From 97904c758f48c07669bf181d798725f64d538d2b Mon Sep 17 00:00:00 2001
From: chrismaz11 <info@trustsignal.dev>
Date: Mon, 23 Mar 2026 13:58:46 -0500
Subject: [PATCH 01/10] docs: fix repo-relative links in README

---
 README.md | 44 ++++++++++++++++++++++----------------------
 1 file changed, 22 insertions(+), 22 deletions(-)

diff --git a/README.md b/README.md
index 758f2ea..947842d 100644
--- a/README.md
+++ b/README.md
@@ -18,7 +18,7 @@ Those risks matter in audit, compliance, partner-review, and trust-sensitive wor
 
 ## Verification Lifecycle
 
-The canonical lifecycle diagram and trust-boundary view are documented in [docs/verification-lifecycle.md](/Users/christopher/Projects/trustsignal/docs/verification-lifecycle.md).
+The canonical lifecycle diagram and trust-boundary view are documented in [docs/verification-lifecycle.md](docs/verification-lifecycle.md).
 
 TrustSignal accepts a verification request, returns verification signals, issues a signed verification receipt, and supports later verification against stored receipt state so downstream teams can detect artifact tampering, evidence provenance loss, or stale records during audit review.
 
@@ -47,17 +47,17 @@ It shows the full lifecycle in one run:
 4. later verification
 5. tampered artifact mismatch detection
 
-See [demo/README.md](/Users/christopher/Projects/trustsignal/demo/README.md).
+See [demo/README.md](demo/README.md).
 
 ## Integration Model
 
 Start here if you are evaluating the public verification lifecycle:
 
-- [Evaluator quickstart](/Users/christopher/Projects/trustsignal/docs/partner-eval/quickstart.md)
-- [API playground](/Users/christopher/Projects/trustsignal/docs/partner-eval/api-playground.md)
-- [OpenAPI contract](/Users/christopher/Projects/trustsignal/openapi.yaml)
-- [Postman collection](/Users/christopher/Projects/trustsignal/postman/TrustSignal.postman_collection.json)
-- [Postman local environment](/Users/christopher/Projects/trustsignal/postman/TrustSignal.local.postman_environment.json)
+- [Evaluator quickstart](docs/partner-eval/quickstart.md)
+- [API playground](docs/partner-eval/api-playground.md)
+- [OpenAPI contract](openapi.yaml)
+- [Postman collection](postman/TrustSignal.postman_collection.json)
+- [Postman local environment](postman/TrustSignal.local.postman_environment.json)
 
 Golden path:
 
@@ -191,12 +191,12 @@ Fail-closed defaults are part of the security posture. They are meant to prevent
 
 The public evaluation artifacts in this repo are:
 
-- [openapi.yaml](/Users/christopher/Projects/trustsignal/openapi.yaml)
-- [verification-request.json](/Users/christopher/Projects/trustsignal/examples/verification-request.json)
-- [verification-response.json](/Users/christopher/Projects/trustsignal/examples/verification-response.json)
-- [verification-receipt.json](/Users/christopher/Projects/trustsignal/examples/verification-receipt.json)
-- [verification-status.json](/Users/christopher/Projects/trustsignal/examples/verification-status.json)
-- [partner evaluation kit](/Users/christopher/Projects/trustsignal/docs/partner-eval/overview.md)
+- [openapi.yaml](openapi.yaml)
+- [verification-request.json](examples/verification-request.json)
+- [verification-response.json](examples/verification-response.json)
+- [verification-receipt.json](examples/verification-receipt.json)
+- [verification-status.json](examples/verification-status.json)
+- [partner evaluation kit](docs/partner-eval/overview.md)
 
 These artifacts document the public verification lifecycle only. They intentionally avoid proof internals, model outputs, circuit identifiers, signing infrastructure specifics, and internal service topology.
 
@@ -211,7 +211,7 @@ Public-facing security properties for this repository are:
 - explicit lifecycle boundaries for read, revoke, and provenance-state operations
 - fail-closed defaults where production trust assumptions are not satisfied
 
-See [docs/security-summary.md](/Users/christopher/Projects/trustsignal/docs/security-summary.md), [SECURITY_CHECKLIST.md](/Users/christopher/Projects/trustsignal/SECURITY_CHECKLIST.md), and [docs/SECURITY.md](/Users/christopher/Projects/trustsignal/docs/SECURITY.md) for the current public-safe security summary and repository guardrails.
+See [docs/security-summary.md](docs/security-summary.md), [SECURITY_CHECKLIST.md](SECURITY_CHECKLIST.md), and [docs/SECURITY.md](docs/SECURITY.md) for the current public-safe security summary and repository guardrails.
 
 ## What TrustSignal Does Not Claim
 
@@ -225,7 +225,7 @@ TrustSignal does not provide:
 
 ## Current Repository Context
 
-DeedShield is the current application surface in this repository. The broader product framing remains TrustSignal as evidence integrity infrastructure and an integrity layer for existing workflows.
+TrustSignal is the canonical product and application surface in this repository. The current wedge remains property-record verification, with the platform framed as evidence integrity infrastructure for existing workflows.
 
 ## Newbie Difficulty Rating
 
@@ -261,10 +261,10 @@ npm run build
 
 ## Documentation Map
 
-- [docs/partner-eval/overview.md](/Users/christopher/Projects/trustsignal/docs/partner-eval/overview.md)
-- [docs/partner-eval/quickstart.md](/Users/christopher/Projects/trustsignal/docs/partner-eval/quickstart.md)
-- [docs/partner-eval/api-playground.md](/Users/christopher/Projects/trustsignal/docs/partner-eval/api-playground.md)
-- [wiki/What-is-TrustSignal.md](/Users/christopher/Projects/trustsignal/wiki/What-is-TrustSignal.md)
-- [wiki/API-Overview.md](/Users/christopher/Projects/trustsignal/wiki/API-Overview.md)
-- [wiki/Claims-Boundary.md](/Users/christopher/Projects/trustsignal/wiki/Claims-Boundary.md)
-- [wiki/Verification-Receipts.md](/Users/christopher/Projects/trustsignal/wiki/Verification-Receipts.md)
+- [docs/partner-eval/overview.md](docs/partner-eval/overview.md)
+- [docs/partner-eval/quickstart.md](docs/partner-eval/quickstart.md)
+- [docs/partner-eval/api-playground.md](docs/partner-eval/api-playground.md)
+- [wiki/What-is-TrustSignal.md](wiki/What-is-TrustSignal.md)
+- [wiki/API-Overview.md](wiki/API-Overview.md)
+- [wiki/Claims-Boundary.md](wiki/Claims-Boundary.md)
+- [wiki/Verification-Receipts.md](wiki/Verification-Receipts.md)

From 35ad31b608cc9dd648508db4ee6f680733a2c1bc Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 18 Mar 2026 03:26:50 +0000
Subject: [PATCH 02/10] feat: add missing security workflows
 (dependency-review, trivy, zizmor)

Co-authored-by: chrismaz11 <24700273+chrismaz11@users.noreply.github.com>
---
 .github/workflows/dependency-review.yml | 26 ++++++++++++++
 .github/workflows/trivy.yml             | 46 +++++++++++++++++++++++++
 .github/workflows/zizmor.yml            | 34 ++++++++++++++++++
 3 files changed, 106 insertions(+)
 create mode 100644 .github/workflows/dependency-review.yml
 create mode 100644 .github/workflows/trivy.yml
 create mode 100644 .github/workflows/zizmor.yml

diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
new file mode 100644
index 0000000..05a3149
--- /dev/null
+++ b/.github/workflows/dependency-review.yml
@@ -0,0 +1,26 @@
+name: Dependency diff review
+
+on:
+  pull_request:
+    branches:
+      - master
+      - work
+
+# Restrict to the minimum permissions needed for checkout and dependency review.
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    name: Dependency diff review
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Dependency diff review
+        uses: actions/dependency-review-action@da45c9571d1e7cdec26844a76b8e6b89e4f1ee6b # v4.7.1
+        with:
+          fail-on-severity: high
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
new file mode 100644
index 0000000..8b97c9c
--- /dev/null
+++ b/.github/workflows/trivy.yml
@@ -0,0 +1,46 @@
+name: Trivy repository scan
+
+on:
+  push:
+    branches:
+      - master
+      - work
+  pull_request:
+    branches:
+      - master
+      - work
+
+# Restrict to minimum required permissions.
+# security-events: write is required only for SARIF upload to code scanning.
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  trivy:
+    name: Trivy filesystem scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Run Trivy filesystem scan
+        uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # v0.30.0
+        with:
+          scan-type: fs
+          scan-ref: "."
+          severity: HIGH,CRITICAL
+          ignore-unfixed: true
+          format: sarif
+          output: trivy-results.sarif
+
+      - name: Upload Trivy SARIF to code scanning
+        # Skip on forked PRs — GitHub does not grant security-events: write to
+        # untrusted fork tokens, so SARIF upload would fail with a permissions error.
+        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+        uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+        with:
+          sarif_file: trivy-results.sarif
+          category: trivy
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 0000000..e58f7ee
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,34 @@
+name: zizmor advisory audit
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/**"
+
+# Restrict to minimum required permissions.
+permissions:
+  contents: read
+
+jobs:
+  zizmor:
+    name: zizmor workflow audit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Install zizmor
+        run: pip install zizmor==1.5.0
+
+      - name: Run zizmor workflow audit
+        # Advisory mode — findings are reported but do not fail the job.
+        # Maintainers should review and address findings before merging workflow changes.
+        run: |
+          zizmor --format plain .github/workflows/
+          EXIT_CODE=$?
+          if [ $EXIT_CODE -ne 0 ]; then
+            echo "::warning::zizmor found workflow security findings (advisory). Review the output above before merging."
+          fi
+          exit 0

From 1b36b1a669b949b19c6c81a0c61717c03849d7d1 Mon Sep 17 00:00:00 2001
From: chrismaz11 <chrismaz11@me.com>
Date: Thu, 19 Mar 2026 16:51:29 -0500
Subject: [PATCH 03/10] fix(ci): repair security workflow checks

---
 .github/workflows/dependency-review.yml | 2 +-
 .github/workflows/zizmor.yml            | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 05a3149..ed5dd8b 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -21,6 +21,6 @@ jobs:
           persist-credentials: false
 
       - name: Dependency diff review
-        uses: actions/dependency-review-action@da45c9571d1e7cdec26844a76b8e6b89e4f1ee6b # v4.7.1
+        uses: actions/dependency-review-action@da24556b548a50705dd671f47852072ea4c105d9 # v4.7.1
         with:
           fail-on-severity: high
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index e58f7ee..8b6bf05 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -26,8 +26,8 @@ jobs:
         # Advisory mode — findings are reported but do not fail the job.
         # Maintainers should review and address findings before merging workflow changes.
         run: |
-          zizmor --format plain .github/workflows/
-          EXIT_CODE=$?
+          EXIT_CODE=0
+          zizmor --format plain .github/workflows/ || EXIT_CODE=$?
           if [ $EXIT_CODE -ne 0 ]; then
             echo "::warning::zizmor found workflow security findings (advisory). Review the output above before merging."
           fi

From 31ddb99940a083fe88813d1bc352cb7264f9bf67 Mon Sep 17 00:00:00 2001
From: chrismaz11 <chrismaz11@me.com>
Date: Thu, 19 Mar 2026 23:44:48 -0500
Subject: [PATCH 04/10] fix(api): restore runtime env helpers

---
 apps/api/src/env.ts | 106 +++++++++++++++++++++-----------------------
 1 file changed, 51 insertions(+), 55 deletions(-)

diff --git a/apps/api/src/env.ts b/apps/api/src/env.ts
index bbef345..ef134a7 100644
--- a/apps/api/src/env.ts
+++ b/apps/api/src/env.ts
@@ -1,74 +1,70 @@
-import { existsSync, readFileSync } from 'node:fs';
+import { readFileSync } from 'node:fs';
 import path from 'node:path';
 
-let runtimeEnvLoaded = false;
+import dotenv from 'dotenv';
 
-function parseEnvFile(contents: string): Record<string, string> {
-  const values: Record<string, string> = {};
+let envLoaded = false;
 
-  for (const rawLine of contents.split(/\r?\n/u)) {
-    const line = rawLine.trim();
-    if (!line || line.startsWith('#')) {
-      continue;
-    }
-
-    const separatorIndex = line.indexOf('=');
-    if (separatorIndex <= 0) {
-      continue;
-    }
+export function loadRuntimeEnv(envPathCandidates?: string[]): void {
+  if (envLoaded) return;
 
-    const key = line.slice(0, separatorIndex).trim();
-    let value = line.slice(separatorIndex + 1).trim();
+  const candidates =
+    envPathCandidates ??
+    [
+      path.resolve(process.cwd(), '.env.local'),
+      path.resolve(process.cwd(), '.env'),
+      path.resolve(process.cwd(), '../../.env.local'),
+      path.resolve(process.cwd(), '../../.env')
+    ];
 
-    if (
-      (value.startsWith('"') && value.endsWith('"')) ||
-      (value.startsWith("'") && value.endsWith("'"))
-    ) {
-      value = value.slice(1, -1);
-    }
-
-    values[key] = value;
+  for (const envPath of candidates) {
+    dotenv.config({ path: envPath, override: false });
   }
 
-  return values;
+  envLoaded = true;
 }
 
-export function loadRuntimeEnv(): void {
-  if (runtimeEnvLoaded) {
-    return;
-  }
+export function resolveDatabaseUrl(env: NodeJS.ProcessEnv = process.env): string | null {
+  const direct = (env.DATABASE_URL || '').trim();
+  if (direct) return direct;
 
-  const envFiles = [
-    path.resolve(process.cwd(), '.env'),
-    path.resolve(process.cwd(), '../../.env')
-  ];
+  const candidates = [env.SUPABASE_DB_URL, env.SUPABASE_POOLER_URL, env.SUPABASE_DIRECT_URL];
 
-  for (const envFile of envFiles) {
-    if (!existsSync(envFile)) {
-      continue;
+  for (const candidate of candidates) {
+    const value = (candidate || '').trim();
+    if (value) {
+      env.DATABASE_URL = value;
+      return value;
     }
+  }
 
-    const parsed = parseEnvFile(readFileSync(envFile, 'utf8'));
-    for (const [key, value] of Object.entries(parsed)) {
-      if (process.env[key] === undefined) {
-        process.env[key] = value;
+  const supabasePassword = (env.SUPABASE_DB_PASSWORD || '').trim();
+  if (supabasePassword) {
+    const poolerCandidates = [
+      path.resolve(process.cwd(), 'supabase/.temp/pooler-url'),
+      path.resolve(process.cwd(), '../../supabase/.temp/pooler-url'),
+      path.resolve(process.env.HOME || '', 'supabase/.temp/pooler-url')
+    ];
+
+    for (const poolerPath of poolerCandidates) {
+      try {
+        const rawPoolerUrl = readFileSync(poolerPath, 'utf-8').trim();
+        if (!rawPoolerUrl) continue;
+
+        const parsed = new URL(rawPoolerUrl);
+        if (!parsed.password) {
+          parsed.password = encodeURIComponent(supabasePassword);
+        }
+        parsed.searchParams.set('sslmode', 'require');
+
+        const resolved = parsed.toString();
+        env.DATABASE_URL = resolved;
+        return resolved;
+      } catch {
+        // Continue searching candidate pooler URLs.
       }
     }
   }
 
-  runtimeEnvLoaded = true;
-}
-
-export function resolveDatabaseUrl(env: NodeJS.ProcessEnv = process.env): string | undefined {
-  const databaseUrl =
-    env.DATABASE_URL ||
-    env.SUPABASE_DB_URL ||
-    env.SUPABASE_POOLER_URL ||
-    env.SUPABASE_DIRECT_URL;
-
-  if (databaseUrl && !env.DATABASE_URL) {
-    env.DATABASE_URL = databaseUrl;
-  }
-
-  return env.DATABASE_URL;
+  return null;
 }

From d8ff560394d7edff4fa120bbad41d066a89f00a1 Mon Sep 17 00:00:00 2001
From: chrismaz11 <info@trustsignal.dev>
Date: Mon, 23 Mar 2026 13:38:34 -0500
Subject: [PATCH 05/10] docs: fix repo-relative links and update messaging

---
 SECURITY_CHECKLIST.md                         |   6 +-
 USER_MANUAL.md                                |  10 +-
 docs/CANONICAL_MESSAGING.md                   |   2 +-
 docs/IMPLEMENTATION_PLAN_PASSIVE_INSPECTOR.md |   4 +-
 docs/IT_INSTALLATION_MANUAL.md                |  10 +-
 .../kpmg-enterprise-audit-runbook.md          |  89 +++++++++++
 ...-enterprise-readiness-validation-report.md | 140 ++++++++++++++++++
 docs/compliance/kpmg-evidence-index.md        |  57 +++++++
 docs/customer/pilot-handbook.md               |   2 +-
 docs/final/01_EXECUTIVE_SUMMARY.md            |   4 +-
 ...10_INCIDENT_ESCALATION_AND_SLO_BASELINE.md |   2 +-
 docs/final/11_NSF_GRANT_WHITEPAPER.md         |   2 +-
 docs/final/14_VANTA_INTEGRATION_USE_CASE.md   |   4 +-
 docs/legal/cookie-policy.md                   |   2 +-
 docs/legal/pilot-agreement.md                 |   2 +-
 docs/legal/privacy-policy.md                  |   4 +-
 docs/legal/terms-of-service.md                |   2 +-
 docs/ops/monitoring/README.md                 |   4 +-
 docs/ops/monitoring/alert-rules.yml           |  14 +-
 .../grafana-dashboard-deedshield-api.json     |   2 +-
 docs/partner-eval/integration-model.md        |   2 +-
 packages/README.md                            |   9 +-
 22 files changed, 327 insertions(+), 46 deletions(-)
 create mode 100644 docs/compliance/kpmg-enterprise-audit-runbook.md
 create mode 100644 docs/compliance/kpmg-enterprise-readiness-validation-report.md
 create mode 100644 docs/compliance/kpmg-evidence-index.md

diff --git a/SECURITY_CHECKLIST.md b/SECURITY_CHECKLIST.md
index 9633521..eca6632 100644
--- a/SECURITY_CHECKLIST.md
+++ b/SECURITY_CHECKLIST.md
@@ -1,6 +1,6 @@
-# Deed Shield — Security & Production Readiness Checklist
+# TrustSignal — Security & Production Readiness Checklist
 
-> This document tracks the security posture of the Deed Shield API.
+> This document tracks the security posture of the TrustSignal API.
 > Each item is either ✅ (verified in-repo), 🔒 (enforced by code), or 📋 (requires infra/ops verification).
 
 ---
@@ -45,7 +45,7 @@
 
 | #   | Requirement                                | Status | Evidence                                                 |
 | --- | ------------------------------------------ | ------ | -------------------------------------------------------- |
-| 4.1 | Keccak-256 for document hashing            | ✅     | `keccak256Buffer` from `@deed-shield/core`.              |
+| 4.1 | Keccak-256 for document hashing            | ✅     | `keccak256Buffer` from `@trustsignal/core`.              |
 | 4.2 | Receipt hash verification                  | ✅     | `POST /receipt/:id/verify` recomputes hash.              |
 | 4.3 | JWT receipts have expiration               | ✅     | Enforced in core receipt builder.                        |
 | 4.4 | Private keys never in code or config files | ✅     | Only via `PRIVATE_KEY` env var, never imported directly. |
diff --git a/USER_MANUAL.md b/USER_MANUAL.md
index 6d9a8af..790c17c 100644
--- a/USER_MANUAL.md
+++ b/USER_MANUAL.md
@@ -1,10 +1,10 @@
-# DeedShield User Manual
+# TrustSignal User Manual
 
 **Version:** 2.0 (Risk & Compliance Enhanced)  
 **Date:** February 2026
 
 ## 1. Overview
-DeedShield is an automated document verification platform designed to prevent real estate title fraud. It protects homeowners and county clerks by ensuring:
+TrustSignal is an automated document verification platform designed to prevent real estate title fraud. It protects homeowners and county clerks by ensuring:
 1.  **Recording Integrity**: Documents meet strict Cook County formatting and content rules.
 2.  **Fraud Detection**: An AI Risk Engine analyzes documents for signs of forgery or tampering.
 3.  **Immutable Proof**: Every validation is "anchored" on a public blockchain (EVM), creating a permanent, tamper-proof audit trail.
@@ -20,7 +20,7 @@ DeedShield is an automated document verification platform designed to prevent re
     *   *Note: Only PDF files are supported for full verification.*
 
 ### Step 2: Automated Extraction & Review
-Once uploaded, DeedShield automatically:
+Once uploaded, TrustSignal automatically:
 *   **Removes Watermarks**: Strips "DO NOT COPY" or "UNOFFICIAL" stamps to read the text.
 *   **Extracts Metadata**: Finds the **Parcel ID (PIN)** and **Grantor Name**.
 *   **Computes Hash**: Generates a unique `SHA-256` digital fingerprint of your file.
@@ -36,7 +36,7 @@ The system pre-fills the verification form with your document's data.
 3.  Click **"Verify Bundle"**.
 
 ### Step 4: Results & Receipt
-DeedShield runs a comprehensive audit and produces a **Verification Receipt**.
+TrustSignal runs a comprehensive audit and produces a **Verification Receipt**.
 *   **Decision**: 
     *   `ALLOW`: Safe to record.
     *   `FLAG`: Minor issues found (e.g., low visual quality, warnings).
@@ -63,7 +63,7 @@ The **Document Fraud Risk Engine** assigns a probability score (0.0 - 1.0) based
 
 ### C. Anchoring
 *   **"Anchored" Status**: The digital fingerprint (hash) of your receipt has been written to the Ethereum blockchain.
-*   **Proof**: This proves *exactly* what the document looked like and what the verification result was at that specific moment in time. Even DeedShield cannot alter this record later.
+*   **Proof**: This proves *exactly* what the document looked like and what the verification result was at that specific moment in time. Even TrustSignal cannot alter this record later.
 
 ---
 
diff --git a/docs/CANONICAL_MESSAGING.md b/docs/CANONICAL_MESSAGING.md
index f453e4d..aafc54b 100644
--- a/docs/CANONICAL_MESSAGING.md
+++ b/docs/CANONICAL_MESSAGING.md
@@ -45,7 +45,7 @@ TrustSignal is evidence integrity infrastructure for existing workflows. It acts
 
 ### Entity Confusion
 
-- Do not collapse TrustSignal, DeedShield, Vanta, healthcare, and future marketplaces into one undifferentiated story
+- Do not collapse TrustSignal, Vanta, healthcare, and future marketplaces into one undifferentiated story
 - Do not let the deed wedge define the entire product
 - Do not describe TrustSignal as a replacement for the system that collected the evidence
 
diff --git a/docs/IMPLEMENTATION_PLAN_PASSIVE_INSPECTOR.md b/docs/IMPLEMENTATION_PLAN_PASSIVE_INSPECTOR.md
index 6bf039d..ceae06e 100644
--- a/docs/IMPLEMENTATION_PLAN_PASSIVE_INSPECTOR.md
+++ b/docs/IMPLEMENTATION_PLAN_PASSIVE_INSPECTOR.md
@@ -8,7 +8,7 @@ Implement a "Passive Inspector" workflow that monitors a directory, cryptographi
 
 ### A. `apps/watcher` (The Inspector)
 
-- **Dependencies**: Add `chokidar`, `axios`, `pdf-lib`, `dotenv`, `form-data` (if sending files), and link `@deed-shield/core`.
+- **Dependencies**: Add `chokidar`, `axios`, `pdf-lib`, `dotenv`, `form-data` (if sending files), and link `@trustsignal/core`.
 - **Configuration**: Load `SOURCE_DIR` and `API_URL` from `.env`.
 - **Ingest Logic**:
   - Monitor `SOURCE_DIR` for new `.pdf` files.
@@ -42,7 +42,7 @@ Implement a "Passive Inspector" workflow that monitors a directory, cryptographi
   - Modify `POST /verify`.
   - If `decision` is `FLAG` or `BLOCK`:
     - Query the _Logic assumes single tenant or default_ `Organization`.
-    - "Send" Email: Log a structured alert to stdout simulating an email to `adminEmail` with the subject "Deed Shield Alert: [Risk Score] [Reasons]".
+    - "Send" Email: Log a structured alert to stdout simulating an email to `adminEmail` with the subject "TrustSignal Alert: [Risk Score] [Reasons]".
 
 ### C. `packages/core` (The Standard)
 
diff --git a/docs/IT_INSTALLATION_MANUAL.md b/docs/IT_INSTALLATION_MANUAL.md
index c6b6ffc..a6aa550 100644
--- a/docs/IT_INSTALLATION_MANUAL.md
+++ b/docs/IT_INSTALLATION_MANUAL.md
@@ -2,11 +2,11 @@
 
 ## 1. Environment Configuration
 
-The following environment variables are required for the Deed Shield API and Core services (`apps/api` and `packages/core`).
+The following environment variables are required for the TrustSignal API and Core services (`apps/api` and `packages/core`).
 
 ### System Identity
 
-- `ISSUER_DID`: The decentralized identifier for the Deed Shield instance (e.g., `did:web:deedshield.io`).
+- `ISSUER_DID`: The decentralized identifier for the TrustSignal instance (e.g., `did:web:trustsignal.dev`).
 - `SIGNING_PRIVATE_KEY`: Private key (PKCS8 PEM or Hex) used to sign receipts.
 
 ### Database (PostgreSQL required)
@@ -38,17 +38,17 @@ The following environment variables are required for the Deed Shield API and Cor
 
 ## 2. PRIA XML Schema Mapping (Phase 2)
 
-For the next integration phase, we will map internal Deed Shield JSON Bundle schemas to PRIA (Property Records Industry Association) XML standards.
+For the next integration phase, we will map internal TrustSignal JSON bundle schemas to PRIA (Property Records Industry Association) XML standards.
 
 ### Mapping Table
 
-| Deed Shield Field            | PRIA XML XPath                          | Description                                        |
+| TrustSignal Field           | PRIA XML XPath                          | Description                                        |
 | ---------------------------- | --------------------------------------- | -------------------------------------------------- |
 | `bundle.ron.sealPayload`     | `//Signatures/Signature/Keyinfo`        | Cryptographic evidence of the seal                 |
 | `bundle.doc.docHash`         | `//Document/Hash`                       | Integrity hash of the recorded instrument          |
 | `bundle.property.parcelId`   | `//Property/ParcelID`                   | County-assigned PIN/APN                            |
 | `bundle.ocrData.grantorName` | `//Parties/Party[@Type='Grantor']/Name` | Grantor name extracted or verified                 |
-| `receipt.receiptHash`        | `//Recording/Return/ReceiptHash`        | **New Field**: Deed Shield Receipt Hash            |
+| `receipt.receiptHash`        | `//Recording/Return/ReceiptHash`        | **New Field**: TrustSignal Receipt Hash            |
 | `receipt.decision`           | `//Recording/Status/Code`               | Mapped to `Verified` (ALLOW) or `Rejected` (BLOCK) |
 
 ## 3. Installation Steps
diff --git a/docs/compliance/kpmg-enterprise-audit-runbook.md b/docs/compliance/kpmg-enterprise-audit-runbook.md
new file mode 100644
index 0000000..7800420
--- /dev/null
+++ b/docs/compliance/kpmg-enterprise-audit-runbook.md
@@ -0,0 +1,89 @@
+# TrustSignal Enterprise Audit Runbook
+
+Last updated: 2026-03-19
+
+## Scope
+
+This runbook documents the validation surface currently present in the TrustSignal repository and how to execute it for external technical diligence. It is intentionally conservative. A passing local run is repository evidence, not an audit opinion and not a substitute for staging or production operational evidence.
+
+## Evidence classes
+
+### Repo-provable evidence
+
+These checks can be executed from the repository and produce direct technical evidence:
+
+| Command | What it proves | Diligence themes |
+| --- | --- | --- |
+| `npm ci` | Clean dependency install from lockfile, workspace bootstrap, postinstall build of `packages/core` | secure development, change management, dependency hygiene |
+| `npm run lint` | Static policy enforcement across JS/TS sources | secure development, change management |
+| `npm run typecheck` | TypeScript consistency across workspace projects | secure development, API contract correctness |
+| `npm run build` | Releasable workspace artifacts can be produced | change management, reliability/availability |
+| `npx vitest run --coverage --reporter=json --outputFile=<file>` | Root unit/integration coverage for legacy auth/logging/rate-limit core | auth/access enforcement, logging/redaction, reliability/availability |
+| `cd apps/api && npx vitest run --reporter=json --outputFile=<file>` | API lifecycle, auth, scopes, tenant isolation, redaction, revocation, schema, health/status hardening | auth/access enforcement, tenant isolation, logging/redaction, API contract correctness, reliability/availability |
+| `cd apps/web && npx vitest run --reporter=json --outputFile=<file>` | Web utility tests execute under repo state | secure development |
+| `cd circuits/non_mem_gadget && cargo test --message-format=json` | Rust/Halo2 verifier tests compile and pass | secure development, reliability/availability |
+| `bash scripts/history-secret-scan.sh` | No blocked secret file paths were found in Git object history | secure development, dependency hygiene |
+| `gitleaks git . --redact --no-banner` | Secret-scanning over repository history and current tree | secure development |
+| `npm audit --omit=dev --audit-level=high` | Production dependency vulnerability posture from npm advisory data | dependency hygiene |
+| `npm ls --omit=dev --all --json` | Machine-readable production dependency inventory | dependency hygiene |
+
+### CI-provable evidence
+
+These controls exist in the repository or GitHub workflow configuration, but require GitHub Actions execution context or repository settings to fully prove:
+
+| Evidence source | What it covers | Diligence themes |
+| --- | --- | --- |
+| `.github/workflows/ci.yml` | lint, typecheck, root coverage tests, web build, signed-receipt smoke, Rust build/tests, gitleaks, npm audit | secure development, change management, auth/access enforcement, dependency hygiene |
+| `.github/workflows/scorecard.yml` | OSSF Scorecard SARIF and supply-chain review in GitHub | secure development, dependency hygiene, change management |
+| `scripts/smoke-signed-receipt.sh` | signed receipt smoke path in CI with PostgreSQL | API contract correctness, reliability/availability |
+
+### Manual operational evidence required
+
+These items are not provable from a local repository run alone:
+
+| Evidence item | Why local repo evidence is insufficient | Diligence themes |
+| --- | --- | --- |
+| Staging TLS and ingress behavior | Requires deployed endpoint, certificate chain, and redirect behavior | reliability/availability |
+| Production database TLS and encryption at rest | Requires database provider and runtime configuration evidence | auth/access enforcement, reliability/availability |
+| Access reviews, RBAC review records, IAM exports | Operational control evidence lives outside the repo | auth/access enforcement, change management |
+| Monitoring exports, alert delivery, on-call evidence | Docs exist, but live telemetry and alert evidence are external | logging/redaction, incident readiness, reliability/availability |
+| Backup/restore proof | Restore drills and provider snapshots are not in-repo artifacts | backup/recovery evidence |
+| Incident tabletop evidence | Policies and runbooks exist, but exercise evidence is external | incident readiness |
+| Secret rotation proof | Repo can show scanning, not proof of external credential rotation | dependency hygiene, secure development |
+| Combined `trustagents` or external oracle integration evidence | Not wired and exercised in this repository run | API contract correctness, reliability/availability |
+
+## High-value targeted regressions
+
+These are the repo checks that best map to KPMG-style technical diligence themes:
+
+| Area | Current check |
+| --- | --- |
+| Unauthorized requests rejected | `apps/api/src/security-hardening.test.ts` |
+| Invalid scopes rejected | `apps/api/src/security-hardening.test.ts` |
+| Malformed payloads rejected | `apps/api/src/request-validation.test.ts` |
+| Logging redaction | `tests/middleware/logger.test.ts` |
+| Cross-tenant isolation | `apps/api/src/v2-integration.test.ts` |
+| Revocation behavior | `apps/api/src/v2-integration.test.ts`, `tests/api/routes.test.ts` |
+| Receipt immutability and tamper detection | `tests/integration/fullBundle.test.ts`, `tests/e2e/verify-negative.test.ts` |
+| Fail-closed proof/registry behavior | `tests/e2e/verify-negative.test.ts`, `apps/api/src/registry-adapters.test.ts` |
+| Rate limiting | `tests/middleware/rateLimit.test.ts`, `apps/api/src/security-hardening.test.ts`, `apps/api/test/rate-limit.test.ts` |
+| Health/status sensitive-state leakage | `apps/api/src/health-endpoints.test.ts` |
+| Missing required env/config | `apps/api/src/env.test.ts`, `apps/api/src/security-hardening.test.ts`, `tests/middleware/auth.test.ts` |
+
+## Existing staging and operational capture scripts
+
+These scripts are useful for follow-on diligence once a deployed environment is available:
+
+| Script | Purpose | Evidence class |
+| --- | --- | --- |
+| `scripts/capture-staging-evidence.sh` | HTTP, HTTPS redirect, ingress forwarding probes | manual operational evidence required |
+| `scripts/capture-vercel-staging-evidence.sh` | Deployed API health/status probes | manual operational evidence required |
+| `scripts/capture-db-security-evidence.mjs` | DB TLS, redacted URL, Prisma migration status | manual operational evidence required |
+| `scripts/capture-vanta-integration-evidence.sh` | Deployed Vanta schema and verification endpoint capture | manual operational evidence required |
+| `scripts/capture-github-governance-evidence.sh` | GitHub branch protection and governance evidence | manual operational evidence required |
+
+## Current local rerun notes
+
+- The repository shell sandbox blocked local artifact writes inside the repo, so this run stored machine-generated artifacts under `/tmp/kpmg-readiness-20260319T191111Z`.
+- The local Node runtime was `v22.14.0` while `package.json` declares `20.x`. `npm ci` completed with an engine warning; this should be normalized in a controlled diligence environment.
+- Do not present this run as proof that `trustagents` or any external oracle has been integrated into TrustSignal. That evidence was not produced here.
diff --git a/docs/compliance/kpmg-enterprise-readiness-validation-report.md b/docs/compliance/kpmg-enterprise-readiness-validation-report.md
new file mode 100644
index 0000000..1e8827c
--- /dev/null
+++ b/docs/compliance/kpmg-enterprise-readiness-validation-report.md
@@ -0,0 +1,140 @@
+# TrustSignal Enterprise Readiness Validation Report
+
+## Execution metadata
+
+- Execution window: `2026-03-19 14:11:11 CDT` to `2026-03-19 14:20:13 CDT`
+- UTC end time: `2026-03-19T19:20:13Z`
+- Repository: `trustsignal`
+- Branch: `cm/recover-artifact-verify`
+- Commit SHA: `28c4694d01465560369ecab73d40d3fe9c89bdb7`
+- Runtime: Node `v22.14.0`, npm `10.9.2`, rustc `1.92.0`, cargo `1.92.0`
+- Evidence artifact root: `/tmp/kpmg-readiness-20260319T191111Z`
+
+## Commands executed
+
+Executed for this run:
+
+- `npm ci`
+- `npm run lint`
+- `npm run typecheck`
+- `npm run build`
+- `npx vitest run --coverage --reporter=json --outputFile=/tmp/kpmg-readiness-20260319T191111Z/05-root-vitest-escalated.json`
+- `cd apps/api && npx vitest run --reporter=json --outputFile=/tmp/kpmg-readiness-20260319T191111Z/06-apps-api-vitest-escalated-final.json`
+- `cd apps/web && npx vitest run --reporter=json --outputFile=/tmp/kpmg-readiness-20260319T191111Z/07-apps-web-vitest-escalated.json`
+- `cd circuits/non_mem_gadget && cargo test --message-format=json`
+- `bash scripts/history-secret-scan.sh`
+- `gitleaks git /Users/christopher/Projects/TSREPO/trustsignal --redact --no-banner`
+- `npm audit --omit=dev --audit-level=high`
+- `npm ls --omit=dev --all --json`
+
+Also executed during remediation:
+
+- `cd apps/api && npx vitest run src/health-endpoints.test.ts`
+- `cd apps/api && npx vitest run src/registryLoader.test.ts --reporter=json --outputFile=/tmp/kpmg-readiness-20260319T191111Z/12-registryloader-fix.json`
+
+## Pass/fail summary
+
+| Check | Final status | Notes |
+| --- | --- | --- |
+| Install/bootstrap (`npm ci`) | PASS | Completed after elevated rerun; engine warning because repo declares Node `20.x` and local runtime was Node `22.14.0`. |
+| Lint (`npm run lint`) | FAIL | Static lint debt remains across API, web, watcher, contracts, SDK, and legacy demo files. |
+| Typecheck (`npm run typecheck`) | PASS | Initial sandbox run failed on write permissions; elevated rerun passed. |
+| Build (`npm run build`) | PASS | Initial run failed because `apps/watcher` had no `build` script. Minimal no-op build script added; rerun passed. |
+| Root JS/TS tests with coverage | PASS | `36/36` suites passed, `72` tests passed, `3` pending/skipped. |
+| `apps/api` Vitest suite | PASS | `23/23` suites passed, `29/29` tests passed after two minimal fixes. |
+| `apps/web` Vitest suite | PASS | `3/3` suites passed, `9/9` tests passed. |
+| Rust tests | PASS | `cargo test` completed successfully for `circuits/non_mem_gadget`. |
+| History secret scan | PASS | No blocked secret file paths found in git object history. |
+| Gitleaks secret scan | PASS | `163` commits scanned, no leaks found. |
+| Production dependency audit | FAIL | `next` dependency reported `1` moderate vulnerability via `npm audit`. |
+| Dependency inventory export | PASS with warning | JSON inventory produced; npm reported `invalid: ws@8.17.1` in stderr. |
+| Workflow linting | NOT RUN | `actionlint` not installed locally. Manual or CI follow-up required. |
+| Trivy / image scanning | NOT RUN | Tooling not present in repo or local environment. |
+| OSSF Scorecard | CI-ONLY | Workflow exists in `.github/workflows/scorecard.yml`; not executed locally. |
+
+## Coverage metrics
+
+Source: `/Users/christopher/Projects/TSREPO/trustsignal/coverage/coverage-summary.json`
+
+| Metric | Result |
+| --- | --- |
+| Statements | `99.34%` |
+| Lines | `99.34%` |
+| Functions | `100%` |
+| Branches | `93.33%` |
+
+## Security scan results
+
+### Secret scanning
+
+- `bash scripts/history-secret-scan.sh`: PASS
+- `gitleaks git . --redact --no-banner`: PASS
+- Local gitleaks output: `163 commits scanned`, `no leaks found`
+
+### Dependency vulnerability scanning
+
+- `npm audit --omit=dev --audit-level=high`: FAIL
+- Current finding:
+  - `next` reported `1` moderate severity vulnerability set, including request smuggling, unbounded cache growth, buffering DoS, and CSRF-related advisories per npm advisory feed.
+
+### Dependency inventory
+
+- `npm ls --omit=dev --all --json` produced a machine-readable inventory at `/tmp/kpmg-readiness-20260319T191111Z/10-dependency-inventory.json`
+- npm also reported `invalid: ws@8.17.1` on stderr. This should be triaged before diligence packaging.
+
+## Notable hardening added during this run
+
+Minimal, audit-focused changes made to improve evidence quality:
+
+1. Added [health-endpoints.test.ts](/Users/christopher/Projects/TSREPO/trustsignal/apps/api/src/health-endpoints.test.ts) to prove `/api/v1/health` and `/api/v1/status` do not expose raw database initialization errors in public responses or logs.
+2. Hardened [server.ts](/Users/christopher/Projects/TSREPO/trustsignal/apps/api/src/server.ts) so database initialization failures expose `database_initialization_failed` rather than raw connection strings.
+3. Restored production fail-fast behavior in [registryLoader.ts](/Users/christopher/Projects/TSREPO/trustsignal/apps/api/src/registryLoader.ts) for missing `TRUST_REGISTRY_PUBLIC_KEY`.
+4. Isolated registry adapter test state in [registry-adapters.test.ts](/Users/christopher/Projects/TSREPO/trustsignal/apps/api/src/registry-adapters.test.ts) by clearing registry cache and job tables before the suite.
+5. Added a minimal no-op workspace build script in [package.json](/Users/christopher/Projects/TSREPO/trustsignal/apps/watcher/package.json) so root workspace build evidence is reproducible.
+
+## Known limitations
+
+- `npm run lint` still fails. The repository is not currently in a lint-clean state.
+- `npm audit` still reports an unresolved moderate vulnerability in `next`.
+- The local runtime used Node `22.14.0` even though the repo declares Node `20.x`.
+- Some machine artifacts were written to `/tmp` instead of a repo path because the local shell sandbox blocked writing new files into the repository during command execution.
+- Workflow linting, Trivy, and Scorecard were not executed locally.
+
+## What this does NOT prove
+
+- It does not prove enterprise readiness in production.
+- It does not prove SOC 2 compliance, audit readiness sign-off, or KPMG acceptance.
+- It does not prove staging or production TLS enforcement, certificate hygiene, WAF behavior, or ingress policy.
+- It does not prove database encryption at rest, backup quality, restore success, or credential rotation.
+- It does not prove monitoring is live, alerts page correctly, or incident response has been exercised.
+- It does not prove combined `trustagents` plus TrustSignal behavior, nor any hypothetical oracle integration that was not actually wired and tested.
+- It does not prove every public API response is fully checked against external OpenAPI documentation; this run validates implemented route behaviors and in-repo schema checks only.
+
+## Manual evidence still required for auditor review
+
+- Staging evidence from deployed `health`, `status`, `metrics`, and Vanta integration endpoints
+- TLS certificate and HTTPS redirect evidence from deployed environments
+- Database TLS, encryption-at-rest, credential separation, and least-privilege proof
+- Monitoring exports, alert delivery evidence, and on-call escalation records
+- Backup snapshot evidence and at least one documented restore drill
+- Incident/tabletop exercise evidence with timestamps and participants
+- Secret rotation evidence for any historic or operational credentials
+- GitHub branch protection, required checks, secret scanning enablement, and code scanning settings screenshots or exports
+- Any real `trustagents` integration evidence or external oracle proof workflow evidence
+
+## Go / No-Go assessment for technical diligence
+
+Assessment: `NO-GO for external enterprise-readiness presentation in current form`
+
+Reasoning:
+
+- The repository now provides a materially stronger technical evidence packet than before this run.
+- Core build, typecheck, web tests, API tests, root coverage tests, Rust tests, and secret scans now have reproducible artifacts.
+- However, the repo still fails a basic lint gate and still carries at least one unresolved moderate dependency vulnerability.
+- Operational and staging evidence gaps remain substantial and explicitly block any credible “enterprise-ready” positioning.
+
+A narrower claim is supportable:
+
+- The repository has a meaningful, evidence-backed validation suite for code-level diligence.
+- The suite demonstrates implemented controls around auth, scopes, tenant isolation, revocation, rate limiting, fail-closed behavior, logging redaction, and receipt verification.
+- Additional remediation and non-repo operational evidence are still required before showing this package to KPMG as a serious enterprise-readiness submission.
diff --git a/docs/compliance/kpmg-evidence-index.md b/docs/compliance/kpmg-evidence-index.md
new file mode 100644
index 0000000..adf8e56
--- /dev/null
+++ b/docs/compliance/kpmg-evidence-index.md
@@ -0,0 +1,57 @@
+# KPMG Evidence Index
+
+Run timestamp: `2026-03-19T19:20:13Z`
+
+## Generated artifacts
+
+Machine-generated artifacts for this run were written to:
+
+- `/tmp/kpmg-readiness-20260319T191111Z`
+
+Primary files:
+
+- `/tmp/kpmg-readiness-20260319T191111Z/01-npm-ci.log`
+- `/tmp/kpmg-readiness-20260319T191111Z/02-lint.log`
+- `/tmp/kpmg-readiness-20260319T191111Z/03-typecheck-escalated.log`
+- `/tmp/kpmg-readiness-20260319T191111Z/04-build-escalated-rerun.log`
+- `/tmp/kpmg-readiness-20260319T191111Z/05-root-vitest-escalated.log`
+- `/tmp/kpmg-readiness-20260319T191111Z/05-root-vitest-escalated.json`
+- `/tmp/kpmg-readiness-20260319T191111Z/06-apps-api-vitest-escalated-final.log`
+- `/tmp/kpmg-readiness-20260319T191111Z/06-apps-api-vitest-escalated-final.json`
+- `/tmp/kpmg-readiness-20260319T191111Z/07-apps-web-vitest-escalated.log`
+- `/tmp/kpmg-readiness-20260319T191111Z/07-apps-web-vitest-escalated.json`
+- `/tmp/kpmg-readiness-20260319T191111Z/08-history-secret-scan.log`
+- `/tmp/kpmg-readiness-20260319T191111Z/09-dependency-audit-escalated.log`
+- `/tmp/kpmg-readiness-20260319T191111Z/10-dependency-inventory.json`
+- `/tmp/kpmg-readiness-20260319T191111Z/10-dependency-inventory.stderr`
+- `/tmp/kpmg-readiness-20260319T191111Z/11-rust-test-escalated.json`
+- `/tmp/kpmg-readiness-20260319T191111Z/11-rust-test-escalated.stderr`
+- `/tmp/kpmg-readiness-20260319T191111Z/12-registryloader-fix.json`
+- `/tmp/kpmg-readiness-20260319T191111Z/12-registryloader-fix.log`
+- `/tmp/kpmg-readiness-20260319T191111Z/13-gitleaks.log`
+
+Coverage output created by the escalated root run:
+
+- `/Users/christopher/Projects/TSREPO/trustsignal/coverage/coverage-summary.json`
+
+## In-repo supporting documents
+
+- [Enterprise audit runbook](/Users/christopher/Projects/TSREPO/trustsignal/docs/compliance/kpmg-enterprise-audit-runbook.md)
+- [Validation report](/Users/christopher/Projects/TSREPO/trustsignal/docs/compliance/kpmg-enterprise-readiness-validation-report.md)
+- [Security checklist](/Users/christopher/Projects/TSREPO/trustsignal/SECURITY_CHECKLIST.md)
+- [AI guardrails](/Users/christopher/Projects/TSREPO/trustsignal/docs/ai-guardrails.md)
+- [SOC 2 readiness report](/Users/christopher/Projects/TSREPO/trustsignal/docs/compliance/soc2/readiness-report.md)
+- [SOC 2 readiness checklist](/Users/christopher/Projects/TSREPO/trustsignal/docs/compliance/soc2/readiness-checklist.md)
+- [Security posture summary](/Users/christopher/Projects/TSREPO/trustsignal/docs/compliance/security-posture.md)
+- [Incident response policy](/Users/christopher/Projects/TSREPO/trustsignal/docs/compliance/policies/incident-response-policy.md)
+- [Secure development policy](/Users/christopher/Projects/TSREPO/trustsignal/docs/compliance/policies/secure-development-policy.md)
+- [Access control policy](/Users/christopher/Projects/TSREPO/trustsignal/docs/compliance/policies/access-control-policy.md)
+- [Evidence boundary](/Users/christopher/Projects/TSREPO/trustsignal/docs/compliance/evidence-boundary.md)
+- [Monitoring README](/Users/christopher/Projects/TSREPO/trustsignal/docs/ops/monitoring/README.md)
+- [GitHub settings checklist](/Users/christopher/Projects/TSREPO/trustsignal/docs/github-settings-checklist.md)
+
+## Notes
+
+- `/tmp` artifacts are valid for this run but are not durable evidence storage.
+- For a formal diligence packet, rerun the same commands in a controlled environment and store the resulting artifacts in a durable evidence bucket or repository path.
+- No combined `trustagents` plus TrustSignal evidence appears in this index, because that integration was not actually performed or exercised.
diff --git a/docs/customer/pilot-handbook.md b/docs/customer/pilot-handbook.md
index 89c9005..3a5ba8e 100644
--- a/docs/customer/pilot-handbook.md
+++ b/docs/customer/pilot-handbook.md
@@ -7,7 +7,7 @@
 
 ## 1. Welcome
 
-Welcome to the Deed Shield **Verifier Simulator Pilot**. This handbook will guide you through testing the pre-recording verification workflow.
+Welcome to the TrustSignal **Verifier Simulator Pilot**. This handbook will guide you through testing the pre-recording verification workflow.
 
 ## 2. Accessing the Simulator
 
diff --git a/docs/final/01_EXECUTIVE_SUMMARY.md b/docs/final/01_EXECUTIVE_SUMMARY.md
index fcca7f9..43888f3 100644
--- a/docs/final/01_EXECUTIVE_SUMMARY.md
+++ b/docs/final/01_EXECUTIVE_SUMMARY.md
@@ -1,7 +1,7 @@
-# TrustSignal / Deed Shield Executive Summary
+# TrustSignal Executive Summary
 
 ## Product Position
-TrustSignal is a verification platform with Deed Shield as the property-records module. The immediate business objective is production-ready operation for title and lender pilots, followed by ICE Mortgage Technology / Encompass marketplace integration.
+TrustSignal is a verification platform whose initial wedge is property-record verification. The immediate business objective is production-ready operation for title and lender pilots, followed by ICE Mortgage Technology / Encompass marketplace integration.
 
 ## Current Priority
 The priority is operational and security readiness over feature expansion:
diff --git a/docs/final/10_INCIDENT_ESCALATION_AND_SLO_BASELINE.md b/docs/final/10_INCIDENT_ESCALATION_AND_SLO_BASELINE.md
index b365616..7c455eb 100644
--- a/docs/final/10_INCIDENT_ESCALATION_AND_SLO_BASELINE.md
+++ b/docs/final/10_INCIDENT_ESCALATION_AND_SLO_BASELINE.md
@@ -4,7 +4,7 @@
 Define the minimum incident response workflow and alert/SLO thresholds for pilot-safe operations.
 
 ## Scope
-Applies to TrustSignal / Deed Shield API operations in staging and production-like environments.
+Applies to TrustSignal API operations in staging and production-like environments.
 
 ## Severity Model
 - `SEV-1` Critical security or integrity event.
diff --git a/docs/final/11_NSF_GRANT_WHITEPAPER.md b/docs/final/11_NSF_GRANT_WHITEPAPER.md
index 8fd6ae3..013a862 100644
--- a/docs/final/11_NSF_GRANT_WHITEPAPER.md
+++ b/docs/final/11_NSF_GRANT_WHITEPAPER.md
@@ -5,7 +5,7 @@ Program fit: Applied cryptography, trustworthy AI, and secure digital infrastruc
 
 ## Abstract
 
-TrustSignal is a verification platform that combines zero-knowledge proof systems, machine-learning risk scoring, and auditable API controls to produce tamper-evident trust decisions for document workflows. The initial production wedge is DeedShield (property deed verification), with architecture designed to generalize to additional credential domains. The system is implemented as a modular verification engine with three independent checks: Halo2 non-membership proof verification, Halo2 revocation proof verification, and ZKML-backed fraud signal verification. Session 7 finalization establishes a production-ready documentation and operations baseline with security controls, CI gates, and reproducible artifacts.
+TrustSignal is a verification platform that combines zero-knowledge proof systems, machine-learning risk scoring, and auditable API controls to produce tamper-evident trust decisions for document workflows. The initial production wedge is property deed verification, with architecture designed to generalize to additional credential domains. The system is implemented as a modular verification engine with three independent checks: Halo2 non-membership proof verification, Halo2 revocation proof verification, and ZKML-backed fraud signal verification. Session 7 finalization establishes a production-ready documentation and operations baseline with security controls, CI gates, and reproducible artifacts.
 
 ## Problem Statement
 
diff --git a/docs/final/14_VANTA_INTEGRATION_USE_CASE.md b/docs/final/14_VANTA_INTEGRATION_USE_CASE.md
index 1aded90..b65bb20 100644
--- a/docs/final/14_VANTA_INTEGRATION_USE_CASE.md
+++ b/docs/final/14_VANTA_INTEGRATION_USE_CASE.md
@@ -9,7 +9,7 @@ Provide Vanta-ingestable verification evidence from TrustSignal for document-lev
 
 ## Reference Pilot Scenario
 
-- Vertical: Property deed verification (DeedShield module)
+- Vertical: Property deed verification (TrustSignal property-records module)
 - Workflow: Partner submits a verification bundle, receives receipt, and forwards normalized verification output to Vanta evidence workflows.
 - Data mode: Pilot-safe/synthetic where required by policy and agreement.
 
@@ -41,7 +41,7 @@ Provide Vanta-ingestable verification evidence from TrustSignal for document-lev
   "generatedAt": "2026-03-05T15:00:00.000Z",
   "vendor": {
     "name": "TrustSignal",
-    "module": "DeedShield",
+    "module": "TrustSignal",
     "environment": "production",
     "apiVersion": "v1"
   },
diff --git a/docs/legal/cookie-policy.md b/docs/legal/cookie-policy.md
index e87c97b..25f2b17 100644
--- a/docs/legal/cookie-policy.md
+++ b/docs/legal/cookie-policy.md
@@ -4,7 +4,7 @@
 **Effective Date:** 2026-02-25
 
 ## 1. Purpose
-This policy explains how TrustSignal and Deed Shield use cookies and similar technologies in web-facing service components.
+This policy explains how TrustSignal uses cookies and similar technologies in web-facing service components.
 
 ## 2. Tracking Approach
 Our default model is first-party operational tracking for service delivery and reliability.
diff --git a/docs/legal/pilot-agreement.md b/docs/legal/pilot-agreement.md
index e4bd152..6686598 100644
--- a/docs/legal/pilot-agreement.md
+++ b/docs/legal/pilot-agreement.md
@@ -4,7 +4,7 @@
 **Effective Date:** 2026-02-25
 
 ## 1. Pilot Scope
-These terms govern participation in the TrustSignal / Deed Shield pilot program. The pilot is intended to validate integrations, verification workflows, and operational readiness.
+These terms govern participation in the TrustSignal pilot program. The pilot is intended to validate integrations, verification workflows, and operational readiness.
 
 ## 2. Pilot Nature
 Participants acknowledge that pilot services are pre-production and may include incomplete features, control changes, or service interruptions while the platform matures.
diff --git a/docs/legal/privacy-policy.md b/docs/legal/privacy-policy.md
index 1fb892e..54c123b 100644
--- a/docs/legal/privacy-policy.md
+++ b/docs/legal/privacy-policy.md
@@ -4,12 +4,12 @@
 **Effective Date:** 2026-02-25
 
 ## 1. Purpose
-This Privacy Policy describes how TrustSignal and its Deed Shield module ("we", "us", "our") handle data when customers use our verification services.
+This Privacy Policy describes how TrustSignal ("we", "us", "our") handles data when customers use our verification services.
 
 ## 2. Scope
 This policy applies to:
 - TrustSignal APIs and web applications
-- Deed Shield pilot and pre-production verification workflows
+- TrustSignal pilot and pre-production verification workflows
 - related support and operational services
 
 ## 3. Data Categories
diff --git a/docs/legal/terms-of-service.md b/docs/legal/terms-of-service.md
index 2f88f09..51b8e0d 100644
--- a/docs/legal/terms-of-service.md
+++ b/docs/legal/terms-of-service.md
@@ -4,7 +4,7 @@
 **Effective Date:** 2026-02-25
 
 ## 1. Acceptance
-These Terms govern access to and use of TrustSignal and the Deed Shield module (the "Service"). By using the Service, you agree to these Terms and the Privacy Policy.
+These Terms govern access to and use of TrustSignal and its verification modules (the "Service"). By using the Service, you agree to these Terms and the Privacy Policy.
 
 ## 2. Service Posture
 Unless otherwise stated in a signed agreement:
diff --git a/docs/ops/monitoring/README.md b/docs/ops/monitoring/README.md
index 63652be..5ffb386 100644
--- a/docs/ops/monitoring/README.md
+++ b/docs/ops/monitoring/README.md
@@ -1,6 +1,6 @@
 # TrustSignal Monitoring Baseline (Staging)
 
-This directory contains the minimum monitoring artifacts for DeedShield API pilot operations, aligned to:
+This directory contains the minimum monitoring artifacts for TrustSignal API pilot operations, aligned to:
 - `docs/final/10_INCIDENT_ESCALATION_AND_SLO_BASELINE.md`
 
 ## Files
@@ -30,7 +30,7 @@ Copy this repository file to the configured rules path and reload Prometheus.
 - Dashboards -> New -> Import
 - Upload `docs/ops/monitoring/grafana-dashboard-deedshield-api.json`
 - Select the staging Prometheus datasource
-- Set `job` variable to the DeedShield API scrape job (or keep `All`)
+- Set `job` variable to the TrustSignal API scrape job (or keep `All`)
 
 5. Confirm baseline panels populate:
 - Health Success Ratio (5m)
diff --git a/docs/ops/monitoring/alert-rules.yml b/docs/ops/monitoring/alert-rules.yml
index fc0a4bd..2adbb79 100644
--- a/docs/ops/monitoring/alert-rules.yml
+++ b/docs/ops/monitoring/alert-rules.yml
@@ -60,7 +60,7 @@ groups:
   - name: deedshield-api-slo-alerts
     interval: 30s
     rules:
-      - alert: DeedShieldHealthProbeFailuresSEV2
+      - alert: TrustSignalHealthProbeFailuresSEV2
         expr: |
           (
             sum by (job) (increase(deedshield_http_requests_total{route="/api/v1/health"}[3m])) >= 3
@@ -80,7 +80,7 @@ groups:
           description: "No successful /api/v1/health checks observed across the last 3 checks for job {{ $labels.job }}. Start SEV-2 triage."
           runbook: "docs/final/10_INCIDENT_ESCALATION_AND_SLO_BASELINE.md"
 
-      - alert: DeedShieldHealthProbeFailuresSEV1
+      - alert: TrustSignalHealthProbeFailuresSEV1
         expr: |
           (
             sum by (job) (increase(deedshield_http_requests_total{route="/api/v1/health"}[3m])) >= 3
@@ -100,7 +100,7 @@ groups:
           description: "Health failures persisted for 15 minutes for job {{ $labels.job }}. Escalate incident severity to SEV-1 and open stakeholder timeline updates every 30 minutes."
           runbook: "docs/final/10_INCIDENT_ESCALATION_AND_SLO_BASELINE.md"
 
-      - alert: DeedShieldApi5xxRateWarning
+      - alert: TrustSignalApi5xxRateWarning
         expr: |
           (
             deedshield:api_5xx_ratio:rate5m > 0.02
@@ -120,7 +120,7 @@ groups:
           description: "API error-rate warning threshold breached (>2% 5xx) for job {{ $labels.job }}. Investigate core verification and revocation paths."
           runbook: "docs/final/10_INCIDENT_ESCALATION_AND_SLO_BASELINE.md"
 
-      - alert: DeedShieldApi5xxRateCritical
+      - alert: TrustSignalApi5xxRateCritical
         expr: |
           (
             deedshield:api_5xx_ratio:rate5m > 0.05
@@ -140,7 +140,7 @@ groups:
           description: "API error-rate critical threshold breached (>5% 5xx) for job {{ $labels.job }}. Start SEV-2 incident workflow and contain blast radius."
           runbook: "docs/final/10_INCIDENT_ESCALATION_AND_SLO_BASELINE.md"
 
-      - alert: DeedShieldApiCoreP95LatencyWarning
+      - alert: TrustSignalApiCoreP95LatencyWarning
         expr: |
           (
             deedshield:api_core_p95_latency_seconds:rate5m > 1.0
@@ -160,7 +160,7 @@ groups:
           description: "P95 latency for /api/v1/verify and receipt verification paths exceeded baseline target for job {{ $labels.job }}."
           runbook: "docs/final/10_INCIDENT_ESCALATION_AND_SLO_BASELINE.md"
 
-      - alert: DeedShieldApiCoreP95LatencyCritical
+      - alert: TrustSignalApiCoreP95LatencyCritical
         expr: |
           (
             deedshield:api_core_p95_latency_seconds:rate5m > 2.5
@@ -180,7 +180,7 @@ groups:
           description: "Critical latency regression on core verification flow for job {{ $labels.job }}. Start SEV-2 incident escalation."
           runbook: "docs/final/10_INCIDENT_ESCALATION_AND_SLO_BASELINE.md"
 
-      - alert: DeedShieldApiTrafficDropBusinessHours
+      - alert: TrustSignalApiTrafficDropBusinessHours
         expr: |
           (
             deedshield:api_traffic_ratio_to_24h_baseline < 0.30
diff --git a/docs/ops/monitoring/grafana-dashboard-deedshield-api.json b/docs/ops/monitoring/grafana-dashboard-deedshield-api.json
index 95d0869..679e2e0 100644
--- a/docs/ops/monitoring/grafana-dashboard-deedshield-api.json
+++ b/docs/ops/monitoring/grafana-dashboard-deedshield-api.json
@@ -903,7 +903,7 @@
   },
   "timepicker": {},
   "timezone": "browser",
-  "title": "DeedShield API - SLO Baseline",
+  "title": "TrustSignal API - SLO Baseline",
   "uid": "deedshield-api-slo-baseline",
   "version": 1,
   "weekStart": ""
diff --git a/docs/partner-eval/integration-model.md b/docs/partner-eval/integration-model.md
index 8a2f178..9d9cfef 100644
--- a/docs/partner-eval/integration-model.md
+++ b/docs/partner-eval/integration-model.md
@@ -31,7 +31,7 @@ The current public verification request includes these core fields:
 - `transactionType`: workflow category
 - `doc.docHash`: artifact hash
 - `policy.profile`: policy or control identifier
-- `property`: workflow-specific subject context for the current DeedShield surface
+- `property`: workflow-specific subject context for the current TrustSignal property-records surface
 - `timestamp`: caller-provided event time when available
 
 ## Response Outputs
diff --git a/packages/README.md b/packages/README.md
index 48cae61..2cf1350 100644
--- a/packages/README.md
+++ b/packages/README.md
@@ -1,10 +1,5 @@
 # TrustSignal Packages
 
-All packages under the `@deed-shield/*` scope are **legacy identifiers** 
-maintained for backward compatibility with early integrations.
+All packages under the `@trustsignal/*` scope are TrustSignal workspace packages.
 
