zklicensing 0.1.0-beta.2 → 0.1.0-beta.21

package/build/trustAnchorVerify.js

@@ -0,0 +1,432 @@
+// Copyright (c) 2025-2026 zkLicensing project developers
+// SPDX-License-Identifier: BUSL-1.1
+/**
+ * trustAnchorVerify.ts
+ *
+ * End-to-end trust-anchor verification for a single zkLicensing app.
+ *
+ * Given a vendor origin + a zkApp address + one or more pinned platform
+ * manifest public keys, this module performs the full "does this vendor
+ * page point at a real zkLicensing deployment for this vendor?" pipeline
+ * that the trust-anchor page walks a human buyer through — mechanically,
+ * with structured findings suitable for CI, monitoring, or a
+ * wallet/extension consumer.
+ *
+ * The verifier is address-keyed: buyers see zkApp addresses in their
+ * wallet popup, not opaque platform appIds, so the primary lookup is by
+ * address. The signed manifest served at
+ * `<origin>/.well-known/zklicensing/<zkAppAddress>.json` carries the
+ * appId inside its signed payload, so callers never need to know the
+ * appId out-of-band.
+ *
+ * Pipeline (each step yields a discrete Finding — no boolean collapse):
+ *
+ *   1.  manifest_fetch                    — GET https://<origin>/.well-known/zklicensing/<address>.json
+ *   2.  manifest_signature                — Ed25519 verify against caller-provided pinned keys
+ *                                            (any of the manifest's signatures: during a platform
+ *                                            key rotation it carries the old and the new key's)
+ *   2b. manifest_network                  — signed for the network being checked (minaNetworkId)
+ *   3.  manifest_address_in_generations   — opts.address appears in the signed generations[]
+ *   3b. manifest_matches_backend          — (opt-in, opts.crossCheck) vendor payload equals
+ *                                            zklicensing.com/apps/by-address/<address> after
+ *                                            independent signature-verify against same pins
+ *   4.  chain_account_exists              — fetchAccount succeeds at the address
+ *   5.  chain_zkapp_uri_match             — on-chain zkappUri equals opts.origin
+ *   6.  chain_vk_hash_pinned              — on-chain verification-key hash equals CANONICAL_VK_HASHES[generation]
+ *   7.  chain_set_zkapp_uri_impossible    — permissions.setZkappUri === Permissions.impossible()
+ *   8.  chain_set_permissions_impossible  — permissions.setPermissions === Permissions.impossible() (meta-freeze)
+ *   9.  chain_set_verification_key_locked — permissions.setVerificationKey.auth === Permissions.impossible()
+ *   10. chain_send_proof_only             — permissions.send === Permissions.proof()
+ *   11. chain_edit_state_proof_only       — permissions.editState === Permissions.proof()
+ *
+ * Steps 5 + 7 close the URI-binding loop: (5) proves the contract claims
+ * this origin, (7) proves nobody can rewrite that claim. Steps 8–11 verify
+ * the rest of LicensingApp.init()'s permission matrix — catching the case
+ * where a deployer used the correct VK but skipped/altered init(), leaving
+ * default `signature()` permissions that would still let the deploy key
+ * drain escrow, rewrite state, or swap the circuit.
+ *
+ * Chain reads go to the Mina node's GraphQL API directly (chainHead.ts):
+ * no o1js is needed, and o1js's global Mina instance is never switched, so
+ * long-lived services can run the check concurrently.
+ *
+ * The pinned pubkey list is caller-supplied — the SDK ships NO baked-in
+ * pin. Source it from https://zklicensing.com/trustanchor.html (published
+ * next to each generation's VK hash). See the SDK README for details.
+ */
+import { canonicalize, manifestSignaturesOf, signedManifestOf, verifyManifestSignature } from './manifestVerify.js';
+// The zkLicensing backend is mounted under /api/keeper on zklicensing.com —
+// the bare /apps/... paths return 404 (they're not the app route, they're an
+// unrelated marketing route). This is the concrete URL prefix, not just an
+// origin. The `/api/keeper` path is a stable public route and must not be
+// renamed here.
+const BACKEND_URL_PREFIX = 'https://zklicensing.com/api/keeper';
+const DEFAULT_FETCH_TIMEOUT_MS = 15000;
+function normalizeOrigin(origin) {
+    return origin.replace(/\/+$/, '');
+}
+// Strip trailing slash / path from a URL so we can compare against zkappUri,
+// which vendors typically set to their bare origin.
