@agenticprimitives/delegation 1.0.0-alpha.12 → 1.0.0-alpha.14

package/dist/caveats.d.ts

@@ -18,6 +18,9 @@ export declare function encodeAllowedMethodsTerms(selectors: Hex[]): Hex;
 export declare function encodeCallDataHashTerms(callData: Hex): Hex;
 export declare function buildMcpToolScopeCaveat(allowedTools: string[]): Caveat;
 export declare function buildDataScopeCaveat(grants: DataScopeGrant[]): Caveat;
+/** Decode a `DATA_SCOPE` caveat's terms back to its grants. Used OFF-CHAIN by the resource server (the
+ *  vault/MCP runtime) to scope the field projection — the on-chain evaluator treats the sentinel as inert. */
+export declare function decodeDataScopeTerms(terms: Hex): DataScopeGrant[];
 export declare function buildVaultKeyUseCaveat(grant: VaultKeyUseGrant): Caveat;
 /** Decode a `VAULT_KEY_USE` caveat's terms back to its grant. Used by the KAS
  *  (key-authorization, P2) to evaluate the authorization's scope against a request. */

package/dist/caveats.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"caveats.d.ts","sourceRoot":"","sources":["../src/caveats.ts"],"names":[],"mappings":"AAQA,OAAO,EAAuD,KAAK,GAAG,EAAE,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AAEnG,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAW3E,eAAO,MAAM,uBAAuB,EAAE,OAA2D,CAAC;AAClG,eAAO,MAAM,mBAAmB,EAAE,OAAuD,CAAC;AAC1F,eAAO,MAAM,yBAAyB,EAAE,OAA6D,CAAC;AACtG;uFACuF;AACvF,eAAO,MAAM,sBAAsB,EAAE,OAA0D,CAAC;AAIhG,wBAAgB,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,GAAG,MAAM,CAE7E;AAID,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,GAAG,CAWhF;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAGtD;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,GAAG,CAGjE;AAED,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,GAAG,CAQ/D;AAED;;;oGAGoG;AACpG,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,GAAG,GAAG,GAAG,CAK1D;AAID,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,CAItE;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,CAgBrE;AAeD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAStE;AAED;uFACuF;AACvF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,GAAG,GAAG,gBAAgB,CAGnE;AAED,wBAAgB,0BAA0B,CACxC,oBAAoB,EAAE,OAAO,EAC7B,mBAAmB,EAAE,OAAO,GAC3B,MAAM,CAMR;AAWD,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;yDAEqD;IACrD,OAAO,EAAE,OAAO,EAAE,CAAC;IACnB;;kDAE8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB;kEAC8D;IAC9D,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAwBhE;AAID,iGAAiG;AACjG,eAAO,MAAM,yBAAyB,EAAE,GAAkB,CAAC;AAE3D,MAAM,WAAW,wBAAwB;IACvC;iFAC6E;IAC7E,SAAS,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,cAAc,EAAE,OAAO,CAAC;QAAC,cAAc,EAAE,OAAO,CAAA;KAAE,CAAC;IACtG,sDAAsD;IACtD,KAAK,EAAE,OAAO,CAAC;IACf,wBAAwB;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,0EAA0E;IAC1E,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,uBAAuB,EAAE,MAAM,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;kCAEkC;AAClC,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,uBAAuB,EAAE,MAAM,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG,GAAG,CA6BN;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,wBAAwB,GAAG,MAAM,EAAE,CAOnF;AAED;;gDAEgD;AAChD,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,MAAM,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,wBAAwB,GAAG,qBAAqB,CAW5F"}
+{"version":3,"file":"caveats.d.ts","sourceRoot":"","sources":["../src/caveats.ts"],"names":[],"mappings":"AAQA,OAAO,EAAuD,KAAK,GAAG,EAAE,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AAEnG,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAW3E,eAAO,MAAM,uBAAuB,EAAE,OAA2D,CAAC;AAClG,eAAO,MAAM,mBAAmB,EAAE,OAAuD,CAAC;AAC1F,eAAO,MAAM,yBAAyB,EAAE,OAA6D,CAAC;AACtG;uFACuF;AACvF,eAAO,MAAM,sBAAsB,EAAE,OAA0D,CAAC;AAIhG,wBAAgB,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,GAAG,MAAM,CAE7E;AAID,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,GAAG,CAWhF;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAGtD;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,GAAG,CAGjE;AAED,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,GAAG,CAQ/D;AAED;;;oGAGoG;AACpG,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,GAAG,GAAG,GAAG,CAK1D;AAID,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,CAItE;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,CAgBrE;AAaD;8GAC8G;AAC9G,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,GAAG,GAAG,cAAc,EAAE,CAGjE;AAeD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAStE;AAED;uFACuF;AACvF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,GAAG,GAAG,gBAAgB,CAGnE;AAED,wBAAgB,0BAA0B,CACxC,oBAAoB,EAAE,OAAO,EAC7B,mBAAmB,EAAE,OAAO,GAC3B,MAAM,CAMR;AAWD,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