-**Current naming:** `@deed-shield/core`, `@deed-shield/verifier`  
-**Future naming:** `@trustsignal/core`, `@trustsignal/verifier`  
-(Planned for v1.0 with aliasing and deprecation warnings)
-
-For new projects, treat `@deed-shield/*` as TrustSignal components.
+**Current naming:** `@trustsignal/core`, `@trustsignal/api`, `@trustsignal/web`, `@trustsignal/contracts`

From 52748881d39c52c451e4a2c795becf17e3355e6d Mon Sep 17 00:00:00 2001
From: chrismaz11 <info@trustsignal.dev>
Date: Mon, 23 Mar 2026 13:38:55 -0500
Subject: [PATCH 06/10] feat: update docs, API, and proof integration work

---
 apps/api/.env.example                         |   21 +
 apps/api/SETUP.md                             |    4 +-
 apps/api/package.json                         |    4 +-
 apps/api/prisma/schema.prisma                 |    4 +
 apps/api/src/db.ts                            |    8 +
 .../src/registry-adapters-new-sources.test.ts |  301 ++++
 apps/api/src/registry-adapters.test.ts        |   18 +
 apps/api/src/registryLoader.test.ts           |    5 +-
 apps/api/src/security-hardening.test.ts       |   44 +-
 apps/api/src/security.ts                      |    6 +
 apps/api/src/server.ts                        |   42 +-
 apps/api/src/services/compliance.ts           |    1 +
 apps/api/src/services/registryAdapters.ts     | 1284 ++++++++++++++---
 apps/watcher/src/index.js                     |   10 +-
 apps/web/package.json                         |    2 +-
 apps/web/src/app/verify-artifact/page.tsx     |   10 +-
 apps/web/src/contexts/OperatorContext.tsx     |   17 +-
 bench/run-bench.ts                            |    2 +-
 circuits/non_mem_gadget/src/lib.rs            |   61 +-
 circuits/non_mem_gadget/src/revocation.rs     |    8 +-
 package-lock.json                             |   47 +-
 package.json                                  |    2 +-
 packages/contracts/package.json               |    2 +-
 packages/core/package.json                    |    2 +-
 packages/core/src/receipt.ts                  |    2 +-
 packages/core/src/receiptSigner.test.ts       |   10 +-
 packages/core/tsconfig.tsbuildinfo            |    2 +-
 src/api/verify.js                             |    4 +-
 trustsignal_tests.sh                          |  192 +++
 29 files changed, 1828 insertions(+), 287 deletions(-)
 create mode 100644 apps/api/src/registry-adapters-new-sources.test.ts
 create mode 100755 trustsignal_tests.sh

diff --git a/apps/api/.env.example b/apps/api/.env.example
index c3692b5..0be0702 100644
--- a/apps/api/.env.example
+++ b/apps/api/.env.example
@@ -23,9 +23,30 @@ US_CSL_CSV_URL=https://data.trade.gov/downloadable_consolidated_screening_list/v
 NPPES_NPI_API_URL=https://npiregistry.cms.hhs.gov/api/
 SEC_EDGAR_TICKERS_URL=https://www.sec.gov/files/company_tickers.json
 FDIC_BANKFIND_URL=https://banks.data.fdic.gov/api/institutions
+UN_CONSOLIDATED_SANCTIONS_URL=https://scsanctions.un.org/resources/xml/en/consolidated.xml
+STATE_DEPT_DEBARRED_URL=https://www.pmddtc.state.gov/ddtc_public?id=ddtc_public_portal_debarred_list
+STATE_DEPT_NONPROLIFERATION_URL=https://www.state.gov/key-topics-bureau-of-international-security-and-nonproliferation/nonproliferation-sanctions/
+NCUA_CREDIT_UNIONS_URL=https://ncua.gov/api/credit-unions
+FINRA_BROKERCHECK_URL=https://api.brokercheck.finra.org/search
+FINRA_BROKERCHECK_API_KEY=replace-with-finra-api-key
+FINCEN_MSB_URL=https://www.fincen.gov/money-services-business-msb-registration
+FFIEC_NIC_URL=https://www.ffiec.gov/npw/FinancialReport/ReturnFinancialReport
+GLEIF_LEI_URL=https://api.gleif.org/api/v1/lei-records
+CMS_MEDICARE_OPTOUT_URL=https://data.cms.gov/provider-characteristics/medicare-provider-supplier-enrollment/opt-out-affidavits
+IRS_TEOS_URL=https://www.irs.gov/charities-non-profits/exempt-organizations-business-master-file-extract-eo-bmf
+NYC_ACRIS_URL=https://data.cityofnewyork.us/resource/bnx9-e6tj.json
+CANADA_SEMA_SANCTIONS_URL=https://www.international.gc.ca/world-monde/assets/office_docs/international_relations-relations_internationales/sanctions/sema-lmes.xml
+CANADA_FINTRAC_MSB_URL=https://fintrac-canafe.canada.ca/msb-esm/public/msb-esm-list.aspx
+CANADA_CRA_CHARITIES_URL=https://apps.cra-arc.gc.ca/ebci/hacc/srch/pub/api/v1/charities
+CANADA_OSFI_FRI_URL=https://www.osfi-bsif.gc.ca/en/supervision/federally-regulated-financial-institutions
+PACER_FEDERAL_COURTS_URL=https://pcl.uscourts.gov/pcl/pages/search/findCase.jsf
+PACER_API_TOKEN=replace-with-pacer-token
+CANADA_BC_REGISTRY_URL=https://bcregistry.gov.bc.ca/api/search/businesses
+CANADA_CORPORATIONS_CANADA_URL=https://ised-isde.canada.ca/cc/lgcy/fdrl/srch/index.html
 REGISTRY_USER_AGENT=TrustSignal-RegistryAdapter/1.0 (compliance@trustsignal.dev)
 REGISTRY_FETCH_TIMEOUT_MS=15000
 REGISTRY_PROVIDER_COOLDOWN_MS=300
+REGISTRY_SNAPSHOT_DIR=
 ZK_ORACLE_URL=https://zk-oracle.internal/registry-jobs
 
 # API access controls
diff --git a/apps/api/SETUP.md b/apps/api/SETUP.md
index 9074338..e68f29d 100644
--- a/apps/api/SETUP.md
+++ b/apps/api/SETUP.md
@@ -1,4 +1,4 @@
-# Deed Shield API — Developer Setup
+# TrustSignal API — Developer Setup
 
