@agenticprimitives/agent-profile 1.0.0-alpha.4 → 1.0.0-alpha.40

package/dist/caip10.d.ts

@@ -1,6 +1,7 @@
 /**
- * CAIP-10 chain-agnostic account identifier helpers (HCS-14 +
- * ERC-8004 aligned; ADR-0008).
+ * CAIP-10 chain-agnostic account identifier helpers. AP uses CAIP-10
+ * as a portable back-link to the canonical Smart Agent (ADR-0008);
+ * external registry-specific identifiers are derived outside Ring 0.
  *
  * Subpath: `@agenticprimitives/agent-profile/caip10`.
  *
@@ -11,7 +12,7 @@
  * (any grammar-valid string accepted) — this is the "validate at write,
  * forward-compat at read" pattern.
  */
-import { CAIP10_NAMESPACE_ALLOWLIST } from './constants';
+import { CAIP10_NAMESPACE_ALLOWLIST } from './constants.js';
 import type { Caip10Address, Caip10Parts } from '@agenticprimitives/types';
 export type { Caip10Address, Caip10Parts };
 export { CAIP10_NAMESPACE_ALLOWLIST };

package/dist/caip10.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"caip10.d.ts","sourceRoot":"","sources":["../src/caip10.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAM3E,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC;AAC3C,OAAO,EAAE,0BAA0B,EAAE,CAAC;AAItC;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,aAAa,CAcpE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAMtD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD"}
+{"version":3,"file":"caip10.d.ts","sourceRoot":"","sources":["../src/caip10.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAM3E,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC;AAC3C,OAAO,EAAE,0BAA0B,EAAE,CAAC;AAMtC;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,aAAa,CAcpE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAMtD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD"}

package/dist/caip10.js

@@ -1,6 +1,7 @@
 /**
- * CAIP-10 chain-agnostic account identifier helpers (HCS-14 +
- * ERC-8004 aligned; ADR-0008).
+ * CAIP-10 chain-agnostic account identifier helpers. AP uses CAIP-10
+ * as a portable back-link to the canonical Smart Agent (ADR-0008);
+ * external registry-specific identifiers are derived outside Ring 0.
  *
  * Subpath: `@agenticprimitives/agent-profile/caip10`.
  *
@@ -11,10 +12,12 @@
  * (any grammar-valid string accepted) — this is the "validate at write,
  * forward-compat at read" pattern.
  */
-import { CAIP10_NAMESPACE_ALLOWLIST } from './constants';
-import { InvalidCaip10Error } from './errors';
+import { CAIP10_NAMESPACE_ALLOWLIST } from './constants.js';
+import { InvalidCaip10Error } from './errors.js';
 export { CAIP10_NAMESPACE_ALLOWLIST };
-const CAIP10_GRAMMAR = /^([-a-z0-9]{3,8}):([-_a-zA-Z0-9]{1,32}):([-.%a-zA-Z0-9]{1,128})$/;
+// The GRAMMAR is a protocol fact and lives in `types`, where the five packages that cannot import
+// this one can reach it. The ALLOWLIST below is policy and stays here — that split is the point.
+import { CAIP10_GRAMMAR } from '@agenticprimitives/types';
 /**
  * Build a CAIP-10 string. Strict on the encode side — namespace must
  * be in `CAIP10_NAMESPACE_ALLOWLIST`. Address half is lowercased for

package/dist/caip10.js.map

@@ -1 +1 @@
-{"version":3,"file":"caip10.js","sourceRoot":"","sources":["../src/caip10.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAQ9C,OAAO,EAAE,0BAA0B,EAAE,CAAC;AAEtC,MAAM,cAAc,GAAG,kEAAkE,CAAC;AAE1F;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAkB;IACnD,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAChD,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,kBAAkB,CAC1B,GAAG,SAAS,IAAI,SAAS,IAAI,OAAO,EAAE,EACtC,cAAc,SAAS,uBAAuB,CAAC,GAAG,0BAA0B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAC3F,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAG,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACnF,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,SAAS,IAAI,iBAAiB,EAAE,CAAC;IAC7D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,GAAoB,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC"}
+{"version":3,"file":"caip10.js","sourceRoot":"","sources":["../src/caip10.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAQjD,OAAO,EAAE,0BAA0B,EAAE,CAAC;AAEtC,kGAAkG;AAClG,iGAAiG;AACjG,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAkB;IACnD,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAChD,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,kBAAkB,CAC1B,GAAG,SAAS,IAAI,SAAS,IAAI,OAAO,EAAE,EACtC,cAAc,SAAS,uBAAuB,CAAC,GAAG,0BAA0B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAC3F,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAG,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACnF,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,SAAS,IAAI,iBAAiB,EAAE,CAAC;IAC7D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,GAAoB,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC"}