;yDAEqD;IACrD,OAAO,EAAE,OAAO,EAAE,CAAC;IACnB;;kDAE8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB;kEAC8D;IAC9D,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAwBhE;AAID,iGAAiG;AACjG,eAAO,MAAM,yBAAyB,EAAE,GAAkB,CAAC;AAE3D,MAAM,WAAW,wBAAwB;IACvC;iFAC6E;IAC7E,SAAS,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,cAAc,EAAE,OAAO,CAAC;QAAC,cAAc,EAAE,OAAO,CAAA;KAAE,CAAC;IACtG,sDAAsD;IACtD,KAAK,EAAE,OAAO,CAAC;IACf,wBAAwB;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,0EAA0E;IAC1E,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,uBAAuB,EAAE,MAAM,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;kCAEkC;AAClC,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,uBAAuB,EAAE,MAAM,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG,GAAG,CA6BN;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,wBAAwB,GAAG,MAAM,EAAE,CAOnF;AAED;;gDAEgD;AAChD,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,MAAM,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,wBAAwB,GAAG,qBAAqB,CAW5F"}

package/dist/caveats.js

@@ -87,6 +87,22 @@ export function buildDataScopeCaveat(grants) {
     ], [grants]);
     return { enforcer: DATA_SCOPE_ENFORCER, terms, args: '0x' };
 }
+const DATA_SCOPE_ABI = [
+    {
+        type: 'tuple[]',
+        components: [
+            { name: 'server', type: 'string' },
+            { name: 'resources', type: 'string[]' },
+            { name: 'fields', type: 'string[]' },
+        ],
+    },
+];
+/** Decode a `DATA_SCOPE` caveat's terms back to its grants. Used OFF-CHAIN by the resource server (the
+ *  vault/MCP runtime) to scope the field projection — the on-chain evaluator treats the sentinel as inert. */
+export function decodeDataScopeTerms(terms) {
+    const [grants] = decodeAbiParameters(DATA_SCOPE_ABI, terms);
+    return grants;
+}
 // VAULT_KEY_USE (spec 278 §3.2): the person SA authorizes a host to wield a KEK
 // for bounded resources/ops. ABI shape mirrors `VaultKeyUseGrant`; the KAS decodes
 // it (via `decodeVaultKeyUseTerms`) to check scope ⊇ request before releasing a key.

package/dist/caveats.js.map

@@ -1 +1 @@
-{"version":3,"file":"caveats.js","sourceRoot":"","sources":["../src/caveats.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,8BAA8B;AAE9B,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,SAAS,EAA0B,MAAM,MAAM,CAAC;AACnG,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAGnD,4EAA4E;AAE5E,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1E,OAAO,GAAc,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAY,eAAe,CAAC,gCAAgC,CAAC,CAAC;AAClG,MAAM,CAAC,MAAM,mBAAmB,GAAY,eAAe,CAAC,4BAA4B,CAAC,CAAC;AAC1F,MAAM,CAAC,MAAM,yBAAyB,GAAY,eAAe,CAAC,kCAAkC,CAAC,CAAC;AACtG;uFACuF;AACvF,MAAM,CAAC,MAAM,sBAAsB,GAAY,eAAe,CAAC,+BAA+B,CAAC,CAAC;AAEhG,4EAA4E;AAE5E,MAAM,UAAU,WAAW,CAAC,QAAiB,EAAE,KAAU,EAAE,IAAU;IACnE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;AACjD,CAAC;AAED,4EAA4E;AAE5E,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,UAAkB;IACzE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,UAAU,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,mBAAmB,CACxB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAC1C,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CACzC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,QAAQ,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACtF,OAAO,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAkB;IAC1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IACrG,OAAO,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,SAAgB;IACxD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACzG,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,sCAAsC,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;IACD,OAAO,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;oGAGoG;AACpG,MAAM,UAAU,uBAAuB,CAAC,QAAa;IACnD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,4EAA4E;AAE5E,MAAM,UAAU,uBAAuB,CAAC,YAAsB;IAC5D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACtG,MAAM,KAAK,GAAG,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAC1E,OAAO,EAAE,QAAQ,EAAE,uBAAuB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAwB;IAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC9F,MAAM,KAAK,GAAG,mBAAmB,CAC/B;QACE;YACE,IAAI,EAAE,SAAS;YACf,UAAU,EAAE;gBACV,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAClC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE;gBACvC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE;aACrC;SACF;KACF,EACD,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED,gFAAgF;AAChF,mFAAmF;AACnF,qFAAqF;AACrF,MAAM,wBAAwB,GAAG;IAC/B,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE;IACrC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE;IACvC,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjD,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE;IACjC,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,EAAE;CACjC,CAAC;AACX,MAAM,iBAAiB,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,CAAU,CAAC;AAE7F,MAAM,UAAU,sBAAsB,CAAC,KAAuB;IAC5D,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAChF,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACpF,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5G,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAChG,IAAI,CAAC,KAAK,CAAC,qBAAqB;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5G,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,uHAAuH,CAAC,CAAC;IAC7K,MAAM,KAAK,GAAG,mBAAmB,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACjE,CAAC;AAED;uFACuF;AACvF,MAAM,UAAU,sBAAsB,CAAC,KAAU;IAC/C,MAAM,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC,iBAAiB,EAAE,KAAK,CAAgC,CAAC;IACzF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,oBAA6B,EAC7B,mBAA4B;IAE5B,MAAM,KAAK,GAAG,mBAAmB,CAC/B,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAC1C,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,CAC5C,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,yBAAyB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACpE,CAAC;AAgCD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAsB;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,CAAC,SAAS,8BAA8B,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CACpG,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,CAC/B;QACE,EAAE,IAAI,EAAE,WAAW,EAAE;QACrB,EAAE,IAAI,EAAE,OAAO,EAAE;QACjB,EAAE,IAAI,EAAE,SAAS,EAAE;KACpB,EACD,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAC1D,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxD,CAAC;AAED,qGAAqG;AAErG,iGAAiG;AACjG,MAAM,CAAC,MAAM,yBAAyB,GAAQ,YAAY,CAAC;AAmB3D;;kCAEkC;AAClC,MAAM,UAAU,kBAAkB,CAAC,IAOlC;IACC,IAAI,IAAI,CAAC,kBAAkB,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACzG,IAAI,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC,uBAAuB,IAAI,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,mBAAmB,CACxB;QACE,EAAE,IAAI,EAAE,SAAS,EAAE;QACnB,EAAE,IAAI,EAAE,SAAS,EAAE;QACnB,EAAE,IAAI,EAAE,SAAS,EAAE;QACnB,EAAE,IAAI,EAAE,SAAS,EAAE;QACnB,EAAE,IAAI,EAAE,QAAQ,EAAE;QAClB,EAAE,IAAI,EAAE,QAAQ,EAAE;KACnB,EACD;QACE,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,kBAAkB;QACvB,IAAI,CAAC,YAAY;QACjB,IAAI,CAAC,uBAAuB;QAC5B,IAAI,CAAC,aAAa;KACnB,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAA8B;IACvE,OAAO;QACL,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC7D,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAClG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACnF,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC;KACnG,CAAC;AACJ,CAAC;AAgBD,MAAM,UAAU,sBAAsB,CAAC,IAA8B;IACnE,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,KAAK;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,aAAa,EAAE,IAAI,CAAC,YAAY;QAChC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"caveats.js","sourceRoot":"","sources":["../src/caveats.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,8BAA8B;AAE9B,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,SAAS,EAA0B,MAAM,MAAM,CAAC;AACnG,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAGnD,4EAA4E;AAE5E,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1E,OAAO,GAAc,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAY,eAAe,CAAC,gCAAgC,CAAC,CAAC;AAClG,MAAM,CAAC,MAAM,mBAAmB,GAAY,eAAe,CAAC,4BAA4B,CAAC,CAAC;AAC1F,MAAM,CAAC,MAAM,yBAAyB,GAAY,eAAe,CAAC,kCAAkC,CAAC,CAAC;AACtG;uFACuF;AACvF,MAAM,CAAC,MAAM,sBAAsB,GAAY,eAAe,CAAC,+BAA+B,CAAC,CAAC;AAEhG,4EAA4E;AAE5E,MAAM,UAAU,WAAW,CAAC,QAAiB,EAAE,KAAU,EAAE,IAAU;IACnE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;AACjD,CAAC;AAED,4EAA4E;AAE5E,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,UAAkB;IACzE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,UAAU,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,mBAAmB,CACxB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAC1C,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CACzC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,QAAQ,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACtF,OAAO,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAkB;IAC1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IACrG,OAAO,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,SAAgB;IACxD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACzG,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,sCAAsC,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;IACD,OAAO,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;oGAGoG;AACpG,MAAM,UAAU,uBAAuB,CAAC,QAAa;IACnD