 ## Prerequisites
 
@@ -67,7 +67,7 @@ npx prisma db seed
 
 ```bash
 docker run -d \
-  --name deed-shield-pg \
+  --name trustsignal-pg \
   -e POSTGRES_DB=deed_shield \
   -e POSTGRES_PASSWORD=localdev \
   -p 5432:5432 \
diff --git a/apps/api/package.json b/apps/api/package.json
index f1c2f27..522b799 100644
--- a/apps/api/package.json
+++ b/apps/api/package.json
@@ -1,5 +1,5 @@
 {
-  "name": "@deed-shield/api",
+  "name": "@trustsignal/api",
   "version": "0.2.0",
   "private": true,
   "type": "commonjs",
@@ -15,7 +15,7 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@deed-shield/core": "file:../../packages/core",
+    "@trustsignal/core": "file:../../packages/core",
     "@fastify/cors": "^11.2.0",
     "@fastify/rate-limit": "^10.3.0",
     "@prisma/client": "^5.17.0",
diff --git a/apps/api/prisma/schema.prisma b/apps/api/prisma/schema.prisma
index 75e5f1e..d80962c 100644
--- a/apps/api/prisma/schema.prisma
+++ b/apps/api/prisma/schema.prisma
@@ -115,6 +115,7 @@ model RegistrySource {
   id                   String          @id
   name                 String
   category             String
+  accessType           String          @default("API")
   endpoint             String
   zkCircuit            String
   active               Boolean         @default(true)
@@ -151,10 +152,13 @@ model RegistryOracleJob {
   subjectHash     String
   zkCircuit       String
   inputCommitment String
+  jobType         String         @default("VERIFY")
   status          String
   resultStatus    String?
   proofUri        String?
   error           String?
+  snapshotCapturedAt DateTime?
+  snapshotSourceVersion String?
   createdAt       DateTime       @default(now())
   completedAt     DateTime?
   source          RegistrySource @relation(fields: [sourceId], references: [id], onDelete: Cascade)
diff --git a/apps/api/src/db.ts b/apps/api/src/db.ts
index 40cb51a..cda3f10 100644
--- a/apps/api/src/db.ts
+++ b/apps/api/src/db.ts
@@ -58,6 +58,7 @@ export async function ensureDatabase(prisma: PrismaClient) {
       "id" TEXT PRIMARY KEY,
       "name" TEXT NOT NULL,
       "category" TEXT NOT NULL,
+      "accessType" TEXT NOT NULL DEFAULT 'API',
       "endpoint" TEXT NOT NULL,
       "zkCircuit" TEXT NOT NULL,
       "active" BOOLEAN NOT NULL DEFAULT TRUE,
@@ -86,10 +87,13 @@ export async function ensureDatabase(prisma: PrismaClient) {
       "subjectHash" TEXT NOT NULL,
       "zkCircuit" TEXT NOT NULL,
       "inputCommitment" TEXT NOT NULL,
+      "jobType" TEXT NOT NULL DEFAULT 'VERIFY',
       "status" TEXT NOT NULL,
       "resultStatus" TEXT,
       "proofUri" TEXT,
       "error" TEXT,
+      "snapshotCapturedAt" TIMESTAMP(3),
+      "snapshotSourceVersion" TEXT,
       "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
       "completedAt" TIMESTAMP(3)
     )`,
@@ -111,6 +115,10 @@ export async function ensureDatabase(prisma: PrismaClient) {
       "payload" JSONB NOT NULL,
       "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP
     )`,
+    `ALTER TABLE "RegistrySource" ADD COLUMN IF NOT EXISTS "accessType" TEXT NOT NULL DEFAULT 'API'`,
+    `ALTER TABLE "RegistryOracleJob" ADD COLUMN IF NOT EXISTS "jobType" TEXT NOT NULL DEFAULT 'VERIFY'`,
+    `ALTER TABLE "RegistryOracleJob" ADD COLUMN IF NOT EXISTS "snapshotCapturedAt" TIMESTAMP(3)`,
+    `ALTER TABLE "RegistryOracleJob" ADD COLUMN IF NOT EXISTS "snapshotSourceVersion" TEXT`,
     `CREATE UNIQUE INDEX IF NOT EXISTS "RegistryCache_sourceId_subjectHash_key"
       ON "RegistryCache" ("sourceId", "subjectHash")`,
     `CREATE INDEX IF NOT EXISTS "RegistryCache_expiresAt_idx"
diff --git a/apps/api/src/registry-adapters-new-sources.test.ts b/apps/api/src/registry-adapters-new-sources.test.ts
new file mode 100644
index 0000000..22ea808
--- /dev/null
+++ b/apps/api/src/registry-adapters-new-sources.test.ts
@@ -0,0 +1,301 @@
+import { mkdtemp, rm } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import { afterEach, describe, expect, it } from 'vitest';
+
+import { __testables, type RegistrySourceId } from './services/registryAdapters.js';
+
+type FakeJob = {
+  id: string;
+  sourceId: string;
+  jobType: string;
+  status: string;
+  snapshotCapturedAt: Date | null;
+  snapshotSourceVersion: string | null;
+  error?: string | null;
+};
+
+function createFakePrisma() {
+  const jobs: FakeJob[] = [];
+  return {
+    jobs,
+    prisma: {
+      registryOracleJob: {
+        async create({ data }: { data: Record<string, unknown> }) {
+          const job: FakeJob = {
+            id: `job-${jobs.length + 1}`,
+            sourceId: String(data.sourceId),
+            jobType: String(data.jobType),
+            status: String(data.status),
+            snapshotCapturedAt: null,
+            snapshotSourceVersion: null
+          };
+          jobs.push(job);
+          return job;
+        },
+        async update({ where, data }: { where: { id: string }; data: Record<string, unknown> }) {
+          const job = jobs.find((entry) => entry.id === where.id);
+          if (!job) throw new Error(`job_not_found:${where.id}`);
+          if (typeof data.status === 'string') job.status = data.status;
+          if ('snapshotCapturedAt' in data) {
+            job.snapshotCapturedAt = data.snapshotCapturedAt as Date | null;
+          }
+          if ('snapshotSourceVersion' in data) {
+            job.snapshotSourceVersion = data.snapshotSourceVersion as string | null;
+          }
+          if ('error' in data) {
+            job.error = (data.error as string | null) || null;
+          }
+          return job;
+        }
+      },
+      registrySource: {
+        async update() {
+          return null;
+        }
+      }
+    }
+  };
+}
+
+type SourceFixture = {
+  sourceId: RegistrySourceId;
+  subject: string;
+  matchBody: string;
+  noMatchBody: string;
+  malformedBody: string;
+  contentType?: string;
+  env?: Record<string, string>;
+};
+
+const FIXTURES: SourceFixture[] = [
+  {
+    sourceId: 'un_consolidated_sanctions',
+    subject: 'Acme Holdings LLC',
+    matchBody: '<root><entry><name>Acme Holdings LLC</name></entry></root>',
+    noMatchBody: '<root><entry><name>Other Entity LLC</name></entry></root>',
+    malformedBody: '<root></root>',
+    contentType: 'application/xml'
+  },
+  {
+    sourceId: 'state_dept_debarred',
+    subject: 'Acme Holdings LLC',
+    matchBody: '<root><party><name>Acme Holdings LLC</name></party></root>',
+    noMatchBody: '<root><party><name>Other Defense Corp</name></party></root>',
+    malformedBody: '<root></root>',
+    contentType: 'application/xml'
+  },
+  {
+    sourceId: 'state_dept_nonproliferation',
+    subject: 'Acme Holdings LLC',
+    matchBody: '<html><body><table><tr><td>Acme Holdings LLC</td></tr></table></body></html>',
+    noMatchBody: '<html><body><table><tr><td>Other Export Corp</td></tr></table></body></html>',
+    malformedBody: '<html><body></body></html>',
+    contentType: 'text/html'
+  },
+  {
+    sourceId: 'ncua_credit_unions',
+    subject: 'Acme Credit Union',
+    matchBody: '{"results":[{"name":"Acme Credit Union"}]}',
+    noMatchBody: '{"results":[{"name":"Other Credit Union"}]}',
+    malformedBody: 'not-json',
+    contentType: 'application/json'
+  },
+  {
+    sourceId: 'finra_brokercheck',
+    subject: 'Acme Securities LLC',
+    matchBody: '{"results":[{"brokerName":"Acme Securities LLC"}]}',
+    noMatchBody: '{"results":[{"brokerName":"Other Securities LLC"}]}',
+    malformedBody: 'not-json',
+    contentType: 'application/json',
+    env: { FINRA_BROKERCHECK_API_KEY: 'test-finra-key' }
+  },
+  {
+    sourceId: 'fincen_msb',
+    subject: 'Acme Money Services',
+    matchBody: 'name\nAcme Money Services',
+    noMatchBody: 'name\nOther MSB',
+    malformedBody: 'name',
+    contentType: 'text/csv'
+  },
+  {
+    sourceId: 'ffiec_nic',
+    subject: 'Acme Bancorp',
+    matchBody: '<root><holding><name>Acme Bancorp</name></holding></root>',
+    noMatchBody: '<root><holding><name>Other Bancorp</name></holding></root>',
+    malformedBody: '<root></root>',
+    contentType: 'application/xml'
+  },
+  {
+    sourceId: 'gleif_lei',
+    subject: 'Acme Global LLC',
+    matchBody: '{"data":[{"attributes":{"entity":{"legalName":{"name":"Acme Global LLC"}}}}]}',
+    noMatchBody: '{"data":[{"attributes":{"entity":{"legalName":{"name":"Other Global LLC"}}}}]}',
+    malformedBody: 'not-json',
+    contentType: 'application/json'
+  },
+  {
+    sourceId: 'cms_medicare_optout',
+    subject: 'Acme Medical Group',
+    matchBody: 'name\nAcme Medical Group',
+    noMatchBody: 'name\nOther Medical Group',
+    malformedBody: 'name',
+    contentType: 'text/csv'
+  },
+  {
+    sourceId: 'irs_teos',
+    subject: 'Acme Foundation',
+    matchBody: 'name\nAcme Foundation',
+    noMatchBody: 'name\nOther Foundation',
+    malformedBody: 'name',
+    contentType: 'text/csv'
+  },
+  {
+    sourceId: 'nyc_acris',
+    subject: 'Acme Holdings LLC',
+    matchBody: '[{"party_name":"Acme Holdings LLC"}]',
+    noMatchBody: '[{"party_name":"Other Holdings LLC"}]',
+    malformedBody: '{"oops":true}',
+    contentType: 'application/json'
+  },
+  {
+    sourceId: 'canada_sema_sanctions',
+    subject: 'Acme Holdings LLC',
+    matchBody: '<root><entry><name>Acme Holdings LLC</name></entry></root>',
+    noMatchBody: '<root><entry><name>Other Entity Ltd</name></entry></root>',
+    malformedBody: '<root></root>',
+    contentType: 'application/xml'
+  },
+  {
+    sourceId: 'canada_fintrac_msb',
+    subject: 'Acme Money Services',
+    matchBody: '<html><body><table><tr><td>Acme Money Services</td></tr></table></body></html>',
+    noMatchBody: '<html><body><table><tr><td>Other Money Services</td></tr></table></body></html>',
+    malformedBody: '<html><body></body></html>',
+    contentType: 'text/html'
+  },
+  {
+    sourceId: 'canada_cra_charities',
+    subject: 'Acme Charity',
+    matchBody: '{"results":[{"charityName":"Acme Charity"}]}',
+    noMatchBody: '{"results":[{"charityName":"Other Charity"}]}',
+    malformedBody: 'not-json',
+    contentType: 'application/json'
+  },
+  {
+    sourceId: 'canada_osfi_fri',
+    subject: 'Acme Bank',
+    matchBody: '<html><body><table><tr><td>Acme Bank</td></tr></table></body></html>',
+    noMatchBody: '<html><body><table><tr><td>Other Bank</td></tr></table></body></html>',
+    malformedBody: '<html><body></body></html>',
+    contentType: 'text/html'
+  },
+  {
+    sourceId: 'pacer_federal_courts',
+    subject: 'Acme Holdings LLC',
+    matchBody: '<html><body><table><tr><td>Acme Holdings LLC</td></tr></table></body></html>',
+    noMatchBody: '<html><body><table><tr><td>Other Holdings LLC</td></tr></table></body></html>',
+    malformedBody: '<html><body></body></html>',
+    contentType: 'text/html',
+    env: { PACER_API_TOKEN: 'test-pacer-token' }
+  },
+  {
+    sourceId: 'canada_bc_registry',
+    subject: 'Acme Industries Ltd',
+    matchBody: '{"results":[{"businessName":"Acme Industries Ltd"}]}',
+    noMatchBody: '{"results":[{"businessName":"Other Industries Ltd"}]}',
+    malformedBody: 'not-json',
+    contentType: 'application/json'
+  },
+  {
+    sourceId: 'canada_corporations_canada',
+    subject: 'Acme Industries Ltd',
+    matchBody: '<html><body><table><tr><td>Acme Industries Ltd</td></tr></table></body></html>',
+    noMatchBody: '<html><body><table><tr><td>Other Industries Ltd</td></tr></table></body></html>',
+    malformedBody: '<html><body></body></html>',
+    contentType: 'text/html'
+  }
+];
+
+const tempDirs: string[] = [];
+
+afterEach(async () => {
+  __testables.resetProviderCooldowns();
+  while (tempDirs.length > 0) {
+    const dir = tempDirs.pop();
+    if (dir) {
+      await rm(dir, { recursive: true, force: true });
+    }
+  }
+});
+
+describe('Registry adapters: new source fail-closed behavior', () => {
+  for (const fixture of FIXTURES) {
+    describe(fixture.sourceId, () => {
+      async function execute(body: string, status = 200) {
+        const { prisma, jobs } = createFakePrisma();
+        const snapshotDir = await mkdtemp(path.join(os.tmpdir(), 'registry-adapter-test-'));
+        tempDirs.push(snapshotDir);
+
+        const fetchImpl: typeof fetch = async () =>
+          new Response(body, {
+            status,
+            headers: {
+              'content-type': fixture.contentType || 'application/json',
+              etag: `${fixture.sourceId}-v1`
+            }
+          });
+
+        const result = await __testables.lookupSourceById({
+          prisma: prisma as never,
+          sourceId: fixture.sourceId,
+          subject: fixture.subject,
+          fetchImpl,
+          env: { ...process.env, ...(fixture.env || {}) },
+          snapshotDir
+        });
+
+        return { result, jobs };
+      }
+
+      it('returns MATCH when the official source contains the subject', async () => {
+        const { result } = await execute(fixture.matchBody);
+        expect(result.status).toBe('MATCH');
+        expect(result.matches[0]?.name).toContain(fixture.subject.split(' ')[0] || fixture.subject);
+      });
+
+      it('returns NO_MATCH when the official source does not contain the subject', async () => {
+        const { result } = await execute(fixture.noMatchBody);
+        expect(result.status).toBe('NO_MATCH');
+        expect(result.matches).toHaveLength(0);
+      });
+
+      it('returns COMPLIANCE_GAP on fetch failure', async () => {
+        const { result } = await execute('unavailable', 503);
+        expect(result.status).toBe('COMPLIANCE_GAP');
+        expect(result.details).toContain('upstream_http_503');
+      });
+
+      it('returns COMPLIANCE_GAP on malformed upstream data', async () => {
+        const { result } = await execute(fixture.malformedBody);
+        expect(result.status).toBe('COMPLIANCE_GAP');
+      });
+
+      if (
+        fixture.sourceId === 'un_consolidated_sanctions' ||
+        fixture.sourceId === 'fincen_msb' ||
+        fixture.sourceId === 'irs_teos'
+      ) {
+        it('creates an ingest job and records snapshot metadata for snapshot-backed sources', async () => {
+          const { result, jobs } = await execute(fixture.matchBody);
+          expect(result.snapshotCapturedAt).toBeTruthy();
+          expect(jobs.some((job) => job.jobType === 'INGEST')).toBe(true);
+          const ingestJob = jobs.find((job) => job.jobType === 'INGEST');
+          expect(ingestJob?.status).toBe('COMPLETED');
+          expect(ingestJob?.snapshotCapturedAt).toBeTruthy();
+        });
+      }
+    });
+  }
+});
diff --git a/apps/api/src/registry-adapters.test.ts b/apps/api/src/registry-adapters.test.ts
index f85510a..b421ad4 100644
--- a/apps/api/src/registry-adapters.test.ts
+++ b/apps/api/src/registry-adapters.test.ts
@@ -126,6 +126,24 @@ describeWithDatabase('Registry adapters: free source wiring', () => {
     expect(ids).toContain('nppes_npi_registry');
     expect(ids).toContain('sec_edgar_company_tickers');
     expect(ids).toContain('fdic_bankfind_institutions');
+    expect(ids).toContain('un_consolidated_sanctions');
+    expect(ids).toContain('state_dept_debarred');
+    expect(ids).toContain('state_dept_nonproliferation');
+    expect(ids).toContain('ncua_credit_unions');
+    expect(ids).toContain('finra_brokercheck');
+    expect(ids).toContain('fincen_msb');
+    expect(ids).toContain('ffiec_nic');
+    expect(ids).toContain('gleif_lei');
+    expect(ids).toContain('cms_medicare_optout');
+    expect(ids).toContain('irs_teos');
+    expect(ids).toContain('nyc_acris');
+    expect(ids).toContain('canada_sema_sanctions');
+    expect(ids).toContain('canada_fintrac_msb');
+    expect(ids).toContain('canada_cra_charities');
+    expect(ids).toContain('canada_osfi_fri');
+    expect(ids).toContain('pacer_federal_courts');
+    expect(ids).toContain('canada_bc_registry');
+    expect(ids).toContain('canada_corporations_canada');
   });
 
   it('verifies against OFAC and uses cache on repeated lookups', async () => {
diff --git a/apps/api/src/registryLoader.test.ts b/apps/api/src/registryLoader.test.ts
index 82f4d70..ad98172 100644
--- a/apps/api/src/registryLoader.test.ts
+++ b/apps/api/src/registryLoader.test.ts
@@ -1,9 +1,8 @@
 import * as fsPromises from 'fs/promises';
 
-import { generateRegistryKeypair, signRegistry } from '@deed-shield/core';
-import { afterEach, beforeEach, describe, expect, it, vi, type MockedFunction } from 'vitest';
-
 import { loadRegistry } from './registryLoader.js';
+import { generateRegistryKeypair, signRegistry } from '@trustsignal/core';
+import { afterEach, beforeEach, describe, expect, it, vi, type MockedFunction } from 'vitest';
 
 type RegistryFixture = {
   version: string;
diff --git a/apps/api/src/security-hardening.test.ts b/apps/api/src/security-hardening.test.ts
index f9a9270..0923b4d 100644
--- a/apps/api/src/security-hardening.test.ts
+++ b/apps/api/src/security-hardening.test.ts
@@ -232,9 +232,21 @@ describeWithDatabase('Security hardening: auth, scopes, and per-key throttling',
     expect(verifyRes.statusCode).toBe(200);
     const receiptId = verifyRes.json().receiptId as string;
 
+    const revokeUrl = `/api/v1/receipt/${receiptId}/revoke`;
+
+    const missingKey = await app.inject({ method: 'POST', url: revokeUrl });
+    expect(missingKey.statusCode).toBe(401);
+
+    const invalidKey = await app.inject({
+      method: 'POST',
+      url: revokeUrl,
+      headers: { 'x-api-key': 'invalid-key' }
+    });
+    expect(invalidKey.statusCode).toBe(403);
+
     const missingHeaders = await app.inject({
       method: 'POST',
-      url: `/api/v1/receipt/${receiptId}/revoke`,
+      url: revokeUrl,
       headers: { 'x-api-key': apiKeyVerify }
     });
     expect(missingHeaders.statusCode).toBe(401);
@@ -243,9 +255,35 @@ describeWithDatabase('Security hardening: auth, scopes, and per-key throttling',
     const validMessage = `revoke:${receiptId}:${timestamp}`;
     const validSignature = await revocationSigner.signMessage(validMessage);
 
+    const staleTimestamp = (Date.now() - 600_000).toString();
+    const staleSignature = await revocationSigner.signMessage(`revoke:${receiptId}:${staleTimestamp}`);
+    const staleTimestampRes = await app.inject({
+      method: 'POST',
+      url: revokeUrl,
+      headers: {
+        'x-api-key': apiKeyVerify,
+        'x-issuer-id': 'issuer-a',
+        'x-signature-timestamp': staleTimestamp,
+        'x-issuer-signature': staleSignature
+      }
+    });
+    expect(staleTimestampRes.statusCode).toBe(401);
+
+    const unknownIssuer = await app.inject({
+      method: 'POST',
+      url: revokeUrl,
+      headers: {
+        'x-api-key': apiKeyVerify,
+        'x-issuer-id': 'issuer-unknown',
+        'x-signature-timestamp': timestamp,
+        'x-issuer-signature': validSignature
+      }
+    });
+    expect(unknownIssuer.statusCode).toBe(403);
+
     const badSignature = await app.inject({
       method: 'POST',
-      url: `/api/v1/receipt/${receiptId}/revoke`,
+      url: revokeUrl,
       headers: {
         'x-api-key': apiKeyVerify,
         'x-issuer-id': 'issuer-a',
@@ -257,7 +295,7 @@ describeWithDatabase('Security hardening: auth, scopes, and per-key throttling',
 
     const valid = await app.inject({
       method: 'POST',
-      url: `/api/v1/receipt/${receiptId}/revoke`,
+      url: revokeUrl,
       headers: {
         'x-api-key': apiKeyVerify,
         'x-issuer-id': 'issuer-a',
diff --git a/apps/api/src/security.ts b/apps/api/src/security.ts
index 4574946..ee00b6d 100644
--- a/apps/api/src/security.ts
+++ b/apps/api/src/security.ts
@@ -29,6 +29,11 @@ export type AuthContext = {
   scopes: Set<string>;
 };
 
+export type RevocationAuthContext = {
+  receiptId: string;
+  issuerId: string;
+};
+
 export type SecurityConfig = {
   apiKeys: Map<string, Set<string>>;
   revocationIssuers: Map<string, string>;
@@ -54,6 +59,7 @@ export type ReceiptSigningConfig = {
 declare module 'fastify' {
   interface FastifyRequest {
     authContext?: AuthContext;
+    revocationAuth?: RevocationAuthContext;
   }
 }
 
diff --git a/apps/api/src/server.ts b/apps/api/src/server.ts
index 0834bbc..74c1ad8 100644
--- a/apps/api/src/server.ts
+++ b/apps/api/src/server.ts
@@ -3,6 +3,7 @@ import { randomUUID } from 'crypto';
 
 import { PrismaClient } from '@prisma/client';
 import Fastify from 'fastify';
+import type { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify';
 import cors from '@fastify/cors';
 import rateLimit from '@fastify/rate-limit';
 import { JsonRpcProvider, keccak256, toUtf8Bytes } from 'ethers';
@@ -435,7 +436,7 @@ function receiptFromDb(record: ReceiptRecord) {
     decision: record.decision as 'ALLOW' | 'FLAG' | 'BLOCK',
     reasons: JSON.parse(record.reasons) as string[],
     riskScore: record.riskScore,
-    verifierId: 'deed-shield',
+    verifierId: 'trustsignal',
     ...(record.signingKeyId ? { signing_key_id: record.signingKeyId } : {}),
     receiptHash: record.receiptHash,
     fraudRisk: record.fraudRisk ? JSON.parse(record.fraudRisk) as DocumentRisk : undefined,
@@ -476,6 +477,25 @@ function parseReceiptIdParam(
   return parsed.data.receiptId;
 }
 
+function requireRevocationAuthorization(config: SecurityConfig) {
+  return async function revocationPreHandler(request: FastifyRequest, reply: FastifyReply) {
+    const receiptId = parseReceiptIdParam(request, reply);
+    if (!receiptId) return;
+
+    const revocationVerification = verifyRevocationHeaders(request, receiptId, config);
+    if ('error' in revocationVerification) {
+      const statusCode = revocationVerification.error === 'issuer_not_allowed' ? 403 : 401;
+      reply.code(statusCode).send({ error: revocationVerification.error });
+      return;
+    }
+
+    request.revocationAuth = {
+      receiptId,
+      issuerId: revocationVerification.issuerId
+    };
+  };
+}
+
 function hasUnexpectedBody(body: unknown): boolean {
   if (typeof body === 'undefined') return false;
   if (body === null) return false;
@@ -973,7 +993,7 @@ export async function buildServer(options: BuildServerOptions = {}) {
     const forwardedProto = normalizeForwardedProto(request.headers['x-forwarded-proto']);
     return {
       status: 'ok',
-      service: 'deed-shield-api',
+      service: 'trustsignal-api',
       environment: process.env.NODE_ENV || 'development',
       uptimeSeconds: Math.floor(process.uptime()),
       timestamp: new Date().toISOString(),
@@ -1399,7 +1419,7 @@ export async function buildServer(options: BuildServerOptions = {}) {
       canonicalDocumentBase64: input.doc.pdfBase64
     });
 
-    const receipt = buildReceipt(input, verification, 'deed-shield', {
+    const receipt = buildReceipt(input, verification, 'trustsignal', {
       signing_key_id: securityConfig.receiptSigning.current.kid,
       fraudRisk,
       zkpAttestation
@@ -1662,19 +1682,17 @@ export async function buildServer(options: BuildServerOptions = {}) {
   });
 
   app.post('/api/v1/receipt/:receiptId/revoke', {
-    preHandler: [requireApiKeyScope(securityConfig, 'revoke')],
+    preHandler: [requireApiKeyScope(securityConfig, 'revoke'), requireRevocationAuthorization(securityConfig)],
     config: { rateLimit: perApiKeyRateLimit }
   }, async (request, reply) => {
     if (hasUnexpectedBody(request.body)) {
       return reply.code(400).send({ error: 'request_body_not_allowed' });
     }
-    const receiptId = parseReceiptIdParam(request, reply);
-    if (!receiptId) return;
-    const revocationVerification = verifyRevocationHeaders(request, receiptId, securityConfig);
-    if ('error' in revocationVerification) {
-      const statusCode = revocationVerification.error === 'issuer_not_allowed' ? 403 : 401;
-      return reply.code(statusCode).send({ error: revocationVerification.error });
+    const revocationAuth = request.revocationAuth;
+    if (!revocationAuth) {
+      return reply.code(401).send({ error: 'revocation_authorization_required' });
     }
+    const { receiptId, issuerId } = revocationAuth;
 
     const record = await prisma.receipt.findUnique({ where: { id: receiptId } });
     if (!record) {
@@ -1696,12 +1714,12 @@ export async function buildServer(options: BuildServerOptions = {}) {
         event: 'receipt_revoked',
         request_id: request.id,
         receipt_id: receiptId,
-        issuer_id: revocationVerification.issuerId
+        issuer_id: issuerId
       },
       'receipt_revoked'
     );
 
-    return reply.send({ status: 'REVOKED', issuerId: revocationVerification.issuerId });
+    return reply.send({ status: 'REVOKED', issuerId });
   });
 
   app.get('/api/v1/receipts', {
diff --git a/apps/api/src/services/compliance.ts b/apps/api/src/services/compliance.ts
index 383f31c..4272f0c 100644
--- a/apps/api/src/services/compliance.ts
+++ b/apps/api/src/services/compliance.ts
@@ -24,6 +24,7 @@ const COOK_COUNTY_SYSTEM_PROMPT = `
 TRUSTSIGNAL LLM SYSTEM PROMPT: Cook County Clerk Recording Requirements
 Your Role
 You are an AI assistant integrated into TrustSignal, a deed verification and title company automation platform. Your primary responsibility is to validate real estate documents against Cook County Clerk's Office recording requirements and identify policy mismatches before submission.
+You are an AI assistant integrated into TrustSignal, an evidence verification and title workflow automation platform. Your primary responsibility is to validate real estate documents against Cook County Clerk's Office recording requirements and identify policy mismatches before submission.
 
 Core Recording Requirements (Illinois §55 ILCS 5/3-5018)
 All real estate documents submitted to the Cook County Clerk must meet these mandatory requirements:
diff --git a/apps/api/src/services/registryAdapters.ts b/apps/api/src/services/registryAdapters.ts
index 458c564..5f4dcff 100644
--- a/apps/api/src/services/registryAdapters.ts
+++ b/apps/api/src/services/registryAdapters.ts
@@ -1,10 +1,14 @@
 import { createHash, randomUUID } from 'node:crypto';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
 
 import type { PrismaClient, RegistrySource } from '@prisma/client';
 
 type FetchLike = typeof fetch;
 
 export type RegistrySourceCategory = 'sanctions' | 'deeds' | 'dmv' | 'license' | 'notary' | 'misc';
+export type RegistrySourceAccessType = 'API' | 'BULK_DOWNLOAD' | 'PORTAL';
+export type ComplianceState = 'MATCH' | 'NO_MATCH' | 'COMPLIANCE_GAP';
 
 export const REGISTRY_SOURCE_IDS = [
   'ofac_sdn',
@@ -19,7 +23,25 @@ export const REGISTRY_SOURCE_IDS = [
   'us_csl_consolidated',
   'nppes_npi_registry',
   'sec_edgar_company_tickers',
-  'fdic_bankfind_institutions'
+  'fdic_bankfind_institutions',
+  'un_consolidated_sanctions',
+  'state_dept_debarred',
+  'state_dept_nonproliferation',
+  'ncua_credit_unions',
+  'finra_brokercheck',
+  'fincen_msb',
+  'ffiec_nic',
+  'gleif_lei',
+  'cms_medicare_optout',
+  'irs_teos',
+  'nyc_acris',
+  'canada_sema_sanctions',
+  'canada_fintrac_msb',
+  'canada_cra_charities',
+  'canada_osfi_fri',
+  'pacer_federal_courts',
+  'canada_bc_registry',
+  'canada_corporations_canada'
 ] as const;
 
 export type RegistrySourceId = typeof REGISTRY_SOURCE_IDS[number];
@@ -29,14 +51,20 @@ type ProviderType =
   | 'sam_json'
   | 'npi_json'
   | 'sec_tickers_json'
-  | 'fdic_json';
-
-export type ComplianceState = 'MATCH' | 'NO_MATCH' | 'COMPLIANCE_GAP';
+  | 'fdic_json'
+  | 'snapshot_csv'
+  | 'snapshot_xml'
+  | 'snapshot_html'
+  | 'generic_search_json'
+  | 'gleif_json'
+  | 'nyc_acris_json'
+  | 'portal_html_search';
 
 type RegistrySourceSeed = {
   id: RegistrySourceId;
   name: string;
   category: RegistrySourceCategory;
+  accessType: RegistrySourceAccessType;
   endpointEnv: string;
   endpointDefault: string;
   zkCircuit: string;
@@ -44,8 +72,71 @@ type RegistrySourceSeed = {
   parserVersion: string;
   providerType: ProviderType;
   officialSourceName: string;
-  primarySourceHost: string;
+  primarySourceHosts: string[];
   requestAcceptHeader: string;
+  authEnv?: string;
+  searchParam?: string;
+  searchPath?: string;
+};
+
+type RegistrySourceView = {
+  id: string;
+  sourceId: string;
+  name: string;
+  sourceName: string;
+  category: string;
+  accessType: RegistrySourceAccessType;
+  endpoint: string;
+  zkCircuit: string;
+  active: boolean;
+  freeTier: boolean;
+  fetchIntervalMinutes: number;
+  parserVersion: string;
+  lastFetchedAt: Date | null;
+  lastSuccessAt: Date | null;
+  lastUpdated: string | null;
+  lastError: string | null;
+};
+
+type SnapshotRecord = {
+  sourceId: RegistrySourceId;
+  capturedAt: string;
+  sourceVersion: string | null;
+  candidates: string[];
+};
+
+type RegistrySourceRecord = {
+  id: string;
+  name: string;
+  category: string;
+  endpoint: string;
+  zkCircuit: string;
+  fetchIntervalMinutes: number;
+  accessType?: string | null;
+};
+
+type RegistryOracleJobRecord = {
+  id: string;
+  sourceId: string;
+  zkCircuit: string;
+  status: string;
+  resultStatus: string | null;
+  proofUri: string | null;
+  error: string | null;
+  jobType?: string | null;
+  snapshotCapturedAt?: Date | null;
+  snapshotSourceVersion?: string | null;
+  createdAt: Date;
+  completedAt: Date | null;
+};
+
+type LookupResult = {
+  status: ComplianceState;
+  matches: RegistryMatch[];
+  sourceVersion: string | null;
+  details?: string;
+  snapshotCapturedAt?: string | null;
+  snapshotSourceVersion?: string | null;
 };
 
 export type RegistryMatch = {
@@ -72,18 +163,23 @@ export type RegistryOracleJobView = {
   id: string;
   sourceId: string;
   zkCircuit: string;
+  jobType: string;
   status: string;
   resultStatus: string | null;
   proofUri: string | null;
   error: string | null;
+  snapshotCapturedAt: string | null;
+  snapshotSourceVersion: string | null;
   createdAt: string;
   completedAt: string | null;
 };
+
 const SOURCE_SEEDS: RegistrySourceSeed[] = [
   {
     id: 'ofac_sdn',
     name: 'OFAC SDN',
     category: 'sanctions',
+    accessType: 'BULK_DOWNLOAD',
     endpointEnv: 'OFAC_SDN_URL',
     endpointDefault: 'https://www.treasury.gov/ofac/downloads/sdn.csv',
     zkCircuit: 'sanctions_nonmembership',
@@ -91,13 +187,14 @@ const SOURCE_SEEDS: RegistrySourceSeed[] = [
     parserVersion: 'ofac-csv-v1',
     providerType: 'csv',
     officialSourceName: 'U.S. Department of the Treasury - OFAC SDN List',
-    primarySourceHost: 'treasury.gov',
+    primarySourceHosts: ['treasury.gov'],
     requestAcceptHeader: 'text/csv'
   },
   {
     id: 'ofac_sls',
     name: 'OFAC SLS (Non-SDN)',
     category: 'sanctions',
+    accessType: 'BULK_DOWNLOAD',
     endpointEnv: 'OFAC_SLS_URL',
     endpointDefault: 'https://www.treasury.gov/ofac/downloads/non-sdn.csv',
     zkCircuit: 'sanctions_nonmembership',
@@ -105,13 +202,14 @@ const SOURCE_SEEDS: RegistrySourceSeed[] = [
     parserVersion: 'ofac-csv-v1',
     providerType: 'csv',
     officialSourceName: 'U.S. Department of the Treasury - OFAC Non-SDN List',
-    primarySourceHost: 'treasury.gov',
+    primarySourceHosts: ['treasury.gov'],
     requestAcceptHeader: 'text/csv'
   },
   {
     id: 'ofac_ssi',
     name: 'OFAC Sectoral (SSI)',
     category: 'sanctions',
+    accessType: 'BULK_DOWNLOAD',
     endpointEnv: 'OFAC_SSI_URL',
     endpointDefault: 'https://www.treasury.gov/ofac/downloads/ssi.csv',
     zkCircuit: 'sectoral_restriction_match',
@@ -119,13 +217,14 @@ const SOURCE_SEEDS: RegistrySourceSeed[] = [
     parserVersion: 'ofac-csv-v1',
     providerType: 'csv',
     officialSourceName: 'U.S. Department of the Treasury - OFAC SSI List',
-    primarySourceHost: 'treasury.gov',
+    primarySourceHosts: ['treasury.gov'],
     requestAcceptHeader: 'text/csv'
   },
   {
     id: 'hhs_oig_leie',
     name: 'HHS OIG LEIE',
     category: 'sanctions',
+    accessType: 'BULK_DOWNLOAD',
     endpointEnv: 'OIG_LEIE_URL',
     endpointDefault: 'https://oig.hhs.gov/exclusions/downloadables/UPDATED.csv',
     zkCircuit: 'sanctions_nonmembership',
@@ -133,13 +232,14 @@ const SOURCE_SEEDS: RegistrySourceSeed[] = [
     parserVersion: 'oig-csv-v1',
     providerType: 'csv',
     officialSourceName: 'U.S. Department of Health and Human Services OIG LEIE',
-    primarySourceHost: 'oig.hhs.gov',
+    primarySourceHosts: ['oig.hhs.gov'],
     requestAcceptHeader: 'text/csv'
   },
   {
     id: 'sam_exclusions',
     name: 'SAM Exclusions',
     category: 'sanctions',
+    accessType: 'API',
     endpointEnv: 'SAM_EXCLUSIONS_URL',
     endpointDefault: 'https://api.sam.gov/entity-information/v2/entities',
     zkCircuit: 'sanctions_nonmembership',
@@ -147,13 +247,15 @@ const SOURCE_SEEDS: RegistrySourceSeed[] = [
     parserVersion: 'sam-json-v1',
     providerType: 'sam_json',
     officialSourceName: 'U.S. General Services Administration - SAM.gov',
-    primarySourceHost: 'sam.gov',
-    requestAcceptHeader: 'application/json'
+    primarySourceHosts: ['sam.gov', 'api.sam.gov'],
+    requestAcceptHeader: 'application/json',
+    authEnv: 'SAM_API_KEY'
   },
   {
     id: 'uk_sanctions_list',
     name: 'UK Sanctions List',
     category: 'sanctions',
+    accessType: 'BULK_DOWNLOAD',
     endpointEnv: 'UK_SANCTIONS_CSV_URL',
     endpointDefault: 'https://sanctionslist.fcdo.gov.uk/docs/UK-Sanctions-List.csv',
     zkCircuit: 'sanctions_nonmembership',
@@ -161,13 +263,14 @@ const SOURCE_SEEDS: RegistrySourceSeed[] = [
     parserVersion: 'uk-csv-v1',
     providerType: 'csv',
     officialSourceName: 'UK Foreign, Commonwealth & Development Office - UK Sanctions List',
-    primarySourceHost: 'fcdo.gov.uk',
+    primarySourceHosts: ['sanctionslist.fcdo.gov.uk', 'fcdo.gov.uk'],
     requestAcceptHeader: 'text/csv'
   },
   {
     id: 'bis_entity_list',
     name: 'BIS Entity List',
     category: 'sanctions',
+    accessType: 'BULK_DOWNLOAD',
     endpointEnv: 'BIS_ENTITY_LIST_URL',
     endpointDefault: 'https://media.bis.gov/sites/default/files/documents/entity-list.csv',
     zkCircuit: 'sanctions_nonmembership',
@@ -175,13 +278,14 @@ const SOURCE_SEEDS: RegistrySourceSeed[] = [
     parserVersion: 'bis-csv-v1',
     providerType: 'csv',
     officialSourceName: 'U.S. Department of Commerce BIS Entity List',
-    primarySourceHost: 'bis.gov',
+    primarySourceHosts: ['media.bis.gov', 'bis.gov'],
     requestAcceptHeader: 'text/csv'
   },
   {
     id: 'bis_unverified_list',
     name: 'BIS Unverified List',
     category: 'sanctions',
+    accessType: 'BULK_DOWNLOAD',
     endpointEnv: 'BIS_UNVERIFIED_LIST_URL',
     endpointDefault: 'https://media.bis.gov/sites/default/files/documents/unverified-list.csv',
     zkCircuit: 'sanctions_nonmembership',
@@ -189,13 +293,14 @@ const SOURCE_SEEDS: RegistrySourceSeed[] = [
     parserVersion: 'bis-csv-v1',
     providerType: 'csv',
     officialSourceName: 'U.S. Department of Commerce BIS Unverified List',
-    primarySourceHost: 'bis.gov',
+    primarySourceHosts: ['media.bis.gov', 'bis.gov'],
     requestAcceptHeader: 'text/csv'
   },
   {
     id: 'bis_military_end_user',
     name: 'BIS Military End User List',
     category: 'sanctions',
+    accessType: 'BULK_DOWNLOAD',
     endpointEnv: 'BIS_MEU_LIST_URL',
     endpointDefault: 'https://media.bis.gov/sites/default/files/documents/military-end-user-list.csv',
     zkCircuit: 'sanctions_nonmembership',
@@ -203,13 +308,14 @@ const SOURCE_SEEDS: RegistrySourceSeed[] = [
     parserVersion: 'bis-csv-v1',
     providerType: 'csv',
     officialSourceName: 'U.S. Department of Commerce BIS Military End User List',
-    primarySourceHost: 'bis.gov',
+    primarySourceHosts: ['media.bis.gov', 'bis.gov'],
     requestAcceptHeader: 'text/csv'
   },
   {
     id: 'us_csl_consolidated',
     name: 'US Consolidated Screening List',
     category: 'sanctions',
+    accessType: 'BULK_DOWNLOAD',
     endpointEnv: 'US_CSL_CSV_URL',
     endpointDefault: 'https://data.trade.gov/downloadable_consolidated_screening_list/v1/consolidated.csv',
     zkCircuit: 'sanctions_nonmembership',
@@ -217,13 +323,14 @@ const SOURCE_SEEDS: RegistrySourceSeed[] = [
     parserVersion: 'csl-csv-v1',
     providerType: 'csv',
     officialSourceName: 'U.S. International Trade Administration - Consolidated Screening List',
-    primarySourceHost: 'trade.gov',
+    primarySourceHosts: ['data.trade.gov', 'trade.gov'],
     requestAcceptHeader: 'text/csv'
   },
   {
     id: 'nppes_npi_registry',
     name: 'NPPES NPI Registry',
     category: 'license',
+    accessType: 'API',
     endpointEnv: 'NPPES_NPI_API_URL',
     endpointDefault: 'https://npiregistry.cms.hhs.gov/api/',
     zkCircuit: 'license_status_nonmembership',
@@ -231,13 +338,14 @@ const SOURCE_SEEDS: RegistrySourceSeed[] = [
     parserVersion: 'npi-json-v1',
     providerType: 'npi_json',
     officialSourceName: 'U.S. Centers for Medicare & Medicaid Services - NPPES NPI Registry',
-    primarySourceHost: 'cms.hhs.gov',
+    primarySourceHosts: ['npiregistry.cms.hhs.gov', 'cms.hhs.gov'],
     requestAcceptHeader: 'application/json'
   },
   {
     id: 'sec_edgar_company_tickers',
     name: 'SEC EDGAR Company Tickers',
     category: 'misc',
+    accessType: 'API',
     endpointEnv: 'SEC_EDGAR_TICKERS_URL',
     endpointDefault: 'https://www.sec.gov/files/company_tickers.json',
     zkCircuit: 'entity_registry_match',
@@ -245,13 +353,14 @@ const SOURCE_SEEDS: RegistrySourceSeed[] = [
     parserVersion: 'sec-edgar-json-v1',
     providerType: 'sec_tickers_json',
     officialSourceName: 'U.S. Securities and Exchange Commission - EDGAR',
-    primarySourceHost: 'sec.gov',
+    primarySourceHosts: ['sec.gov', 'www.sec.gov'],
     requestAcceptHeader: 'application/json'
   },
   {
     id: 'fdic_bankfind_institutions',
     name: 'FDIC BankFind Institutions',
     category: 'license',
+    accessType: 'API',
     endpointEnv: 'FDIC_BANKFIND_URL',
     endpointDefault: 'https://banks.data.fdic.gov/api/institutions',
     zkCircuit: 'entity_registry_match',
@@ -259,8 +368,292 @@ const SOURCE_SEEDS: RegistrySourceSeed[] = [
     parserVersion: 'fdic-json-v1',
     providerType: 'fdic_json',
     officialSourceName: 'U.S. Federal Deposit Insurance Corporation - BankFind Suite',
-    primarySourceHost: 'fdic.gov',
+    primarySourceHosts: ['banks.data.fdic.gov', 'fdic.gov'],
     requestAcceptHeader: 'application/json'
+  },
+  {
+    id: 'un_consolidated_sanctions',
+    name: 'UN Security Council Consolidated List',
+    category: 'sanctions',
+    accessType: 'BULK_DOWNLOAD',
+    endpointEnv: 'UN_CONSOLIDATED_SANCTIONS_URL',
+    endpointDefault: 'https://scsanctions.un.org/resources/xml/en/consolidated.xml',
+    zkCircuit: 'sanctions_nonmembership',
+    fetchIntervalMinutes: 1440,
+    parserVersion: 'un-xml-v1',
+    providerType: 'snapshot_xml',
+    officialSourceName: 'United Nations Security Council - Consolidated Sanctions List',
+    primarySourceHosts: ['scsanctions.un.org'],
+    requestAcceptHeader: 'application/xml'
+  },
+  {
+    id: 'state_dept_debarred',
+    name: 'US State Dept AECA Debarred Parties',
+    category: 'sanctions',
+    accessType: 'BULK_DOWNLOAD',
+    endpointEnv: 'STATE_DEPT_DEBARRED_URL',
+    endpointDefault: 'https://www.pmddtc.state.gov/ddtc_public?id=ddtc_public_portal_debarred_list',
+    zkCircuit: 'sanctions_nonmembership',
+    fetchIntervalMinutes: 1440,
+    parserVersion: 'state-dept-debarred-v1',
+    providerType: 'snapshot_xml',
+    officialSourceName: 'U.S. Department of State - AECA Debarred Parties',
+    primarySourceHosts: ['pmddtc.state.gov', 'state.gov'],
+    requestAcceptHeader: 'application/xml,text/html'
+  },
+  {
+    id: 'state_dept_nonproliferation',
+    name: 'US State Dept Nonproliferation Sanctions',
+    category: 'sanctions',
+    accessType: 'BULK_DOWNLOAD',
+    endpointEnv: 'STATE_DEPT_NONPROLIFERATION_URL',
+    endpointDefault:
+      'https://www.state.gov/key-topics-bureau-of-international-security-and-nonproliferation/nonproliferation-sanctions/',
+    zkCircuit: 'sanctions_nonmembership',
+    fetchIntervalMinutes: 1440,
+    parserVersion: 'state-dept-nonpro-v1',
+    providerType: 'snapshot_html',
+    officialSourceName: 'U.S. Department of State - Nonproliferation Sanctions',
+    primarySourceHosts: ['www.state.gov', 'state.gov'],
+    requestAcceptHeader: 'text/html,application/xml'
+  },
+  {
+    id: 'ncua_credit_unions',
+    name: 'NCUA Credit Union Registry',
+    category: 'license',
+    accessType: 'API',
+    endpointEnv: 'NCUA_CREDIT_UNIONS_URL',
+    endpointDefault: 'https://ncua.gov/api/credit-unions',
+    zkCircuit: 'entity_registry_match',
+    fetchIntervalMinutes: 1440,
+    parserVersion: 'ncua-json-v1',
+    providerType: 'generic_search_json',
+    officialSourceName: 'National Credit Union Administration - Credit Union Registry',
+    primarySourceHosts: ['ncua.gov', 'www.ncua.gov'],
+    requestAcceptHeader: 'application/json',
+    searchParam: 'q'
+  },
+  {
+    id: 'finra_brokercheck',
+    name: 'FINRA BrokerCheck',
+    category: 'license',
+    accessType: 'API',
+    endpointEnv: 'FINRA_BROKERCHECK_URL',
+    endpointDefault: 'https://api.brokercheck.finra.org/search',
+    zkCircuit: 'license_status_nonmembership',
+    fetchIntervalMinutes: 1440,
+    parserVersion: 'finra-json-v1',
+    providerType: 'generic_search_json',
+    officialSourceName: 'Financial Industry Regulatory Authority - BrokerCheck',
+    primarySourceHosts: ['api.brokercheck.finra.org', 'brokercheck.finra.org', 'finra.org'],
+    requestAcceptHeader: 'application/json',
+    authEnv: 'FINRA_BROKERCHECK_API_KEY',
+    searchParam: 'query'
+  },
+  {
+    id: 'fincen_msb',
+    name: 'FinCEN Money Services Business Registry',
+    category: 'license',
+    accessType: 'BULK_DOWNLOAD',
+    endpointEnv: 'FINCEN_MSB_URL',
+    endpointDefault: 'https://www.fincen.gov/money-services-business-msb-registration',
+    zkCircuit: 'entity_registry_match',
+    fetchIntervalMinutes: 10080,
+    parserVersion: 'fincen-csv-v1',
+    providerType: 'snapshot_csv',
+    officialSourceName: 'U.S. Financial Crimes Enforcement Network - MSB Registry',
+    primarySourceHosts: ['www.fincen.gov', 'fincen.gov'],
+    requestAcceptHeader: 'text/csv,text/html'
+  },
+  {
+    id: 'ffiec_nic',
+    name: 'FFIEC National Information Center',
+    category: 'license',
+    accessType: 'BULK_DOWNLOAD',
+    endpointEnv: 'FFIEC_NIC_URL',
+    endpointDefault: 'https://www.ffiec.gov/npw/FinancialReport/ReturnFinancialReport',
+    zkCircuit: 'entity_registry_match',
+    fetchIntervalMinutes: 10080,
+    parserVersion: 'ffiec-xml-v1',
+    providerType: 'snapshot_xml',
+    officialSourceName: 'Federal Financial Institutions Examination Council - National Information Center',
+    primarySourceHosts: ['www.ffiec.gov', 'ffiec.gov'],
+    requestAcceptHeader: 'application/xml,text/xml'
+  },
+  {
+    id: 'gleif_lei',
+    name: 'GLEIF Legal Entity Identifier Registry',
+    category: 'misc',
+    accessType: 'API',
+    endpointEnv: 'GLEIF_LEI_URL',
+    endpointDefault: 'https://api.gleif.org/api/v1/lei-records',
+    zkCircuit: 'entity_registry_match',
+    fetchIntervalMinutes: 1440,
+    parserVersion: 'gleif-json-v1',
+    providerType: 'gleif_json',
+    officialSourceName: 'Global Legal Entity Identifier Foundation - LEI Registry',
+    primarySourceHosts: ['api.gleif.org', 'gleif.org'],
+    requestAcceptHeader: 'application/vnd.api+json'
+  },
+  {
+    id: 'cms_medicare_optout',
+    name: 'CMS Medicare Opt-Out Providers',
+    category: 'license',
+    accessType: 'BULK_DOWNLOAD',
+    endpointEnv: 'CMS_MEDICARE_OPTOUT_URL',
+    endpointDefault:
+      'https://data.cms.gov/provider-characteristics/medicare-provider-supplier-enrollment/opt-out-affidavits',
+    zkCircuit: 'license_status_nonmembership',
+    fetchIntervalMinutes: 10080,
+    parserVersion: 'cms-optout-csv-v1',
+    providerType: 'snapshot_csv',
+    officialSourceName: 'U.S. Centers for Medicare & Medicaid Services - Medicare Opt-Out Affidavits',
+    primarySourceHosts: ['data.cms.gov', 'cms.gov'],
+    requestAcceptHeader: 'text/csv,text/html'
+  },
+  {
+    id: 'irs_teos',
+    name: 'IRS Tax-Exempt Organization Search / EO BMF',
+    category: 'misc',
+    accessType: 'BULK_DOWNLOAD',
+    endpointEnv: 'IRS_TEOS_URL',
+    endpointDefault: 'https://www.irs.gov/charities-non-profits/exempt-organizations-business-master-file-extract-eo-bmf',
+    zkCircuit: 'entity_registry_match',
+    fetchIntervalMinutes: 10080,
+    parserVersion: 'irs-teos-csv-v1',
+    providerType: 'snapshot_csv',
+    officialSourceName: 'U.S. Internal Revenue Service - Exempt Organizations Business Master File',
+    primarySourceHosts: ['www.irs.gov', 'irs.gov'],
+    requestAcceptHeader: 'text/csv,text/html'
+  },
+  {
+    id: 'nyc_acris',
+    name: 'NYC ACRIS Combined Property Records',
+    category: 'deeds',
+    accessType: 'API',
+    endpointEnv: 'NYC_ACRIS_URL',
+    endpointDefault: 'https://data.cityofnewyork.us/resource/bnx9-e6tj.json',
+    zkCircuit: 'deed_registry_match',
+    fetchIntervalMinutes: 10080,
+    parserVersion: 'nyc-acris-json-v1',
+    providerType: 'nyc_acris_json',
+    officialSourceName: 'New York City Department of Finance - ACRIS Real Property Master',
+    primarySourceHosts: ['data.cityofnewyork.us'],
+    requestAcceptHeader: 'application/json',
+    searchParam: '$q'
+  },
+  {
+    id: 'canada_sema_sanctions',
+    name: 'Global Affairs Canada Autonomous Sanctions List',
+    category: 'sanctions',
+    accessType: 'BULK_DOWNLOAD',
+    endpointEnv: 'CANADA_SEMA_SANCTIONS_URL',
+    endpointDefault:
+      'https://www.international.gc.ca/world-monde/assets/office_docs/international_relations-relations_internationales/sanctions/sema-lmes.xml',
+    zkCircuit: 'sanctions_nonmembership',
+    fetchIntervalMinutes: 1440,
+    parserVersion: 'canada-sema-xml-v1',
+    providerType: 'snapshot_xml',
+    officialSourceName:
+      'Global Affairs Canada - Consolidated Canadian Autonomous Sanctions List',
+    primarySourceHosts: ['international.gc.ca'],
+    requestAcceptHeader: 'application/xml'
+  },
+  {
+    id: 'canada_fintrac_msb',
+    name: 'FINTRAC Money Services Business Registry',
+    category: 'license',
+    accessType: 'BULK_DOWNLOAD',
+    endpointEnv: 'CANADA_FINTRAC_MSB_URL',
+    endpointDefault: 'https://fintrac-canafe.canada.ca/msb-esm/public/msb-esm-list.aspx',
+    zkCircuit: 'entity_registry_match',
+    fetchIntervalMinutes: 10080,
+    parserVersion: 'fintrac-html-v1',
+    providerType: 'snapshot_html',
+    officialSourceName: 'Financial Transactions and Reports Analysis Centre of Canada - MSB Registry',
+    primarySourceHosts: ['fintrac-canafe.canada.ca'],
+    requestAcceptHeader: 'text/html'
+  },
+  {
+    id: 'canada_cra_charities',
+    name: 'CRA Canadian Charities Registry',
+    category: 'misc',
+    accessType: 'API',
+    endpointEnv: 'CANADA_CRA_CHARITIES_URL',
+    endpointDefault: 'https://apps.cra-arc.gc.ca/ebci/hacc/srch/pub/api/v1/charities',
+    zkCircuit: 'entity_registry_match',
+    fetchIntervalMinutes: 10080,
+    parserVersion: 'cra-charities-json-v1',
+    providerType: 'generic_search_json',
+    officialSourceName: 'Canada Revenue Agency - Charities Listings',
+    primarySourceHosts: ['apps.cra-arc.gc.ca', 'canada.ca'],
+    requestAcceptHeader: 'application/json',
+    searchParam: 'q'
+  },
+  {
+    id: 'canada_osfi_fri',
+    name: 'OSFI Federally Regulated Financial Institutions List',
+    category: 'license',
+    accessType: 'BULK_DOWNLOAD',
+    endpointEnv: 'CANADA_OSFI_FRI_URL',
+    endpointDefault:
+      'https://www.osfi-bsif.gc.ca/en/supervision/federally-regulated-financial-institutions',
+    zkCircuit: 'entity_registry_match',
+    fetchIntervalMinutes: 10080,
+    parserVersion: 'osfi-html-v1',
+    providerType: 'snapshot_html',
+    officialSourceName: 'Office of the Superintendent of Financial Institutions - FRFI List',
+    primarySourceHosts: ['www.osfi-bsif.gc.ca', 'osfi-bsif.gc.ca'],
+    requestAcceptHeader: 'text/html,text/csv'
+  },
+  {
+    id: 'pacer_federal_courts',
+    name: 'PACER Federal Court Records',
+    category: 'misc',
+    accessType: 'PORTAL',
+    endpointEnv: 'PACER_FEDERAL_COURTS_URL',
+    endpointDefault: 'https://pcl.uscourts.gov/pcl/pages/search/findCase.jsf',
+    zkCircuit: 'litigation_registry_match',
+    fetchIntervalMinutes: 10080,
+    parserVersion: 'pacer-portal-v1',
+    providerType: 'portal_html_search',
+    officialSourceName: 'Administrative Office of the U.S. Courts - PACER Case Locator',
+    primarySourceHosts: ['pcl.uscourts.gov', 'pacer.uscourts.gov', 'uscourts.gov'],
+    requestAcceptHeader: 'text/html,application/json',
+    authEnv: 'PACER_API_TOKEN',
+    searchParam: 'caseSearchText'
+  },
+  {
+    id: 'canada_bc_registry',
+    name: 'BC Business Registry',
+    category: 'misc',
+    accessType: 'API',
+    endpointEnv: 'CANADA_BC_REGISTRY_URL',
+    endpointDefault: 'https://bcregistry.gov.bc.ca/api/search/businesses',
+    zkCircuit: 'entity_registry_match',
+    fetchIntervalMinutes: 10080,
+    parserVersion: 'bc-registry-json-v1',
+    providerType: 'generic_search_json',
+    officialSourceName: 'British Columbia Registries and Online Services - Business Registry',
+    primarySourceHosts: ['bcregistry.gov.bc.ca'],
+    requestAcceptHeader: 'application/json',
+    searchParam: 'q'
+  },
+  {
+    id: 'canada_corporations_canada',
+    name: 'Corporations Canada Federal Business Registry',
+    category: 'misc',
+    accessType: 'PORTAL',
+    endpointEnv: 'CANADA_CORPORATIONS_CANADA_URL',
+    endpointDefault: 'https://ised-isde.canada.ca/cc/lgcy/fdrl/srch/index.html',
+    zkCircuit: 'entity_registry_match',
+    fetchIntervalMinutes: 10080,
+    parserVersion: 'corporations-canada-portal-v1',
+    providerType: 'portal_html_search',
+    officialSourceName: 'Innovation, Science and Economic Development Canada - Corporations Canada',
+    primarySourceHosts: ['ised-isde.canada.ca'],
+    requestAcceptHeader: 'text/html',
+    searchParam: 'q'
   }
 ];
 
@@ -294,6 +687,26 @@ function scoreCandidate(subject: string, candidate: string): number {
   return union === 0 ? 0 : overlap / union;
 }
 
+function buildMatches(subject: string, candidates: Iterable<string>): RegistryMatch[] {
+  const matchMap = new Map<string, number>();
+  for (const candidate of candidates) {
+    const trimmed = candidate.trim();
+    if (!trimmed) continue;
+    const score = scoreCandidate(subject, trimmed);
+    if (score >= 0.7) {
+      const current = matchMap.get(trimmed) || 0;
+      if (score > current) {
+        matchMap.set(trimmed, score);
+      }
+    }
+  }
+
+  return [...matchMap.entries()]
+    .map(([name, score]) => ({ name, score: Number(score.toFixed(3)) }))
+    .sort((a, b) => b.score - a.score)
+    .slice(0, 10);
+}
+
 function parseCsvLine(line: string): string[] {
   const values: string[] = [];
   let current = '';
@@ -349,7 +762,7 @@ function extractCandidateNames(headers: string[], row: string[]): string[] {
   const candidates: string[] = [];
   for (const [header, value] of byHeader.entries()) {
     if (!value) continue;
-    if (/(name|entity|individual|organization|aka|alias)/.test(header)) {
+    if (/(name|entity|individual|organization|aka|alias|company|institution|charity|business|provider)/.test(header)) {
       candidates.push(value);
     }
   }
@@ -367,6 +780,117 @@ function extractCandidateNames(headers: string[], row: string[]): string[] {
   return [...new Set(candidates.map((value) => value.trim()).filter(Boolean))];
 }
 
+function extractXmlCandidates(text: string): string[] {
+  const candidates = new Set<string>();
+  const tagPattern = /<([a-zA-Z0-9:_-]+)[^>]*>([^<]*)<\/\1>/g;
+  let match: RegExpExecArray | null;
+  let firstName = '';
+  let lastName = '';
+
+  while ((match = tagPattern.exec(text)) !== null) {
+    const tag = match[1].toLowerCase();
+    const value = match[2].replace(/\s+/g, ' ').trim();
+    if (!value) continue;
+
+    if (/(firstname|givenname|first-name)/.test(tag)) firstName = value;
+    if (/(lastname|surname|familyname|last-name)/.test(tag)) lastName = value;
+
+    if (/(name|entity|individual|organization|company|firm|institution|alias)/.test(tag)) {
+      candidates.add(value);
+    }
+  }
+
+  if (firstName || lastName) {
+    candidates.add(`${firstName} ${lastName}`.trim());
+  }
+
+  return [...candidates];
+}
+
+function stripHtml(text: string): string {
+  return text
+    .replace(/<script[\s\S]*?<\/script>/gi, ' ')
+    .replace(/<style[\s\S]*?<\/style>/gi, ' ')
+    .replace(/<\/?(br|p|tr|td|th|li|div|section|article|h[1-6])[^>]*>/gi, ' ')
+    .replace(/<[^>]+>/g, ' ')
+    .replace(/&nbsp;/gi, ' ')
+    .replace(/&amp;/gi, '&')
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+
+function extractHtmlCandidates(text: string): string[] {
+  const tableRows = [...text.matchAll(/<tr[^>]*>([\s\S]*?)<\/tr>/gi)];
+  const candidates = new Set<string>();
+
+  for (const row of tableRows) {
+    const rowText = stripHtml(row[1]);
+    if (!rowText) continue;
+    const parts = rowText.split(/\s{2,}|\|/).map((part) => part.trim()).filter(Boolean);
+    if (parts.length > 0) {
+      candidates.add(parts[0]);
+    }
+  }
+
+  if (candidates.size === 0) {
+    const textValue = stripHtml(text);
+    const chunks = textValue.split(/[\n;,]/).map((part) => part.trim()).filter(Boolean);
+    for (const chunk of chunks) {
+      if (chunk.split(' ').length >= 2) {
+        candidates.add(chunk);
+      }
+    }
+  }
+
+  return [...candidates];
+}
+
+function extractJsonCandidates(value: unknown, keyHint = ''): string[] {
+  const candidates = new Set<string>();
+  const keyNorm = keyHint.toLowerCase();
+
+  if (typeof value === 'string') {
