zklicensing 0.1.0-beta.2 → 0.1.0-beta.21

package/build/onChainRoot.js

@@ -0,0 +1,74 @@
+// Copyright (c) 2025-2026 zkLicensing project developers
+// SPDX-License-Identifier: BUSL-1.1
+/**
+ * onChainRoot.ts
+ *
+ * Non-custodial trust anchor for `verifyOffline`. Reads the live
+ * `licensesRoot` (`zkapp.appState[0]`) directly from Mina — no
+ * licensing-service round-trip, no trust assumption about whoever
+ * served the witness / license record.
+ *
+ * Pair it with `verifyOffline` to close the trust loop:
+ *
+ *   ```ts
+ *   import { fetchOnChainLicensesRoot } from 'zklicensing/on-chain-root';
+ *   import { verifyOffline }            from 'zklicensing/verify-offline';
+ *
+ *   // 1. Ask the licensing service for a witness + slot snapshot.
+ *   const snap = await fetch(`${service}/witness?licenseHash=${h}&zkAppAddress=${a}`).then(r => r.json());
+ *
+ *   // 2. Fetch the on-chain root INDEPENDENTLY, from Mina.
+ *   const onChainRoot = await fetchOnChainLicensesRoot({ zkAppAddress: a, network: 'devnet' });
+ *
+ *   // 3. Cross-check — if they disagree, the service is stale/wrong; bail.
+ *   if (snap.root !== onChainRoot) throw new Error('service root disagrees with chain');
+ *
+ *   // 4. Fold-verify the snapshot against the on-chain root.
+ *   const res = verifyOffline({ licensesRoot: onChainRoot, ...snap });
+ *   ```
+ *
+ * The read goes to the node's GraphQL API directly: no o1js is needed
+ * and o1js's global Mina instance is never touched, so it is safe in
+ * long-lived hosts that talk to several networks.
+ */
+// Default read-only public Mina GraphQL endpoints. Devnet points at
+// o1Labs' Mesa cluster (the current stable devnet node published at
+// devnet-plain-1.gcp.o1test.net); mainnet uses Minascan's public node.
+// Neither requires auth or a rate-limit key. Vendors who prefer their
+// own Mina node can override via `graphqlUrl` on the input.
+export const DEFAULT_MINA_GRAPHQL_URLS = {
+    mainnet: 'https://api.minascan.io/node/mainnet/v1/graphql',
+    devnet: 'https://devnet-plain-1.gcp.o1test.net/graphql',
+};
+/**
+ * Read the live `licensesRoot` from the deployed LicensingApp's
+ * on-chain state. Returns the field value as a decimal string,
+ * matching the shape `verifyOffline` and the licensing service both
+ * consume.
+ *
+ * Throws on any of:
+ *   - `fetchAccount` returned an error (network down, wrong endpoint,
+ *     account doesn't exist on this chain);
+ *   - account exists but has no zkApp state (not a zkApp address, or
+ *     contract deployed but `initialize()` never ran).
+ */
+export async function fetchOnChainLicensesRoot(input) {
+    const { zkAppAddress } = input;
+    const network = input.network ?? 'devnet';
+    const graphqlUrl = input.graphqlUrl ?? DEFAULT_MINA_GRAPHQL_URLS[network];
+    // Over the node's GraphQL API: no o1js, no global Mina instance.
+    const { readZkappAccount } = await import('./chainHead.js');
+    let account;
+    try {
+        account = await readZkappAccount({ address: zkAppAddress, graphqlUrl });
+    }
+    catch (e) {
+        throw new Error(`fetchAccount(${zkAppAddress}) via ${graphqlUrl} failed: ${e?.message ?? e}`);
+    }
+    const root = account.found ? account.appState?.[0] : undefined;
+    if (!root) {
+        throw new Error(`zkApp ${zkAppAddress} has no appState — is the LicensingApp deployed and initialized on ${network}?`);
+    }
+    return root;
+}
+//# sourceMappingURL=onChainRoot.js.map

package/build/onChainRoot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onChainRoot.js","sourceRoot":"","sources":["../src/onChainRoot.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,oCAAoC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,oEAAoE;AACpE,oEAAoE;AACpE,uEAAuE;AACvE,sEAAsE;AACtE,4DAA4D;AAC5D,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,OAAO,EAAE,iDAAiD;IAC1D,MAAM,EAAG,+CAA+C;CAChD,CAAC;AAYX;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAoC;IAEpC,MAAM,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IAC/B,MAAM,OAAO,GAAgB,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC;IACvD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAE1E,iEAAiE;IACjE,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,gBAAgB,YAAY,SAAS,UAAU,YAAY,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,SAAS,YAAY,sEAAsE,OAAO,GAAG,CACtG,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/build/ownershipLicenseHash.d.ts

@@ -0,0 +1,25 @@
+/**
+ * ownershipLicenseHash.ts
+ *
+ * Field-side binding between the buyer's Pallas Schnorr pubkey and the
+ * `licenseHash` Field stored on-chain. The buy circuit and the buy client
+ * both compute this from the pubkey and assert equality — that mutual
+ * assertion is what proves knowledge of the passphrase without ever
+ * showing the passphrase to the network.