+function urlOrigin(url) {
+    try {
+        const u = new URL(url);
+        return `${u.protocol}//${u.host}`;
+    }
+    catch {
+        return null;
+    }
+}
+async function fetchManifest(origin, address, timeoutMs) {
+    const originOk = origin.startsWith('https://');
+    if (!originOk) {
+        return { name: 'manifest_fetch', ok: false, detail: 'origin must be https://' };
+    }
+    let manifestUrl;
+    try {
+        manifestUrl = new URL(`/.well-known/zklicensing/${encodeURIComponent(address)}.json`, origin).href;
+    }
+    catch {
+        return { name: 'manifest_fetch', ok: false, detail: 'origin is not a valid URL' };
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const resp = await fetch(manifestUrl, { signal: controller.signal, redirect: 'follow' });
+        if (!resp.ok) {
+            return { name: 'manifest_fetch', ok: false, detail: `HTTP ${resp.status} from ${manifestUrl}` };
+        }
+        const text = await resp.text();
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch {
+            return { name: 'manifest_fetch', ok: false, detail: 'response is not valid JSON' };
+        }
+        return { name: 'manifest_fetch', ok: true, detail: `fetched ${manifestUrl}`, body: parsed };
+    }
+    catch (err) {
+        return { name: 'manifest_fetch', ok: false, detail: `fetch failed: ${err?.message ?? String(err)}` };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+// Split a raw manifest JSON into { signature, payload }. The backend writes the
+// payload fields at the top level plus { signature, publicKey } — we ignore
+// publicKey (never trust the payload's self-declared key; only the
+// caller-pinned list is authoritative). The same signed bytes are served at
+// every /.well-known/zklicensing/<address>.json — one file per generation
+// address, all carrying the same appId in the payload.
+//
+// We whitelist the signed fields (appId, current, generations, issuedAt)
+// rather than blacklist non-signed ones. The backend appends advisory
+// fields (e.g. `forkActivationSlot`) to the response AFTER signing, so a
+// blacklist misses them and canonicalize() then hashes bytes the signer
+// never saw — the signature never verifies.
+function splitManifest(raw) {
+    const payload = signedManifestOf(raw);
+    return { signatures: manifestSignaturesOf(raw), payload };
+}
+/** True when one of `signatures` verifies over `payload` against a pinned key. */
+async function anySignatureVerifies(payload, signatures, pinned) {
+    for (const sig of signatures)
+        if (await verifyManifestSignature(payload, sig, pinned))
+            return true;
+    return false;
+}
+// Optional cross-check against the zkLicensing backend's own copy of the
+// signed generation list. Fetches `https://zklicensing.com/apps/by-address/
+// {address}`, verifies its signature against the same caller-pinned keys (so
+// a compromised backend URL cannot lie), strips signature/publicKey/issuedAt/
+// app/network, and byte-compares canonicalized payloads against the vendor's
+// `.well-known` copy. `issuedAt` is stripped because the backend re-stamps on
+// every call; `app` and `network` are stripped because they are unsigned
+// envelope fields the by-address endpoint tacks on.
+async function checkBackendMatch(args) {
+    const name = 'manifest_matches_backend';
+    const url = `${BACKEND_URL_PREFIX}/apps/by-address/${encodeURIComponent(args.address)}`;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), args.timeoutMs);
+    let body;
+    try {
+        const resp = await fetch(url, { signal: controller.signal, redirect: 'follow' });
+        if (!resp.ok)
+            return { name, ok: false, detail: `backend HTTP ${resp.status} from ${url}` };
+        body = await resp.json();
+    }
+    catch (err) {
+        return { name, ok: false, detail: `backend fetch failed: ${err?.message ?? String(err)}` };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    if (!body || typeof body !== 'object') {
+        return { name, ok: false, detail: 'backend response is not a JSON object' };
+    }
+    // Only the signed fields (same reason as splitManifest above): the backend
+    // appends envelope fields (publicKey, app, forkActivationSlot) after signing.
+    const backendSignatures = manifestSignaturesOf(body);
+    if (!backendSignatures.length) {
+        return { name, ok: false, detail: 'backend response missing signature' };
+    }
+    const backendPayload = signedManifestOf(body);
+    if (!backendPayload) {
+        return { name, ok: false, detail: 'backend response missing signed fields' };
+    }
+    if (!await anySignatureVerifies(backendPayload, backendSignatures, args.pinnedPublicKeysBase64)) {
+        return { name, ok: false, detail: 'backend response signature does not verify against pinned keys' };
+    }
+    const { issuedAt: _kIA, ...kRest } = backendPayload;
+    const { issuedAt: _vIA, ...vRest } = args.vendorPayload;
+    if (canonicalize(kRest) !== canonicalize(vRest)) {
+        return { name, ok: false, detail: 'vendor manifest content diverges from backend record (stale or drifted)' };
+    }
+    return { name, ok: true, detail: `vendor payload matches backend /apps/by-address/${args.address}` };
+}
+// Converts an o1js-decoded Permission (three booleans) back to its canonical
+// enum string. Mirrors the switch inside o1js's own AuthRequired.toJSON — kept
+// inline because o1js doesn't publicly export it.