package/dist/calls.d.ts

@@ -14,6 +14,8 @@
  * pure encode-only.
  */
 import type { Address, Hex } from '@agenticprimitives/types';
+import { type ClientKeysRecordV1 } from './client-key-binding.js';
+import type { AgentDistributionV1 } from './types.js';
 /** Minimal call-shape: the standard `{ to, value, data }` triple. */
 export interface ContractCall {
     to: Address;
@@ -51,6 +53,27 @@ export declare function buildSetProfileStringCall(args: {
     predicate: Hex;
     value: string;
 }): ContractCall;
+/**
+ * Set the SA-keyed `atl:distribution` record (spec 347 §8.5) — the JCS-canonical JSON of an
+ * `AgentDistributionV1` via `setStringProperty`. Validates first and throws `InvalidProfileError` on an
+ * invalid distribution, so nothing unreadable reaches the chain. The walletClient's account MUST equal
+ * `agent` (the record is the agent's own declaration; a registry only projects it).
+ */
+export declare function buildSetDistributionCall(args: {
+    profileResolver: Address;
+    agent: Address;
+    distribution: AgentDistributionV1;
+}): ContractCall;
+/**
+ * Set the SA-keyed `atl:clientKeys` record (spec 442 §3) via `setStringProperty`. The SA signs this call itself —
+ * a registry never writes it. Validates first and throws `InvalidProfileError`. Writing a record WITHOUT a row is
+ * the explicit revocation of that key (the custody-epoch bump is the other).
+ */
+export declare function buildSetClientKeysCall(args: {
+    profileResolver: Address;
+    agent: Address;
+    clientKeys: ClientKeysRecordV1;
+}): ContractCall;
 /** Set a single address property on an agent's profile. */
 export declare function buildSetProfileAddressCall(args: {
     profileResolver: Address;

package/dist/calls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"calls.d.ts","sourceRoot":"","sources":["../src/calls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAG7D,qEAAqE;AACrE,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,GAAG,CAAC;CACX;AAID;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,GAAG,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,YAAY,CAgBf;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,GAAG,CAAC;CACnB,GAAG,YAAY,CAUf;AAED,0DAA0D;AAC1D,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,GAAG,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,YAAY,CAUf;AAED,2DAA2D;AAC3D,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,GAAG,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,YAAY,CAUf;AAED,2DAA2D;AAC3D,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,GAAG,CAAC;IACf,KAAK,EAAE,GAAG,CAAC;CACZ,GAAG,YAAY,CAUf;AAED,yDAAyD;AACzD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,YAAY,CAUf"}
+{"version":3,"file":"calls.d.ts","sourceRoot":"","sources":["../src/calls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAG7D,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAEpF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,qEAAqE;AACrE,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,GAAG,CAAC;CACX;AAID;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,GAAG,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,YAAY,CAgBf;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,GAAG,CAAC;CACnB,GAAG,YAAY,CAUf;AAED,0DAA0D;AAC1D,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,GAAG,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,YAAY,CAUf;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,mBAAmB,CAAC;CACnC,GAAG,YAAY,CAOf;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,kBAAkB,CAAC;CAChC,GAAG,YAAY,CAOf;AAED,2DAA2D;AAC3D,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,GAAG,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,YAAY,CAUf;AAED,2DAA2D;AAC3D,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,GAAG,CAAC;IACf,KAAK,EAAE,GAAG,CAAC;CACZ,GAAG,YAAY,CAUf;AAED,yDAAyD;AACzD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,YAAY,CAUf"}

package/dist/calls.js

@@ -14,7 +14,10 @@
  * pure encode-only.
  */
 import { encodeFunctionData } from 'viem';
-import { agentProfileResolverAbi } from './abis';
+import { agentProfileResolverAbi } from './abis.js';
+import { CLIENT_KEYS, DISTRIBUTION } from './constants.js';
+import { encodeClientKeys } from './client-key-binding.js';
+import { encodeDistribution } from './distribution.js';
 const ZERO_BYTES32 = '0x0000000000000000000000000000000000000000000000000000000000000000';
 /**
  * Build a call to register an agent's profile for the first time.
@@ -66,6 +69,33 @@ export function buildSetProfileStringCall(args) {
         }),
     };
 }
+/**
+ * Set the SA-keyed `atl:distribution` record (spec 347 §8.5) — the JCS-canonical JSON of an
+ * `AgentDistributionV1` via `setStringProperty`. Validates first and throws `InvalidProfileError` on an
+ * invalid distribution, so nothing unreadable reaches the chain. The walletClient's account MUST equal
+ * `agent` (the record is the agent's own declaration; a registry only projects it).
+ */
+export function buildSetDistributionCall(args) {
+    return buildSetProfileStringCall({
+        profileResolver: args.profileResolver,
+        agent: args.agent,
+        predicate: DISTRIBUTION,
+        value: encodeDistribution(args.distribution),
+    });
+}
+/**
+ * Set the SA-keyed `atl:clientKeys` record (spec 442 §3) via `setStringProperty`. The SA signs this call itself —
+ * a registry never writes it. Validates first and throws `InvalidProfileError`. Writing a record WITHOUT a row is
+ * the explicit revocation of that key (the custody-epoch bump is the other).
+ */
+export function buildSetClientKeysCall(args) {
+    return buildSetProfileStringCall({
+        profileResolver: args.profileResolver,
+        agent: args.agent,
+        predicate: CLIENT_KEYS,
+        value: encodeClientKeys(args.clientKeys),
+    });
+}
 /** Set a single address property on an agent's profile. */
 export function buildSetProfileAddressCall(args) {
     return {

