@agenticprimitives/delegation 0.1.0-alpha.2

package/dist/token.js

@@ -0,0 +1,459 @@
+// DelegationToken envelope (per spec 202 §4):
+//   base64url(canonicalJSON(claims)) + '.' + base64url(sessionKeySig)
+//
+// Verification (per spec 202 §6):
+//   1. recover session key from signature → must match claims.sessionKeyAddress
+//   2. check claims.aud matches expected audience + claims.exp not past
+//   3. EIP-712 hashDelegation
+//   4. on-chain DelegationManager.isRevoked
+//   5. on-chain AgentAccount.isValidSignature (ERC-1271)
+//   6. evaluateCaveats (fail-closed) — pass toolName via opts for tool-scope
+//   7. atomic JTI usage tracking
+//   8. return { principal: delegator }
+import { secp256k1 } from '@noble/curves/secp256k1';
+import { keccak_256 } from '@noble/hashes/sha3';
+import { createPublicClient, http } from 'viem';
+import { hashDelegation } from './hash';
+import { evaluateCaveats } from './evaluator';
+import { buildEvent } from '@agenticprimitives/audit';
+// ─── base64url + canonical JSON helpers ──────────────────────────────────
+function base64urlEncode(s) {
+    return Buffer.from(s, 'utf8').toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function base64urlDecodeStr(s) {
+    let padded = s.replace(/-/g, '+').replace(/_/g, '/');
+    while (padded.length % 4)
+        padded += '=';
+    return Buffer.from(padded, 'base64').toString('utf8');
+}
+function base64urlEncodeBytes(b) {
+    return Buffer.from(b).toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function base64urlDecodeBytes(s) {
+    let padded = s.replace(/-/g, '+').replace(/_/g, '/');
+    while (padded.length % 4)
+        padded += '=';
+    return new Uint8Array(Buffer.from(padded, 'base64'));
+}
+/** Sorted-key JSON; BigInt → numeric string. Both sides must produce the
+ *  exact same bytes for the signature to round-trip.
+ *
+ *  Exported for cross-runtime golden-test fixtures. Stability of this
+ *  function is a SECURITY INVARIANT — any byte-level drift across
+ *  runtimes (Node, Bun, browser, Cloudflare Workers) means the same
+ *  claims hash to different signatures, breaking token verification
+ *  silently. */
+export function canonicalJSON(value) {
+    const seen = new WeakSet();
+    const stringify = (v) => {
+        if (v === null)
+            return 'null';
+        if (typeof v === 'boolean')
+            return String(v);
+        if (typeof v === 'number')
+            return Number.isFinite(v) ? String(v) : 'null';
+        if (typeof v === 'bigint')
+            return JSON.stringify(v.toString());
+        if (typeof v === 'string')
+            return JSON.stringify(v);
+        if (Array.isArray(v)) {
+            return '[' + v.map((x) => (x === undefined ? 'null' : stringify(x))).join(',') + ']';
+        }
+        if (typeof v === 'object') {
+            if (seen.has(v))
+                throw new Error('canonicalJSON: circular reference');
+            seen.add(v);
+            const obj = v;
+            // Drop undefined keys (standard JSON behavior).
+            const keys = Object.keys(obj).filter((k) => obj[k] !== undefined).sort();
+            return '{' + keys.map((k) => JSON.stringify(k) + ':' + stringify(obj[k])).join(',') + '}';
+        }
+        throw new Error(`canonicalJSON: unsupported type ${typeof v}`);
+    };
+    return stringify(value);
+}
+function eip191Digest(message) {
+    const bytes = new TextEncoder().encode(message);
+    const prefix = new TextEncoder().encode(`\x19Ethereum Signed Message:\n${bytes.length}`);
+    const combined = new Uint8Array(prefix.length + bytes.length);
+    combined.set(prefix, 0);
+    combined.set(bytes, prefix.length);
+    return keccak_256(combined);
+}
+function recoverEoaFromEip191Sig(message, signature) {
+    const sig = signature.startsWith('0x') ? signature.slice(2) : signature;
+    if (sig.length !== 130)
+        throw new Error(`signature must be 65 bytes (130 hex chars); got ${sig.length}`);
+    const r = BigInt('0x' + sig.slice(0, 64));
+    const s = BigInt('0x' + sig.slice(64, 128));
+    const v = parseInt(sig.slice(128, 130), 16);
+    const recovery = v >= 27 ? v - 27 : v;
+    const eipSig = new secp256k1.Signature(r, s).addRecoveryBit(recovery);
+    const digest = eip191Digest(message);
+    const pub = eipSig.recoverPublicKey(digest).toRawBytes(false);
+    const hash = keccak_256(pub.slice(1));
+    let hex = '0x';
+    for (const b of hash.slice(12))
+        hex += b.toString(16).padStart(2, '0');
+    return hex;
+}
+function randomJti() {
+    const buf = new Uint8Array(16);
+    globalThis.crypto.getRandomValues(buf);
+    let s = 'jti_';
+    for (const b of buf)
+        s += b.toString(16).padStart(2, '0');
+    return s;
+}
+// ─── Mint ──────────────────────────────────────────────────────────────────
+/**
+ * Production hard-ceilings on token lifespan + reuse. Callers may set
+ * tighter limits via `opts.maxAllowedTtlSeconds` / `opts.maxAllowedUsageLimit`;
+ * setting LOOSER values requires explicit `opts.acceptElevatedRisk: true`.