+    if (/(name|entity|organization|company|broker|firm|charity|business|provider|case)/.test(keyNorm)) {
+      candidates.add(value);
+    }
+    return [...candidates];
+  }
+
+  if (Array.isArray(value)) {
+    for (const entry of value) {
+      for (const candidate of extractJsonCandidates(entry, keyHint)) {
+        candidates.add(candidate);
+      }
+    }
+    return [...candidates];
+  }
+
+  if (!value || typeof value !== 'object') {
+    return [];
+  }
+
+  const record = value as Record<string, unknown>;
+  const firstNameKeys = ['firstName', 'first_name', 'givenName'];
+  const lastNameKeys = ['lastName', 'last_name', 'surname', 'familyName'];
+  const firstName = firstNameKeys.find((key) => typeof record[key] === 'string');
+  const lastName = lastNameKeys.find((key) => typeof record[key] === 'string');
+  if (firstName || lastName) {
+    candidates.add(`${(record[firstName || ''] as string | undefined) || ''} ${(record[lastName || ''] as string | undefined) || ''}`.trim());
+  }
+
+  for (const [key, nested] of Object.entries(record)) {
+    if (typeof nested === 'string' && /(name|entity|organization|company|broker|firm|charity|business|provider|case)/i.test(key)) {
+      candidates.add(nested);
+      continue;
+    }
+    for (const candidate of extractJsonCandidates(nested, key)) {
+      candidates.add(candidate);
+    }
+  }
+
+  return [...candidates];
+}
+
 function sourceEndpoint(seed: RegistrySourceSeed, env: NodeJS.ProcessEnv = process.env): string {
   const configured = (env[seed.endpointEnv] || '').trim();
   return configured || seed.endpointDefault;
@@ -378,7 +902,11 @@ function subjectHash(sourceId: RegistrySourceId, subject: string): string {
     .digest('hex');
 }
 
-function inputCommitment(sourceId: RegistrySourceId, subject: string, response: Omit<RegistryVerifyResult, 'cached'>): string {
+function inputCommitment(
+  sourceId: RegistrySourceId,
+  subject: string,
+  response: Omit<RegistryVerifyResult, 'cached'>
+): string {
   return createHash('sha256')
     .update(
       JSON.stringify({
@@ -418,6 +946,14 @@ function resolveProviderCooldownMs(): number {
   return Math.min(parsed, 5000);
 }
 
+function resolveSnapshotRoot(snapshotDir?: string): string {
+  return snapshotDir || process.env.REGISTRY_SNAPSHOT_DIR || path.resolve(__dirname, '../..', '.registry-snapshots');
+}
+
+function snapshotPath(sourceId: RegistrySourceId, snapshotDir?: string): string {
+  return path.join(resolveSnapshotRoot(snapshotDir), `${sourceId}.json`);
+}
+
 const providerLastCallAt = new Map<string, number>();
 
 async function applyProviderCooldown(providerKey: string): Promise<void> {
@@ -432,11 +968,17 @@ async function applyProviderCooldown(providerKey: string): Promise<void> {
   providerLastCallAt.set(providerKey, Date.now());
 }
 
-function validatePrimarySourceEndpoint(seed: RegistrySourceSeed, endpoint: string): { ok: true } | { ok: false; details: string } {
+function validatePrimarySourceEndpoint(
+  seed: RegistrySourceSeed,
+  endpoint: string
+): { ok: true } | { ok: false; details: string } {
   try {
     const url = new URL(endpoint);
     const host = url.hostname.toLowerCase();
-    if (host === seed.primarySourceHost || host.endsWith(`.${seed.primarySourceHost}`)) {
+    const allowed = seed.primarySourceHosts.some(
+      (approvedHost) => host === approvedHost || host.endsWith(`.${approvedHost}`)
+    );
+    if (allowed) {
       return { ok: true };
     }
     return {
@@ -458,12 +1000,14 @@ async function secureFetch(
     method?: string;
     body?: string;
     contentType?: string;
+    headers?: Record<string, string>;
   },
   fetchImpl: FetchLike
 ): Promise<Response> {
   const headers: Record<string, string> = {
     accept: options.accept,
-    'user-agent': resolveRegistryUserAgent()
+    'user-agent': resolveRegistryUserAgent(),
+    ...(options.headers || {})
   };
 
   if (options.contentType) {
@@ -497,39 +1041,29 @@ async function fetchCsvMatches(
   }
   const csv = await response.text();
   const { headers, rows } = parseCsv(csv);
-
-  const matchMap = new Map<string, number>();
-  for (const row of rows) {
-    const names = extractCandidateNames(headers, row);
-    for (const name of names) {
-      const score = scoreCandidate(subject, name);
-      if (score >= 0.7) {
-        const current = matchMap.get(name) || 0;
-        if (score > current) {
-          matchMap.set(name, score);
-        }
-      }
-    }
+  if (headers.length === 0 || rows.length === 0) {
+    throw new Error('malformed_response');
   }
 
-  const matches = [...matchMap.entries()]
-    .map(([name, score]) => ({ name, score: Number(score.toFixed(3)) }))
-    .sort((a, b) => b.score - a.score)
-    .slice(0, 10);
+  const candidates = rows.flatMap((row) => extractCandidateNames(headers, row));
+  if (candidates.length === 0) {
+    throw new Error('malformed_response');
+  }
 
   const sourceVersion = response.headers.get('etag') || response.headers.get('last-modified');
-  return { matches, sourceVersion };
+  return { matches: buildMatches(subject, candidates), sourceVersion };
 }
 
 async function fetchSamMatches(
   source: RegistrySourceSeed,
   endpoint: string,
   subject: string,
-  fetchImpl: FetchLike
+  fetchImpl: FetchLike,
+  env: NodeJS.ProcessEnv = process.env
 ): Promise<{ matches: RegistryMatch[]; sourceVersion: string | null }> {
-  const apiKey = (process.env.SAM_API_KEY || '').trim();
+  const apiKey = (env.SAM_API_KEY || '').trim();
   if (!apiKey) {
-    return { matches: [], sourceVersion: null };
+    throw new Error('missing_auth_env:SAM_API_KEY');
   }
 
   const url = new URL(endpoint);
@@ -546,42 +1080,17 @@ async function fetchSamMatches(
   }
 
   const payload = await response.json() as Record<string, unknown>;
-  const sources = ['entityData', 'entities', 'results'] as const;
-  const entities: Array<Record<string, unknown>> = [];
-  for (const key of sources) {
-    const value = payload[key];
-    if (Array.isArray(value)) {
-      for (const entry of value) {
-        if (entry && typeof entry === 'object') {
-          entities.push(entry as Record<string, unknown>);
-        }
-      }
-    }
-  }
+  const entities = ['entityData', 'entities', 'results']
+    .flatMap((key) => (Array.isArray(payload[key]) ? payload[key] : []))
+    .filter((entry): entry is Record<string, unknown> => Boolean(entry) && typeof entry === 'object');
 
-  const matchMap = new Map<string, number>();
-  for (const entity of entities) {
-    const nameCandidates = [
-      entity.legalBusinessName,
-      entity.entityName,
-      entity.entityRegistrationName
-    ]
-      .filter((value): value is string => typeof value === 'string' && value.trim().length > 0);
-    for (const name of nameCandidates) {
-      const score = scoreCandidate(subject, name);
-      if (score >= 0.7) {
-        const current = matchMap.get(name) || 0;
-        if (score > current) matchMap.set(name, score);
-      }
-    }
-  }
+  const candidates = entities.flatMap((entity) =>
+    [entity.legalBusinessName, entity.entityName, entity.entityRegistrationName]
+      .filter((value): value is string => typeof value === 'string' && value.trim().length > 0)
+  );
 
-  const matches = [...matchMap.entries()]
-    .map(([name, score]) => ({ name, score: Number(score.toFixed(3)) }))
-    .sort((a, b) => b.score - a.score)
-    .slice(0, 10);
   const sourceVersion = response.headers.get('etag') || response.headers.get('last-modified');
-  return { matches, sourceVersion };
+  return { matches: buildMatches(subject, candidates), sourceVersion };
 }
 
 async function fetchNpiMatches(
@@ -602,14 +1111,16 @@ async function fetchNpiMatches(
   }
 
   const payload = await response.json() as Record<string, unknown>;
-  const results = Array.isArray(payload.results) ? payload.results : [];
-  const matchMap = new Map<string, number>();
+  if (!Array.isArray(payload.results)) {
+    throw new Error('malformed_response');
+  }
 
-  for (const entry of results) {
+  const candidates: string[] = [];
+  for (const entry of payload.results) {
     if (!entry || typeof entry !== 'object') continue;
     const asRecord = entry as Record<string, unknown>;
-    const basic = (asRecord.basic && typeof asRecord.basic === 'object')
-      ? (asRecord.basic as Record<string, unknown>)
+    const basic = asRecord.basic && typeof asRecord.basic === 'object'
+      ? asRecord.basic as Record<string, unknown>
       : null;
     const names = [
       typeof basic?.organization_name === 'string' ? basic.organization_name : '',
@@ -617,22 +1128,11 @@ async function fetchNpiMatches(
         typeof basic?.last_name === 'string' ? basic.last_name : ''
       }`.trim()
     ].filter((value) => value.trim().length > 0);
-
-    for (const name of names) {
-      const score = scoreCandidate(subject, name);
-      if (score >= 0.7) {
-        const current = matchMap.get(name) || 0;
-        if (score > current) matchMap.set(name, score);
-      }
-    }
+    candidates.push(...names);
   }
 
-  const matches = [...matchMap.entries()]
-    .map(([name, score]) => ({ name, score: Number(score.toFixed(3)) }))
-    .sort((a, b) => b.score - a.score)
-    .slice(0, 10);
   const sourceVersion = response.headers.get('etag') || response.headers.get('last-modified');
-  return { matches, sourceVersion };
+  return { matches: buildMatches(subject, candidates), sourceVersion };
 }
 
 async function fetchSecTickerMatches(
@@ -648,28 +1148,21 @@ async function fetchSecTickerMatches(
   }
 
   const payload = await response.json() as Record<string, unknown>;
-  const matchMap = new Map<string, number>();
-  for (const value of Object.values(payload)) {
+  const values = Object.values(payload);
+  if (values.length === 0) {
+    throw new Error('malformed_response');
+  }
+
+  const candidates: string[] = [];
+  for (const value of values) {
     if (!value || typeof value !== 'object') continue;
     const company = value as Record<string, unknown>;
-    const title = typeof company.title === 'string' ? company.title : '';
-    const ticker = typeof company.ticker === 'string' ? company.ticker : '';
-    const candidates = [title, ticker].filter((item) => item.length > 0);
-    for (const candidate of candidates) {
-      const score = scoreCandidate(subject, candidate);
-      if (score >= 0.7) {
-        const current = matchMap.get(candidate) || 0;
-        if (score > current) matchMap.set(candidate, score);
-      }
-    }
+    if (typeof company.title === 'string') candidates.push(company.title);
+    if (typeof company.ticker === 'string') candidates.push(company.ticker);
   }
 
-  const matches = [...matchMap.entries()]
-    .map(([name, score]) => ({ name, score: Number(score.toFixed(3)) }))
-    .sort((a, b) => b.score - a.score)
-    .slice(0, 10);
   const sourceVersion = response.headers.get('etag') || response.headers.get('last-modified');
-  return { matches, sourceVersion };
+  return { matches: buildMatches(subject, candidates), sourceVersion };
 }
 
 async function fetchFdicMatches(
@@ -691,27 +1184,236 @@ async function fetchFdicMatches(
   }
 
   const payload = await response.json() as Record<string, unknown>;
-  const data = Array.isArray(payload.data) ? payload.data : [];
-  const matchMap = new Map<string, number>();
-  for (const row of data) {
+  if (!Array.isArray(payload.data)) {
+    throw new Error('malformed_response');
+  }
+
+  const candidates: string[] = [];
+  for (const row of payload.data) {
     if (!row || typeof row !== 'object') continue;
     const details = (row as Record<string, unknown>).data;
     if (!details || typeof details !== 'object') continue;
     const name = (details as Record<string, unknown>).NAME;
-    if (typeof name !== 'string' || name.trim().length === 0) continue;
-    const score = scoreCandidate(subject, name);
-    if (score >= 0.7) {
-      const current = matchMap.get(name) || 0;
-      if (score > current) matchMap.set(name, score);
+    if (typeof name === 'string' && name.trim().length > 0) {
+      candidates.push(name);
     }
   }
 
-  const matches = [...matchMap.entries()]
-    .map(([name, score]) => ({ name, score: Number(score.toFixed(3)) }))
-    .sort((a, b) => b.score - a.score)
-    .slice(0, 10);
   const sourceVersion = response.headers.get('etag') || response.headers.get('last-modified');
-  return { matches, sourceVersion };
+  return { matches: buildMatches(subject, candidates), sourceVersion };
+}
+
+async function fetchGenericSearchJsonMatches(
+  source: RegistrySourceSeed,
+  endpoint: string,
+  subject: string,
+  fetchImpl: FetchLike,
+  env: NodeJS.ProcessEnv = process.env
+): Promise<{ matches: RegistryMatch[]; sourceVersion: string | null }> {
+  if (source.authEnv && !(env[source.authEnv] || '').trim()) {
+    throw new Error(`missing_auth_env:${source.authEnv}`);
+  }
+
+  const url = new URL(endpoint);
+  url.searchParams.set(source.searchParam || 'q', subject);
+  url.searchParams.set('limit', '25');
+
+  const headers: Record<string, string> = {};
+  if (source.authEnv) {
+    headers.authorization = `Bearer ${(env[source.authEnv] || '').trim()}`;
+  }
+
+  await applyProviderCooldown(source.id);
+  const response = await secureFetch(url.toString(), {
+    accept: source.requestAcceptHeader,
+    headers
+  }, fetchImpl);
+  if (!response.ok) {
+    throw new Error(`upstream_http_${response.status}`);
+  }
+
+  const payload = await response.json().catch(() => null);
+  if (!payload || typeof payload !== 'object') {
+    throw new Error('malformed_response');
+  }
+
+  const candidates = extractJsonCandidates(payload);
+  const sourceVersion = response.headers.get('etag') || response.headers.get('last-modified');
+  return { matches: buildMatches(subject, candidates), sourceVersion };
+}
+
+async function fetchGleifMatches(
+  source: RegistrySourceSeed,
+  endpoint: string,
+  subject: string,
+  fetchImpl: FetchLike
+): Promise<{ matches: RegistryMatch[]; sourceVersion: string | null }> {
+  const url = new URL(endpoint);
+  url.searchParams.set('filter[entity.legalName]', subject);
+  url.searchParams.set('page[size]', '25');
+
+  await applyProviderCooldown(source.id);
+  const response = await secureFetch(url.toString(), { accept: source.requestAcceptHeader }, fetchImpl);
+  if (!response.ok) {
+    throw new Error(`upstream_http_${response.status}`);
+  }
+
+  const payload = await response.json().catch(() => null) as Record<string, unknown> | null;
+  if (!payload || !Array.isArray(payload.data)) {
+    throw new Error('malformed_response');
+  }
+
+  const candidates: string[] = [];
+  for (const entry of payload.data) {
+    if (!entry || typeof entry !== 'object') continue;
+    const attributes = (entry as Record<string, unknown>).attributes;
+    if (!attributes || typeof attributes !== 'object') continue;
+    const entity = (attributes as Record<string, unknown>).entity;
+    if (!entity || typeof entity !== 'object') continue;
+    const legalName = (entity as Record<string, unknown>).legalName;
+    if (legalName && typeof legalName === 'object' && typeof (legalName as Record<string, unknown>).name === 'string') {
+      candidates.push((legalName as Record<string, unknown>).name as string);
+    }
+    const legalAddress = (entity as Record<string, unknown>).otherNames;
+    candidates.push(...extractJsonCandidates(legalAddress));
+  }
+
+  const sourceVersion = response.headers.get('etag') || response.headers.get('last-modified');
+  return { matches: buildMatches(subject, candidates), sourceVersion };
+}
+
+async function fetchNycAcrisMatches(
+  source: RegistrySourceSeed,
+  endpoint: string,
+  subject: string,
+  fetchImpl: FetchLike
+): Promise<{ matches: RegistryMatch[]; sourceVersion: string | null }> {
+  const url = new URL(endpoint);
+  url.searchParams.set(source.searchParam || '$q', subject);
+  url.searchParams.set('$limit', '25');
+
+  await applyProviderCooldown(source.id);
+  const response = await secureFetch(url.toString(), { accept: source.requestAcceptHeader }, fetchImpl);
+  if (!response.ok) {
+    throw new Error(`upstream_http_${response.status}`);
+  }
+
+  const payload = await response.json().catch(() => null);
+  if (!Array.isArray(payload)) {
+    throw new Error('malformed_response');
+  }
+
+  const candidates = payload.flatMap((entry) => extractJsonCandidates(entry));
+  const sourceVersion = response.headers.get('etag') || response.headers.get('last-modified');
+  return { matches: buildMatches(subject, candidates), sourceVersion };
+}
+
+async function fetchPortalHtmlMatches(
+  source: RegistrySourceSeed,
+  endpoint: string,
+  subject: string,
+  fetchImpl: FetchLike,
+  env: NodeJS.ProcessEnv = process.env
+): Promise<{ matches: RegistryMatch[]; sourceVersion: string | null }> {
+  if (source.authEnv && !(env[source.authEnv] || '').trim()) {
+    throw new Error(`missing_auth_env:${source.authEnv}`);
+  }
+
+  const url = new URL(endpoint);
+  url.searchParams.set(source.searchParam || 'q', subject);
+
+  const headers: Record<string, string> = {};
+  if (source.authEnv) {
+    headers.authorization = `Bearer ${(env[source.authEnv] || '').trim()}`;
+  }
+
+  await applyProviderCooldown(source.id);
+  const response = await secureFetch(url.toString(), {
+    accept: source.requestAcceptHeader,
+    headers
+  }, fetchImpl);
+  if (!response.ok) {
+    throw new Error(`upstream_http_${response.status}`);
+  }
+
+  const contentType = response.headers.get('content-type') || '';
+  const body = await response.text();
+  const candidates = contentType.includes('json')
+    ? extractJsonCandidates(JSON.parse(body))
+    : extractHtmlCandidates(body);
+  if (candidates.length === 0) {
+    throw new Error('malformed_response');
+  }
+
+  const sourceVersion = response.headers.get('etag') || response.headers.get('last-modified');
+  return { matches: buildMatches(subject, candidates), sourceVersion };
+}
+
+async function fetchSnapshotPayload(
+  seed: RegistrySourceSeed,
+  endpoint: string,
+  fetchImpl: FetchLike
+): Promise<SnapshotRecord> {
+  await applyProviderCooldown(seed.id);
+  const response = await secureFetch(endpoint, { accept: seed.requestAcceptHeader }, fetchImpl);
+  if (!response.ok) {
+    throw new Error(`upstream_http_${response.status}`);
+  }
+
+  const body = await response.text();
+  if (!body.trim()) {
+    throw new Error('malformed_response');
+  }
+
+  let candidates: string[] = [];
+  if (seed.providerType === 'snapshot_csv') {
+    const { headers, rows } = parseCsv(body);
+    if (headers.length === 0 || rows.length === 0) {
+      throw new Error('malformed_response');
+    }
+    candidates = rows.flatMap((row) => extractCandidateNames(headers, row));
+  } else if (seed.providerType === 'snapshot_xml') {
+    candidates = extractXmlCandidates(body);
+  } else if (seed.providerType === 'snapshot_html') {
+    candidates = extractHtmlCandidates(body);
+  }
+
+  const normalizedCandidates = [...new Set(candidates.map((candidate) => candidate.trim()).filter(Boolean))];
+  if (normalizedCandidates.length === 0) {
+    throw new Error('malformed_response');
+  }
+
+  return {
+    sourceId: seed.id,
+    capturedAt: new Date().toISOString(),
+    sourceVersion: response.headers.get('etag') || response.headers.get('last-modified'),
+    candidates: normalizedCandidates
+  };
+}
+
+async function readSnapshot(
+  sourceId: RegistrySourceId,
+  snapshotDir?: string
+): Promise<SnapshotRecord | null> {
+  try {
+    const raw = await readFile(snapshotPath(sourceId, snapshotDir), 'utf8');
+    return JSON.parse(raw) as SnapshotRecord;
+  } catch {
+    return null;
+  }
+}
+
+async function writeSnapshot(snapshot: SnapshotRecord, snapshotDir?: string): Promise<void> {
+  const filePath = snapshotPath(snapshot.sourceId, snapshotDir);
+  await mkdir(path.dirname(filePath), { recursive: true });
+  await writeFile(filePath, JSON.stringify(snapshot), 'utf8');
+}
+
+function snapshotIsFresh(snapshot: SnapshotRecord | null, seed: RegistrySourceSeed): boolean {
+  if (!snapshot) return false;
+  const capturedAt = Date.parse(snapshot.capturedAt);
+  if (!Number.isFinite(capturedAt)) return false;
+  return Date.now() - capturedAt < seed.fetchIntervalMinutes * 60 * 1000;
 }
 
 async function syncRegistrySources(prisma: PrismaClient, env: NodeJS.ProcessEnv = process.env): Promise<void> {
@@ -721,33 +1423,117 @@ async function syncRegistrySources(prisma: PrismaClient, env: NodeJS.ProcessEnv
       update: {
         name: seed.officialSourceName,
         category: seed.category,
+        accessType: seed.accessType,
         endpoint: sourceEndpoint(seed, env),
         zkCircuit: seed.zkCircuit,
         active: true,
         freeTier: true,
         fetchIntervalMinutes: seed.fetchIntervalMinutes,
         parserVersion: seed.parserVersion
-      },
+      } as never,
       create: {
         id: seed.id,
         name: seed.officialSourceName,
         category: seed.category,
+        accessType: seed.accessType,
         endpoint: sourceEndpoint(seed, env),
         zkCircuit: seed.zkCircuit,
         active: true,
         freeTier: true,
         fetchIntervalMinutes: seed.fetchIntervalMinutes,
         parserVersion: seed.parserVersion
+      } as never
+    });
+  }
+}
+
+async function createIngestJob(
+  prisma: PrismaClient,
+  seed: RegistrySourceSeed
+) {
+  return prisma.registryOracleJob.create({
+    data: {
+      sourceId: seed.id,
+      subjectHash: createHash('sha256').update(`snapshot:${seed.id}`).digest('hex'),
+      zkCircuit: seed.zkCircuit,
+      inputCommitment: createHash('sha256').update(`${seed.id}:${Date.now()}`).digest('hex'),
+      jobType: 'INGEST',
+      status: 'QUEUED',
+      resultStatus: null
+    } as never
+  });
+}
+
+async function ensureSourceSnapshot(
+  prisma: PrismaClient,
+  source: RegistrySourceRecord,
+  seed: RegistrySourceSeed,
+  fetchImpl: FetchLike,
+  snapshotDir?: string
+): Promise<SnapshotRecord> {
+  const existing = await readSnapshot(seed.id, snapshotDir);
+  if (snapshotIsFresh(existing, seed)) {
+    return existing as SnapshotRecord;
+  }
+
+  const ingestJob = await createIngestJob(prisma, seed);
+  try {
+    const snapshot = await fetchSnapshotPayload(seed, source.endpoint, fetchImpl);
+    await writeSnapshot(snapshot, snapshotDir);
+    const capturedAt = new Date(snapshot.capturedAt);
+    await prisma.registryOracleJob.update({
+      where: { id: ingestJob.id },
+      data: {
+        status: 'COMPLETED',
+        completedAt: capturedAt,
+        snapshotCapturedAt: capturedAt,
+        snapshotSourceVersion: snapshot.sourceVersion || null
+      } as never
+    });
+    await prisma.registrySource.update({
+      where: { id: source.id },
+      data: {
+        lastFetchedAt: capturedAt,
+        lastSuccessAt: capturedAt,
+        lastError: null
       }
     });
+    return snapshot;
+  } catch (error) {
+    const message =
+      error instanceof Error && error.message ? error.message.slice(0, 200) : 'snapshot_ingest_failed';
+    await prisma.registryOracleJob.update({
+      where: { id: ingestJob.id },
+      data: {
+        status: 'FAILED',
+        error: `snapshot ingest failed: ${message}`,
+        completedAt: new Date()
+      } as never
+    });
+    await prisma.registrySource.update({
+      where: { id: source.id },
+      data: {
+        lastFetchedAt: new Date(),
+        lastError: `snapshot ingest failed: ${message}`
+      }
+    });
+    throw error;
   }
 }
 
-async function runLookup(
-  source: RegistrySource,
-  subject: string,
-  fetchImpl: FetchLike
-): Promise<{ status: RegistryVerifyResult['status']; matches: RegistryMatch[]; sourceVersion: string | null; details?: string }> {
+function providerUsesSnapshot(seed: RegistrySourceSeed): boolean {
+  return seed.providerType === 'snapshot_csv' || seed.providerType === 'snapshot_xml' || seed.providerType === 'snapshot_html';
+}
+
+async function runLookup(args: {
+  prisma: PrismaClient;
+  source: RegistrySourceRecord;
+  subject: string;
+  fetchImpl: FetchLike;
+  env?: NodeJS.ProcessEnv;
+  snapshotDir?: string;
+}): Promise<LookupResult> {
+  const { prisma, source, subject, fetchImpl, env = process.env, snapshotDir } = args;
   const seed = SOURCE_SEED_BY_ID.get(source.id as RegistrySourceId);
   if (!seed) {
     return {
@@ -769,16 +1555,19 @@ async function runLookup(
   }
 
   try {
+    if (providerUsesSnapshot(seed)) {
+      const snapshot = await ensureSourceSnapshot(prisma, source, seed, fetchImpl, snapshotDir);
+      return {
+        status: buildMatches(subject, snapshot.candidates).length > 0 ? 'MATCH' : 'NO_MATCH',
+        matches: buildMatches(subject, snapshot.candidates),
+        sourceVersion: snapshot.sourceVersion,
+        snapshotCapturedAt: snapshot.capturedAt,
+        snapshotSourceVersion: snapshot.sourceVersion
+      };
+    }
+
     if (seed.providerType === 'sam_json') {
-      if (!(process.env.SAM_API_KEY || '').trim()) {
-        return {
-          status: 'COMPLIANCE_GAP',
-          matches: [],
-          sourceVersion: null,
-          details: 'SAM_API_KEY is not configured for SAM.gov primary source calls'
-        };
-      }
-      const result = await fetchSamMatches(seed, source.endpoint, subject, fetchImpl);
+      const result = await fetchSamMatches(seed, source.endpoint, subject, fetchImpl, env);
       return {
         status: result.matches.length > 0 ? 'MATCH' : 'NO_MATCH',
         matches: result.matches,
@@ -813,6 +1602,42 @@ async function runLookup(
       };
     }
 
+    if (seed.providerType === 'gleif_json') {
+      const result = await fetchGleifMatches(seed, source.endpoint, subject, fetchImpl);
+      return {
+        status: result.matches.length > 0 ? 'MATCH' : 'NO_MATCH',
+        matches: result.matches,
+        sourceVersion: result.sourceVersion
+      };
+    }
+
+    if (seed.providerType === 'nyc_acris_json') {
+      const result = await fetchNycAcrisMatches(seed, source.endpoint, subject, fetchImpl);
+      return {
+        status: result.matches.length > 0 ? 'MATCH' : 'NO_MATCH',
+        matches: result.matches,
+        sourceVersion: result.sourceVersion
+      };
+    }
+
+    if (seed.providerType === 'generic_search_json') {
+      const result = await fetchGenericSearchJsonMatches(seed, source.endpoint, subject, fetchImpl, env);
+      return {
+        status: result.matches.length > 0 ? 'MATCH' : 'NO_MATCH',
+        matches: result.matches,
+        sourceVersion: result.sourceVersion
+      };
+    }
+
+    if (seed.providerType === 'portal_html_search') {
+      const result = await fetchPortalHtmlMatches(seed, source.endpoint, subject, fetchImpl, env);
+      return {
+        status: result.matches.length > 0 ? 'MATCH' : 'NO_MATCH',
+        matches: result.matches,
+        sourceVersion: result.sourceVersion
+      };
+    }
+
     const result = await fetchCsvMatches(seed, source.endpoint, subject, fetchImpl);
     return {
       status: result.matches.length > 0 ? 'MATCH' : 'NO_MATCH',
@@ -871,13 +1696,14 @@ async function dispatchOracleJob(
   }
 }
 
-const SOURCES_SYNC_TTL_MS = 60 * 60 * 1000; // re-sync source seeds at most once per hour
+const SOURCES_SYNC_TTL_MS = 60 * 60 * 1000;
 
 export function createRegistryAdapterService(
   prisma: PrismaClient,
-  options?: { fetchImpl?: FetchLike }
+  options?: { fetchImpl?: FetchLike; snapshotDir?: string }
 ) {
   const fetchImpl = options?.fetchImpl ?? fetch;
+  const snapshotDir = options?.snapshotDir;
   let sourcesReadyAt: number | null = null;
   let syncInFlight: Promise<void> | null = null;
 
@@ -886,37 +1712,48 @@ export function createRegistryAdapterService(
     if (sourcesReadyAt !== null && now - sourcesReadyAt < SOURCES_SYNC_TTL_MS) {
       return;
     }
-    // Deduplicate concurrent sync calls: share a single in-flight promise.
     if (!syncInFlight) {
-      syncInFlight = syncRegistrySources(prisma).then(() => {
-        sourcesReadyAt = Date.now();
-        syncInFlight = null;
-      }).catch((err) => {
-        syncInFlight = null;
-        throw err;
-      });
+      syncInFlight = syncRegistrySources(prisma)
+        .then(() => {
+          sourcesReadyAt = Date.now();
+          syncInFlight = null;
+        })
+        .catch((err) => {
+          syncInFlight = null;
+          throw err;
+        });
     }
     await syncInFlight;
   }
 
   return {
-    async listSources() {
+    async listSources(): Promise<RegistrySourceView[]> {
       await ensureSourcesReady();
       const sources = await prisma.registrySource.findMany({ orderBy: [{ category: 'asc' }, { id: 'asc' }] });
-      return sources.map((source) => ({
-        id: source.id,
+      return sources.map((source) => {
+        const seed = SOURCE_SEED_BY_ID.get(source.id as RegistrySourceId);
+        const sourceWithAccessType = source as RegistrySource & { accessType?: string | null };
+        const accessType = (sourceWithAccessType.accessType as RegistrySourceAccessType | null) || seed?.accessType || 'API';
+        const lastUpdated = source.lastSuccessAt || source.lastFetchedAt;
+        return {
+          id: source.id,
+        sourceId: source.id,
         name: source.name,
-        category: source.category,
-        endpoint: source.endpoint,
-        zkCircuit: source.zkCircuit,
-        active: source.active,
-        freeTier: source.freeTier,
-        fetchIntervalMinutes: source.fetchIntervalMinutes,
-        parserVersion: source.parserVersion,
-        lastFetchedAt: source.lastFetchedAt,
-        lastSuccessAt: source.lastSuccessAt,
-        lastError: source.lastError
-      }));
+        sourceName: seed?.name || source.name,
+          category: source.category,
+          accessType,
+          endpoint: source.endpoint,
+          zkCircuit: source.zkCircuit,
+          active: source.active,
+          freeTier: source.freeTier,
+          fetchIntervalMinutes: source.fetchIntervalMinutes,
+          parserVersion: source.parserVersion,
+          lastFetchedAt: source.lastFetchedAt,
+          lastSuccessAt: source.lastSuccessAt,
+          lastUpdated: lastUpdated ? lastUpdated.toISOString() : null,
+          lastError: source.lastError
+        };
+      });
     },
 
     async verify(input: { sourceId: RegistrySourceId; subject: string; forceRefresh?: boolean }): Promise<RegistryVerifyResult> {
@@ -926,6 +1763,7 @@ export function createRegistryAdapterService(
       if (!source || !source.active) {
         throw new Error('registry_source_not_found');
       }
+      const sourceWithAccessType = source as RegistrySource & { accessType?: string | null };
 
       const now = new Date();
       const key = subjectHash(input.sourceId, input.subject);
@@ -945,7 +1783,21 @@ export function createRegistryAdapterService(
         }
       }
 
-      const lookup = await runLookup(source, input.subject, fetchImpl);
+      const lookup = await runLookup({
+        prisma,
+        source: {
+          id: source.id,
+          name: source.name,
+          category: source.category,
+          endpoint: source.endpoint,
+          zkCircuit: source.zkCircuit,
+          fetchIntervalMinutes: source.fetchIntervalMinutes,
+          accessType: sourceWithAccessType.accessType
+        },
+        subject: input.subject,
+        fetchImpl,
+        snapshotDir
+      });
       const checkedAt = new Date();
       const response: Omit<RegistryVerifyResult, 'cached'> = {
         sourceId: input.sourceId,
@@ -968,9 +1820,12 @@ export function createRegistryAdapterService(
           subjectHash: key,
           zkCircuit: source.zkCircuit,
           inputCommitment: commitment,
+          jobType: 'VERIFY',
           status: 'QUEUED',
-          resultStatus: response.status
-        }
+          resultStatus: response.status,
+          snapshotCapturedAt: lookup.snapshotCapturedAt ? new Date(lookup.snapshotCapturedAt) : null,
+          snapshotSourceVersion: lookup.snapshotSourceVersion || null
+        } as never
       });
 
       const dispatch = await dispatchOracleJob(
@@ -988,7 +1843,9 @@ export function createRegistryAdapterService(
         data: {
           status: dispatch.status,
           proofUri: dispatch.proofUri || null,
-          error: dispatch.error || null,
+          error: response.status === 'COMPLIANCE_GAP'
+            ? response.details || dispatch.error || null
+            : dispatch.error || null,
           completedAt: dispatch.status === 'DISPATCHED' ? null : checkedAt
         }
       });
@@ -1025,7 +1882,7 @@ export function createRegistryAdapterService(
         data: {
           lastFetchedAt: checkedAt,
           lastSuccessAt: response.status === 'COMPLIANCE_GAP' ? source.lastSuccessAt : checkedAt,
-          lastError: response.status === 'COMPLIANCE_GAP' ? (response.details || 'compliance_gap') : null
+          lastError: response.status === 'COMPLIANCE_GAP' ? response.details || 'compliance_gap' : null
         }
       });
 
@@ -1057,16 +1914,20 @@ export function createRegistryAdapterService(
       });
 
       if (!job) return null;
+      const typedJob = job as RegistryOracleJobRecord;
       return {
-        id: job.id,
-        sourceId: job.sourceId,
-        zkCircuit: job.zkCircuit,
-        status: job.status,
-        resultStatus: job.resultStatus,
-        proofUri: job.proofUri,
-        error: job.error,
-        createdAt: job.createdAt.toISOString(),
-        completedAt: job.completedAt ? job.completedAt.toISOString() : null
+        id: typedJob.id,
+        sourceId: typedJob.sourceId,
+        zkCircuit: typedJob.zkCircuit,
+        jobType: typedJob.jobType || 'VERIFY',
+        status: typedJob.status,
+        resultStatus: typedJob.resultStatus,
+        proofUri: typedJob.proofUri,
+        error: typedJob.error,
+        snapshotCapturedAt: typedJob.snapshotCapturedAt ? typedJob.snapshotCapturedAt.toISOString() : null,
+        snapshotSourceVersion: typedJob.snapshotSourceVersion || null,
+        createdAt: typedJob.createdAt.toISOString(),
+        completedAt: typedJob.completedAt ? typedJob.completedAt.toISOString() : null
       };
     },
 
@@ -1076,17 +1937,60 @@ export function createRegistryAdapterService(
         take: Math.max(1, Math.min(limit, 200))
       });
 
-      return jobs.map((job) => ({
-        id: job.id,
-        sourceId: job.sourceId,
-        zkCircuit: job.zkCircuit,
-        status: job.status,
-        resultStatus: job.resultStatus,
-        proofUri: job.proofUri,
-        error: job.error,
-        createdAt: job.createdAt.toISOString(),
-        completedAt: job.completedAt ? job.completedAt.toISOString() : null
-      }));
+      return jobs.map((job) => {
+        const typedJob = job as RegistryOracleJobRecord;
+        return {
+          id: typedJob.id,
+          sourceId: typedJob.sourceId,
+          zkCircuit: typedJob.zkCircuit,
+          jobType: typedJob.jobType || 'VERIFY',
+          status: typedJob.status,
+          resultStatus: typedJob.resultStatus,
+          proofUri: typedJob.proofUri,
+          error: typedJob.error,
+          snapshotCapturedAt: typedJob.snapshotCapturedAt ? typedJob.snapshotCapturedAt.toISOString() : null,
+          snapshotSourceVersion: typedJob.snapshotSourceVersion || null,
+          createdAt: typedJob.createdAt.toISOString(),
+          completedAt: typedJob.completedAt ? typedJob.completedAt.toISOString() : null
+        };
+      });
     }
   };
 }
+
+export const __testables = {
+  SOURCE_SEEDS,
+  resetProviderCooldowns() {
+    providerLastCallAt.clear();
+  },
+  async lookupSourceById(input: {
+    prisma: PrismaClient;
+    sourceId: RegistrySourceId;
+    subject: string;
+    fetchImpl: FetchLike;
+    env?: NodeJS.ProcessEnv;
+    endpoint?: string;
+    snapshotDir?: string;
+  }) {
+    const seed = SOURCE_SEED_BY_ID.get(input.sourceId);
+    if (!seed) {
+      throw new Error(`unknown_source:${input.sourceId}`);
+    }
+    return runLookup({
+      prisma: input.prisma,
+      source: {
+        id: seed.id,
+        name: seed.officialSourceName,
+        category: seed.category,
+        endpoint: input.endpoint || sourceEndpoint(seed, input.env),
+        zkCircuit: seed.zkCircuit,
+        fetchIntervalMinutes: seed.fetchIntervalMinutes,
+        accessType: seed.accessType
+      },
+      subject: input.subject,
+      fetchImpl: input.fetchImpl,
+      env: input.env,
+      snapshotDir: input.snapshotDir
+    });
+  }
+};
diff --git a/apps/watcher/src/index.js b/apps/watcher/src/index.js
index 8d2c00d..8813f0a 100644
--- a/apps/watcher/src/index.js
+++ b/apps/watcher/src/index.js
@@ -27,7 +27,7 @@ if (!fs.existsSync(WATCH_DIR)) {
     console.log(`Created watch directory: ${WATCH_DIR}`);
 }
 
-console.log(`DeedShield Watcher Service started.`);
+console.log(`TrustSignal Watcher Service started.`);
 console.log(`Monitoring: ${WATCH_DIR}`);
 
 const watcher = chokidar.watch(WATCH_DIR, {
@@ -81,7 +81,7 @@ watcher.on('add', async (filePath) => {
         };
 
         // 3. Verify via API
-        console.log(' -> Verifying against Deed Shield Network...');
+        console.log(' -> Verifying against TrustSignal Network...');
         const response = await axios.post(API_URL, payload);
         const result = response.data;
 
@@ -89,7 +89,7 @@ watcher.on('add', async (filePath) => {
         if (result.decision === 'ALLOW') {
             console.log(` -> ✅ RESULT: VERIFIED (Score: ${result.riskScore})`);
             notifier.notify({
-                title: 'Deed Shield Verified',
+                title: 'TrustSignal Verified',
                 message: `File: ${fileName}\nStatus: Is Clean (Score: 0)`,
                 sound: true
             });
@@ -97,7 +97,7 @@ watcher.on('add', async (filePath) => {
             console.log(` -> ⚠️ RESULT: ${result.decision}`);
             const reasons = Array.isArray(result.reasons) ? result.reasons.join(', ') : 'Unknown risks';
             notifier.notify({
-                title: 'Deed Shield Alert',
+                title: 'TrustSignal Alert',
                 message: `File: ${fileName}\nFlagged: ${reasons}`,
                 sound: 'Glass'
             });
@@ -106,7 +106,7 @@ watcher.on('add', async (filePath) => {
     } catch (err) {
         if (err.code === 'ECONNREFUSED') {
             console.error(' -> ❌ ERROR: API Server is unreachable. Is it running on port 3001?');
-            notifier.notify({ title: 'Deed Shield Error', message: 'Could not connect to Verification Server.' });
+            notifier.notify({ title: 'TrustSignal Error', message: 'Could not connect to Verification Server.' });
         } else {
             console.error(' -> ❌ ERROR:', err.message);
             if (err.response) {
diff --git a/apps/web/package.json b/apps/web/package.json
index badc02d..ace79bf 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -1,5 +1,5 @@
 {
-  "name": "@deed-shield/web",
+  "name": "@trustsignal/web",
   "version": "0.2.0",
   "private": true,
   "type": "module",
diff --git a/apps/web/src/app/verify-artifact/page.tsx b/apps/web/src/app/verify-artifact/page.tsx
index a9e8202..27e475f 100644
--- a/apps/web/src/app/verify-artifact/page.tsx
+++ b/apps/web/src/app/verify-artifact/page.tsx
@@ -1,9 +1,5 @@
-import ArtifactVerifyClient from './ArtifactVerifyClient';
+import { redirect } from 'next/navigation';
 
-export default function VerifyArtifactPage() {
-  return (
-    <div className="grid">
-      <ArtifactVerifyClient />
-    </div>
-  );
+export default function VerifyArtifactAliasPage() {
+  redirect('/verify');
 }
diff --git a/apps/web/src/contexts/OperatorContext.tsx b/apps/web/src/contexts/OperatorContext.tsx
index 9530796..8d5d18a 100644
--- a/apps/web/src/contexts/OperatorContext.tsx
+++ b/apps/web/src/contexts/OperatorContext.tsx
@@ -28,18 +28,23 @@ interface OperatorProviderProps {
 export function OperatorProvider({ children }: OperatorProviderProps) {
   const [operator, setOperator] = useState<OperatorContextType | null>(null);
   const [isAuthenticated, setIsAuthenticated] = useState(false);
+  const storageKey = 'trustsignal-operator';
+  const legacyStorageKey = 'deed-shield-operator';
 
   useEffect(() => {
-    // Check for existing session on mount
-    const savedOperator = localStorage.getItem('deed-shield-operator');
+    // Check for existing session on mount and migrate legacy branding.
+    const savedOperator = localStorage.getItem(storageKey) || localStorage.getItem(legacyStorageKey);
     if (savedOperator) {
       try {
         const parsedOperator = JSON.parse(savedOperator);
         setOperator(parsedOperator);
         setIsAuthenticated(true);
+        localStorage.setItem(storageKey, JSON.stringify(parsedOperator));
+        localStorage.removeItem(legacyStorageKey);
       } catch (error) {
         console.error('Failed to parse saved operator context:', error);
-        localStorage.removeItem('deed-shield-operator');
+        localStorage.removeItem(storageKey);
+        localStorage.removeItem(legacyStorageKey);
       }
     }
   }, []);
@@ -47,13 +52,15 @@ export function OperatorProvider({ children }: OperatorProviderProps) {
   const login = (operatorData: OperatorContextType) => {
     setOperator(operatorData);
     setIsAuthenticated(true);
-    localStorage.setItem('deed-shield-operator', JSON.stringify(operatorData));
+    localStorage.setItem(storageKey, JSON.stringify(operatorData));
+    localStorage.removeItem(legacyStorageKey);
   };
 
   const logout = () => {
     setOperator(null);
     setIsAuthenticated(false);
-    localStorage.removeItem('deed-shield-operator');
+    localStorage.removeItem(storageKey);
+    localStorage.removeItem(legacyStorageKey);
   };
 
   const value: OperatorState = {
diff --git a/bench/run-bench.ts b/bench/run-bench.ts
index bfc75ae..f5c3333 100644
--- a/bench/run-bench.ts
+++ b/bench/run-bench.ts
@@ -422,7 +422,7 @@ async function scenarioClean(
         checks: receipt.checks
       };
       const started = performance.now();
-      const rebuiltReceipt = buildReceipt(bundle, verificationLike, 'deed-shield', {
+      const rebuiltReceipt = buildReceipt(bundle, verificationLike, 'trustsignal', {
         fraudRisk: receipt.fraudRisk,
         zkpAttestation: receipt.zkpAttestation
       });
diff --git a/circuits/non_mem_gadget/src/lib.rs b/circuits/non_mem_gadget/src/lib.rs
index 66e0588..2e72d93 100644
--- a/circuits/non_mem_gadget/src/lib.rs
+++ b/circuits/non_mem_gadget/src/lib.rs
@@ -5,11 +5,12 @@ pub mod revocation;
 use halo2_proofs::{
     arithmetic::Field,
     circuit::{Layouter, SimpleFloorPlanner, Value},
-    dev::MockProver,
-    pasta::Fp,
-    plonk::{Advice, Circuit, Column, ConstraintSystem, Error, Instance, Selector},
-    poly::Rotation,
+    pasta::{EqAffine, Fp},
+    plonk::{create_proof, keygen_pk, keygen_vk, verify_proof, Advice, Circuit, Column, ConstraintSystem, Error, Instance, Selector, SingleVerifier},
+    poly::{commitment::Params, Rotation},
+    transcript::{Blake2bRead, Blake2bWrite, Challenge255},
 };
+use rand_core::OsRng;
 use std::time::Instant;
 
 use merkle::{MerklePath, NON_MEM_DOMAIN_TAG};
@@ -229,11 +230,43 @@ impl Circuit<Fp> for NonMembershipCircuit {
     }
 }
 
+fn prove_and_verify_circuit(
+    circuit: impl Circuit<Fp>,
+    instances: &[Vec<Fp>],
+    k: u32,
+) -> Result<(), String> {
+    let params = Params::<EqAffine>::new(k);
+    let vk = keygen_vk(&params, &circuit).map_err(|e| e.to_string())?;
+    let pk = keygen_pk(&params, vk, &circuit).map_err(|e| e.to_string())?;
+    let instance_refs: Vec<&[Fp]> = instances.iter().map(|column| column.as_slice()).collect();
+    let proof_instances = [instance_refs.as_slice()];
+
+    let mut transcript = Blake2bWrite::<Vec<u8>, EqAffine, Challenge255<EqAffine>>::init(vec![]);
+    create_proof(
+        &params,
+        &pk,
+        &[circuit],
+        &proof_instances,
+        OsRng,
+        &mut transcript,
+    )
+    .map_err(|e| e.to_string())?;
+    let proof = transcript.finalize();
+
+    let strategy = SingleVerifier::new(&params);
+    let mut read_transcript = Blake2bRead::<_, EqAffine, Challenge255<EqAffine>>::init(&proof[..]);
+    verify_proof(
+        &params,
+        pk.get_vk(),
+        strategy,
+        &proof_instances,
+        &mut read_transcript,
+    )
+    .map_err(|e| e.to_string())
+}
+
 pub fn prove_non_membership(circuit: NonMembershipCircuit, root: Fp, k: u32) -> Result<(), String> {
-    let prover = MockProver::run(k, &circuit, vec![vec![root]]).map_err(|e| e.to_string())?;
-    prover
-        .verify()
-        .map_err(|errs| format!("proof failed: {errs:?}"))
+    prove_and_verify_circuit(circuit, &[vec![root]], k)
 }
 
 #[derive(Clone, Debug)]
@@ -319,16 +352,12 @@ pub fn prove_and_verify(
     validate_nullifier(&circuit.revocation)?;
 
     let started_at = Instant::now();
-    let prover = MockProver::run(
+    prove_and_verify_circuit(
+        circuit,
+        &[vec![non_membership_root, revocation_root]],
         k,
-        &circuit,
-        vec![vec![non_membership_root, revocation_root]],
     )
-    .map_err(|e| CombinedProofError::ProofFailed(e.to_string()))?;
-
-    prover.verify().map_err(|errs| {
-        CombinedProofError::ProofFailed(format!("combined proof failed: {errs:?}"))
-    })?;
+    .map_err(CombinedProofError::ProofFailed)?;
 
     Ok(CombinedProofResult {
         k,
diff --git a/circuits/non_mem_gadget/src/revocation.rs b/circuits/non_mem_gadget/src/revocation.rs
index bcc4f87..55e76c1 100644
--- a/circuits/non_mem_gadget/src/revocation.rs
+++ b/circuits/non_mem_gadget/src/revocation.rs
@@ -1,9 +1,8 @@
-use crate::merkle::{MerklePath, NON_MEM_DOMAIN_TAG};
+use crate::{merkle::{MerklePath, NON_MEM_DOMAIN_TAG}, prove_and_verify_circuit};
 use halo2_poseidon::{ConstantLength, Hash, P128Pow5T3};
 use halo2_proofs::{
     arithmetic::Field,
     circuit::{Layouter, SimpleFloorPlanner, Value},
-    dev::MockProver,
     pasta::Fp,
     plonk::{Advice, Circuit, Column, ConstraintSystem, Error, Instance, Selector},
     poly::Rotation,
@@ -298,7 +297,6 @@ pub fn prove_revocation(
 ) -> Result<(), RevocationError> {
     validate_nullifier(&circuit.witness)?;
 
-    let prover = MockProver::run(k, &circuit, vec![vec![root]])
-        .map_err(|_| RevocationError::NullifierSpent)?;
-    prover.verify().map_err(|_| RevocationError::NullifierSpent)
+    prove_and_verify_circuit(circuit, &[vec![root]], k)
+        .map_err(|_| RevocationError::NullifierSpent)
 }
diff --git a/package-lock.json b/package-lock.json
index b339ef2..9d6d117 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,11 +1,11 @@
 {
-  "name": "deed-shield",
+  "name": "trustsignal",
   "version": "0.2.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
-      "name": "deed-shield",
+      "name": "trustsignal",
       "version": "0.2.0",
       "hasInstallScript": true,
       "workspaces": [
@@ -44,14 +44,14 @@
       }
     },
     "apps/api": {
-      "name": "@deed-shield/api",
+      "name": "@trustsignal/api",
       "version": "0.2.0",
       "hasInstallScript": true,
       "dependencies": {
-        "@deed-shield/core": "file:../../packages/core",
         "@fastify/cors": "^11.2.0",
         "@fastify/rate-limit": "^10.3.0",
         "@prisma/client": "^5.17.0",
+        "@trustsignal/core": "file:../../packages/core",
         "ethers": "^6.12.0",
         "fastify": "^5.8.1",
         "openai": "^6.17.0",
@@ -108,7 +108,7 @@
       "license": "UNLICENSED"
     },
     "apps/web": {
-      "name": "@deed-shield/web",
+      "name": "@trustsignal/web",
       "version": "0.2.0",
       "dependencies": {
         "fastify": "5.8.1",
@@ -873,22 +873,6 @@
         "node": ">=18"
       }
     },
-    "node_modules/@deed-shield/api": {
-      "resolved": "apps/api",
-      "link": true
-    },
-    "node_modules/@deed-shield/contracts": {
-      "resolved": "packages/contracts",
-      "link": true
-    },
-    "node_modules/@deed-shield/core": {
-      "resolved": "packages/core",
-      "link": true
-    },
-    "node_modules/@deed-shield/web": {
-      "resolved": "apps/web",
-      "link": true
-    },
     "node_modules/@emnapi/runtime": {
       "version": "1.8.1",
       "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.8.1.tgz",
@@ -3239,6 +3223,22 @@
         }
       }
     },
+    "node_modules/@trustsignal/api": {
+      "resolved": "apps/api",
+      "link": true
+    },
+    "node_modules/@trustsignal/contracts": {
+      "resolved": "packages/contracts",
+      "link": true
+    },
+    "node_modules/@trustsignal/core": {
+      "resolved": "packages/core",
+      "link": true
+    },
+    "node_modules/@trustsignal/web": {
+      "resolved": "apps/web",
+      "link": true
+    },
     "node_modules/@tsconfig/node10": {
       "version": "1.0.12",
       "resolved": "https://registry.npmjs.org/@tsconfig/node10/-/node10-1.0.12.tgz",
@@ -8722,6 +8722,7 @@
     },
     "node_modules/pdf2json/node_modules/@xmldom/xmldom": {
       "version": "0.8.10",
+      "extraneous": true,
       "inBundle": true,
       "license": "MIT",
       "engines": {
@@ -11833,7 +11834,7 @@
       }
     },
     "packages/contracts": {
-      "name": "@deed-shield/contracts",
+      "name": "@trustsignal/contracts",
       "version": "0.2.0",
       "dependencies": {
         "fastify": "5.8.1"
@@ -12108,7 +12109,7 @@
       }
     },
     "packages/core": {
-      "name": "@deed-shield/core",
+      "name": "@trustsignal/core",
       "version": "0.2.0",
       "dependencies": {
         "ethers": "^6.12.0",
diff --git a/package.json b/package.json
index f574d33..ecb63a5 100644
--- a/package.json
+++ b/package.json
@@ -1,5 +1,5 @@
 {
-  "name": "deed-shield",
+  "name": "trustsignal",
   "private": true,
   "version": "0.2.0",
   "type": "commonjs",
diff --git a/packages/contracts/package.json b/packages/contracts/package.json
index 39baf03..aa505bf 100644
--- a/packages/contracts/package.json
+++ b/packages/contracts/package.json
@@ -1,5 +1,5 @@
 {
-  "name": "@deed-shield/contracts",
+  "name": "@trustsignal/contracts",
   "version": "0.2.0",
   "private": true,
   "type": "module",
diff --git a/packages/core/package.json b/packages/core/package.json
index d5f09a4..e285f43 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -1,5 +1,5 @@
 {
-  "name": "@deed-shield/core",
+  "name": "@trustsignal/core",
   "version": "0.2.0",
   "private": true,
   "type": "commonjs",
diff --git a/packages/core/src/receipt.ts b/packages/core/src/receipt.ts
index 2426faa..bd054f0 100644
--- a/packages/core/src/receipt.ts
+++ b/packages/core/src/receipt.ts
@@ -33,7 +33,7 @@ export function toUnsignedReceiptPayload(receipt: Receipt): UnsignedReceiptPaylo
 export function buildReceipt(
   input: BundleInput,
   verification: VerificationResult,
-  verifierId = 'deed-shield',
+  verifierId = 'trustsignal',
   extensions: {
     fraudRisk?: Receipt['fraudRisk'];
     zkpAttestation?: Receipt['zkpAttestation'];
diff --git a/packages/core/src/receiptSigner.test.ts b/packages/core/src/receiptSigner.test.ts
index f75eabf..8f6490c 100644
--- a/packages/core/src/receiptSigner.test.ts
+++ b/packages/core/src/receiptSigner.test.ts
@@ -34,7 +34,7 @@ describe('receipt signing', () => {
       timestamp: new Date().toISOString()
     };
     const verification = await verifyBundle(bundle, registry);
-    const receipt = buildReceipt(bundle, verification, 'deed-shield');
+    const receipt = buildReceipt(bundle, verification, 'trustsignal');
     const unsignedPayload = toUnsignedReceiptPayload(receipt);
     const { privateJwk } = await generateRegistryKeypair();
 
@@ -74,7 +74,7 @@ describe('receipt signing', () => {
       timestamp: new Date().toISOString()
     };
     const verification = await verifyBundle(bundle, registry);
-    const receipt = buildReceipt(bundle, verification, 'deed-shield', { signing_key_id: signingKeyId });
+    const receipt = buildReceipt(bundle, verification, 'trustsignal', { signing_key_id: signingKeyId });
     const unsignedPayload = toUnsignedReceiptPayload(receipt);
     expect(unsignedPayload.signing_key_id).toBe(signingKeyId);
 
@@ -119,7 +119,7 @@ describe('receipt signing', () => {
       timestamp: new Date().toISOString()
     };
     const verification = await verifyBundle(bundle, registry);
-    const receipt = buildReceipt(bundle, verification, 'deed-shield', { signing_key_id: signingKeyId });
+    const receipt = buildReceipt(bundle, verification, 'trustsignal', { signing_key_id: signingKeyId });
     const unsignedPayload = toUnsignedReceiptPayload(receipt);
     const keypair = await generateRegistryKeypair();
     const receiptSignature = await signReceiptPayload(unsignedPayload, {
@@ -157,7 +157,7 @@ describe('receipt signing', () => {
       timestamp: new Date().toISOString()
     };
     const verification = await verifyBundle(bundle, registry);
-    const receipt = buildReceipt(bundle, verification, 'deed-shield');
+    const receipt = buildReceipt(bundle, verification, 'trustsignal');
     const unsignedPayload = toUnsignedReceiptPayload(receipt);
     const { privateJwk, publicJwk } = await generateRegistryKeypair();
     const receiptSignature = await signReceiptPayload(unsignedPayload, {
@@ -207,7 +207,7 @@ describe('receipt signing', () => {
       timestamp: new Date().toISOString()
     };
     const verification = await verifyBundle(bundle, registry);
-    const receipt = buildReceipt(bundle, verification, 'deed-shield');
+    const receipt = buildReceipt(bundle, verification, 'trustsignal');
     const unsignedPayload = toUnsignedReceiptPayload(receipt);
 
