,cAAc,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;AAC7G,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,QAAkB,EAAE,OAAgB,EAAE,GAAY;IAChF,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC;IACrD,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChE,MAAM,cAAc,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;AAC3I,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAkB;IAC1C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,KAAK,CAAC,GAAG,CAAuB,CAAC,GAAG,CAAC;IAClF,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,QAAkB;IAC7D,OAAO,UAAU,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QACrC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,0EAA0E;QAC1H,IAAI,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,2EAA2E;QACtG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAkB;IACxD,OAAO,UAAU,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QACrC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,sDAAsD;YACtF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACzC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,QAAkB,EAAE,IAAgB;IAC7D,OAAO,UAAU,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QACrC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC/C,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3E,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACzC,MAAM,cAAc,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,QAAkB,EAAE,KAAa;IAC5D,OAAO,UAAU,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QACrC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5C,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;QACrF,CAAC;QACD,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACzC,MAAM,cAAc,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAkB,EAAE,gBAAwB;IAC7E,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7E,MAAM,MAAM,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC3C,OAAO,UAAU,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QACrC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,CAAC;QACtF,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAClD,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACzC,MAAM,cAAc,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACjG,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,kDAAkD;AAClD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAkB;IACzD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;SAC1B,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;SACrC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAkB;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAkB,EAAE,KAAa;IACrE,OAAO,CAAC,MAAM,wBAAwB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,QAAkB,EAAE,KAAa;IAC9E,OAAO,CAAC,MAAM,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;SACnD,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;SACrC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAAkB,EAAE,KAAa;IAC5E,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AACvG,CAAC;AAED,2EAA2E;AAC3E,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,4EAA4E;AAC5E,2EAA2E;AAC3E,0EAA0E;AAC1E,0EAA0E;AAE1E,oJAAoJ;AACpJ,SAAS,iBAAiB,CAAC,IAAgB,EAAE,MAA+E;IAC1H,OAAO,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,kBAAkB,KAAK,MAAM,CAAC,kBAAkB,IAAI,IAAI,CAAC,gBAAgB,KAAK,MAAM,CAAC,gBAAgB,CAAC;AACnJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAkB,EAAE,IAAgB,EAAE,WAAwB;IAClG,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE;QAC3D,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;KAC1F,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,KAAK;QAAE,MAAM,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC;AAChB,CAAC;AAcD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,WAAqB,EACrB,OAAmB,EACnB,UAAkC,EAAE;IAEpC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChE,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yGAAyG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAE1L,MAAM,QAAQ,GAAqB,EAAE,OAAO,EAAE,oBAAoB,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACtG,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC7D,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAqB,EACrB,KAAkE;IAElE,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,cAAc,EAAE,CAAC;AAC5F,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAkB,EAClB,SAA4B,EAC5B,OAA0C;IAE1C,IAAI,OAAO,OAAO,EAAE,qBAAqB,KAAK,QAAQ,IAAI,OAAO,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACtG,MAAM,IAAI,KAAK,CAAC,oIAAoI,CAAC,CAAC;IACxJ,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,SAAS,CAAC;IAE/D,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE;QACrE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;KACtG,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE;QACrE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;KACtG,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7E,IAAI,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,SAAS,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAC1F,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC1D,CAAC;IAED,yFAAyF;IACzF,OAAO,UAAU,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QACrC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAkB,CAAC,CAAC,0CAA0C;QAEvH,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvF,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QAC1F,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACzC,MAAM,cAAc,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/F,OAAO,EAAE,KAAK,EAAE,IAAI,EAAkB,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC;AAcD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAAkB,EAAE,UAA+B,EAAE;IAChG,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAuB;QACnC,WAAW,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QAC3C,SAAS;QACT,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACvD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,QAAkB,EAAE,MAAwB;IACtF,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IACzC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAErG,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE;QAC/D,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;KAC1G,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC;IAEjC,OAAO,UAAU,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QACrC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAkB,CAAC,CAAC,oCAAoC;QAEjH,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC9D,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACzC,MAAM,cAAc,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;QACnG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAkB,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "raz-encrypt",
-  "version": "2.1.0",
+  "version": "2.4.0",
   "description": "Local-first, hybrid classical+post-quantum signing and verification for two consenting parties. No server, no database required.",
   "license": "MIT",
   "type": "module",
@@ -32,7 +32,9 @@
     "demo:verify": "tsx demo/verify-as-bob.ts",
     "demo:tamper": "tsx demo/verify-as-bob.ts --tamper",
     "demo:clean": "rm -rf demo/.alice-store demo/.bob-store demo/alice-card.json demo/bob-card.json demo/signed-doc.json",
-    "prepublishOnly": "npm run typecheck && npm test && npm run build"
+    "prepublishOnly": "npm run typecheck && npm test && npm run build",
+    "lint": "eslint src",
+    "sbom": "cyclonedx-npm --omit dev --output-file sbom.cdx.json"
   },
   "dependencies": {
     "@noble/ciphers": "2.4.0",
@@ -41,10 +43,15 @@
     "@noble/post-quantum": "0.7.1"
   },
   "devDependencies": {
+    "@cyclonedx/cyclonedx-npm": "6.0.1",
+    "@eslint/js": "10.0.1",
     "@types/node": "^26.6.4",
+    "eslint": "10.12.0",
+    "eslint-plugin-security": "4.2.0",
     "fast-check": "^4.10.2",
     "tsx": "^4.19.2",
     "typescript": "^5.7.2",
+    "typescript-eslint": "8.71.1",
     "vitest": "^5.0.0"
   },
   "repository": {
@@ -56,7 +63,6 @@
   },
   "homepage": "https://github.com/razmans/raz-encrypt#readme",
   "publishConfig": {
-    "access": "public",
-    "provenance": true
+    "access": "public"
   }
 }