+ *
+ * Rationale: a leaked long-lived high-usage token is an authority leak
+ * for its full window. Today's defaults (1h TTL, 100 uses) are aggressive
+ * enough that a missed-rotation incident has bounded blast radius.
+ */
+const DEFAULT_MAX_TTL_SECONDS = 60 * 60; // 1 hour
+const DEFAULT_MAX_USAGE_LIMIT = 100;
+export async function mintDelegationToken(claims, signMessage, opts) {
+    const jti = claims.jti ?? randomJti();
+    const ttl = claims.ttlSeconds ?? 600; // 10 minutes default; tokens are short-lived
+    // Production ceiling enforcement.
+    const ttlCeiling = opts?.maxAllowedTtlSeconds ?? DEFAULT_MAX_TTL_SECONDS;
+    if (ttl > ttlCeiling && !opts?.acceptElevatedRisk) {
+        throw new Error(`mintDelegationToken: ttlSeconds=${ttl} exceeds ceiling=${ttlCeiling}. ` +
+            `Tighten TTL or set { acceptElevatedRisk: true } to acknowledge ` +
+            `the elevated blast-radius of a long-lived token.`);
+    }
+    if (typeof claims.usageLimit === 'number' &&
+        claims.usageLimit > (opts?.maxAllowedUsageLimit ?? DEFAULT_MAX_USAGE_LIMIT) &&
+        !opts?.acceptElevatedRisk) {
+        throw new Error(`mintDelegationToken: usageLimit=${claims.usageLimit} exceeds ceiling=` +
+            `${opts?.maxAllowedUsageLimit ?? DEFAULT_MAX_USAGE_LIMIT}. ` +
+            `Tighten usageLimit or set { acceptElevatedRisk: true }.`);
+    }
+    if (ttl <= 0) {
+        throw new Error(`mintDelegationToken: ttlSeconds must be positive; got ${ttl}`);
+    }
+    if (typeof claims.usageLimit === 'number' && claims.usageLimit <= 0) {
+        throw new Error(`mintDelegationToken: usageLimit must be positive when set; got ${claims.usageLimit}`);
+    }
+    const iat = Math.floor(Date.now() / 1000);
+    const exp = iat + ttl;
+    const full = {
+        iss: claims.iss,
+        aud: claims.aud,
+        sub: claims.sub,
+        delegation: claims.delegation,
+        sessionKeyAddress: claims.sessionKeyAddress,
+        jti,
+        iat,
+        exp,
+        usageLimit: claims.usageLimit,
+    };
+    const canonical = canonicalJSON(full);
+    const sig = await signMessage(canonical);
+    const sigHex = sig.startsWith('0x') ? sig.slice(2) : sig;
+    const sigBytes = new Uint8Array(Buffer.from(sigHex, 'hex'));
+    const token = `${base64urlEncode(canonical)}.${base64urlEncodeBytes(sigBytes)}`;
+    // Audit emit (C3 pass 3c). Fail-soft. JTI is logged because it's the
+    // correlation primitive for downstream verify events — not secret.
+    if (opts?.auditSink) {
+        try {
+            await opts.auditSink.write(buildEvent({
+                action: 'delegation.mint',
+                outcome: 'success',
+                correlationId: opts.correlationId,
+                actor: { type: 'user', id: claims.delegation.delegator },
+                subject: { type: 'jti', id: jti },
+                audience: claims.aud,
+                context: {
+                    iss: claims.iss,
+                    sub: claims.sub,
+                    sessionKeyAddress: claims.sessionKeyAddress,
+                    ttlSeconds: ttl,
+                    usageLimit: claims.usageLimit ?? null,
+                },
+            }));
+        }
+        catch {
+            /* fail-soft */
+        }
+    }
+    return { token, jti };
+}
+// ─── Verify ────────────────────────────────────────────────────────────────
+const DELEGATION_MANAGER_ABI = [
+    {
+        type: 'function',
+        name: 'isRevoked',
+        stateMutability: 'view',
+        inputs: [{ name: 'hash', type: 'bytes32' }],
+        outputs: [{ name: '', type: 'bool' }],
+    },
+];
+const ACCOUNT_ABI_ERC1271 = [
+    {
+        type: 'function',
+        name: 'isValidSignature',
+        stateMutability: 'view',
+        inputs: [
+            { name: 'hash', type: 'bytes32' },
+            { name: 'signature', type: 'bytes' },
+        ],
+        outputs: [{ name: '', type: 'bytes4' }],
+    },
+];
+const ACCEPTED_SESSION_DELEGATION_ABI = [
+    {
+        type: 'function',
+        name: 'isAcceptedSessionDelegation',
+        stateMutability: 'view',
+        inputs: [{ name: 'sessionDelegationHash', type: 'bytes32' }],
+        outputs: [{ name: '', type: 'bool' }],
+    },
+];
+const ERC1271_MAGIC = '0x1626ba7e';
+function decodeToken(token) {
+    const parts = token.split('.');
+    if (parts.length !== 2)
+        return null;
+    let canonical;
+    let claims;
+    try {
+        canonical = base64urlDecodeStr(parts[0]);
+        const parsed = JSON.parse(canonical);
+        if (typeof parsed.delegation.salt === 'string') {
+            parsed.delegation = { ...parsed.delegation, salt: BigInt(parsed.delegation.salt) };
+        }
+        claims = parsed;
+    }
+    catch {
+        return null;
+    }
+    const sigBytes = base64urlDecodeBytes(parts[1]);
+    let sigHex = '0x';
+    for (const b of sigBytes)
+        sigHex += b.toString(16).padStart(2, '0');
+    return { claims, canonical, signature: sigHex };
+}
+/**
+ * Full verification pipeline. Caller passes `toolName` in opts for tool-scope
+ * caveat evaluation; without it the mcp-tool-scope caveat denies.