     const malformed = await verifyReceiptSignature(
diff --git a/packages/core/tsconfig.tsbuildinfo b/packages/core/tsconfig.tsbuildinfo
index d1efbb2..850ff7e 100644
--- a/packages/core/tsconfig.tsbuildinfo
+++ b/packages/core/tsconfig.tsbuildinfo
@@ -1 +1 @@
-{"program":{"fileNames":["../../node_modules/typescript/lib/lib.es5.d.ts","../../node_modules/typescript/lib/lib.es2015.d.ts","../../node_modules/typescript/lib/lib.es2016.d.ts","../../node_modules/typescript/lib/lib.es2017.d.ts","../../node_modules/typescript/lib/lib.es2018.d.ts","../../node_modules/typescript/lib/lib.es2019.d.ts","../../node_modules/typescript/lib/lib.es2020.d.ts","../../node_modules/typescript/lib/lib.es2021.d.ts","../../node_modules/typescript/lib/lib.es2022.d.ts","../../node_modules/typescript/lib/lib.dom.d.ts","../../node_modules/typescript/lib/lib.es2015.core.d.ts","../../node_modules/typescript/lib/lib.es2015.collection.d.ts","../../node_modules/typescript/lib/lib.es2015.generator.d.ts","../../node_modules/typescript/lib/lib.es2015.iterable.d.ts","../../node_modules/typescript/lib/lib.es2015.promise.d.ts","../../node_modules/typescript/lib/lib.es2015.proxy.d.ts","../../node_modules/typescript/lib/lib.es2015.reflect.d.ts","../../node_modules/typescript/lib/lib.es2015.symbol.d.ts","../../node_modules/typescript/lib/lib.es2015.symbol.wellknown.d.ts","../../node_modules/typescript/lib/lib.es2016.array.include.d.ts","../../node_modules/typescript/lib/lib.es2016.intl.d.ts","../../node_modules/typescript/lib/lib.es2017.date.d.ts","../../node_modules/typescript/lib/lib.es2017.object.d.ts","../../node_modules/typescript/lib/lib.es2017.sharedmemory.d.ts","../../node_modules/typescript/lib/lib.es2017.string.d.ts","../../node_modules/typescript/lib/lib.es2017.intl.d.ts","../../node_modules/typescript/lib/lib.es2017.typedarrays.d.ts","../../node_modules/typescript/lib/lib.es2018.asyncgenerator.d.ts","../../node_modules/typescript/lib/lib.es2018.asynciterable.d.ts","../../node_modules/typescript/lib/lib.es2018.intl.d.ts","../../node_modules/typescript/lib/lib.es2018.promise.d.ts","../../node_modules/typescript/lib/lib.es2018.regexp.d.ts","../../node_modules/typescript/lib/lib.es2019.array.d.ts","../../node_modules/typescript/lib/lib.es2019.object.d.ts","../../node_modules/typescript/lib/lib.es2019.string.d.ts","../../node_modules/typescript/lib/lib.es2019.symbol.d.ts","../../node_modules/typescript/lib/lib.es2019.intl.d.ts","../../node_modules/typescript/lib/lib.es2020.bigint.d.ts","../../node_modules/typescript/lib/lib.es2020.date.d.ts","../../node_modules/typescript/lib/lib.es2020.promise.d.ts","../../node_modules/typescript/lib/lib.es2020.sharedmemory.d.ts","../../node_modules/typescript/lib/lib.es2020.string.d.ts","../../node_modules/typescript/lib/lib.es2020.symbol.wellknown.d.ts","../../node_modules/typescript/lib/lib.es2020.intl.d.ts","../../node_modules/typescript/lib/lib.es2020.number.d.ts","../../node_modules/typescript/lib/lib.es2021.promise.d.ts","../../node_modules/typescript/lib/lib.es2021.string.d.ts","../../node_modules/typescript/lib/lib.es2021.weakref.d.ts","../../node_modules/typescript/lib/lib.es2021.intl.d.ts","../../node_modules/typescript/lib/lib.es2022.array.d.ts","../../node_modules/typescript/lib/lib.es2022.error.d.ts","../../node_modules/typescript/lib/lib.es2022.intl.d.ts","../../node_modules/typescript/lib/lib.es2022.object.d.ts","../../node_modules/typescript/lib/lib.es2022.sharedmemory.d.ts","../../node_modules/typescript/lib/lib.es2022.string.d.ts","../../node_modules/typescript/lib/lib.es2022.regexp.d.ts","../../node_modules/typescript/lib/lib.decorators.d.ts","../../node_modules/typescript/lib/lib.decorators.legacy.d.ts","../../node_modules/@vitest/pretty-format/dist/index.d.ts","../../node_modules/@vitest/utils/dist/types.d.ts","../../node_modules/@vitest/utils/dist/helpers.d.ts","../../node_modules/tinyrainbow/dist/index-8b61d5bc.d.ts","../../node_modules/tinyrainbow/dist/node.d.ts","../../node_modules/@vitest/utils/dist/index.d.ts","../../node_modules/@vitest/runner/dist/tasks.d-CkscK4of.d.ts","../../node_modules/@vitest/utils/dist/types.d-BCElaP-c.d.ts","../../node_modules/@vitest/utils/dist/diff.d.ts","../../node_modules/@vitest/runner/dist/types.d.ts","../../node_modules/@vitest/utils/dist/error.d.ts","../../node_modules/@vitest/runner/dist/index.d.ts","../../node_modules/vitest/optional-types.d.ts","../../node_modules/vitest/dist/chunks/environment.d.cL3nLXbE.d.ts","../../node_modules/@types/node/compatibility/disposable.d.ts","../../node_modules/@types/node/compatibility/indexable.d.ts","../../node_modules/@types/node/compatibility/iterators.d.ts","../../node_modules/@types/node/compatibility/index.d.ts","../../node_modules/@types/node/ts5.6/globals.typedarray.d.ts","../../node_modules/@types/node/ts5.6/buffer.buffer.d.ts","../../node_modules/@types/node/globals.d.ts","../../node_modules/@types/node/web-globals/abortcontroller.d.ts","../../node_modules/@types/node/web-globals/domexception.d.ts","../../node_modules/@types/node/web-globals/events.d.ts","../../node_modules/buffer/index.d.ts","../../node_modules/undici-types/header.d.ts","../../node_modules/undici-types/readable.d.ts","../../node_modules/undici-types/file.d.ts","../../node_modules/undici-types/fetch.d.ts","../../node_modules/undici-types/formdata.d.ts","../../node_modules/undici-types/connector.d.ts","../../node_modules/undici-types/client.d.ts","../../node_modules/undici-types/errors.d.ts","../../node_modules/undici-types/dispatcher.d.ts","../../node_modules/undici-types/global-dispatcher.d.ts","../../node_modules/undici-types/global-origin.d.ts","../../node_modules/undici-types/pool-stats.d.ts","../../node_modules/undici-types/pool.d.ts","../../node_modules/undici-types/handlers.d.ts","../../node_modules/undici-types/balanced-pool.d.ts","../../node_modules/undici-types/agent.d.ts","../../node_modules/undici-types/mock-interceptor.d.ts","../../node_modules/undici-types/mock-agent.d.ts","../../node_modules/undici-types/mock-client.d.ts","../../node_modules/undici-types/mock-pool.d.ts","../../node_modules/undici-types/mock-errors.d.ts","../../node_modules/undici-types/proxy-agent.d.ts","../../node_modules/undici-types/env-http-proxy-agent.d.ts","../../node_modules/undici-types/retry-handler.d.ts","../../node_modules/undici-types/retry-agent.d.ts","../../node_modules/undici-types/api.d.ts","../../node_modules/undici-types/interceptors.d.ts","../../node_modules/undici-types/util.d.ts","../../node_modules/undici-types/cookies.d.ts","../../node_modules/undici-types/patch.d.ts","../../node_modules/undici-types/websocket.d.ts","../../node_modules/undici-types/eventsource.d.ts","../../node_modules/undici-types/filereader.d.ts","../../node_modules/undici-types/diagnostics-channel.d.ts","../../node_modules/undici-types/content-type.d.ts","../../node_modules/undici-types/cache.d.ts","../../node_modules/undici-types/index.d.ts","../../node_modules/@types/node/web-globals/fetch.d.ts","../../node_modules/@types/node/assert.d.ts","../../node_modules/@types/node/assert/strict.d.ts","../../node_modules/@types/node/async_hooks.d.ts","../../node_modules/@types/node/buffer.d.ts","../../node_modules/@types/node/child_process.d.ts","../../node_modules/@types/node/cluster.d.ts","../../node_modules/@types/node/console.d.ts","../../node_modules/@types/node/constants.d.ts","../../node_modules/@types/node/crypto.d.ts","../../node_modules/@types/node/dgram.d.ts","../../node_modules/@types/node/diagnostics_channel.d.ts","../../node_modules/@types/node/dns.d.ts","../../node_modules/@types/node/dns/promises.d.ts","../../node_modules/@types/node/domain.d.ts","../../node_modules/@types/node/events.d.ts","../../node_modules/@types/node/fs.d.ts","../../node_modules/@types/node/fs/promises.d.ts","../../node_modules/@types/node/http.d.ts","../../node_modules/@types/node/http2.d.ts","../../node_modules/@types/node/https.d.ts","../../node_modules/@types/node/inspector.generated.d.ts","../../node_modules/@types/node/module.d.ts","../../node_modules/@types/node/net.d.ts","../../node_modules/@types/node/os.d.ts","../../node_modules/@types/node/path.d.ts","../../node_modules/@types/node/perf_hooks.d.ts","../../node_modules/@types/node/process.d.ts","../../node_modules/@types/node/punycode.d.ts","../../node_modules/@types/node/querystring.d.ts","../../node_modules/@types/node/readline.d.ts","../../node_modules/@types/node/readline/promises.d.ts","../../node_modules/@types/node/repl.d.ts","../../node_modules/@types/node/sea.d.ts","../../node_modules/@types/node/stream.d.ts","../../node_modules/@types/node/stream/promises.d.ts","../../node_modules/@types/node/stream/consumers.d.ts","../../node_modules/@types/node/stream/web.d.ts","../../node_modules/@types/node/string_decoder.d.ts","../../node_modules/@types/node/test.d.ts","../../node_modules/@types/node/timers.d.ts","../../node_modules/@types/node/timers/promises.d.ts","../../node_modules/@types/node/tls.d.ts","../../node_modules/@types/node/trace_events.d.ts","../../node_modules/@types/node/tty.d.ts","../../node_modules/@types/node/url.d.ts","../../node_modules/@types/node/util.d.ts","../../node_modules/@types/node/v8.d.ts","../../node_modules/@types/node/vm.d.ts","../../node_modules/@types/node/wasi.d.ts","../../node_modules/@types/node/worker_threads.d.ts","../../node_modules/@types/node/zlib.d.ts","../../node_modules/@types/node/ts5.6/index.d.ts","../../node_modules/@types/estree/index.d.ts","../../node_modules/rollup/dist/rollup.d.ts","../../node_modules/rollup/dist/parseAst.d.ts","../../node_modules/vite/types/hmrPayload.d.ts","../../node_modules/vite/types/customEvent.d.ts","../../node_modules/vite/types/hot.d.ts","../../node_modules/vite/dist/node/moduleRunnerTransport.d-DJ_mE5sf.d.ts","../../node_modules/vite/dist/node/module-runner.d.ts","../../node_modules/esbuild/lib/main.d.ts","../../node_modules/source-map-js/source-map.d.ts","../../node_modules/postcss/lib/previous-map.d.ts","../../node_modules/postcss/lib/input.d.ts","../../node_modules/postcss/lib/css-syntax-error.d.ts","../../node_modules/postcss/lib/declaration.d.ts","../../node_modules/postcss/lib/root.d.ts","../../node_modules/postcss/lib/warning.d.ts","../../node_modules/postcss/lib/lazy-result.d.ts","../../node_modules/postcss/lib/no-work-result.d.ts","../../node_modules/postcss/lib/processor.d.ts","../../node_modules/postcss/lib/result.d.ts","../../node_modules/postcss/lib/document.d.ts","../../node_modules/postcss/lib/rule.d.ts","../../node_modules/postcss/lib/node.d.ts","../../node_modules/postcss/lib/comment.d.ts","../../node_modules/postcss/lib/container.d.ts","../../node_modules/postcss/lib/at-rule.d.ts","../../node_modules/postcss/lib/list.d.ts","../../node_modules/postcss/lib/postcss.d.ts","../../node_modules/postcss/lib/postcss.d.mts","../../node_modules/vite/types/internal/lightningcssOptions.d.ts","../../node_modules/vite/types/internal/cssPreprocessorOptions.d.ts","../../node_modules/vite/types/importGlob.d.ts","../../node_modules/vite/types/metadata.d.ts","../../node_modules/vite/dist/node/index.d.ts","../../node_modules/@vitest/mocker/dist/registry.d-D765pazg.d.ts","../../node_modules/@vitest/mocker/dist/types.d-D_aRZRdy.d.ts","../../node_modules/@vitest/mocker/dist/index.d.ts","../../node_modules/@vitest/utils/dist/source-map.d.ts","../../node_modules/vite-node/dist/trace-mapping.d-DLVdEqOp.d.ts","../../node_modules/vite-node/dist/index.d-DGmxD2U7.d.ts","../../node_modules/vite-node/dist/index.d.ts","../../node_modules/@vitest/snapshot/dist/environment.d-DHdQ1Csl.d.ts","../../node_modules/@vitest/snapshot/dist/rawSnapshot.d-lFsMJFUd.d.ts","../../node_modules/@vitest/snapshot/dist/index.d.ts","../../node_modules/@vitest/snapshot/dist/environment.d.ts","../../node_modules/vitest/dist/chunks/config.d.D2ROskhv.d.ts","../../node_modules/vitest/dist/chunks/worker.d.1GmBbd7G.d.ts","../../node_modules/@types/deep-eql/index.d.ts","../../node_modules/assertion-error/index.d.ts","../../node_modules/@types/chai/index.d.ts","../../node_modules/@vitest/runner/dist/utils.d.ts","../../node_modules/tinybench/dist/index.d.ts","../../node_modules/vitest/dist/chunks/benchmark.d.BwvBVTda.d.ts","../../node_modules/vite-node/dist/client.d.ts","../../node_modules/vitest/dist/chunks/coverage.d.S9RMNXIe.d.ts","../../node_modules/@vitest/snapshot/dist/manager.d.ts","../../node_modules/vitest/dist/chunks/reporters.d.BFLkQcL6.d.ts","../../node_modules/vitest/dist/chunks/worker.d.CKwWzBSj.d.ts","../../node_modules/@vitest/spy/dist/index.d.ts","../../node_modules/@vitest/expect/dist/index.d.ts","../../node_modules/vitest/dist/chunks/global.d.MAmajcmJ.d.ts","../../node_modules/vitest/dist/chunks/vite.d.CMLlLIFP.d.ts","../../node_modules/vitest/dist/chunks/mocker.d.BE_2ls6u.d.ts","../../node_modules/vitest/dist/chunks/suite.d.FvehnV49.d.ts","../../node_modules/expect-type/dist/utils.d.ts","../../node_modules/expect-type/dist/overloads.d.ts","../../node_modules/expect-type/dist/branding.d.ts","../../node_modules/expect-type/dist/messages.d.ts","../../node_modules/expect-type/dist/index.d.ts","../../node_modules/vitest/dist/index.d.ts","../../node_modules/json-canonicalize/types/canonicalize.d.ts","../../node_modules/json-canonicalize/types/serializer.d.ts","../../node_modules/json-canonicalize/types/canonicalize-ex.d.ts","../../node_modules/json-canonicalize/types/index.d.ts","./src/canonicalize.ts","./src/canonicalize.test.ts","../../node_modules/ethers/lib.esm/_version.d.ts","../../node_modules/ethers/lib.esm/utils/base58.d.ts","../../node_modules/ethers/lib.esm/utils/data.d.ts","../../node_modules/ethers/lib.esm/utils/base64.d.ts","../../node_modules/ethers/lib.esm/address/address.d.ts","../../node_modules/ethers/lib.esm/address/contract-address.d.ts","../../node_modules/ethers/lib.esm/address/checks.d.ts","../../node_modules/ethers/lib.esm/address/index.d.ts","../../node_modules/ethers/lib.esm/crypto/hmac.d.ts","../../node_modules/ethers/lib.esm/crypto/keccak.d.ts","../../node_modules/ethers/lib.esm/crypto/ripemd160.d.ts","../../node_modules/ethers/lib.esm/crypto/pbkdf2.d.ts","../../node_modules/ethers/lib.esm/crypto/random.d.ts","../../node_modules/ethers/lib.esm/crypto/scrypt.d.ts","../../node_modules/ethers/lib.esm/crypto/sha2.d.ts","../../node_modules/ethers/lib.esm/crypto/signature.d.ts","../../node_modules/ethers/lib.esm/crypto/signing-key.d.ts","../../node_modules/ethers/lib.esm/crypto/index.d.ts","../../node_modules/ethers/lib.esm/utils/maths.d.ts","../../node_modules/ethers/lib.esm/transaction/accesslist.d.ts","../../node_modules/ethers/lib.esm/transaction/authorization.d.ts","../../node_modules/ethers/lib.esm/transaction/address.d.ts","../../node_modules/ethers/lib.esm/transaction/transaction.d.ts","../../node_modules/ethers/lib.esm/transaction/index.d.ts","../../node_modules/ethers/lib.esm/providers/contracts.d.ts","../../node_modules/ethers/lib.esm/utils/fetch.d.ts","../../node_modules/ethers/lib.esm/providers/plugins-network.d.ts","../../node_modules/ethers/lib.esm/providers/network.d.ts","../../node_modules/ethers/lib.esm/providers/formatting.d.ts","../../node_modules/ethers/lib.esm/providers/provider.d.ts","../../node_modules/ethers/lib.esm/providers/ens-resolver.d.ts","../../node_modules/ethers/lib.esm/providers/abstract-provider.d.ts","../../node_modules/ethers/lib.esm/hash/authorization.d.ts","../../node_modules/ethers/lib.esm/hash/id.d.ts","../../node_modules/ethers/lib.esm/hash/namehash.d.ts","../../node_modules/ethers/lib.esm/hash/message.d.ts","../../node_modules/ethers/lib.esm/hash/solidity.d.ts","../../node_modules/ethers/lib.esm/hash/typed-data.d.ts","../../node_modules/ethers/lib.esm/hash/index.d.ts","../../node_modules/ethers/lib.esm/providers/signer.d.ts","../../node_modules/ethers/lib.esm/providers/abstract-signer.d.ts","../../node_modules/ethers/lib.esm/providers/community.d.ts","../../node_modules/ethers/lib.esm/providers/provider-jsonrpc.d.ts","../../node_modules/ethers/lib.esm/providers/provider-socket.d.ts","../../node_modules/ethers/lib.esm/providers/provider-websocket.d.ts","../../node_modules/ethers/lib.esm/providers/default-provider.d.ts","../../node_modules/ethers/lib.esm/providers/signer-noncemanager.d.ts","../../node_modules/ethers/lib.esm/providers/provider-fallback.d.ts","../../node_modules/ethers/lib.esm/providers/provider-browser.d.ts","../../node_modules/ethers/lib.esm/providers/provider-alchemy.d.ts","../../node_modules/ethers/lib.esm/providers/provider-blockscout.d.ts","../../node_modules/ethers/lib.esm/providers/provider-ankr.d.ts","../../node_modules/ethers/lib.esm/providers/provider-cloudflare.d.ts","../../node_modules/ethers/lib.esm/providers/provider-chainstack.d.ts","../../node_modules/ethers/lib.esm/contract/types.d.ts","../../node_modules/ethers/lib.esm/contract/wrappers.d.ts","../../node_modules/ethers/lib.esm/contract/contract.d.ts","../../node_modules/ethers/lib.esm/contract/factory.d.ts","../../node_modules/ethers/lib.esm/contract/index.d.ts","../../node_modules/ethers/lib.esm/providers/provider-etherscan.d.ts","../../node_modules/ethers/lib.esm/providers/provider-infura.d.ts","../../node_modules/ethers/lib.esm/providers/provider-pocket.d.ts","../../node_modules/ethers/lib.esm/providers/provider-quicknode.d.ts","../../node_modules/ethers/lib.esm/providers/provider-ipcsocket.d.ts","../../node_modules/ethers/lib.esm/providers/index.d.ts","../../node_modules/ethers/lib.esm/utils/errors.d.ts","../../node_modules/ethers/lib.esm/utils/events.d.ts","../../node_modules/ethers/lib.esm/utils/fixednumber.d.ts","../../node_modules/ethers/lib.esm/utils/properties.d.ts","../../node_modules/ethers/lib.esm/utils/rlp-decode.d.ts","../../node_modules/ethers/lib.esm/utils/rlp.d.ts","../../node_modules/ethers/lib.esm/utils/rlp-encode.d.ts","../../node_modules/ethers/lib.esm/utils/units.d.ts","../../node_modules/ethers/lib.esm/utils/utf8.d.ts","../../node_modules/ethers/lib.esm/utils/uuid.d.ts","../../node_modules/ethers/lib.esm/utils/index.d.ts","../../node_modules/ethers/lib.esm/abi/coders/abstract-coder.d.ts","../../node_modules/ethers/lib.esm/abi/fragments.d.ts","../../node_modules/ethers/lib.esm/abi/abi-coder.d.ts","../../node_modules/ethers/lib.esm/abi/bytes32.d.ts","../../node_modules/ethers/lib.esm/abi/typed.d.ts","../../node_modules/ethers/lib.esm/abi/interface.d.ts","../../node_modules/ethers/lib.esm/abi/index.d.ts","../../node_modules/ethers/lib.esm/constants/addresses.d.ts","../../node_modules/ethers/lib.esm/constants/hashes.d.ts","../../node_modules/ethers/lib.esm/constants/numbers.d.ts","../../node_modules/ethers/lib.esm/constants/strings.d.ts","../../node_modules/ethers/lib.esm/constants/index.d.ts","../../node_modules/ethers/lib.esm/wallet/base-wallet.d.ts","../../node_modules/ethers/lib.esm/wordlists/wordlist.d.ts","../../node_modules/ethers/lib.esm/wordlists/wordlist-owl.d.ts","../../node_modules/ethers/lib.esm/wordlists/lang-en.d.ts","../../node_modules/ethers/lib.esm/wordlists/wordlist-owla.d.ts","../../node_modules/ethers/lib.esm/wordlists/wordlists.d.ts","../../node_modules/ethers/lib.esm/wordlists/index.d.ts","../../node_modules/ethers/lib.esm/wallet/mnemonic.d.ts","../../node_modules/ethers/lib.esm/wallet/hdwallet.d.ts","../../node_modules/ethers/lib.esm/wallet/json-crowdsale.d.ts","../../node_modules/ethers/lib.esm/wallet/json-keystore.d.ts","../../node_modules/ethers/lib.esm/wallet/wallet.d.ts","../../node_modules/ethers/lib.esm/wallet/index.d.ts","../../node_modules/ethers/lib.esm/ethers.d.ts","../../node_modules/ethers/lib.esm/index.d.ts","./src/hashing.ts","./src/hashing.test.ts","../../node_modules/jose/dist/types/types.d.ts","../../node_modules/jose/dist/types/jwe/compact/decrypt.d.ts","../../node_modules/jose/dist/types/jwe/flattened/decrypt.d.ts","../../node_modules/jose/dist/types/jwe/general/decrypt.d.ts","../../node_modules/jose/dist/types/jwe/general/encrypt.d.ts","../../node_modules/jose/dist/types/jws/compact/verify.d.ts","../../node_modules/jose/dist/types/jws/flattened/verify.d.ts","../../node_modules/jose/dist/types/jws/general/verify.d.ts","../../node_modules/jose/dist/types/jwt/verify.d.ts","../../node_modules/jose/dist/types/jwt/decrypt.d.ts","../../node_modules/jose/dist/types/jwt/produce.d.ts","../../node_modules/jose/dist/types/jwe/compact/encrypt.d.ts","../../node_modules/jose/dist/types/jwe/flattened/encrypt.d.ts","../../node_modules/jose/dist/types/jws/compact/sign.d.ts","../../node_modules/jose/dist/types/jws/flattened/sign.d.ts","../../node_modules/jose/dist/types/jws/general/sign.d.ts","../../node_modules/jose/dist/types/jwt/sign.d.ts","../../node_modules/jose/dist/types/jwt/encrypt.d.ts","../../node_modules/jose/dist/types/jwk/thumbprint.d.ts","../../node_modules/jose/dist/types/jwk/embedded.d.ts","../../node_modules/jose/dist/types/jwks/local.d.ts","../../node_modules/jose/dist/types/jwks/remote.d.ts","../../node_modules/jose/dist/types/jwt/unsecured.d.ts","../../node_modules/jose/dist/types/key/export.d.ts","../../node_modules/jose/dist/types/key/import.d.ts","../../node_modules/jose/dist/types/util/decode_protected_header.d.ts","../../node_modules/jose/dist/types/util/decode_jwt.d.ts","../../node_modules/jose/dist/types/util/errors.d.ts","../../node_modules/jose/dist/types/key/generate_key_pair.d.ts","../../node_modules/jose/dist/types/key/generate_secret.d.ts","../../node_modules/jose/dist/types/util/base64url.d.ts","../../node_modules/jose/dist/types/util/runtime.d.ts","../../node_modules/jose/dist/types/index.d.ts","./src/risk/types.ts","./src/zkp/types.ts","./src/types.ts","./src/registry.ts","./src/verifiers.ts","./src/verification.ts","./src/mocks.ts","./src/synthetic.ts","./src/headless.test.ts","./src/receipt.ts","./src/receiptSigner.ts","./src/risk/forensics.ts","./src/risk/layout.ts","./src/risk/patterns.ts","./src/risk/index.ts","./src/zkp/index.ts","./src/anchor/portable.ts","./src/anchor/provenance.ts","./src/attom/types.ts","./src/attom/normalize.ts","./src/attom/crossCheck.ts","./src/index.ts","./src/receiptSigner.test.ts","./src/registry.test.ts","./src/verification.test.ts","./src/anchor/provenance.test.ts","./src/attom/crossCheck.test.ts","./src/risk/risk.test.ts","./src/zkp/zkp.test.ts","../../node_modules/@types/aria-query/index.d.ts","../../node_modules/@babel/types/lib/index.d.ts","../../node_modules/@types/babel__generator/index.d.ts","../../node_modules/@babel/parser/typings/babel-parser.d.ts","../../node_modules/@types/babel__template/index.d.ts","../../node_modules/@types/babel__traverse/index.d.ts","../../node_modules/@types/babel__core/index.d.ts","../../node_modules/@types/json5/index.d.ts","../../node_modules/@types/ms/index.d.ts","../../node_modules/@types/jsonwebtoken/index.d.ts","../../node_modules/@types/mocha/index.d.ts","../../node_modules/@types/pdf-parse/index.d.ts","../../node_modules/@types/pdfkit/index.d.ts","../../node_modules/@types/prop-types/index.d.ts","../../node_modules/@types/react/global.d.ts","../../node_modules/csstype/index.d.ts","../../node_modules/@types/react/index.d.ts","../../node_modules/@types/react-dom/index.d.ts"],"fileInfos":[{"version":"44e584d4f6444f58791784f1d530875970993129442a847597db702a073ca68c","affectsGlobalScope":true},"45b7ab580deca34ae9729e97c13cfd999df04416a79116c3bfb483804f85ded4","3facaf05f0c5fc569c5649dd359892c98a85557e3e0c847964caeb67076f4d75","9a68c0c07ae2fa71b44384a839b7b8d81662a236d4b9ac30916718f7510b1b2d","5e1c4c362065a6b95ff952c0eab010f04dcd2c3494e813b493ecfd4fcb9fc0d8","68d73b4a11549f9c0b7d352d10e91e5dca8faa3322bfb77b661839c42b1ddec7","5efce4fc3c29ea84e8928f97adec086e3dc876365e0982cc8479a07954a3efd4","feecb1be483ed332fad555aff858affd90a48ab19ba7272ee084704eb7167569","5514e54f17d6d74ecefedc73c504eadffdeda79c7ea205cf9febead32d45c4bc",{"version":"4af6b0c727b7a2896463d512fafd23634229adf69ac7c00e2ae15a09cb084fad","affectsGlobalScope":true},{"version":"6920e1448680767498a0b77c6a00a8e77d14d62c3da8967b171f1ddffa3c18e4","affectsGlobalScope":true},{"version":"dc2df20b1bcdc8c2d34af4926e2c3ab15ffe1160a63e58b7e09833f616efff44","affectsGlobalScope":true},{"version":"4443e68b35f3332f753eacc66a04ac1d2053b8b035a0e0ac1d455392b5e243b3","affectsGlobalScope":true},{"version":"bc47685641087c015972a3f072480889f0d6c65515f12bd85222f49a98952ed7","affectsGlobalScope":true},{"version":"0dc1e7ceda9b8b9b455c3a2d67b0412feab00bd2f66656cd8850e8831b08b537","affectsGlobalScope":true},{"version":"ce691fb9e5c64efb9547083e4a34091bcbe5bdb41027e310ebba8f7d96a98671","affectsGlobalScope":true},{"version":"8d697a2a929a5fcb38b7a65594020fcef05ec1630804a33748829c5ff53640d0","affectsGlobalScope":true},{"version":"4ff2a353abf8a80ee399af572debb8faab2d33ad38c4b4474cff7f26e7653b8d","affectsGlobalScope":true},{"version":"93495ff27b8746f55d19fcbcdbaccc99fd95f19d057aed1bd2c0cafe1335fbf0","affectsGlobalScope":true},{"version":"6fc23bb8c3965964be8c597310a2878b53a0306edb71d4b5a4dfe760186bcc01","affectsGlobalScope":true},{"version":"ea011c76963fb15ef1cdd7ce6a6808b46322c527de2077b6cfdf23ae6f5f9ec7","affectsGlobalScope":true},{"version":"38f0219c9e23c915ef9790ab1d680440d95419ad264816fa15009a8851e79119","affectsGlobalScope":true},{"version":"bb42a7797d996412ecdc5b2787720de477103a0b2e53058569069a0e2bae6c7e","affectsGlobalScope":true},{"version":"4738f2420687fd85629c9efb470793bb753709c2379e5f85bc1815d875ceadcd","affectsGlobalScope":true},{"version":"2f11ff796926e0832f9ae148008138ad583bd181899ab7dd768a2666700b1893","affectsGlobalScope":true},{"version":"4de680d5bb41c17f7f68e0419412ca23c98d5749dcaaea1896172f06435891fc","affectsGlobalScope":true},{"version":"9fc46429fbe091ac5ad2608c657201eb68b6f1b8341bd6d670047d32ed0a88fa","affectsGlobalScope":true},{"version":"61c37c1de663cf4171e1192466e52c7a382afa58da01b1dc75058f032ddf0839","affectsGlobalScope":true},{"version":"b541a838a13f9234aba650a825393ffc2292dc0fc87681a5d81ef0c96d281e7a","affectsGlobalScope":true},{"version":"9e9fbd7030c440b33d021da145d3232984c8bb7916f277e8ffd3dc2e3eae2bdb","affectsGlobalScope":true},{"version":"811ec78f7fefcabbda4bfa93b3eb67d9ae166ef95f9bff989d964061cbf81a0c","affectsGlobalScope":true},{"version":"717937616a17072082152a2ef351cb51f98802fb4b2fdabd32399843875974ca","affectsGlobalScope":true},{"version":"d7e7d9b7b50e5f22c915b525acc5a49a7a6584cf8f62d0569e557c5cfc4b2ac2","affectsGlobalScope":true},{"version":"71c37f4c9543f31dfced6c7840e068c5a5aacb7b89111a4364b1d5276b852557","affectsGlobalScope":true},{"version":"576711e016cf4f1804676043e6a0a5414252560eb57de9faceee34d79798c850","affectsGlobalScope":true},{"version":"89c1b1281ba7b8a96efc676b11b264de7a8374c5ea1e6617f11880a13fc56dc6","affectsGlobalScope":true},{"version":"74f7fa2d027d5b33eb0471c8e82a6c87216223181ec31247c357a3e8e2fddc5b","affectsGlobalScope":true},{"version":"ae37d6ccd1560b0203ab88d46987393adaaa78c919e51acf32fb82c86502e98c","affectsGlobalScope":true},{"version":"063600664504610fe3e99b717a1223f8b1900087fab0b4cad1496a114744f8df","affectsGlobalScope":true},{"version":"934019d7e3c81950f9a8426d093458b65d5aff2c7c1511233c0fd5b941e608ab","affectsGlobalScope":true},{"version":"bf14a426dbbf1022d11bd08d6b8e709a2e9d246f0c6c1032f3b2edb9a902adbe","affectsGlobalScope":true},{"version":"5e07ed3809d48205d5b985642a59f2eba47c402374a7cf8006b686f79efadcbd","affectsGlobalScope":true},{"version":"2b72d528b2e2fe3c57889ca7baef5e13a56c957b946906d03767c642f386bbc3","affectsGlobalScope":true},{"version":"479553e3779be7d4f68e9f40cdb82d038e5ef7592010100410723ceced22a0f7","affectsGlobalScope":true},{"version":"368af93f74c9c932edd84c58883e736c9e3d53cec1fe24c0b0ff451f529ceab1","affectsGlobalScope":true},{"version":"af3dd424cf267428f30ccfc376f47a2c0114546b55c44d8c0f1d57d841e28d74","affectsGlobalScope":true},{"version":"995c005ab91a498455ea8dfb63aa9f83fa2ea793c3d8aa344be4a1678d06d399","affectsGlobalScope":true},{"version":"d3d7b04b45033f57351c8434f60b6be1ea71a2dfec2d0a0c3c83badbb0e3e693","affectsGlobalScope":true},{"version":"956d27abdea9652e8368ce029bb1e0b9174e9678a273529f426df4b3d90abd60","affectsGlobalScope":true},{"version":"4fa6ed14e98aa80b91f61b9805c653ee82af3502dc21c9da5268d3857772ca05","affectsGlobalScope":true},{"version":"e6633e05da3ff36e6da2ec170d0d03ccf33de50ca4dc6f5aeecb572cedd162fb","affectsGlobalScope":true},{"version":"d8670852241d4c6e03f2b89d67497a4bbefe29ecaa5a444e2c11a9b05e6fccc6","affectsGlobalScope":true},{"version":"8444af78980e3b20b49324f4a16ba35024fef3ee069a0eb67616ea6ca821c47a","affectsGlobalScope":true},{"version":"caccc56c72713969e1cfe5c3d44e5bab151544d9d2b373d7dbe5a1e4166652be","affectsGlobalScope":true},{"version":"3287d9d085fbd618c3971944b65b4be57859f5415f495b33a6adc994edd2f004","affectsGlobalScope":true},{"version":"b4b67b1a91182421f5df999988c690f14d813b9850b40acd06ed44691f6727ad","affectsGlobalScope":true},{"version":"33358442698bb565130f52ba79bfd3d4d484ac85fe33f3cb1759c54d18201393","affectsGlobalScope":true},{"version":"782dec38049b92d4e85c1585fbea5474a219c6984a35b004963b00beb1aab538","affectsGlobalScope":true},"5c54a34e3d91727f7ae840bfe4d5d1c9a2f93c54cb7b6063d06ee4a6c3322656","db4da53b03596668cf6cc9484834e5de3833b9e7e64620cf08399fe069cd398d","ac7c28f153820c10850457994db1462d8c8e462f253b828ad942a979f726f2f9","f9b028d3c3891dd817e24d53102132b8f696269309605e6ed4f0db2c113bbd82","fb7c8d90e52e2884509166f96f3d591020c7b7977ab473b746954b0c8d100960","0bff51d6ed0c9093f6955b9d8258ce152ddb273359d50a897d8baabcb34de2c4","45cec9a1ba6549060552eead8959d47226048e0b71c7d0702ae58b7e16a28912","ef13c73d6157a32933c612d476c1524dd674cf5b9a88571d7d6a0d147544d529","13918e2b81c4288695f9b1f3dcc2468caf0f848d5c1f3dc00071c619d34ff63a","6907b09850f86610e7a528348c15484c1e1c09a18a9c1e98861399dfe4b18b46","12deea8eaa7a4fc1a2908e67da99831e5c5a6b46ad4f4f948fd4759314ea2b80","f0a8b376568a18f9a4976ecb0855187672b16b96c4df1c183a7e52dc1b5d98e8","8124828a11be7db984fcdab052fd4ff756b18edcfa8d71118b55388176210923","092944a8c05f9b96579161e88c6f211d5304a76bd2c47f8d4c30053269146bc8",{"version":"70521b6ab0dcba37539e5303104f29b721bfb2940b2776da4cc818c07e1fefc1","affectsGlobalScope":true},{"version":"ab41ef1f2cdafb8df48be20cd969d875602483859dc194e9c97c8a576892c052","affectsGlobalScope":true},{"version":"d153a11543fd884b596587ccd97aebbeed950b26933ee000f94009f1ab142848","affectsGlobalScope":true},"21d819c173c0cf7cc3ce57c3276e77fd9a8a01d35a06ad87158781515c9a438a",{"version":"1456e80bd8a3870034d89f91bd7df12ac29acfb083e31c0bb1fb38ca7bf5fbc2","affectsGlobalScope":true},{"version":"a98aedd64ad81793f146d36d1611ed9ba61b8b49ff040f0d13a103ed626595d9","affectsGlobalScope":true},{"version":"6d9ef24f9a22a88e3e9b3b3d8c40ab1ddb0853f1bfbd5c843c37800138437b61","affectsGlobalScope":true},{"version":"1db0b7dca579049ca4193d034d835f6bfe73096c73663e5ef9a0b5779939f3d0","affectsGlobalScope":true},{"version":"9798340ffb0d067d69b1ae5b32faa17ab31b82466a3fc00d8f2f2df0c8554aaa","affectsGlobalScope":true},{"version":"f26b11d8d8e4b8028f1c7d618b22274c892e4b0ef5b3678a8ccbad85419aef43","affectsGlobalScope":true},"8e9c23ba78aabc2e0a27033f18737a6df754067731e69dc5f52823957d60a4b6","5929864ce17fba74232584d90cb721a89b7ad277220627cc97054ba15a98ea8f","763fe0f42b3d79b440a9b6e51e9ba3f3f91352469c1e4b3b67bfa4ff6352f3f4","25c8056edf4314820382a5fdb4bb7816999acdcb929c8f75e3f39473b87e85bc","c464d66b20788266e5353b48dc4aa6bc0dc4a707276df1e7152ab0c9ae21fad8","78d0d27c130d35c60b5e5566c9f1e5be77caf39804636bc1a40133919a949f21","c6fd2c5a395f2432786c9cb8deb870b9b0e8ff7e22c029954fabdd692bff6195","1d6e127068ea8e104a912e42fc0a110e2aa5a66a356a917a163e8cf9a65e4a75","5ded6427296cdf3b9542de4471d2aa8d3983671d4cac0f4bf9c637208d1ced43","7f182617db458e98fc18dfb272d40aa2fff3a353c44a89b2c0ccb3937709bfb5","cadc8aced301244057c4e7e73fbcae534b0f5b12a37b150d80e5a45aa4bebcbd","385aab901643aa54e1c36f5ef3107913b10d1b5bb8cbcd933d4263b80a0d7f20","9670d44354bab9d9982eca21945686b5c24a3f893db73c0dae0fd74217a4c219","0b8a9268adaf4da35e7fa830c8981cfa22adbbe5b3f6f5ab91f6658899e657a7","11396ed8a44c02ab9798b7dca436009f866e8dae3c9c25e8c1fbc396880bf1bb","ba7bc87d01492633cb5a0e5da8a4a42a1c86270e7b3d2dea5d156828a84e4882","4893a895ea92c85345017a04ed427cbd6a1710453338df26881a6019432febdd","c21dc52e277bcfc75fac0436ccb75c204f9e1b3fa5e12729670910639f27343e","13f6f39e12b1518c6650bbb220c8985999020fe0f21d818e28f512b7771d00f9","9b5369969f6e7175740bf51223112ff209f94ba43ecd3bb09eefff9fd675624a","4fe9e626e7164748e8769bbf74b538e09607f07ed17c2f20af8d680ee49fc1da","24515859bc0b836719105bb6cc3d68255042a9f02a6022b3187948b204946bd2","ea0148f897b45a76544ae179784c95af1bd6721b8610af9ffa467a518a086a43","24c6a117721e606c9984335f71711877293a9651e44f59f3d21c1ea0856f9cc9","dd3273ead9fbde62a72949c97dbec2247ea08e0c6952e701a483d74ef92d6a17","405822be75ad3e4d162e07439bac80c6bcc6dbae1929e179cf467ec0b9ee4e2e","0db18c6e78ea846316c012478888f33c11ffadab9efd1cc8bcc12daded7a60b6","e61be3f894b41b7baa1fbd6a66893f2579bfad01d208b4ff61daef21493ef0a8","bd0532fd6556073727d28da0edfd1736417a3f9f394877b6d5ef6ad88fba1d1a","89167d696a849fce5ca508032aabfe901c0868f833a8625d5a9c6e861ef935d2","615ba88d0128ed16bf83ef8ccbb6aff05c3ee2db1cc0f89ab50a4939bfc1943f","a4d551dbf8746780194d550c88f26cf937caf8d56f102969a110cfaed4b06656","8bd86b8e8f6a6aa6c49b71e14c4ffe1211a0e97c80f08d2c8cc98838006e4b88","317e63deeb21ac07f3992f5b50cdca8338f10acd4fbb7257ebf56735bf52ab00","4732aec92b20fb28c5fe9ad99521fb59974289ed1e45aecb282616202184064f","2e85db9e6fd73cfa3d7f28e0ab6b55417ea18931423bd47b409a96e4a169e8e6","c46e079fe54c76f95c67fb89081b3e399da2c7d109e7dca8e4b58d83e332e605","bf67d53d168abc1298888693338cb82854bdb2e69ef83f8a0092093c2d562107",{"version":"2cbe0621042e2a68c7cbce5dfed3906a1862a16a7d496010636cdbdb91341c0f","affectsGlobalScope":true},"e2677634fe27e87348825bb041651e22d50a613e2fdf6a4a3ade971d71bac37e","7394959e5a741b185456e1ef5d64599c36c60a323207450991e7a42e08911419","8c0bcd6c6b67b4b503c11e91a1fb91522ed585900eab2ab1f61bba7d7caa9d6f",{"version":"8cd19276b6590b3ebbeeb030ac271871b9ed0afc3074ac88a94ed2449174b776","affectsGlobalScope":true},"696eb8d28f5949b87d894b26dc97318ef944c794a9a4e4f62360cd1d1958014b","3f8fa3061bd7402970b399300880d55257953ee6d3cd408722cb9ac20126460c",{"version":"35ec8b6760fd7138bbf5809b84551e31028fb2ba7b6dc91d95d098bf212ca8b4","affectsGlobalScope":true},"5524481e56c48ff486f42926778c0a3cce1cc85dc46683b92b1271865bcf015a",{"version":"68bd56c92c2bd7d2339457eb84d63e7de3bd56a69b25f3576e1568d21a162398","affectsGlobalScope":true},"3e93b123f7c2944969d291b35fed2af79a6e9e27fdd5faa99748a51c07c02d28","9d19808c8c291a9010a6c788e8532a2da70f811adb431c97520803e0ec649991","87aad3dd9752067dc875cfaa466fc44246451c0c560b820796bdd528e29bef40","4aacb0dd020eeaef65426153686cc639a78ec2885dc72ad220be1d25f1a439df","f0bd7e6d931657b59605c44112eaf8b980ba7f957a5051ed21cb93d978cf2f45",{"version":"8db0ae9cb14d9955b14c214f34dae1b9ef2baee2fe4ce794a4cd3ac2531e3255","affectsGlobalScope":true},"15fc6f7512c86810273af28f224251a5a879e4261b4d4c7e532abfbfc3983134","58adba1a8ab2d10b54dc1dced4e41f4e7c9772cbbac40939c0dc8ce2cdb1d442","2fd4c143eff88dabb57701e6a40e02a4dbc36d5eb1362e7964d32028056a782b","714435130b9015fae551788df2a88038471a5a11eb471f27c4ede86552842bc9","855cd5f7eb396f5f1ab1bc0f8580339bff77b68a770f84c6b254e319bbfd1ac7","5650cf3dace09e7c25d384e3e6b818b938f68f4e8de96f52d9c5a1b3db068e86",{"version":"1354ca5c38bd3fd3836a68e0f7c9f91f172582ba30ab15bb8c075891b91502b7","affectsGlobalScope":true},"27fdb0da0daf3b337c5530c5f266efe046a6ceb606e395b346974e4360c36419","2d2fcaab481b31a5882065c7951255703ddbe1c0e507af56ea42d79ac3911201","a192fe8ec33f75edbc8d8f3ed79f768dfae11ff5735e7fe52bfa69956e46d78d",{"version":"ca867399f7db82df981d6915bcbb2d81131d7d1ef683bc782b59f71dda59bc85","affectsGlobalScope":true},{"version":"d9e971bba9cf977c7774abbd4d2e3413a231af8a06a2e8b16af2a606bc91ddd0","affectsGlobalScope":true},"9e043a1bc8fbf2a255bccf9bf27e0f1caf916c3b0518ea34aa72357c0afd42ec","b4f70ec656a11d570e1a9edce07d118cd58d9760239e2ece99306ee9dfe61d02","3bc2f1e2c95c04048212c569ed38e338873f6a8593930cf5a7ef24ffb38fc3b6","6e70e9570e98aae2b825b533aa6292b6abd542e8d9f6e9475e88e1d7ba17c866","f9d9d753d430ed050dc1bf2667a1bab711ccbb1c1507183d794cc195a5b085cc","9eece5e586312581ccd106d4853e861aaaa1a39f8e3ea672b8c3847eedd12f6e","47ab634529c5955b6ad793474ae188fce3e6163e3a3fb5edd7e0e48f14435333","37ba7b45141a45ce6e80e66f2a96c8a5ab1bcef0fc2d0f56bb58df96ec67e972","45650f47bfb376c8a8ed39d4bcda5902ab899a3150029684ee4c10676d9fbaee",{"version":"0225ecb9ed86bdb7a2c7fd01f1556906902929377b44483dc4b83e03b3ef227d","affectsGlobalScope":true},"74cf591a0f63db318651e0e04cb55f8791385f86e987a67fd4d2eaab8191f730","5eab9b3dc9b34f185417342436ec3f106898da5f4801992d8ff38ab3aff346b5",{"version":"12ed4559eba17cd977aa0db658d25c4047067444b51acfdcbf38470630642b23","affectsGlobalScope":true},"f3ffabc95802521e1e4bcba4c88d8615176dc6e09111d920c7a213bdda6e1d65","f9ab232778f2842ffd6955f88b1049982fa2ecb764d129ee4893cbc290f41977","ae56f65caf3be91108707bd8dfbccc2a57a91feb5daabf7165a06a945545ed26","a136d5de521da20f31631a0a96bf712370779d1c05b7015d7019a9b2a0446ca9",{"version":"c3b41e74b9a84b88b1dca61ec39eee25c0dbc8e7d519ba11bb070918cfacf656","affectsGlobalScope":true},{"version":"4737a9dc24d0e68b734e6cfbcea0c15a2cfafeb493485e27905f7856988c6b29","affectsGlobalScope":true},"36d8d3e7506b631c9582c251a2c0b8a28855af3f76719b12b534c6edf952748d","1ca69210cc42729e7ca97d3a9ad48f2e9cb0042bada4075b588ae5387debd318","f5ebe66baaf7c552cfa59d75f2bfba679f329204847db3cec385acda245e574e",{"version":"ed59add13139f84da271cafd32e2171876b0a0af2f798d0c663e8eeb867732cf","affectsGlobalScope":true},"05db535df8bdc30d9116fe754a3473d1b6479afbc14ae8eb18b605c62677d518","0ea329e5eab6719ff83bcb97e8bd03f1faab4feb74704010783b881fc9d80f92","151ff381ef9ff8da2da9b9663ebf657eac35c4c9a19183420c05728f31a6761d",{"version":"ee70b8037ecdf0de6c04f35277f253663a536d7e38f1539d270e4e916d225a3f","affectsGlobalScope":true},"a660aa95476042d3fdcc1343cf6bb8fdf24772d31712b1db321c5a4dcc325434","a7ca8df4f2931bef2aa4118078584d84a0b16539598eaadf7dce9104dfaa381c","11443a1dcfaaa404c68d53368b5b818712b95dd19f188cab1669c39bee8b84b3","36977c14a7f7bfc8c0426ae4343875689949fb699f3f84ecbe5b300ebf9a2c55","035d0934d304483f07148427a5bd5b98ac265dae914a6b49749fe23fbd893ec7","e2ed5b81cbed3a511b21a18ab2539e79ac1f4bc1d1d28f8d35d8104caa3b429f",{"version":"161c8e0690c46021506e32fda85956d785b70f309ae97011fd27374c065cac9b","affectsGlobalScope":true},"402e5c534fb2b85fa771170595db3ac0dd532112c8fa44fc23f233bc6967488b","8885cf05f3e2abf117590bbb951dcf6359e3e5ac462af1c901cfd24c6a6472e2","333caa2bfff7f06017f114de738050dd99a765c7eb16571c6d25a38c0d5365dc","e61df3640a38d535fd4bc9f4a53aef17c296b58dc4b6394fd576b808dd2fe5e6","459920181700cec8cbdf2a5faca127f3f17fd8dd9d9e577ed3f5f3af5d12a2e4","4719c209b9c00b579553859407a7e5dcfaa1c472994bd62aa5dd3cc0757eb077","7ec359bbc29b69d4063fe7dad0baaf35f1856f914db16b3f4f6e3e1bca4099fa","70790a7f0040993ca66ab8a07a059a0f8256e7bb57d968ae945f696cbff4ac7a","d1b9a81e99a0050ca7f2d98d7eedc6cda768f0eb9fa90b602e7107433e64c04c","a022503e75d6953d0e82c2c564508a5c7f8556fad5d7f971372d2d40479e4034","b215c4f0096f108020f666ffcc1f072c81e9f2f95464e894a5d5f34c5ea2a8b1","644491cde678bd462bb922c1d0cfab8f17d626b195ccb7f008612dc31f445d2d","dfe54dab1fa4961a6bcfba68c4ca955f8b5bbeb5f2ab3c915aa7adaa2eabc03a","1251d53755b03cde02466064260bb88fd83c30006a46395b7d9167340bc59b73","47865c5e695a382a916b1eedda1b6523145426e48a2eae4647e96b3b5e52024f","4cdf27e29feae6c7826cdd5c91751cc35559125e8304f9e7aed8faef97dcf572","331b8f71bfae1df25d564f5ea9ee65a0d847c4a94baa45925b6f38c55c7039bf","2a771d907aebf9391ac1f50e4ad37952943515eeea0dcc7e78aa08f508294668","0146fd6262c3fd3da51cb0254bb6b9a4e42931eb2f56329edd4c199cb9aaf804","183f480885db5caa5a8acb833c2be04f98056bdcc5fb29e969ff86e07efe57ab","4ec16d7a4e366c06a4573d299e15fe6207fc080f41beac5da06f4af33ea9761e",{"version":"7870becb94cbc11d2d01b77c4422589adcba4d8e59f726246d40cd0d129784d8","affectsGlobalScope":true},"7f698624bbbb060ece7c0e51b7236520ebada74b747d7523c7df376453ed6fea","f70b8328a15ca1d10b1436b691e134a49bc30dcf3183a69bfaa7ba77e1b78ecd","683b035f752e318d02e303894e767a1ac16ac4493baa2b593195d7976e6b7310","b34b5f6b506abb206b1ea73c6a332b9ee9c8c98be0f6d17cdbda9430ecc1efab","75d4c746c3d16af0df61e7b0afe9606475a23335d9f34fcc525d388c21e9058b","fa959bf357232201c32566f45d97e70538c75a093c940af594865d12f31d4912","d2c52abd76259fc39a30dfae70a2e5ce77fd23144457a7ff1b64b03de6e3aec7","e6233e1c976265e85aa8ad76c3881febe6264cb06ae3136f0257e1eab4a6cc5a","f73e2335e568014e279927321770da6fe26facd4ac96cdc22a56687f1ecbb58e","317878f156f976d487e21fd1d58ad0461ee0a09185d5b0a43eedf2a56eb7e4ea","324ac98294dab54fbd580c7d0e707d94506d7b2c3d5efe981a8495f02cf9ad96","9ec72eb493ff209b470467e24264116b6a8616484bca438091433a545dfba17e","d6ee22aba183d5fc0c7b8617f77ee82ecadc2c14359cc51271c135e23f6ed51f","49747416f08b3ba50500a215e7a55d75268b84e31e896a40313c8053e8dec908","81e634f1c5e1ca309e7e3dc69e2732eea932ef07b8b34517d452e5a3e9a36fa3","34f39f75f2b5aa9c84a9f8157abbf8322e6831430e402badeaf58dd284f9b9a6","427fe2004642504828c1476d0af4270e6ad4db6de78c0b5da3e4c5ca95052a99","2eeffcee5c1661ddca53353929558037b8cf305ffb86a803512982f99bcab50d",{"version":"9afb4cb864d297e4092a79ee2871b5d3143ea14153f62ef0bb04ede25f432030","affectsGlobalScope":true},"891694d3694abd66f0b8872997b85fd8e52bc51632ce0f8128c96962b443189f","69bf2422313487956e4dacf049f30cb91b34968912058d244cb19e4baa24da97","971a2c327ff166c770c5fb35699575ba2d13bba1f6d2757309c9be4b30036c8e","4f45e8effab83434a78d17123b01124259fbd1e335732135c213955d85222234","7bd51996fb7717941cbe094b05adc0d80b9503b350a77b789bbb0fc786f28053","b62006bbc815fe8190c7aee262aad6bff993e3f9ade70d7057dfceab6de79d2f","13497c0d73306e27f70634c424cd2f3b472187164f36140b504b3756b0ff476d","bf7a2d0f6d9e72d59044079d61000c38da50328ccdff28c47528a1a139c610ec","04471dc55f802c29791cc75edda8c4dd2a121f71c2401059da61eff83099e8ab",{"version":"120a80aa556732f684db3ed61aeff1d6671e1655bd6cba0aa88b22b88ac9a6b1","affectsGlobalScope":true},{"version":"e58c0b5226aff07b63be6ac6e1bec9d55bc3d2bda3b11b9b68cccea8c24ae839","affectsGlobalScope":true},"a23a08b626aa4d4a1924957bd8c4d38a7ffc032e21407bbd2c97413e1d8c3dbd","5a88655bf852c8cc007d6bc874ab61d1d63fba97063020458177173c454e9b4a","7e4dfae2da12ec71ffd9f55f4641a6e05610ce0d6784838659490e259e4eb13c","c30a41267fc04c6518b17e55dcb2b810f267af4314b0b6d7df1c33a76ce1b330","72422d0bac4076912385d0c10911b82e4694fc106e2d70added091f88f0824ba","da251b82c25bee1d93f9fd80c5a61d945da4f708ca21285541d7aff83ecb8200","64db14db2bf37ac089766fdb3c7e1160fabc10e9929bc2deeede7237e4419fc8","98b94085c9f78eba36d3d2314affe973e8994f99864b8708122750788825c771","13573a613314e40482386fe9c7934f9d86f3e06f19b840466c75391fb833b99b","f494a096f4e9b3c1b93dd6a852c68d6def531c537c1103273e954b51bdcda04a","30560eac555d009c4678a1c7fa1762b234dbe74b09ee69bfaa04c7f0869cfe79","705ac27abcc360c236033c486bfee3d79bd80197b0990722594a5a418a3eafaa","7a42f6c911fcdb3727bee2f82b214b4233aa93ab78bcc432e85eec16b8e7f4c9",{"version":"bce6291d0d8b8b060e33d1ef7032cc42f05ed47f0b7422630a2738f8f5579603","signature":"4410765ab1ccaf0c5197e953e8ead82c6ecf695f228fbec966a3b99f225e06cc"},{"version":"23db59200c3527367ae6277d0b64030e274bf2a074fe2093e1c76c9e44c1c8fe","signature":"8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881"},"cbd8f7cbc0832353a1db0c80ffe50f4d623bcf992faac71b4aef9e0aa6f4f33e","643b5be3fb728581cdb973f3937606d4925a5270d367a38366e4ddc6b30ba688","f7b9aaeace9a3837c47fad74de94ba117751951904a6cb6f6a2340ca3a5052d2","b59a8f409202638d6530f1e9746035717925f196f8350ef188535d6b6f07ac30","10752162e9a90e7f4e6f92d096706911e209f5e6026bb0fe788b9979bf0c807b","91010341cfcb3809686aefe12ceaa794087fcd0c7d4d72fc81d567535c51f7b9","a5fa720bdcd335d6f01999c7f4c93fb00447782db3c2fad005cc775b1b37b684","c8657b2bf39dbb8bbe8223ca66b76e33c83a649c7655fd7042b50b50cf805c96","18282a2d197d5d3b187d6cfe784b0bfeb36dc3caed79d24705c284506c6a7937","bc7f372120474ef5e195f4c5627aa9136af9dfc52c3e81f5404641f3eb921b20","c897edb7e0074c2cb1a118ad1f144d4095a76e13023c1c9d31499a97f0943c6d","5123f400963c1ae260ba78bd27826dd5ada91cc3df088a913fb709906c2f0fed","f6c69d4211c1c0dc144101b7d564eec8992315a5b652108ab44e617fdfb64a9f","3a0b914cd5a33a695925999bc0e20988f625ff92224224a60356531cc248324b","3b9ef4448417e777778007a2abbfb171fbb400c4012560331330c89a8fd08599","6c086fa316e7f3b80649021bc62262bb4b71c09cc2bbfeb0c72dfeba406f3bc9","80ae4448e40828f253d49dd0cba14ddaa948c4988d54d6bbd558015c4727f1f7","36ccd9bc1c33bf3cce297133d37acfc376d89ea0aff3111cf1792498ae5732d4","ef3212ac0f4934627604a36a63ebdbf235e844065ba3217f368515531b9b452e","a5bb15e8903456dedd2a0c6c7f29b520b75a02fc44b36248fbac98e8b3106f2e","7087a77f8804d330429778346f2adf8418a4641b159f621938604aa20386887a","6d2e4114ccd05fb0cd657cfb73419eeb7e1464446aabfe4e652d4ad460c1fd1a","ce4b1dd7655ecc6b75393994ab906df4350790e30d675870446e59d9fb19c21a","8478f046870fe3053785d1fdb8fc3d4972437fbb230771841eb3945edda1cdce","8827ca3cd0a35d4a2da2b460620586a68dc0681b19f08559bc382f453ae0a915","5c56eea87bcede67b8df6a08185aaa023080fe74f21e7d262e5e0c5885ea6747","2a6140dea5f4014fbf2c301bcefcac865d9b5354ccc09865b309ec25b170eb24","62fbeac38ecc6d7b5ffe8b9c10c60a519963c8bc5a06d7260446a45fe920c01f","5cb04775c9a257123584dc85441b5cb816af5e201074571d629f5861c4ebea0f","91bb13afae2c0de8d11c6a8027f4113067a6907c40378ed38e92b9fef2b2b20c","6cdb8c1473687522f8ef65e1620bb8d703a02f4c570c662bd99ebf442ec9c3ff","799e4c2b1aae2c8531a20544168c528c7994f13bbce20f4813e30cde1ca72cb9","804a7dbd4c64f201d927b23b8563affa0325ec4bd3eeab339933cc85fcbbe4c1","c0a7ac0e0b21d67124311e0a70138df950cfa22360ae582c5d7b95a9a31f3436","c39a02bcdde4e5cf742febb47995c209f651249aa3f339d8981b47eb157dbc7f","3b63f1706adba31dd86669c3745ce127e1d80b83b1376942a5ae3653089b526f","d93c86ac706e8a3eb5c4fd2c3965d793c192438b44b21f94a422029d037113cd","c775b9469b2cbb895386691568a08c5f07e011d79531c79cb65f89355d324339","f8b830bc7cf2ebcadb5381cb0965e9e2e5e1006a96d5569729fc8eae99f1e02b","6465f2a53c52cb1cf228a7eeab54e3380b8971fed677deb08fa082e72854e24c","123c6c775f283b756565682d4aa48e2e72cf4a69249cb296e95b01d7c64c68cf","74965fc49475caca96b090c472f2c3e2085e3be05ce34639e9aabeccd5fb71aa","9640153ef1838657c1de17d486d9755fb714407156ec0be12acd132db4732c7f","b21157929842b9593200c73299fffde810be1b6c2554437e319db0025ecd53ae","cb929086d0d062bb948a1726e87c604db6387d885a846838a4da40e006c51deb","cb2e0b454aed00d0109fa243d681650916750a960736755edb673d4c2fc495dc","2a5c6f30ace32a85b24dec0f03525ed0a40190104be5876bd9107f92cca0166b","4d752856defdcbb39e2915429f85a92aac94406eb1bdef2855b908dde5bc013b","515caaccdd09e635befbfd45f023015a42d375e0536c9786412cf4dab847ff65","6cde23545d1e8d78b222c594e0a66de065311e0c6b0e3989feffb5c7f6b66560","a025111523c3c2c24484c1af1bfcab340490817de7e4b247b700ca7ee203a5cc","39c8ca333a9f4c497aeb72f36857fbca17bd4eb8348a822e4052e76212efb7fc","156d4829532c7d26f824ab7bb26b1eced1bfaf5711d426e95357004c43f40d98","2d9a0ac7d80da8b003ac92445f47891c3acdca1517fb0a0ca3006e2d71e1d2ab","5c62b984997b2e15f2d2ae0f0202121738db19901dc2bad5fe6a7a2d6af871d3","8c04e9d03324f465d5fb381371c06799cd06234f2aa83bdf4318cb9728132b80","cd7a3946f3f2f8c734971b4b7c8c57e02ea88ef98c06c44b8be8c93fe046e8a9","a14590df3ef464f8a9dff9514df70c7aeff05c999f447e761ec13b8158a6cab0","98cbb6e3aa1b6610e7234ff6afa723b9cb52caf19ecb67cf1d96b04aa72b8f88","4bd91244643feda6c0f2fb50f58ee3c2e6af29dd473dc5fb70bb1cbd2eade134","f9575d2a80566ba8d17d2260526ffb81907386aa7cb21508888fb2e967911dca","d388e40b946609b83a5df1a1d12a0ea77168ee2407f28eac6958d6638a3fbf69","83e8adc1946281f15747109c98bd6af5ce3853f3693263419707510b704b70e5","64fb32566d6ac361bdff2fafb937b67ee96b0f4b0ea835c2164620ec2ad8ea09","678b6be72cdcec74f602d366fef05ba709aa60816d4abf2a4faff64a68cdfc1f","b0b8ac2d71ea2251f4f513c7d644db07a46446a6e4bccbcc23ccbefbe9ac3ac4","c7cae4f5befd90da675906c456cc35244edad7cdcedb51fb8f94d576f2b52e5e","a00e19c6ad43bfc4daf759038e309b797b59cc532d68f4556083022ed1d4b134","c4e720b6dd8053526bedd57807a9914e45bb2ffbda801145a086b93cf1cda6d5","1dc465a4431aaa00bb80452b26aa7e7ec33aca666e4256c271bdf04f18fef54d","ea5916d20a81cc0fd49bd783fce0837b690f2d39e456d979bc4b912cb89ceefc","dccc0a4cbe7cbabcf629ef783d3226ed28649f1215eb577a2e2cdb1129347a37","add54a06a7a910f6ed0195282144d58f24e375b7d16bd4a5c5b9d91bb4b5e184","dc03aa8332b32c2d7cd0f4f72b4a8cc61bbc2806eb18fa841ec3de56b8e806a6","dd56e1c623e5b14260b6d817f4f26d6cc63c77f5bf55321306d118617fc20c7d","d4cb93b91ab77070c8baebdcc5c951954ee219900795cc7e34aaef6be0081a2b","93ff68f1f2b1be14e488d472820e2cbc3c1744e4b55aea9a12288f612e8cf56f","7e4d2c8b02fc2529a60bd495322092644b5cf2f391b10bea4bcae8efea227c32","219b5d42961185874397f62f12d64e74e0825d260054984e0248010de538015e","27b5570022c0f24a093c0718de58a4f2d2b4124df0f7ff9b9786874c84c8af27","ad37fb454bd70dd332bb8b5047fbc0cf00ddfc48972d969a8530ab44998b7e70","265bdbd67761e88d8be1d91a21ec53bb8915e769a71bdc3f0e1e48fdda0a4c6e","817e174de32fb2f0d55d835c184c1248877c639885fcaed66bab759ff8be1b59","ea76d1231ea876a2a352eae09d90ae6ef20126052e0adfdc691437d624ebcc47","0961671995b68a718e081179cfa23c89410b97031880cf0fea203f702193385a","b6592f9a1102da83ba752d678e5e94af9443bf1ab70666f2f756ba1a85b8adfc","d1c933acc6c2847d38c7a29c3d154ef5a6b51e2ad728f682e47717524683e563","44380b6f061bbb7d7b81b3d9973c9a18b176e456eee4316a56c9e2932df77bfd","e558775330d82e3a2e16a2442c1332572f3cb269a545de3952ed226473e4ccdd","32d5ec19fbe22a610e11aa721d9947c1249e59a5b8e68f864d954f68795982d1","e1fa85a34e9710a03fb4e68a8b318b50cde979325a874a311c0429be2e9a6380","998c9ae7ae683f16a68d9204b8dea071377d886ed649f7da777dce408ede67b7","e02fe9a276b87b4c10c56cbcee81f8c6437d21a0a68eeb705e23105c3620677e","d56bc539844eceaaae11714c214add744ace0227da77c91e62d8c3cd0ee78964","9199f6ead2ae205b4a0efe8b427706b7b9856f2fb51587ca25e9161cfee2b163","120a62730ef5b8b61b4a82005c421506d0bf4f5a2fbe84b88149c79c894900da","3ca2a4b5f57c480c798f8310b3d3c10dc24fa73d5618889a27835eb80f783fa3","faf92d569360b567c70c11b08aadd997fb2ca1847687f370eaea8eda19f807f2","38e878406954753d87c2b0db8b5146da5abb86c44139526cba2046cc70fbd1d4","c500d215a2e0490d77f0f926507adac154bfc5cfcb855ffdbe2c600e67fbf36f","6a22003e006988f31654d8bf884208ff753d64bcb980a89e4c5eb933bf446d09","3a8493e70ee5fc14e8e9a028e5e3b1df79acbd4bc4ded50725d2ad4927a9c101","7f02dfc714a76c78325cdfbc138b57531103490dc9d88affdb3f4a54fdd879a0",{"version":"e950b8f29687653d0065e99b37e2d72d39e6336bb15e6275ca1d35d5c44974ad","signature":"57d11d9b86270e81ef50598552fba05a828338280cbe7393ba0002ec693443ee"},{"version":"1305285533d821eca222a7de9639ddbf610ffa9aff2263e5e6a35dad74969a99","signature":"8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881"},"7bb53546e9bd6e3f22804497a41d4b885674e7b15b7d64c7d3f83722dfd2b456","4083e6d84bfe72b0835b600185c7b7ce321da3d6053f866859185eefc161e7a0","b883e245dc30c73b655ffe175712cac82981fc999d6284685f0ed7c1dac8aa6f","626e3504b81883fa94578c2a97eff345fadc5eae17a57c39f585655eef5b8272","e9a15eeba29ceb0ee109dd5e0282d2877d8165d87251f2ea9741a82685a25c61","c6cb06cc021d9149301f3c51762a387f9d7571feed74273b157d934c56857fac","cd7c133395a1c72e7c9e546f62292f839819f50a8aa46050f8588b63ef56df88","196f5f74208ce4accea017450ed2abc9ce4ab13c29a9ea543db4c2d715a19183","4687c961ab2e3107379f139d22932253afb7dd52e75a18890e70d4a376cdf5d9","ae8cfe2e3bdef3705fc294d07869a0ab8a52d9b623d1cc0482b6fc2be262b015","94c8e9c00244bbf1c868ca526b12b4db1fab144e3f5e18af3591b5b471854157","827d576995f67a6205c0f048ae32f6a1cf7bda9a7a76917ab286ef11d7987fd7","cb5dc83310a61d2bb351ddcdcaa6ec1cf60cc965d26ce6f156a28b4062e96ab2","0091cb2456a823e123fe76faa8b94dea81db421770d9a9c9ade1b111abe0fcd1","034d811fd7fb2262ad35b21df0ecab14fdd513e25dbf563572068e3f083957d9","298bcc906dd21d62b56731f9233795cd11d88e062329f5df7cdb4e499207cdd4","f7e64be58c24f2f0b7116bed8f8c17e6543ddcdc1f46861d5c54217b4a47d731","966394e0405e675ca1282edbfa5140df86cb6dc025e0f957985f059fe4b9d5d6","b0587deb3f251b7ad289240c54b7c41161bb6488807d1f713e0a14c540cbcaee","4254aab77d0092cab52b34c2e0ab235f24f82a5e557f11d5409ae02213386e29","19db45929fad543b26b12504ee4e3ff7d9a8bddc1fc3ed39723c2259e3a4590f","b21934bebe4cd01c02953ab8d17be4d33d69057afdb5469be3956e84a09a8d99","b2b734c414d440c92a17fd409fa8dac89f425031a6fc7843bac765c6c174d1ca","239f39e8ad95065f5188a7acd8dbefbbbf94d9e00c460ffdc331e24bc1f63a54","d44f78893cb79e00e16a028e3023a65c1f2968352378e8e323f8c8f88b8da495","32afc9daae92391cb4efeb0d2dac779dc0fb17c69be0eb171fd5ed7f7908eeb4","b835c6e093ad9cda87d376c248735f7e4081f64d304b7c54a688f1276875cbf0","a9eabe1d0b20e967a18758a77884fbd61b897d72a57ddd9bf7ea6ef1a3f4514b","64c5059e7d7a80fe99d7dad639f3ba765f8d5b42c5b265275d7cd68f8426be75","05dc1970dc02c54db14d23ff7a30af00efbd7735313aa8af45c4fd4f5c3d3a33","a0caf07fe750954ad4cf079c5cf036be2191a758c2700424085ffde6af60d185","1ea59d0d71022de8ea1c98a3f88d452ad5701c7f85e74ddaa0b3b9a34ed0e81c","eab89b3aa37e9e48b2679f4abe685d56ac371daa8fbe68526c6b0c914eb28474",{"version":"55a1ce846b49bb081d5ae2d534ad4c11da92ee9ef143648ae898f20463779ee6","signature":"6844b6bbd468c2d381d121057b1af6154724f24fba1e131da45ccf0ef503eb87"},{"version":"23742d0d73a762c548a83ddad5f46b173e87aee670cf28932b01672b215c47b2","signature":"8c9ec7d5b2aae5dd2ff9b50b0af138982b1473b1c852c157eaa1e16774abcd18"},{"version":"e20fde5169422ed444d8538b9832c79854d25aa4edbbb314b9f8f097b9d10396","signature":"b07c6d91032d53eafc562906e5ce97a4354ba1bcc5a395da2ad5533259e54665"},{"version":"47b45b090f8c2a6b1bb1bb0e838cdab7206d89bdbf5c9472dfb055589a39007a","signature":"9cd0fd3e469fcf87317940f1c422f3fb4ef887e083873c665facf52a2d7eb26d"},{"version":"3c6f3e7d02301bde29822f570f31d456bb96086f4716cbe99b83d21b257e1140","signature":"6b8bac2fa56bc4dda47db82b764fda5f282b213ddb1c8f518628b07d724321a6"},{"version":"d0cfc3c5428ae6cd64b4e8ad8098fb7e4cbb423b0c55ff0c88961f4c99b83ba4","signature":"ba3d00fa06f7b7e3fd75fd78e0515473e681ae1cc0413a8f09be786b8df87eef"},{"version":"331613b28aba32b71dba103850db4e69e1b2f4d1a86eb7d7f523b08d13c5b1fb","signature":"13e69f0647407ffab96c796d0ed855be7774dfd5417fa835fdc00b2f8546ca89"},{"version":"b4485f74e7bd23eb97015523f86ad8409244ea69f0c7b36a2a2c8f47309e59c2","signature":"6321dc5c363ab82d13c16893e8f9512ee70f48665ebc27fc7c05b915fb37c9dd"},{"version":"df5c583df82b394f242f4764662756c3ba7de0eb385b85951fcf6d01f553dcaf","signature":"8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881"},{"version":"b4109a6ce113a93a2876a38b83c016179