+export function permToString(p) {
+    const b = (v) => (typeof v?.toBoolean === 'function' ? v.toBoolean() : Boolean(v)) ? 1 : 0;
+    const key = `${b(p?.constant)}${b(p?.signatureNecessary)}${b(p?.signatureSufficient)}`;
+    switch (key) {
+        case '110': return 'Impossible';
+        case '101': return 'None';
+        case '000': return 'Proof';
+        case '011': return 'Signature';
+        case '001': return 'Either';
+        default: return undefined;
+    }
+}
+// Reads the on-chain facts needed to close the trust loop for a single
+// zkApp address, over the node's GraphQL API (no o1js, and no switch of
+// o1js's global Mina instance, so long-lived hosts can call it safely).
+async function readChainState(address, minaGraphqlUrl, _minaNetworkId, fetcher) {
+    try {
+        const { readZkappAccount } = await import('./chainHead.js');
+        const a = await readZkappAccount({ address, graphqlUrl: minaGraphqlUrl, fetcher });
+        if (!a.found)
+            return { accountFound: false, fetchError: `no account at ${address} via ${minaGraphqlUrl}` };
+        const p = a.permissions ?? {};
+        return {
+            accountFound: true,
+            zkappUri: a.zkappUri,
+            vkHash: a.vkHash,
+            setZkappUriIsImpossible: p.setZkappUri === 'Impossible',
+            setPermissionsIsImpossible: p.setPermissions === 'Impossible',
+            setVerificationKeyAuth: p.setVerificationKey?.auth,
+            setVerificationKeyTxnVersion: p.setVerificationKey?.txnVersion,
+            sendIsProof: p.send === 'Proof',
+            editStateIsProof: p.editState === 'Proof',
+        };
+    }
+    catch (err) {
+        return { accountFound: false, fetchError: err?.message ?? String(err) };
+    }
+}
+async function loadCanonicalVkHashes() {
+    try {
+        const m = await import('./contractInterface.js');
+        return m.CANONICAL_VK_HASHES ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function verifyTrustAnchor(opts) {
+    const origin = normalizeOrigin(opts.origin);
+    const address = opts.address;
+    const findings = [];
+    const timeoutMs = opts.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+    // 1. manifest_fetch
+    const fetchResult = await fetchManifest(origin, address, timeoutMs);
+    findings.push({ name: fetchResult.name, ok: fetchResult.ok, detail: fetchResult.detail });
+    if (!fetchResult.ok) {
+        return { ok: false, origin, address, findings };
+    }
+    const { signatures, payload } = splitManifest(fetchResult.body);
+    // 2. manifest_signature
+    if (!signatures.length || !payload) {
+        findings.push({ name: 'manifest_signature', ok: false, detail: 'manifest missing signature or payload fields (appId, network, current, generations, issuedAt)' });
+        return { ok: false, origin, address, findings };
+    }
+    const sigOk = await anySignatureVerifies(payload, signatures, opts.pinnedPublicKeysBase64);
+    findings.push({
+        name: 'manifest_signature',
+        ok: sigOk,
+        detail: sigOk
+            ? `Ed25519 verified against pinned key (1 of ${opts.pinnedPublicKeysBase64.length})`
+            : 'signature does not verify against any pinned key',
+    });
+    if (!sigOk) {
+        return { ok: false, origin, address, findings };
+    }
+    // appId is trusted only after signature verifies — it comes from the signed
+    // payload, not the caller.
+    const appId = payload.appId;
+    // 2b. manifest_network: signed for the network being checked (a devnet
+    // manifest never vouches for a mainnet contract, nor the other way round).