+ *
+ * A Pallas `PublicKey` is `(x: Field, isOdd: Bool)` — the two Fields that
+ * uniquely identify the compressed point. Poseidon-hashing them yields a
+ * single Field that matches the on-chain shape of every other `licenseHash`
+ * used by LicensingApp (which treats licenseHash as an opaque Field
+ * commitment, not a specific preimage).
+ */
+import { PublicKey } from 'o1js';
+/**
+ * Derive the Field-side `licenseHash` from a Pallas Schnorr pubkey. The
+ * hash is domain-free because the whole platform treats `licenseHash` as
+ * an opaque commitment — the on-chain contract never re-derives it from
+ * a preimage, so there's no cross-preimage collision surface to guard
+ * against here.
+ */
+export declare function licenseHashFromPubkey(publicKey: PublicKey): string;
+//# sourceMappingURL=ownershipLicenseHash.d.ts.map

package/build/ownershipLicenseHash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownershipLicenseHash.d.ts","sourceRoot":"","sources":["../src/ownershipLicenseHash.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAY,SAAS,EAAE,MAAM,MAAM,CAAC;AAE3C;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,CAElE"}

package/build/ownershipLicenseHash.js

@@ -0,0 +1,29 @@
+// Copyright (c) 2025-2026 zkLicensing project developers
+// SPDX-License-Identifier: BUSL-1.1
+/**
+ * ownershipLicenseHash.ts
+ *
+ * Field-side binding between the buyer's Pallas Schnorr pubkey and the
+ * `licenseHash` Field stored on-chain. The buy circuit and the buy client
+ * both compute this from the pubkey and assert equality — that mutual
+ * assertion is what proves knowledge of the passphrase without ever
+ * showing the passphrase to the network.
+ *
+ * A Pallas `PublicKey` is `(x: Field, isOdd: Bool)` — the two Fields that
+ * uniquely identify the compressed point. Poseidon-hashing them yields a
+ * single Field that matches the on-chain shape of every other `licenseHash`
+ * used by LicensingApp (which treats licenseHash as an opaque Field
+ * commitment, not a specific preimage).
+ */
+import { Poseidon } from 'o1js';
+/**
+ * Derive the Field-side `licenseHash` from a Pallas Schnorr pubkey. The
+ * hash is domain-free because the whole platform treats `licenseHash` as
+ * an opaque commitment — the on-chain contract never re-derives it from
+ * a preimage, so there's no cross-preimage collision surface to guard
+ * against here.
+ */
+export function licenseHashFromPubkey(publicKey) {
+    return Poseidon.hash([publicKey.x, publicKey.isOdd.toField()]).toString();
+}
+//# sourceMappingURL=ownershipLicenseHash.js.map

package/build/ownershipLicenseHash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownershipLicenseHash.js","sourceRoot":"","sources":["../src/ownershipLicenseHash.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,oCAAoC;AAEpC;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,QAAQ,EAAa,MAAM,MAAM,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAoB;IACxD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC5E,CAAC"}

package/build/ownershipSignature.d.ts

@@ -0,0 +1,153 @@
+/**
+ * ownershipSignature.ts
+ *
+ * Schnorr-over-Pallas signing primitive for the two on-chain flows that
+ * need the passphrase-derived owner key:
+ *
+ *  1. The /prove/bind and /prove/unbind flows — the passphrase-derived
+ *     keypair authorizes device slot mutations, and the signature is
+ *     re-verified INSIDE the circuit by `Signature.verify()` so even a
+ *     compromised licensing service cannot forge a bind.
+ *  2. The retained `ActivationMessage` shape (see below) — kept so external
+ *     tooling can still sign an "I hold the passphrase for this license"
+ *     assertion off-band. The platform no longer runs a challenge/respond
+ *     endpoint; the shape is purely an SDK primitive now.
+ *
+ * Deterministic HKDF-SHA256 derivation of a seed from the passphrase,
+ * reduced to a Pallas scalar → o1js `PrivateKey`. The buyer can
+ * re-derive the same keypair anywhere from just the passphrase.