979225cb1e97949f260785614cfd8a5","signature":"bca0ac4786ab80179e7a24ff54151f7db7d525cdd18b11d96d849b1467f22590"},{"version":"56afdd3f17b1b6438ab0db1d6ad137b24e072b24ad17091ee12263100b954f91","signature":"33573e91aa311d26daddb7f9c897ed20c7f41166d8c024b739db6c56471d2b4b"},{"version":"396f5ed51074899b2d54b99c3d288e8d8b38d4607ef62d4be2930eb9c510f790","signature":"c43ccb93a2083ed202db9f103a8a1a86094f59f1359d94ad0567bf1143a627cb"},{"version":"35e4d8699c4718c12fdb6539b7a0fa3cb291cb488ef2153fe80c3ab861840d56","signature":"ee3ec8c1e006d2cf3f89599d3156dfae90834dcf4521364aac58a581d8c6fb30"},{"version":"4fd3c5af716a11e90c562987dbc074daa3303d40920faf6cb4bc96b0fc61102e","signature":"a87433d1ab7576dba0fa3b5125c43df3231cd2ca295bcd87d6fbfb0ed1ef0bb3"},{"version":"0a7d5a1ce7c811e4c1cdb1efc58785ecdb380831f59c4fff4909c927bf6dac9e","signature":"fb8b456c11acf1536fed7e23632ee9958a49397941d77c560b50c7efaf6642fe"},{"version":"d5d662b803f489945d253ef590b0bc5f2ceedaa28994e0da718b5ada42afaa00","signature":"89615e090bf6efd0d5d82650f8fd3d481a07acab10a67bbfabb5c5a8de683a4a"},{"version":"c6e319ca80b2ff5538be337e792b81c8da173c9a2eee540ac6d068e78cf1c0d3","signature":"936b0bbc2c3d926c925c96f83e2e8d3319ac3323a090d6f353da83c0d84e18cd"},{"version":"e86eb2f5203682a9157c44b0f8c7a4614e48ccdbfc868afc015064a99f0400b4","signature":"ed8a8855cf5b3e52a7f2b60811206b8ec96eb70e536efd2abe2b52cd5d0762bc"},{"version":"872152953de2bd9772bcf4090fd44dc7823ebc4df3cd061c5e38873f1427724c","signature":"4747398580c3ac97fe5736cb089081d348869c384e930148f0f9a62571a2aa8b"},{"version":"ef1c7f9ce11a452029935d19f69f82b41141902d94a1ada3f93dd907519be1c1","signature":"86e7770c1c98dd3cadd7e74e036d0a1b5c115601c17a5eaa6ce682e9a28529c7"},{"version":"a483bcc6b83d53b4915ccd0a8a2640fe0cc29ec5fbbbe23966a8421ba6f8c14d","signature":"c6c2365d7f4aa1e854215d50a052f24c994251be95657825ef53b6fc6ed3cea8"},"413eb8ce5f776537ab4d2557388f94128a4f907b45cb991cffe83723451f816d",{"version":"bb4f8277ab6463e534d5c38fed37fa917409b3982d45cf0b194e38a0a44771d3","signature":"8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881"},{"version":"1135efd5ddf0f5607b14a8a6654332b85470afe8d04fa6ca38cd9360a0feca49","signature":"8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881"},{"version":"671c21df703b99e4d2cbe1f7f0f8891fb4a5423761b77411e91904ba2e04e17b","signature":"8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881"},{"version":"c16da7de580cc1b380c6fdc8c7bf62b7bfd3a57dbbb1e62b3078896ac1d29624","signature":"8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881"},{"version":"c42314f3d7db70ce3bc5e1d473bbe6993d88173827316479cd132c5be2b560b2","signature":"8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881"},{"version":"ebf6e80a5711a94b406dd733e7e32a99618c82524c42106f1631b61161a98dec","signature":"8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881"},{"version":"8410c6aaaf7bda9d7148dc119dc8c011c5ff6a583ebe4a36a6f6b4ce7d98533f","signature":"8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881"},"ae77d81a5541a8abb938a0efedf9ac4bea36fb3a24cc28cfa11c598863aba571","556ccd493ec36c7d7cb130d51be66e147b91cc1415be383d71da0f1e49f742a9","b6d03c9cfe2cf0ba4c673c209fcd7c46c815b2619fd2aad59fc4229aaef2ed43","95aba78013d782537cc5e23868e736bec5d377b918990e28ed56110e3ae8b958","670a76db379b27c8ff42f1ba927828a22862e2ab0b0908e38b671f0e912cc5ed","13b77ab19ef7aadd86a1e54f2f08ea23a6d74e102909e3c00d31f231ed040f62","069bebfee29864e3955378107e243508b163e77ab10de6a5ee03ae06939f0bb9","96d14f21b7652903852eef49379d04dbda28c16ed36468f8c9fa08f7c14c9538","fb893a0dfc3c9fb0f9ca93d0648694dd95f33cbad2c0f2c629f842981dfd4e2e","95da3c365e3d45709ad6e0b4daa5cdaf05e9076ba3c201e8f8081dd282c02f57",{"version":"29f72ec1289ae3aeda78bf14b38086d3d803262ac13904b400422941a26a3636","affectsGlobalScope":true},"9df0f2ba281c306c80873282ff8993bd76198e86d478bb5ad36c80ee2b66674b",{"version":"cb10a0a912da58ffb11ea16a0138f3f799628559b9f391a8caefee162b7249f6","affectsGlobalScope":true},"87d9d29dbc745f182683f63187bf3d53fd8673e5fca38ad5eaab69798ed29fbc",{"version":"eb5b19b86227ace1d29ea4cf81387279d04bb34051e944bc53df69f58914b788","affectsGlobalScope":true},"ac51dd7d31333793807a6abaa5ae168512b6131bd41d9c5b98477fc3b7800f9f",{"version":"7a3aa194cfd5919c4da251ef04ea051077e22702638d4edcb9579e9101653519","affectsGlobalScope":true},"17ed71200119e86ccef2d96b73b02ce8854b76ad6bd21b5021d4269bec527b5f"],"root":[248,249,353,354,[388,416]],"options":{"composite":true,"declaration":true,"esModuleInterop":true,"module":7,"outDir":"./dist","rootDir":"./src","skipLibCheck":true,"strict":true,"target":9},"fileIdsList":[[78,125,418],[78,125],[78,125,418,419,420,421,422],[78,125,418,420],[78,125,221,222],[78,125,130,173,425],[78,122,125],[78,124,125],[78,125,130,158],[78,125,126,131,136,144,155,166],[78,125,126,127,136,144],[73,74,75,78,125],[78,125,128,167],[78,125,129,130,137,145],[78,125,130,155,163],[78,125,131,133,136,144],[78,124,125,132],[78,125,133,134],[78,125,135,136],[78,124,125,136],[78,125,136,137,138,155,166],[78,125,136,137,138,151,155,158],[78,125,133,136,139,144,155,166],[78,125,136,137,139,140,144,155,163,166],[78,125,139,141,155,163,166],[78,125,136,142],[78,125,143,166,171],[78,125,133,136,144,155],[78,125,145],[78,125,146],[78,124,125,147],[78,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172],[78,125,149],[78,125,150],[78,125,136,151,152],[78,125,151,153,167,169],[78,125,136,155,156,158],[78,125,157,158],[78,125,155,156],[78,125,158],[78,125,159],[78,122,125,155,160],[78,125,136,161,162],[78,125,161,162],[78,125,130,144,155,163],[78,125,164],[125],[76,77,78,79,80,81,82,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172],[78,125,144,165],[78,125,139,150,166],[78,125,130,167],[78,125,155,168],[78,125,143,169],[78,125,170],[78,120,125],[78,120,125,136,138,147,155,158,166,169,171],[78,125,155,172],[78,125,173],[78,125,433],[78,125,430,431,432],[63,64,67,78,125,232],[78,125,208,209],[64,65,67,68,69,78,125],[64,78,125],[64,65,67,78,125],[64,65,78,125],[78,125,215],[59,78,125,215,216],[59,78,125,215],[59,66,78,125],[60,78,125],[59,60,61,63,78,125],[59,78,125],[78,125,325,326,327],[78,125,325],[78,125,327,328,329,330,331],[78,125,325,326,327,328,330],[78,125,257,325,326],[78,125,257],[78,125,254,255,256],[78,125,333,334,335,336],[78,125,257,279,304,305,314,325,332],[78,125,257,304,305,306,314,325,332],[78,125,304,305,306,307],[78,125,305,314,332],[78,125,279,304,306,314,325,332],[78,125,258,259,260,261,262,263,264,265,266],[78,125,265,267,325],[78,125,250,257,267,273,288,308,314,325,332,337,344,350],[78,125,257,267,325],[78,125,282,283,284,285,286,287],[78,125,267],[78,125,267,325],[78,125,351],[78,125,257,277,278,279,280,325],[78,125,273,279,288,289],[78,125,279],[78,125,277,281,294],[78,125,279,281,325],[78,125,267,273],[78,125,274,276,277,278,279,280,281,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,309,310,311,312,313],[78,125,273,276,325],[78,125,275,279],[78,125,277,281,291,292,325],[78,125,277,292],[78,125,276,277,279,281,308],[78,125,277,281],[78,125,277,281,291,292,294,325],[78,125,144,173,277,292,293],[78,125,273,277,279,281,288,289,290,325],[78,125,277,279,281,292],[78,125,277,292,293],[78,125,257,267,273,274,277,278,325],[78,125,279,288,289,290],[78,125,257,273,274,279,288],[78,125,273],[78,125,267,268,269,270,271,272],[78,125,267,273,325],[78,125,252],[78,125,275,314],[78,125,251,252,253,268,275,315,316,317,318,319,320,321,322,323,324],[78,125,320],[78,125,319,321],[78,125,267,273,288,314],[78,125,267,314,325,338,344,345],[78,125,338,345,346,347,348,349],[78,125,325,344],[78,125,267,314,338,346],[78,125,339,340,341,342,343],[78,125,340],[78,125,339],[78,125,238,239],[78,125,238,239,240,241],[78,125,238,240],[78,125,238],[78,125,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386],[78,125,355],[78,125,355,365],[78,125,245],[78,125,244,246],[78,125,198],[78,125,196,198],[78,125,187,195,196,197,199,201],[78,125,185],[78,125,188,193,198,201],[78,125,184,201],[78,125,188,189,192,193,194,201],[78,125,188,189,190,192,193,201],[78,125,185,186,187,188,189,193,194,195,197,198,199,201],[78,125,201],[78,125,183,185,186,187,188,189,190,192,193,194,195,196,197,198,199,200],[78,125,183,201],[78,125,188,190,191,193,194,201],[78,125,192,201],[78,125,193,194,198,201],[78,125,186,196],[78,125,175,206,207],[78,125,174,175],[62,78,125],[78,92,96,125,166],[78,92,125,155,166],[78,87,125],[78,89,92,125,163,166],[78,125,144,163],[78,87,125,173],[78,89,92,125,144,166],[78,84,85,88,91,125,136,155,166],[78,92,99,125],[78,84,90,125],[78,92,113,114,125],[78,88,92,125,158,166,173],[78,113,125,173],[78,86,87,125,173],[78,92,125],[78,86,87,88,89,90,91,92,93,94,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,114,115,116,117,118,119,125],[78,92,107,125],[78,92,99,100,125],[78,90,92,100,101,125],[78,91,125],[78,84,87,92,125],[78,92,96,100,101,125],[78,96,125],[78,90,92,95,125,166],[78,84,89,92,99,125],[78,125,155],[78,87,92,113,125,171,173],[78,125,212,213],[78,125,212],[78,125,136,137,139,140,141,144,155,163,166,172,173,175,176,177,178,180,181,182,202,203,204,205,206,207],[78,125,177,178,179,180],[78,125,177],[78,125,178],[78,125,175,207],[70,78,125,224,225,234],[59,67,70,78,125,217,218,234],[78,125,227],[71,78,125],[59,70,72,78,125,217,226,233,234],[78,125,210],[59,64,67,70,72,78,125,128,137,155,207,210,211,214,217,219,220,223,226,228,229,234,235],[70,78,125,224,225,226,234],[78,125,207,230,235],[70,72,78,125,214,217,219,234],[78,125,171,220],[59,64,67,70,71,72,78,125,128,137,155,171,207,210,211,214,217,218,219,220,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,242],[78,125,243,405],[78,125,248,352,389],[78,125,243,406,408],[78,125,406,407],[78,125,130,406],[78,125,243,248],[78,125,247],[78,125,243,248,353],[78,125,352],[78,125,243,390,393,394,395],[78,125,248,353,390,391,392,393,394,395,397,398,402,403,404,405,406,407,408],[78,125,390],[78,125,130,248,353,390],[78,125,243,391,393,395,397,398],[78,125,248,387,390],[78,125,243,390,391],[78,125,388],[78,125,388,399,400,401],[78,125,243,402],[78,125,130,352,390],[78,125,388,389],[78,125,243,393,394,395],[78,125,352,390,391,392],[78,125,126,130,352,389],[78,125,126,137,145,146,243,403]],"referencedMap":[[420,1],[418,2],[417,2],[423,3],[419,1],[421,4],[422,1],[223,5],[221,2],[174,2],[424,2],[426,6],[427,2],[425,2],[122,7],[123,7],[124,8],[125,9],[126,10],[127,11],[73,2],[76,12],[74,2],[75,2],[128,13],[129,14],[130,15],[131,16],[132,17],[133,18],[134,18],[135,19],[136,20],[137,21],[138,22],[79,2],[139,23],[140,24],[141,25],[142,26],[143,27],[144,28],[145,29],[146,30],[147,31],[148,32],[149,33],[150,34],[151,35],[152,35],[153,36],[154,2],[155,37],[157,38],[156,39],[158,40],[159,41],[160,42],[161,43],[162,44],[163,45],[164,46],[78,47],[77,2],[173,48],[165,49],[166,50],[167,51],[168,52],[169,53],[170,54],[80,2],[81,2],[82,2],[121,55],[171,56],[172,57],[428,58],[429,58],[430,2],[434,59],[431,2],[433,60],[233,61],[210,62],[208,2],[209,2],[59,2],[70,63],[65,64],[68,65],[224,66],[215,2],[218,67],[217,68],[229,68],[216,69],[232,2],[67,70],[69,70],[61,71],[64,72],[211,71],[66,73],[60,2],[222,2],[83,2],[432,2],[182,2],[250,2],[328,74],[329,75],[326,75],[327,2],[332,76],[331,77],[330,78],[254,2],[256,79],[255,75],[257,80],[333,2],[334,2],[337,81],[335,2],[336,2],[306,82],[307,83],[308,84],[304,85],[305,86],[258,75],[267,87],[259,75],[261,75],[262,2],[260,75],[263,75],[264,75],[265,75],[266,88],[351,89],[282,90],[283,2],[288,91],[285,92],[284,2],[286,2],[287,93],[352,94],[281,95],[290,96],[291,2],[274,97],[295,98],[280,99],[278,100],[314,101],[277,102],[276,103],[299,104],[301,104],[300,104],[298,105],[303,104],[302,105],[309,106],[297,107],[310,108],[313,109],[292,110],[311,104],[312,104],[293,111],[294,112],[279,113],[296,114],[289,115],[269,116],[271,93],[270,116],[273,117],[272,118],[251,75],[253,119],[252,2],[315,120],[316,2],[275,2],[317,75],[325,121],[268,119],[318,2],[319,75],[321,122],[320,123],[322,75],[323,75],[324,75],[338,124],[346,125],[350,126],[347,2],[348,93],[345,127],[349,128],[344,129],[341,130],[340,131],[342,130],[339,2],[343,131],[240,132],[242,133],[241,134],[239,135],[238,2],[387,136],[356,137],[366,137],[357,137],[367,137],[358,137],[359,137],[374,137],[373,137],[375,137],[376,137],[368,137],[360,137],[369,137],[361,137],[370,137],[362,137],[364,137],[372,138],[365,137],[371,138],[377,138],[363,137],[378,137],[383,137],[384,137],[379,137],[355,2],[385,2],[381,137],[380,137],[382,137],[386,137],[246,139],[244,2],[247,140],[245,2],[199,141],[197,142],[198,143],[186,144],[187,142],[194,145],[185,146],[190,147],[200,2],[191,148],[196,149],[202,150],[201,151],[184,152],[192,153],[193,154],[188,155],[195,141],[189,156],[176,157],[175,158],[183,2],[225,2],[62,2],[63,159],[57,2],[58,2],[10,2],[12,2],[11,2],[2,2],[13,2],[14,2],[15,2],[16,2],[17,2],[18,2],[19,2],[20,2],[3,2],[21,2],[4,2],[22,2],[26,2],[23,2],[24,2],[25,2],[27,2],[28,2],[29,2],[5,2],[30,2],[31,2],[32,2],[33,2],[6,2],[37,2],[34,2],[35,2],[36,2],[38,2],[7,2],[39,2],[44,2],[45,2],[40,2],[41,2],[42,2],[43,2],[8,2],[49,2],[46,2],[47,2],[48,2],[50,2],[9,2],[51,2],[52,2],[53,2],[56,2],[54,2],[55,2],[1,2],[99,160],[109,161],[98,160],[119,162],[90,163],[89,164],[118,58],[112,165],[117,166],[92,167],[106,168],[91,169],[115,170],[87,171],[86,58],[116,172],[88,173],[93,174],[94,2],[97,174],[84,2],[120,175],[110,176],[101,177],[102,178],[104,179],[100,180],[103,181],[113,58],[95,182],[96,183],[105,184],[85,185],[108,176],[107,174],[111,2],[114,186],[227,187],[213,188],[214,187],[212,2],[207,189],[181,190],[180,191],[178,191],[177,2],[179,192],[205,2],[204,2],[203,2],[206,193],[226,194],[219,195],[228,196],[72,197],[234,198],[236,199],[230,200],[237,201],[235,202],[220,203],[231,204],[243,205],[71,2],[404,2],[413,206],[405,207],[414,208],[408,209],[407,210],[406,2],[249,211],[248,212],[354,213],[353,214],[396,215],[409,216],[394,217],[397,218],[410,219],[398,220],[411,221],[391,220],[399,222],[402,223],[400,222],[401,222],[415,224],[388,2],[395,225],[390,226],[412,227],[393,228],[392,217],[403,229],[389,2],[416,230]],"latestChangedDtsFile":"./dist/zkp/zkp.test.d.ts"},"version":"5.5.4"}
\ No newline at end of file
+{"program":{"fileNames":["../../node_modules/typescript/lib/lib.es5.d.ts","../../node_modules/typescript/lib/lib.es2015.d.ts","../../node_modules/typescript/lib/lib.es2016.d.ts","../../node_modules/typescript/lib/lib.es2017.d.ts","../../node_modules/typescript/lib/lib.es2018.d.ts","../../node_modules/typescript/lib/lib.es2019.d.ts","../../node_modules/typescript/lib/lib.es2020.d.ts","../../node_modules/typescript/lib/lib.es2021.d.ts","../../node_modules/typescript/lib/lib.es2022.d.ts","../../node_modules/typescript/lib/lib.dom.d.ts","../../node_modules/typescript/lib/lib.es2015.core.d.ts","../../node_modules/typescript/lib/lib.es2015.collection.d.ts","../../node_modules/typescript/lib/lib.es2015.generator.d.ts","../../node_modules/typescript/lib/lib.es2015.iterable.d.ts","../../node_modules/typescript/lib/lib.es2015.promise.d.ts","../../node_modules/typescript/lib/lib.es2015.proxy.d.ts","../../node_modules/typescript/lib/lib.es2015.reflect.d.ts","../../node_modules/typescript/lib/lib.es2015.symbol.d.ts","../../node_modules/typescript/lib/lib.es2015.symbol.wellknown.d.ts","../../node_modules/typescript/lib/lib.es2016.array.include.d.ts","../../node_modules/typescript/lib/lib.es2016.intl.d.ts","../../node_modules/typescript/lib/lib.es2017.date.d.ts","../../node_modules/typescript/lib/lib.es2017.object.d.ts","../../node_modules/typescript/lib/lib.es2017.sharedmemory.d.ts","../../node_modules/typescript/lib/lib.es2017.string.d.ts","../../node_modules/typescript/lib/lib.es2017.intl.d.ts","../../node_modules/typescript/lib/lib.es2017.typedarrays.d.ts","../../node_modules/typescript/lib/lib.es2018.asyncgenerator.d.ts","../../node_modules/typescript/lib/lib.es2018.asynciterable.d.ts","../../node_modules/typescript/lib/lib.es2018.intl.d.ts","../../node_modules/typescript/lib/lib.es2018.promise.d.ts","../../node_modules/typescript/lib/lib.es2018.regexp.d.ts","../../node_modules/typescript/lib/lib.es2019.array.d.ts","../../node_modules/typescript/lib/lib.es2019.object.d.ts","../../node_modules/typescript/lib/lib.es2019.string.d.ts","../../node_modules/typescript/lib/lib.es2019.symbol.d.ts","../../node_modules/typescript/lib/lib.es2019.intl.d.ts","../../node_modules/typescript/lib/lib.es2020.bigint.d.ts","../../node_modules/typescript/lib/lib.es2020.date.d.ts","../../node_modules/typescript/lib/lib.es2020.promise.d.ts","../../node_modules/typescript/lib/lib.es2020.sharedmemory.d.ts","../../node_modules/typescript/lib/lib.es2020.string.d.ts","../../node_modules/typescript/lib/lib.es2020.symbol.wellknown.d.ts","../../node_modules/typescript/lib/lib.es2020.intl.d.ts","../../node_modules/typescript/lib/lib.es2020.number.d.ts","../../node_modules/typescript/lib/lib.es2021.promise.d.ts","../../node_modules/typescript/lib/lib.es2021.string.d.ts","../../node_modules/typescript/lib/lib.es2021.weakref.d.ts","../../node_modules/typescript/lib/lib.es2021.intl.d.ts","../../node_modules/typescript/lib/lib.es2022.array.d.ts","../../node_modules/typescript/lib/lib.es2022.error.d.ts","../../node_modules/typescript/lib/lib.es2022.intl.d.ts","../../node_modules/typescript/lib/lib.es2022.object.d.ts","../../node_modules/typescript/lib/lib.es2022.sharedmemory.d.ts","../../node_modules/typescript/lib/lib.es2022.string.d.ts","../../node_modules/typescript/lib/lib.es2022.regexp.d.ts","../../node_modules/typescript/lib/lib.decorators.d.ts","../../node_modules/typescript/lib/lib.decorators.legacy.d.ts","../../node_modules/@vitest/pretty-format/dist/index.d.ts","../../node_modules/@vitest/utils/dist/types.d.ts","../../node_modules/@vitest/utils/dist/helpers.d.ts","../../node_modules/tinyrainbow/dist/index-8b61d5bc.d.ts","../../node_modules/tinyrainbow/dist/node.d.ts","../../node_modules/@vitest/utils/dist/index.d.ts","../../node_modules/@vitest/runner/dist/tasks.d-cksck4of.d.ts","../../node_modules/@vitest/utils/dist/types.d-bcelap-c.d.ts","../../node_modules/@vitest/utils/dist/diff.d.ts","../../node_modules/@vitest/runner/dist/types.d.ts","../../node_modules/@vitest/utils/dist/error.d.ts","../../node_modules/@vitest/runner/dist/index.d.ts","../../node_modules/vitest/optional-types.d.ts","../../node_modules/vitest/dist/chunks/environment.d.cl3nlxbe.d.ts","../../node_modules/@types/node/compatibility/disposable.d.ts","../../node_modules/@types/node/compatibility/indexable.d.ts","../../node_modules/@types/node/compatibility/iterators.d.ts","../../node_modules/@types/node/compatibility/index.d.ts","../../node_modules/@types/node/ts5.6/globals.typedarray.d.ts","../../node_modules/@types/node/ts5.6/buffer.buffer.d.ts","../../node_modules/@types/node/globals.d.ts","../../node_modules/@types/node/web-globals/abortcontroller.d.ts","../../node_modules/@types/node/web-globals/domexception.d.ts","../../node_modules/@types/node/web-globals/events.d.ts","../../node_modules/buffer/index.d.ts","../../node_modules/undici-types/header.d.ts","../../node_modules/undici-types/readable.d.ts","../../node_modules/undici-types/file.d.ts","../../node_modules/undici-types/fetch.d.ts","../../node_modules/undici-types/formdata.d.ts","../../node_modules/undici-types/connector.d.ts","../../node_modules/undici-types/client.d.ts","../../node_modules/undici-types/errors.d.ts","../../node_modules/undici-types/dispatcher.d.ts","../../node_modules/undici-types/global-dispatcher.d.ts","../../node_modules/undici-types/global-origin.d.ts","../../node_modules/undici-types/pool-stats.d.ts","../../node_modules/undici-types/pool.d.ts","../../node_modules/undici-types/handlers.d.ts","../../node_modules/undici-types/balanced-pool.d.ts","../../node_modules/undici-types/agent.d.ts","../../node_modules/undici-types/mock-interceptor.d.ts","../../node_modules/undici-types/mock-agent.d.ts","../../node_modules/undici-types/mock-client.d.ts","../../node_modules/undici-types/mock-pool.d.ts","../../node_modules/undici-types/mock-errors.d.ts","../../node_modules/undici-types/proxy-agent.d.ts","../../node_modules/undici-types/env-http-proxy-agent.d.ts","../../node_modules/undici-types/retry-handler.d.ts","../../node_modules/undici-types/retry-agent.d.ts","../../node_modules/undici-types/api.d.ts","../../node_modules/undici-types/interceptors.d.ts","../../node_modules/undici-types/util.d.ts","../../node_modules/undici-types/cookies.d.ts","../../node_modules/undici-types/patch.d.ts","../../node_modules/undici-types/websocket.d.ts","../../node_modules/undici-types/eventsource.d.ts","../../node_modules/undici-types/filereader.d.ts","../../node_modules/undici-types/diagnostics-channel.d.ts","../../node_modules/undici-types/content-type.d.ts","../../node_modules/undici-types/cache.d.ts","../../node_modules/undici-types/index.d.ts","../../node_modules/@types/node/web-globals/fetch.d.ts","../../node_modules/@types/node/assert.d.ts","../../node_modules/@types/node/assert/strict.d.ts","../../node_modules/@types/node/async_hooks.d.ts","../../node_modules/@types/node/buffer.d.ts","../../node_modules/@types/node/child_process.d.ts","../../node_modules/@types/node/cluster.d.ts","../../node_modules/@types/node/console.d.ts","../../node_modules/@types/node/constants.d.ts","../../node_modules/@types/node/crypto.d.ts","../../node_modules/@types/node/dgram.d.ts","../../node_modules/@types/node/diagnostics_channel.d.ts","../../node_modules/@types/node/dns.d.ts","../../node_modules/@types/node/dns/promises.d.ts","../../node_modules/@types/node/domain.d.ts","../../node_modules/@types/node/events.d.ts","../../node_modules/@types/node/fs.d.ts","../../node_modules/@types/node/fs/promises.d.ts","../../node_modules/@types/node/http.d.ts","../../node_modules/@types/node/http2.d.ts","../../node_modules/@types/node/https.d.ts","../../node_modules/@types/node/inspector.generated.d.ts","../../node_modules/@types/node/module.d.ts","../../node_modules/@types/node/net.d.ts","../../node_modules/@types/node/os.d.ts","../../node_modules/@types/node/path.d.ts","../../node_modules/@types/node/perf_hooks.d.ts","../../node_modules/@types/node/process.d.ts","../../node_modules/@types/node/punycode.d.ts","../../node_modules/@types/node/querystring.d.ts","../../node_modules/@types/node/readline.d.ts","../../node_modules/@types/node/readline/promises.d.ts","../../node_modules/@types/node/repl.d.ts","../../node_modules/@types/node/sea.d.ts","../../node_modules/@types/node/stream.d.ts","../../node_modules/@types/node/stream/promises.d.ts","../../node_modules/@types/node/stream/consumers.d.ts","../../node_modules/@types/node/stream/web.d.ts","../../node_modules/@types/node/string_decoder.d.ts","../../node_modules/@types/node/test.d.ts","../../node_modules/@types/node/timers.d.ts","../../node_modules/@types/node/timers/promises.d.ts","../../node_modules/@types/node/tls.d.ts","../../node_modules/@types/node/trace_events.d.ts","../../node_modules/@types/node/tty.d.ts","../../node_modules/@types/node/url.d.ts","../../node_modules/@types/node/util.d.ts","../../node_modules/@types/node/v8.d.ts","../../node_modules/@types/node/vm.d.ts","../../node_modules/@types/node/wasi.d.ts","../../node_modules/@types/node/worker_threads.d.ts","../../node_modules/@types/node/zlib.d.ts","../../node_modules/@types/node/ts5.6/index.d.ts","../../node_modules/@types/estree/index.d.ts","../../node_modules/rollup/dist/rollup.d.ts","../../node_modules/rollup/dist/parseast.d.ts","../../node_modules/vite/types/hmrpayload.d.ts","../../node_modules/vite/types/customevent.d.ts","../../node_modules/vite/types/hot.d.ts","../../node_modules/vite/dist/node/modulerunnertransport.d-dj_me5sf.d.ts","../../node_modules/vite/dist/node/module-runner.d.ts","../../node_modules/esbuild/lib/main.d.ts","../../node_modules/source-map-js/source-map.d.ts","../../node_modules/postcss/lib/previous-map.d.ts","../../node_modules/postcss/lib/input.d.ts","../../node_modules/postcss/lib/css-syntax-error.d.ts","../../node_modules/postcss/lib/declaration.d.ts","../../node_modules/postcss/lib/root.d.ts","../../node_modules/postcss/lib/warning.d.ts","../../node_modules/postcss/lib/lazy-result.d.ts","../../node_modules/postcss/lib/no-work-result.d.ts","../../node_modules/postcss/lib/processor.d.ts","../../node_modules/postcss/lib/result.d.ts","../../node_modules/postcss/lib/document.d.ts","../../node_modules/postcss/lib/rule.d.ts","../../node_modules/postcss/lib/node.d.ts","../../node_modules/postcss/lib/comment.d.ts","../../node_modules/postcss/lib/container.d.ts","../../node_modules/postcss/lib/at-rule.d.ts","../../node_modules/postcss/lib/list.d.ts","../../node_modules/postcss/lib/postcss.d.ts","../../node_modules/postcss/lib/postcss.d.mts","../../node_modules/vite/types/internal/lightningcssoptions.d.ts","../../node_modules/vite/types/internal/csspreprocessoroptions.d.ts","../../node_modules/vite/types/importglob.d.ts","../../node_modules/vite/types/metadata.d.ts","../../node_modules/vite/dist/node/index.d.ts","../../node_modules/@vitest/mocker/dist/registry.d-d765pazg.d.ts","../../node_modules/@vitest/mocker/dist/types.d-d_arzrdy.d.ts","../../node_modules/@vitest/mocker/dist/index.d.ts","../../node_modules/@vitest/utils/dist/source-map.d.ts","../../node_modules/vite-node/dist/trace-mapping.d-dlvdeqop.d.ts","../../node_modules/vite-node/dist/index.d-dgmxd2u7.d.ts","../../node_modules/vite-node/dist/index.d.ts","../../node_modules/@vitest/snapshot/dist/environment.d-dhdq1csl.d.ts","../../node_modules/@vitest/snapshot/dist/rawsnapshot.d-lfsmjfud.d.ts","../../node_modules/@vitest/snapshot/dist/index.d.ts","../../node_modules/@vitest/snapshot/dist/environment.d.ts","../../node_modules/vitest/dist/chunks/config.d.d2roskhv.d.ts","../../node_modules/vitest/dist/chunks/worker.d.1gmbbd7g.d.ts","../../node_modules/@types/deep-eql/index.d.ts","../../node_modules/assertion-error/index.d.ts","../../node_modules/@types/chai/index.d.ts","../../node_modules/@vitest/runner/dist/utils.d.ts","../../node_modules/tinybench/dist/index.d.ts","../../node_modules/vitest/dist/chunks/benchmark.d.bwvbvtda.d.ts","../../node_modules/vite-node/dist/client.d.ts","../../node_modules/vitest/dist/chunks/coverage.d.s9rmnxie.d.ts","../../node_modules/@vitest/snapshot/dist/manager.d.ts","../../node_modules/vitest/dist/chunks/reporters.d.bflkqcl6.d.ts","../../node_modules/vitest/dist/chunks/worker.d.ckwwzbsj.d.ts","../../node_modules/@vitest/spy/dist/index.d.ts","../../node_modules/@vitest/expect/dist/index.d.ts","../../node_modules/vitest/dist/chunks/global.d.mamajcmj.d.ts","../../node_modules/vitest/dist/chunks/vite.d.cmlllifp.d.ts","../../node_modules/vitest/dist/chunks/mocker.d.be_2ls6u.d.ts","../../node_modules/vitest/dist/chunks/suite.d.fvehnv49.d.ts","../../node_modules/expect-type/dist/utils.d.ts","../../node_modules/expect-type/dist/overloads.d.ts","../../node_modules/expect-type/dist/branding.d.ts","../../node_modules/expect-type/dist/messages.d.ts","../../node_modules/expect-type/dist/index.d.ts","../../node_modules/vitest/dist/index.d.ts","../../node_modules/json-canonicalize/types/canonicalize.d.ts","../../node_modules/json-canonicalize/types/serializer.d.ts","../../node_modules/json-canonicalize/types/canonicalize-ex.d.ts","../../node_modules/json-canonicalize/types/index.d.ts","./src/canonicalize.ts","./src/canonicalize.test.ts","../../node_modules/ethers/lib.esm/_version.d.ts","../../node_modules/ethers/lib.esm/utils/base58.d.ts","../../node_modules/ethers/lib.esm/utils/data.d.ts","../../node_modules/ethers/lib.esm/utils/base64.d.ts","../../node_modules/ethers/lib.esm/address/address.d.ts","../../node_modules/ethers/lib.esm/address/contract-address.d.ts","../../node_modules/ethers/lib.esm/address/checks.d.ts","../../node_modules/ethers/lib.esm/address/index.d.ts","../../node_modules/ethers/lib.esm/crypto/hmac.d.ts","../../node_modules/ethers/lib.esm/crypto/keccak.d.ts","../../node_modules/ethers/lib.esm/crypto/ripemd160.d.ts","../../node_modules/ethers/lib.esm/crypto/pbkdf2.d.ts","../../node_modules/ethers/lib.esm/crypto/random.d.ts","../../node_modules/ethers/lib.esm/crypto/scrypt.d.ts","../../node_modules/ethers/lib.esm/crypto/sha2.d.ts","../../node_modules/ethers/lib.esm/crypto/signature.d.ts","../../node_modules/ethers/lib.esm/crypto/signing-key.d.ts","../../node_modules/ethers/lib.esm/crypto/index.d.ts","../../node_modules/ethers/lib.esm/utils/maths.d.ts","../../node_modules/ethers/lib.esm/transaction/accesslist.d.ts","../../node_modules/ethers/lib.esm/transaction/authorization.d.ts","../../node_modules/ethers/lib.esm/transaction/address.d.ts","../../node_modules/ethers/lib.esm/transaction/transaction.d.ts","../../node_modules/ethers/lib.esm/transaction/index.d.ts","../../node_modules/ethers/lib.esm/providers/contracts.d.ts","../../node_modules/ethers/lib.esm/utils/fetch.d.ts","../../node_modules/ethers/lib.esm/providers/plugins-network.d.ts","../../node_modules/ethers/lib.esm/providers/network.d.ts","../../node_modules/ethers/lib.esm/providers/formatting.d.ts","../../node_modules/ethers/lib.esm/providers/provider.d.ts","../../node_modules/ethers/lib.esm/providers/ens-resolver.d.ts","../../node_modules/ethers/lib.esm/providers/abstract-provider.d.ts","../../node_modules/ethers/lib.esm/hash/authorization.d.ts","../../node_modules/ethers/lib.esm/hash/id.d.ts","../../node_modules/ethers/lib.esm/hash/namehash.d.ts","../../node_modules/ethers/lib.esm/hash/message.d.ts","../../node_modules/ethers/lib.esm/hash/solidity.d.ts","../../node_modules/ethers/lib.esm/hash/typed-data.d.ts","../../node_modules/ethers/lib.esm/hash/index.d.ts","../../node_modules/ethers/lib.esm/providers/signer.d.ts","../../node_modules/ethers/lib.esm/providers/abstract-signer.d.ts","../../node_modules/ethers/lib.esm/providers/community.d.ts","../../node_modules/ethers/lib.esm/providers/provider-jsonrpc.d.ts","../../node_modules/ethers/lib.esm/providers/provider-socket.d.ts","../../node_modules/ethers/lib.esm/providers/provider-websocket.d.ts","../../node_modules/ethers/lib.esm/providers/default-provider.d.ts","../../node_modules/ethers/lib.esm/providers/signer-noncemanager.d.ts","../../node_modules/ethers/lib.esm/providers/provider-fallback.d.ts","../../node_modules/ethers/lib.esm/providers/provider-browser.d.ts","../../node_modules/ethers/lib.esm/providers/provider-alchemy.d.ts","../../node_modules/ethers/lib.esm/providers/provider-blockscout.d.ts","../../node_modules/ethers/lib.esm/providers/provider-ankr.d.ts","../../node_modules/ethers/lib.esm/providers/provider-cloudflare.d.ts","../../node_modules/ethers/lib.esm/providers/provider-chainstack.d.ts","../../node_modules/ethers/lib.esm/contract/types.d.ts","../../node_modules/ethers/lib.esm/contract/wrappers.d.ts","../../node_modules/ethers/lib.esm/contract/contract.d.ts","../../node_modules/ethers/lib.esm/contract/factory.d.ts","../../node_modules/ethers/lib.esm/contract/index.d.ts","../../node_modules/ethers/lib.esm/providers/provider-etherscan.d.ts","../../node_modules/ethers/lib.esm/providers/provider-infura.d.ts","../../node_modules/ethers/lib.esm/providers/provider-pocket.d.ts","../../node_modules/ethers/lib.esm/providers/provider-quicknode.d.ts","../../node_modules/ethers/lib.esm/providers/provider-ipcsocket.d.ts","../../node_modules/ethers/lib.esm/providers/index.d.ts","../../node_modules/ethers/lib.esm/utils/errors.d.ts","../../node_modules/ethers/lib.esm/utils/events.d.ts","../../node_modules/ethers/lib.esm/utils/fixednumber.d.ts","../../node_modules/ethers/lib.esm/utils/properties.d.ts","../../node_modules/ethers/lib.esm/utils/rlp-decode.d.ts","../../node_modules/ethers/lib.esm/utils/rlp.d.ts","../../node_modules/ethers/lib.esm/utils/rlp-encode.d.ts","../../node_modules/ethers/lib.esm/utils/units.d.ts","../../node_modules/ethers/lib.esm/utils/utf8.d.ts","../../node_modules/ethers/lib.esm/utils/uuid.d.ts","../../node_modules/ethers/lib.esm/utils/index.d.ts","../../node_modules/ethers/lib.esm/abi/coders/abstract-coder.d.ts","../../node_modules/ethers/lib.esm/abi/fragments.d.ts","../../node_modules/ethers/lib.esm/abi/abi-coder.d.ts","../../node_modules/ethers/lib.esm/abi/bytes32.d.ts","../../node_modules/ethers/lib.esm/abi/typed.d.ts","../../node_modules/ethers/lib.esm/abi/interface.d.ts","../../node_modules/ethers/lib.esm/abi/index.d.ts","../../node_modules/ethers/lib.esm/constants/addresses.d.ts","../../node_modules/ethers/lib.esm/constants/hashes.d.ts","../../node_modules/ethers/lib.esm/constants/numbers.d.ts","../../node_modules/ethers/lib.esm/constants/strings.d.ts","../../node_modules/ethers/lib.esm/constants/index.d.ts","../../node_modules/ethers/lib.esm/wallet/base-wallet.d.ts","../../node_modules/ethers/lib.esm/wordlists/wordlist.d.ts","../../node_modules/ethers/lib.esm/wordlists/wordlist-owl.d.ts","../../node_modules/ethers/lib.esm/wordlists/lang-en.d.ts","../../node_modules/ethers/lib.esm/wordlists/wordlist-owla.d.ts","../../node_modules/ethers/lib.esm/wordlists/wordlists.d.ts","../../node_modules/ethers/lib.esm/wordlists/index.d.ts","../../node_modules/ethers/lib.esm/wallet/mnemonic.d.ts","../../node_modules/ethers/lib.esm/wallet/hdwallet.d.ts","../../node_modules/ethers/lib.esm/wallet/json-crowdsale.d.ts","../../node_modules/ethers/lib.esm/wallet/json-keystore.d.ts","../../node_modules/ethers/lib.esm/wallet/wallet.d.ts","../../node_modules/ethers/lib.esm/wallet/index.d.ts","../../node_modules/ethers/lib.esm/ethers.d.ts","../../node_modules/ethers/lib.esm/index.d.ts","./src/hashing.ts","./src/hashing.test.ts","../../node_modules/jose/dist/types/types.d.ts","../../node_modules/jose/dist/types/jwe/compact/decrypt.d.ts","../../node_modules/jose/dist/types/jwe/flattened/decrypt.d.ts","../../node_modules/jose/dist/types/jwe/general/decrypt.d.ts","../../node_modules/jose/dist/types/jwe/general/encrypt.d.ts","../../node_modules/jose/dist/types/jws/compact/verify.d.ts","../../node_modules/jose/dist/types/jws/flattened/verify.d.ts","../../node_modules/jose/dist/types/jws/general/verify.d.ts","../../node_modules/jose/dist/types/jwt/verify.d.ts","../../node_modules/jose/dist/types/jwt/decrypt.d.ts","../../node_modules/jose/dist/types/jwt/produce.d.ts","../../node_modules/jose/dist/types/jwe/compact/encrypt.d.ts","../../node_modules/jose/dist/types/jwe/flattened/encrypt.d.ts","../../node_modules/jose/dist/types/jws/compact/sign.d.ts","../../node_modules/jose/dist/types/jws/flattened/sign.d.ts","../../node_modules/jose/dist/types/jws/general/sign.d.ts","../../node_modules/jose/dist/types/jwt/sign.d.ts","../../node_modules/jose/dist/types/jwt/encrypt.d.ts","../../node_modules/jose/dist/types/jwk/thumbprint.d.ts","../../node_modules/jose/dist/types/jwk/embedded.d.ts","../../node_modules/jose/dist/types/jwks/local.d.ts","../../node_modules/jose/dist/types/jwks/remote.d.ts","../../node_modules/jose/dist/types/jwt/unsecured.d.ts","../../node_modules/jose/dist/types/key/export.d.ts","../../node_modules/jose/dist/types/key/import.d.ts","../../node_modules/jose/dist/types/util/decode_protected_header.d.ts","../../node_modules/jose/dist/types/util/decode_jwt.d.ts","../../node_modules/jose/dist/types/util/errors.d.ts","../../node_modules/jose/dist/types/key/generate_key_pair.d.ts","../../node_modules/jose/dist/types/key/generate_secret.d.ts","../../node_modules/jose/dist/types/util/base64url.d.ts","../../node_modules/jose/dist/types/util/runtime.d.ts","../../node_modules/jose/dist/types/index.d.ts","./src/risk/types.ts","./src/zkp/types.ts","./src/types.ts","./src/registry.ts","./src/verifiers.ts","./src/verification.ts","./src/mocks.ts","./src/synthetic.ts","./src/headless.test.ts","./src/receipt.ts","./src/receiptsigner.ts","./src/risk/forensics.ts","./src/risk/layout.ts","./src/risk/patterns.ts","./src/risk/index.ts","./src/zkp/index.ts","./src/anchor/portable.ts","./src/anchor/provenance.ts","./src/attom/types.ts","./src/attom/normalize.ts","./src/attom/crosscheck.ts","./src/index.ts","./src/receiptsigner.test.ts","./src/registry.test.ts","./src/verification.test.ts","./src/anchor/provenance.test.ts","./src/attom/crosscheck.test.ts","./src/risk/risk.test.ts","./src/zkp/zkp.test.ts","../../node_modules/@types/aria-query/index.d.ts","../../node_modules/@babel/types/lib/index.d.ts","../../node_modules/@types/babel__generator/index.d.ts","../../node_modules/@babel/parser/typings/babel-parser.d.ts","../../node_modules/@types/babel__template/index.d.ts","../../node_modules/@types/babel__traverse/index.d.ts","../../node_modules/@types/babel__core/index.d.ts","../../node_modules/@types/json5/index.d.ts","../../node_modules/@types/ms/index.d.ts","../../node_modules/@types/jsonwebtoken/index.d.ts","../../node_modules/@types/mocha/index.d.ts","../../node_modules/@types/pdf-parse/index.d.ts","../../node_modules/@types/pdfkit/index.d.ts","../../node_modules/@types/prop-types/index.d.ts","../../node_modules/@types/react/global.d.ts","../../node_modules/csstype/index.d.ts","../../node_modules/@types/react/index.d.ts","../../node_modules/@types/react-dom/index.d.ts"],"fileInfos":[{"version":"44e584d4f6444f58791784f1d530875970993129442a847597db702a073ca68c","affectsGlobalScope":true},"45b7ab580deca34ae9729e97c13cfd999df04416a79116c3bfb483804f85ded4","3facaf05f0c5fc569c5649dd359892c98a85557e3e0c847964caeb67076f4d75","9a68c0c07ae2fa71b44384a839b7b8d81662a236d4b9ac30916718f7510b1b2d","5e1c4c362065a6b95ff952c0eab010f04dcd2c3494e813b493ecfd4fcb9fc0d8","68d73b4a11549f9c0b7d352d10e91e5dca8faa3322bfb77b661839c42b1ddec7","5efce4fc3c29ea84e8928f97adec086e3dc876365e0982cc8479a07954a3efd4","feecb1be483ed332fad555aff858affd90a48ab19ba7272ee084704eb7167569","5514e54f17d6d74ecefedc73c504eadffdeda79c7ea205cf9febead32d45c4bc",{"version":"4af6b0c727b7a2896463d512fafd23634229adf69ac7c00e2ae15a09cb084fad","affectsGlobalScope":true},{"version":"6920e1448680767498a0b77c6a00a8e77d14d62c3da8967b171f1ddffa3c18e4","affectsGlobalScope":true},{"version":"dc2df20b1bcdc8c2d34af4926e2c3ab15ffe1160a63e58b7e09833f616efff44","affectsGlobalScope":true},{"version":"4443e68b35f3332f753eacc66a04ac1d2053b8b035a0e0ac1d455392b5e243b3","affectsGlobalScope":true},{"version":"bc47685641087c015972a3f072480889f0d6c65515f12bd85222f49a98952ed7","affectsGlobalScope":true},{"version":"0dc1e7ceda9b8b9b455c3a2d67b0412feab00bd2f66656cd8850e8831b08b537","affectsGlobalScope":true},{"version":"ce691fb9e5c64efb9547083e4a34091bcbe5bdb41027e310ebba8f7d96a98671","affectsGlobalScope":true},{"version":"8d697a2a929a5fcb38b7a65594020fcef05ec1630804a33748829c5ff53640d0","affectsGlobalScope":true},{"version":"4ff2a353abf8a80ee399af572debb8faab2d33ad38c4b4474cff7f26e7653b8d","affectsGlobalScope":true},{"version":"93495ff27b8746f55d19fcbcdbaccc99fd95f19d057aed1bd2c0cafe1335fbf0","affectsGlobalScope":true},{"version":"6fc23bb8c3965964be8c597310a2878b53a0306edb71d4b5a4dfe760186bcc01","affectsGlobalScope":true},{"version":"ea011c76963fb15ef1cdd7ce6a6808b46322c527de2077b6cfdf23ae6f5f9ec7","affectsGlobalScope":true},{"version":"38f0219c9e23c915ef9790ab1d680440d95419ad264816fa15009a8851e79119","affectsGlobalScope":true},{"version":"bb42a7797d996412ecdc5b2787720de477103a0b2e53058569069a0e2bae6c7e","affectsGlobalScope":true},{"version":"4738f2420687fd85629c9efb470793bb753709c2379e5f85bc1815d875ceadcd","affectsGlobalScope":true},{"version":"2f11ff796926e0832f9ae148008138ad583bd181899ab7dd768a2666700b1893","affectsGlobalScope":true},{"version":"4de680d5bb41c17f7f68e0419412ca23c98d5749dcaaea1896172f06435891fc","affectsGlobalScope":true},{"version":"9fc46429fbe091ac5ad2608c657201eb68b6f1b8341bd6d670047d32ed0a88fa","affectsGlobalScope":true},{"version":"61c37c1de663cf4171e1192466e52c7a382afa58da01b1dc75058f032ddf0839","affectsGlobalScope":true},{"version":"b541a838a13f9234aba650a825393ffc2292dc0fc87681a5d81ef0c96d281e7a","affectsGlobalScope":true},{"version":"9e9fbd7030c440b33d021da145d3232984c8bb7916f277e8ffd3dc2e3eae2bdb","affectsGlobalScope":true},{"version":"811ec78f7fefcabbda4bfa93b3eb67d9ae166ef95f9bff989d964061cbf81a0c","affectsGlobalScope":true},{"version":"717937616a17072082152a2ef351cb51f98802fb4b2fdabd32399843875974ca","affectsGlobalScope":true},{"version":"d7e7d9b7b50e5f22c915b525acc5a49a7a6584cf8f62d0569e557c5cfc4b2ac2","affectsGlobalScope":true},{"version":"71c37f4c9543f31dfced6c7840e068c5a5aacb7b89111a4364b1d5276b852557","affectsGlobalScope":true},{"version":"576711e016cf4f1804676043e6a0a5414252560eb57de9faceee34d79798c850","affectsGlobalScope":true},{"version":"89c1b1281ba7b8a96efc676b11b264de7a8374c5ea1e6617f11880a13fc56dc6","affectsGlobalScope":true},{"version":"74f7fa2d027d5b33eb0471c8e82a6c87216223181ec31247c357a3e8e2fddc5b","affectsGlobalScope":true},{"version":"ae37d6ccd1560b0203ab88d46987393adaaa78c919e51acf32fb82c86502e98c","affectsGlobalScope":true},{"version":"063600664504610fe3e99b717a1223f8b1900087fab0b4cad1496a114744f8df","affectsGlobalScope":true},{"version":"934019d7e3c81950f9a8426d093458b65d5aff2c7c1511233c0fd5b941e608ab","affectsGlobalScope":true},{"version":"bf14a426dbbf1022d11bd08d6b8e709a2e9d246f0c6c1032f3b2edb9a902adbe","affectsGlobalScope":true},{"version":"5e07ed3809d48205d5b985642a59f2eba47c402374a7cf8006b686f79efadcbd","affectsGlobalScope":true},{"version":"2b72d528b2e2fe3c57889ca7baef5e13a56c957b946906d03767c642f386bbc3","affectsGlobalScope":true},{"version":"479553e3779be7d4f68e9f40cdb82d038e5ef7592010100410723ceced22a0f7","affectsGlobalScope":true},{"version":"368af93f74c9c932edd84c58883e736c9e3d53cec1fe24c0b0ff451f529ceab1","affectsGlobalScope":true},{"version":"af3dd424cf267428f30ccfc376f47a2c0114546b55c44d8c0f1d57d841e28d74","affectsGlobalScope":true},{"version":"995c005ab91a498455ea8dfb63aa9f83fa2ea793c3d8aa344be4a1678d06d399","affectsGlobalScope":true},{"version":"d3d7b04b45033f57351c8434f60b6be1ea71a2dfec2d0a0c3c83badbb0e3e693","affectsGlobalScope":true},{"version":"956d27abdea9652e8368ce029bb1e0b9174e9678a273529f426df4b3d90abd60","affectsGlobalScope":true},{"version":"4fa6ed14e98aa80b91f61b9805c653ee82af3502dc21c9da5268d3857772ca05","affectsGlobalScope":true},{"version":"e6633e05da3ff36e6da2ec170d0d03ccf33de50ca4dc6f5aeecb572cedd162fb","affectsGlobalScope":true},{"version":"d8670852241d4c6e03f2b89d67497a4bbefe29ecaa5a444e2c11a9b05e6fccc6","affectsGlobalScope":true},{"version":"8444af78980e3b20b49324f4a16ba35024fef3ee069a0eb67616ea6ca821c47a","affectsGlobalScope":true},{"version":"caccc56c72713969e1cfe5c3d44e5bab151544d9d2b373d7dbe5a1e4166652be","affectsGlobalScope":true},{"version":"3287d9d085fbd618c3971944b65b4be57859f5415f495b33a6adc994edd2f004","affectsGlobalScope":true},{"version":"b4b67b1a91182421f5df999988c690f14d813b9850b40acd06ed44691f6727ad","affectsGlobalScope":true},{"version":"33358442698bb565130f52ba79bfd3d4d484ac85fe33f3cb1759c54d18201393","affectsGlobalScope":true},{"version":"782dec38049b92d4e85c1585fbea5474a219c6984a35b004963b00beb1aab538","affectsGlobalScope":true},"5c54a34e3d91727f7ae840bfe4d5d1c9a2f93c54cb7b6063d06ee4a6c3322656","db4da53b03596668cf6cc9484834e5de3833b9e7e64620cf08399fe069cd398d","ac7c28f153820c10850457994db1462d8c8e462f253b828ad942a979f726f2f9","f9b028d3c3891dd817e24d53102132b8f696269309605e6ed4f0db2c113bbd82","fb7c8d90e52e2884509166f96f3d591020c7b7977ab473b746954b0c8d100960","0bff51d6ed0c9093f6955b9d8258ce152ddb273359d50a897d8baabcb34de2c4","45cec9a1ba6549060552eead8959d47226048e0b71c7d0702ae58b7e16a28912","ef13c73d6157a32933c612d476c1524dd674cf5b9a88571d7d6a0d147544d529","13918e2b81c4288695f9b1f3dcc2468caf0f848d5c1f3dc00071c619d34ff63a","6907b09850f86610e7a528348c15484c1e1c09a18a9c1e98861399dfe4b18b46","12deea8eaa7a4fc1a2908e67da99831e5c5a6b46ad4f4f948fd4759314ea2b80","f0a8b376568a18f9a4976ecb0855187672b16b96c4df1c183a7e52dc1b5d98e8","8124828a11be7db984fcdab052fd4ff756b18edcfa8d71118b55388176210923","092944a8c05f9b96579161e88c6f211d5304a76bd2c47f8d4c30053269146bc8",{"version":"70521b6ab0dcba37539e5303104f29b721bfb2940b2776da4cc818c07e1fefc1","affectsGlobalScope":true},{"version":"ab41ef1f2cdafb8df48be20cd969d875602483859dc194e9c97c8a576892c052","affectsGlobalScope":true},{"version":"d153a11543fd884b596587ccd97aebbeed950b26933ee000f94009f1ab142848","affectsGlobalScope":true},"21d819c173c0cf7cc3ce57c3276e77fd9a8a01d35a06ad87158781515c9a438a",{"version":"1456e80bd8a3870034d89f91bd7df12ac29acfb083e31c0bb1fb38ca7bf5fbc2","affectsGlobalScope":true},{"version":"a98aedd64ad81793f146d36d1611ed9ba61b8b49ff040f0d13a103ed626595d9","affectsGlobalScope":true},{"version":"6d9ef24f9a22a88e3e9b3b3d8c40ab1ddb0853f1bfbd5c843c37800138437b61","affectsGlobalScope":true},{"version":"1db0b7dca579049ca4193d034d835f6bfe73096c73663e5ef9a0b5779939f3d0","affectsGlobalScope":true},{"version":"9798340ffb0d067d69b1ae5b32faa17ab31b82466a3fc00d8f2f2df0c8554aaa","affectsGlobalScope":true},{"version":"f26b11d8d8e4b8028f1c7d618b22274c892e4b0ef5b3678a8ccbad85419aef43","affectsGlobalScope":true},"8e9c23ba78aabc2e0a27033f18737a6df754067731e69dc5f52823957d60a4b6","5929864ce17fba74232584d90cb721a89b7ad277220627cc97054ba15a98ea8f","763fe0f42b3d79b440a9b6e51e9ba3f3f91352469c1e4b3b67bfa4ff6352f3f4","25c8056edf4314820382a5fdb4bb7816999acdcb929c8f75e3f39473b87e85bc","c464d66b20788266e5353b48dc4aa6bc0dc4a707276df1e7152ab0c9ae21fad8","78d0d27c130d35c60b5e5566c9f1e5be77caf39804636bc1a40133919a949f21","c6fd2c5a395f2432786c9cb8deb870b9b0e8ff7e22c029954fabdd692bff6195","1d6e127068ea8e104a912e42fc0a110e2aa5a66a356a917a163e8cf9a65e4a75","5ded6427296cdf3b9542de4471d2aa8d3983671d4cac0f4bf9c637208d1ced43","7f182617db458e98fc18dfb272d40aa2fff3a353c44a89b2c0ccb3937709bfb5","cadc8aced301244057c4e7e73fbcae534b0f5b12a37b150d80e5a45aa4bebcbd","385aab901643aa54e1c36f5ef3107913b10d1b5bb8cbcd933d4263b80a0d7f20","9670d44354bab9d9982eca21945686b5c24a3f893db73c0dae0fd74217a4c219","0b8a9268adaf4da35e7fa830c8981cfa22adbbe5b3f6f5ab91f6658899e657a7","11396ed8a44c02ab9798b7dca436009f866e8dae3c9c25e8c1fbc396880bf1bb","ba7bc87d01492633cb5a0e5da8a4a42a1c86270e7b3d2dea5d156828a84e4882","4893a895ea92c85345017a04ed427cbd6a1710453338df26881a6019432febdd","c21dc52e277bcfc75fac0436ccb75c204f9e1b3fa5e12729670910639f27343e","13f6f39e12b1518c6650bbb220c8985999020fe0f21d818e28f512b7771d00f9","9b5369969f6e7175740bf51223112ff209f94ba43ecd3bb09eefff9fd675624a","4fe9e626e7164748e8769bbf74b538e09607f07ed17c2f20af8d680ee49fc1da","24515859bc0b836719105bb6cc3d68255042a9f02a6022b3187948b204946bd2","ea0148f897b45a76544ae179784c95af1bd6721b8610af9ffa467a518a086a43","24c6a117721e606c9984335f71711877293a9651e44f59f3d21c1ea0856f9cc9","dd3273ead9fbde62a72949c97dbec2247ea08e0c6952e701a483d74ef92d6a17","405822be75ad3e4d162e07439bac80c6bcc6dbae1929e179cf467ec0b9ee4e2e","0db18c6e78ea846316c012478888f33c11ffadab9efd1cc8bcc12daded7a60b6","e61be3f894b41b7baa1fbd6a66893f2579bfad01d208b4ff61daef21493ef0a8","bd0532fd6556073727d28da0edfd1736417a3f9f394877b6d5ef6ad88fba1d1a","89167d696a849fce5ca508032aabfe901c0868f833a8625d5a9c6e861ef935d2","615ba88d0128ed16bf83ef8ccbb6aff05c3ee2db1cc0f89ab50a4939bfc1943f","a4d551dbf8746780194d550c88f26cf937caf8d56f102969a110cfaed4b06656","8bd86b8e8f6a6aa6c49b71e14c4ffe1211a0e97c80f08d2c8cc98838006e4b88","317e63deeb21ac07f3992f5b50cdca8338f10acd4fbb7257ebf56735bf52ab00","4732aec92b20fb28c5fe9ad99521fb59974289ed1e45aecb282616202184064f","2e85db9e6fd73cfa3d7f28e0ab6b55417ea18931423bd47b409a96e4a169e8e6","c46e079fe54c76f95c67fb89081b3e399da2c7d109e7dca8e4b58d83e332e605","bf67d53d168abc1298888693338cb82854bdb2e69ef83f8a0092093c2d562107",{"version":"2cbe0621042e2a68c7cbce5dfed3906a1862a16a7d496010636cdbdb91341c0f","affectsGlobalScope":true},"e2677634fe27e87348825bb041651e22d50a613e2fdf6a4a3ade971d71bac37e","7394959e5a741b185456e1ef5d64599c36c60a323207450991e7a42e08911419","8c0bcd6c6b67b4b503c11e91a1fb91522ed585900eab2ab1f61bba7d7caa9d6f",{"version":"8cd19276b6590b3ebbeeb030ac271871b9ed0afc3074ac88a94ed2449174b776","affectsGlobalScope":true},"696eb8d28f5949b87d894b26dc97318ef944c794a9a4e4f62360cd1d1958014b","3f8fa3061bd7402970b399300880d55257953ee6d3cd408722cb9ac20126460c",{"version":"35ec8b6760fd7138bbf5809b84551e31028fb2ba7b6dc91d95d098bf212ca8b4","affectsGlobalScope":true},"5524481e56c48ff486f42926778c0a3cce1cc85dc46683b92b1271865bcf015a",{"version":"68bd56c92c2bd7d2339457eb84d63e7de3bd56a69b25f3576e1568d21a162398","affectsGlobalScope":true},"3e93b123f7c2944969d291b35fed2af79a6e9e27fdd5faa99748a51c07c02d28","9d19808c8c291a9010a6c788e8532a2da70f811adb431c97520803e0ec649991","87aad3dd9752067dc875cfaa466fc44246451c0c560b820796bdd528e29bef40","4aacb0dd020eeaef65426153686cc639a78ec2885dc72ad220be1d25f1a439df","f0bd7e6d931657b59605c44112eaf8b980ba7f957a5051ed21cb93d978cf2f45",{"version":"8db0ae9cb14d9955b14c214f34dae1b9ef2baee2fe4ce794a4cd3ac2531e3255","affectsGlobalScope":true},"15fc6f7512c86810273af28f224251a5a879e4261b4d4c7e532abfbfc3983134","58adba1a8ab2d10b54dc1dced4e41f4e7c9772cbbac40939c0dc8ce2cdb1d442","2fd4c143eff88dabb57701e6a40e02a4dbc36d5eb1362e7964d32028056a782b","714435130b9015fae551788df2a88038471a5a11eb471f27c4ede86552842bc9","855cd5f7eb396f5f1ab1bc0f8580339bff77b68a770f84c6b254e319bbfd1ac7","5650cf3dace09e7c25d384e3e6b818b938f68f4e8de96f52d9c5a1b3db068e86",{"version":"1354ca5c38bd3fd3836a68e0f7c9f91f172582ba30ab15bb8c075891b91502b7","affectsGlobalScope":true},"27fdb0da0daf3b337c5530c5f266efe046a6ceb606e395b346974e4360c36419","2d2fcaab481b31a5882065c7951255703ddbe1c0e507af56ea42d79ac3911201","a192fe8ec33f75edbc8d8f3ed79f768dfae11ff5735e7fe52bfa69956e46d78d",{"version":"ca867399f7db82df981d6915bcbb2d81131d7d1ef683bc782b59f71dda59bc85","affectsGlobalScope":true},{"version":"d9e971bba9cf977c7774abbd4d2e3413a231af8a06a2e8b16af2a606bc91ddd0","affectsGlobalScope":true},"9e043a1bc8fbf2a255bccf9bf27e0f1caf916c3b0518ea34aa72357c0afd42ec","b4f70ec656a11d570e1a9edce07d118cd58d9760239e2ece99306ee9dfe61d02","3bc2f1e2c95c04048212c569ed38e338873f6a8593930cf5a7ef24ffb38fc3b6","6e70e9570e98aae2b825b533aa6292b6abd542e8d9f6e9475e88e1d7ba17c866","f9d9d753d430ed050dc1bf2667a1bab711ccbb1c1507183d794cc195a5b085cc","9eece5e586312581ccd106d4853e861aaaa1a39f8e3ea672b8c3847eedd12f6e","47ab634529c5955b6ad793474ae188fce3e6163e3a3fb5edd7e0e48f14435333","37ba7b45141a45ce6e80e66f2a96c8a5ab1bcef0fc2d0f56bb58df96ec67e972","45650f47bfb376c8a8ed39d4bcda5902ab899a3150029684ee4c10676d9fbaee",{"version":"0225ecb9ed86bdb7a2c7fd01f1556906902929377b44483dc4b83e03b3ef227d","affectsGlobalScope":true},"74cf591a0f63db318651e0e04cb55f8791385f86e987a67fd4d2eaab8191f730","5eab9b3dc9b34f185417342436ec3f106898da5f4801992d8ff38ab3aff346b5",{"version":"12ed4559eba17cd977aa0db658d25c4047067444b51acfdcbf38470630642b23","affectsGlobalScope":true},"f3ffabc95802521e1e4bcba4c88d8615176dc6e09111d920c7a213bdda6e1d65","f9ab232778f2842ffd6955f88b1049982fa2ecb764d129ee4893cbc290f41977","ae56f65caf3be91108707bd8dfbccc2a57a91feb5daabf7165a06a945545ed26","a136d5de521da20f31631a0a96bf712370779d1c05b7015d7019a9b2a0446ca9",{"version":"c3b41e74b9a84b88b1dca61ec39eee25c0dbc8e7d519ba11bb070918cfacf656","affectsGlobalScope":true},{"version":"4737a9dc24d0e68b734e6cfbcea0c15a2cfafeb493485e27905f7856988c6b29","affectsGlobalScope":true},"36d8d3e7506b631c9582c251a2c0b8a28855af3f76719b12b534c6edf952748d","1ca69210cc42729e7ca97d3a9ad48f2e9cb0042bada4075b588ae5387debd318","f5ebe66baaf7c552cfa59d75f2bfba679f329204847db3cec385acda245e574e",{"version":"ed59add13139f84da271cafd32e2171876b0a0af2f798d0c663e8eeb867732cf","affectsGlobalScope":true},"05db535df8bdc30d9116fe754a3473d1b6479afbc14ae8eb18b605c62677d518","0ea329e5eab6719ff83bcb97e8bd03f1faab4feb74704010783b881fc9d80f92","151ff381ef9ff8da2da9b9663ebf657eac35c4c9a19183420c05728f31a6761d",{"version":"ee70b8037ecdf0de6c04f35277f253663a536d7e38f1539d270e4e916d225a3f","affectsGlobalScope":true},"a660aa95476042d3fdcc1343cf6bb8fdf24772d31712b1db321c5a4dcc325434","a7ca8df4f2931bef2aa4118078584d84a0b16539598eaadf7dce9104dfaa381c","11443a1dcfaaa404c68d53368b5b818712b95dd19f188cab1669c39bee8b84b3","36977c14a7f7bfc8c0426ae4343875689949fb699f3f84ecbe5b300ebf9a2c55","035d0934d304483f07148427a5bd5b98ac265dae914a6b49749fe23fbd893ec7","e2ed5b81cbed3a511b21a18ab2539e79ac1f4bc1d1d28f8d35d8104caa3b429f",{"version":"161c8e0690c46021506e32fda85956d785b70f309ae97011fd27374c065cac9b","affectsGlobalScope":true},"402e5c534fb2b85fa771170595db3ac0dd532112c8fa44fc23f233bc6967488b","8885cf05f3e2abf117590bbb951dcf6359e3e5ac462af1c901cfd24c6a6472e2","333caa2bfff7f06017f114de738050dd99a765c7eb16571c6d25a38c0d5365dc","e61df3640a38d535fd4bc9f4a53aef17c296b58dc4b6394fd576b808dd2fe5e6","459920181700cec8cbdf2a5faca127f3f17fd8dd9d9e577ed3f5f3af5d12a2e4","4719c209b9c00b579553859407a7e5dcfaa1c472994bd62aa5dd3cc0757eb077","7ec359bbc29b69d4063fe7dad0baaf35f1856f914db16b3f4f6e3e1bca4099fa","70790a7f0040993ca66ab8a07a059a0f8256e7bb57d968ae945f696cbff4ac7a","d1b9a81e99a0050ca7f2d98d7eedc6cda768f0eb9fa90b602e7107433e64c04c","a022503e75d6953d0e82c2c564508a5c7f8556fad5d7f971372d2d40479e4034","b215c4f0096f108020f666ffcc1f072c81e9f2f95464e894a5d5f34c5ea2a8b1","644491cde678bd462bb922c1d0cfab8f17d626b195ccb7f008612dc31f445d2d","dfe54dab1fa4961a6bcfba68c4ca955f8b5bbeb5f2ab3c915aa7adaa2eabc03a","1251d53755b03cde02466064260bb88fd83c30006a46395b7d9167340bc59b73","47865c5e695a382a916b1eedda1b6523145426e48a2eae4647e96b3b5e52024f","4cdf27e29feae6c7826cdd5c91751cc35559125e8304f9e7aed8faef97dcf572","331b8f71bfae1df25d564f5ea9ee65a0d847c4a94baa45925b6f38c55c7039bf","2a771d907aebf9391ac1f50e4ad37952943515eeea0dcc7e78aa08f508294668","0146fd6262c3fd3da51cb0254bb6b9a4e42931eb2f56329edd4c199cb9aaf804","183f480885db5caa5a8acb833c2be04f98056bdcc5fb29e969ff86e07efe57ab","4ec16d7a4e366c06a4573d299e15fe6207fc080f41beac5da06f4af33ea9761e",{"version":"7870becb94cbc11d2d01b77c4422589adcba4d8e59f726246d40cd0d129784d8","affectsGlobalScope":true},"7f698624bbbb060ece7c0e51b7236520ebada74b747d7523c7df376453ed6fea","f70b8328a15ca1d10b1436b691e134a49bc30dcf3183a69bfaa7ba77e1b78ecd","683b035f752e318d02e303894e767a1ac16ac4493baa2b593195d7976e6b7310","b34b5f6b506abb206b1ea73c6a332b9ee9c8c98be0f6d17cdbda9430ecc1efab","75d4c746c3d16af0df61e7b0afe9606475a23335d9f34fcc525d388c21e9058b","fa959bf357232201c32566f45d97e70538c75a093c940af594865d12f31d4912","d2c52abd76259