+    const expectedNetwork = (opts.minaNetworkId ?? 'mainnet') === 'mainnet' ? 'mainnet' : 'devnet';
+    findings.push({
+        name: 'manifest_network',
+        ok: payload.network === expectedNetwork,
+        detail: payload.network === expectedNetwork ? `signed for ${payload.network}` : `signed for ${payload.network}, checking ${expectedNetwork}`,
+    });
+    if (payload.network !== expectedNetwork) {
+        return { ok: false, origin, address, findings };
+    }
+    // 3. manifest_address_in_generations
+    const entry = payload.generations.find((g) => g.zkAppAddress === address);
+    findings.push({
+        name: 'manifest_address_in_generations',
+        ok: !!entry,
+        detail: entry
+            ? `address maps to gen ${entry.gen} (${entry.status})`
+            : `address ${address} not in manifest generations for app "${appId}"`,
+    });
+    const generation = entry?.gen;
+    // 3b. manifest_matches_backend (opt-in)
+    if (opts.crossCheck) {
+        findings.push(await checkBackendMatch({
+            address,
+            vendorPayload: payload,
+            pinnedPublicKeysBase64: opts.pinnedPublicKeysBase64,
+            timeoutMs,
+        }));
+    }
+    if (opts.skipChainChecks) {
+        const allOk = findings.every((f) => f.ok);
+        return { ok: allOk, origin, appId, address, generation, findings };
+    }
+    if (!opts.minaGraphqlUrl) {
+        findings.push({ name: 'chain_account_exists', ok: false, detail: 'minaGraphqlUrl is required for chain checks' });
+        return { ok: false, origin, appId, address, generation, findings };
+    }
+    // 4-11: chain reads
+    const state = await readChainState(address, opts.minaGraphqlUrl, opts.minaNetworkId ?? 'mainnet');
+    findings.push({
+        name: 'chain_account_exists',
+        ok: state.accountFound,
+        detail: state.accountFound ? `account ${address.slice(0, 12)}… found` : (state.fetchError ?? 'account not found'),
+    });
+    if (!state.accountFound) {
+        return { ok: false, origin, appId, address, generation, findings };
+    }
+    const onChainOrigin = state.zkappUri ? urlOrigin(state.zkappUri) : null;
+    const originClean = urlOrigin(origin);
+    const uriOk = !!state.zkappUri && !!onChainOrigin && !!originClean && onChainOrigin === originClean;
+    findings.push({
+        name: 'chain_zkapp_uri_match',
+        ok: uriOk,
+        detail: state.zkappUri
+            ? (uriOk ? `zkappUri "${state.zkappUri}" origin matches` : `zkappUri "${state.zkappUri}" origin ≠ "${originClean ?? origin}"`)
+            : 'zkappUri is empty on chain',
+    });
+    // Pinned by circuit: the on-chain VK must be one of the published circuit
+    // hashes. The manifest's `gen` counts this app's redeploys, which is not
+    // the circuit generation (a redeploy can keep the circuit, and an app
+    // deployed after a circuit bump starts at gen 1 on the newer circuit).
+    const canonicalVks = await loadCanonicalVkHashes();
+    const matchedCircuit = state.vkHash && canonicalVks
+        ? Object.entries(canonicalVks).find(([, h]) => h === state.vkHash)?.[0]
+        : undefined;
+    const vkOk = matchedCircuit !== undefined;
+    findings.push({
+        name: 'chain_vk_hash_pinned',
+        ok: vkOk,
+        detail: vkOk
+            ? `on-chain vkHash matches CANONICAL_VK_HASHES[${matchedCircuit}] (app gen ${generation ?? '?'})`
+            : !canonicalVks
+                ? 'CANONICAL_VK_HASHES unavailable'
+                : `on-chain vkHash "${state.vkHash?.slice(0, 16) ?? 'missing'}…" is not a published circuit hash`,
+    });
+    findings.push({
+        name: 'chain_set_zkapp_uri_impossible',
+        ok: !!state.setZkappUriIsImpossible,
+        detail: state.setZkappUriIsImpossible
+            ? 'permissions.setZkappUri = impossible (zkappUri is frozen)'
+            : 'permissions.setZkappUri ≠ impossible — vendor could rewrite the URI',
+    });
+    // The meta-freeze: without this, every other permission lock below is
+    // reversible with a single signature. Priority #1 among the extras.
+    findings.push({
+        name: 'chain_set_permissions_impossible',
+        ok: !!state.setPermissionsIsImpossible,
+        detail: state.setPermissionsIsImpossible
+            ? 'permissions.setPermissions = impossible (permission matrix is meta-frozen)'
+            : 'permissions.setPermissions ≠ impossible — every other lock could be relaxed later',
+    });
+    // setVerificationKey lock, with hardfork-aware softening.
+    //
+    // The contract deploys with VerificationKey.impossibleDuringCurrentVersion(),
+    // which stores {auth: Impossible, txnVersion: <chain's txnVersion at deploy
+    // time>}. After a Mina hardfork the chain's current txnVersion advances
+    // past the stored value and the effective enforcement falls back to
+    // signature() — but the deploy key was discarded (LicensingApp.ts:546-547),
+    // so no one can sign the fallback update.