+ *
+ * o1js-dependent by design: the whole point of switching from Ed25519 to
+ * Pallas Schnorr is native in-circuit verification. Any client that
+ * signs an activation or binding challenge already ships o1js for the
+ * downstream buy/verify surface, so the "keep this module o1js-free"
+ * constraint that motivated the Ed25519 version no longer applies.
+ *
+ * HKDF still needs WebCrypto (Node ≥ 20, Chromium 137+, Safari 17+,
+ * Firefox 130+). The module throws at derive time if
+ * `globalThis.crypto.subtle` is unavailable — callers cannot silently
+ * fall back to a weaker path.
+ */
+import { Field, PrivateKey, PublicKey, Signature } from 'o1js';
+export declare const TAG_ACTIVATION = 1n;
+export declare const TAG_BINDING = 2n;
+export declare const TAG_UNBINDING = 3n;
+/**
+ * HKDF-SHA256 with empty salt and a per-app domain-separation info
+ * string (`zkLicensing/v1/ownership|<zkAppAddress>`). Deterministic:
+ * same (passphrase, zkAppAddress) → same 32-byte seed. Different
+ * zkAppAddress → cryptographically unrelated seed even with the same
+ * passphrase.
+ */
+export declare function deriveSeed(passphrase: string, zkAppAddress: string): Promise<Uint8Array>;
+export type OwnershipKeypair = {
+    privateKey: PrivateKey;
+    publicKey: PublicKey;
+    publicKeyBase58: string;
+};
+/**
+ * Derive a Pallas Schnorr keypair deterministically from (passphrase,
+ * zkAppAddress). The keypair is bound to the specific app: the same
+ * passphrase used against a different app yields a different keypair,
+ * so a leaked passphrase cannot be replayed as an activation for any
+ * other app.
+ *
+ * The 32-byte HKDF output is interpreted as a big-endian integer and
+ * passed to `PrivateKey.fromBigInt`, which reduces it modulo the Pallas
+ * scalar field order internally. All 2^256 possible HKDF outputs map to
+ * valid private keys with (256 - log2(Fq_order))-bit modular bias — the
+ * scalar field is ~254 bits, so bias is <2^-253 and lies well below any
+ * practical distinguisher.
+ */
+export declare function deriveOwnershipKeypair(passphrase: string, zkAppAddress: string): Promise<OwnershipKeypair>;
+/**
+ * The ownership keypair of license `licenseHash`, trying each candidate app
+ * address in turn. The key is derived from the address the license was
+ * issued on; after a redeploy the license carries over to the successor
+ * unchanged, so its key is the earlier generation's. Pass the app's
+ * generation addresses (any order; the live one first is cheapest for new
+ * licenses). A wrong address only gives a key that doesn't match, so the
+ * list needn't be authenticated. Null when none matches (another passphrase).
+ */
+export declare function findOwnershipKeypair(passphrase: string, licenseHash: string, candidateAddresses: readonly string[]): Promise<(OwnershipKeypair & {
+    zkAppAddress: string;
+}) | null>;
+/**
+ * The addresses of every generation of the app at `zkAppAddress` (any of
+ * them), live first, from the keeper's generation list; just
+ * `zkAppAddress` when the keeper doesn't know it. For findOwnershipKeypair.
+ */
+export declare function ownershipCandidateAddresses(keeperUrl: string, zkAppAddress: string, fetcher?: typeof fetch): Promise<string[]>;
+/**
+ * Activation assertion shape. Proves the caller holds the passphrase
+ * that derived the license's ownerPubKey. Retained as an SDK primitive
+ * so external tooling can still request / verify an off-band "I own
+ * this license" signature — the on-chain flows themselves do not use
+ * it.
+ */
+export type ActivationMessage = {
+    licenseHash: string;
+    nonce: string;
+    zkAppAddress: string;
+};
+/**
+ * Binding / unbinding message — the /prove/bind and /prove/unbind
+ * flows. Authorizes a specific device commitment being placed into or
+ * cleared from a specific slot on a specific license.
+ */
+export type BindingMessage = {
+    licenseHash: string;
+    deviceCommitment: string;
+    slotIndex: number;
+    nonce: string;
+    slotState: string;
+    expirySlot: number;
+    zkAppAddress: string;
+};
+/**
+ * Packed (boundAt, freedAt) of one slot as the circuit sees it — the
+ * `slotState` a BindingMessage must commit to. Takes the slot entry from a
+ * LicenseRecord's `devices[]` (as served by GET /license/:zkApp/:hash);
+ * an absent entry is a pristine slot (0).