package/dist/calls.js.map

@@ -1 +1 @@
-{"version":3,"file":"calls.js","sourceRoot":"","sources":["../src/calls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,QAAQ,CAAC;AASjD,MAAM,YAAY,GAAG,oEAA2E,CAAC;AAEjG;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAOxC;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,eAAe;QACxB,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,UAAU;YACxB,IAAI,EAAE;gBACJ,IAAI,CAAC,KAAK;gBACV,IAAI,CAAC,WAAW,IAAI,EAAE;gBACtB,IAAI,CAAC,WAAW,IAAI,EAAE;gBACtB,IAAI,CAAC,SAAS,IAAI,YAAY;gBAC9B,IAAI,CAAC,gBAAgB,IAAI,EAAE;aAC5B;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAK3C;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,eAAe;QACxB,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,aAAa;YAC3B,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC;SACxD,CAAC;KACH,CAAC;AACJ,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,yBAAyB,CAAC,IAKzC;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,eAAe;QACxB,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,mBAAmB;YACjC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC;SAC/C,CAAC;KACH,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,0BAA0B,CAAC,IAK1C;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,eAAe;QACxB,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,oBAAoB;YAClC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC;SAC/C,CAAC;KACH,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,0BAA0B,CAAC,IAK1C;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,eAAe;QACxB,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,oBAAoB;YAClC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC;SAC/C,CAAC;KACH,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,yBAAyB,CAAC,IAIzC;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,eAAe;QACxB,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,WAAW;YACzB,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;SAChC,CAAC;KACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"calls.js","sourceRoot":"","sources":["../src/calls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAA2B,MAAM,yBAAyB,CAAC;AACpF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAUvD,MAAM,YAAY,GAAG,oEAA2E,CAAC;AAEjG;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAOxC;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,eAAe;QACxB,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,UAAU;YACxB,IAAI,EAAE;gBACJ,IAAI,CAAC,KAAK;gBACV,IAAI,CAAC,WAAW,IAAI,EAAE;gBACtB,IAAI,CAAC,WAAW,IAAI,EAAE;gBACtB,IAAI,CAAC,SAAS,IAAI,YAAY;gBAC9B,IAAI,CAAC,gBAAgB,IAAI,EAAE;aAC5B;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAK3C;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,eAAe;QACxB,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,aAAa;YAC3B,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC;SACxD,CAAC;KACH,CAAC;AACJ,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,yBAAyB,CAAC,IAKzC;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,eAAe;QACxB,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,mBAAmB;YACjC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC;SAC/C,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAIxC;IACC,OAAO,yBAAyB,CAAC;QAC/B,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,YAAY;QACvB,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC;KAC7C,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAItC;IACC,OAAO,yBAAyB,CAAC;QAC/B,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,WAAW;QACtB,KAAK,EAAE,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC;KACzC,CAAC,CAAC;AACL,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,0BAA0B,CAAC,IAK1C;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,eAAe;QACxB,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,oBAAoB;YAClC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC;SAC/C,CAAC;KACH,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,0BAA0B,CAAC,IAK1C;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,eAAe;QACxB,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,oBAAoB;YAClC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC;SAC/C,CAAC;KACH,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,yBAAyB,CAAC,IAIzC;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,eAAe;QACxB,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,WAAW;YACzB,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;SAChC,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/card.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Signed agent card bundle (spec 279 §3.2) — the discovery-substrate primitive that lets a verifier prove
+ * `cardHash → subjectAgent` WITHOUT trusting the registry or server that served the card.
+ *
+ * Subpath: `@agenticprimitives/agent-profile/card`.
+ *
+ * Shape: `cardHash` = sha256 of the canonical-JSON card; the subject Smart Agent signs (ERC-1271) a digest
+ * binding `{cardHash, subjectAgent, issuedAt, expiresAt, chainId, verifyingContract}`. Verification
+ * recomputes the card hash (catches a card tamper) AND re-checks the subject SA's ERC-1271 signature over
+ * that digest (authoritative — catches a tamper that also rewrote the hash). Both the signer and the
+ * on-chain ERC-1271 read are INJECTED so the module stays a pure, network-free helper (ADR-0006/0021);
+ * fail-closed throughout (ADR-0013).
+ *
+ * This is the off-chain card whose hash a registry entry references (`@agenticprimitives/registry-kit`).
+ * It is descriptive evidence only and carries NO authority to act.
+ */
+import { type Address, type Hex } from 'viem';
+import type { CanonicalAgentProfileV1, Sha256, SignedCanonicalProfileBundleV1 } from './types.js';
+/** sha256 over the canonical-JSON encoding of a card → `sha256:<hex>`. Deterministic across runtimes
+ *  (UTF-8 byte-level). Reuses {@link canonicalProfileJson} so the bytes hashed here match the package's
+ *  one canonical card encoding. */
+export declare function hashCanonicalProfile(profile: CanonicalAgentProfileV1): Sha256;
+/** @deprecated Renamed `hashCanonicalProfile` (spec 347 §0.3). Same bytes, same hash. */
+export declare const hashAgentCard: typeof hashCanonicalProfile;
+/** Injected ERC-1271 read — `verifyingContract.isValidSignature(hash, signature)` resolved to a bool.
+ *  Satisfied structurally by a viem `PublicClient` (`verifyHash`). */
+export interface Erc1271Verifier {
+    verifyHash(args: {
+        address: Address;
+        hash: Hex;
+        signature: Hex;
+    }): Promise<boolean>;
+}
+/** Injected Smart-Agent signer: signs the 32-byte digest, returning the ERC-1271-validatable signature. */
+export type SmartAgentCardSigner = (digest: Hex) => Promise<Hex>;
+export interface BuildSignedAgentCardInput {
+    card: CanonicalAgentProfileV1;
+    /** The canonical Smart Agent the card describes. Also the signer + verifying contract in V1. */
+    subjectAgent: Address;
+    chainId: number;
+    issuedAt: string;
+    expiresAt?: string;
+    /** ERC-1271 verifying contract; defaults to `subjectAgent` (the SA validates its own card). */
+    verifyingContract?: Address;
+}
+/** Build a signed card bundle: hash the card, have the subject SA sign the digest (ERC-1271), return the
+ *  signed {@link SignedAgentCardBundleV1}. */
+export declare function buildSignedCanonicalProfileBundle(input: BuildSignedAgentCardInput, sign: SmartAgentCardSigner): Promise<SignedCanonicalProfileBundleV1>;
+/** @deprecated Renamed `buildSignedCanonicalProfileBundle` (spec 347 §0.3). */
+export declare const buildSignedAgentCardBundle: typeof buildSignedCanonicalProfileBundle;
+export type VerifySignedAgentCardResult = {
+    ok: true;
+    subjectAgent: Address;
+    cardHash: Sha256;
+    card: CanonicalAgentProfileV1;
+} | {
+    ok: false;
+    reason: 'bad_shape' | 'card_hash_mismatch' | 'subject_mismatch' | 'expired' | 'signature_invalid';
+};
+/** Verify a signed card bundle WITHOUT trusting whoever served it: recompute `cardHash` from the card
+ *  (catches a card tamper that left the hash stale), confirm the proof is self-asserted by the subject SA
+ *  (signer == verifyingContract == subjectAgent — V1), enforce expiry, then re-check the subject SA's
+ *  ERC-1271 signature over the digest (authoritative). Fail-closed: any anomaly → `ok:false`. */
+export declare function verifySignedCanonicalProfileBundle(bundle: SignedCanonicalProfileBundleV1, opts: {
+    verifier: Erc1271Verifier;
+    now?: number;
+}): Promise<VerifySignedAgentCardResult>;
+/** @deprecated Renamed `verifySignedCanonicalProfileBundle` (spec 347 §0.3). */
+export declare const verifySignedAgentCardBundle: typeof verifySignedCanonicalProfileBundle;
+//# sourceMappingURL=card.d.ts.map