fc39a30dfae70a2e5ce77fd23144457a7ff1b64b03de6e3aec7","e6233e1c976265e85aa8ad76c3881febe6264cb06ae3136f0257e1eab4a6cc5a","f73e2335e568014e279927321770da6fe26facd4ac96cdc22a56687f1ecbb58e","317878f156f976d487e21fd1d58ad0461ee0a09185d5b0a43eedf2a56eb7e4ea","324ac98294dab54fbd580c7d0e707d94506d7b2c3d5efe981a8495f02cf9ad96","9ec72eb493ff209b470467e24264116b6a8616484bca438091433a545dfba17e","d6ee22aba183d5fc0c7b8617f77ee82ecadc2c14359cc51271c135e23f6ed51f","49747416f08b3ba50500a215e7a55d75268b84e31e896a40313c8053e8dec908","81e634f1c5e1ca309e7e3dc69e2732eea932ef07b8b34517d452e5a3e9a36fa3","34f39f75f2b5aa9c84a9f8157abbf8322e6831430e402badeaf58dd284f9b9a6","427fe2004642504828c1476d0af4270e6ad4db6de78c0b5da3e4c5ca95052a99","2eeffcee5c1661ddca53353929558037b8cf305ffb86a803512982f99bcab50d",{"version":"9afb4cb864d297e4092a79ee2871b5d3143ea14153f62ef0bb04ede25f432030","affectsGlobalScope":true},"891694d3694abd66f0b8872997b85fd8e52bc51632ce0f8128c96962b443189f","69bf2422313487956e4dacf049f30cb91b34968912058d244cb19e4baa24da97","971a2c327ff166c770c5fb35699575ba2d13bba1f6d2757309c9be4b30036c8e","4f45e8effab83434a78d17123b01124259fbd1e335732135c213955d85222234","7bd51996fb7717941cbe094b05adc0d80b9503b350a77b789bbb0fc786f28053","b62006bbc815fe8190c7aee262aad6bff993e3f9ade70d7057dfceab6de79d2f","13497c0d73306e27f70634c424cd2f3b472187164f36140b504b3756b0ff476d","bf7a2d0f6d9e72d59044079d61000c38da50328ccdff28c47528a1a139c610ec","04471dc55f802c29791cc75edda8c4dd2a121f71c2401059da61eff83099e8ab",{"version":"120a80aa556732f684db3ed61aeff1d6671e1655bd6cba0aa88b22b88ac9a6b1","affectsGlobalScope":true},{"version":"e58c0b5226aff07b63be6ac6e1bec9d55bc3d2bda3b11b9b68cccea8c24ae839","affectsGlobalScope":true},"a23a08b626aa4d4a1924957bd8c4d38a7ffc032e21407bbd2c97413e1d8c3dbd","5a88655bf852c8cc007d6bc874ab61d1d63fba97063020458177173c454e9b4a","7e4dfae2da12ec71ffd9f55f4641a6e05610ce0d6784838659490e259e4eb13c","c30a41267fc04c6518b17e55dcb2b810f267af4314b0b6d7df1c33a76ce1b330","72422d0bac4076912385d0c10911b82e4694fc106e2d70added091f88f0824ba","da251b82c25bee1d93f9fd80c5a61d945da4f708ca21285541d7aff83ecb8200","64db14db2bf37ac089766fdb3c7e1160fabc10e9929bc2deeede7237e4419fc8","98b94085c9f78eba36d3d2314affe973e8994f99864b8708122750788825c771","13573a613314e40482386fe9c7934f9d86f3e06f19b840466c75391fb833b99b","f494a096f4e9b3c1b93dd6a852c68d6def531c537c1103273e954b51bdcda04a","30560eac555d009c4678a1c7fa1762b234dbe74b09ee69bfaa04c7f0869cfe79","705ac27abcc360c236033c486bfee3d79bd80197b0990722594a5a418a3eafaa","7a42f6c911fcdb3727bee2f82b214b4233aa93ab78bcc432e85eec16b8e7f4c9",{"version":"bce6291d0d8b8b060e33d1ef7032cc42f05ed47f0b7422630a2738f8f5579603","signature":"4410765ab1ccaf0c5197e953e8ead82c6ecf695f228fbec966a3b99f225e06cc"},{"version":"23db59200c3527367ae6277d0b64030e274bf2a074fe2093e1c76c9e44c1c8fe","signature":"8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881"},"cbd8f7cbc0832353a1db0c80ffe50f4d623bcf992faac71b4aef9e0aa6f4f33e","643b5be3fb728581cdb973f3937606d4925a5270d367a38366e4ddc6b30ba688","f7b9aaeace9a3837c47fad74de94ba117751951904a6cb6f6a2340ca3a5052d2","b59a8f409202638d6530f1e9746035717925f196f8350ef188535d6b6f07ac30","10752162e9a90e7f4e6f92d096706911e209f5e6026bb0fe788b9979bf0c807b","91010341cfcb3809686aefe12ceaa794087fcd0c7d4d72fc81d567535c51f7b9","a5fa720bdcd335d6f01999c7f4c93fb00447782db3c2fad005cc775b1b37b684","c8657b2bf39dbb8bbe8223ca66b76e33c83a649c7655fd7042b50b50cf805c96","18282a2d197d5d3b187d6cfe784b0bfeb36dc3caed79d24705c284506c6a7937","bc7f372120474ef5e195f4c5627aa9136af9dfc52c3e81f5404641f3eb921b20","c897edb7e0074c2cb1a118ad1f144d4095a76e13023c1c9d31499a97f0943c6d","5123f400963c1ae260ba78bd27826dd5ada91cc3df088a913fb709906c2f0fed","f6c69d4211c1c0dc144101b7d564eec8992315a5b652108ab44e617fdfb64a9f","3a0b914cd5a33a695925999bc0e20988f625ff92224224a60356531cc248324b","3b9ef4448417e777778007a2abbfb171fbb400c4012560331330c89a8fd08599","6c086fa316e7f3b80649021bc62262bb4b71c09cc2bbfeb0c72dfeba406f3bc9","80ae4448e40828f253d49dd0cba14ddaa948c4988d54d6bbd558015c4727f1f7","36ccd9bc1c33bf3cce297133d37acfc376d89ea0aff3111cf1792498ae5732d4","ef3212ac0f4934627604a36a63ebdbf235e844065ba3217f368515531b9b452e","a5bb15e8903456dedd2a0c6c7f29b520b75a02fc44b36248fbac98e8b3106f2e","7087a77f8804d330429778346f2adf8418a4641b159f621938604aa20386887a","6d2e4114ccd05fb0cd657cfb73419eeb7e1464446aabfe4e652d4ad460c1fd1a","ce4b1dd7655ecc6b75393994ab906df4350790e30d675870446e59d9fb19c21a","8478f046870fe3053785d1fdb8fc3d4972437fbb230771841eb3945edda1cdce","8827ca3cd0a35d4a2da2b460620586a68dc0681b19f08559bc382f453ae0a915","5c56eea87bcede67b8df6a08185aaa023080fe74f21e7d262e5e0c5885ea6747","2a6140dea5f4014fbf2c301bcefcac865d9b5354ccc09865b309ec25b170eb24","62fbeac38ecc6d7b5ffe8b9c10c60a519963c8bc5a06d7260446a45fe920c01f","5cb04775c9a257123584dc85441b5cb816af5e201074571d629f5861c4ebea0f","91bb13afae2c0de8d11c6a8027f4113067a6907c40378ed38e92b9fef2b2b20c","6cdb8c1473687522f8ef65e1620bb8d703a02f4c570c662bd99ebf442ec9c3ff","799e4c2b1aae2c8531a20544168c528c7994f13bbce20f4813e30cde1ca72cb9","804a7dbd4c64f201d927b23b8563affa0325ec4bd3eeab339933cc85fcbbe4c1","c0a7ac0e0b21d67124311e0a70138df950cfa22360ae582c5d7b95a9a31f3436","c39a02bcdde4e5cf742febb47995c209f651249aa3f339d8981b47eb157dbc7f","3b63f1706adba31dd86669c3745ce127e1d80b83b1376942a5ae3653089b526f","d93c86ac706e8a3eb5c4fd2c3965d793c192438b44b21f94a422029d037113cd","c775b9469b2cbb895386691568a08c5f07e011d79531c79cb65f89355d324339","f8b830bc7cf2ebcadb5381cb0965e9e2e5e1006a96d5569729fc8eae99f1e02b","6465f2a53c52cb1cf228a7eeab54e3380b8971fed677deb08fa082e72854e24c","123c6c775f283b756565682d4aa48e2e72cf4a69249cb296e95b01d7c64c68cf","74965fc49475caca96b090c472f2c3e2085e3be05ce34639e9aabeccd5fb71aa","9640153ef1838657c1de17d486d9755fb714407156ec0be12acd132db4732c7f","b21157929842b9593200c73299fffde810be1b6c2554437e319db0025ecd53ae","cb929086d0d062bb948a1726e87c604db6387d885a846838a4da40e006c51deb","cb2e0b454aed00d0109fa243d681650916750a960736755edb673d4c2fc495dc","2a5c6f30ace32a85b24dec0f03525ed0a40190104be5876bd9107f92cca0166b","4d752856defdcbb39e2915429f85a92aac94406eb1bdef2855b908dde5bc013b","515caaccdd09e635befbfd45f023015a42d375e0536c9786412cf4dab847ff65","6cde23545d1e8d78b222c594e0a66de065311e0c6b0e3989feffb5c7f6b66560","a025111523c3c2c24484c1af1bfcab340490817de7e4b247b700ca7ee203a5cc","39c8ca333a9f4c497aeb72f36857fbca17bd4eb8348a822e4052e76212efb7fc","156d4829532c7d26f824ab7bb26b1eced1bfaf5711d426e95357004c43f40d98","2d9a0ac7d80da8b003ac92445f47891c3acdca1517fb0a0ca3006e2d71e1d2ab","5c62b984997b2e15f2d2ae0f0202121738db19901dc2bad5fe6a7a2d6af871d3","8c04e9d03324f465d5fb381371c06799cd06234f2aa83bdf4318cb9728132b80","cd7a3946f3f2f8c734971b4b7c8c57e02ea88ef98c06c44b8be8c93fe046e8a9","a14590df3ef464f8a9dff9514df70c7aeff05c999f447e761ec13b8158a6cab0","98cbb6e3aa1b6610e7234ff6afa723b9cb52caf19ecb67cf1d96b04aa72b8f88","4bd91244643feda6c0f2fb50f58ee3c2e6af29dd473dc5fb70bb1cbd2eade134","f9575d2a80566ba8d17d2260526ffb81907386aa7cb21508888fb2e967911dca","d388e40b946609b83a5df1a1d12a0ea77168ee2407f28eac6958d6638a3fbf69","83e8adc1946281f15747109c98bd6af5ce3853f3693263419707510b704b70e5","64fb32566d6ac361bdff2fafb937b67ee96b0f4b0ea835c2164620ec2ad8ea09","678b6be72cdcec74f602d366fef05ba709aa60816d4abf2a4faff64a68cdfc1f","b0b8ac2d71ea2251f4f513c7d644db07a46446a6e4bccbcc23ccbefbe9ac3ac4","c7cae4f5befd90da675906c456cc35244edad7cdcedb51fb8f94d576f2b52e5e","a00e19c6ad43bfc4daf759038e309b797b59cc532d68f4556083022ed1d4b134","c4e720b6dd8053526bedd57807a9914e45bb2ffbda801145a086b93cf1cda6d5","1dc465a4431aaa00bb80452b26aa7e7ec33aca666e4256c271bdf04f18fef54d","ea5916d20a81cc0fd49bd783fce0837b690f2d39e456d979bc4b912cb89ceefc","dccc0a4cbe7cbabcf629ef783d3226ed28649f1215eb577a2e2cdb1129347a37","add54a06a7a910f6ed0195282144d58f24e375b7d16bd4a5c5b9d91bb4b5e184","dc03aa8332b32c2d7cd0f4f72b4a8cc61bbc2806eb18fa841ec3de56b8e806a6","dd56e1c623e5b14260b6d817f4f26d6cc63c77f5bf55321306d118617fc20c7d","d4cb93b91ab77070c8baebdcc5c951954ee219900795cc7e34aaef6be0081a2b","93ff68f1f2b1be14e488d472820e2cbc3c1744e4b55aea9a12288f612e8cf56f","7e4d2c8b02fc2529a60bd495322092644b5cf2f391b10bea4bcae8efea227c32","219b5d42961185874397f62f12d64e74e0825d260054984e0248010de538015e","27b5570022c0f24a093c0718de58a4f2d2b4124df0f7ff9b9786874c84c8af27","ad37fb454bd70dd332bb8b5047fbc0cf00ddfc48972d969a8530ab44998b7e70","265bdbd67761e88d8be1d91a21ec53bb8915e769a71bdc3f0e1e48fdda0a4c6e","817e174de32fb2f0d55d835c184c1248877c639885fcaed66bab759ff8be1b59","ea76d1231ea876a2a352eae09d90ae6ef20126052e0adfdc691437d624ebcc47","0961671995b68a718e081179cfa23c89410b97031880cf0fea203f702193385a","b6592f9a1102da83ba752d678e5e94af9443bf1ab70666f2f756ba1a85b8adfc","d1c933acc6c2847d38c7a29c3d154ef5a6b51e2ad728f682e47717524683e563","44380b6f061bbb7d7b81b3d9973c9a18b176e456eee4316a56c9e2932df77bfd","e558775330d82e3a2e16a2442c1332572f3cb269a545de3952ed226473e4ccdd","32d5ec19fbe22a610e11aa721d9947c1249e59a5b8e68f864d954f68795982d1","e1fa85a34e9710a03fb4e68a8b318b50cde979325a874a311c0429be2e9a6380","998c9ae7ae683f16a68d9204b8dea071377d886ed649f7da777dce408ede67b7","e02fe9a276b87b4c10c56cbcee81f8c6437d21a0a68eeb705e23105c3620677e","d56bc539844eceaaae11714c214add744ace0227da77c91e62d8c3cd0ee78964","9199f6ead2ae205b4a0efe8b427706b7b9856f2fb51587ca25e9161cfee2b163","120a62730ef5b8b61b4a82005c421506d0bf4f5a2fbe84b88149c79c894900da","3ca2a4b5f57c480c798f8310b3d3c10dc24fa73d5618889a27835eb80f783fa3","faf92d569360b567c70c11b08aadd997fb2ca1847687f370eaea8eda19f807f2","38e878406954753d87c2b0db8b5146da5abb86c44139526cba2046cc70fbd1d4","c500d215a2e0490d77f0f926507adac154bfc5cfcb855ffdbe2c600e67fbf36f","6a22003e006988f31654d8bf884208ff753d64bcb980a89e4c5eb933bf446d09","3a8493e70ee5fc14e8e9a028e5e3b1df79acbd4bc4ded50725d2ad4927a9c101","7f02dfc714a76c78325cdfbc138b57531103490dc9d88affdb3f4a54fdd879a0",{"version":"e950b8f29687653d0065e99b37e2d72d39e6336bb15e6275ca1d35d5c44974ad","signature":"57d11d9b86270e81ef50598552fba05a828338280cbe7393ba0002ec693443ee"},{"version":"1305285533d821eca222a7de9639ddbf610ffa9aff2263e5e6a35dad74969a99","signature":"8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881"},"7bb53546e9bd6e3f22804497a41d4b885674e7b15b7d64c7d3f83722dfd2b456","4083e6d84bfe72b0835b600185c7b7ce321da3d6053f866859185eefc161e7a0","b883e245dc30c73b655ffe175712cac82981fc999d6284685f0ed7c1dac8aa6f","626e3504b81883fa94578c2a97eff345fadc5eae17a57c39f585655eef5b8272","e9a15eeba29ceb0ee109dd5e0282d2877d8165d87251f2ea9741a82685a25c61","c6cb06cc021d9149301f3c51762a387f9d7571feed74273b157d934c56857fac","cd7c133395a1c72e7c9e546f62292f839819f50a8aa46050f8588b63ef56df88","196f5f74208ce4accea017450ed2abc9ce4ab13c29a9ea543db4c2d715a19183","4687c961ab2e3107379f139d22932253afb7dd52e75a18890e70d4a376cdf5d9","ae8cfe2e3bdef3705fc294d07869a0ab8a52d9b623d1cc0482b6fc2be262b015","94c8e9c00244bbf1c868ca526b12b4db1fab144e3f5e18af3591b5b471854157","827d576995f67a6205c0f048ae32f6a1cf7bda9a7a76917ab286ef11d7987fd7","cb5dc83310a61d2bb351ddcdcaa6ec1cf60cc965d26ce6f156a28b4062e96ab2","0091cb2456a823e123fe76faa8b94dea81db421770d9a9c9ade1b111abe0fcd1","034d811fd7fb2262ad35b21df0ecab14fdd513e25dbf563572068e3f083957d9","298bcc906dd21d62b56731f9233795cd11d88e062329f5df7cdb4e499207cdd4","f7e64be58c24f2f0b7116bed8f8c17e6543ddcdc1f46861d5c54217b4a47d731","966394e0405e675ca1282edbfa5140df86cb6dc025e0f957985f059fe4b9d5d6","b0587deb3f251b7ad289240c54b7c41161bb6488807d1f713e0a14c540cbcaee","4254aab77d0092cab52b34c2e0ab235f24f82a5e557f11d5409ae02213386e29","19db45929fad543b26b12504ee4e3ff7d9a8bddc1fc3ed39723c2259e3a4590f","b21934bebe4cd01c02953ab8d17be4d33d69057afdb5469be3956e84a09a8d99","b2b734c414d440c92a17fd409fa8dac89f425031a6fc7843bac765c6c174d1ca","239f39e8ad95065f5188a7acd8dbefbbbf94d9e00c460ffdc331e24bc1f63a54","d44f78893cb79e00e16a028e3023a65c1f2968352378e8e323f8c8f88b8da495","32afc9daae92391cb4efeb0d2dac779dc0fb17c69be0eb171fd5ed7f7908eeb4","b835c6e093ad9cda87d376c248735f7e4081f64d304b7c54a688f1276875cbf0","a9eabe1d0b20e967a18758a77884fbd61b897d72a57ddd9bf7ea6ef1a3f4514b","64c5059e7d7a80fe99d7dad639f3ba765f8d5b42c5b265275d7cd68f8426be75","05dc1970dc02c54db14d23ff7a30af00efbd7735313aa8af45c4fd4f5c3d3a33","a0caf07fe750954ad4cf079c5cf036be2191a758c2700424085ffde6af60d185","1ea59d0d71022de8ea1c98a3f88d452ad5701c7f85e74ddaa0b3b9a34ed0e81c","eab89b3aa37e9e48b2679f4abe685d56ac371daa8fbe68526c6b0c914eb28474",{"version":"55a1ce846b49bb081d5ae2d534ad4c11da92ee9ef143648ae898f20463779ee6","signature":"6844b6bbd468c2d381d121057b1af6154724f24fba1e131da45ccf0ef503eb87"},{"version":"23742d0d73a762c548a83ddad5f46b173e87aee670cf28932b01672b215c47b2","signature":"8c9ec7d5b2aae5dd2ff9b50b0af138982b1473b1c852c157eaa1e16774abcd18"},{"version":"e20fde5169422ed444d8538b9832c79854d25aa4edbbb314b9f8f097b9d10396","signature":"b07c6d91032d53eafc562906e5ce97a4354ba1bcc5a395da2ad5533259e54665"},{"version":"47b45b090f8c2a6b1bb1bb0e838cdab7206d89bdbf5c9472dfb055589a39007a","signature":"9cd0fd3e469fcf87317940f1c422f3fb4ef887e083873c665facf52a2d7eb26d"},{"version":"3c6f3e7d02301bde29822f570f31d456bb96086f4716cbe99b83d21b257e1140","signature":"6b8bac2fa56bc4dda47db82b764fda5f282b213ddb1c8f518628b07d724321a6"},{"version":"d0cfc3c5428ae6cd64b4e8ad8098fb7e4cbb423b0c55ff0c88961f4c99b83ba4","signature":"ba3d00fa06f7b7e3fd75fd78e0515473e681ae1cc0413a8f09be786b8df87eef"},{"version":"331613b28aba32b71dba103850db4e69e1b2f4d1a86eb7d7f523b08d13c5b1fb","signature":"13e69f0647407ffab96c796d0ed855be7774dfd5417fa835fdc00b2f8546ca89"},{"version":"b4485f74e7bd23eb97015523f86ad8409244ea69f0c7b36a2a2c8f47309e59c2","signature":"6321dc5c363ab82d13c16893e8f9512ee70f48665ebc27fc7c05b915fb37c9dd"},{"version":"df5c583df82b394f242f4764662756c3ba7de0eb385b85951fcf6d01f553dcaf","signature":"8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881"},{"version":"05a3284fccf07348713b9048cd8cdaa7fbf0956bb47fce90868c6dbfab229780","signature":"bca0ac4786ab80179e7a24ff54151f7db7d525cdd18b11d96d849b1467f22590"},{"version":"56afdd3f17b1b6438ab0db1d6ad137b24e072b24ad17091ee12263100b954f91","signature":"33573e91aa311d26daddb7f9c897ed20c7f41166d8c024b739db6c56471d2b4b"},{"version":"396f5ed51074899b2d54b99c3d288e8d8b38d4607ef62d4be2930eb9c510f790","signature":"c43ccb93a2083ed202db9f103a8a1a86094f59f1359d94ad0567bf1143a627cb"},{"version":"35e4d8699c4718c12fdb6539b7a0fa3cb291cb488ef2153fe80c3ab861840d56","signature":"ee3ec8c1e006d2cf3f89599d3156dfae90834dcf4521364aac58a581d8c6fb30"},{"version":"4fd3c5af716a11e90c562987dbc074daa3303d40920faf6cb4bc96b0fc61102e","signature":"a87433d1ab7576dba0fa3b5125c43df3231cd2ca295bcd87d6fbfb0ed1ef0bb3"},{"version":"0a7d5a1ce7c811e4c1cdb1efc58785ecdb380831f59c4fff4909c927bf6dac9e","signature":"fb8b456c11acf1536fed7e23632ee9958a49397941d77c560b50c7efaf6642fe"},{"version":"d5d662b803f489945d253ef590b0bc5f2ceedaa28994e0da718b5ada42afaa00","signature":"89615e090bf6efd0d5d82650f8fd3d481a07acab10a67bbfabb5c5a8de683a4a"},{"version":"c6e319ca80b2ff5538be337e792b81c8da173c9a2eee540ac6d068e78cf1c0d3","signature":"936b0bbc2c3d926c925c96f83e2e8d3319ac3323a090d6f353da83c0d84e18cd"},{"version":"e86eb2f5203682a9157c44b0f8c7a4614e48ccdbfc868afc015064a99f0400b4","signature":"ed8a8855cf5b3e52a7f2b60811206b8ec96eb70e536efd2abe2b52cd5d0762bc"},{"version":"872152953de2bd9772bcf4090fd44dc7823ebc4df3cd061c5e38873f1427724c","signature":"4747398580c3ac97fe5736cb089081d348869c384e930148f0f9a62571a2aa8b"},{"version":"ef1c7f9ce11a452029935d19f69f82b41141902d94a1ada3f93dd907519be1c1","signature":"86e7770c1c98dd3cadd7e74e036d0a1b5c115601c17a5eaa6ce682e9a28529c7"},{"version":"a483bcc6b83d53b4915ccd0a8a2640fe0cc29ec5fbbbe23966a8421ba6f8c14d","signature":"c6c2365d7f4aa1e854215d50a052f24c994251be95657825ef53b6fc6ed3cea8"},"413eb8ce5f776537ab4d2557388f94128a4f907b45cb991cffe83723451f816d",{"version":"6f561595e6763c36529297ee21fa928c56864fe2b747f5af5720719b11cb52da","signature":"8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881"},{"version":"1135efd5ddf0f5607b14a8a6654332b85470afe8d04fa6ca38cd9360a0feca49","signature":"8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881"},{"version":"671c21df703b99e4d2cbe1f7f0f8891fb4a5423761b77411e91904ba2e04e17b","signature":"8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881"},{"version":"c16da7de580cc1b380c6fdc8c7bf62b7bfd3a57dbbb1e62b3078896ac1d29624","signature":"8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881"},{"version":"c42314f3d7db70ce3bc5e1d473bbe6993d88173827316479cd132c5be2b560b2","signature":"8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881"},{"version":"ebf6e80a5711a94b406dd733e7e32a99618c82524c42106f1631b61161a98dec","signature":"8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881"},{"version":"8410c6aaaf7bda9d7148dc119dc8c011c5ff6a583ebe4a36a6f6b4ce7d98533f","signature":"8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881"},"ae77d81a5541a8abb938a0efedf9ac4bea36fb3a24cc28cfa11c598863aba571","556ccd493ec36c7d7cb130d51be66e147b91cc1415be383d71da0f1e49f742a9","b6d03c9cfe2cf0ba4c673c209fcd7c46c815b2619fd2aad59fc4229aaef2ed43","95aba78013d782537cc5e23868e736bec5d377b918990e28ed56110e3ae8b958","670a76db379b27c8ff42f1ba927828a22862e2ab0b0908e38b671f0e912cc5ed","13b77ab19ef7aadd86a1e54f2f08ea23a6d74e102909e3c00d31f231ed040f62","069bebfee29864e3955378107e243508b163e77ab10de6a5ee03ae06939f0bb9","96d14f21b7652903852eef49379d04dbda28c16ed36468f8c9fa08f7c14c9538","fb893a0dfc3c9fb0f9ca93d0648694dd95f33cbad2c0f2c629f842981dfd4e2e","95da3c365e3d45709ad6e0b4daa5cdaf05e9076ba3c201e8f8081dd282c02f57",{"version":"29f72ec1289ae3aeda78bf14b38086d3d803262ac13904b400422941a26a3636","affectsGlobalScope":true},"9df0f2ba281c306c80873282ff8993bd76198e86d478bb5ad36c80ee2b66674b",{"version":"cb10a0a912da58ffb11ea16a0138f3f799628559b9f391a8caefee162b7249f6","affectsGlobalScope":true},"87d9d29dbc745f182683f63187bf3d53fd8673e5fca38ad5eaab69798ed29fbc",{"version":"eb5b19b86227ace1d29ea4cf81387279d04bb34051e944bc53df69f58914b788","affectsGlobalScope":true},"ac51dd7d31333793807a6abaa5ae168512b6131bd41d9c5b98477fc3b7800f9f",{"version":"7a3aa194cfd5919c4da251ef04ea051077e22702638d4edcb9579e9101653519","affectsGlobalScope":true},"17ed71200119e86ccef2d96b73b02ce8854b76ad6bd21b5021d4269bec527b5f"],"root":[248,249,353,354,[388,416]],"options":{"composite":true,"declaration":true,"esModuleInterop":true,"module":7,"outDir":"./dist","rootDir":"./src","skipLibCheck":true,"strict":true,"target":9},"fileIdsList":[[78,125,418],[78,125],[78,125,418,419,420,421,422],[78,125,418,420],[78,125,221,222],[78,125,130,173,425],[78,122,125],[78,124,125],[78,125,130,158],[78,125,126,131,136,144,155,166],[78,125,126,127,136,144],[73,74,75,78,125],[78,125,128,167],[78,125,129,130,137,145],[78,125,130,155,163],[78,125,131,133,136,144],[78,124,125,132],[78,125,133,134],[78,125,135,136],[78,124,125,136],[78,125,136,137,138,155,166],[78,125,136,137,138,151,155,158],[78,125,133,136,139,144,155,166],[78,125,136,137,139,140,144,155,163,166],[78,125,139,141,155,163,166],[78,125,136,142],[78,125,143,166,171],[78,125,133,136,144,155],[78,125,145],[78,125,146],[78,124,125,147],[78,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172],[78,125,149],[78,125,150],[78,125,136,151,152],[78,125,151,153,167,169],[78,125,136,155,156,158],[78,125,157,158],[78,125,155,156],[78,125,158],[78,125,159],[78,122,125,155,160],[78,125,136,161,162],[78,125,161,162],[78,125,130,144,155,163],[78,125,164],[125],[76,77,78,79,80,81,82,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172],[78,125,144,165],[78,125,139,150,166],[78,125,130,167],[78,125,155,168],[78,125,143,169],[78,125,170],[78,120,125],[78,120,125,136,138,147,155,158,166,169,171],[78,125,155,172],[78,125,173],[78,125,433],[78,125,430,431,432],[63,64,67,78,125,232],[78,125,208,209],[64,65,67,68,69,78,125],[64,78,125],[64,65,67,78,125],[64,65,78,125],[78,125,215],[59,78,125,215,216],[59,78,125,215],[59,66,78,125],[60,78,125],[59,60,61,63,78,125],[59,78,125],[78,125,325,326,327],[78,125,325],[78,125,327,328,329,330,331],[78,125,325,326,327,328,330],[78,125,257,325,326],[78,125,257],[78,125,254,255,256],[78,125,333,334,335,336],[78,125,257,279,304,305,314,325,332],[78,125,257,304,305,306,314,325,332],[78,125,304,305,306,307],[78,125,305,314,332],[78,125,279,304,306,314,325,332],[78,125,258,259,260,261,262,263,264,265,266],[78,125,265,267,325],[78,125,250,257,267,273,288,308,314,325,332,337,344,350],[78,125,257,267,325],[78,125,282,283,284,285,286,287],[78,125,267],[78,125,267,325],[78,125,351],[78,125,257,277,278,279,280,325],[78,125,273,279,288,289],[78,125,279],[78,125,277,281,294],[78,125,279,281,325],[78,125,267,273],[78,125,274,276,277,278,279,280,281,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,309,310,311,312,313],[78,125,273,276,325],[78,125,275,279],[78,125,277,281,291,292,325],[78,125,277,292],[78,125,276,277,279,281,308],[78,125,277,281],[78,125,277,281,291,292,294,325],[78,125,144,173,277,292,293],[78,125,273,277,279,281,288,289,290,325],[78,125,277,279,281,292],[78,125,277,292,293],[78,125,257,267,273,274,277,278,325],[78,125,279,288,289,290],[78,125,257,273,274,279,288],[78,125,273],[78,125,267,268,269,270,271,272],[78,125,267,273,325],[78,125,252],[78,125,275,314],[78,125,251,252,253,268,275,315,316,317,318,319,320,321,322,323,324],[78,125,320],[78,125,319,321],[78,125,267,273,288,314],[78,125,267,314,325,338,344,345],[78,125,338,345,346,347,348,349],[78,125,325,344],[78,125,267,314,338,346],[78,125,339,340,341,342,343],[78,125,340],[78,125,339],[78,125,238,239],[78,125,238,239,240,241],[78,125,238,240],[78,125,238],[78,125,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386],[78,125,355],[78,125,355,365],[78,125,245],[78,125,244,246],[78,125,198],[78,125,196,198],[78,125,187,195,196,197,199,201],[78,125,185],[78,125,188,193,198,201],[78,125,184,201],[78,125,188,189,192,193,194,201],[78,125,188,189,190,192,193,201],[78,125,185,186,187,188,189,193,194,195,197,198,199,201],[78,125,201],[78,125,183,185,186,187,188,189,190,192,193,194,195,196,197,198,199,200],[78,125,183,201],[78,125,188,190,191,193,194,201],[78,125,192,201],[78,125,193,194,198,201],[78,125,186,196],[78,125,175,206,207],[78,125,174,175],[62,78,125],[78,92,96,125,166],[78,92,125,155,166],[78,87,125],[78,89,92,125,163,166],[78,125,144,163],[78,87,125,173],[78,89,92,125,144,166],[78,84,85,88,91,125,136,155,166],[78,92,99,125],[78,84,90,125],[78,92,113,114,125],[78,88,92,125,158,166,173],[78,113,125,173],[78,86,87,125,173],[78,92,125],[78,86,87,88,89,90,91,92,93,94,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,114,115,116,117,118,119,125],[78,92,107,125],[78,92,99,100,125],[78,90,92,100,101,125],[78,91,125],[78,84,87,92,125],[78,92,96,100,101,125],[78,96,125],[78,90,92,95,125,166],[78,84,89,92,99,125],[78,125,155],[78,87,92,113,125,171,173],[78,125,212,213],[78,125,212],[78,125,136,137,139,140,141,144,155,163,166,172,173,175,176,177,178,180,181,182,202,203,204,205,206,207],[78,125,177,178,179,180],[78,125,177],[78,125,178],[78,125,175,207],[70,78,125,224,225,234],[59,67,70,78,125,217,218,234],[78,125,227],[71,78,125],[59,70,72,78,125,217,226,233,234],[78,125,210],[59,64,67,70,72,78,125,128,137,155,207,210,211,214,217,219,220,223,226,228,229,234,235],[70,78,125,224,225,226,234],[78,125,207,230,235],[70,72,78,125,214,217,219,234],[78,125,171,220],[59,64,67,70,71,72,78,125,128,137,155,171,207,210,211,214,217,218,219,220,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,242],[78,125,243,405],[78,125,248,352,389],[78,125,243,406,408],[78,125,406,407],[78,125,130,406],[78,125,243,248],[78,125,247],[78,125,243,248,353],[78,125,352],[78,125,243,390,393,394,395],[78,125,248,353,390,391,392,393,394,395,397,398,402,403,404,405,406,407,408],[78,125,390],[78,125,130,248,353,390],[78,125,243,391,393,395,397,398],[78,125,248,387,390],[78,125,243,390,391],[78,125,388],[78,125,388,399,400,401],[78,125,243,402],[78,125,130,352,390],[78,125,388,389],[78,125,243,393,394,395],[78,125,352,390,391,392],[78,125,126,130,352,389],[78,125,126,137,145,146,243,403]],"referencedMap":[[420,1],[418,2],[417,2],[423,3],[419,1],[421,4],[422,1],[223,5],[221,2],[174,2],[424,2],[426,6],[427,2],[425,2],[122,7],[123,7],[124,8],[125,9],[126,10],[127,11],[73,2],[76,12],[74,2],[75,2],[128,13],[129,14],[130,15],[131,16],[132,17],[133,18],[134,18],[135,19],[136,20],[137,21],[138,22],[79,2],[139,23],[140,24],[141,25],[142,26],[143,27],[144,28],[145,29],[146,30],[147,31],[148,32],[149,33],[150,34],[151,35],[152,35],[153,36],[154,2],[155,37],[157,38],[156,39],[158,40],[159,41],[160,42],[161,43],[162,44],[163,45],[164,46],[78,47],[77,2],[173,48],[165,49],[166,50],[167,51],[168,52],[169,53],[170,54],[80,2],[81,2],[82,2],[121,55],[171,56],[172,57],[428,58],[429,58],[430,2],[434,59],[431,2],[433,60],[233,61],[210,62],[208,2],[209,2],[59,2],[70,63],[65,64],[68,65],[224,66],[215,2],[218,67],[217,68],[229,68],[216,69],[232,2],[67,70],[69,70],[61,71],[64,72],[211,71],[66,73],[60,2],[222,2],[83,2],[432,2],[182,2],[250,2],[328,74],[329,75],[326,75],[327,2],[332,76],[331,77],[330,78],[254,2],[256,79],[255,75],[257,80],[333,2],[334,2],[337,81],[335,2],[336,2],[306,82],[307,83],[308,84],[304,85],[305,86],[258,75],[267,87],[259,75],[261,75],[262,2],[260,75],[263,75],[264,75],[265,75],[266,88],[351,89],[282,90],[283,2],[288,91],[285,92],[284,2],[286,2],[287,93],[352,94],[281,95],[290,96],[291,2],[274,97],[295,98],[280,99],[278,100],[314,101],[277,102],[276,103],[299,104],[301,104],[300,104],[298,105],[303,104],[302,105],[309,106],[297,107],[310,108],[313,109],[292,110],[311,104],[312,104],[293,111],[294,112],[279,113],[296,114],[289,115],[269,116],[271,93],[270,116],[273,117],[272,118],[251,75],[253,119],[252,2],[315,120],[316,2],[275,2],[317,75],[325,121],[268,119],[318,2],[319,75],[321,122],[320,123],[322,75],[323,75],[324,75],[338,124],[346,125],[350,126],[347,2],[348,93],[345,127],[349,128],[344,129],[341,130],[340,131],[342,130],[339,2],[343,131],[240,132],[242,133],[241,134],[239,135],[238,2],[387,136],[356,137],[366,137],[357,137],[367,137],[358,137],[359,137],[374,137],[373,137],[375,137],[376,137],[368,137],[360,137],[369,137],[361,137],[370,137],[362,137],[364,137],[372,138],[365,137],[371,138],[377,138],[363,137],[378,137],[383,137],[384,137],[379,137],[355,2],[385,2],[381,137],[380,137],[382,137],[386,137],[246,139],[244,2],[247,140],[245,2],[199,141],[197,142],[198,143],[186,144],[187,142],[194,145],[185,146],[190,147],[200,2],[191,148],[196,149],[202,150],[201,151],[184,152],[192,153],[193,154],[188,155],[195,141],[189,156],[176,157],[175,158],[183,2],[225,2],[62,2],[63,159],[57,2],[58,2],[10,2],[12,2],[11,2],[2,2],[13,2],[14,2],[15,2],[16,2],[17,2],[18,2],[19,2],[20,2],[3,2],[21,2],[4,2],[22,2],[26,2],[23,2],[24,2],[25,2],[27,2],[28,2],[29,2],[5,2],[30,2],[31,2],[32,2],[33,2],[6,2],[37,2],[34,2],[35,2],[36,2],[38,2],[7,2],[39,2],[44,2],[45,2],[40,2],[41,2],[42,2],[43,2],[8,2],[49,2],[46,2],[47,2],[48,2],[50,2],[9,2],[51,2],[52,2],[53,2],[56,2],[54,2],[55,2],[1,2],[99,160],[109,161],[98,160],[119,162],[90,163],[89,164],[118,58],[112,165],[117,166],[92,167],[106,168],[91,169],[115,170],[87,171],[86,58],[116,172],[88,173],[93,174],[94,2],[97,174],[84,2],[120,175],[110,176],[101,177],[102,178],[104,179],[100,180],[103,181],[113,58],[95,182],[96,183],[105,184],[85,185],[108,176],[107,174],[111,2],[114,186],[227,187],[213,188],[214,187],[212,2],[207,189],[181,190],[180,191],[178,191],[177,2],[179,192],[205,2],[204,2],[203,2],[206,193],[226,194],[219,195],[228,196],[72,197],[234,198],[236,199],[230,200],[237,201],[235,202],[220,203],[231,204],[243,205],[71,2],[404,2],[413,206],[405,207],[414,208],[408,209],[407,210],[406,2],[249,211],[248,212],[354,213],[353,214],[396,215],[409,216],[394,217],[397,218],[410,219],[398,220],[411,221],[391,220],[399,222],[402,223],[400,222],[401,222],[415,224],[388,2],[395,225],[390,226],[412,227],[393,228],[392,217],[403,229],[389,2],[416,230]],"latestChangedDtsFile":"./dist/zkp/zkp.test.d.ts"},"version":"5.5.4"}
\ No newline at end of file
diff --git a/src/api/verify.js b/src/api/verify.js
index 4cfd3d6..8a46438 100644
--- a/src/api/verify.js
+++ b/src/api/verify.js
@@ -315,7 +315,7 @@ function startServer({ port }) {
 <html>
 <head>
 <meta charset="utf-8" />
-<title>Deed Shield Demo</title>
+<title>TrustSignal Demo</title>
 <style>
 body{font-family:system-ui, -apple-system, Segoe UI, Roboto, sans-serif; max-width:820px; margin:24px auto; padding:0 12px}
 .row{margin:12px 0}
@@ -329,7 +329,7 @@ button{padding:8px 12px}
 </style>
 </head>
 <body>
-<h1>Deed Shield Demo</h1>
+<h1>TrustSignal Demo</h1>
 
 <section class="row">
   <h2>1) Generate Receipt</h2>
diff --git a/trustsignal_tests.sh b/trustsignal_tests.sh
new file mode 100755
index 0000000..50bc2ba
--- /dev/null
+++ b/trustsignal_tests.sh
@@ -0,0 +1,192 @@
+#!/bin/bash
+# =============================================================
+# TrustSignal — API Test Suite
+# Tests: hash, ingest, policy check, verify, tamper detection
+# Base URL: update API_URL to match your environment
+# =============================================================
+
+API_URL="https://api.trustsignal.dev"
+API_KEY="d4a2bd92be56c54905a99f2b5709e14064e9eaeb99c44aa74898125aedf5028a"
+
+BOLD="\033[1m"
+GREEN="\033[0;32m"
+RED="\033[0;31m"
+YELLOW="\033[0;33m"
+RESET="\033[0m"
+
+echo -e "\n${BOLD}TrustSignal API Test Suite${RESET}"
+echo "=================================================="
+
+# ----------------------------------------------------------
+# Spinner — runs in background while curl executes
+# Usage: start_spinner "label" & SPIN_PID=$!
+#        stop_spinner $SPIN_PID
+# ----------------------------------------------------------
+SPINNER_FRAMES=("⠋" "⠙" "⠹" "⠸" "⠼" "⠴" "⠦" "⠧" "⠇" "⠏")
+
+start_spinner() {
+  local label="$1"
+  local i=0
+  while true; do
+    printf "\r  ${SPINNER_FRAMES[$i]} $label..." 2>/dev/null
+    i=$(( (i+1) % ${#SPINNER_FRAMES[@]} ))
+    sleep 0.1
+  done
+}
+
+stop_spinner() {
+  local pid=$1
+  kill "$pid" 2>/dev/null
+  wait "$pid" 2>/dev/null
+  printf "\r\033[K"  # clear spinner line
+}
+
+
+# ----------------------------------------------------------
+# TEST 1 — Service Contract (PSA)
+# Expected: PASS — all metadata present, signature required
+# ----------------------------------------------------------
+echo -e "\n${BOLD}[TEST 1] Service Contract — PSA-2026-001${RESET}"
+echo "File: 1774182030454_test_contract.html"
+echo "Expected: PASS"
+
+start_spinner "Sending contract to /v1/ingest" &
+SPIN_PID=$!
+RESULT=$(curl -s -X POST "$API_URL/v1/ingest" \
+  -H "Authorization: Bearer $API_KEY" \
+  -H "Accept: application/json" \
+  -F "file=@1774182030454_test_contract.html;type=text/html" \
+  -F "doc_id=PSA-2026-001" \
+  -F "doc_type=service_agreement" \
+  -F "policy_tags=requires_signature,requires_notarization=false,retention_years=7")
+stop_spinner $SPIN_PID
+echo "$RESULT" | jq '.'
+echo -e "${GREEN}→ Check: status=PASS, receipt_id present, hash present${RESET}"
+
+
+# ----------------------------------------------------------
+# TEST 2 — Financial Schedule (ACFR)
+# ----------------------------------------------------------
+echo -e "\n${BOLD}[TEST 2] Financial Schedule — ACFR-GF-R-01-2025${RESET}"
+echo "File: 1774182030456_test_financial_schedule.html"
+echo "Expected: PASS (if prior hash on file) or WARN (first submission)"
+
+start_spinner "Sending financial schedule to /v1/ingest" &
+SPIN_PID=$!
+RESULT=$(curl -s -X POST "$API_URL/v1/ingest" \
+  -H "Authorization: Bearer $API_KEY" \
+  -H "Accept: application/json" \
+  -F "file=@1774182030456_test_financial_schedule.html;type=text/html" \
+  -F "doc_id=ACFR-GF-R-01-2025" \
+  -F "doc_type=financial_schedule" \
+  -F "policy_tags=requires_prior_version_match=true,fiscal_year=2025,fund=general")
+stop_spinner $SPIN_PID
+echo "$RESULT" | jq '.'
+echo -e "${GREEN}→ Check: prior_version_match field in response, hash anchored${RESET}"
+
+
+# ----------------------------------------------------------
+# TEST 3 — Government Registration Form
+# ----------------------------------------------------------
+echo -e "\n${BOLD}[TEST 3] Government Form — GOV-FORM-2026-0042${RESET}"
+echo "File: 1774182030456_test_gov_form.html"
+echo "Expected: PASS"
+
+start_spinner "Sending gov form to /v1/ingest" &
+SPIN_PID=$!
+RESULT=$(curl -s -X POST "$API_URL/v1/ingest" \
+  -H "Authorization: Bearer $API_KEY" \
+  -H "Accept: application/json" \
+  -F "file=@1774182030456_test_gov_form.html;type=text/html" \
+  -F "doc_id=GOV-FORM-2026-0042" \
+  -F "doc_type=government_form" \
+  -F "policy_tags=requires_signature=true,requires_notarization=false,govt_entity=IL-IDFPR,public_record=true")
+stop_spinner $SPIN_PID
+echo "$RESULT" | jq '.'
+echo -e "${GREEN}→ Check: signature_check=passed, public_record flag acknowledged${RESET}"
+
+
+# ----------------------------------------------------------
+# TEST 4a — Invoice (original, clean)
+# ----------------------------------------------------------
+echo -e "\n${BOLD}[TEST 4a] Invoice ORIGINAL — INV-2026-0047${RESET}"
+echo "File: 1774182030457_test_invoice.html"
+echo "Expected: CONDITIONAL (PO match check)"
+
+start_spinner "Sending clean invoice to /v1/ingest" &
+SPIN_PID=$!
+INGEST_RESPONSE=$(curl -s -X POST "$API_URL/v1/ingest" \
+  -H "Authorization: Bearer $API_KEY" \
+  -H "Accept: application/json" \
+  -F "file=@1774182030457_test_invoice.html;type=text/html" \
+  -F "doc_id=INV-2026-0047" \
+  -F "doc_type=invoice" \
+  -F "policy_tags=requires_signature=false,payment_terms=net30,currency=USD,requires_po_match=true" \
+  -F "po_number=PO-ACME-2026-0011")
+stop_spinner $SPIN_PID
+echo "$INGEST_RESPONSE" | jq '.'
+
+RECEIPT_ID=$(echo "$INGEST_RESPONSE" | jq -r '.receipt_id // "TSR-2026-inv0047-original"')
+ORIGINAL_HASH=$(echo "$INGEST_RESPONSE" | jq -r '.hash // "b7e2...f491"')
+
+echo -e "${GREEN}→ Saved receipt_id: $RECEIPT_ID${RESET}"
+echo -e "${GREEN}→ Saved original hash: $ORIGINAL_HASH${RESET}"
+echo -e "${YELLOW}→ Check: po_match_required=true, conditional status if PO not on file${RESET}"
+
+
+# ----------------------------------------------------------
+# TEST 4b — Invoice TAMPERED (hash mismatch test)
+# ----------------------------------------------------------
+echo -e "\n${BOLD}[TEST 4b] Invoice TAMPERED — Hash Mismatch Detection${RESET}"
+echo "File: 1774182030456_test_invoice_tampered.html"
+echo "Expected: FAIL — HASH_MISMATCH"
+
+start_spinner "Verifying tampered invoice against receipt" &
+SPIN_PID=$!
+RESULT=$(curl -s -X POST "$API_URL/v1/verify" \
+  -H "Authorization: Bearer $API_KEY" \
+  -H "Accept: application/json" \
+  -F "file=@1774182030456_test_invoice_tampered.html;type=text/html" \
+  -F "doc_id=INV-2026-0047" \
+  -F "receipt_id=$RECEIPT_ID" \
+  -F "original_hash=$ORIGINAL_HASH")
+stop_spinner $SPIN_PID
+echo "$RESULT" | jq '.'
+echo -e "${RED}→ Check: status=FAIL, reason=HASH_MISMATCH, verdict=DOCUMENT_ALTERED_AFTER_RECEIPT${RESET}"
+echo -e "${RED}→ 4 tampered fields: due_date, status, po_number, overage_qty${RESET}"
+
+
+# ----------------------------------------------------------
+# TEST 5 — CPA Credential / License
+# ----------------------------------------------------------
+echo -e "\n${BOLD}[TEST 5] CPA Credential — CRED-IL-CPA-2026-009182${RESET}"
+echo "File: 1774182030455_test_credential.html"
+echo "Expected: PASS"
+
+start_spinner "Sending CPA credential to /v1/ingest" &
+SPIN_PID=$!
+RESULT=$(curl -s -X POST "$API_URL/v1/ingest" \
+  -H "Authorization: Bearer $API_KEY" \
+  -H "Accept: application/json" \
+  -F "file=@1774182030455_test_credential.html;type=text/html" \
+  -F "doc_id=CRED-IL-CPA-2026-009182" \
+  -F "doc_type=professional_credential" \
+  -F "policy_tags=requires_issuer_signature=true,issuer=IL-IDFPR,credential_type=CPA_LICENSE,expiry_check=true" \
+  -F "credential_expiry=2026-12-31")
+stop_spinner $SPIN_PID
+echo "$RESULT" | jq '.'
+echo -e "${GREEN}→ Check: expiry_check=passed, issuer_verified=true, status=ACTIVE${RESET}"
+
+
+# ----------------------------------------------------------
+# SUMMARY
+# ----------------------------------------------------------
+echo -e "\n=================================================="
+echo -e "${BOLD}Test summary${RESET}"
+echo -e "  Test 1 — Contract         → Expected: ${GREEN}PASS${RESET}"
+echo -e "  Test 2 — Financial sched  → Expected: ${GREEN}PASS / WARN (first run)${RESET}"
+echo -e "  Test 3 — Gov form         → Expected: ${GREEN}PASS${RESET}"
+echo -e "  Test 4a — Invoice clean   → Expected: ${YELLOW}CONDITIONAL${RESET}"
+echo -e "  Test 4b — Invoice tampered→ Expected: ${RED}FAIL — HASH_MISMATCH${RESET}"
+echo -e "  Test 5 — CPA credential   → Expected: ${GREEN}PASS${RESET}"
+echo -e "==================================================\n"

From c5dd1552344b619991fcc49629e23cf9404e42a0 Mon Sep 17 00:00:00 2001
From: chrismaz11 <info@trustsignal.dev>
Date: Mon, 23 Mar 2026 15:38:36 -0500
Subject: [PATCH 07/10] fix(security): harden workflow permissions and static
 analysis findings

---
 .github/workflows/ci.yml                    |  37 +++++++++++---------
 .github/workflows/copilotsetupsteps.yml     |   7 ++--
 .github/workflows/main.yml                  |   5 ++-
 .gitignore                                  |   2 ++
 apps/api/src/security.ts                    |  10 ++++--
 apps/api/src/server.ts                      |  16 +++++++--
 ml/model/__pycache__/common.cpython-314.pyc | Bin 7414 -> 0 bytes
 sdk/index.ts                                |  10 +++++-
 src/routes/verify.ts                        |   9 ++++-
 9 files changed, 69 insertions(+), 27 deletions(-)
 delete mode 100644 ml/model/__pycache__/common.cpython-314.pyc

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index aea1da8..560f1a4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,15 +8,18 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version: '20'
           cache: npm
@@ -31,10 +34,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version: '20'
           cache: npm
@@ -54,10 +57,10 @@ jobs:
       POLYGON_RPC_URL: ${{ secrets.POLYGON_RPC_URL }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version: '20'
           cache: npm
@@ -72,10 +75,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version: '20'
           cache: npm
@@ -106,10 +109,10 @@ jobs:
       DATABASE_URL: postgresql://postgres@127.0.0.1:5432/trustsignal_signed_receipt_smoke?sslmode=disable
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version: '20'
           cache: npm
@@ -127,10 +130,10 @@ jobs:
         working-directory: circuits/non_mem_gadget
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
 
       - name: Build Halo2 verifier
         run: cargo build --release
@@ -142,7 +145,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install gitleaks
         run: |
@@ -158,10 +161,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version: '20'
           cache: npm
@@ -178,10 +181,10 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version: 22
 
diff --git a/.github/workflows/copilotsetupsteps.yml b/.github/workflows/copilotsetupsteps.yml
index 178406d..b3bcfd9 100644
--- a/.github/workflows/copilotsetupsteps.yml
+++ b/.github/workflows/copilotsetupsteps.yml
@@ -1,12 +1,15 @@
 name: "Copilot Setup Steps"
 on: workflow_dispatch
 
+permissions:
+  contents: read
+
 jobs:
   copilot-setup:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version: '24'
           cache: 'npm'
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index d9392a4..8942210 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -5,6 +5,9 @@ on:
   push:
     branches: ["master"]
 
+permissions:
+  contents: read
+
 jobs:
   verify-artifact:
     runs-on: ubuntu-latest
@@ -13,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Build release artifact
         run: |
diff --git a/.gitignore b/.gitignore
index 7b7cdbc..8b4925c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -73,6 +73,8 @@ packages/core/registry/registry.private.jwk
 .vercel
 circuits/non_mem_gadget/target/
 ml/.venv/
+**/__pycache__/
+**/*.py[cod]
 ml/zkml/deed_cnn.pk
 tmp/
 
diff --git a/apps/api/src/security.ts b/apps/api/src/security.ts
index ee00b6d..def0a6a 100644
--- a/apps/api/src/security.ts
+++ b/apps/api/src/security.ts
@@ -1,4 +1,4 @@
-import { createHash, generateKeyPairSync } from 'node:crypto';
+import { createHmac, generateKeyPairSync } from 'node:crypto';
 
 import { getAddress, verifyMessage } from 'ethers';
 import { FastifyReply, FastifyRequest } from 'fastify';
@@ -13,6 +13,7 @@ const DEFAULT_DEV_CORS_ORIGINS = [
   'http://127.0.0.1:5173'
 ];
 const DEV_RECEIPT_SIGNING_KID = 'dev-local-receipt-signer-v1';
+const DEV_API_KEY_FINGERPRINT_SECRET = 'trustsignal-dev-api-key-fingerprint-v1';
 const DEV_RECEIPT_SIGNING_KEYS = (() => {
   const { privateKey, publicKey } = generateKeyPairSync('ed25519');
   return {
@@ -268,8 +269,11 @@ function readHeader(request: FastifyRequest, headerName: string): string | null
   return null;
 }
 
-function fingerprintApiKey(apiKey: string): string {
-  return createHash('sha256').update(apiKey).digest('hex').slice(0, 16);
+function fingerprintApiKey(
+  apiKey: string,
+  secret = process.env.API_KEY_FINGERPRINT_SECRET || DEV_API_KEY_FINGERPRINT_SECRET
+): string {
+  return createHmac('sha256', secret).update(apiKey).digest('hex').slice(0, 16);
 }
 
 export function requireApiKeyScope(config: SecurityConfig, requiredScope: AuthScope) {
diff --git a/apps/api/src/server.ts b/apps/api/src/server.ts
index 74c1ad8..8248259 100644
--- a/apps/api/src/server.ts
+++ b/apps/api/src/server.ts
@@ -1290,7 +1290,13 @@ export async function buildServer(options: BuildServerOptions = {}) {
 
   app.post('/api/v1/verify/attom', {
     preHandler: [requireApiKeyScope(securityConfig, 'verify')],
-    config: { rateLimit: perApiKeyRateLimit }
+    config: {
+      rateLimit: {
+        max: securityConfig.perApiKeyRateLimitMax,
+        timeWindow: securityConfig.rateLimitWindow,
+        keyGenerator: getApiRateLimitKey
+      }
+    }
   }, async (request, reply) => {
     const parsed = deedParsedSchema.safeParse(request.body);
     if (!parsed.success) {
@@ -1312,7 +1318,13 @@ export async function buildServer(options: BuildServerOptions = {}) {
 
   app.post('/api/v1/verify', {
     preHandler: [requireApiKeyScope(securityConfig, 'verify')],
-    config: { rateLimit: perApiKeyRateLimit }
+    config: {
+      rateLimit: {
+        max: securityConfig.perApiKeyRateLimitMax,
+        timeWindow: securityConfig.rateLimitWindow,
+        keyGenerator: getApiRateLimitKey
+      }
+    }
   }, async (request, reply) => {
     const verifyStartMs = Date.now();
     const parsed = verifyInputSchema.safeParse(request.body);
diff --git a/ml/model/__pycache__/common.cpython-314.pyc b/ml/model/__pycache__/common.cpython-314.pyc
deleted file mode 100644
index 1ec248bfb5aa3853198319ac80c862689d0bbf6a..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 7414
zcmcIJZEPDycC+O2Yq=yP*_3EgjwsnyEXS5&TNi(S#<nEKR(WfOzDpf#*5u0KnOZWl
zOIvcCJNA$^w$iJVUJC016j6W_c7OnvLsMLS^v4zG*H5vOOJdJK4P5U>eiWrEA9T21
zeQ%aa(yGobQe+^`zL|M5^JeCK>xE!IAW;70AOAZ2Um_vD!iHU37Qii=02Ig=k+=~u
z%o$u4!j2Kgu+wld*g3)vy9^hD`4RW9$M7)NHR3gVfa@9&3_tsdhRD8w;h+%&9Ip`y
zlWropJBZ|YJs6MKn>W6LP75|#Uw1NGFW~wH9aisP4bf<m1nBp7kW7oQPHK}xXa%s9
z;f(cC5LzKN7M5B7Ze?)0<l0R7)_sL*^l_$N(X_0g80oC0L(`X13?-RSbZqc(#h8Gv
z^SCxWnyhWgJ~i^V<pa=E;G$k91}722G1g)@C9Z=c$R18|z=mERjhCFTJ<qmxNiM^k
zAO|_a17x^O@uaGzPE#eHdU<p-$-#2?!@|Q4_TiRe02E-wF~`2Q2}wa;C;2uv!AY=#
z<dpaU2dw1!3NOd>rL|n%kW=YN)0x%`(@j+)Pc@St&1&i=cwqN<mQE^$j@$H@2L@i%
zRjLmpCumwXvbhPB4#a8pdur0q2QJXOZk$hF(Ui=<B>ZJlYGxprot(^S{kdsVl;zsx
zsj_TtXg)}P^H3}7q;F)0SRo<T=0{j9Y_8(x-WJwchEbBNJukw<4?j4mZ#f3NhqwZ{
z#JaIM??{k0fKhEW=pvW!u2_k?ZK(0>ZXWkG`faG2jB#V$G3OZE=-%2&O)D~Cv2m?$
zcYW_BytP;Mj*0*8l|e{Xmu`}P*WX*?mBE_WCWz*-F`FoR)}6H2a~j_@PuSKNw;{MY
zajeA_%%(m6ueY}Lnk{3Tz2;!;Mc{1pH7~Yk$RDgoPT+q2E4+z5hv~nnQccasdisWH
zdU8rCmDaBGakK-5NBcz6rRQ@hHNCQ&*3t&BtwYmH;k^20Ue%1Wk}=&cXSHj)QYJ5{
zXJ0ja$FE(9XR{gT@Q$krh?1(Cp3@n{FjUQSpG|A3LQR1wjP!U~r4;GvbDF%aX2w~=
z^vN<Cmt`H*MsII{qC`-X2s6A&YAmXl#N37P-xkONZ{W74=#4CSH$I4L{4nrA;DH#N
z9hn)KQ|4Rmai8s462FB#Lo-9~jx>ha?zMh)d`W!iiJ`MIXBWP^Bn~Y5-5Z2k{GSCL
z2T63(hdV#miD+kL&b)ipUg7e5Pf6VL#BAL2@_ctm>|FM_qBuWP70JfUe;%akf!433
zyc|q<@f4rd<fd+jMwTWg`Y))Oo~1MZy)*<BydW~ErL?T;L&l-&pz6T^TfI14J&y=f
z^PN@v+}pug7Jbd?1z&=xmk9tsxpHw^?Lylwz=XBl9G4(*oU^JVp2Vn$VKY(#1K5<K
z?Jx%H;md0}u$+2Br7`HCo3YzLw;;R?DjjL<?PVu5J)p6#D>P-Ue}Y+Rz3liq0KGse
zVqo@_+po-X?~dN$Dq_p*x!dR1dqFF-ZuSSae=z@MDb&5_?PeF!=Vbd@6fnN^qF`vs
zB<gcPmO<g?GYEsGe>1OSY9k?89#2!<$N=|iSy^VBOkV&J%rG!H8q=f<5<=6L^M<O!
z{6I|vl4>R+%Ww@_@r-!4$E?Rh-AS=xuZ+U_+dm~M4loeRO04w2TQ1{+GQt^V5|HYp
z_B7n`G3aWt#@h_%7I0x+=Osrkj4;Sqhxj_=VvyT#NobY5rvJ1h>~SS|^>>1n>(^2W
zrOGtBE7P4(E~^>cbWN&?rh}{-DV?$DXrG(zgnei~Rs&eQ2$cyp*5qcujqSoAWNhm^
zOdp^*qgXKpK!$#YJPbxke54|_m-zOIKV0I&6=8juUvEuA<gX=lHJ8DXI`4#{PskJM
zl<Cxsn#_F*X?dF9q4eR=>VoIuLXQYk^LwiJSvbI2j7~-(;Ie`u0<Q&L4LpCdRbNxQ
zh%JCplMUxcj=SWptw-X>HmeF+$0m%r-DseJrLU=jI4YS{rD<+()eto6G&y$Etq>tO
zN5T<D_FYxR$PRqVT4`9web>R41Iyk?E}<4<MRM9}PjCtJ>iALc*jy=NI;UP?7!R|@
zZfs9$*OW{;6~l*%WmN5oF%bi85UW|Jm^x)pC5bL=pJ2K!PlFJG5~0~id}Lwx`1xV^
z#CI>8IuFJ#X9_rQIX^xQX3>=gpK+h*R&?AE=47&pv1d0}%?SnCLPE*p)l-yaDd>)a
zK#=LA%5~FuO-)+1Ef%v>mMAl(GO{uZ(N_SIG0PhOfJGBRvpa9^ocET5?u8dVKCmeC
z7hZlKh_gFqcFsFL-hFr9NBfq99c5upQP}hOiJzbO*_o1X^cP$23qysMD<0vU=|7&H
zYyFd(@84MRbUz427B`$K1y3(}PgnfG!kGrk*%}=ggs~h7*3%qm$tCfUTk;I>s01wO
zaHPh6C+1T9Cm}8XH+@p2dtsFutqq+JyBS00n(l*s%VIG}ewOqgy1tuHv_d+#aqbbT
zE8g{0CpIga`fI@9Q44tJYI)?sA?t`Wod+v`n+!j8M3G-5Rn10^p%Mta5=44}E8}Yz
zu7(WQJQ>GbR+US2*{Wl$Ay0TASRf3n%U#ad@aW^ek4i_g?5s(pwJ_B2r$}lX73`{F
z(*$?n{N{IQI_sJqFHpgM^HkVx)NjQ)wOh~eP1LPlbxqLhCKm_$9V|Msb>>?9QlI#=
zm&m!`q^@u7q$s|2RFrckI29=EBnij(G4^%E(YIJt7*{qNJy(3gDg<agf#YbpuO{7Y
z&jR^!NZx&LSCTK`uu~a1$Hi~&s7nh0oF}Y@=h7y7e!}zhIsKvndkc0H3u?>{DGkUl
zFnx?E4P`2=n|=dKglt(3GpOY!Azp$g-wJQs%49YVsRI}DaxUPcWHvW_<wyVdw+k!(
z^w|;15RvN9KHhR2Ujo9JR%9x$FGNp32iOcqq+F$^aPSazI46}HGX<sx>_P_84fHhj
zd!Yp+KtjQl$zIu&GyTb|mQ*0Xf}hEwkA<E|%5+_a?1ai(B+$<1aADNNY**9rVj!_$
z3VKq>C{zZxL7ypTnD)p(SeVk$AoTY3#;{oSYW?MWI+K!X29!-rPthdcF*U6*U*)lz
zw6x7m%}mWZ<`4c=s2u4pM*2V1OOZY0$lhXP@85}~$f<JVTrqO46#0Y2#Koo1cM8M*
z(Yo$V<S!x*#o(>C?u(ns;+CSg<zwmYYahK<5??Hf`-|fKl6bHp1{XtJ_r+LQe7-0?
z|Ec4r!Y4vW+*1}06~#j(@d$=u!!yHk(!BRCFO|dFis5aaw*7SDCmT!Q!E*R;F?_fb
zK3WowRXw~<s0t()dK~byxeI3=w;|czpZWg$)Z%l4U+h{69WIAX7DFfhLHg&{{{FR6
zC|($@1VVG3AN^rD&{Yg{eeAd^d?b_tFO&m=#lYYfTNVR@rNGg`>4zTihi}dEABdHf
z$eqA@frVXjfl|xXTdqo|WA^6ln+vVCZk9ruZ}AU8t?ZuodE+Pkh4c5eltKfy_=jy9
z@3-|Vr0%zFFPwScZ(k6~v0cU3uFrdZzWrz0OR>Yh7+-uNwd7Y9dG&u=aWHH(#}R<1
zS#c{JR`YF>`ZYNRSv-mw%d*a+2tCU>OMq1OZ9`lTvQ%7feh{J&F1T=(wHhP>E-UDh
zGAn#!wQpO~n>9T4K`U(QV+b!Hd-zPPSoeADd2406*0R#Jt&2DLt2Qk!LRxpS9>yXa
zy)Xp5&Pk5>v}@RN2$!E?ZFA0q^ZDBHsR;9M>-JaT8s2WA?(K?Xx5GXYc)lEZzMz*N
zFH5K89OPUeIdfwJre<~3h)t$-9kM#HWHytZ)bs<fBgh*jx69-V(>V>!E^pAhdc*_0
z^i`}bU=_y--<6^UqvxSA*Qb<e9h9GzRAsgu>IZO|9XUw&P*q9Ez(7qp3^der@RRv8
zOfiL28og!}CYzobF?1N0bwl#PfQ5Lf;#R1taJe`0X{x47PwfCYl8suZ<}-t{osw&Z
zq}O1KG2z<)fY0pn&qimWbKfcXo-3TFL^mxy*MC1cP>#M-jK1`_UWy(pM~@bxN6XPu
z#ptP0bf_FXTa2Fl*K^~g=#|2WMNdbOkNmg8+u|+^SKCOaqa5rm2D=w}?r#5RdnvfH
zF!b-9Ao|kL!Os(44E>F~ICyGt!|76RXwf@V@dpYc4R*KvYD`Nqc1Pd-X%Y#3HJD}i
zc_p7DNd5sgJg{g<s6U%GFk@X8Qi!TC&&*<cOTV*V6!oy_8&5+nT2}H&)5T&FOQMk%
zpDEEPK+;b#N>@k=xAhTLmDX_83EzkQj;ag3RW}jas~&{B#2>Eu5E4jBxavnpByQnR
z03ho!P^Z`hX<(Pp$z)&pJt-wy5<w0C+bSSUybU+Lwme9Vh9@pLA;w(83$L%rC!9|m
zcU`J$fCO*vFyKb7EWSpTIgV;_Re@(jAFHO(AopI6dE;w(win}eCbx@7UU+yPSZK%*
zsqjyVq+z8<1r{x`K(%4g=?&QV0_1cdjSE6%=%!Z%=f#k-S4aB<`WB2*q?s*2j{{`7
zjV$vk{)jcKX~0icQ)!58S!NNEHOe&=(lk>za~i9<55YFX-KJ3zb=0=tC4iq`$!7>>
z%E<{ec{P`XIGMf!2#l+A01BkqLVV#lwcOrYZ0{|#Z>xCMy?=f_{9)Hmx=P_bi0j_}
zUd0=l3*YH{uk**xRlLDD{*M1W|BnNR`0D)rQg~}M;OTM~hF~REOPOyk^6h25v&eTY
zT=?wdBHy{h?|;Di-Z}HbGq<k)8^47yVV`4kw66oRb>n&T-ype!jAi=k|Hx8xitL34
zGbS?W%ghwQRZZtWiBdeJ>0<tu<+r(W3M9L9Itc^xZ5#y$4Rf-ZMx)qg-Sjz@8?>Yp
z*^ha4%wuAzi(SsD443IWWMveO&^efaYD9kns;ZOYxL=c=Uz6@HN#sk?{wvb<OS0~l
zMEsJ39|nR2;juf+^~~+Qv;V#Qj|qU)7m35a;^4V(l|Z%Zgk}|+zX?L_X{7~&<lhW}
Lsb1M)3+w*?4r5lj

diff --git a/sdk/index.ts b/sdk/index.ts
index ba9dea5..ac7d2c3 100644
--- a/sdk/index.ts
+++ b/sdk/index.ts
@@ -42,7 +42,7 @@ export class TrustSignalSDK {
   private readonly apiKey: string;
 
   constructor(options: SDKOptions) {
-    this.baseUrl = options.baseUrl.replace(/\/+$/, '');
+    this.baseUrl = stripTrailingSlashes(options.baseUrl);
     this.apiKey = options.apiKey;
   }
 
@@ -105,3 +105,11 @@ export class TrustSignalSDK {
     return (await response.json()) as T;
   }
 }
+
+function stripTrailingSlashes(value: string): string {
+  let end = value.length;
+  while (end > 0 && value.charCodeAt(end - 1) === 47) {
+    end -= 1;
+  }
+  return end === value.length ? value : value.slice(0, end);
+}
diff --git a/src/routes/verify.ts b/src/routes/verify.ts
index b7362c5..4e65586 100644
--- a/src/routes/verify.ts
+++ b/src/routes/verify.ts
@@ -49,8 +49,15 @@ export async function registerVerifyRoute(
   options: VerifyRoutePluginOptions = {}
 ): Promise<void> {
   const deps = createRouteDependencies(options.deps);
+  const verifyRouteRateLimit = {
+    max: 100,
+    timeWindow: '1 minute'
+  };
 
-  app.post('/v1/verify-bundle', { preHandler: authenticateJWT }, async (request, reply) => {
+  app.post('/v1/verify-bundle', {
+    preHandler: authenticateJWT,
+    config: { rateLimit: verifyRouteRateLimit }
+  }, async (request, reply) => {
     const parsedBody = verifyBundleBodySchema.safeParse(request.body);
     if (!parsedBody.success) {
       return reply.code(400).send({

From a0378943687b97127d4f3549baa24eaa5dd5aa26 Mon Sep 17 00:00:00 2001
From: chrismaz11 <info@trustsignal.dev>
Date: Mon, 23 Mar 2026 19:29:59 -0500
Subject: [PATCH 08/10] docs(security): add repo ownership boundaries

---
 .github/CODEOWNERS | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 .github/CODEOWNERS

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..b28198f
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,4 @@
+* @chrismaz11
+/apps/api/src/ @chrismaz11
+/circuits/ @chrismaz11
+/packages/core/ @chrismaz11

From e4bffa380f62c4a43d0d1ec002ad44c4fa7dbe1f Mon Sep 17 00:00:00 2001
From: chrismaz11 <info@trustsignal.dev>
Date: Wed, 25 Mar 2026 08:04:59 -0500
Subject: [PATCH 09/10] chore(docs): standardize public messaging and claims
 boundary

---
 README.md                       | 50 +++++++++++++++++++++++++++++----
 docs/public-private-boundary.md | 38 +++++++++----------------
 docs/security-summary.md        | 15 ++++------
 3 files changed, 63 insertions(+), 40 deletions(-)

diff --git a/README.md b/README.md
index 947842d..7fb1608 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@
 
 Website: https://trustsignal.dev
 
-TrustSignal is evidence integrity infrastructure for existing workflows. It acts as an integrity layer that returns signed verification receipts, verification signals, verifiable provenance metadata, and later verification capability without replacing the upstream system of record.
+TrustSignal is evidence-integrity infrastructure that operates as an integrity layer for existing workflows. It issues **signed verification receipts**, verification signals, and verifiable provenance metadata — enabling **later verification** and auditability without replacing the upstream system of record. TrustSignal’s public integration boundary intentionally avoids exposing signing internals or proof internals and focuses on returning durable verification artifacts that integrators can store alongside their own evidence.
 
 ## Problem
 
@@ -72,6 +72,19 @@ The fastest path in this repository is the public `/api/v1/*` evaluator flow. It
 
 The current partner-facing lifecycle in this repository is:
 
+- `POST /api/v1/clients`
+- `POST /api/v1/auth/register`
+- `GET /api/v1/auth/login`
+- `POST /api/v1/auth/login`
+- `POST /api/v1/auth/logout`
+- `GET /api/v1/oauth/authorize`
+- `POST /api/v1/oauth/authorize/consent`
+- `GET /api/v1/clients/:clientId/keys`
+- `POST /api/v1/clients/:clientId/keys`
+- `DELETE /api/v1/clients/:clientId/keys/:kid`
+- `POST /api/v1/clients/:clientId/revoke`
+- `POST /api/v1/token`
+- `POST /api/v1/introspect`
 - `POST /api/v1/verify`
 - `GET /api/v1/receipt/:receiptId`
 - `GET /api/v1/receipt/:receiptId/pdf`
@@ -124,10 +137,32 @@ Default local ports:
 
 Once the local API is running, use the evaluator quickstart or the public examples directly:
 
+Preferred machine flow:
+
+1. register a client with a public JWK at `POST /api/v1/clients`
+2. rotate local public keys with `POST /api/v1/clients/:clientId/keys` and `DELETE /api/v1/clients/:clientId/keys/:kid` as needed
+3. exchange a signed `private_key_jwt` assertion at `POST /api/v1/token`
+4. optionally introspect or self-revoke machine clients with `POST /api/v1/introspect` and `POST /api/v1/clients/:clientId/revoke`
+5. call the verification API with `Authorization: Bearer $TRUSTSIGNAL_ACCESS_TOKEN`
+
+Set `TRUSTSIGNAL_REPLAY_REDIS_URL` in multi-instance deployments so assertion replay protection is shared across API nodes. Without Redis, replay protection falls back to the database nonce table.
+
+Legacy `x-api-key` auth is still accepted during the migration window.
+
+Preferred browser OAuth flow:
+
+1. create a user with `POST /api/v1/auth/register`
+2. sign in through `GET /api/v1/auth/login` or `POST /api/v1/auth/login`
+3. register a browser client with `POST /api/v1/clients` using `clientType: browser` and exact `redirectUris`
+4. start Authorization Code + PKCE with `GET /api/v1/oauth/authorize`
+5. approve consent at `POST /api/v1/oauth/authorize/consent`
+6. exchange the one-time code at `POST /api/v1/token` with `grant_type=authorization_code`
+7. call protected API routes with the delegated bearer token
+
 ```bash
 curl -X POST "http://localhost:3001/api/v1/verify" \
   -H "Content-Type: application/json" \
-  -H "x-api-key: $TRUSTSIGNAL_API_KEY" \
+  -H "Authorization: Bearer $TRUSTSIGNAL_ACCESS_TOKEN" \
   --data @examples/verification-request.json
 ```
 
@@ -135,10 +170,10 @@ Then retrieve the stored receipt and run later verification:
 