+    //
+    // The backend records the deploy-time txnVersion in the signed manifest as
+    // deployTxnVersion. We accept two states as OK, provided the on-chain
+    // stored txnVersion still matches the manifest-recorded value (which proves
+    // no one has re-set the permission since deploy):
+    //
+    //   - auth = Impossible  → normal, pre-hardfork state
+    //   - auth = Signature   → post-hardfork fallback (see above)
+    //
+    // Any mismatch — different txnVersion, or auth is some other string, or
+    // deployTxnVersion missing from an old manifest — falls back to the strict
+    // rule (auth === 'Impossible').
+    const onChainAuth = state.setVerificationKeyAuth;
+    const onChainTxnVersion = state.setVerificationKeyTxnVersion;
+    const manifestDeployTxnVersion = entry?.deployTxnVersion;
+    let vkLockOk = false;
+    let vkLockDetail;
+    if (manifestDeployTxnVersion !== undefined && onChainTxnVersion !== undefined && onChainTxnVersion === manifestDeployTxnVersion) {
+        if (onChainAuth === 'Impossible') {
+            vkLockOk = true;
+            vkLockDetail = `permissions.setVerificationKey.auth = impossible (circuit cannot be swapped; txnVersion ${onChainTxnVersion} matches deploy)`;
+        }
+        else if (onChainAuth === 'Signature') {
+            vkLockOk = true;
+            vkLockDetail = `permissions.setVerificationKey.auth = signature (post-hardfork fallback; deploy key was destroyed at deploy time; txnVersion ${onChainTxnVersion} matches deploy)`;
+        }
+        else {
+            vkLockDetail = `permissions.setVerificationKey.auth = "${onChainAuth ?? '?'}" — expected impossible or signature`;
+        }
+    }
+    else if (manifestDeployTxnVersion === undefined) {
+        // Older manifest without deployTxnVersion — fall back to strict.
+        vkLockOk = onChainAuth === 'Impossible';
+        vkLockDetail = vkLockOk
+            ? 'permissions.setVerificationKey.auth = impossible (circuit cannot be swapped; manifest omits deployTxnVersion — strict rule applied)'
+            : `permissions.setVerificationKey.auth = "${onChainAuth ?? '?'}" ≠ impossible — vendor could swap the circuit (manifest omits deployTxnVersion — strict rule applied)`;
+    }
+    else {
+        vkLockDetail = `on-chain setVerificationKey.txnVersion (${onChainTxnVersion ?? 'unknown'}) ≠ manifest deployTxnVersion (${manifestDeployTxnVersion}) — permission may have been re-set since deploy`;
+    }
+    findings.push({
+        name: 'chain_set_verification_key_locked',
+        ok: vkLockOk,
+        detail: vkLockDetail,
+    });
+    // send + editState must be proof() (not signature()): withdrawals and Merkle
+    // root advances only happen via a valid LicensingApp proof.
+    findings.push({
+        name: 'chain_send_proof_only',
+        ok: !!state.sendIsProof,
+        detail: state.sendIsProof
+            ? 'permissions.send = proof() (escrow only leaves via a refund proof)'
+            : 'permissions.send ≠ proof() — vendor could drain escrow with a signature',
+    });
+    findings.push({
+        name: 'chain_edit_state_proof_only',
+        ok: !!state.editStateIsProof,
+        detail: state.editStateIsProof
+            ? 'permissions.editState = proof() (Merkle root advances only via a proof)'
+            : 'permissions.editState ≠ proof() — vendor could rewrite the license root',
+    });
+    const allOk = findings.every((f) => f.ok);
+    return { ok: allOk, origin, appId, address, generation, findings };
+}
+//# sourceMappingURL=trustAnchorVerify.js.map