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,4EAA4E;AAE5E,MAAM,UAAU,uBAAuB,CAAC,YAAsB;IAC5D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACtG,MAAM,KAAK,GAAG,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAC1E,OAAO,EAAE,QAAQ,EAAE,uBAAuB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAwB;IAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC9F,MAAM,KAAK,GAAG,mBAAmB,CAC/B;QACE;YACE,IAAI,EAAE,SAAS;YACf,UAAU,EAAE;gBACV,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAClC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE;gBACvC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE;aACrC;SACF;KACF,EACD,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,cAAc,GAAG;IACrB;QACE,IAAI,EAAE,SAAS;QACf,UAAU,EAAE;YACV,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;YAClC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE;YACvC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE;SACrC;KACF;CACO,CAAC;AAEX;8GAC8G;AAC9G,MAAM,UAAU,oBAAoB,CAAC,KAAU;IAC7C,MAAM,CAAC,MAAM,CAAC,GAAG,mBAAmB,CAAC,cAAc,EAAE,KAAK,CAAgC,CAAC;IAC3F,OAAO,MAA0B,CAAC;AACpC,CAAC;AAED,gFAAgF;AAChF,mFAAmF;AACnF,qFAAqF;AACrF,MAAM,wBAAwB,GAAG;IAC/B,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE;IACrC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE;IACvC,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjD,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE;IACjC,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,EAAE;CACjC,CAAC;AACX,MAAM,iBAAiB,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,CAAU,CAAC;AAE7F,MAAM,UAAU,sBAAsB,CAAC,KAAuB;IAC5D,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAChF,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACpF,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5G,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAChG,IAAI,CAAC,KAAK,CAAC,qBAAqB;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5G,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,uHAAuH,CAAC,CAAC;IAC7K,MAAM,KAAK,GAAG,mBAAmB,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACjE,CAAC;AAED;uFACuF;AACvF,MAAM,UAAU,sBAAsB,CAAC,KAAU;IAC/C,MAAM,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC,iBAAiB,EAAE,KAAK,CAAgC,CAAC;IACzF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,oBAA6B,EAC7B,mBAA4B;IAE5B,MAAM,KAAK,GAAG,mBAAmB,CAC/B,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAC1C,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,CAC5C,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,yBAAyB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACpE,CAAC;AAgCD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAsB;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,CAAC,SAAS,8BAA8B,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CACpG,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,CAC/B;QACE,EAAE,IAAI,EAAE,WAAW,EAAE;QACrB,EAAE,IAAI,EAAE,OAAO,EAAE;QACjB,EAAE,IAAI,EAAE,SAAS,EAAE;KACpB,EACD,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAC1D,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxD,CAAC;AAED,qGAAqG;AAErG,iGAAiG;AACjG,MAAM,CAAC,MAAM,yBAAyB,GAAQ,YAAY,CAAC;AAmB3D;;kCAEkC;AAClC,MAAM,UAAU,kBAAkB,CAAC,IAOlC;IACC,IAAI,IAAI,CAAC,kBAAkB,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACzG,IAAI,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC,uBAAuB,IAAI,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,mBAAmB,CACxB;QACE,EAAE,IAAI,EAAE,SAAS,EAAE;QACnB,EAAE,IAAI,EAAE,SAAS,EAAE;QACnB,EAAE,IAAI,EAAE,SAAS,EAAE;QACnB,EAAE,IAAI,EAAE,SAAS,EAAE;QACnB,EAAE,IAAI,EAAE,QAAQ,EAAE;QAClB,EAAE,IAAI,EAAE,QAAQ,EAAE;KACnB,EACD;QACE,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,kBAAkB;QACvB,IAAI,CAAC,YAAY;QACjB,IAAI,CAAC,uBAAuB;QAC5B,IAAI,CAAC,aAAa;KACnB,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAA8B;IACvE,OAAO;QACL,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC7D,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAClG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACnF,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC;KACnG,CAAC;AACJ,CAAC;AAgBD,MAAM,UAAU,sBAAsB,CAAC,IAA8B;IACnE,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,KAAK;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,aAAa,EAAE,IAAI,CAAC,YAAY;QAChC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { ROOT_AUTHORITY } from './types.js';
-export { buildCaveat, buildMcpToolScopeCaveat, buildDataScopeCaveat, buildVaultKeyUseCaveat, decodeVaultKeyUseTerms, buildDelegateBindingCaveat, buildQuorumCaveat, encodeTimestampTerms, encodeValueTerms, encodeAllowedTargetsTerms, encodeAllowedMethodsTerms, encodeCallDataHashTerms, MCP_TOOL_SCOPE_ENFORCER, DATA_SCOPE_ENFORCER, DELEGATE_BINDING_ENFORCER, VAULT_KEY_USE_ENFORCER, PAYMENT_TRANSFER_SELECTOR, encodePaymentTerms, buildPaymentMandateCaveats, describePaymentMandate, } from './caveats.js';