+ */
+export declare function slotStateOf(device?: {
+    boundAtSlot: number;
+    freedAtSlot: number;
+} | null): string;
+export type ChallengeMessage = ActivationMessage;
+/**
+ * Canonicalize the activation message into the Field[] that
+ * `Signature.create` / `Signature.verify` hash. The domain-separation
+ * tag prefix means no captured activation signature can be replayed as
+ * a binding signature, even if all other fields collide.
+ */
+export declare function activationMessageFields(msg: ActivationMessage): Field[];
+export declare function bindingMessageFields(msg: BindingMessage): Field[];
+export declare function unbindingMessageFields(msg: BindingMessage): Field[];
+export declare function signActivation(privateKey: PrivateKey, msg: ActivationMessage): Signature;
+export declare function signBinding(privateKey: PrivateKey, msg: BindingMessage): Signature;
+export declare function signUnbinding(privateKey: PrivateKey, msg: BindingMessage): Signature;
+export declare function signChallenge(privateKey: PrivateKey, msg: ChallengeMessage): Signature;
+/**
+ * Verify an activation signature. Returns false (never throws) for any
+ * failure — malformed pubkey, malformed signature, actual signature
+ * mismatch. Callers get a single go/no-go decision without having to
+ * distinguish "invalid" from "unparseable."
+ */
+export declare function verifyActivation(publicKey: PublicKey, msg: ActivationMessage, signature: Signature): boolean;
+export declare function verifyBinding(publicKey: PublicKey, msg: BindingMessage, signature: Signature): boolean;
+export declare function verifyUnbinding(publicKey: PublicKey, msg: BindingMessage, signature: Signature): boolean;
+export declare function verifyChallenge(publicKey: PublicKey, msg: ChallengeMessage, signature: Signature): boolean;
+/**
+ * Encode a signature for the wire (POST body, ProofFile JSON, etc).
+ * Base58 matches Mina's canonical serialization for both PublicKey and
+ * Signature, keeping the same encoding shape across everything the
+ * buyer's SDK produces.
+ */
+export declare function encodeSignature(sig: Signature): string;
+export declare function decodeSignature(base58: string): Signature;
+export declare function encodePublicKey(pk: PublicKey): string;
+export declare function decodePublicKey(base58: string): PublicKey;
+export declare function encodeBase64(bytes: Uint8Array): string;
+export declare function decodeBase64(b64: string): Uint8Array;
+//# sourceMappingURL=ownershipSignature.d.ts.map

package/build/ownershipSignature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownershipSignature.d.ts","sourceRoot":"","sources":["../src/ownershipSignature.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAU,MAAM,MAAM,CAAC;AA2BvE,eAAO,MAAM,cAAc,KAAK,CAAC;AACjC,eAAO,MAAM,WAAW,KAAQ,CAAC;AACjC,eAAO,MAAM,aAAa,KAAM,CAAC;AAuCjC;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,UAAU,EAAI,MAAM,EACpB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,UAAU,CAAC,CAoBrB;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,EAAO,UAAU,CAAC;IAC5B,SAAS,EAAQ,SAAS,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAI,MAAM,EACpB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,gBAAgB,CAAC,CAK3B;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,kBAAkB,EAAE,SAAS,MAAM,EAAE,GACpC,OAAO,CAAC,CAAC,gBAAgB,GAAG;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,CAAC,CAM/D;AAED;;;;GAIG;AACH,wBAAsB,2BAA2B,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,GAAE,OAAO,KAAa,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAU3I;AAID;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAG,MAAM,CAAC;IACrB,KAAK,EAAS,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,WAAW,EAAO,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAS,MAAM,CAAC;IACzB,KAAK,EAAa,MAAM,CAAC;IAIzB,SAAS,EAAS,MAAM,CAAC;IAIzB,UAAU,EAAQ,MAAM,CAAC;IACzB,YAAY,EAAM,MAAM,CAAC;CAC1B,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,MAAM,CAAC,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAC3D,MAAM,CAGR;AAKD,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAEjD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,iBAAiB,GAAG,KAAK,EAAE,CASvE;AAuBD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,KAAK,EAAE,CAEjE;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,cAAc,GAAG,KAAK,EAAE,CAEnE;AAID,wBAAgB,cAAc,CAC5B,UAAU,EAAE,UAAU,EACtB,GAAG,EAAE,iBAAiB,GACrB,SAAS,CAEX;AAED,wBAAgB,WAAW,CACzB,UAAU,EAAE,UAAU,EACtB,GAAG,EAAE,cAAc,GAClB,SAAS,CAEX;AAED,wBAAgB,aAAa,CAC3B,UAAU,EAAE,UAAU,EACtB,GAAG,EAAE,cAAc,GAClB,SAAS,CAEX;AAID,wBAAgB,aAAa,CAC3B,UAAU,EAAE,UAAU,EACtB,GAAG,EAAE,gBAAgB,GACpB,SAAS,CAEX;AAID;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,iBAAiB,EACtB,SAAS,EAAE,SAAS,GACnB,OAAO,CAMT;AAED,wBAAgB,aAAa,CAC3B,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,cAAc,EACnB,SAAS,EAAE,SAAS,GACnB,OAAO,CAMT;AAED,wBAAgB,eAAe,CAC7B,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,cAAc,EACnB,SAAS,EAAE,SAAS,GACnB,OAAO,CAMT;AAGD,wBAAgB,eAAe,CAC7B,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,gBAAgB,EACrB,SAAS,EAAE,SAAS,GACnB,OAAO,CAET;AAID;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAEtD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAEzD;AAED,wBAAgB,eAAe,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,CAErD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAEzD;AAKD,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAEtD;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAEpD"}

package/build/ownershipSignature.js

@@ -0,0 +1,297 @@
+// Copyright (c) 2025-2026 zkLicensing project developers
+// SPDX-License-Identifier: BUSL-1.1
+/**
+ * ownershipSignature.ts
+ *
+ * Schnorr-over-Pallas signing primitive for the two on-chain flows that
+ * need the passphrase-derived owner key:
+ *
+ *  1. The /prove/bind and /prove/unbind flows — the passphrase-derived
+ *     keypair authorizes device slot mutations, and the signature is
+ *     re-verified INSIDE the circuit by `Signature.verify()` so even a
+ *     compromised licensing service cannot forge a bind.
+ *  2. The retained `ActivationMessage` shape (see below) — kept so external
+ *     tooling can still sign an "I hold the passphrase for this license"
+ *     assertion off-band. The platform no longer runs a challenge/respond
+ *     endpoint; the shape is purely an SDK primitive now.
+ *
+ * Deterministic HKDF-SHA256 derivation of a seed from the passphrase,
+ * reduced to a Pallas scalar → o1js `PrivateKey`. The buyer can
+ * re-derive the same keypair anywhere from just the passphrase.
+ *
+ * o1js-dependent by design: the whole point of switching from Ed25519 to
+ * Pallas Schnorr is native in-circuit verification. Any client that
+ * signs an activation or binding challenge already ships o1js for the
+ * downstream buy/verify surface, so the "keep this module o1js-free"
+ * constraint that motivated the Ed25519 version no longer applies.
+ *
+ * HKDF still needs WebCrypto (Node ≥ 20, Chromium 137+, Safari 17+,
+ * Firefox 130+). The module throws at derive time if
+ * `globalThis.crypto.subtle` is unavailable — callers cannot silently
+ * fall back to a weaker path.
+ */
+import { Field, PrivateKey, PublicKey, Signature, UInt32 } from 'o1js';
+import { packSlotTimes } from './licenseLeaf.js';
+import { licenseHashFromPubkey } from './ownershipLicenseHash.js';
+// HKDF info binds the derivation to a specific zkApp address, so the
+// same passphrase yields different keypairs for different apps. This
+// makes credentials per-app: a leaked passphrase for app A cannot be
+// replayed as an activation for app B. RFC 5869 designates `info` as
+// the domain-separation channel (salt is for randomness, which we don't
+// have here — the passphrase IS the secret input).
+//
+// The `v1` prefix reserves room to rotate the KDF or the target key type
+// later without a silent collision — a future scheme bumps to `v2` and
+// derives an unrelated key from the same passphrase.
+const HKDF_INFO_PREFIX = 'zkLicensing/v1/ownership|';
+const HKDF_SALT = new Uint8Array(0);
+// Domain-separation tags baked into every signed message. Prevents a
+// signature captured on one flow (activation) from being replayed on
+// another (binding) — the first Field the signer hashes is the flow ID,
+// so the two signatures live in disjoint spaces even at identical
+// (licenseHash, nonce).
+//
+// Exported so `LicensingApp.bind()` / `unbind()` can rebuild the exact
+// same Field[] preimage inside the circuit for `Signature.verify()`.
+// Bumping these values is a hardfork — every off-chain signer and every
+// deployed circuit would need to agree.