+ */
+export async function verifyDelegationToken(token, opts) {
+    // Audit emit helper (audit C3 pass 3b). Fail-soft: an emit failure
+    // never breaks the verify flow.
+    const emit = async (outcome, reason, principal, delegationDigest) => {
+        if (!opts.auditSink)
+            return;
+        try {
+            await opts.auditSink.write(buildEvent({
+                action: outcome === 'success'
+                    ? 'delegation.verify.accept'
+                    : 'delegation.verify.reject',
+                outcome,
+                correlationId: opts.correlationId,
+                actor: principal ? { type: 'user', id: principal } : { type: 'unknown' },
+                subject: delegationDigest
+                    ? { type: 'delegation', id: delegationDigest }
+                    : undefined,
+                audience: opts.audience,
+                chainId: opts.chainId,
+                digest: delegationDigest,
+                reason,
+                context: opts.toolName ? { tool: opts.toolName } : undefined,
+            }));
+        }
+        catch {
+            /* fail-soft */
+        }
+    };
+    const rejectWith = async (reason, principal, delegationDigest) => {
+        await emit('denied', reason, principal, delegationDigest);
+        return { error: reason };
+    };
+    const decoded = decodeToken(token);
+    if (!decoded)
+        return rejectWith('malformed token');
+    const { claims, canonical, signature } = decoded;
+    if (claims.aud !== opts.audience)
+        return rejectWith('audience mismatch');
+    const now = Math.floor((opts.now ?? Date.now)() / 1000);
+    if (typeof claims.exp !== 'number' || claims.exp < now)
+        return rejectWith('token expired');
+    // 1. recover session key
+    let recovered;
+    try {
+        recovered = recoverEoaFromEip191Sig(canonical, signature);
+    }
+    catch (e) {
+        return rejectWith(`signature recovery failed: ${e instanceof Error ? e.message : e}`);
+    }
+    if (recovered.toLowerCase() !== claims.sessionKeyAddress.toLowerCase()) {
+        return rejectWith('session-key signature mismatch');
+    }
+    // 2. EIP-712 hash
+    const eip712Hash = hashDelegation(claims.delegation, opts.chainId, opts.delegationManager);
+    // 3. on-chain checks
+    const requireDeployed = opts.requireDeployed ?? true;
+    // H7-B.9 / XPKG-005: default fail-CLOSED regardless of runtime. The
+    // previous NODE_ENV-keyed default opened on Workers / SES where
+    // `process.env.NODE_ENV` is undefined. Callers who genuinely want the
+    // permissive behavior MUST set `revocationFailMode: 'open'` explicitly.
+    const revocationFailMode = opts.revocationFailMode ?? 'closed';
+    const publicClient = createPublicClient({ transport: http(opts.rpcUrl) });
+    try {
+        const revoked = (await publicClient.readContract({
+            address: opts.delegationManager,
+            abi: DELEGATION_MANAGER_ABI,
+            functionName: 'isRevoked',
+            args: [eip712Hash],
+        }));
+        if (revoked) {
+            return rejectWith('delegation revoked', claims.delegation.delegator, eip712Hash);
+        }
+    }
+    catch (e) {
+        if (revocationFailMode === 'closed') {
+            return rejectWith('revocation check unavailable; refusing to verify (set revocationFailMode=open only for explicit dev/demo paths)', claims.delegation.delegator, eip712Hash);
+        }
+        void e;
+    }
+    try {
+        const code = await publicClient.getCode({ address: claims.delegation.delegator });
+        const isDeployed = !!(code && code !== '0x' && code.length > 2);
+        if (!isDeployed) {
+            if (requireDeployed) {
+                return rejectWith(`delegator smart account ${claims.delegation.delegator} is not deployed — cannot verify ERC-1271. Set verifyDelegationToken opt requireDeployed=false only for explicit counterfactual-demo use cases.`, claims.delegation.delegator, eip712Hash);
+            }
+            // Tolerated: caller opted into the undeployed path explicitly.