+export { buildCaveat, buildMcpToolScopeCaveat, buildDataScopeCaveat, decodeDataScopeTerms, buildVaultKeyUseCaveat, decodeVaultKeyUseTerms, buildDelegateBindingCaveat, buildQuorumCaveat, encodeTimestampTerms, encodeValueTerms, encodeAllowedTargetsTerms, encodeAllowedMethodsTerms, encodeCallDataHashTerms, MCP_TOOL_SCOPE_ENFORCER, DATA_SCOPE_ENFORCER, DELEGATE_BINDING_ENFORCER, VAULT_KEY_USE_ENFORCER, PAYMENT_TRANSFER_SELECTOR, encodePaymentTerms, buildPaymentMandateCaveats, describePaymentMandate, } from './caveats.js';
 export type { QuorumCaveatOpts, PaymentMandateCaveatOpts, PaymentMandateConsent } from './caveats.js';
 export { hashDelegation, hashCaveats, DELEGATION_EIP712_TYPES, delegationDomain } from './hash.js';
 export { buildSessionDelegation } from './session-delegation.js';
@@ -15,7 +15,11 @@ export { SessionManager, createMemorySessionStore } from './session-manager.js';
 export { verifyAuthorization } from './verify-authorization.js';
 export type { VerifyAuthorizationResult } from './verify-authorization.js';
 export { mintDelegationToken, verifyDelegationToken, sessionDelegateBindingError } from './token.js';
-export { isRevoked, buildRevokeDelegationCall } from './onchain.js';
-export type { Address, Hex, Caveat, CaveatContext, CaveatVerdict, Delegation, DataScopeGrant, VaultKeyUseGrant, DelegationClientOpts, DelegationTokenClaims, EnforcerAddressMap, EvaluateOpts, JtiStore, SessionMeta, SessionPackage, SessionRow, SessionStore, TxContext, VerifyError, VerifyOpts, } from './types.js';
+export { isRevoked, buildRevokeDelegationCall, verifyUniversalSignature } from './onchain.js';
+export { verifyOffChainQuorum } from './quorum.js';
+export type { OffChainQuorumProof, VerifyOffChainQuorumInput, OffChainQuorumResult } from './quorum.js';
+export { INVOCATION_PROOF_VERSION, INVOCATION_PROOF_EIP712_TYPES, DEFAULT_MAX_PROOF_TTL_MS, DEFAULT_PROOF_CLOCK_SKEW_MS, invocationProofDomain, hashInvocationProof, canonicalArgumentsHash, hashDelegationTokenString, buildInvocationProof, verifyInvocationProofClaims, } from './invocation-proof.js';
+export type { AgenticInvocationProofV1, InvocationProofSignedFields, InvocationProofSignatureVerifier, VerifyInvocationProofInput, InvocationProofResult, } from './invocation-proof.js';
+export type { Address, Hex, Caveat, CaveatContext, CaveatVerdict, Delegation, DataScopeGrant, VaultKeyUseGrant, DelegationClientOpts, DelegationTokenClaims, EnforcerAddressMap, EvaluateOpts, JtiStore, JtiReservation, SessionMeta, SessionPackage, SessionRow, SessionStore, TxContext, VerifyError, VerifyOpts, } from './types.js';
 export type { VerifyOptsExt } from './token.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,kBAAkB,EAClB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAEtG,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAEnG,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,YAAY,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhF;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,YAAY,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAM3E,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AACrG,OAAO,EAAE,SAAS,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAEpE,YAAY,EACV,OAAO,EACP,GAAG,EACH,MAAM,EACN,aAAa,EACb,aAAa,EACb,UAAU,EACV,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,cAAc,EACd,UAAU,EACV,YAAY,EACZ,SAAS,EACT,WAAW,EACX,UAAU,GACX,MAAM,YAAY,CAAC;AAKpB,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,kBAAkB,EAClB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAEtG,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAEnG,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,YAAY,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhF;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,YAAY,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAM3E,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AACrG,OAAO,EAAE,SAAS,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAG9F,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAIxG,OAAO,EACL,wBAAwB,EACxB,6BAA6B,EAC7B,wBAAwB,EACxB,2BAA2B,EAC3B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,wBAAwB,EACxB,2BAA2B,EAC3B,gCAAgC,EAChC,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EACV,OAAO,EACP,GAAG,EACH,MAAM,EACN,aAAa,EACb,aAAa,EACb,UAAU,EACV,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,QAAQ,EACR,cAAc,EACd,WAAW,EACX,cAAc,EACd,UAAU,EACV,YAAY,EACZ,SAAS,EACT,WAAW,EACX,UAAU,GACX,MAAM,YAAY,CAAC;AAKpB,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -2,7 +2,7 @@
 //
 // See ../../specs/202-delegation.md for the full contract.