package/dist/card.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"card.d.ts","sourceRoot":"","sources":["../src/card.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAA+B,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAE3E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC;AAMlG;;mCAEmC;AACnC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,uBAAuB,GAAG,MAAM,CAE7E;AAED,yFAAyF;AACzF,eAAO,MAAM,aAAa,6BAAuB,CAAC;AA4BlD;sEACsE;AACtE,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,GAAG,CAAC;QAAC,SAAS,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACrF;AAED,2GAA2G;AAC3G,MAAM,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;AAEjE,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,gGAAgG;IAChG,YAAY,EAAE,OAAO,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+FAA+F;IAC/F,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;8CAC8C;AAC9C,wBAAsB,iCAAiC,CACrD,KAAK,EAAE,yBAAyB,EAChC,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,8BAA8B,CAAC,CA4BzC;AAED,+EAA+E;AAC/E,eAAO,MAAM,0BAA0B,0CAAoC,CAAC;AAE5E,MAAM,MAAM,2BAA2B,GACnC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,uBAAuB,CAAA;CAAE,GACpF;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,oBAAoB,GAAG,kBAAkB,GAAG,SAAS,GAAG,mBAAmB,CAAA;CAAE,CAAC;AAErH;;;iGAGiG;AACjG,wBAAsB,kCAAkC,CACtD,MAAM,EAAE,8BAA8B,EACtC,IAAI,EAAE;IAAE,QAAQ,EAAE,eAAe,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAChD,OAAO,CAAC,2BAA2B,CAAC,CAkDtC;AAED,gFAAgF;AAChF,eAAO,MAAM,2BAA2B,2CAAqC,CAAC"}