package/build/trustAnchorVerify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustAnchorVerify.js","sourceRoot":"","sources":["../src/trustAnchorVerify.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,oCAAoC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAmDpH,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAC3E,0EAA0E;AAC1E,gBAAgB;AAChB,MAAM,kBAAkB,GAAG,oCAAoC,CAAC;AAEhE,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAEvC,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,6EAA6E;AAC7E,oDAAoD;AACpD,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAuBD,KAAK,UAAU,aAAa,CAC1B,MAAc,EACd,OAAe,EACf,SAAiB;IAEjB,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,GAAG,CAAC,4BAA4B,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC;IACrG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IACpF,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,IAAI,CAAC,MAAM,SAAS,WAAW,EAAE,EAAE,CAAC;QAClG,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAClC,MAAM,CAAC;YAAC,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;QAAC,CAAC;QAC7F,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9F,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IACvG,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,4EAA4E;AAC5E,mEAAmE;AACnE,4EAA4E;AAC5E,0EAA0E;AAC1E,uDAAuD;AACvD,EAAE;AACF,yEAAyE;AACzE,sEAAsE;AACtE,yEAAyE;AACzE,wEAAwE;AACxE,4CAA4C;AAC5C,SAAS,aAAa,CAAC,GAAY;IACjC,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAA2B,CAAC;IAChE,OAAO,EAAE,UAAU,EAAE,oBAAoB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC;AAC5D,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,oBAAoB,CAAC,OAAgB,EAAE,UAA6B,EAAE,MAAyB;IAC5G,KAAK,MAAM,GAAG,IAAI,UAAU;QAAE,IAAI,MAAM,uBAAuB,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IACnG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yEAAyE;AACzE,4EAA4E;AAC5E,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,yEAAyE;AACzE,oDAAoD;AACpD,KAAK,UAAU,iBAAiB,CAAC,IAKhC;IACC,MAAM,IAAI,GAAG,0BAA0B,CAAC;IACxC,MAAM,GAAG,GAAG,GAAG,kBAAkB,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IACxF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,IAAI,CAAC,MAAM,SAAS,GAAG,EAAE,EAAE,CAAC;QAC5F,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC7F,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IAC9E,CAAC;IACD,2EAA2E;IAC3E,8EAA8E;IAC9E,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;IAC3E,CAAC;IACD,MAAM,cAAc,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,MAAM,oBAAoB,CAAC,cAAc,EAAE,iBAAiB,EAAE,IAAI,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAChG,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gEAAgE,EAAE,CAAC;IACvG,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,GAAG,cAAyC,CAAC;IAC/E,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,aAAmD,CAAC;IAC9F,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yEAAyE,EAAE,CAAC;IAChH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,mDAAmD,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;AACvG,CAAC;AA0BD,6EAA6E;AAC7E,+EAA+E;AAC/E,kDAAkD;AAClD,MAAM,UAAU,YAAY,CAAC,CAAM;IACjC,MAAM,CAAC,GAAG,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChG,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,mBAAmB,CAAC,EAAE,CAAC;IACvF,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,KAAK,CAAC,CAAC,OAAO,YAAY,CAAC;QAChC,KAAK,KAAK,CAAC,CAAC,OAAO,MAAM,CAAC;QAC1B,KAAK,KAAK,CAAC,CAAC,OAAO,OAAO,CAAC;QAC3B,KAAK,KAAK,CAAC,CAAC,OAAO,WAAW,CAAC;QAC/B,KAAK,KAAK,CAAC,CAAC,OAAO,QAAQ,CAAC;QAC5B,OAAO,CAAC,CAAI,OAAO,SAAS,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,wEAAwE;AACxE,wEAAwE;AACxE,KAAK,UAAU,cAAc,CAC3B,OAAe,EACf,cAAsB,EACtB,cAAgD,EAChD,OAAsB;IAEtB,IAAI,CAAC;QACH,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC5D,MAAM,CAAC,GAAG,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,CAAC,CAAC,KAAK;YAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,iBAAiB,OAAO,QAAQ,cAAc,EAAE,EAAE,CAAC;QAC3G,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;QAC9B,OAAO;YACL,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,uBAAuB,EAAO,CAAC,CAAC,WAAW,KAAK,YAAY;YAC5D,0BAA0B,EAAI,CAAC,CAAC,cAAc,KAAK,YAAY;YAC/D,sBAAsB,EAAQ,CAAC,CAAC,kBAAkB,EAAE,IAAI;YACxD,4BAA4B,EAAE,CAAC,CAAC,kBAAkB,EAAE,UAAU;YAC9D,WAAW,EAAmB,CAAC,CAAC,IAAI,KAAK,OAAO;YAChD,gBAAgB,EAAc,CAAC,CAAC,SAAS,KAAK,OAAO;SACtD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB;IAClC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC,mBAAmB,IAAI,IAAI,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAA2B;IACjE,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAAC;IAElE,oBAAoB;IACpB,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAClD,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAEhE,wBAAwB;IACxB,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+FAA+F,EAAE,CAAC,CAAC;QAClK,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAClD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC3F,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,oBAAoB;QAC1B,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,KAAK;YACX,CAAC,CAAC,6CAA6C,IAAI,CAAC,sBAAsB,CAAC,MAAM,GAAG;YACpF,CAAC,CAAC,kDAAkD;KACvD,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAClD,CAAC;IAED,4EAA4E;IAC5E,2BAA2B;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAE5B,uEAAuE;IACvE,2EAA2E;IAC3E,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,SAAS,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC/F,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,kBAAkB;QACxB,EAAE,EAAE,OAAO,CAAC,OAAO,KAAK,eAAe;QACvC,MAAM,EAAE,OAAO,CAAC,OAAO,KAAK,eAAe,CAAC,CAAC,CAAC,cAAc,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,cAAc,OAAO,CAAC,OAAO,cAAc,eAAe,EAAE;KAC7I,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAClD,CAAC;IAED,qCAAqC;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,OAAO,CAAC,CAAC;IAC1E,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,iCAAiC;QACvC,EAAE,EAAE,CAAC,CAAC,KAAK;QACX,MAAM,EAAE,KAAK;YACX,CAAC,CAAC,uBAAuB,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,MAAM,GAAG;YACtD,CAAC,CAAC,WAAW,OAAO,yCAAyC,KAAK,GAAG;KACxE,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,KAAK,EAAE,GAAG,CAAC;IAE9B,wCAAwC;IACxC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,QAAQ,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC;YACpC,OAAO;YACP,aAAa,EAAE,OAAO;YACtB,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;YACnD,SAAS;SACV,CAAC,CAAC,CAAC;IACN,CAAC;IAED,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IACrE,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC,CAAC;QAClH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IACrE,CAAC;IAED,oBAAoB;IACpB,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,aAAa,IAAI,SAAS,CAAC,CAAC;IAClG,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,sBAAsB;QAC5B,EAAE,EAAE,KAAK,CAAC,YAAY;QACtB,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,IAAI,mBAAmB,CAAC;KAClH,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IACrE,CAAC;IAED,MAAM,aAAa,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,WAAW,IAAI,aAAa,KAAK,WAAW,CAAC;IACpG,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,uBAAuB;QAC7B,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,KAAK,CAAC,QAAQ;YACpB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,QAAQ,kBAAkB,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,QAAQ,eAAe,WAAW,IAAI,MAAM,GAAG,CAAC;YAC9H,CAAC,CAAC,4BAA4B;KACjC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,yEAAyE;IACzE,sEAAsE;IACtE,uEAAuE;IACvE,MAAM,YAAY,GAAG,MAAM,qBAAqB,EAAE,CAAC;IACnD,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,IAAI,YAAY;QACjD,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACvE,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,IAAI,GAAG,cAAc,KAAK,SAAS,CAAC;IAC1C,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,sBAAsB;QAC5B,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,IAAI;YACV,CAAC,CAAC,+CAA+C,cAAc,cAAc,UAAU,IAAI,GAAG,GAAG;YACjG,CAAC,CAAC,CAAC,YAAY;gBACb,CAAC,CAAC,iCAAiC;gBACnC,CAAC,CAAC,oBAAoB,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,oCAAoC;KACtG,CAAC,CAAC;IAEH,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,gCAAgC;QACtC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB;QACnC,MAAM,EAAE,KAAK,CAAC,uBAAuB;YACnC,CAAC,CAAC,2DAA2D;YAC7D,CAAC,CAAC,qEAAqE;KAC1E,CAAC,CAAC;IAEH,sEAAsE;IACtE,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,kCAAkC;QACxC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B;QACtC,MAAM,EAAE,KAAK,CAAC,0BAA0B;YACtC,CAAC,CAAC,4EAA4E;YAC9E,CAAC,CAAC,mFAAmF;KACxF,CAAC,CAAC;IAEH,0DAA0D;IAC1D,EAAE;IACF,8EAA8E;IAC9E,4EAA4E;IAC5E,wEAAwE;IACxE,oEAAoE;IACpE,4EAA4E;IAC5E,0CAA0C;IAC1C,EAAE;IACF,2EAA2E;IAC3E,sEAAsE;IACtE,4EAA4E;IAC5E,kDAAkD;IAClD,EAAE;IACF,sDAAsD;IACtD,8DAA8D