+        }
+        else {
+            const magic = (await publicClient.readContract({
+                address: claims.delegation.delegator,
+                abi: ACCOUNT_ABI_ERC1271,
+                functionName: 'isValidSignature',
+                args: [eip712Hash, claims.delegation.signature],
+            }));
+            if (magic.toLowerCase() !== ERC1271_MAGIC) {
+                return rejectWith('erc1271 validation failed', claims.delegation.delegator, eip712Hash);
+            }
+        }
+    }
+    catch (e) {
+        return rejectWith(`erc1271 call reverted: ${e instanceof Error ? e.message : e}`, claims.delegation.delegator, eip712Hash);
+    }
+    // 4. caveat evaluation
+    //
+    // H7-B.2 (PKG-DELEGATION-001 closure): verifyDelegationToken is an
+    // OFF-CHAIN gate (JTI / session-token / ERC-1271 / audit). It does NOT
+    // redeem the delegation on-chain, so on-chain-only caveats MUST stay
+    // strict — missing context for Value / AllowedTargets / AllowedMethods /
+    // inert sentinels denies with `'context-required'` rather than silently
+    // permitting. Callers who genuinely will redeem on-chain (a separate
+    // redeem path) call `evaluateCaveats` directly with `{ enforceOnChain: true }`.
+    const verdicts = evaluateCaveats(claims.delegation.caveats, { timestamp: now, mcpTool: opts.toolName }, opts.enforcerMap, { enforceOnChain: opts.enforceOnChain === true });
+    for (const v of verdicts) {
+        if (!v.allowed) {
+            return rejectWith(`caveat denied (${v.reason})`, claims.delegation.delegator, eip712Hash);
+        }
+    }
+    // 4.5. Spec 207 threshold-policy gates.
+    //   - requireQuorumCaveat: the delegation MUST carry a caveat whose
+    //     enforcer matches the caller's expected QuorumEnforcer address.
+    //     Caller decides which delegations need this based on the tool's
+    //     tool-policy decision (`requiresQuorum`). Without this opt set
+    //     we don't require quorum — backwards-compatible.
+    if (opts.requireQuorumCaveat) {
+        const target = opts.requireQuorumCaveat.enforcer.toLowerCase();
+        const hasQuorum = claims.delegation.caveats.some((c) => c.enforcer.toLowerCase() === target);
+        if (!hasQuorum) {
+            return rejectWith('tier requires quorum caveat but delegation lacks one', claims.delegation.delegator, eip712Hash);
+        }
+        // Audit H3 — caveat presence alone is NOT proof of quorum. The
+        // caller must declare ONE of two enforcement models so the gap
+        // is structural rather than implicit.
+        if (!opts.quorumProof) {
+            return rejectWith('quorum caveat present but no quorumProof supplied — refusing to assume on-chain enforcement', claims.delegation.delegator, eip712Hash);
+        }
+        if (opts.quorumProof.mode === 'off-chain') {
+            // Off-chain verification is a planned mode; the wire-format
+            // (payloadHash + packedSignatures) is reserved here so consumers
+            // can migrate when the implementation lands. Failing closed
+            // until the spec'd off-chain payload format is implemented.
+            return rejectWith('quorum_off_chain_not_implemented', claims.delegation.delegator, eip712Hash);
+        }
+        // mode === 'on-chain-redeemed' — caller asserts the call will
+        // pass through QuorumEnforcer.beforeHook on chain. Accept; the
+        // on-chain layer is responsible for the actual signature check.
+    }
+    //   - requireAcceptedOnChain: account.isAcceptedSessionDelegation(hash)
+    //     must return true. Spec § 6 high-risk gate. Single extra chain
+    //     read; only fires when the tool-policy decision flips this on
+    //     (typically critical-tier tools).
+    let acceptedOnChain = false;
+    if (opts.requireAcceptedOnChain) {
+        try {
+            acceptedOnChain = (await publicClient.readContract({
+                address: claims.delegation.delegator,
+                abi: ACCEPTED_SESSION_DELEGATION_ABI,
+                functionName: 'isAcceptedSessionDelegation',
+                args: [eip712Hash],
+            }));
+        }
+        catch (e) {
+            return rejectWith(`acceptSessionDelegation check reverted: ${e instanceof Error ? e.message : e}`, claims.delegation.delegator, eip712Hash);
+        }
+        if (!acceptedOnChain) {
+            return rejectWith('tier requires on-chain acceptSessionDelegation blessing; not present', claims.delegation.delegator, eip712Hash);
+        }
+    }
+    // 5. JTI replay
+    const limit = claims.usageLimit ?? 10;
+    const usage = await opts.jtiStore.trackUsage(claims.jti, limit);
+    if (!usage.allowed) {
+        return rejectWith('token usage limit exceeded', claims.delegation.delegator, eip712Hash);
+    }
+    // Accept emit — extended context to capture the threshold-policy
+    // outcome (`acceptedOnChain`) for forensics + dashboards. Reuses the
+    // same `emit` shape as the reject path but with extra context fields.