+export const TAG_ACTIVATION = 1n;
+export const TAG_BINDING = 2n;
+export const TAG_UNBINDING = 3n;
+function buildHkdfInfo(zkAppAddress) {
+    return new TextEncoder().encode(HKDF_INFO_PREFIX + zkAppAddress);
+}
+function utf8Bytes(s) {
+    return new TextEncoder().encode(s);
+}
+function bytesToBase64(bytes) {
+    let s = '';
+    for (const b of bytes)
+        s += String.fromCharCode(b);
+    return btoa(s);
+}
+function base64ToBytes(b64) {
+    const bin = atob(b64);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}
+function subtle() {
+    const s = globalThis.crypto?.subtle;
+    if (!s) {
+        throw new Error('WebCrypto unavailable — ownershipSignature requires Node ≥ 20 or a modern browser (Chromium 137+, Safari 17+, Firefox 130+).');
+    }
+    return s;
+}
+function bytesToBigInt(bytes) {
+    let n = 0n;
+    for (const b of bytes)
+        n = (n << 8n) | BigInt(b);
+    return n;
+}
+/**
+ * HKDF-SHA256 with empty salt and a per-app domain-separation info
+ * string (`zkLicensing/v1/ownership|<zkAppAddress>`). Deterministic:
+ * same (passphrase, zkAppAddress) → same 32-byte seed. Different
+ * zkAppAddress → cryptographically unrelated seed even with the same
+ * passphrase.
+ */
+export async function deriveSeed(passphrase, zkAppAddress) {
+    const baseKey = await subtle().importKey('raw', utf8Bytes(passphrase), 'HKDF', false, ['deriveBits']);
+    const info = buildHkdfInfo(zkAppAddress);
+    const bits = await subtle().deriveBits({
+        name: 'HKDF',
+        hash: 'SHA-256',
+        salt: HKDF_SALT,
+        info: info,
+    }, baseKey, 256);
+    return new Uint8Array(bits);
+}
+/**
+ * Derive a Pallas Schnorr keypair deterministically from (passphrase,
+ * zkAppAddress). The keypair is bound to the specific app: the same
+ * passphrase used against a different app yields a different keypair,
+ * so a leaked passphrase cannot be replayed as an activation for any
+ * other app.
+ *
+ * The 32-byte HKDF output is interpreted as a big-endian integer and
+ * passed to `PrivateKey.fromBigInt`, which reduces it modulo the Pallas
+ * scalar field order internally. All 2^256 possible HKDF outputs map to
+ * valid private keys with (256 - log2(Fq_order))-bit modular bias — the
+ * scalar field is ~254 bits, so bias is <2^-253 and lies well below any
+ * practical distinguisher.
+ */
+export async function deriveOwnershipKeypair(passphrase, zkAppAddress) {
+    const seed = await deriveSeed(passphrase, zkAppAddress);
+    const privateKey = PrivateKey.fromBigInt(bytesToBigInt(seed));
+    const publicKey = privateKey.toPublicKey();
+    return { privateKey, publicKey, publicKeyBase58: publicKey.toBase58() };
+}
+/**
+ * The ownership keypair of license `licenseHash`, trying each candidate app
+ * address in turn. The key is derived from the address the license was
+ * issued on; after a redeploy the license carries over to the successor
+ * unchanged, so its key is the earlier generation's. Pass the app's
+ * generation addresses (any order; the live one first is cheapest for new
+ * licenses). A wrong address only gives a key that doesn't match, so the
+ * list needn't be authenticated. Null when none matches (another passphrase).
+ */
+export async function findOwnershipKeypair(passphrase, licenseHash, candidateAddresses) {
+    for (const zkAppAddress of [...new Set(candidateAddresses)]) {
+        const kp = await deriveOwnershipKeypair(passphrase, zkAppAddress);
+        if (licenseHashFromPubkey(kp.publicKey) === licenseHash)
+            return { ...kp, zkAppAddress };
+    }
+    return null;
+}
+/**
+ * The addresses of every generation of the app at `zkAppAddress` (any of
+ * them), live first, from the keeper's generation list; just
+ * `zkAppAddress` when the keeper doesn't know it. For findOwnershipKeypair.
+ */
+export async function ownershipCandidateAddresses(keeperUrl, zkAppAddress, fetcher = fetch) {
+    try {
+        const r = await fetcher(`${keeperUrl.replace(/\/+$/, '')}/apps/by-address/${encodeURIComponent(zkAppAddress)}`);
+        if (!r.ok)
+            return [zkAppAddress];
+        const body = await r.json();
+        const gens = Array.isArray(body.generations) ? [...body.generations].sort((a, b) => b.gen - a.gen).map(g => g.zkAppAddress) : [];
+        return [...new Set([zkAppAddress, ...gens])];
+    }
+    catch {
+        return [zkAppAddress];
+    }
+}
+/**
+ * Packed (boundAt, freedAt) of one slot as the circuit sees it — the
+ * `slotState` a BindingMessage must commit to. Takes the slot entry from a
+ * LicenseRecord's `devices[]` (as served by GET /license/:zkApp/:hash);
+ * an absent entry is a pristine slot (0).