;IAC9D,EAAE;IACF,wEAAwE;IACxE,2EAA2E;IAC3E,gCAAgC;IAChC,MAAM,WAAW,GAAG,KAAK,CAAC,sBAAsB,CAAC;IACjD,MAAM,iBAAiB,GAAG,KAAK,CAAC,4BAA4B,CAAC;IAC7D,MAAM,wBAAwB,GAAG,KAAK,EAAE,gBAAgB,CAAC;IACzD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,YAAoB,CAAC;IACzB,IAAI,wBAAwB,KAAK,SAAS,IAAI,iBAAiB,KAAK,SAAS,IAAI,iBAAiB,KAAK,wBAAwB,EAAE,CAAC;QAChI,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;YACjC,QAAQ,GAAG,IAAI,CAAC;YAChB,YAAY,GAAG,2FAA2F,iBAAiB,kBAAkB,CAAC;QAChJ,CAAC;aAAM,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;YACvC,QAAQ,GAAG,IAAI,CAAC;YAChB,YAAY,GAAG,gIAAgI,iBAAiB,kBAAkB,CAAC;QACrL,CAAC;aAAM,CAAC;YACN,YAAY,GAAG,0CAA0C,WAAW,IAAI,GAAG,sCAAsC,CAAC;QACpH,CAAC;IACH,CAAC;SAAM,IAAI,wBAAwB,KAAK,SAAS,EAAE,CAAC;QAClD,iEAAiE;QACjE,QAAQ,GAAG,WAAW,KAAK,YAAY,CAAC;QACxC,YAAY,GAAG,QAAQ;YACrB,CAAC,CAAC,qIAAqI;YACvI,CAAC,CAAC,0CAA0C,WAAW,IAAI,GAAG,wGAAwG,CAAC;IAC3K,CAAC;SAAM,CAAC;QACN,YAAY,GAAG,2CAA2C,iBAAiB,IAAI,SAAS,kCAAkC,wBAAwB,kDAAkD,CAAC;IACvM,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,mCAAmC;QACzC,EAAE,EAAE,QAAQ;QACZ,MAAM,EAAE,YAAY;KACrB,CAAC,CAAC;IAEH,6EAA6E;IAC7E,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,uBAAuB;QAC7B,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW;QACvB,MAAM,EAAE,KAAK,CAAC,WAAW;YACvB,CAAC,CAAC,oEAAoE;YACtE,CAAC,CAAC,yEAAyE;KAC9E,CAAC,CAAC;IAEH,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,6BAA6B;QACnC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB;QAC5B,MAAM,EAAE,KAAK,CAAC,gBAAgB;YAC5B,CAAC,CAAC,yEAAyE;YAC3E,CAAC,CAAC,yEAAyE;KAC9E,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AACrE,CAAC"}

package/build/trustAnchorVerifyCli.d.ts

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+/**
+ * trustAnchorVerifyCli.ts
+ *
+ * Command-line front-end for verifyTrustAnchor(). Ships as the `zklicensing-verify-trust`
+ * bin — the sibling of `zklicensing-verify` (which is the verifyService HTTP daemon).
+ *
+ * Usage:
+ *   zklicensing-verify-trust \
+ *     --origin https://store.example.com \
+ *     --address B62q... \
+ *     --pinned-key <base64-ed25519-pubkey> \
+ *     [--mina-graphql https://api.minascan.io/node/mainnet/v1/graphql] \
+ *     [--mina-network-id mainnet|testnet|devnet] \
+ *     [--skip-chain-checks] \
+ *     [--json]
+ *
+ * The manifest lives at `<origin>/.well-known/zklicensing/<address>.json` —
+ * one file per generation address, all signed by the same platform key. The
+ * appId is read out of the signed payload; callers never need to know it
+ * out-of-band, which lets buyers verify from just the address their wallet
+ * shows them (including addresses for retired generations).
+ *
+ * Permit registries:
+ *   zklicensing-verify-trust --registry B62q... [--origin https://authority.example]
+ *     [--mina-network-id mainnet|devnet] [--keeper-url https://zklicensing.com/api/keeper]
+ *     [--no-well-known] [--mina-graphql <url>] [--json]
+ * checks the registry's verification key against the published PermitRegistry
+ * hashes, its locked permissions and network binding, the authority website
+ * written into it at deploy (on the --origin host, when given) and that the
+ * website's /.well-known/zkpermits/<address>.json claims it, and (with
+ * --keeper-url) that the keeper's authority keys, payout and website match.
+ *
+ * Exit codes:
+ *   0 — every finding passed
+ *   1 — one or more findings failed
+ *   2 — invalid arguments
+ *
+ * --pinned-key is required and may be repeated; the CLI ships NO baked-in
+ * pin. Source it from https://zklicensing.com/trustanchor.html (published
+ * next to each generation's VK hash). See the SDK README for details.
+ */
+import { type Finding } from './trustAnchorVerify.js';
+export type { Finding };
+//# sourceMappingURL=trustAnchorVerifyCli.d.ts.map

package/build/trustAnchorVerifyCli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustAnchorVerifyCli.d.ts","sourceRoot":"","sources":["../src/trustAnchorVerifyCli.ts"],"names":[],"mappings":";AAIA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAqB,KAAK,OAAO,EAA0B,MAAM,wBAAwB,CAAC;AA2LjG,YAAY,EAAE,OAAO,EAAE,CAAC"}