+    if (opts.auditSink) {
+        try {
+            const context = {};
+            if (opts.toolName)
+                context.tool = opts.toolName;
+            if (opts.requireAcceptedOnChain !== undefined) {
+                context.acceptedOnChain = acceptedOnChain;
+            }
+            await opts.auditSink.write(buildEvent({
+                action: 'delegation.verify.accept',
+                outcome: 'success',
+                correlationId: opts.correlationId,
+                actor: { type: 'user', id: claims.delegation.delegator },
+                subject: { type: 'delegation', id: eip712Hash },
+                audience: opts.audience,
+                chainId: opts.chainId,
+                digest: eip712Hash,
+                context: Object.keys(context).length > 0 ? context : undefined,
+            }));
+        }
+        catch {
+            /* fail-soft */
+        }
+    }
+    return { principal: claims.delegation.delegator };
+}
+// H7-B.8 (XPKG-002 / EXT-024 closure) — `verifyCrossDelegation` was a
+// public stub that unconditionally returned a "not implemented" error
+// string. Public symbols whose existence implies a capability the runtime
+// can't provide are an ADR-0013 violation (silent fallback in the type
+// system). Per spec 100 §6, experimental surface goes behind the
+// `./experimental` subpath. This implementation isn't ready for that
+// subpath either, so the function is DELETED from the public surface.
+// When the cross-delegation work resumes it lands under
+// `./experimental` per the doctrine. See PKG-delegation-001 in
+// docs/audits/2026-05-packages-contracts-production-readiness.md.
+//# sourceMappingURL=token.js.map

package/dist/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,sEAAsE;AACtE,EAAE;AACF,kCAAkC;AAClC,gFAAgF;AAChF,wEAAwE;AACxE,8BAA8B;AAC9B,4CAA4C;AAC5C,yDAAyD;AACzD,6EAA6E;AAC7E,iCAAiC;AACjC,uCAAuC;AAEvC,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAA0B,MAAM,MAAM,CAAC;AAQxE,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAkB,MAAM,0BAA0B,CAAC;AAEtE,4EAA4E;AAE5E,SAAS,eAAe,CAAC,CAAS;IAChC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9G,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAS;IACnC,IAAI,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,GAAG,CAAC;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,oBAAoB,CAAC,CAAa;IACzC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACtG,CAAC;AAED,SAAS,oBAAoB,CAAC,CAAS;IACrC,IAAI,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,GAAG,CAAC;IACxC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;gBAOgB;AAChB,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IACnC,MAAM,SAAS,GAAG,CAAC,CAAU,EAAU,EAAE;QACvC,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;QAC9B,IAAI,OAAO,CAAC,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1E,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACpD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,OAAO,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QACvF,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,IAAI,CAAC,GAAG,CAAC,CAAW,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YAChF,IAAI,CAAC,GAAG,CAAC,CAAW,CAAC,CAAC;YACtB,MAAM,GAAG,GAAG,CAA4B,CAAC;YACzC,gDAAgD;YAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;YACzE,OAAO,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QAC5F,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC;IACF,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,iCAAiC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9D,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAe,EAAE,SAAc;IAC9D,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACzG,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5C,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACvE,OAAO,GAAc,CAAC;AACxB,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,GAAG,MAAM,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,GAAG;QAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS;AAClD,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAkG,EAClG,WAA0C,EAC1C,IAsBC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,SAAS,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,6CAA6C;IAEnF,kCAAkC;IAClC,MAAM,UAAU,GAAG,IAAI,EAAE,oBAAoB,IAAI,uBAAuB,CAAC;IACzE,IAAI,GAAG,GAAG,UAAU,IAAI,CAAC,IAAI,EAAE,kBAAkB,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,mCAAmC,GAAG,oBAAoB,UAAU,IAAI;YACtE,iEAAiE;YACjE,kDAAkD,CACrD,CAAC;IACJ,CAAC;IACD,IACE,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;QACrC,MAAM,CAAC,UAAU,GAAG,CAAC,IAAI,EAAE,oBAAoB,IAAI,uBAAuB,CAAC;QAC3E,CAAC,IAAI,EAAE,kBAAkB,EACzB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,CAAC,UAAU,mBAAmB;YACrE,GAAG,IAAI,EAAE,oBAAoB,IAAI,uBAAuB,IAAI;YAC5D,yDAAyD,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,yDAAyD,GAAG,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,kEAAkE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACzG,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACtB,MAAM,IAAI,GAA0B;QAClC,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,GAAG;QACH,GAAG;QACH,GAAG;QACH,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC;IACF,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;IAChF,qEAAqE;IACrE,mEAAmE;IACnE,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CACxB,UAAU,CAAC;gBACT,MAAM,EAAE,iBAAiB;gBACzB,OAAO,EAAE,SAAS;gBAClB,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE;gBACxD,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE;gBACjC,QAAQ,EAAE,MAAM,CAAC,GAAG;gBACpB,OAAO,EAAE;oBACP,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;oBAC3C,UAAU,EAAE,GAAG;oBACf,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;iBACtC;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACxB,CAAC;AAED,8EAA8E;AAE9E,MAAM,sBAAsB,GAAG;IAC7B;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,WAAW;QACjB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC3C,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;KACtC;CACO,CAAC;AAEX,MAAM,mBAAmB,GAAG;IAC1B;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,kBAAkB;QACxB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;YACjC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;SACrC;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;KACxC;CACO,CAAC;AAEX,MAAM,+BAA+B,GAAG;IACtC;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,6BAA6B;QACnC,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC5D,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;KACtC;CACO,CAAC;AAEX,MAAM,aAAa,GAAG,YAAY,CAAC;AAyHnC,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,SAAiB,CAAC;IACtB,IAAI,MAA6B,CAAC;IAClC,IAAI,CAAC;QACH,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAElC,CAAC;QACF,IAAI,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,CAAC,UAAU,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrF,CAAC;QACD,MAAM,GAAG,MAAM,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACjD,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAa,EAAE,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAa,EACb,IAAmB;IAEnB,mEAAmE;IACnE,gCAAgC;IAChC,MAAM,IAAI,GAAG,KAAK,EAChB,OAA6B,EAC7B,MAA0B,EAC1B,SAA8B,EAC9B,gBAAiC,EACjC,EAAE;QACF,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO;QAC5B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CACxB,UAAU,CAAC;gBACT,MAAM,EACJ,OAAO,KAAK,SAAS;oBACnB,CAAC,CAAC,0BAA0B;oBAC5B,CAAC,CAAC,0BAA0B;gBAChC,OAAO;gBACP,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE;gBACxE,OAAO,EAAE,gBAAgB;oBACvB,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,gBAAgB,EAAE;oBAC9C,CAAC,CAAC,SAAS;gBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,gBAAgB;gBACxB,MAAM;gBACN,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;aAC7D,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,KAAK,EACtB,MAAc,EACd,SAAmB,EACnB,gBAAsB,EACA,EAAE;QACxB,MAAM,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAC1D,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO;QAAE,OAAO,UAAU,CAAC,iBAAiB,CAAC,CAAC;IACnD,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAEjD,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAC,mBAAmB,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IACxD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG;QAAE,OAAO,UAAU,CAAC,eAAe,CAAC,CAAC;IAE3F,yBAAyB;IACzB,IAAI,SAAkB,CAAC;IACvB,IAAI,CAAC;QACH,SAAS,GAAG,uBAAuB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,UAAU,CAAC,8BAA8B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,iBAAiB,CAAC,WAAW,EAAE,EAAE,CAAC;QACvE,OAAO,UAAU,CAAC,gCAAgC,CAAC,CAAC;IACtD,CAAC;IAED,kBAAkB;IAClB,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAE3F,qBAAqB;IACrB,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC;IACrD,oEAAoE;IACpE,gEAAgE;IAChE,sEAAsE;IACtE,wEAAwE;IACxE,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,IAAI,QAAQ,CAAC;IAC/D,MAAM,YAAY,GAAG,kBAAkB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC;YAC/C,OAAO,EAAE,IAAI,CAAC,iBAAiB;YAC/B,GAAG,EAAE,sBAAsB;YAC3B,YAAY,EAAE,WAAW;YACzB,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB,CAAC,CAAY,CAAC;QACf,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,UAAU,CAAC,oBAAoB,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,UAAU,CACf,iHAAiH,EACjH,MAAM,CAAC,UAAU,CAAC,SAAS,EAC3B,UAAU,CACX,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,CAAC;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;QAClF,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,eAAe,EAAE,CAAC;gBACpB,OAAO,UAAU,CACf,2BAA2B,MAAM,CAAC,UAAU,CAAC,SAAS,iJAAiJ,EACvM,MAAM,CAAC,UAAU,CAAC,SAAS,EAC3B,UAAU,CACX,CAAC;YACJ,CAAC;YACD,+DAA+D;QACjE,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC;gBAC7C,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS;gBACpC,GAAG,EAAE,mBAAmB;gBACxB,YAAY,EAAE,kBAAkB;gBAChC,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;aAChD,CAAC,CAAQ,CAAC;YACX,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,aAAa,EAAE,CAAC;gBAC1C,OAAO,UAAU,CAAC,2BAA2B,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,UAAU,CACf,0BAA0B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAC9D,MAAM,CAAC,UAAU,CAAC,SAAS,EAC3B,UAAU,CACX,CAAC;IACJ,CAAC;IAED,uBAAuB;IACvB,EAAE;IACF,mEAAmE;IACnE,uEAAuE;IACvE,qEAAqE;IACrE,yEAAyE;IACzE,wEAAwE;IACxE,qEAAqE;IACrE,gFAAgF;IAChF,MAAM,QAAQ,GAAG,eAAe,CAC9B,MAAM,CAAC,UAAU,CAAC,OAAO,EACzB,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,EAC1C,IAAI,CAAC,WAAW,EAChB,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CACjD,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,kBAAkB,CAAC,CAAC,MAAM,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,oEAAoE;IACpE,qEAAqE;IACrE,qEAAqE;IACrE,oEAAoE;IACpE,sDAAsD;IACtD,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAC9C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,MAAM,CAC3C,CAAC;QACF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,UAAU,CACf,sDAAsD,EACtD,MAAM,CAAC,UAAU,CAAC,SAAS,EAC3B,UAAU,CACX,CAAC;QACJ,CAAC;QAED,+DAA+D;QAC/D,+DAA+D;QAC/D,sCAAsC;QACtC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,OAAO,UAAU,CACf,6FAA6F,EAC7F,MAAM,CAAC,UAAU,CAAC,SAAS,EAC3B,UAAU,CACX,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC1C,4DAA4D;YAC5D,iEAAiE;YACjE,4DAA4D;YAC5D,4DAA4D;YAC5D,OAAO,UAAU,CACf,kCAAkC,EAClC,MAAM,CAAC,UAAU,CAAC,SAAS,EAC3B,UAAU,CACX,CAAC;QACJ,CAAC;QACD,8DAA8D;QAC9D,+DAA+D;QAC/D,gEAAgE;IAClE,CAAC;IAED,wEAAwE;IACxE,oEAAoE;IACpE,mEAAmE;IACnE,uCAAuC;IACvC,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,eAAe,GAAG,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC;gBACjD,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS;gBACpC,GAAG,EAAE,+BAA+B;gBACpC,YAAY,EAAE,6BAA6B;gBAC3C,IAAI,EAAE,CAAC,UAAU,CAAC;aACnB,CAAC,CAAY,CAAC;QACjB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,UAAU,CACf,2CAA2C,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAC/E,MAAM,CAAC,UAAU,CAAC,SAAS,EAC3B,UAAU,CACX,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,OAAO,UAAU,CACf,sEAAsE,EACtE,MAAM,CAAC,UAAU,CAAC,SAAS,EAC3B,UAAU,CACX,CAAC;QACJ,CAAC;IACH,CAAC;IAED,gBAAgB;IAChB,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAChE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,UAAU,CAAC,4BAA4B,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC3F,CAAC;IAED,iEAAiE;IACjE,qEAAqE;IACrE,sEAAsE;IACtE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,OAAO,GAAqD,EAAE,CAAC;YACrE,IAAI,IAAI,CAAC,QAAQ;gBAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC;YAChD,IAAI,IAAI,CAAC,sBAAsB,KAAK,SAAS,EAAE,CAAC;gBAC9C,OAAO,CAAC,eAAe,GAAG,eAAe,CAAC;YAC5C,CAAC;YACD,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CACxB,UAAU,CAAC;gBACT,MAAM,EAAE,0BAA0B;gBAClC,OAAO,EAAE,SAAS;gBAClB,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE;gBACxD,OAAO,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE;gBAC/C,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,UAAU;gBAClB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;aAC/D,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;AACpD,CAAC;AAED,sEAAsE;AACtE,sEAAsE;AACtE,0EAA0E;AAC1E,uEAAuE;AACvE,iEAAiE;AACjE,qEAAqE;AACrE,sEAAsE;AACtE,wDAAwD;AACxD,+DAA+D;AAC/D,kEAAkE"}

package/dist/types.d.ts

@@ -0,0 +1,162 @@
+import type { Address, Hex } from '@agenticprimitives/types';
+export type { Address, Hex };
+export declare const ROOT_AUTHORITY: Hex;
+export interface Caveat {
+    enforcer: Address;
+    terms: Hex;
+    args?: Hex;
+}
+export interface Delegation {
+    delegator: Address;
+    delegate: Address;
+    authority: Hex;
+    caveats: Caveat[];
+    salt: bigint;
+    signature: Hex;
+}
+export interface DataScopeGrant {
+    server: string;
+    resources: string[];
+    fields: string[];
+}
+export interface DelegationTokenClaims {
+    iss: string;
+    aud: string;
+    sub: Address;
+    delegation: Delegation;
+    sessionKeyAddress: Address;
+    jti: string;
+    iat: number;
+    exp: number;
+    usageLimit?: number;
+}
+export interface EnforcerAddressMap {
+    delegationManager: Address;
+    timestamp: Address;
+    value: Address;
+    allowedTargets: Address;
+    allowedMethods: Address;
+    taskBinding?: Address;
+    callDataHash?: Address;
+    recovery?: Address;
+    rateLimit?: Address;
+}
+export interface CaveatContext {
+    timestamp: number;
+    mcpTool?: string;
+    target?: Address;
+    selector?: Hex;
+    value?: bigint;
+    principal?: Address;
+}
+export type CaveatVerdict = {
+    enforcer: Address;
+    allowed: true;
+    reason?: string;
+} | {
+    enforcer: Address;
+    allowed: false;
+    reason: string;
+};
+export type VerifyError = {
+    error: string;
+};
+export interface JtiStore {
+    trackUsage(jti: string, limit: number): Promise<{
+        usage: number;
+        allowed: boolean;
+    }>;
+}
+export interface VerifyOpts {
+    chainId: number;
+    delegationManager: Address;
+    rpcUrl: string;
+    audience: string;
+    enforcerMap: EnforcerAddressMap;
+    jtiStore: JtiStore;
+    now?: () => number;
+    /**
+     * Opt in to permissive caveat evaluation for on-chain-only caveats
+     * (Value / AllowedTargets / AllowedMethods / inert sentinels) when the
+     * caller can guarantee an on-chain redeem will follow (where the enforcer
+     * DOES fire). When `false`/omitted (default — H7-B.2 strict mode), those
+     * caveats deny missing-context with `'context-required'` so off-chain
+     * gates (MCP / A2A) can't silently permit a call that the on-chain
+     * enforcer would have caught.