+ */
+export function slotStateOf(device) {
+    if (!device)
+        return '0';
+    return packSlotTimes(UInt32.from(device.boundAtSlot), UInt32.from(device.freedAtSlot)).toString();
+}
+/**
+ * Canonicalize the activation message into the Field[] that
+ * `Signature.create` / `Signature.verify` hash. The domain-separation
+ * tag prefix means no captured activation signature can be replayed as
+ * a binding signature, even if all other fields collide.
+ */
+export function activationMessageFields(msg) {
+    const addr = PublicKey.fromBase58(msg.zkAppAddress);
+    return [
+        Field(TAG_ACTIVATION),
+        Field(msg.licenseHash),
+        Field(msg.nonce),
+        addr.x,
+        addr.isOdd.toField(),
+    ];
+}
+/**
+ * Canonicalize a binding or unbinding message. The `tag` argument
+ * distinguishes bind (TAG_BINDING) from unbind (TAG_UNBINDING) so a
+ * bind signature captured off-chain cannot be replayed as an unbind
+ * even at identical (licenseHash, deviceCommitment, slotIndex, nonce).
+ */
+function bindingLikeFields(tag, msg) {
+    const addr = PublicKey.fromBase58(msg.zkAppAddress);
+    return [
+        Field(tag),
+        Field(msg.licenseHash),
+        Field(msg.deviceCommitment),
+        Field(msg.slotIndex),
+        Field(msg.nonce),
+        Field(msg.slotState),
+        Field(msg.expirySlot),
+        addr.x,
+        addr.isOdd.toField(),
+    ];
+}
+export function bindingMessageFields(msg) {
+    return bindingLikeFields(TAG_BINDING, msg);
+}
+export function unbindingMessageFields(msg) {
+    return bindingLikeFields(TAG_UNBINDING, msg);
+}
+// ── Signing ───────────────────────────────────────────────────────
+export function signActivation(privateKey, msg) {
+    return Signature.create(privateKey, activationMessageFields(msg));
+}
+export function signBinding(privateKey, msg) {
+    return Signature.create(privateKey, bindingMessageFields(msg));
+}
+export function signUnbinding(privateKey, msg) {
+    return Signature.create(privateKey, unbindingMessageFields(msg));
+}
+// Retained for back-compat with the Ed25519-era name. New code should
+// call signActivation directly.
+export function signChallenge(privateKey, msg) {
+    return signActivation(privateKey, msg);
+}
+// ── Verification ──────────────────────────────────────────────────
+/**
+ * Verify an activation signature. Returns false (never throws) for any
+ * failure — malformed pubkey, malformed signature, actual signature
+ * mismatch. Callers get a single go/no-go decision without having to
+ * distinguish "invalid" from "unparseable."
+ */
+export function verifyActivation(publicKey, msg, signature) {
+    try {
+        return signature.verify(publicKey, activationMessageFields(msg)).toBoolean();
+    }
+    catch {
+        return false;
+    }
+}
+export function verifyBinding(publicKey, msg, signature) {
+    try {
+        return signature.verify(publicKey, bindingMessageFields(msg)).toBoolean();
+    }
+    catch {
+        return false;
+    }
+}
+export function verifyUnbinding(publicKey, msg, signature) {
+    try {
+        return signature.verify(publicKey, unbindingMessageFields(msg)).toBoolean();
+    }
+    catch {
+        return false;
+    }
+}
+// Back-compat alias, see signChallenge.
+export function verifyChallenge(publicKey, msg, signature) {
+    return verifyActivation(publicKey, msg, signature);
+}
+// ── Wire encoding helpers ─────────────────────────────────────────
+/**
+ * Encode a signature for the wire (POST body, ProofFile JSON, etc).
+ * Base58 matches Mina's canonical serialization for both PublicKey and
+ * Signature, keeping the same encoding shape across everything the
+ * buyer's SDK produces.