package/dist/card.js

@@ -0,0 +1,130 @@
+/**
+ * Signed agent card bundle (spec 279 §3.2) — the discovery-substrate primitive that lets a verifier prove
+ * `cardHash → subjectAgent` WITHOUT trusting the registry or server that served the card.
+ *
+ * Subpath: `@agenticprimitives/agent-profile/card`.
+ *
+ * Shape: `cardHash` = sha256 of the canonical-JSON card; the subject Smart Agent signs (ERC-1271) a digest
+ * binding `{cardHash, subjectAgent, issuedAt, expiresAt, chainId, verifyingContract}`. Verification
+ * recomputes the card hash (catches a card tamper) AND re-checks the subject SA's ERC-1271 signature over
+ * that digest (authoritative — catches a tamper that also rewrote the hash). Both the signer and the
+ * on-chain ERC-1271 read are INJECTED so the module stays a pure, network-free helper (ADR-0006/0021);
+ * fail-closed throughout (ADR-0013).
+ *
+ * This is the off-chain card whose hash a registry entry references (`@agenticprimitives/registry-kit`).
+ * It is descriptive evidence only and carries NO authority to act.
+ */
+import { sha256 as viemSha256, toHex } from 'viem';
+import { canonicalProfileJson } from './profile.js';
+// Sorted-key canonical JSON is `types.canonicalizeJson`. This file declared a BYTE-IDENTICAL
+// copy; aliased rather than renamed so call sites are untouched and the output cannot change —
+// which matters, because these bytes get hashed and signed.
+import { canonicalizeJson as canonicalize } from '@agenticprimitives/types';
+/** sha256 over the canonical-JSON encoding of a card → `sha256:<hex>`. Deterministic across runtimes
+ *  (UTF-8 byte-level). Reuses {@link canonicalProfileJson} so the bytes hashed here match the package's
+ *  one canonical card encoding. */
+export function hashCanonicalProfile(profile) {
+    return `sha256:${viemSha256(toHex(canonicalProfileJson(profile))).slice(2)}`;
+}
+/** @deprecated Renamed `hashCanonicalProfile` (spec 347 §0.3). Same bytes, same hash. */
+export const hashAgentCard = hashCanonicalProfile;
+/** The 32-byte digest (0x-hex) the subject SA signs / the ERC-1271 read validates over. Binds the card
+ *  hash to the subject + chain + verifying contract, so a card cannot be replayed for another SA/chain. */
+function cardDigest(b) {
+    return viemSha256(toHex(canonicalize({
+        cardHash: b.cardHash,
+        subjectAgent: b.subjectAgent.toLowerCase(),
+        issuedAt: b.issuedAt,
+        expiresAt: b.expiresAt,
+        chainId: b.chainId,
+        verifyingContract: b.verifyingContract.toLowerCase(),
+    })));
+}
+/** Build a signed card bundle: hash the card, have the subject SA sign the digest (ERC-1271), return the
+ *  signed {@link SignedAgentCardBundleV1}. */
+export async function buildSignedCanonicalProfileBundle(input, sign) {
+    const verifyingContract = input.verifyingContract ?? input.subjectAgent;
+    const cardHash = hashCanonicalProfile(input.card);
+    const signature = await sign(cardDigest({
+        cardHash,
+        subjectAgent: input.subjectAgent,
+        issuedAt: input.issuedAt,
+        expiresAt: input.expiresAt,
+        chainId: input.chainId,
+        verifyingContract,
+    }));
+    return {
+        type: 'SignedAgentCardBundleV1',
+        card: input.card,
+        cardHash,
+        subjectAgent: input.subjectAgent,
+        issuedAt: input.issuedAt,
+        expiresAt: input.expiresAt,
+        proof: {
+            type: 'ERC1271SmartAgentSignature',
+            chainId: input.chainId,
+            verifyingContract,
+            signer: input.subjectAgent,
+            signature,
+        },
+    };
+}
+/** @deprecated Renamed `buildSignedCanonicalProfileBundle` (spec 347 §0.3). */
+export const buildSignedAgentCardBundle = buildSignedCanonicalProfileBundle;
+/** Verify a signed card bundle WITHOUT trusting whoever served it: recompute `cardHash` from the card
+ *  (catches a card tamper that left the hash stale), confirm the proof is self-asserted by the subject SA
+ *  (signer == verifyingContract == subjectAgent — V1), enforce expiry, then re-check the subject SA's
+ *  ERC-1271 signature over the digest (authoritative). Fail-closed: any anomaly → `ok:false`. */
+export async function verifySignedCanonicalProfileBundle(bundle, opts) {
+    if (!bundle ||
+        bundle.type !== 'SignedAgentCardBundleV1' ||
+        !bundle.card ||
+        !bundle.proof?.signature ||
+        bundle.proof.type !== 'ERC1271SmartAgentSignature') {
+        return { ok: false, reason: 'bad_shape' };
+    }
+    let recomputed;
+    try {
+        recomputed = hashCanonicalProfile(bundle.card);
+    }
+    catch {
+        return { ok: false, reason: 'bad_shape' }; // invalid card shape
+    }
+    if (recomputed !== bundle.cardHash)
+        return { ok: false, reason: 'card_hash_mismatch' };
+    // V1: the subject SA self-asserts its own card. A delegated signer is a future version.
+    const subject = bundle.subjectAgent.toLowerCase();
+    if (bundle.proof.signer.toLowerCase() !== subject || bundle.proof.verifyingContract.toLowerCase() !== subject) {
+        return { ok: false, reason: 'subject_mismatch' };
+    }
+    if (bundle.expiresAt) {
+        const exp = Date.parse(bundle.expiresAt);
+        const now = opts.now ?? Date.now();
+        if (!Number.isNaN(exp) && now > exp)
+            return { ok: false, reason: 'expired' };
+    }
+    let valid;
+    try {
+        valid = await opts.verifier.verifyHash({
+            address: bundle.proof.verifyingContract,
+            hash: cardDigest({
+                cardHash: bundle.cardHash,
+                subjectAgent: bundle.subjectAgent,
+                issuedAt: bundle.issuedAt,
+                expiresAt: bundle.expiresAt,
+                chainId: bundle.proof.chainId,
+                verifyingContract: bundle.proof.verifyingContract,
+            }),
+            signature: bundle.proof.signature,
+        });
+    }
+    catch {
+        return { ok: false, reason: 'signature_invalid' };
+    }
+    if (!valid)
+        return { ok: false, reason: 'signature_invalid' };
+    return { ok: true, subjectAgent: bundle.subjectAgent, cardHash: bundle.cardHash, card: bundle.card };
+}
+/** @deprecated Renamed `verifySignedCanonicalProfileBundle` (spec 347 §0.3). */
+export const verifySignedAgentCardBundle = verifySignedCanonicalProfileBundle;
+//# sourceMappingURL=card.js.map