 export { ROOT_AUTHORITY } from './types.js';
-export { buildCaveat, buildMcpToolScopeCaveat, buildDataScopeCaveat, buildVaultKeyUseCaveat, decodeVaultKeyUseTerms, buildDelegateBindingCaveat, buildQuorumCaveat, encodeTimestampTerms, encodeValueTerms, encodeAllowedTargetsTerms, encodeAllowedMethodsTerms, encodeCallDataHashTerms, MCP_TOOL_SCOPE_ENFORCER, DATA_SCOPE_ENFORCER, DELEGATE_BINDING_ENFORCER, VAULT_KEY_USE_ENFORCER, PAYMENT_TRANSFER_SELECTOR, encodePaymentTerms, buildPaymentMandateCaveats, describePaymentMandate, } from './caveats.js';
+export { buildCaveat, buildMcpToolScopeCaveat, buildDataScopeCaveat, decodeDataScopeTerms, buildVaultKeyUseCaveat, decodeVaultKeyUseTerms, buildDelegateBindingCaveat, buildQuorumCaveat, encodeTimestampTerms, encodeValueTerms, encodeAllowedTargetsTerms, encodeAllowedMethodsTerms, encodeCallDataHashTerms, MCP_TOOL_SCOPE_ENFORCER, DATA_SCOPE_ENFORCER, DELEGATE_BINDING_ENFORCER, VAULT_KEY_USE_ENFORCER, PAYMENT_TRANSFER_SELECTOR, encodePaymentTerms, buildPaymentMandateCaveats, describePaymentMandate, } from './caveats.js';
 export { hashDelegation, hashCaveats, DELEGATION_EIP712_TYPES, delegationDomain } from './hash.js';
 // DEL-001 session-delegation leaf builder (spec 270 v4 W2) — every connect flow uses this.
 export { buildSessionDelegation } from './session-delegation.js';
@@ -20,5 +20,10 @@ export { verifyAuthorization } from './verify-authorization.js';
 // error string — a public symbol that lies about runtime capability. When the
 // work resumes it lands behind `./experimental` per spec 100 §6.
 export { mintDelegationToken, verifyDelegationToken, sessionDelegateBindingError } from './token.js';
-export { isRevoked, buildRevokeDelegationCall } from './onchain.js';
+export { isRevoked, buildRevokeDelegationCall, verifyUniversalSignature } from './onchain.js';
+// Off-chain quorum verification (spec 291 §6b) — for MCP-only ops that never redeem on chain.
+export { verifyOffChainQuorum } from './quorum.js';
+// Agentic Invocation Proof (spec 287) — per-call proof-of-possession for the
+// public native MCP ingress. Crypto primitive only; mcp-runtime wires it.
+export { INVOCATION_PROOF_VERSION, INVOCATION_PROOF_EIP712_TYPES, DEFAULT_MAX_PROOF_TTL_MS, DEFAULT_PROOF_CLOCK_SKEW_MS, invocationProofDomain, hashInvocationProof, canonicalArgumentsHash, hashDelegationTokenString, buildInvocationProof, verifyInvocationProofClaims, } from './invocation-proof.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,EAAE;AACF,2DAA2D;AAE3D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,kBAAkB,EAClB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACnG,2FAA2F;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhF;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAGhE,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAC9E,iEAAiE;AACjE,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AACrG,OAAO,EAAE,SAAS,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,EAAE;AACF,2DAA2D;AAE3D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,kBAAkB,EAClB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACnG,2FAA2F;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhF;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAGhE,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAC9E,iEAAiE;AACjE,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AACrG,OAAO,EAAE,SAAS,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAE9F,8FAA8F;AAC9F,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGnD,6EAA6E;AAC7E,0EAA0E;AAC1E,OAAO,EACL,wBAAwB,EACxB,6BAA6B,EAC7B,wBAAwB,EACxB,2BAA2B,EAC3B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC"}

package/dist/invocation-proof.d.ts

@@ -0,0 +1,133 @@
+import type { Address, Hex } from '@agenticprimitives/types';
+import type { JtiStore } from './types.js';
+export declare const INVOCATION_PROOF_VERSION: "agentic-invocation-v1";
+/** Default bounded TTL window (spec 287 §5). */
+export declare const DEFAULT_MAX_PROOF_TTL_MS = 120000;
+export declare const DEFAULT_PROOF_CLOCK_SKEW_MS = 30000;
+/**
+ * The proof envelope. `chainId` + `audience` are domain separators; `principal`
+ * and `sessionKey` are carried for the runtime's cross-checks but are NOT in the
+ * signed message — their binding is closed by signature recovery + the delegation
+ * token's `sub` (spec 287 §6).