+ */
+export function encodeSignature(sig) {
+    return sig.toBase58();
+}
+export function decodeSignature(base58) {
+    return Signature.fromBase58(base58);
+}
+export function encodePublicKey(pk) {
+    return pk.toBase58();
+}
+export function decodePublicKey(base58) {
+    return PublicKey.fromBase58(base58);
+}
+// Retained so callers that already do `encodeBase64(seed)` for logging
+// or persistence keep working — this module no longer produces raw byte
+// pubkeys or signatures, only o1js objects with .toBase58().
+export function encodeBase64(bytes) {
+    return bytesToBase64(bytes);
+}
+export function decodeBase64(b64) {
+    return base64ToBytes(b64);
+}
+//# sourceMappingURL=ownershipSignature.js.map

package/build/ownershipSignature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownershipSignature.js","sourceRoot":"","sources":["../src/ownershipSignature.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,oCAAoC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,qEAAqE;AACrE,qEAAqE;AACrE,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,mDAAmD;AACnD,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,qDAAqD;AACrD,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AACrD,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;AAEpC,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,kEAAkE;AAClE,wBAAwB;AACxB,EAAE;AACF,uEAAuE;AACvE,qEAAqE;AACrE,wEAAwE;AACxE,wCAAwC;AACxC,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AACjC,MAAM,CAAC,MAAM,WAAW,GAAM,EAAE,CAAC;AACjC,MAAM,CAAC,MAAM,aAAa,GAAI,EAAE,CAAC;AAEjC,SAAS,aAAa,CAAC,YAAoB;IACzC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,GAAG,YAAY,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,MAAM;IACb,MAAM,CAAC,GAAI,UAAU,CAAC,MAA6B,EAAE,MAAM,CAAC;IAC5D,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CACb,8HAA8H,CAC/H,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,UAAoB,EACpB,YAAoB;IAEpB,MAAM,OAAO,GAAG,MAAM,MAAM,EAAE,CAAC,SAAS,CACtC,KAAK,EACL,SAAS,CAAC,UAAU,CAA2B,EAC/C,MAAM,EACN,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC;IACF,MAAM,IAAI,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,MAAM,EAAE,CAAC,UAAU,CACpC;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,SAAmC;QACzC,IAAI,EAAE,IAA8B;KACrC,EACD,OAAO,EACP,GAAG,CACJ,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAQD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAoB,EACpB,YAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IAC3C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAkB,EAClB,WAAmB,EACnB,kBAAqC;IAErC,KAAK,MAAM,YAAY,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,EAAE,GAAG,MAAM,sBAAsB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAClE,IAAI,qBAAqB,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,WAAW;YAAE,OAAO,EAAE,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC;IAC1F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,SAAiB,EAAE,YAAoB,EAAE,UAAwB,KAAK;IACtH,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,oBAAoB,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAChH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,EAAoE,CAAC;QAC9F,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjI,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,YAAY,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAsCD;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,MAA4D;IAE5D,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IACxB,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AACpG,CAAC;AAOD;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAsB;IAC5D,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACpD,OAAO;QACL,KAAK,CAAC,cAAc,CAAC;QACrB,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC;QACtB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;QAChB,IAAI,CAAC,CAAC;QACN,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;KACrB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAAW,EAAE,GAAmB;IACzD,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACpD,OAAO;QACL,KAAK,CAAC,GAAG,CAAC;QACV,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC;QACtB,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC3B,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;QACpB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;QAChB,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;QACpB,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;QACrB,IAAI,CAAC,CAAC;QACN,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;KACrB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAmB;IACtD,OAAO,iBAAiB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAmB;IACxD,OAAO,iBAAiB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,qEAAqE;AAErE,MAAM,UAAU,cAAc,CAC5B,UAAsB,EACtB,GAAsB;IAEtB,OAAO,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,UAAsB,EACtB,GAAmB;IAEnB,OAAO,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,UAAsB,EACtB,GAAmB;IAEnB,OAAO,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,sEAAsE;AACtE,gCAAgC;AAChC,MAAM,UAAU,aAAa,CAC3B,UAAsB,EACtB,GAAqB;IAErB,OAAO,cAAc,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,qEAAqE;AAErE;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAoB,EACpB,GAAsB,EACtB,SAAoB;IAEpB,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,SAAoB,EACpB,GAAmB,EACnB,SAAoB;IAEpB,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,SAAoB,EACpB,GAAmB,EACnB,SAAoB;IAEpB,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,eAAe,CAC7B,SAAoB,EACpB,GAAqB,EACrB,SAAoB;IAEpB,OAAO,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;AACrD,CAAC;AAED,qEAAqE;AAErE;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAc;IAC5C,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,EAAa;IAC3C,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,uEAAuE;AACvE,wEAAwE;AACxE,6DAA6D;AAC7D,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC5C,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC"}