 ```bash
 curl "http://localhost:3001/api/v1/receipt/$RECEIPT_ID" \
-  -H "x-api-key: $TRUSTSIGNAL_API_KEY"
+  -H "Authorization: Bearer $TRUSTSIGNAL_ACCESS_TOKEN"
 
 curl -X POST "http://localhost:3001/api/v1/receipt/$RECEIPT_ID/verify" \
-  -H "x-api-key: $TRUSTSIGNAL_API_KEY"
+  -H "Authorization: Bearer $TRUSTSIGNAL_ACCESS_TOKEN"
 ```
 
 ## What The Developer Trial Proves
@@ -165,7 +200,9 @@ The upstream platform remains the system of record. TrustSignal adds an integrit
 
 The local evaluator path is intentionally constrained. Local development defaults are a deliberate evaluator and development path, and they fail closed where production trust assumptions are not satisfied.
 
-Authentication is `x-api-key` with scoped access. Revocation additionally requires issuer authorization headers: `x-issuer-id`, `x-signature-timestamp`, and `x-issuer-signature`.
+Authentication prefers short-lived bearer access tokens minted from registered client keys at `POST /api/v1/token`. Legacy scoped `x-api-key` auth remains available during the migration. Revocation additionally requires issuer authorization headers: `x-issuer-id`, `x-signature-timestamp`, and `x-issuer-signature`.
+
+Browser Authorization Code + PKCE is implemented in this repository through `/api/v1/auth/*`, `/api/v1/oauth/authorize`, `/api/v1/oauth/authorize/consent`, and the shared `POST /api/v1/token` endpoint. Browser clients are stored as `clientType: browser`, must register exact redirect URIs, and require PKCE `S256`. The same bearer-token validation path is reused for both browser and machine access tokens, while M2M `private_key_jwt` remains intact.
 
 The repository also still includes a legacy JWT-authenticated `/v1/*` surface used by the current JavaScript SDK:
 
@@ -179,7 +216,7 @@ Production deployment requires explicit authentication, signing configuration, a
 
 For production use, plan for at least:
 
-- explicit API-key and JWT configuration
+- explicit machine-client registration and access-token signing configuration
 - signing configuration and key management through environment setup
 - receipt lifecycle checks before downstream reliance
 - database and network security controls appropriate for the deployment environment
@@ -205,6 +242,7 @@ These artifacts document the public verification lifecycle only. They intentiona
 Public-facing security properties for this repository are:
 
 - scoped API authentication for the integration-facing API
+- browser Authorization Code + PKCE with exact redirect URI matching and consent persistence
 - request validation and rate limiting at the gateway
 - signed verification receipts returned with verification responses
 - later verification of stored receipt integrity and status
diff --git a/docs/public-private-boundary.md b/docs/public-private-boundary.md
index 0e190eb..8ea9bbc 100644
--- a/docs/public-private-boundary.md
+++ b/docs/public-private-boundary.md
@@ -1,34 +1,22 @@
 # Public / Private Boundary
 
-This repository is currently a single codebase, but it is being organized so a
-future split into:
+This codebase is organized to make it straightforward to operate a **public integration layer** and a **private verification engine** with a narrow engine interface.
 
-- a public integration-layer repository
-- a private verification-engine repository or service
+## Public integration layer
+The public integration layer contains API, SDK, public docs, and public route/middleware code. It is responsible for:
+- Authentication and authorization
+- Request validation and tenant scoping
+- Rate limiting and exposure controls
+- Response shaping and partner-facing contracts
 
-is straightforward.
+Public code must not import or orchestrate engine-private helpers or signing internals.
 
-## Public-Oriented Surfaces
+## Private verification engine
+The private verification engine owns proof orchestration, signing internals, revocation/anchoring workflows, ZKP/circuits, and compliance evaluation. Engine code is intentionally internal; integrators should depend on the API contract and receipt model rather than internal implementation details.
 
-These directories are intended to remain part of the public integration layer:
-
-- `api/`
-- `sdk/`
-- `docs/`
-- `security/`
-- `apps/web/`
-- `apps/watcher/`
-- `packages/public-contracts/`
-- public-facing route, middleware, and response-mapping code in `apps/api/src/`
-
-Public code should own:
-
-- authentication and authorization
-- request validation
-- tenant scoping
-- rate limiting
-- idempotency and request lifecycle concerns
-- response shaping and partner-facing contracts
+## Guardrails
+- Route handlers must call the narrow engine interface and must not import engine internals directly.
+- Public gateway code uses import restrictions and checks (e.g., `npm run check:api-boundary`) to prevent accidental leakage of private engine code.
 
 ## Private Engine Candidates
 
diff --git a/docs/security-summary.md b/docs/security-summary.md
index a45965c..eeb6447 100644
--- a/docs/security-summary.md
+++ b/docs/security-summary.md
@@ -1,18 +1,15 @@
 # TrustSignal Public Security Summary
 
-> TrustSignal is evidence integrity infrastructure for signed verification receipts and later verification.
+TrustSignal provides a public-safe security posture at the integration boundary: scoped API authentication, request validation and rate-limiting at the API gateway, server-side persistence of artifact receipts, fail-closed production defaults, and a claims boundary that avoids exposing signing internals or proof internals.
 
-Short description:
-This public-safe security summary explains the TrustSignal integration boundary, security posture, and claims boundary without exposing non-public implementation details.
-
-Audience:
-- partner security reviewers
-- evaluators
-- developers
+## Audience
+- Partner security reviewers
+- Evaluators
+- Developers
 
 ## Problem / Context
 
-Partners and evaluators need a public-safe security summary that explains the attack surface without exposing internal implementation details. In high-stakes workflows, evidence can be challenged after collection through tampered evidence, provenance loss, artifact substitution, or stale records that are no longer independently verifiable.
+Partners and evaluators need a public-safe security summary that explains the attack surface and the integration-facing guarantees without exposing non-public implementation details.
 
 ## Integrity Model
 

From 0ef74a34bc36153204c9e46fece0b6e3a8343cc8 Mon Sep 17 00:00:00 2001
From: chrismaz11 <info@trustsignal.dev>
Date: Fri, 27 Mar 2026 13:07:26 -0500
Subject: [PATCH 10/10] feat(api): browser OAuth, machine client registration,
 GET /api/v1/clients, P1 fixes

- Add browser OAuth user registration and login endpoints (/api/v1/auth/register, /api/v1/auth/login, /api/v1/auth/logout)
- Add machine client registration with Ed25519 JWK support (POST /api/v1/clients)
- Add GET /api/v1/clients endpoint filtered by userEmail for client listing
- Add replayStore for webhook delivery deduplication; fix release() to actually delete record on failure
- Fix parseCookieHeader to wrap decodeURIComponent in try/catch, preventing URIError crashes on malformed cookies
- Fix appendQueryParams to split on '?' instead of using new URL(), avoiding throws on relative paths
- Add Prisma migrations for artifact receipts, machine clients, and browser OAuth session storage
- Extract auth helpers into auth.ts module

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .../migration.sql                             |   51 +
 .../migration.sql                             |   35 +
 .../migration.sql                             |  125 ++
 apps/api/prisma/schema.prisma                 |  231 ++-
 apps/api/src/auth.ts                          |  316 ++++
 apps/api/src/db.ts                            |  142 +-
 apps/api/src/replayStore.ts                   |  231 +++
 apps/api/src/server.ts                        | 1503 ++++++++++++++++-
 8 files changed, 2558 insertions(+), 76 deletions(-)
 create mode 100644 apps/api/prisma/migrations/20260313090000_add_artifact_receipts/migration.sql
 create mode 100644 apps/api/prisma/migrations/20260324110000_add_machine_clients/migration.sql
 create mode 100644 apps/api/prisma/migrations/20260324124500_add_browser_oauth_storage/migration.sql
 create mode 100644 apps/api/src/auth.ts
 create mode 100644 apps/api/src/replayStore.ts

diff --git a/apps/api/prisma/migrations/20260313090000_add_artifact_receipts/migration.sql b/apps/api/prisma/migrations/20260313090000_add_artifact_receipts/migration.sql
new file mode 100644
index 0000000..b24d7ed
--- /dev/null
+++ b/apps/api/prisma/migrations/20260313090000_add_artifact_receipts/migration.sql
@@ -0,0 +1,51 @@
+CREATE TABLE "ArtifactReceipt" (
+    "receiptId" TEXT NOT NULL PRIMARY KEY,
+    "verificationId" TEXT NOT NULL,
+    "artifactHash" TEXT NOT NULL,
+    "algorithm" TEXT NOT NULL,
+    "sourceProvider" TEXT NOT NULL,
+    "repository" TEXT,
+    "workflow" TEXT,
+    "runId" TEXT,
+    "commitSha" TEXT,
+    "actor" TEXT,
+    "status" TEXT NOT NULL,
+    "receiptSignature" TEXT NOT NULL,
+    "receiptSignatureAlg" TEXT NOT NULL,
+    "receiptSignatureKid" TEXT NOT NULL,
+    "metadataArtifactPath" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE UNIQUE INDEX "ArtifactReceipt_verificationId_key"
+ON "ArtifactReceipt" ("verificationId");
+
+CREATE INDEX "ArtifactReceipt_createdAt_idx"
+ON "ArtifactReceipt" ("createdAt");
+
+ALTER TABLE "ArtifactReceipt" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "ArtifactReceipt" FORCE ROW LEVEL SECURITY;
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'postgres') THEN
+    CREATE POLICY "artifact_receipts_postgres_all"
+    ON "ArtifactReceipt"
+    FOR ALL
+    TO postgres
+    USING (true)
+    WITH CHECK (true);
+  END IF;
+END $$;
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'service_role') THEN
+    CREATE POLICY "artifact_receipts_service_role_all"
+    ON "ArtifactReceipt"
+    FOR ALL
+    TO service_role
+    USING (true)
+    WITH CHECK (true);
+  END IF;
+END $$;
diff --git a/apps/api/prisma/migrations/20260324110000_add_machine_clients/migration.sql b/apps/api/prisma/migrations/20260324110000_add_machine_clients/migration.sql
new file mode 100644
index 0000000..512619a
--- /dev/null
+++ b/apps/api/prisma/migrations/20260324110000_add_machine_clients/migration.sql
@@ -0,0 +1,35 @@
+CREATE TABLE "Client" (
+    "id" TEXT NOT NULL,
+    "name" TEXT,
+    "userEmail" TEXT,
+    "clientType" TEXT NOT NULL DEFAULT 'machine',
+    "scopes" TEXT NOT NULL DEFAULT 'verify read',
+    "jwks" JSONB,
+    "jwksUrl" TEXT,
+    "subscriptionId" TEXT,
+    "plan" TEXT NOT NULL DEFAULT 'FREE',
+    "usageLimit" INTEGER NOT NULL DEFAULT 100,
+    "usageCount" INTEGER NOT NULL DEFAULT 0,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "createdBy" TEXT NOT NULL DEFAULT 'self-service',
+    "revokedAt" TIMESTAMP(3),
+    "lastUsedAt" TIMESTAMP(3),
+
+    CONSTRAINT "Client_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "ClientAssertionNonce" (
+    "id" TEXT NOT NULL,
+    "clientId" TEXT NOT NULL,
+    "jtiHash" TEXT NOT NULL,
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "ClientAssertionNonce_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX "ClientAssertionNonce_clientId_jtiHash_key" ON "ClientAssertionNonce"("clientId", "jtiHash");
+CREATE INDEX "ClientAssertionNonce_expiresAt_idx" ON "ClientAssertionNonce"("expiresAt");
+
+ALTER TABLE "ClientAssertionNonce" ADD CONSTRAINT "ClientAssertionNonce_clientId_fkey"
+FOREIGN KEY ("clientId") REFERENCES "Client"("id") ON DELETE CASCADE ON UPDATE CASCADE;
diff --git a/apps/api/prisma/migrations/20260324124500_add_browser_oauth_storage/migration.sql b/apps/api/prisma/migrations/20260324124500_add_browser_oauth_storage/migration.sql
new file mode 100644
index 0000000..9555cac
--- /dev/null
+++ b/apps/api/prisma/migrations/20260324124500_add_browser_oauth_storage/migration.sql
@@ -0,0 +1,125 @@
+CREATE TABLE "UserAccount" (
+    "id" TEXT NOT NULL,
+    "email" TEXT NOT NULL,
+    "displayName" TEXT,
+    "passwordHash" TEXT NOT NULL,
+    "passwordSalt" TEXT NOT NULL,
+    "disabledAt" TIMESTAMP(3),
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "lastLoginAt" TIMESTAMP(3),
+
+    CONSTRAINT "UserAccount_pkey" PRIMARY KEY ("id")
+);
+
+ALTER TABLE "Client"
+ADD COLUMN "ownerUserId" TEXT;
+
+ALTER TABLE "Client"
+ADD CONSTRAINT "Client_ownerUserId_fkey"
+FOREIGN KEY ("ownerUserId") REFERENCES "UserAccount"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+CREATE TABLE "ClientRedirectUri" (
+    "id" TEXT NOT NULL,
+    "clientId" TEXT NOT NULL,
+    "redirectUri" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "ClientRedirectUri_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "BrowserSession" (
+    "id" TEXT NOT NULL,
+    "userId" TEXT NOT NULL,
+    "sessionTokenHash" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "lastUsedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+    "revokedAt" TIMESTAMP(3),
+
+    CONSTRAINT "BrowserSession_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "OAuthConsentGrant" (
+    "id" TEXT NOT NULL,
+    "clientId" TEXT NOT NULL,
+    "userId" TEXT NOT NULL,
+    "grantedScopes" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "revokedAt" TIMESTAMP(3),
+
+    CONSTRAINT "OAuthConsentGrant_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "OAuthAuthorizationRequest" (
+    "id" TEXT NOT NULL,
+    "clientId" TEXT NOT NULL,
+    "userId" TEXT,
+    "redirectUri" TEXT NOT NULL,
+    "scope" TEXT NOT NULL,
+    "state" TEXT,
+    "codeChallenge" TEXT NOT NULL,
+    "codeChallengeMethod" TEXT NOT NULL DEFAULT 'S256',
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "consumedAt" TIMESTAMP(3),
+
+    CONSTRAINT "OAuthAuthorizationRequest_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "OAuthAuthorizationCode" (
+    "id" TEXT NOT NULL,
+    "clientId" TEXT NOT NULL,
+    "userId" TEXT NOT NULL,
+    "codeHash" TEXT NOT NULL,
+    "redirectUri" TEXT NOT NULL,
+    "scope" TEXT NOT NULL,
+    "codeChallenge" TEXT NOT NULL,
+    "codeChallengeMethod" TEXT NOT NULL DEFAULT 'S256',
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "usedAt" TIMESTAMP(3),
+
+    CONSTRAINT "OAuthAuthorizationCode_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX "UserAccount_email_key" ON "UserAccount"("email");
+CREATE INDEX "Client_ownerUserId_idx" ON "Client"("ownerUserId");
+CREATE UNIQUE INDEX "ClientRedirectUri_clientId_redirectUri_key" ON "ClientRedirectUri"("clientId", "redirectUri");
+CREATE INDEX "ClientRedirectUri_clientId_idx" ON "ClientRedirectUri"("clientId");
+CREATE UNIQUE INDEX "BrowserSession_sessionTokenHash_key" ON "BrowserSession"("sessionTokenHash");
+CREATE INDEX "BrowserSession_expiresAt_idx" ON "BrowserSession"("expiresAt");
+CREATE INDEX "BrowserSession_userId_expiresAt_idx" ON "BrowserSession"("userId", "expiresAt");
+CREATE UNIQUE INDEX "OAuthConsentGrant_clientId_userId_key" ON "OAuthConsentGrant"("clientId", "userId");
+CREATE INDEX "OAuthConsentGrant_clientId_idx" ON "OAuthConsentGrant"("clientId");
+CREATE INDEX "OAuthConsentGrant_userId_idx" ON "OAuthConsentGrant"("userId");
+CREATE INDEX "OAuthAuthorizationRequest_clientId_expiresAt_idx" ON "OAuthAuthorizationRequest"("clientId", "expiresAt");
+CREATE INDEX "OAuthAuthorizationRequest_userId_expiresAt_idx" ON "OAuthAuthorizationRequest"("userId", "expiresAt");
+CREATE UNIQUE INDEX "OAuthAuthorizationCode_codeHash_key" ON "OAuthAuthorizationCode"("codeHash");
+CREATE INDEX "OAuthAuthorizationCode_clientId_expiresAt_idx" ON "OAuthAuthorizationCode"("clientId", "expiresAt");
+CREATE INDEX "OAuthAuthorizationCode_userId_expiresAt_idx" ON "OAuthAuthorizationCode"("userId", "expiresAt");
+
+ALTER TABLE "ClientRedirectUri" ADD CONSTRAINT "ClientRedirectUri_clientId_fkey"
+FOREIGN KEY ("clientId") REFERENCES "Client"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+ALTER TABLE "BrowserSession" ADD CONSTRAINT "BrowserSession_userId_fkey"
+FOREIGN KEY ("userId") REFERENCES "UserAccount"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+ALTER TABLE "OAuthConsentGrant" ADD CONSTRAINT "OAuthConsentGrant_clientId_fkey"
+FOREIGN KEY ("clientId") REFERENCES "Client"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+ALTER TABLE "OAuthConsentGrant" ADD CONSTRAINT "OAuthConsentGrant_userId_fkey"
+FOREIGN KEY ("userId") REFERENCES "UserAccount"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+ALTER TABLE "OAuthAuthorizationRequest" ADD CONSTRAINT "OAuthAuthorizationRequest_clientId_fkey"
+FOREIGN KEY ("clientId") REFERENCES "Client"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+ALTER TABLE "OAuthAuthorizationRequest" ADD CONSTRAINT "OAuthAuthorizationRequest_userId_fkey"
+FOREIGN KEY ("userId") REFERENCES "UserAccount"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+ALTER TABLE "OAuthAuthorizationCode" ADD CONSTRAINT "OAuthAuthorizationCode_clientId_fkey"
+FOREIGN KEY ("clientId") REFERENCES "Client"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+ALTER TABLE "OAuthAuthorizationCode" ADD CONSTRAINT "OAuthAuthorizationCode_userId_fkey"
+FOREIGN KEY ("userId") REFERENCES "UserAccount"("id") ON DELETE CASCADE ON UPDATE CASCADE;
diff --git a/apps/api/prisma/schema.prisma b/apps/api/prisma/schema.prisma
index d80962c..89468b9 100644
--- a/apps/api/prisma/schema.prisma
+++ b/apps/api/prisma/schema.prisma
@@ -27,6 +27,141 @@ model ApiKey {
   verificationLogs VerificationRecord[]
 }
 
+model Client {
+  id               String                @id @default(cuid())
+  name             String?
+  userEmail        String?
+  clientType       String                @default("machine")
+  scopes           String                @default("verify read")
+  jwks             Json?
+  jwksUrl          String?
+  ownerUserId      String?
+  ownerUser        UserAccount?           @relation("ClientOwner", fields: [ownerUserId], references: [id], onDelete: SetNull)
+  subscriptionId   String?
+  plan             String                @default("FREE")
+  usageLimit       Int                   @default(100)
+  usageCount       Int                   @default(0)
+  createdAt        DateTime              @default(now())
+  createdBy        String                @default("self-service")
+  revokedAt        DateTime?
+  lastUsedAt       DateTime?
+  assertionNonces  ClientAssertionNonce[]
+  redirectUris     ClientRedirectUri[]
+  authRequests     OAuthAuthorizationRequest[]
+  authCodes        OAuthAuthorizationCode[]
+  consentGrants    OAuthConsentGrant[]
+
+  @@index([ownerUserId])
+}
+
+model ClientRedirectUri {
+  id          String   @id @default(cuid())
+  clientId    String
+  client      Client   @relation(fields: [clientId], references: [id], onDelete: Cascade)
+  redirectUri String
+  createdAt   DateTime @default(now())
+
+  @@unique([clientId, redirectUri])
+  @@index([clientId])
+}
+
+model ClientAssertionNonce {
+  id         String   @id @default(cuid())
+  clientId   String
+  client     Client   @relation(fields: [clientId], references: [id], onDelete: Cascade)
+  jtiHash    String
+  expiresAt  DateTime
+  createdAt  DateTime @default(now())
+
+  @@unique([clientId, jtiHash])
+  @@index([expiresAt])
+}
+
+model UserAccount {
+  id              String                   @id @default(cuid())
+  email           String                   @unique
+  displayName     String?
+  passwordHash    String
+  passwordSalt    String
+  disabledAt      DateTime?
+  createdAt       DateTime                 @default(now())
+  updatedAt       DateTime                 @updatedAt
+  lastLoginAt     DateTime?
+  ownedClients    Client[]                 @relation("ClientOwner")
+  browserSessions BrowserSession[]
+  consentGrants   OAuthConsentGrant[]
+  authRequests    OAuthAuthorizationRequest[]
+  authCodes       OAuthAuthorizationCode[]
+}
+
+model BrowserSession {
+  id               String      @id @default(cuid())
+  userId           String
+  user             UserAccount @relation(fields: [userId], references: [id], onDelete: Cascade)
+  sessionTokenHash String      @unique
+  createdAt        DateTime    @default(now())
+  lastUsedAt       DateTime    @default(now())
+  expiresAt        DateTime
+  revokedAt        DateTime?
+
+  @@index([expiresAt])
+  @@index([userId, expiresAt])
+}
+
+model OAuthConsentGrant {
+  id            String      @id @default(cuid())
+  clientId      String
+  client        Client      @relation(fields: [clientId], references: [id], onDelete: Cascade)
+  userId        String
+  user          UserAccount @relation(fields: [userId], references: [id], onDelete: Cascade)
+  grantedScopes String
+  createdAt     DateTime    @default(now())
+  updatedAt     DateTime    @updatedAt
+  revokedAt     DateTime?
+
+  @@unique([clientId, userId])
+  @@index([clientId])
+  @@index([userId])
+}
+
+model OAuthAuthorizationRequest {
+  id                  String       @id @default(cuid())
+  clientId            String
+  client              Client       @relation(fields: [clientId], references: [id], onDelete: Cascade)
+  userId              String?
+  user                UserAccount? @relation(fields: [userId], references: [id], onDelete: Cascade)
+  redirectUri         String
+  scope               String
+  state               String?
+  codeChallenge       String
+  codeChallengeMethod String       @default("S256")
+  expiresAt           DateTime
+  createdAt           DateTime     @default(now())
+  consumedAt          DateTime?
+
+  @@index([clientId, expiresAt])
+  @@index([userId, expiresAt])
+}
+
+model OAuthAuthorizationCode {
+  id                  String      @id @default(cuid())
+  clientId            String
+  client              Client      @relation(fields: [clientId], references: [id], onDelete: Cascade)
+  userId              String
+  user                UserAccount @relation(fields: [userId], references: [id], onDelete: Cascade)
+  codeHash            String      @unique
+  redirectUri         String
+  scope               String
+  codeChallenge       String
+  codeChallengeMethod String      @default("S256")
+  expiresAt           DateTime
+  createdAt           DateTime    @default(now())
+  usedAt              DateTime?
+
+  @@index([clientId, expiresAt])
+  @@index([userId, expiresAt])
+}
+
 model VerificationRecord {
   id            String   @id @default(cuid())
   apiKeyId      String
@@ -63,31 +198,31 @@ model WorkflowEvent {
 }
 
 model Receipt {
-  id               String   @id @default(uuid())
-  receiptHash      String
-  inputsCommitment String
-  policyProfile    String
-  parcelId         String?
-  decision         String
-  reasons          String
-  riskScore        Int
-  checks           String
-  rawInputsHash    String
-  signingKeyId     String?
-  createdAt        DateTime @default(now())
-  anchorStatus     String   @default("PENDING")
-  anchorTxHash     String?
-  anchorChainId    String?
-  anchorId         String?
-  anchorSubjectDigest  String?
-  anchorSubjectVersion String?
-  anchorAnchoredAt     DateTime?
-  fraudRisk        String?  // JSON
-  zkpAttestation   String?  // JSON
-  receiptSignature String?  // Compact JWS
-  receiptSignatureAlg String?
-  receiptSignatureKid String?
-  revoked          Boolean  @default(false)
+  id                    String   @id @default(uuid())
+  receiptHash           String
+  inputsCommitment      String
+  policyProfile         String
+  parcelId              String?
+  decision              String
+  reasons               String
+  riskScore             Int
+  checks                String
+  rawInputsHash         String
+  signingKeyId          String?
+  createdAt             DateTime @default(now())
+  anchorStatus          String   @default("PENDING")
+  anchorTxHash          String?
+  anchorChainId         String?
+  anchorId              String?
+  anchorSubjectDigest   String?
+  anchorSubjectVersion  String?
+  anchorAnchoredAt      DateTime?
+  fraudRisk             String?  // JSON
+  zkpAttestation        String?  // JSON
+  receiptSignature      String?  // Compact JWS
+  receiptSignatureAlg   String?
+  receiptSignatureKid   String?
+  revoked               Boolean  @default(false)
 }
 
 model Property {
@@ -132,36 +267,36 @@ model RegistrySource {
 }
 
 model RegistryCache {
-  id           String         @id @default(cuid())
-  sourceId     String
-  subjectHash  String
-  responseJson String
-  status       String
-  fetchedAt    DateTime       @default(now())
-  expiresAt    DateTime
+  id            String         @id @default(cuid())
+  sourceId      String
+  subjectHash   String
+  responseJson  String
+  status        String
+  fetchedAt     DateTime       @default(now())
+  expiresAt     DateTime
   sourceVersion String?
-  source       RegistrySource @relation(fields: [sourceId], references: [id], onDelete: Cascade)
+  source        RegistrySource @relation(fields: [sourceId], references: [id], onDelete: Cascade)
 
   @@unique([sourceId, subjectHash])
   @@index([expiresAt])
 }
 
 model RegistryOracleJob {
-  id              String         @id @default(cuid())
-  sourceId        String
-  subjectHash     String
-  zkCircuit       String
-  inputCommitment String
-  jobType         String         @default("VERIFY")
-  status          String
-  resultStatus    String?
-  proofUri        String?
-  error           String?
-  snapshotCapturedAt DateTime?
-  snapshotSourceVersion String?
-  createdAt       DateTime       @default(now())
-  completedAt     DateTime?
-  source          RegistrySource @relation(fields: [sourceId], references: [id], onDelete: Cascade)
+  id                     String         @id @default(cuid())
+  sourceId               String
+  subjectHash            String
+  zkCircuit              String
+  inputCommitment        String
+  jobType                String         @default("VERIFY")
+  status                 String
+  resultStatus           String?
+  proofUri               String?
+  error                  String?
+  snapshotCapturedAt     DateTime?
+  snapshotSourceVersion  String?
+  createdAt              DateTime       @default(now())
+  completedAt            DateTime?
+  source                 RegistrySource @relation(fields: [sourceId], references: [id], onDelete: Cascade)
 
   @@index([sourceId, createdAt])
   @@index([status])
diff --git a/apps/api/src/auth.ts b/apps/api/src/auth.ts
new file mode 100644
index 0000000..ec3dadd
--- /dev/null
+++ b/apps/api/src/auth.ts
@@ -0,0 +1,316 @@
+import { createHash, randomBytes, randomUUID, scrypt, timingSafeEqual } from 'node:crypto';
+import { promisify } from 'node:util';
+
+import {
+  createLocalJWKSet,
+  createRemoteJWKSet,
+  importJWK,
+  jwtVerify,
+  SignJWT,
+  type JWK,
+  type JWTVerifyResult
+} from 'jose';
+import { z } from 'zod';
+
+import type { AccessTokenConfig, AuthScope } from './security.js';
+
+const CLIENT_ASSERTION_TYPE = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer';
+const AUTHORIZATION_CODE_GRANT_TYPE = 'authorization_code';
+const SUPPORTED_SCOPES = ['verify', 'read', 'anchor', 'revoke'] as const;
+const SUPPORTED_CLIENT_TYPES = ['machine', 'integration', 'browser'] as const;
+const ASSERTION_MAX_AGE = '5m';
+const PKCE_CODE_CHALLENGE_METHOD = 'S256' as const;
+const PASSWORD_MIN_LENGTH = 12;
+const scryptAsync = promisify(scrypt);
+const scopeEnum = z.enum(SUPPORTED_SCOPES);
+
+const jwkSchema = z.object({ kty: z.string().min(1) }).passthrough();
+const redirectUriSchema = z.string().trim().url().max(2048);
+const codeChallengeSchema = z.string().trim().regex(/^[A-Za-z0-9_-]{43,128}$/);
+const codeVerifierSchema = z.string().trim().regex(/^[A-Za-z0-9._~-]{43,128}$/);
+const jwksSchema = z.union([
+  jwkSchema,
+  z.object({
+    keys: z.array(jwkSchema).min(1)
+  }).passthrough()
+]);
+
+export const clientRegistrationSchema = z
+  .object({
+    name: z.string().trim().min(1).max(120).optional(),
+    userEmail: z.string().trim().email().optional(),
+    clientType: z.enum(SUPPORTED_CLIENT_TYPES).default('machine'),
+    jwks: jwksSchema.optional(),
+    jwksUrl: z.string().trim().url().optional(),
+    redirectUris: z.array(redirectUriSchema).min(1).max(20).optional(),
+    scopes: z.array(scopeEnum).min(1).max(SUPPORTED_SCOPES.length).optional()
+  })
+  .superRefine((value, ctx) => {
+    if (value.clientType === 'browser') {
+      if ((value.redirectUris || []).length === 0) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: 'Provide redirectUris for browser clients',
+          path: ['redirectUris']
+        });
+      }
+      if (value.jwks || value.jwksUrl) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: 'Browser clients cannot register jwks or jwksUrl',
+          path: ['jwks']
+        });
+      }
+      return;
+    }
+
+    if (!value.jwks && !value.jwksUrl) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: 'Provide jwks or jwksUrl',
+        path: ['jwks']
+      });
+    }
+  });
+
+const clientCredentialsTokenRequestSchema = z.object({
+  grant_type: z.literal('client_credentials'),
+  client_assertion_type: z.literal(CLIENT_ASSERTION_TYPE),
+  client_assertion: z.string().trim().min(1),
+  scope: z.string().trim().optional()
+});
+
+export const authorizationCodeTokenRequestSchema = z.object({
+  grant_type: z.literal(AUTHORIZATION_CODE_GRANT_TYPE),
+  code: z.string().trim().min(1),
+  redirect_uri: redirectUriSchema,
+  client_id: z.string().trim().min(1),
+  code_verifier: codeVerifierSchema
+});
+
+export const tokenRequestSchema = z.discriminatedUnion('grant_type', [
+  clientCredentialsTokenRequestSchema,
+  authorizationCodeTokenRequestSchema
+]);
+
+export const oauthUserRegistrationSchema = z.object({
+  email: z.string().trim().email(),
+  password: z.string().min(PASSWORD_MIN_LENGTH).max(200),
+  displayName: z.string().trim().min(1).max(120).optional()
+});
+
+export const oauthLoginSchema = z.object({
+  email: z.string().trim().email(),
+  password: z.string().min(1).max(200),
+  return_to: z.string().trim().max(4096).optional()
+});
+
+export const oauthAuthorizeQuerySchema = z.object({
+  response_type: z.literal('code'),
+  client_id: z.string().trim().min(1),
+  redirect_uri: redirectUriSchema,
+  scope: z.string().trim().optional(),
+  state: z.string().trim().max(2048).optional(),
+  prompt: z.enum(['none', 'consent']).optional(),
+  code_challenge: codeChallengeSchema,
+  code_challenge_method: z.literal(PKCE_CODE_CHALLENGE_METHOD)
+});
+
+export const oauthAuthorizeDecisionSchema = z.object({
+  request_id: z.string().trim().min(1),
+  decision: z.enum(['approve', 'deny'])
+});
+
+type RegisteredClient = {
+  id: string;
+  clientType: string;
+  scopes: string;
+  plan: string;
+  usageLimit: number;
+  usageCount: number;
+  revokedAt: Date | null;
+  jwks: unknown;
+  jwksUrl: string | null;
+};
+
+function parseScopeSet(raw: string | null | undefined): Set<AuthScope> {
+  const result = new Set<AuthScope>();
+
+  for (const part of (raw || '').split(/[\s,|]+/)) {
+    const scope = part.trim() as AuthScope;
+    if ((SUPPORTED_SCOPES as readonly string[]).includes(scope)) {
+      result.add(scope);
+    }
+  }
+
+  return result;
+}
+
+export function normalizeJwks(value: unknown): { keys: JWK[] } {
+  const parsed = jwksSchema.parse(value);
+  if ('keys' in parsed) {
+    return { keys: parsed.keys as JWK[] };
+  }
+
+  return { keys: [parsed as JWK] };
+}
+
+export function hashOpaqueToken(value: string): string {
+  return createHash('sha256').update(value).digest('hex');
+}
+
+export function issueOpaqueToken(bytes = 32): string {
+  return randomBytes(bytes).toString('base64url');
+}
+
+export async function hashPasswordRecord(password: string): Promise<{ passwordHash: string; passwordSalt: string }> {
+  const salt = randomBytes(16).toString('base64url');
+  const derived = (await scryptAsync(password, salt, 64)) as Buffer;
+  return {
+    passwordHash: Buffer.from(derived).toString('base64url'),
+    passwordSalt: salt
+  };
+}
+
+export async function hashPassword(password: string): Promise<string> {
+  const { passwordHash, passwordSalt } = await hashPasswordRecord(password);
+  return `scrypt$${passwordSalt}$${passwordHash}`;
+}
+
+export async function verifyPasswordHash(
+  password: string,
+  storedHash: string | null | undefined,
+  storedSalt?: string | null | undefined
+): Promise<boolean> {
+  if (!storedHash) {
+    return false;
+  }
+
+  const [algorithm, saltEncoded, hashEncoded] = storedHash.split('$');
+  if (algorithm !== 'scrypt' || !saltEncoded || !hashEncoded) {
+    if (!storedSalt) {
+      return false;
+    }
+
+    const expected = Buffer.from(storedHash, 'base64url');
+    const derived = (await scryptAsync(password, storedSalt, expected.length)) as Buffer;
+    if (derived.length !== expected.length) {
+      return false;
+    }
+
+    return timingSafeEqual(Buffer.from(derived), expected);
+  }
+
+  const salt = Buffer.from(saltEncoded, 'base64url');
+  const expected = Buffer.from(hashEncoded, 'base64url');
+  const derived = (await scryptAsync(password, salt, expected.length)) as Buffer;
+  if (derived.length !== expected.length) {
+    return false;
+  }
+
+  return timingSafeEqual(Buffer.from(derived), expected);
+}
+
+export function derivePkceCodeChallenge(codeVerifier: string): string {
+  return createHash('sha256').update(codeVerifier).digest('base64url');
+}
+
+export function verifyPkceCodeVerifier(codeVerifier: string, expectedChallenge: string): boolean {
+  const derived = Buffer.from(derivePkceCodeChallenge(codeVerifier));
+  const expected = Buffer.from(expectedChallenge);
+  if (derived.length !== expected.length) {
+    return false;
+  }
+
+  return timingSafeEqual(derived, expected);
+}
+
+function buildAssertionAudiences(tokenAudience: string, requestUrl?: string): string[] {
+  return Array.from(new Set([tokenAudience, requestUrl].map((value) => (value || '').trim()).filter(Boolean)));
+}
+
+async function resolveAssertionKeySet(client: RegisteredClient) {
+  if (client.jwks) {
+    return createLocalJWKSet(normalizeJwks(client.jwks));
+  }
+
+  if (client.jwksUrl) {
+    return createRemoteJWKSet(new URL(client.jwksUrl));
+  }
+
+  throw new Error('client_has_no_registered_jwks');
+}
+
+export function resolveGrantedScopes(allowedScopesRaw: string, requestedScopesRaw?: string): string {
+  const allowedScopes = parseScopeSet(allowedScopesRaw);
+  const requestedScopes = parseScopeSet(requestedScopesRaw);
+
+  if (requestedScopes.size === 0) {
+    return Array.from(allowedScopes).join(' ');
+  }
+
+  const granted = Array.from(requestedScopes).filter((scope) => allowedScopes.has(scope));
+  return granted.join(' ');
+}
+
+export async function verifyClientAssertion(input: {
+  client: RegisteredClient;
+  clientAssertion: string;
+  tokenAudience: string;
+  requestUrl?: string;
+}): Promise<JWTVerifyResult> {
+  const keySet = await resolveAssertionKeySet(input.client);
+
+  return jwtVerify(input.clientAssertion, keySet, {
+    issuer: input.client.id,
+    subject: input.client.id,
+    audience: buildAssertionAudiences(input.tokenAudience, input.requestUrl),
+    algorithms: ['RS256', 'PS256', 'ES256', 'EdDSA'],
+    clockTolerance: '5s',
+    maxTokenAge: ASSERTION_MAX_AGE
+  });
+}
+
+export async function issueAccessToken(input: {
+  client: RegisteredClient;
+  requestedScope?: string;
+  accessTokenConfig: AccessTokenConfig;
+  subject?: string;
+  additionalClaims?: Record<string, unknown>;
+}) {
+  const grantedScope = resolveGrantedScopes(input.client.scopes, input.requestedScope);
+  if (!grantedScope) {
+    throw new Error('invalid_scope');
+  }
+
+  const privateKey = await importJWK(
+    input.accessTokenConfig.current.privateJwk,
+    input.accessTokenConfig.current.alg
+  );
+
+  const accessToken = await new SignJWT({
+    scope: grantedScope,
+    plan: input.client.plan,
+    usage_limit: input.client.usageLimit,
+    client_type: input.client.clientType,
+    ...(input.additionalClaims || {})
+  })
+    .setProtectedHeader({
+      alg: input.accessTokenConfig.current.alg,
+      kid: input.accessTokenConfig.current.kid,
+      typ: 'at+jwt'
+    })
+    .setIssuer(input.accessTokenConfig.issuer)
+    .setAudience(input.accessTokenConfig.audience)
+    .setSubject(input.subject || input.client.id)
+    .setJti(randomUUID())
+    .setIssuedAt()
+    .setExpirationTime(`${input.accessTokenConfig.ttlSeconds}s`)
+    .sign(privateKey);
+
+  return {
+    accessToken,
+    expiresIn: input.accessTokenConfig.ttlSeconds,
+    scope: grantedScope
+  };
+}
diff --git a/apps/api/src/db.ts b/apps/api/src/db.ts
index cda3f10..45f94a8 100644
--- a/apps/api/src/db.ts
+++ b/apps/api/src/db.ts
@@ -115,10 +115,114 @@ export async function ensureDatabase(prisma: PrismaClient) {
       "payload" JSONB NOT NULL,
       "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP
     )`,
+    `CREATE TABLE IF NOT EXISTS "Client" (
+      "id" TEXT PRIMARY KEY,
+      "name" TEXT,
+      "userEmail" TEXT,
+      "clientType" TEXT NOT NULL DEFAULT 'machine',
+      "scopes" TEXT NOT NULL DEFAULT 'verify read',
+      "jwks" JSONB,
+      "jwksUrl" TEXT,
+      "ownerUserId" TEXT REFERENCES "UserAccount"("id") ON DELETE SET NULL,
+      "subscriptionId" TEXT,
+      "plan" TEXT NOT NULL DEFAULT 'FREE',
+      "usageLimit" INTEGER NOT NULL DEFAULT 100,
+      "usageCount" INTEGER NOT NULL DEFAULT 0,
+      "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      "createdBy" TEXT NOT NULL DEFAULT 'self-service',
+      "revokedAt" TIMESTAMP(3),
+      "lastUsedAt" TIMESTAMP(3)
+    )`,
+    `CREATE TABLE IF NOT EXISTS "ClientAssertionNonce" (
+      "id" TEXT PRIMARY KEY,
+      "clientId" TEXT NOT NULL REFERENCES "Client"("id") ON DELETE CASCADE,
+      "jtiHash" TEXT NOT NULL,
+      "expiresAt" TIMESTAMP(3) NOT NULL,
+      "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP
+    )`,
+    `CREATE TABLE IF NOT EXISTS "ClientRedirectUri" (
+      "id" TEXT PRIMARY KEY,
+      "clientId" TEXT NOT NULL REFERENCES "Client"("id") ON DELETE CASCADE,
+      "redirectUri" TEXT NOT NULL,
+      "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP
+    )`,
+    `CREATE TABLE IF NOT EXISTS "UserAccount" (
+      "id" TEXT PRIMARY KEY,
+      "email" TEXT NOT NULL,
+      "displayName" TEXT,
+      "passwordHash" TEXT NOT NULL DEFAULT '',
+      "passwordSalt" TEXT NOT NULL DEFAULT '',
+      "disabledAt" TIMESTAMP(3),
+      "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      "updatedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      "lastLoginAt" TIMESTAMP(3)
+    )`,
+    `CREATE TABLE IF NOT EXISTS "BrowserSession" (
+      "id" TEXT PRIMARY KEY,
+      "userId" TEXT NOT NULL REFERENCES "UserAccount"("id") ON DELETE CASCADE,
+      "sessionTokenHash" TEXT NOT NULL,
+      "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      "lastUsedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      "expiresAt" TIMESTAMP(3) NOT NULL,
+      "revokedAt" TIMESTAMP(3)
+    )`,
+    `CREATE TABLE IF NOT EXISTS "OAuthConsentGrant" (
+      "id" TEXT PRIMARY KEY,
+      "clientId" TEXT NOT NULL REFERENCES "Client"("id") ON DELETE CASCADE,
+      "userId" TEXT NOT NULL REFERENCES "UserAccount"("id") ON DELETE CASCADE,
+      "grantedScopes" TEXT NOT NULL,
+      "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      "updatedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      "revokedAt" TIMESTAMP(3)
+    )`,
+    `CREATE TABLE IF NOT EXISTS "OAuthAuthorizationRequest" (
+      "id" TEXT PRIMARY KEY,
+      "clientId" TEXT NOT NULL REFERENCES "Client"("id") ON DELETE CASCADE,
+      "userId" TEXT REFERENCES "UserAccount"("id") ON DELETE CASCADE,
+      "redirectUri" TEXT NOT NULL,
+      "scope" TEXT NOT NULL,
+      "state" TEXT,
+      "codeChallenge" TEXT NOT NULL,
+      "codeChallengeMethod" TEXT NOT NULL DEFAULT 'S256',
+      "expiresAt" TIMESTAMP(3) NOT NULL,
+      "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      "consumedAt" TIMESTAMP(3)
+    )`,
+    `CREATE TABLE IF NOT EXISTS "OAuthAuthorizationCode" (
+      "id" TEXT PRIMARY KEY,
+      "clientId" TEXT NOT NULL REFERENCES "Client"("id") ON DELETE CASCADE,
+      "userId" TEXT NOT NULL REFERENCES "UserAccount"("id") ON DELETE CASCADE,
+      "codeHash" TEXT NOT NULL,
+      "redirectUri" TEXT NOT NULL,
+      "scope" TEXT NOT NULL,
+      "codeChallenge" TEXT NOT NULL,
+      "codeChallengeMethod" TEXT NOT NULL DEFAULT 'S256',
+      "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      "expiresAt" TIMESTAMP(3) NOT NULL,
+      "usedAt" TIMESTAMP(3)
+    )`,
     `ALTER TABLE "RegistrySource" ADD COLUMN IF NOT EXISTS "accessType" TEXT NOT NULL DEFAULT 'API'`,
     `ALTER TABLE "RegistryOracleJob" ADD COLUMN IF NOT EXISTS "jobType" TEXT NOT NULL DEFAULT 'VERIFY'`,
     `ALTER TABLE "RegistryOracleJob" ADD COLUMN IF NOT EXISTS "snapshotCapturedAt" TIMESTAMP(3)`,
     `ALTER TABLE "RegistryOracleJob" ADD COLUMN IF NOT EXISTS "snapshotSourceVersion" TEXT`,
+    `ALTER TABLE "Client" ADD COLUMN IF NOT EXISTS "clientType" TEXT NOT NULL DEFAULT 'machine'`,
+    `ALTER TABLE "Client" ADD COLUMN IF NOT EXISTS "scopes" TEXT NOT NULL DEFAULT 'verify read'`,
+    `ALTER TABLE "Client" ADD COLUMN IF NOT EXISTS "jwks" JSONB`,
+    `ALTER TABLE "Client" ADD COLUMN IF NOT EXISTS "jwksUrl" TEXT`,
+    `ALTER TABLE "Client" ADD COLUMN IF NOT EXISTS "ownerUserId" TEXT`,
+    `ALTER TABLE "Client" ADD COLUMN IF NOT EXISTS "subscriptionId" TEXT`,
+    `ALTER TABLE "Client" ADD COLUMN IF NOT EXISTS "plan" TEXT NOT NULL DEFAULT 'FREE'`,
+    `ALTER TABLE "Client" ADD COLUMN IF NOT EXISTS "usageLimit" INTEGER NOT NULL DEFAULT 100`,
+    `ALTER TABLE "Client" ADD COLUMN IF NOT EXISTS "usageCount" INTEGER NOT NULL DEFAULT 0`,
+    `ALTER TABLE "Client" ADD COLUMN IF NOT EXISTS "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP`,
+    `ALTER TABLE "Client" ADD COLUMN IF NOT EXISTS "createdBy" TEXT NOT NULL DEFAULT 'self-service'`,
+    `ALTER TABLE "Client" ADD COLUMN IF NOT EXISTS "revokedAt" TIMESTAMP(3)`,
+    `ALTER TABLE "Client" ADD COLUMN IF NOT EXISTS "lastUsedAt" TIMESTAMP(3)`,
+    `ALTER TABLE "ClientAssertionNonce" ADD COLUMN IF NOT EXISTS "jtiHash" TEXT NOT NULL DEFAULT ''`,
+    `ALTER TABLE "ClientAssertionNonce" ADD COLUMN IF NOT EXISTS "expiresAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP`,
+    `ALTER TABLE "ClientAssertionNonce" ADD COLUMN IF NOT EXISTS "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP`,
+    `ALTER TABLE "UserAccount" ADD COLUMN IF NOT EXISTS "passwordSalt" TEXT NOT NULL DEFAULT ''`,
+    `ALTER TABLE "UserAccount" ADD COLUMN IF NOT EXISTS "lastLoginAt" TIMESTAMP(3)`,
     `CREATE UNIQUE INDEX IF NOT EXISTS "RegistryCache_sourceId_subjectHash_key"
       ON "RegistryCache" ("sourceId", "subjectHash")`,
     `CREATE INDEX IF NOT EXISTS "RegistryCache_expiresAt_idx"
@@ -132,7 +236,43 @@ export async function ensureDatabase(prisma: PrismaClient) {
     `CREATE INDEX IF NOT EXISTS "WorkflowEvent_workflowId_timestamp_idx"
       ON "WorkflowEvent" ("workflowId", "timestamp")`,
     `CREATE INDEX IF NOT EXISTS "RegistrySource_active_idx"
-      ON "RegistrySource" ("active")`
+      ON "RegistrySource" ("active")`,
+    `CREATE INDEX IF NOT EXISTS "Client_revokedAt_idx"
+      ON "Client" ("revokedAt")`,
+    `CREATE INDEX IF NOT EXISTS "Client_ownerUserId_idx"
+      ON "Client" ("ownerUserId")`,
+    `CREATE UNIQUE INDEX IF NOT EXISTS "ClientAssertionNonce_clientId_jtiHash_key"
+      ON "ClientAssertionNonce" ("clientId", "jtiHash")`,
+    `CREATE INDEX IF NOT EXISTS "ClientAssertionNonce_expiresAt_idx"
+      ON "ClientAssertionNonce" ("expiresAt")`,
+    `CREATE UNIQUE INDEX IF NOT EXISTS "ClientRedirectUri_clientId_redirectUri_key"
+      ON "ClientRedirectUri" ("clientId", "redirectUri")`,
+    `CREATE INDEX IF NOT EXISTS "ClientRedirectUri_clientId_idx"
+      ON "ClientRedirectUri" ("clientId")`,
+    `CREATE UNIQUE INDEX IF NOT EXISTS "UserAccount_email_key"
+      ON "UserAccount" ("email")`,
+    `CREATE UNIQUE INDEX IF NOT EXISTS "BrowserSession_sessionTokenHash_key"
+      ON "BrowserSession" ("sessionTokenHash")`,
+    `CREATE INDEX IF NOT EXISTS "BrowserSession_expiresAt_idx"
+      ON "BrowserSession" ("expiresAt")`,
+    `CREATE INDEX IF NOT EXISTS "BrowserSession_userId_expiresAt_idx"
+      ON "BrowserSession" ("userId", "expiresAt")`,
+    `CREATE UNIQUE INDEX IF NOT EXISTS "OAuthConsentGrant_clientId_userId_key"
+      ON "OAuthConsentGrant" ("clientId", "userId")`,
+    `CREATE INDEX IF NOT EXISTS "OAuthConsentGrant_clientId_idx"
+      ON "OAuthConsentGrant" ("clientId")`,
+    `CREATE INDEX IF NOT EXISTS "OAuthConsentGrant_userId_idx"
+      ON "OAuthConsentGrant" ("userId")`,
+    `CREATE INDEX IF NOT EXISTS "OAuthAuthorizationRequest_clientId_expiresAt_idx"
+      ON "OAuthAuthorizationRequest" ("clientId", "expiresAt")`,
+    `CREATE INDEX IF NOT EXISTS "OAuthAuthorizationRequest_userId_expiresAt_idx"
+      ON "OAuthAuthorizationRequest" ("userId", "expiresAt")`,
+    `CREATE UNIQUE INDEX IF NOT EXISTS "OAuthAuthorizationCode_codeHash_key"
+      ON "OAuthAuthorizationCode" ("codeHash")`,
+    `CREATE INDEX IF NOT EXISTS "OAuthAuthorizationCode_clientId_expiresAt_idx"
+      ON "OAuthAuthorizationCode" ("clientId", "expiresAt")`,
+    `CREATE INDEX IF NOT EXISTS "OAuthAuthorizationCode_userId_expiresAt_idx"
+      ON "OAuthAuthorizationCode" ("userId", "expiresAt")`
   ];
 
   for (const sql of statements) {
diff --git a/apps/api/src/replayStore.ts b/apps/api/src/replayStore.ts
new file mode 100644
index 0000000..466a85e
--- /dev/null
+++ b/apps/api/src/replayStore.ts
@@ -0,0 +1,231 @@
+import { createHash } from 'node:crypto';
+import net from 'node:net';
+import tls from 'node:tls';
+
+import { PrismaClient } from '@prisma/client';
+
+type ReplayReservationInput = {
+  clientId: string;
+  jti: string;
+  expiresAt: Date;
+};
+
+export interface AssertionReplayStore {
+  reserve(input: ReplayReservationInput): Promise<boolean>;
+}
+
+function hashAssertionJti(clientId: string, jti: string): string {
+  return createHash('sha256').update(`${clientId}:${jti}`).digest('hex');
+}
+
+export class PrismaAssertionReplayStore implements AssertionReplayStore {
+  constructor(private readonly prisma: PrismaClient) {}
+
+  async reserve(input: ReplayReservationInput): Promise<boolean> {
+    await this.prisma.clientAssertionNonce.deleteMany({
+      where: {
+        expiresAt: {
+          lt: new Date()
+        }
+      }
+    });
+
+    try {
+      await this.prisma.clientAssertionNonce.create({
+        data: {
+          clientId: input.clientId,
+          jtiHash: hashAssertionJti(input.clientId, input.jti),
+          expiresAt: input.expiresAt
+        }
+      });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+}
+
+type RedisConnectionConfig = {
+  host: string;
+  port: number;
+  username?: string;
+  password?: string;
+  database?: number;
+  tls: boolean;
+};
+
+export class RedisAssertionReplayStore implements AssertionReplayStore {
+  constructor(private readonly redisUrl: string) {}
+
+  async reserve(input: ReplayReservationInput): Promise<boolean> {
+    const key = `trustsignal:assertion-jti:${input.clientId}:${hashAssertionJti(input.clientId, input.jti)}`;
+    const ttlSeconds = Math.max(1, Math.ceil((input.expiresAt.getTime() - Date.now()) / 1000));
+    const connection = parseRedisUrl(this.redisUrl);
+    const socket = await connectRedis(connection);
+
+    try {
+      if (connection.password) {
+        if (connection.username) {
+          await sendRedisCommand(socket, ['AUTH', connection.username, connection.password]);
+        } else {
+          await sendRedisCommand(socket, ['AUTH', connection.password]);
+        }
+      }
+
+      if (typeof connection.database === 'number' && Number.isFinite(connection.database)) {
+        await sendRedisCommand(socket, ['SELECT', String(connection.database)]);
+      }
+
+      const reply = await sendRedisCommand(socket, ['SET', key, '1', 'EX', String(ttlSeconds), 'NX']);
+      return reply === 'OK';
+    } finally {
+      socket.end();
+      socket.destroy();
+    }
+  }
+}
+
+export function buildAssertionReplayStore(prisma: PrismaClient, env: NodeJS.ProcessEnv = process.env): AssertionReplayStore {
+  const redisUrl = (env.TRUSTSIGNAL_REPLAY_REDIS_URL || '').trim();
+  if (redisUrl) {
+    return new RedisAssertionReplayStore(redisUrl);
+  }
+
+  return new PrismaAssertionReplayStore(prisma);
+}
+
+function parseRedisUrl(redisUrl: string): RedisConnectionConfig {
+  const parsed = new URL(redisUrl);
+  if (parsed.protocol !== 'redis:' && parsed.protocol !== 'rediss:') {
+    throw new Error('TRUSTSIGNAL_REPLAY_REDIS_URL must use redis:// or rediss://');
+  }
+
+  const database = parsed.pathname && parsed.pathname !== '/' ? Number.parseInt(parsed.pathname.slice(1), 10) : undefined;
+
+  return {
+    host: parsed.hostname,
+    port: parsed.port ? Number.parseInt(parsed.port, 10) : parsed.protocol === 'rediss:' ? 6380 : 6379,
+    username: parsed.username ? decodeURIComponent(parsed.username) : undefined,
+    password: parsed.password ? decodeURIComponent(parsed.password) : undefined,
+    database: Number.isFinite(database) ? database : undefined,
+    tls: parsed.protocol === 'rediss:'
+  };
+}
+
+function connectRedis(config: RedisConnectionConfig): Promise<net.Socket | tls.TLSSocket> {
+  return new Promise((resolve, reject) => {
+    const socket = config.tls
+      ? tls.connect({
+          host: config.host,
+          port: config.port
+        })
+      : net.createConnection({
+          host: config.host,
+          port: config.port
+        });
+
+    const onError = (error: Error) => {
+      cleanup();
+      socket.destroy();
+      reject(error);
+    };
+
+    const onReady = () => {
+      cleanup();
+      resolve(socket);
+    };
+
+    const cleanup = () => {
+      socket.removeListener('error', onError);
+      socket.removeListener(config.tls ? 'secureConnect' : 'connect', onReady);
+    };
+
+    socket.once('error', onError);
+    socket.once(config.tls ? 'secureConnect' : 'connect', onReady);
+  });
+}
+
+function sendRedisCommand(socket: net.Socket | tls.TLSSocket, parts: string[]): Promise<string | null> {
+  return new Promise((resolve, reject) => {
+    let buffer = '';
+
+    const cleanup = () => {
+      socket.off('data', onData);
+      socket.off('error', onError);
+      socket.off('close', onClose);
+    };
+
+    const onError = (error: Error) => {
+      cleanup();
+      reject(error);
+    };
+
+    const onClose = () => {
+      cleanup();
+      reject(new Error('Redis connection closed before reply'));
+    };
+
+    const onData = (chunk: Buffer) => {
+      buffer += chunk.toString('utf8');
+      const parsed = tryParseResp(buffer);
+      if (!parsed.complete) {
+        return;
+      }
+
+      cleanup();
+      if (parsed.error) {
+        reject(new Error(parsed.error));
+        return;
+      }
+      resolve(parsed.value);
+    };
+
+    socket.on('data', onData);
+    socket.once('error', onError);
+    socket.once('close', onClose);
+    socket.write(encodeResp(parts));
+  });
+}
+
+function encodeResp(parts: string[]): string {
+  return `*${parts.length}\r\n${parts.map((part) => `$${Buffer.byteLength(part)}\r\n${part}\r\n`).join('')}`;
+}
+
+function tryParseResp(payload: string): { complete: boolean; value: string | null; error?: string } {
+  if (!payload.includes('\r\n')) {
+    return { complete: false, value: null };
+  }
+
+  const prefix = payload[0];
+  const lineEnd = payload.indexOf('\r\n');
+  const line = payload.slice(1, lineEnd);
+
+  if (prefix === '+') {
+    return { complete: true, value: line };
+  }
+
+  if (prefix === '-') {
+    return { complete: true, value: null, error: line };
+  }
+
+  if (prefix === ':') {
+    return { complete: true, value: line };
+  }
+
+  if (prefix === '$') {
+    const length = Number.parseInt(line, 10);
+    if (length === -1) {
+      return { complete: true, value: null };
+    }
+
+    const expectedEnd = lineEnd + 2 + length + 2;
+    if (payload.length < expectedEnd) {
+      return { complete: false, value: null };
+    }
+
+    const value = payload.slice(lineEnd + 2, lineEnd + 2 + length);
+    return { complete: true, value };
+  }
+
+  return { complete: false, value: null };
+}
diff --git a/apps/api/src/server.ts b/apps/api/src/server.ts
index 8248259..7db720d 100644
--- a/apps/api/src/server.ts
+++ b/apps/api/src/server.ts
@@ -1,5 +1,5 @@
 import { Buffer } from 'node:buffer';
-import { randomUUID } from 'crypto';
+import { randomUUID, timingSafeEqual } from 'crypto';
 
 import { PrismaClient } from '@prisma/client';
 import Fastify from 'fastify';
@@ -44,6 +44,24 @@ import { ensureDatabase } from './db.js';
 import { loadRegistry } from './registryLoader.js';
 import { renderReceiptPdf } from './receiptPdf.js';
 import { loadRuntimeEnv, resolveDatabaseUrl } from './env.js';
+import {
+  hashOpaqueToken,
+  hashPasswordRecord,
+  clientRegistrationSchema,
+  issueAccessToken,
+  issueOpaqueToken,
+  normalizeJwks,
+  oauthAuthorizeDecisionSchema,
+  oauthAuthorizeQuerySchema,
+  oauthLoginSchema,
+  oauthUserRegistrationSchema,
+  resolveGrantedScopes,
+  tokenRequestSchema,
+  verifyPasswordHash,
+  verifyPkceCodeVerifier,
+  verifyClientAssertion
+} from './auth.js';
+import { buildAssertionReplayStore, type AssertionReplayStore } from './replayStore.js';
 import { HttpAttomClient } from './services/attomClient.js';
 import { CookCountyComplianceValidator } from './services/compliance.js';
 import {
@@ -57,6 +75,7 @@ import {
   getApiRateLimitKey,
   isCorsOriginAllowed,
   requireApiKeyScope,
+  verifyAccessTokenPayload,
   type SecurityConfig,
   verifyRevocationHeaders
 } from './security.js';
@@ -139,6 +158,20 @@ const registryVerifyBatchInputSchema = z.object({
 const receiptIdParamSchema = z.object({
   receiptId: z.string().uuid()
 });
+const clientIdParamSchema = z.object({
+  clientId: z.string().min(1)
+});
+const clientKeyParamSchema = z.object({
+  clientId: z.string().min(1),
+  kid: z.string().min(1)
+});
+const clientKeyCreateSchema = z.object({
+  jwk: z.object({ kty: z.string().min(1) }).passthrough()
+});
+const tokenIntrospectionSchema = z.object({
+  token: z.string().trim().min(1),
+  token_type_hint: z.string().trim().optional()
+});
 
 const vantaVerificationResultSchema = z.object({
   schemaVersion: z.literal('trustsignal.vanta.verification_result.v1'),
@@ -390,6 +423,90 @@ function normalizeForwardedProto(value: string | string[] | undefined): string |
   return first || null;
 }
 
+function buildExternalUrl(request: FastifyRequest, pathname: string): string | undefined {
+  const host = request.headers.host;
+  if (!host) return undefined;
+
+  const proto =
+    normalizeForwardedProto(request.headers['x-forwarded-proto']) ||
+    ((request.socket as { encrypted?: boolean }).encrypted ? 'https' : 'http');
+  return `${proto}://${host}${pathname}`;
+}
+
+function parseCookieHeader(headerValue: string | undefined): Map<string, string> {
+  const cookies = new Map<string, string>();
+  if (!headerValue) {
+    return cookies;
+  }
+
+  for (const part of headerValue.split(';')) {
+    const [name, ...rest] = part.trim().split('=');
+    if (!name) {
+      continue;
+    }
+    const raw = rest.join('=');
+    let decoded: string;
+    try {
+      decoded = decodeURIComponent(raw);
+    } catch {
+      decoded = raw;
+    }
+    cookies.set(name, decoded);
+  }
+
+  return cookies;
+}
+
+function serializeCookie(name: string, value: string, options: {
+  httpOnly?: boolean;
+  maxAgeSeconds?: number;
+  path?: string;
+  sameSite?: 'Lax' | 'Strict' | 'None';
+  secure?: boolean;
+} = {}): string {
+  const parts = [`${name}=${encodeURIComponent(value)}`];
+  parts.push(`Path=${options.path || '/'}`);
+  if (typeof options.maxAgeSeconds === 'number') {
+    parts.push(`Max-Age=${Math.max(0, Math.floor(options.maxAgeSeconds))}`);
+  }
+  if (options.httpOnly !== false) {
+    parts.push('HttpOnly');
+  }
+  if (options.sameSite) {
+    parts.push(`SameSite=${options.sameSite}`);
+  }
+  if (options.secure) {
+    parts.push('Secure');
+  }
+  return parts.join('; ');
+}
+
+function appendQueryParams(targetUrl: string, values: Record<string, string | undefined>): string {
+  // new URL() throws on relative paths, so handle them without it
+  const [base, existing] = targetUrl.split('?') as [string, string | undefined];
+  const params = new URLSearchParams(existing ?? '');
+  for (const [key, value] of Object.entries(values)) {
+    if (typeof value === 'string' && value.length > 0) {
+      params.set(key, value);
+    }
+  }
+  const qs = params.toString();
+  return qs ? `${base}?${qs}` : base;
+}
+
+function buildHtmlPage(title: string, body: string): string {
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><title>${title}</title></head><body>${body}</body></html>`;
+}
+
+function escapeHtml(value: string): string {
+  return value
+    .replaceAll('&', '&amp;')
+    .replaceAll('<', '&lt;')
+    .replaceAll('>', '&gt;')
+    .replaceAll('"', '&quot;')
+    .replaceAll("'", '&#39;');
+}
+
 function databaseUrlHasRequiredSslMode(databaseUrl: string | undefined): boolean {
   if (!databaseUrl) return false;
   try {
@@ -827,6 +944,7 @@ class BlockchainVerifier {
 }
 
 type BuildServerOptions = {
+  assertionReplayStore?: AssertionReplayStore;
   fetchImpl?: typeof fetch;
   logger?: boolean | Record<string, unknown>;
   workflowEventSink?: WorkflowEventSink;
@@ -844,6 +962,16 @@ export async function buildServer(options: BuildServerOptions = {}) {
   requireProductionVerifierConfig();
   const app = Fastify({ logger: options.logger ?? true });
   const securityConfig = buildSecurityConfig();
+  const assertionReplayStore = options.assertionReplayStore ?? buildAssertionReplayStore(prisma);
+  const browserSessionStore = (prisma as PrismaClient & { browserSession: any }).browserSession;
+  const oauthConsentGrantStore = (prisma as PrismaClient & { oAuthConsentGrant: any }).oAuthConsentGrant;
+  const oauthAuthorizationRequestStore = (prisma as PrismaClient & { oAuthAuthorizationRequest: any }).oAuthAuthorizationRequest;
+  const oauthAuthorizationCodeStore = (prisma as PrismaClient & { oAuthAuthorizationCode: any }).oAuthAuthorizationCode;
+  const userAccountStore = (prisma as PrismaClient & { userAccount: any }).userAccount;
+  const oauthSessionCookieName = (process.env.TRUSTSIGNAL_OAUTH_SESSION_COOKIE_NAME || 'trustsignal_oauth_session').trim();
+  const oauthSessionTtlSeconds = Math.max(300, Number.parseInt(process.env.TRUSTSIGNAL_OAUTH_SESSION_TTL_SECONDS || '43200', 10) || 43200);
+  const oauthAuthorizationCodeTtlSeconds = Math.max(60, Number.parseInt(process.env.TRUSTSIGNAL_OAUTH_CODE_TTL_SECONDS || '300', 10) || 300);
+  const oauthCookieSecure = (process.env.NODE_ENV || 'development') === 'production';
   const propertyApiKey = resolvePropertyApiKey();
   const registryAdapterService = createRegistryAdapterService(prisma, {
     fetchImpl: options.fetchImpl
@@ -889,11 +1017,100 @@ export async function buildServer(options: BuildServerOptions = {}) {
     buckets: [0.1, 0.25, 0.5, 1, 2, 5, 10],
     registers: [metricsRegistry]
   });
+  const tokenIssuanceTotal = new Counter({
+    name: 'trustsignal_token_issuance_total',
+    help: 'Token issuance attempts by outcome',
+    labelNames: ['outcome'] as const,
+    registers: [metricsRegistry]
+  });
+  const tokenIssuanceFailuresTotal = new Counter({
+    name: 'trustsignal_token_issuance_failures_total',
+    help: 'Token issuance failures by reason',
+    labelNames: ['reason'] as const,
+    registers: [metricsRegistry]
+  });
+  const tokenReplayRejectionsTotal = new Counter({
+    name: 'trustsignal_token_replay_rejections_total',
+    help: 'Rejected replayed client assertion attempts',
+    labelNames: [] as const,
+    registers: [metricsRegistry]
+  });
+  const clientRevocationsTotal = new Counter({
+    name: 'trustsignal_client_revocations_total',
+    help: 'Client revocations processed',
+    labelNames: [] as const,
+    registers: [metricsRegistry]
+  });
+  const oauthLoginTotal = new Counter({
+    name: 'trustsignal_oauth_login_total',
+    help: 'Browser OAuth login attempts by outcome',
+    labelNames: ['outcome'] as const,
+    registers: [metricsRegistry]
+  });
+  const oauthAuthorizationCodeTotal = new Counter({
+    name: 'trustsignal_oauth_authorization_code_total',
+    help: 'OAuth authorization code issuance attempts by outcome',
+    labelNames: ['outcome'] as const,
+    registers: [metricsRegistry]
+  });
   const perApiKeyRateLimit = {
     max: securityConfig.perApiKeyRateLimitMax,
     timeWindow: securityConfig.rateLimitWindow,
     keyGenerator: getApiRateLimitKey
   };
+  const requireActiveClient = async (request: FastifyRequest, reply: FastifyReply) => {
+    const clientId = request.authContext?.clientId;
+    if (!clientId) {
+      return;
+    }
+
+    const client = await prisma.client.findUnique({
+      where: { id: clientId },
+      select: { revokedAt: true }
+    });
+    if (!client || client.revokedAt) {
+      await reply.code(403).send({ error: 'client_revoked' });
+      return;
+    }
+
+    if (request.authContext?.userId) {
+      const user = await userAccountStore.findUnique({
+        where: { id: request.authContext.userId },
+        select: { disabledAt: true }
+      });
+      if (!user || user.disabledAt) {
+        await reply.code(403).send({ error: 'user_disabled' });
+      }
+    }
+  };
+  const authPreHandlers = {
+    read: [requireApiKeyScope(securityConfig, 'read'), requireActiveClient],
+    verify: [requireApiKeyScope(securityConfig, 'verify'), requireActiveClient],
+    anchor: [requireApiKeyScope(securityConfig, 'anchor'), requireActiveClient],
+    revoke: [requireApiKeyScope(securityConfig, 'revoke'), requireActiveClient]
+  };
+  const requireClientOwnership = async (request: FastifyRequest, reply: FastifyReply) => {
+    const params = clientIdParamSchema.safeParse(request.params);
+    if (!params.success) {
+      await reply.code(400).send({ error: 'invalid_client_id' });
+      return;
+    }
+
+    const authenticatedClientId = request.authContext?.clientId;
+    if (!authenticatedClientId) {
+      await reply.code(403).send({ error: 'client_token_required' });
+      return;
+    }
+
+    if (authenticatedClientId !== params.data.clientId) {
+      await reply.code(403).send({ error: 'client_mismatch' });
+    }
+  };
+  const requireNoRequestBody = async (request: FastifyRequest, reply: FastifyReply) => {
+    if (hasUnexpectedBody(request.body)) {
+      await reply.code(400).send({ error: 'unexpected_body' });
+    }
+  };
 
   app.addHook('onRequest', async (request) => {
     (request as RequestTimerState)[REQUEST_START] = Date.now();
@@ -931,6 +1148,17 @@ export async function buildServer(options: BuildServerOptions = {}) {
       requestId: request.id
     })
   });
+  app.addContentTypeParser(
+    'application/x-www-form-urlencoded',
+    { parseAs: 'string' },
+    (_request, body, done) => {
+      try {
+        done(null, Object.fromEntries(new URLSearchParams(String(body))));
+      } catch (error) {
+        done(error as Error);
+      }
+    }
+  );
   let databaseReady = true;
   let databaseInitError: string | null = null;
   try {
@@ -959,6 +1187,220 @@ export async function buildServer(options: BuildServerOptions = {}) {
     eventSink: workflowEventSink
   });
 
+  const buildOauthSetCookie = (value: string, maxAgeSeconds = oauthSessionTtlSeconds) =>
+    serializeCookie(oauthSessionCookieName, value, {
+      httpOnly: true,
+      maxAgeSeconds,
+      path: '/',
+      sameSite: 'Lax',
+      secure: oauthCookieSecure
+    });
+
+  const clearOauthSessionCookie = () =>
+    serializeCookie(oauthSessionCookieName, '', {
+      httpOnly: true,
+      maxAgeSeconds: 0,
+      path: '/',
+      sameSite: 'Lax',
+      secure: oauthCookieSecure
+    });
+
+  const getOauthSessionCookie = (request: FastifyRequest): string | null => {
+    const cookieHeader = request.headers.cookie;
+    const raw = parseCookieHeader(typeof cookieHeader === 'string' ? cookieHeader : undefined).get(oauthSessionCookieName);
+    return raw || null;
+  };
+
+  const resolveReturnTo = (request: FastifyRequest, rawValue: string | undefined): string => {
+    const trimmed = (rawValue || '').trim();
+    if (!trimmed) {
+      return '/api/v1/oauth/authorize';
+    }
+    if (trimmed.startsWith('/')) {
+      return trimmed;
+    }
+
+    try {
+      const url = new URL(trimmed);
+      const origin = buildExternalUrl(request, '')?.replace(/\/$/, '');
+      if (origin && `${url.protocol}//${url.host}` === origin) {
+        return `${url.pathname}${url.search}${url.hash}`;
+      }
+    } catch {
+      return '/api/v1/oauth/authorize';
+    }
+
+    return '/api/v1/oauth/authorize';
+  };
+
+  const buildAuthorizationReturnTo = (input: {
+    clientId: string;
+    redirectUri: string;
+    scope: string;
+    state?: string | null;
+    codeChallenge: string;
+    codeChallengeMethod?: string | null;
+  }) =>
+    appendQueryParams('/api/v1/oauth/authorize', {
+      response_type: 'code',
+      client_id: input.clientId,
+      redirect_uri: input.redirectUri,
+      scope: input.scope,
+      state: input.state || undefined,
+      code_challenge: input.codeChallenge,
+      code_challenge_method: input.codeChallengeMethod || 'S256'
+    });
+
+  const issueBrowserSession = async (request: FastifyRequest, userId: string) => {
+    const sessionSecret = issueOpaqueToken(32);
+    const sessionToken = issueOpaqueToken(16);
+    const expiresAt = new Date(Date.now() + oauthSessionTtlSeconds * 1000);
+    const record = await browserSessionStore.create({
+      data: {
+        userId,
+        sessionTokenHash: hashOpaqueToken(`${sessionToken}.${sessionSecret}`),
+        expiresAt
+      }
+    });
+
+    return {
+      cookieValue: `${record.id}.${sessionToken}.${sessionSecret}`,
+      expiresAt
+    };
+  };
+
+  const loadAuthenticatedBrowserSession = async (request: FastifyRequest) => {
+    const rawCookie = getOauthSessionCookie(request);
+    if (!rawCookie) {
+      return null;
+    }
+
+    const [sessionId, sessionToken, sessionSecret] = rawCookie.split('.');
+    if (!sessionId || !sessionToken || !sessionSecret) {
+      return null;
+    }
+
+    const session = await browserSessionStore.findUnique({
+      where: { id: sessionId },
+      include: {
+        user: {
+          select: {
+            id: true,
+            email: true,
+            displayName: true,
+            disabledAt: true
+          }
+        }
+      }
+    });
+    if (!session || session.revokedAt || session.expiresAt <= new Date()) {
+      return null;
+    }
+
+    const presentedHash = hashOpaqueToken(`${sessionToken}.${sessionSecret}`);
+    const expectedHash = session.sessionTokenHash;
+    if (
+      presentedHash.length !== expectedHash.length ||
+      !timingSafeEqual(Buffer.from(presentedHash), Buffer.from(expectedHash))
+    ) {
+      return null;
+    }
+
+    await browserSessionStore.update({
+      where: { id: session.id },
+      data: { lastUsedAt: new Date() }
+    });
+
+    return session;
+  };
+
+  const issueAuthorizationCode = async (input: {
+    clientId: string;
+    userId: string;
+    sessionId?: string | null;
+    consentGrantId?: string | null;
+    redirectUri: string;
+    scope: string;
+    state?: string;
+    nonce?: string;
+    codeChallenge: string;
+  }) => {
+    const code = issueOpaqueToken(32);
+    await oauthAuthorizationCodeStore.create({
+      data: {
+        clientId: input.clientId,
+        userId: input.userId,
+        codeHash: hashOpaqueToken(code),
+        redirectUri: input.redirectUri,
+        scope: input.scope,
+        codeChallenge: input.codeChallenge,
+        codeChallengeMethod: 'S256',
+        expiresAt: new Date(Date.now() + oauthAuthorizationCodeTtlSeconds * 1000)
+      }
+    });
+    return code;
+  };
+
+  const findOAuthClientWithRedirects = (clientId: string) =>
+    prisma.client.findUnique({
+      where: { id: clientId },
+      include: {
+        redirectUris: true
+      }
+    });
+
+  const redirectWithOauthResult = (reply: FastifyReply, redirectUri: string, values: Record<string, string | undefined>) =>
+    reply.redirect(appendQueryParams(redirectUri, values), 303);
+
+  const reserveMeteredUsage = async (request: FastifyRequest, reply: FastifyReply) => {
+    const clientId = request.authContext?.clientId;
+    if (!clientId) {
+      return true;
+    }
+    if (request.authContext?.userId) {
+      return true;
+    }
+
+    const reserved = await prisma.$queryRaw<Array<{ id: string; usageLimit: number; usageCount: number }>>`
+      UPDATE "Client"
+      SET "usageCount" = "usageCount" + 1,
+          "lastUsedAt" = CURRENT_TIMESTAMP
+      WHERE "id" = ${clientId}
+        AND "revokedAt" IS NULL
+        AND "usageCount" < "usageLimit"
+      RETURNING "id", "usageLimit", "usageCount"
+    `;
+
+    if (reserved.length > 0) {
+      return true;
+    }
+
+    const client = await prisma.client.findUnique({
+      where: { id: clientId },
+      select: {
+        revokedAt: true,
+        usageLimit: true,
+        usageCount: true
+      }
+    });
+    if (!client || client.revokedAt) {
+      await reply.code(403).send({ error: 'client_revoked' });
+      return false;
+    }
+
+    if (client.usageCount >= client.usageLimit) {
+      await reply.code(429).send({
+        error: 'usage_limit_exceeded',
+        usageLimit: client.usageLimit,
+        usageCount: client.usageCount
+      });
+      return false;
+    }
+
+    await reply.code(503).send({ error: 'usage_reservation_failed' });
+    return false;
+  };
+
   const dbOptionalRoutes = new Set([
     '/api/v1/health',
     '/api/v1/status',
@@ -1016,8 +1458,1008 @@ export async function buildServer(options: BuildServerOptions = {}) {
     return reply.send(await metricsRegistry.metrics());
   });
 
+  app.get('/api/v1/clients', {
+    config: {
+      rateLimit: {
+        max: 30,
+        timeWindow: '1 minute',
+        keyGenerator: (request) => request.ip
+      }
+    }
+  }, async (request, reply) => {
+    const { userEmail, clientType } = request.query as { userEmail?: string; clientType?: string };
+    if (!userEmail || typeof userEmail !== 'string' || !userEmail.includes('@')) {
+      return reply.code(400).send({ error: 'userEmail query param is required' });
+    }
+    const where: Record<string, unknown> = { userEmail: userEmail.trim().toLowerCase() };
+    if (clientType) {
+      where.clientType = clientType;
+    }
+    const clients = await prisma.client.findMany({
+      where,
+      select: {
+        id: true,
+        clientType: true,
+        name: true,
+        scopes: true,
+        createdAt: true
+      },
+      orderBy: { createdAt: 'desc' }
+    });
+    return reply.send({
+      clients: clients.map((c: { id: string; clientType: string; name: string | null; scopes: string; createdAt: Date }) => ({
+        client_id: c.id,
+        client_type: c.clientType,
+        name: c.name ?? null,
+        scope: c.scopes,
+        created_at: c.createdAt.toISOString()
+      }))
+    });
+  });
+
+  app.post('/api/v1/clients', {
+    config: {
+      rateLimit: {
+        max: 10,
+        timeWindow: '1 minute',
+        keyGenerator: (request) => request.ip
+      }
+    }
+  }, async (request, reply) => {
+    const parsed = clientRegistrationSchema.safeParse(request.body);
+    if (!parsed.success) {
+      return reply.code(400).send({ error: 'invalid_client_registration', details: parsed.error.flatten() });
+    }
+
+    if (parsed.data.clientType === 'browser') {
+      const session = await loadAuthenticatedBrowserSession(request);
+      if (!session) {
+        return reply.code(401).send({ error: 'login_required' });
+      }
+      if (session.user.disabledAt) {
+        reply.header('set-cookie', clearOauthSessionCookie());
+        return reply.code(403).send({ error: 'user_disabled' });
+      }
+
+      const browserClient = await prisma.client.create({
+        data: {
+          name: parsed.data.name || 'Browser OAuth client',
+          userEmail: parsed.data.userEmail || session.user.email || null,
+          clientType: 'browser',
+          scopes: (parsed.data.scopes || ['read']).join(' '),
+          ownerUserId: session.user.id,
+          createdBy: session.user.id,
+          redirectUris: {
+            create: (parsed.data.redirectUris || []).map((redirectUri: string) => ({
+              redirectUri
+            }))
+          }
+        },
+        include: {
+          redirectUris: true
+        }
+      });
+
+      return reply.code(201).send({
+        client_id: browserClient.id,
+        client_type: browserClient.clientType,
+        scope: browserClient.scopes,
+        owner_user_id: session.user.id,
+        redirect_uris: browserClient.redirectUris.map((entry: { redirectUri: string }) => entry.redirectUri),
+        authorization_endpoint: buildExternalUrl(request, '/api/v1/oauth/authorize') || '/api/v1/oauth/authorize',
+        token_endpoint: buildExternalUrl(request, '/api/v1/token') || '/api/v1/token',
+        token_endpoint_auth_method: 'none',
+        grant_types: ['authorization_code'],
+        response_types: ['code'],
+        pkce_required: true
+      });
+    }
+
+    const client = await prisma.client.create({
+      data: {
+        name: parsed.data.name,
+        userEmail: parsed.data.userEmail,
+        clientType: parsed.data.clientType,
+        scopes: (parsed.data.scopes || ['verify', 'read']).join(' '),
+        jwks: parsed.data.jwks ? JSON.parse(JSON.stringify(parsed.data.jwks)) : undefined,
+        jwksUrl: parsed.data.jwksUrl,
+        createdBy: request.ip
+      }
+    });
+
+    return reply.code(201).send({
+      client_id: client.id,
+      client_type: client.clientType,
+      plan: client.plan,
+      usage_limit: client.usageLimit,
+      scope: client.scopes,
+      token_endpoint: buildExternalUrl(request, '/api/v1/token') || '/api/v1/token',
+      token_endpoint_auth_method: 'private_key_jwt',
+      grant_types: ['client_credentials'],
+      legacy_api_key_support: true
+    });
+  });
+
+  app.post('/api/v1/auth/register', {
+    config: {
+      rateLimit: {
+        max: 10,
+        timeWindow: '1 minute',
+        keyGenerator: (request) => request.ip
+      }
+    }
+  }, async (request, reply) => {
+    const parsed = oauthUserRegistrationSchema.safeParse(request.body);
+    if (!parsed.success) {
+      return reply.code(400).send({ error: 'invalid_oauth_registration', details: parsed.error.flatten() });
+    }
+
+    const email = parsed.data.email.trim().toLowerCase();
+    const existing = await userAccountStore.findUnique({
+      where: { email },
+      select: { id: true }
+    });
+    if (existing) {
+      return reply.code(409).send({ error: 'user_already_exists' });
+    }
+
+    const passwordRecord = await hashPasswordRecord(parsed.data.password);
+    const user = await userAccountStore.create({
+      data: {
+        email,
+        displayName: parsed.data.displayName,
+        passwordHash: passwordRecord.passwordHash,
+        passwordSalt: passwordRecord.passwordSalt
+      }
+    });
+
+    return reply.code(201).send({
+      user_id: user.id,
+      email: user.email,
+      display_name: user.displayName
+    });
+  });
+
+  app.get('/api/v1/auth/login', async (request, reply) => {
+    const query = z.object({
+      return_to: z.string().trim().max(4096).optional()
+    }).safeParse(request.query);
+    const returnTo = resolveReturnTo(request, query.success ? query.data.return_to : undefined);
+    reply.type('text/html; charset=utf-8');
+    return reply.send(
+      buildHtmlPage(
+        'TrustSignal Login',
+        `<h1>TrustSignal Login</h1>
+<form method="post" action="/api/v1/auth/login">
+  <input type="hidden" name="return_to" value="${escapeHtml(returnTo)}">
+  <label>Email <input type="email" name="email" autocomplete="username" required></label><br>
+  <label>Password <input type="password" name="password" autocomplete="current-password" required></label><br>
+  <button type="submit">Sign in</button>
+</form>`
+      )
+    );
+  });
+
+  app.post('/api/v1/auth/login', {
+    config: {
+      rateLimit: {
+        max: 20,
+        timeWindow: '1 minute',
+        keyGenerator: (request) => request.ip
+      }
+    }
+  }, async (request, reply) => {
+    const parsed = oauthLoginSchema.safeParse(request.body);
+    if (!parsed.success) {
+      oauthLoginTotal.inc({ outcome: 'failure' });
+      return reply.code(400).send({ error: 'invalid_oauth_login', details: parsed.error.flatten() });
+    }
+
+    const email = parsed.data.email.trim().toLowerCase();
+    const user = await userAccountStore.findUnique({
+      where: { email }
+    });
+    if (!user || !(await verifyPasswordHash(parsed.data.password, user.passwordHash, user.passwordSalt))) {
+      oauthLoginTotal.inc({ outcome: 'failure' });
+      return reply.code(401).send({ error: 'invalid_credentials' });
+    }
+    if (user.disabledAt) {
+      oauthLoginTotal.inc({ outcome: 'failure' });
+      reply.header('set-cookie', clearOauthSessionCookie());
+      return reply.code(403).send({ error: 'user_disabled' });
+    }
+
+    const session = await issueBrowserSession(request, user.id);
+    await userAccountStore.update({
+      where: { id: user.id },
+      data: { lastLoginAt: new Date() }
+    });
+    reply.header('set-cookie', buildOauthSetCookie(session.cookieValue));
+    oauthLoginTotal.inc({ outcome: 'success' });
+
+    const returnTo = resolveReturnTo(request, parsed.data.return_to);
+    if (parsed.data.return_to) {
+      return reply.redirect(returnTo, 303);
+    }
+
+    return reply.send({
+      status: 'authenticated',
+      user_id: user.id,
+      email: user.email,
+      display_name: user.displayName
+    });
+  });
+
+  app.post('/api/v1/auth/logout', async (request, reply) => {
+    const session = await loadAuthenticatedBrowserSession(request);
+    if (session) {
+      await browserSessionStore.updateMany({
+        where: {
+          id: session.id,
+          revokedAt: null
+        },
+        data: {
+          revokedAt: new Date()
+        }
+      });
+    }
+
+    reply.header('set-cookie', clearOauthSessionCookie());
+    return reply.send({ status: 'signed_out' });
+  });
+
+  app.get('/api/v1/oauth/authorize', async (request, reply) => {
+    const parsed = oauthAuthorizeQuerySchema.safeParse(request.query);
+    if (!parsed.success) {
+      oauthAuthorizationCodeTotal.inc({ outcome: 'failure' });
+      return reply.code(400).send({ error: 'invalid_oauth_authorize_request', details: parsed.error.flatten() });
+    }
+
+    const browserClient = await findOAuthClientWithRedirects(parsed.data.client_id);
+    if (!browserClient || browserClient.revokedAt || browserClient.clientType !== 'browser') {
+      oauthAuthorizationCodeTotal.inc({ outcome: 'failure' });
+      return reply.code(403).send({ error: 'invalid_client' });
+    }
+
+    const redirectAllowed = browserClient.redirectUris.some((entry: { redirectUri: string }) => entry.redirectUri === parsed.data.redirect_uri);
+    if (!redirectAllowed) {
+      oauthAuthorizationCodeTotal.inc({ outcome: 'failure' });
+      return reply.code(400).send({ error: 'invalid_redirect_uri' });
+    }
+
+    const grantedScope = resolveGrantedScopes(browserClient.scopes, parsed.data.scope);
+    if (!grantedScope) {
+      oauthAuthorizationCodeTotal.inc({ outcome: 'failure' });
+      return reply.code(400).send({ error: 'invalid_scope' });
+    }
+
+    const session = await loadAuthenticatedBrowserSession(request);
+    if (!session) {
+      oauthAuthorizationCodeTotal.inc({ outcome: 'failure' });
+      if (parsed.data.prompt === 'none') {
+        return redirectWithOauthResult(reply, parsed.data.redirect_uri, {
+          error: 'login_required',
+          state: parsed.data.state
+        });
+      }
+      return reply.redirect(`/api/v1/auth/login?return_to=${encodeURIComponent(request.url)}`, 303);
+    }
+
+    if (session.user.disabledAt) {
+      oauthAuthorizationCodeTotal.inc({ outcome: 'failure' });
+      reply.header('set-cookie', clearOauthSessionCookie());
+      return reply.code(403).send({ error: 'user_disabled' });
+    }
+
+    const consentGrant = await oauthConsentGrantStore.findUnique({
+      where: {
+        clientId_userId: {
+          clientId: browserClient.id,
+          userId: session.user.id
+        }
+      }
+    });
+    const consentSatisfied =
+      Boolean(consentGrant && !consentGrant.revokedAt && resolveGrantedScopes(consentGrant.grantedScopes, grantedScope) === grantedScope) &&
+      parsed.data.prompt !== 'consent';
+
+    if (consentSatisfied) {
+      const code = await issueAuthorizationCode({
+        clientId: browserClient.id,
+        userId: session.user.id,
+        redirectUri: parsed.data.redirect_uri,
+        scope: grantedScope,
+        state: parsed.data.state,
+        codeChallenge: parsed.data.code_challenge
+      });
+      oauthAuthorizationCodeTotal.inc({ outcome: 'success' });
+      return redirectWithOauthResult(reply, parsed.data.redirect_uri, {
+        code,
+        state: parsed.data.state
+      });
+    }
+
+    if (parsed.data.prompt === 'none') {
+      oauthAuthorizationCodeTotal.inc({ outcome: 'failure' });
+      return redirectWithOauthResult(reply, parsed.data.redirect_uri, {
+        error: 'consent_required',
+        state: parsed.data.state
+      });
+    }
+
+    const authorizationRequest = await oauthAuthorizationRequestStore.create({
+      data: {
+        clientId: browserClient.id,
+        userId: session.user.id,
+        redirectUri: parsed.data.redirect_uri,
+        scope: grantedScope,
+        state: parsed.data.state,
+        codeChallenge: parsed.data.code_challenge,
+        codeChallengeMethod: parsed.data.code_challenge_method,
+        expiresAt: new Date(Date.now() + oauthAuthorizationCodeTtlSeconds * 1000)
+      }
+    });
+
+    reply.type('text/html; charset=utf-8');
+    return reply.send(
+      buildHtmlPage(
+        'TrustSignal Consent',
+        `<h1>Authorize ${escapeHtml(browserClient.name || browserClient.id)}</h1>
+<p>Signed in as ${escapeHtml(session.user.email)}</p>
+<p>This app is requesting: ${escapeHtml(grantedScope)}</p>
+<form method="post" action="/api/v1/oauth/authorize/consent">
+  <input type="hidden" name="request_id" value="${escapeHtml(authorizationRequest.id)}">
+  <button type="submit" name="decision" value="approve">Approve</button>
+  <button type="submit" name="decision" value="deny">Deny</button>
+</form>`
+      )
+    );
+  });
+
+  app.post('/api/v1/oauth/authorize/consent', async (request, reply) => {
+    const parsed = oauthAuthorizeDecisionSchema.safeParse(request.body);
+    if (!parsed.success) {
+      oauthAuthorizationCodeTotal.inc({ outcome: 'failure' });
+      return reply.code(400).send({ error: 'invalid_oauth_authorize_decision', details: parsed.error.flatten() });
+    }
+
+    const session = await loadAuthenticatedBrowserSession(request);
+    if (!session) {
+      oauthAuthorizationCodeTotal.inc({ outcome: 'failure' });
+      const authorizationRequest = await oauthAuthorizationRequestStore.findUnique({
+        where: { id: parsed.data.request_id }
+      });
+      if (!authorizationRequest || authorizationRequest.consumedAt || authorizationRequest.expiresAt <= new Date()) {
+        return reply.code(401).send({ error: 'login_required' });
+      }
+
+      return reply.redirect(
+        `/api/v1/auth/login?return_to=${encodeURIComponent(
+          buildAuthorizationReturnTo({
+            clientId: authorizationRequest.clientId,
+            redirectUri: authorizationRequest.redirectUri,
+            scope: authorizationRequest.scope,
+            state: authorizationRequest.state,
+            codeChallenge: authorizationRequest.codeChallenge,
+            codeChallengeMethod: authorizationRequest.codeChallengeMethod
+          })
+        )}`,
+        303
+      );
+    }
+
+    if (session.user.disabledAt) {
+      oauthAuthorizationCodeTotal.inc({ outcome: 'failure' });
+      reply.header('set-cookie', clearOauthSessionCookie());
+      return reply.code(403).send({ error: 'user_disabled' });
+    }
+
+    const authorizationRequest = await oauthAuthorizationRequestStore.findUnique({
+      where: { id: parsed.data.request_id },
+      include: {
+        client: {
+          include: {
+            redirectUris: true
+          }
+        },
+        user: true
+      }
+    });
+    if (
+      !authorizationRequest ||
+      authorizationRequest.consumedAt ||
+      authorizationRequest.expiresAt <= new Date() ||
+      authorizationRequest.client.revokedAt ||
+      authorizationRequest.client.clientType !== 'browser' ||
+      authorizationRequest.userId !== session.user.id
+    ) {
+      oauthAuthorizationCodeTotal.inc({ outcome: 'failure' });
+      return reply.code(400).send({ error: 'invalid_authorization_request' });
+    }
+
+    const consumed = await oauthAuthorizationRequestStore.updateMany({
+      where: {
+        id: authorizationRequest.id,
+        consumedAt: null
+      },
+      data: {
+        consumedAt: new Date()
+      }
+    });
+    if (consumed.count === 0) {
+      oauthAuthorizationCodeTotal.inc({ outcome: 'failure' });
+      return reply.code(409).send({ error: 'authorization_request_consumed' });
+    }
+
+    if (parsed.data.decision === 'deny') {
+      oauthAuthorizationCodeTotal.inc({ outcome: 'failure' });
+      return redirectWithOauthResult(reply, authorizationRequest.redirectUri, {
+        error: 'access_denied',
+        state: authorizationRequest.state || undefined
+      });
+    }
+
+    const existingConsentGrant = await oauthConsentGrantStore.findUnique({
+      where: {
+        clientId_userId: {
+          clientId: authorizationRequest.clientId,
+          userId: session.user.id
+        }
+      }
+    });
+    const mergedConsentScopes = Array.from(
+      new Set(`${existingConsentGrant?.grantedScopes || ''} ${authorizationRequest.scope}`.trim().split(/\s+/).filter(Boolean))
+    ).join(' ');
+
+    await oauthConsentGrantStore.upsert({
+      where: {
+        clientId_userId: {
+          clientId: authorizationRequest.clientId,
+          userId: session.user.id
+        }
+      },
+      update: {
+        grantedScopes: mergedConsentScopes,
+        revokedAt: null
+      },
+      create: {
+        clientId: authorizationRequest.clientId,
+        userId: session.user.id,
+        grantedScopes: authorizationRequest.scope
+      }
+    });
+
+    const code = await issueAuthorizationCode({
+      clientId: authorizationRequest.clientId,
+      userId: session.user.id,
+      redirectUri: authorizationRequest.redirectUri,
+      scope: authorizationRequest.scope,
+      state: authorizationRequest.state || undefined,
+      codeChallenge: authorizationRequest.codeChallenge
+    });
+    oauthAuthorizationCodeTotal.inc({ outcome: 'success' });
+    return redirectWithOauthResult(reply, authorizationRequest.redirectUri, {
+      code,
+      state: authorizationRequest.state || undefined
+    });
+  });
+
+  app.get('/api/v1/clients/:clientId/keys', {
+    preHandler: [...authPreHandlers.read, requireClientOwnership],
+    config: { rateLimit: perApiKeyRateLimit }
+  }, async (request, reply) => {
+    const params = clientIdParamSchema.safeParse(request.params);
+    if (!params.success) {
+      return reply.code(400).send({ error: 'invalid_client_id' });
+    }
+
+    const client = await prisma.client.findUnique({
+      where: { id: params.data.clientId },
+      select: {
+        id: true,
+        clientType: true,
+        jwks: true,
+        jwksUrl: true
+      }
+    });
+    if (!client) {
+      return reply.code(404).send({ error: 'client_not_found' });
+    }
+    if (client.clientType === 'browser') {
+      return reply.code(409).send({ error: 'browser_client_has_no_keys' });
+    }
+
+    return reply.send({
+      client_id: client.id,
+      management_mode: client.jwksUrl ? 'jwks_url' : 'local_jwks',
+      jwks_url: client.jwksUrl,
+      keys: client.jwks ? normalizeJwks(client.jwks).keys : []
+    });
+  });
+
+  app.post('/api/v1/clients/:clientId/keys', {
+    preHandler: [...authPreHandlers.read, requireClientOwnership],
+    config: { rateLimit: perApiKeyRateLimit }
+  }, async (request, reply) => {
+    const params = clientIdParamSchema.safeParse(request.params);
+    if (!params.success) {
+      return reply.code(400).send({ error: 'invalid_client_id' });
+    }
+    const parsed = clientKeyCreateSchema.safeParse(request.body);
+    if (!parsed.success) {
+      return reply.code(400).send({ error: 'invalid_client_key', details: parsed.error.flatten() });
+    }
+
+    const nextKey = parsed.data.jwk;
+    const nextKid = typeof nextKey.kid === 'string' ? nextKey.kid.trim() : '';
+    if (!nextKid) {
+      return reply.code(400).send({ error: 'client_key_kid_required' });
+    }
+
+    const client = await prisma.client.findUnique({
+      where: { id: params.data.clientId },
+      select: {
+        clientType: true,
+        jwks: true,
+        jwksUrl: true
+      }
+    });
+    if (!client) {
+      return reply.code(404).send({ error: 'client_not_found' });
+    }
+    if (client.clientType === 'browser') {
+      return reply.code(409).send({ error: 'browser_client_has_no_keys' });
+    }
+    if (client.jwksUrl) {
+      return reply.code(409).send({ error: 'client_uses_jwks_url' });
+    }
+
+    const currentKeys = client.jwks ? normalizeJwks(client.jwks).keys : [];
+    if (currentKeys.some((key) => key.kid === nextKid)) {
+      return reply.code(409).send({ error: 'client_key_kid_conflict' });
+    }
+
+    const keys = [...currentKeys, nextKey];
+    await prisma.client.update({
+      where: { id: params.data.clientId },
+      data: {
+        jwks: JSON.parse(JSON.stringify({ keys }))
+      }
+    });
+
+    return reply.code(201).send({
+      client_id: params.data.clientId,
+      key_count: keys.length,
+      added_kid: nextKid,
+      keys
+    });
+  });
+
+  app.delete('/api/v1/clients/:clientId/keys/:kid', {
+    preHandler: [...authPreHandlers.read, requireClientOwnership],
+    config: { rateLimit: perApiKeyRateLimit }
+  }, async (request, reply) => {
+    const params = clientKeyParamSchema.safeParse(request.params);
+    if (!params.success) {
+      return reply.code(400).send({ error: 'invalid_client_key_id' });
+    }
+
+    const client = await prisma.client.findUnique({
+      where: { id: params.data.clientId },
+      select: {
+        clientType: true,
+        jwks: true,
+        jwksUrl: true
+      }
+    });
+    if (!client) {
+      return reply.code(404).send({ error: 'client_not_found' });
+    }
+    if (client.clientType === 'browser') {
+      return reply.code(409).send({ error: 'browser_client_has_no_keys' });
+    }
+    if (client.jwksUrl) {
+      return reply.code(409).send({ error: 'client_uses_jwks_url' });
+    }
+
+    const currentKeys = client.jwks ? normalizeJwks(client.jwks).keys : [];
+    const remainingKeys = currentKeys.filter((key) => key.kid !== params.data.kid);
+    if (remainingKeys.length === currentKeys.length) {
+      return reply.code(404).send({ error: 'client_key_not_found' });
+    }
+    if (remainingKeys.length === 0) {
+      return reply.code(409).send({ error: 'client_must_keep_one_key' });
+    }
+
+    await prisma.client.update({
+      where: { id: params.data.clientId },
+      data: {
+        jwks: JSON.parse(JSON.stringify({ keys: remainingKeys }))
+      }
+    });
+
+    return reply.send({
+      client_id: params.data.clientId,
+      removed_kid: params.data.kid,
+      key_count: remainingKeys.length,
+      keys: remainingKeys
+    });
+  });
+
+  app.post('/api/v1/clients/:clientId/revoke', {
+    preHandler: [...authPreHandlers.revoke, requireClientOwnership, requireNoRequestBody],
+    config: { rateLimit: perApiKeyRateLimit }
+  }, async (request, reply) => {
+    const params = clientIdParamSchema.safeParse(request.params);
+    if (!params.success) {
+      return reply.code(400).send({ error: 'invalid_client_id' });
+    }
+
+    const client = await prisma.client.findUnique({
+      where: { id: params.data.clientId },
+      select: {
+        id: true,
+        revokedAt: true
+      }
+    });
+    if (!client) {
+      return reply.code(404).send({ error: 'client_not_found' });
+    }
+    if (client.revokedAt) {
+      return reply.code(409).send({
+        error: 'client_already_revoked',
+        client_id: client.id,
+        revoked_at: client.revokedAt.toISOString()
+      });
+    }
+
+    const revokedAt = new Date();
+    await prisma.client.update({
+      where: { id: client.id },
+      data: {
+        revokedAt,
+        lastUsedAt: revokedAt
+      }
+    });
+    clientRevocationsTotal.inc();
+
+    return reply.send({
+      status: 'REVOKED',
+      client_id: client.id,
+      revoked_at: revokedAt.toISOString()
+    });
+  });
+
+  app.post('/api/v1/token', {
+    config: {
+      rateLimit: {
+        max: 30,
+        timeWindow: '1 minute',
+        keyGenerator: (request) => request.ip
+      }
+    }
+  }, async (request, reply) => {
+    const parsed = tokenRequestSchema.safeParse(request.body);
+    if (!parsed.success) {
+      return reply.code(400).send({ error: 'invalid_token_request', details: parsed.error.flatten() });
+    }
+
+    if (parsed.data.grant_type === 'authorization_code') {
+      const authCodeRequest = parsed.data;
+      const browserClient = await findOAuthClientWithRedirects(authCodeRequest.client_id);
+      if (!browserClient || browserClient.revokedAt || browserClient.clientType !== 'browser') {
+        tokenIssuanceTotal.inc({ outcome: 'failure' });
+        tokenIssuanceFailuresTotal.inc({ reason: 'invalid_client' });
+        return reply.code(403).send({ error: 'invalid_client' });
+      }
+      const redirectAllowed = browserClient.redirectUris.some((entry: { redirectUri: string }) => entry.redirectUri === authCodeRequest.redirect_uri);
+      if (!redirectAllowed) {
+        tokenIssuanceTotal.inc({ outcome: 'failure' });
+        tokenIssuanceFailuresTotal.inc({ reason: 'invalid_redirect_uri' });
+        return reply.code(400).send({ error: 'invalid_redirect_uri' });
+      }
+
+      const codeRecord = await oauthAuthorizationCodeStore.findUnique({
+        where: {
+          codeHash: hashOpaqueToken(parsed.data.code)
+        }
+      });
+      if (!codeRecord || codeRecord.clientId !== browserClient.id) {
+        tokenIssuanceTotal.inc({ outcome: 'failure' });
+        tokenIssuanceFailuresTotal.inc({ reason: 'invalid_grant' });
+        return reply.code(400).send({ error: 'invalid_grant' });
+      }
+      if (codeRecord.redirectUri !== authCodeRequest.redirect_uri) {
+        tokenIssuanceTotal.inc({ outcome: 'failure' });
+        tokenIssuanceFailuresTotal.inc({ reason: 'invalid_redirect_uri' });
+        return reply.code(400).send({ error: 'invalid_redirect_uri' });
+      }
+      if (codeRecord.usedAt) {
+        tokenIssuanceTotal.inc({ outcome: 'failure' });
+        tokenIssuanceFailuresTotal.inc({ reason: 'authorization_code_reused' });
+        return reply.code(409).send({ error: 'authorization_code_reused' });
+      }
+      if (codeRecord.expiresAt <= new Date()) {
+        tokenIssuanceTotal.inc({ outcome: 'failure' });
+        tokenIssuanceFailuresTotal.inc({ reason: 'authorization_code_expired' });
+        return reply.code(400).send({ error: 'authorization_code_expired' });
+      }
+      if (codeRecord.codeChallengeMethod !== 'S256') {
+        tokenIssuanceTotal.inc({ outcome: 'failure' });
+        tokenIssuanceFailuresTotal.inc({ reason: 'invalid_code_challenge_method' });
+        return reply.code(400).send({ error: 'invalid_code_challenge_method' });
+      }
+      if (!verifyPkceCodeVerifier(authCodeRequest.code_verifier, codeRecord.codeChallenge)) {
+        tokenIssuanceTotal.inc({ outcome: 'failure' });
+        tokenIssuanceFailuresTotal.inc({ reason: 'invalid_code_verifier' });
+        return reply.code(400).send({ error: 'invalid_code_verifier' });
+      }
+
+      const user = await userAccountStore.findUnique({
+        where: { id: codeRecord.userId },
+        select: {
+          id: true,
+          disabledAt: true
+        }
+      });
+      if (!user || user.disabledAt) {
+        tokenIssuanceTotal.inc({ outcome: 'failure' });
+        tokenIssuanceFailuresTotal.inc({ reason: 'user_disabled' });
+        return reply.code(403).send({ error: 'user_disabled' });
+      }
+
+      const consumeResult = await oauthAuthorizationCodeStore.updateMany({
+        where: {
+          id: codeRecord.id,
+          usedAt: null
+        },
+        data: {
+          usedAt: new Date()
+        }
+      });
+      if (consumeResult.count === 0) {
+        tokenIssuanceTotal.inc({ outcome: 'failure' });
+        tokenIssuanceFailuresTotal.inc({ reason: 'authorization_code_reused' });
+        return reply.code(409).send({ error: 'authorization_code_reused' });
+      }
+
+      let issued;
+      try {
+        issued = await issueAccessToken({
+          client: {
+            id: browserClient.id,
+            clientType: browserClient.clientType,
+            scopes: browserClient.scopes,
+            plan: 'BROWSER',
+            usageLimit: 0,
+            usageCount: 0,
+            revokedAt: browserClient.revokedAt,
+            jwks: null,
+            jwksUrl: null
+          },
+          requestedScope: codeRecord.scope,
+          accessTokenConfig: securityConfig.accessTokens,
+          subject: user.id,
+          additionalClaims: {
+            azp: browserClient.id,
+            client_id: browserClient.id,
+            actor_type: 'user',
+            user_id: user.id,
+            grant_type: 'authorization_code'
+          }
+        });
+      } catch (error) {
+        if (error instanceof Error && error.message === 'invalid_scope') {
+          tokenIssuanceTotal.inc({ outcome: 'failure' });
+          tokenIssuanceFailuresTotal.inc({ reason: 'invalid_scope' });
+          return reply.code(400).send({ error: 'invalid_scope' });
+        }
+        throw error;
+      }
+
+      await prisma.client.update({
+        where: { id: browserClient.id },
+        data: {
+          lastUsedAt: new Date()
+        }
+      });
+      tokenIssuanceTotal.inc({ outcome: 'success' });
+      return reply.send({
+        access_token: issued.accessToken,
+        token_type: 'Bearer',
+        expires_in: issued.expiresIn,
+        scope: issued.scope,
+        client_id: browserClient.id,
+        user_id: user.id
+      });
+    }
+
+    let assertionPayload: Record<string, unknown> | null = null;
+    try {
+      const [, payloadSegment] = parsed.data.client_assertion.split('.');
+      if (!payloadSegment) {
+        return reply.code(400).send({ error: 'invalid_client_assertion' });
+      }
+      assertionPayload = JSON.parse(Buffer.from(payloadSegment, 'base64url').toString('utf8')) as Record<string, unknown>;
+    } catch {
+      return reply.code(400).send({ error: 'invalid_client_assertion' });
+    }
+
+    const clientId = typeof assertionPayload?.iss === 'string' ? assertionPayload.iss.trim() : '';
+    if (!clientId) {
+      tokenIssuanceTotal.inc({ outcome: 'failure' });
+      tokenIssuanceFailuresTotal.inc({ reason: 'client_assertion_missing_iss' });
+      return reply.code(400).send({ error: 'client_assertion_missing_iss' });
+    }
+
+    const client = await prisma.client.findUnique({ where: { id: clientId } });
+    if (!client || client.revokedAt) {
+      tokenIssuanceTotal.inc({ outcome: 'failure' });
+      tokenIssuanceFailuresTotal.inc({ reason: 'invalid_client' });
+      return reply.code(403).send({ error: 'invalid_client' });
+    }
+
+    if (client.usageCount >= client.usageLimit) {
+      tokenIssuanceTotal.inc({ outcome: 'failure' });
+      tokenIssuanceFailuresTotal.inc({ reason: 'usage_limit_exceeded' });
+      return reply.code(429).send({
+        error: 'usage_limit_exceeded',
+        usageLimit: client.usageLimit,
+        usageCount: client.usageCount
+      });
+    }
+
+    let verifiedAssertion;
+    try {
+      verifiedAssertion = await verifyClientAssertion({
+        client,
+        clientAssertion: parsed.data.client_assertion,
+        tokenAudience: securityConfig.accessTokens.tokenEndpointAudience,
+        requestUrl: buildExternalUrl(request, '/api/v1/token')
+      });
+    } catch {
+      tokenIssuanceTotal.inc({ outcome: 'failure' });
+      tokenIssuanceFailuresTotal.inc({ reason: 'invalid_client_assertion' });
+      return reply.code(403).send({ error: 'invalid_client_assertion' });
+    }
+
+    const assertionJti = typeof verifiedAssertion.payload.jti === 'string' ? verifiedAssertion.payload.jti.trim() : '';
+    if (!assertionJti) {
+      tokenIssuanceTotal.inc({ outcome: 'failure' });
+      tokenIssuanceFailuresTotal.inc({ reason: 'client_assertion_missing_jti' });
+      return reply.code(400).send({ error: 'client_assertion_missing_jti' });
+    }
+
+    const assertionExpiresAt =
+      typeof verifiedAssertion.payload.exp === 'number'
+        ? new Date(verifiedAssertion.payload.exp * 1000)
+        : new Date(Date.now() + 5 * 60 * 1000);
+
+    let assertionReserved = false;
+    try {
+      assertionReserved = await assertionReplayStore.reserve({
+        clientId: client.id,
+        jti: assertionJti,
+        expiresAt: assertionExpiresAt
+      });
+    } catch (error) {
+      request.log.error(
+        {
+          clientId: client.id,
+          error: error instanceof Error ? error.message : 'unknown_error'
+        },
+        'assertion replay store unavailable'
+      );
+      tokenIssuanceTotal.inc({ outcome: 'failure' });
+      tokenIssuanceFailuresTotal.inc({ reason: 'assertion_replay_store_unavailable' });
+      return reply.code(503).send({ error: 'assertion_replay_store_unavailable' });
+    }
+
+    if (!assertionReserved) {
+      tokenIssuanceTotal.inc({ outcome: 'failure' });
+      tokenIssuanceFailuresTotal.inc({ reason: 'client_assertion_replayed' });
+      tokenReplayRejectionsTotal.inc();
+      return reply.code(409).send({ error: 'client_assertion_replayed' });
+    }
+
+    let issued;
+    try {
+      issued = await issueAccessToken({
+        client,
+        requestedScope: parsed.data.scope,
+        accessTokenConfig: securityConfig.accessTokens
+      });
+    } catch (error) {
+      if (error instanceof Error && error.message === 'invalid_scope') {
+        tokenIssuanceTotal.inc({ outcome: 'failure' });
+        tokenIssuanceFailuresTotal.inc({ reason: 'invalid_scope' });
+        return reply.code(400).send({ error: 'invalid_scope' });
+      }
+      throw error;
+    }
+
+    tokenIssuanceTotal.inc({ outcome: 'success' });
+
+    return reply.send({
+      access_token: issued.accessToken,
+      token_type: 'Bearer',
+      expires_in: issued.expiresIn,
+      scope: issued.scope,
+      client_id: client.id
+    });
+  });
+
+  app.post('/api/v1/introspect', {
+    preHandler: authPreHandlers.read,
+    config: { rateLimit: perApiKeyRateLimit }
+  }, async (request, reply) => {
+    const parsed = tokenIntrospectionSchema.safeParse(request.body);
+    if (!parsed.success) {
+      return reply.code(400).send({ error: 'invalid_token_introspection_request', details: parsed.error.flatten() });
+    }
+
+    try {
+      const payload = await verifyAccessTokenPayload(parsed.data.token, securityConfig.accessTokens);
+      const subject = typeof payload.sub === 'string' ? payload.sub : '';
+      const clientId =
+        typeof payload.azp === 'string'
+          ? payload.azp
+          : typeof payload.client_id === 'string'
+            ? payload.client_id
+            : payload.actor_type === 'user'
+              ? ''
+              : subject;
+      const userId = payload.actor_type === 'user' ? subject : typeof payload.user_id === 'string' ? payload.user_id : undefined;
+      if (!subject || !clientId) {
+        return reply.send({ active: false });
+      }
+
+      if (
+        request.authContext?.principalType === 'access_token' &&
+        request.authContext.clientId &&
+        request.authContext.clientId !== clientId
+      ) {
+        return reply.code(403).send({ error: 'client_mismatch' });
+      }
+
+      const client = await prisma.client.findUnique({
+        where: { id: clientId },
+        select: {
+          revokedAt: true
+        }
+      });
+      let active = Boolean(client && !client.revokedAt);
+      if (active && userId) {
+        const user = await userAccountStore.findUnique({
+          where: { id: userId },
+          select: {
+            disabledAt: true
+          }
+        });
+        active = Boolean(user && !user.disabledAt);
+      }
+
+      return reply.send({
+        active,
+        client_id: clientId,
+        user_id: userId,
+        scope: typeof payload.scope === 'string' ? payload.scope : '',
+        grant_type: typeof payload.grant_type === 'string' ? payload.grant_type : undefined,
+        actor_type: typeof payload.actor_type === 'string' ? payload.actor_type : undefined,
+        token_type: 'Bearer',
+        iss: typeof payload.iss === 'string' ? payload.iss : securityConfig.accessTokens.issuer,
+        aud: payload.aud,
+        exp: typeof payload.exp === 'number' ? payload.exp : undefined,
+        iat: typeof payload.iat === 'number' ? payload.iat : undefined,
+        sub: subject
+      });
+    } catch {
+      return reply.send({ active: false });
+    }
+  });
+
   app.get('/api/v1/integrations/vanta/schema', {
-    preHandler: [requireApiKeyScope(securityConfig, 'read')],
+    preHandler: authPreHandlers.read,
     config: { rateLimit: perApiKeyRateLimit }
   }, async () => {
     return {
@@ -1027,7 +2469,7 @@ export async function buildServer(options: BuildServerOptions = {}) {
   });
 
   app.get('/api/v1/trust-agents', {
-    preHandler: [requireApiKeyScope(securityConfig, 'read')],
+    preHandler: authPreHandlers.read,
     config: { rateLimit: perApiKeyRateLimit }
   }, async () => {
     return {
@@ -1041,7 +2483,7 @@ export async function buildServer(options: BuildServerOptions = {}) {
   });
 
   app.post('/api/v1/workflows', {
-    preHandler: [requireApiKeyScope(securityConfig, 'verify')],
+    preHandler: authPreHandlers.verify,
     config: { rateLimit: perApiKeyRateLimit }
   }, async (request, reply) => {
     const parsed = workflowCreateRequestSchema.safeParse(request.body);
@@ -1054,7 +2496,7 @@ export async function buildServer(options: BuildServerOptions = {}) {
   });
 
   app.post('/api/v1/workflows/readiness-audit', {
-    preHandler: [requireApiKeyScope(securityConfig, 'verify')],
+    preHandler: authPreHandlers.verify,
     config: { rateLimit: perApiKeyRateLimit }
   }, async (request, reply) => {
     const parsed = readinessWorkflowRequestSchema.safeParse(request.body);
@@ -1071,7 +2513,7 @@ export async function buildServer(options: BuildServerOptions = {}) {
   });
 
   app.get('/api/v1/workflows/:workflowId', {
-    preHandler: [requireApiKeyScope(securityConfig, 'read')],
+    preHandler: authPreHandlers.read,
     config: { rateLimit: perApiKeyRateLimit }
   }, async (request, reply) => {
     const parsed = workflowParamsSchema.safeParse(request.params);
@@ -1088,7 +2530,7 @@ export async function buildServer(options: BuildServerOptions = {}) {
   });
 
   app.get('/api/v1/workflows/:workflowId/events', {
-    preHandler: [requireApiKeyScope(securityConfig, 'read')],
+    preHandler: authPreHandlers.read,
     config: { rateLimit: perApiKeyRateLimit }
   }, async (request, reply) => {
     const parsed = workflowParamsSchema.safeParse(request.params);
@@ -1109,7 +2551,7 @@ export async function buildServer(options: BuildServerOptions = {}) {
   });
 
   app.get('/api/v1/workflows/:workflowId/evidence-package', {
-    preHandler: [requireApiKeyScope(securityConfig, 'read')],
+    preHandler: authPreHandlers.read,
     config: { rateLimit: perApiKeyRateLimit }
   }, async (request, reply) => {
     const parsed = workflowParamsSchema.safeParse(request.params);
@@ -1126,7 +2568,7 @@ export async function buildServer(options: BuildServerOptions = {}) {
   });
 
   app.post('/api/v1/workflows/:workflowId/artifacts', {
-    preHandler: [requireApiKeyScope(securityConfig, 'verify')],
+    preHandler: authPreHandlers.verify,
     config: { rateLimit: perApiKeyRateLimit }
   }, async (request, reply) => {
     const params = workflowParamsSchema.safeParse(request.params);
@@ -1154,7 +2596,7 @@ export async function buildServer(options: BuildServerOptions = {}) {
   });
 
   app.post('/api/v1/workflows/:workflowId/runs', {
-    preHandler: [requireApiKeyScope(securityConfig, 'verify')],
+    preHandler: authPreHandlers.verify,
     config: { rateLimit: perApiKeyRateLimit }
   }, async (request, reply) => {
     const params = workflowParamsSchema.safeParse(request.params);
@@ -1176,7 +2618,7 @@ export async function buildServer(options: BuildServerOptions = {}) {
   });
 
   app.post('/api/v1/workflows/:workflowId/artifacts/:artifactId/verify', {
-    preHandler: [requireApiKeyScope(securityConfig, 'verify')],
+    preHandler: authPreHandlers.verify,
     config: { rateLimit: perApiKeyRateLimit }
   }, async (request, reply) => {
     const parsed = workflowArtifactParamsSchema.safeParse(request.params);
@@ -1193,7 +2635,7 @@ export async function buildServer(options: BuildServerOptions = {}) {
   });
 
   app.get('/api/v1/integrations/vanta/verification/:receiptId', {
-    preHandler: [requireApiKeyScope(securityConfig, 'read')],
+    preHandler: authPreHandlers.read,
     config: { rateLimit: perApiKeyRateLimit }
   }, async (request, reply) => {
     const receiptId = parseReceiptIdParam(request, reply);
@@ -1206,7 +2648,7 @@ export async function buildServer(options: BuildServerOptions = {}) {
   });
 
   app.get('/api/v1/registry/sources', {
-    preHandler: [requireApiKeyScope(securityConfig, 'read')],
+    preHandler: authPreHandlers.read,
     config: { rateLimit: perApiKeyRateLimit }
   }, async () => {
     const sources = await registryAdapterService.listSources();
@@ -1217,7 +2659,7 @@ export async function buildServer(options: BuildServerOptions = {}) {
   });
 
   app.post('/api/v1/registry/verify', {
-    preHandler: [requireApiKeyScope(securityConfig, 'verify')],
+    preHandler: authPreHandlers.verify,
     config: { rateLimit: perApiKeyRateLimit }
   }, async (request, reply) => {
     const parsed = registryVerifyInputSchema.safeParse(request.body);
@@ -1242,7 +2684,7 @@ export async function buildServer(options: BuildServerOptions = {}) {
   });
 
   app.post('/api/v1/registry/verify-batch', {
-    preHandler: [requireApiKeyScope(securityConfig, 'verify')],
+    preHandler: authPreHandlers.verify,
     config: { rateLimit: perApiKeyRateLimit }
   }, async (request, reply) => {
     const parsed = registryVerifyBatchInputSchema.safeParse(request.body);
@@ -1263,7 +2705,7 @@ export async function buildServer(options: BuildServerOptions = {}) {
   });
 
   app.get('/api/v1/registry/jobs', {
-    preHandler: [requireApiKeyScope(securityConfig, 'read')],
+    preHandler: authPreHandlers.read,
     config: { rateLimit: perApiKeyRateLimit }
   }, async (request) => {
     const limitRaw = (request.query as { limit?: string } | undefined)?.limit;
@@ -1277,7 +2719,7 @@ export async function buildServer(options: BuildServerOptions = {}) {
   });
 
   app.get('/api/v1/registry/jobs/:jobId', {
-    preHandler: [requireApiKeyScope(securityConfig, 'read')],
+    preHandler: authPreHandlers.read,
     config: { rateLimit: perApiKeyRateLimit }
   }, async (request, reply) => {
     const { jobId } = request.params as { jobId: string };
@@ -1289,7 +2731,7 @@ export async function buildServer(options: BuildServerOptions = {}) {
   });
 
   app.post('/api/v1/verify/attom', {
-    preHandler: [requireApiKeyScope(securityConfig, 'verify')],
+    preHandler: authPreHandlers.verify,
     config: {
       rateLimit: {
         max: securityConfig.perApiKeyRateLimitMax,
@@ -1298,6 +2740,10 @@ export async function buildServer(options: BuildServerOptions = {}) {
       }
     }
   }, async (request, reply) => {
+    if (!(await reserveMeteredUsage(request, reply))) {
+      return;
+    }
+
     const parsed = deedParsedSchema.safeParse(request.body);
     if (!parsed.success) {
       return reply.code(400).send({ error: 'Invalid payload', details: parsed.error.flatten() });
@@ -1311,13 +2757,12 @@ export async function buildServer(options: BuildServerOptions = {}) {
       apiKey: propertyApiKey,
       baseUrl: process.env.ATTOM_BASE_URL || 'https://api.gateway.attomdata.com'
     });
-
     const report = await attomCrossCheck(deed, client);
     return reply.send(report);
   });
 
   app.post('/api/v1/verify', {
-    preHandler: [requireApiKeyScope(securityConfig, 'verify')],
+    preHandler: authPreHandlers.verify,
     config: {
       rateLimit: {
         max: securityConfig.perApiKeyRateLimitMax,
@@ -1326,6 +2771,10 @@ export async function buildServer(options: BuildServerOptions = {}) {
       }
     }
   }, async (request, reply) => {
+    if (!(await reserveMeteredUsage(request, reply))) {
+      return;
+    }
+
     const verifyStartMs = Date.now();
     const parsed = verifyInputSchema.safeParse(request.body);
     if (!parsed.success) {
@@ -1500,7 +2949,7 @@ export async function buildServer(options: BuildServerOptions = {}) {
   });
 
   app.get('/api/v1/synthetic', {
-    preHandler: [requireApiKeyScope(securityConfig, 'read')],
+    preHandler: authPreHandlers.read,
     config: { rateLimit: perApiKeyRateLimit }
   }, async () => {
     const registry = await loadRegistry();
@@ -1534,7 +2983,7 @@ export async function buildServer(options: BuildServerOptions = {}) {
   });
 
   app.get('/api/v1/receipt/:receiptId', {
-    preHandler: [requireApiKeyScope(securityConfig, 'read')],
+    preHandler: authPreHandlers.read,
     config: { rateLimit: perApiKeyRateLimit }
   }, async (request, reply) => {
     const receiptId = parseReceiptIdParam(request, reply);
@@ -1575,7 +3024,7 @@ export async function buildServer(options: BuildServerOptions = {}) {
   });
 
   app.get('/api/v1/receipt/:receiptId/pdf', {
-    preHandler: [requireApiKeyScope(securityConfig, 'read')],
+    preHandler: authPreHandlers.read,
     config: { rateLimit: perApiKeyRateLimit }
   }, async (request, reply) => {
     const receiptId = parseReceiptIdParam(request, reply);
@@ -1595,7 +3044,7 @@ export async function buildServer(options: BuildServerOptions = {}) {
   });
 
   app.post('/api/v1/receipt/:receiptId/verify', {
-    preHandler: [requireApiKeyScope(securityConfig, 'read')],
+    preHandler: authPreHandlers.read,
     config: { rateLimit: perApiKeyRateLimit }
   }, async (request, reply) => {
     if (hasUnexpectedBody(request.body)) {
@@ -1648,7 +3097,7 @@ export async function buildServer(options: BuildServerOptions = {}) {
   });
 
   app.post('/api/v1/anchor/:receiptId', {
-    preHandler: [requireApiKeyScope(securityConfig, 'anchor')],
+    preHandler: authPreHandlers.anchor,
     config: { rateLimit: perApiKeyRateLimit }
   }, async (request, reply) => {
     if (hasUnexpectedBody(request.body)) {
@@ -1694,7 +3143,7 @@ export async function buildServer(options: BuildServerOptions = {}) {
   });
 
   app.post('/api/v1/receipt/:receiptId/revoke', {
-    preHandler: [requireApiKeyScope(securityConfig, 'revoke'), requireRevocationAuthorization(securityConfig)],
+    preHandler: [...authPreHandlers.revoke, requireRevocationAuthorization(securityConfig)],
     config: { rateLimit: perApiKeyRateLimit }
   }, async (request, reply) => {
     if (hasUnexpectedBody(request.body)) {
@@ -1735,7 +3184,7 @@ export async function buildServer(options: BuildServerOptions = {}) {
   });
 
   app.get('/api/v1/receipts', {
-    preHandler: [requireApiKeyScope(securityConfig, 'read')],
+    preHandler: authPreHandlers.read,
     config: { rateLimit: perApiKeyRateLimit }
   }, async (request) => {
     const query = request.query as { limit?: string };