+ */
+export interface AgenticInvocationProofV1 {
+    version: typeof INVOCATION_PROOF_VERSION;
+    chainId: number;
+    audience: string;
+    principal: Address;
+    sessionKey: Address;
+    operation: string;
+    argumentsHash: Hex;
+    delegationTokenHash: Hex;
+    requestId: string;
+    issuedAt: number;
+    expiresAt: number;
+    signature: Hex;
+}
+/** The signed fields (spec 287 §3) — `chainId` rides in the EIP-712 domain. */
+export type InvocationProofSignedFields = Pick<AgenticInvocationProofV1, 'chainId' | 'audience' | 'operation' | 'argumentsHash' | 'delegationTokenHash' | 'requestId' | 'issuedAt' | 'expiresAt'>;
+export declare const INVOCATION_PROOF_EIP712_TYPES: {
+    readonly AgenticInvocationProofV1: readonly [{
+        readonly name: "audience";
+        readonly type: "string";
+    }, {
+        readonly name: "operation";
+        readonly type: "string";
+    }, {
+        readonly name: "argumentsHash";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "delegationTokenHash";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "requestId";
+        readonly type: "string";
+    }, {
+        readonly name: "issuedAt";
+        readonly type: "uint256";
+    }, {
+        readonly name: "expiresAt";
+        readonly type: "uint256";
+    }];
+};
+/** EIP-712 domain — no `verifyingContract` (this is an off-chain proof). */
+export declare function invocationProofDomain(chainId: number): {
+    readonly name: "AgenticInvocationProof";
+    readonly version: "1";
+    readonly chainId: number;
+};
+/**
+ * The digest the session key signs (and the verifier recomputes). Building it is
+ * pure — importable client-side to build + sign a proof.
+ */
+export declare function hashInvocationProof(p: InvocationProofSignedFields): Hex;
+/**
+ * Canonical hash of the EXACT tool arguments (spec 287 §4). Uses the repo's
+ * cross-runtime-stable `canonicalJSON` so the client's signed hash and the
+ * runtime's recomputed hash are byte-identical. The runtime MUST recompute this
+ * from the args it actually received — never trust the client's stated value.
+ */
+export declare function canonicalArgumentsHash(args: unknown): Hex;
+/** Bind the proof to the presented delegation token (spec 287 §4). */
+export declare function hashDelegationTokenString(rawToken: string): Hex;
+/**
+ * Client-side builder: assemble + sign an invocation proof. The caller supplies
+ * a `sign(digest)` that produces the session key's signature over the EIP-712
+ * digest (e.g. `account.sign({ hash })` for an EOA session key, or any SA
+ * `Signer`). `args` MUST be the exact tool arguments the call will
+ * carry — the runtime recomputes `canonicalArgumentsHash(args)` from what it
+ * receives and rejects a mismatch. Pure (no chain); importable in the browser.
+ */
+export declare function buildInvocationProof(input: {
+    chainId: number;
+    audience: string;
+    principal: Address;
+    sessionKey: Address;
+    operation: string;
+    /** The exact tool arguments (excluding the token/quorumProof/invocationProof envelope). */
+    args: unknown;
+    /** The raw delegation token string presented alongside this call. */
+    rawDelegationToken: string;
+    requestId: string;
+    issuedAt: number;
+    expiresAt: number;
+    sign: (digest: Hex) => Promise<Hex>;
+}): Promise<AgenticInvocationProofV1>;
+/** Injected signature verifier — wired to `UniversalSignatureValidator` in prod. */
+export type InvocationProofSignatureVerifier = (input: {
+    signer: Address;
+    digest: Hex;
+    signature: Hex;
+}) => Promise<boolean>;
+export interface VerifyInvocationProofInput {
+    proof: AgenticInvocationProofV1;
+    /** Server-recomputed values the proof MUST match (never the client's claims). */
+    expected: {
+        chainId: number;
+        audience: string;
+        operation: string;
+        argumentsHash: Hex;
+        delegationTokenHash: Hex;
+    };
+    verifySignature: InvocationProofSignatureVerifier;
+    jtiStore: JtiStore;
+    now?: () => number;
+    maxProofTtlMs?: number;
+    clockSkewMs?: number;
+}
+export type InvocationProofResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Verify an invocation proof. Cheap local checks gate first; the (potentially
+ * chain-bound) signature verify runs next; the one-shot `requestId` is reserved
+ * ONLY after the signature verifies (so an unauthenticated party can't burn a
+ * victim's requestId). Fail-closed: every failure returns `{ ok: false, reason }`.