package/dist/card.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"card.js","sourceRoot":"","sources":["../src/card.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,KAAK,EAA0B,MAAM,MAAM,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,6FAA6F;AAC7F,+FAA+F;AAC/F,4DAA4D;AAC5D,OAAO,EAAE,gBAAgB,IAAI,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE5E;;mCAEmC;AACnC,MAAM,UAAU,oBAAoB,CAAC,OAAgC;IACnE,OAAO,UAAU,UAAU,CAAC,KAAK,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAY,CAAC;AACzF,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAIlD;2GAC2G;AAC3G,SAAS,UAAU,CAAC,CAOnB;IACC,OAAO,UAAU,CACf,KAAK,CACH,YAAY,CAAC;QACX,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE;QAC1C,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,CAAC,WAAW,EAAE;KACrD,CAAC,CACH,CACF,CAAC;AACJ,CAAC;AAsBD;8CAC8C;AAC9C,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAAgC,EAChC,IAA0B;IAE1B,MAAM,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,YAAY,CAAC;IACxE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,IAAI,CAC1B,UAAU,CAAC;QACT,QAAQ;QACR,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB;KAClB,CAAC,CACH,CAAC;IACF,OAAO;QACL,IAAI,EAAE,yBAAyB;QAC/B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ;QACR,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE;YACL,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,iBAAiB;YACjB,MAAM,EAAE,KAAK,CAAC,YAAY;YAC1B,SAAS;SACV;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,0BAA0B,GAAG,iCAAiC,CAAC;AAM5E;;;iGAGiG;AACjG,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,MAAsC,EACtC,IAAiD;IAEjD,IACE,CAAC,MAAM;QACP,MAAM,CAAC,IAAI,KAAK,yBAAyB;QACzC,CAAC,MAAM,CAAC,IAAI;QACZ,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS;QACxB,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,4BAA4B,EAClD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IAED,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,qBAAqB;IAClE,CAAC;IACD,IAAI,UAAU,KAAK,MAAM,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAEvF,wFAAwF;IACxF,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;QAC9G,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC/E,CAAC;IAED,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;YACrC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB;YACvC,IAAI,EAAE,UAAU,CAAC;gBACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;gBAC7B,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB;aAClD,CAAC;YACF,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC9D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AACvG,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,2BAA2B,GAAG,kCAAkC,CAAC"}