+     *
+     * Off-chain JTI / session-token verify uses strict mode. Spec 202 §11.
+     */
+    enforceOnChain?: boolean;
+}
+/**
+ * H7-B.2 — options for `evaluateCaveats`. Mirrors the `enforceOnChain` flag
+ * on {@link VerifyOpts}. Strict by default.
+ */
+export interface EvaluateOpts {
+    enforceOnChain?: boolean;
+}
+export interface DelegationClientOpts {
+    signer: {
+        address: Address;
+        signTypedData(args: {
+            domain: {
+                name: string;
+                version: string;
+                chainId: number;
+                verifyingContract: Address;
+            };
+            types: Record<string, ReadonlyArray<{
+                name: string;
+                type: string;
+            }>>;
+            primaryType: string;
+            message: Record<string, unknown>;
+        }): Promise<Hex>;
+    };
+    smartAccount: Address;
+    chainId: number;
+    delegationManager: Address;
+}
+export interface SessionMeta {
+    sessionId: string;
+    accountAddress: Address;
+    chainId: number;
+    expiresAt: string;
+}
+export interface SessionPackage {
+    sessionPrivateKey: Hex;
+    delegation: Delegation;
+}
+export interface SessionRow {
+    id: string;
+    accountAddress: Address;
+    chainId: number;
+    sessionKeyAddress: Address;
+    status: 'pending' | 'active' | 'revoked' | 'expired';
+    encryptedPackage: Uint8Array;
+    iv: Uint8Array;
+    encryptedDataKey: Uint8Array;
+    keyVersion: string;
+    expiresAt: string;
+    variant?: 'A' | 'B';
+    createdAt: string;
+    revokedAt?: string;
+}
+export interface SessionStore {
+    save(row: SessionRow): Promise<void>;
+    get(id: string): Promise<SessionRow | null>;
+    list(accountAddress: Address): Promise<SessionRow[]>;
+    revoke(id: string): Promise<void>;
+}
+export interface TxContext {
+    rpcUrl: string;
+    chainId: number;
+    delegationManager: Address;
+    signer: {
+        address: Address;
+        signMessage(msg: string | {
+            raw: Hex;
+        }): Promise<Hex>;
+    };
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAE7D,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAE7B,eAAO,MAAM,cAAc,EAAE,GACyC,CAAC;AAEvE,MAAM,WAAW,MAAM;IACrB,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,GAAG,CAAC;IACX,IAAI,CAAC,EAAE,GAAG,CAAC;CACZ;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,GAAG,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,GAAG,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,OAAO,CAAC;IACb,UAAU,EAAE,UAAU,CAAC;IACvB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,GAAG,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D,MAAM,MAAM,WAAW,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5C,MAAM,WAAW,QAAQ;IACvB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACtF;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,kBAAkB,CAAC;IAChC,QAAQ,EAAE,QAAQ,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE;QACN,OAAO,EAAE,OAAO,CAAC;QACjB,aAAa,CAAC,IAAI,EAAE;YAClB,MAAM,EAAE;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,OAAO,EAAE,MAAM,CAAC;gBAAC,OAAO,EAAE,MAAM,CAAC;gBAAC,iBAAiB,EAAE,OAAO,CAAA;aAAE,CAAC;YACvF,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAA;aAAE,CAAC,CAAC,CAAC;YACrE,WAAW,EAAE,MAAM,CAAC;YACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SAClC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;KAClB,CAAC;IACF,YAAY,EAAE,OAAO,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,iBAAiB,EAAE,GAAG,CAAC;IACvB,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IACrD,gBAAgB,EAAE,UAAU,CAAC;IAC7B,EAAE,EAAE,UAAU,CAAC;IACf,gBAAgB,EAAE,UAAU,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,cAAc,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACrD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,MAAM,EAAE;QACN,OAAO,EAAE,OAAO,CAAC;QACjB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG;YAAE,GAAG,EAAE,GAAG,CAAA;SAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;KACvD,CAAC;CACH"}

package/dist/types.js

@@ -0,0 +1,3 @@
+// Shared types for @agenticprimitives/delegation.
+export const ROOT_AUTHORITY = '0x0000000000000000000000000000000000000000000000000000000000000000';
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAMlD,MAAM,CAAC,MAAM,cAAc,GACzB,oEAAoE,CAAC"}