package/dist/client-key-binding.d.ts

@@ -0,0 +1,196 @@
+/**
+ * `ClientKeyBindingV1` — the Smart Agent's EIP-712 statement that ONE public key (a JWK, by RFC 7638
+ * thumbprint) may PRESENT for it at external doors — OAuth `private_key_jwt`, DPoP, RFC 9421 HTTP signatures,
+ * a TAP key directory — under one custody epoch, between `notBefore` and `notAfter`, published under one
+ * `clientId` (spec 442 §3; ontology `ap:ClientKeyBinding`; on-chain record `atl:clientKeys`).
+ *
+ * The service-agent-signing rule, applied to the doors the field runs: the service never holds the identity's
+ * key; it holds a DELEGATE (a custodied P-256 / Ed25519 key behind `JwsSignerPort`) and presents this binding beside
+ * it. Those doors cannot verify an ERC-7710 wire, so the binding takes the form they can carry: a signed
+ * statement the SA stands behind, validated through ERC-1271 by anyone who wants more than OAuth's trust.
+ *
+ * WHAT IT IS NOT. It is not an authority wire: it grants the key NO authority to act. Signatures under this key are the
+ * agent's PRESENTATIONS; what the agent may do at a door is still a mandate, verified per step (spec 350 §3.6).
+ * Revoked by a custody-epoch bump (every binding under the old epoch is dead — rotation re-approves, recovery
+ * does not; spec 410 §1) or by an explicit `atl:clientKeys` write. Short `notAfter` (≤ 90 days) is the default.
+ *
+ * Domain: `{ name:'AgenticPrimitivesClientKey', version:'1', chainId, verifyingContract: <SA> }`. The ERC-1271
+ * read and the custody-epoch read are INJECTED so this module stays network-free (same ports as `a2a/binding`).
+ */
+import { type Address, type Hex } from 'viem';
+import type { Erc1271Verifier, SmartAgentCardSigner } from './card.js';
+import { CLIENT_KEYS } from './constants.js';
+/** What the FIELD verifies at a door. secp256k1 (`ES256K`) is deliberately absent: no OAuth / DPoP / 9421 door checks it. */
+export type ClientKeyAlg = 'ES256' | 'EdDSA';
+export declare const CLIENT_KEY_ALGS: readonly ClientKeyAlg[];
+/**
+ * `service` — the estate's personal-agent SERVICE presents (the only client at a company's door, spec 442 §7.1).
+ * `person` — the person's own SA presents under its own `clientId`; allowed ONLY for a `naming: public` posture,
+ * because a per-person client document publishes the person's label to every company (§7).
+ */
+export type ClientKeyScope = 'service' | 'person';
+export interface ClientKeyBindingV1 {
+    /** The Smart Agent, CAIP-10 (`eip155:<chainId>:<address>`). */
+    canonicalAgentId: string;
+    scope: ClientKeyScope;
+    /** The HTTPS URL the key is published under (the client metadata document / JWKS / key directory). */
+    clientId: string;
+    /** RFC 7638 thumbprint (base64url sha256) of the public JWK. */
+    jwkThumbprint: string;
+    alg: ClientKeyAlg;
+    /** The SA's custody epoch at signing (`AgentAccount.custodyEpoch()`; 0 for a generation-1 account). */
+    custodyEpoch: number;
+    /** Unix seconds. */
+    notBefore: number;
+    notAfter: number;
+}
+/** A binding plus the SA's ERC-1271-validatable signature over its EIP-712 digest. */
+export interface SignedClientKeyBindingV1 {
+    binding: ClientKeyBindingV1;
+    chainId: number;
+    /** The Smart Agent (EIP-712 `verifyingContract`; ERC-1271 validator). */
+    verifyingContract: Address;
+    signature: Hex;
+}
+export declare const CLIENT_KEY_BINDING_DOMAIN_NAME = "AgenticPrimitivesClientKey";
+export declare const CLIENT_KEY_BINDING_DOMAIN_VERSION = "1";
+export declare const CLIENT_KEY_BINDING_TYPES: {
+    readonly ClientKeyBinding: readonly [{
+        readonly name: "canonicalAgentId";
+        readonly type: "string";
+    }, {
+        readonly name: "scope";
+        readonly type: "string";
+    }, {
+        readonly name: "clientId";
+        readonly type: "string";
+    }, {
+        readonly name: "jwkThumbprint";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "alg";
+        readonly type: "string";
+    }, {
+        readonly name: "custodyEpoch";
+        readonly type: "uint64";
+    }, {
+        readonly name: "notBefore";
+        readonly type: "uint64";
+    }, {
+        readonly name: "notAfter";
+        readonly type: "uint64";
+    }];
+};
+/** The EIP-712 type string (for TYPEHASH parity checks). Off-chain only today: no contract consumes it. */
+export declare const CLIENT_KEY_BINDING_TYPE_STRING = "ClientKeyBinding(string canonicalAgentId,string scope,string clientId,bytes32 jwkThumbprint,string alg,uint64 custodyEpoch,uint64 notBefore,uint64 notAfter)";
+/** The default validity a Home signs for: 90 days. Longer is allowed and visible; it is never silently extended. */
+export declare const CLIENT_KEY_BINDING_DEFAULT_TTL_SECONDS: number;
+export declare function clientKeyBindingDomain(chainId: number, smartAgent: Address): {
+    readonly name: "AgenticPrimitivesClientKey";
+    readonly version: "1";
+    readonly chainId: number;
+    readonly verifyingContract: `0x${string}`;
+};
+/**
+ * Validate a candidate binding. Returns `[]` when well-formed, else one issue per violation. Shape only — the
+ * posture rule is `assertClientKeyScopeAllowed`, the epoch rule is `verifySignedClientKeyBinding`.
+ */
+export declare function validateClientKeyBinding(b: unknown): string[];
+/** The EIP-712 message as signed: the thumbprint as bytes32, the integers as uint64. */
+export declare function clientKeyBindingMessage(b: ClientKeyBindingV1): {
+    canonicalAgentId: string;
+    scope: ClientKeyScope;
+    clientId: string;
+    jwkThumbprint: `0x${string}`;
+    alg: ClientKeyAlg;
+    custodyEpoch: bigint;
+    notBefore: bigint;
+    notAfter: bigint;
+};
+/** The 32-byte EIP-712 digest the SA signs and ERC-1271 validates. */
+export declare function clientKeyBindingDigest(binding: ClientKeyBindingV1, chainId: number, smartAgent: Address): Hex;
+/**
+ * Spec 442 §7: a `scope: 'person'` binding publishes a per-person client document, which names the person to
+ * every company and is enumerable — allowed only when the person's naming posture is already `public`. The
+ * posture is the agent's `AgentDiscoveryPolicyV1.naming` (agent-resolution); passed structurally so this module
+ * depends on nothing. The estate's personal-agent SERVICE (`scope: 'service'`) is the client for everyone else.
+ */
+export declare function clientKeyScopeRefusal(binding: Pick<ClientKeyBindingV1, 'scope'>, posture: {
+    naming: string;
+}): string | null;
+export declare function assertClientKeyScopeAllowed(binding: Pick<ClientKeyBindingV1, 'scope'>, posture: {
+    naming: string;
+}): void;
+export interface BuildSignedClientKeyBindingInput {
+    binding: ClientKeyBindingV1;
+    chainId: number;
+    smartAgent: Address;
+    /** Signs the 32-byte digest as the SA (ERC-1271-validatable). */
+    signer: SmartAgentCardSigner;
+    /** The agent's naming posture — the §7 rule runs here, before any signature. */
+    posture: {
+        naming: string;
+    };
+}
+/** Validate → posture → sign. The binding names this SA on this chain or it is refused before signing. */
+export declare function buildSignedClientKeyBinding(input: BuildSignedClientKeyBindingInput): Promise<SignedClientKeyBindingV1>;
+export type VerifyClientKeyBindingResult = {
+    ok: true;
+    smartAgent: Address;
+    digest: Hex;
+} | {
+    ok: false;
+    reason: 'bad_shape' | 'agent_mismatch' | 'alg_not_field_verifiable' | 'scope_refused' | 'thumbprint_mismatch' | 'stale_custody_epoch' | 'not_yet_valid' | 'expired' | 'signature_invalid';
+    detail?: string;
+};
+export interface VerifyClientKeyBindingOptions {
+    erc1271Verifier: Erc1271Verifier;
+    /** The SA's CURRENT custody epoch, read by the caller (`agent-account` `custodyEpochOf`). A binding under any other epoch is dead. */
+    currentCustodyEpoch: number;
+    /** Unix seconds; defaults to now. */
+    now?: number;
+    /** When given, the binding MUST name this key (the key that actually signed the request being verified). */
+    expectThumbprint?: string;
+    /** When given, the §7 posture rule is re-checked at verification (a door that knows the agent's posture). */
+    posture?: {
+        naming: string;
+    };
+}
+/**
+ * Fail-closed: shape → alg the field verifies → names this SA on this chain → expected key → posture → custody
+ * epoch is CURRENT → validity window → ERC-1271 over the EIP-712 digest. Any anomaly ⇒ `ok:false`.
+ */
+export declare function verifySignedClientKeyBinding(signed: SignedClientKeyBindingV1, opts: VerifyClientKeyBindingOptions): Promise<VerifyClientKeyBindingResult>;
+/**
+ * One row of the SA-keyed `atl:clientKeys` string record: the PUBLIC half of every live binding (thumbprint,
+ * alg, scope, clientId, epoch, notAfter) — what a verifier that wants more than OAuth's trust checks a
+ * presented binding against, and what a JWKS / key directory is projected from. Never the signature, never a
+ * private key. Written by the SA itself (`buildSetClientKeysCall`); an explicit write with the row removed is
+ * the second way to revoke (the first is the custody-epoch bump).
+ */
+export interface ClientKeyRecordRowV1 {
+    thumbprint: string;
+    alg: ClientKeyAlg;
+    scope: ClientKeyScope;
+    clientId: string;
+    custodyEpoch: number;
+    notAfter: number;
+}
+export interface ClientKeysRecordV1 {
+    v: 1;
+    keys: ClientKeyRecordRowV1[];
+}
+export declare function clientKeyRecordRow(b: ClientKeyBindingV1): ClientKeyRecordRowV1;
+/** Validate a candidate record. `[]` when valid. */
+export declare function validateClientKeysRecord(r: unknown): string[];
+/** RFC 8785 canonical JSON — two equal records encode to identical bytes (as `atl:distribution`). */
+export declare function encodeClientKeys(record: ClientKeysRecordV1): string;
+/** Fail-closed: anything that is not a valid record is `null` — an unreadable record is an answer, never a guess (ADR-0013). */
+export declare function decodeClientKeys(value: string | null | undefined): ClientKeysRecordV1 | null;
+/** The rows a verifier treats as LIVE now: current epoch, not past `notAfter`. Stale rows are dead, not pruned here. */
+export declare function liveClientKeys(record: ClientKeysRecordV1, opts: {
+    currentCustodyEpoch: number;
+    now?: number;
+}): ClientKeyRecordRowV1[];
+export { CLIENT_KEYS };
+//# sourceMappingURL=client-key-binding.d.ts.map

package/dist/client-key-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-key-binding.d.ts","sourceRoot":"","sources":["../src/client-key-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAiB,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAE7D,OAAO,KAAK,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAEvE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAK7C,6HAA6H;AAC7H,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,CAAC;AAC7C,eAAO,MAAM,eAAe,EAAE,SAAS,YAAY,EAAgC,CAAC;AAEpF;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,QAAQ,CAAC;AAElD,MAAM,WAAW,kBAAkB;IACjC,+DAA+D;IAC/D,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,cAAc,CAAC;IACtB,sGAAsG;IACtG,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,YAAY,CAAC;IAClB,uGAAuG;IACvG,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,sFAAsF;AACtF,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,iBAAiB,EAAE,OAAO,CAAC;IAC3B,SAAS,EAAE,GAAG,CAAC;CAChB;AAID,eAAO,MAAM,8BAA8B,+BAA+B,CAAC;AAC3E,eAAO,MAAM,iCAAiC,MAAM,CAAC;AAErD,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;CAW3B,CAAC;AAEX,2GAA2G;AAC3G,eAAO,MAAM,8BAA8B,iKACqH,CAAC;AAEjK,oHAAoH;AACpH,eAAO,MAAM,sCAAsC,QAAiB,CAAC;AAErE,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO;;;;;EAO1E;AAKD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,CAqB7D;AAED,wFAAwF;AACxF,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,kBAAkB;;;;;;;;;EAa5D;AAED,sEAAsE;AACtE,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAG,GAAG,CAO7G;AAID;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,CAK5H;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAGzH;AAID,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,kBAAkB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,iEAAiE;IACjE,MAAM,EAAE,oBAAoB,CAAC;IAC7B,gFAAgF;IAChF,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7B;AAED,0GAA0G;AAC1G,wBAAsB,2BAA2B,CAAC,KAAK,EAAE,gCAAgC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAY5H;AAID,MAAM,MAAM,4BAA4B,GACpC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,GAC9C;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EACF,WAAW,GACX,gBAAgB,GAChB,0BAA0B,GAC1B,eAAe,GACf,qBAAqB,GACrB,qBAAqB,GACrB,eAAe,GACf,SAAS,GACT,mBAAmB,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEN,MAAM,WAAW,6BAA6B;IAC5C,eAAe,EAAE,eAAe,CAAC;IACjC,sIAAsI;IACtI,mBAAmB,EAAE,MAAM,CAAC;IAC5B,qCAAqC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4GAA4G;IAC5G,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6GAA6G;IAC7G,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9B;AAED;;;GAGG;AACH,wBAAsB,4BAA4B,CAChD,MAAM,EAAE,wBAAwB,EAChC,IAAI,EAAE,6BAA6B,GAClC,OAAO,CAAC,4BAA4B,CAAC,CAyCvC;AAID;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,YAAY,CAAC;IAClB,KAAK,EAAE,cAAc,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,oBAAoB,EAAE,CAAC;CAC9B;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,kBAAkB,GAAG,oBAAoB,CAE9E;AAED,oDAAoD;AACpD,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,CA0B7D;AAED,qGAAqG;AACrG,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAInE;AAED,gIAAgI;AAChI,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,kBAAkB,GAAG,IAAI,CAK5F;AAED,wHAAwH;AACxH,wBAAgB,cAAc,CAAC,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE;IAAE,mBAAmB,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,oBAAoB,EAAE,CAGtI;AAED,OAAO,EAAE,WAAW,EAAE,CAAC"}