+ * Callers MUST NOT echo `reason` to external clients — log it, return a generic
+ * error (spec 287 §5, ADR-0013).
+ */
+export declare function verifyInvocationProofClaims(input: VerifyInvocationProofInput): Promise<InvocationProofResult>;
+//# sourceMappingURL=invocation-proof.d.ts.map

package/dist/invocation-proof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invocation-proof.d.ts","sourceRoot":"","sources":["../src/invocation-proof.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAG3C,eAAO,MAAM,wBAAwB,EAAG,uBAAgC,CAAC;AAEzE,gDAAgD;AAChD,eAAO,MAAM,wBAAwB,SAAU,CAAC;AAChD,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAElD;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,wBAAwB,CAAC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,GAAG,CAAC;IACnB,mBAAmB,EAAE,GAAG,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,GAAG,CAAC;CAChB;AAED,+EAA+E;AAC/E,MAAM,MAAM,2BAA2B,GAAG,IAAI,CAC5C,wBAAwB,EACtB,SAAS,GACT,UAAU,GACV,WAAW,GACX,eAAe,GACf,qBAAqB,GACrB,WAAW,GACX,UAAU,GACV,WAAW,CACd,CAAC;AAEF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;CAUhC,CAAC;AAEX,4EAA4E;AAC5E,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM;;;;EAEpD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,2BAA2B,GAAG,GAAG,CAevE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,GAAG,CAEzD;AAED,sEAAsE;AACtE,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAE/D;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,2FAA2F;IAC3F,IAAI,EAAE,OAAO,CAAC;IACd,qEAAqE;IACrE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,CAAC,MAAM,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;CACrC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAmBpC;AAED,oFAAoF;AACpF,MAAM,MAAM,gCAAgC,GAAG,CAAC,KAAK,EAAE;IACrD,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,GAAG,CAAC;IACZ,SAAS,EAAE,GAAG,CAAC;CAChB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEvB,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,wBAAwB,CAAC;IAChC,iFAAiF;IACjF,QAAQ,EAAE;QACR,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,GAAG,CAAC;QACnB,mBAAmB,EAAE,GAAG,CAAC;KAC1B,CAAC;IACF,eAAe,EAAE,gCAAgC,CAAC;IAClD,QAAQ,EAAE,QAAQ,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,qBAAqB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAMjF;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,qBAAqB,CAAC,CAyChC"}

package/dist/invocation-proof.js

@@ -0,0 +1,157 @@
+// Agentic Invocation Proof (spec 287). A per-call proof-of-possession: the
+// DEL-001-bound session key (spec 270) signs an EIP-712 digest over the EXACT
+// call so a public native MCP request is bound to its exact argument payload —
+// the property A2A already has via `hashA2aMessage` and the internal mesh has
+// via the service MAC, but which the direct public hop lacked.
+//
+// This module is the PURE crypto primitive: the type, the EIP-712 digest, the
+// canonical argument/token hashing, and a claims verifier that takes an INJECTED
+// signature verifier (the `UniversalSignatureValidator` surface — so any
+// credential strategy works) + an INJECTED `JtiStore` (one-shot requestId). It
+// imports no audit/transport — it returns a `{ ok, reason }` result and never
+// emits. The MCP-specific wiring (recompute argsHash from the received call,
+// cross-check against the delegation token, gate on `requireInvocationProof`,
+// emit audit) lives in `mcp-runtime`'s `with-delegation` — spec 287 §9.
+import { hashTypedData, keccak256, toBytes } from 'viem';
+import { canonicalJSON } from './token.js';
+export const INVOCATION_PROOF_VERSION = 'agentic-invocation-v1';
+/** Default bounded TTL window (spec 287 §5). */
+export const DEFAULT_MAX_PROOF_TTL_MS = 120_000;
+export const DEFAULT_PROOF_CLOCK_SKEW_MS = 30_000;
+export const INVOCATION_PROOF_EIP712_TYPES = {
+    AgenticInvocationProofV1: [
+        { name: 'audience', type: 'string' },
+        { name: 'operation', type: 'string' },
+        { name: 'argumentsHash', type: 'bytes32' },
+        { name: 'delegationTokenHash', type: 'bytes32' },
+        { name: 'requestId', type: 'string' },
+        { name: 'issuedAt', type: 'uint256' },
+        { name: 'expiresAt', type: 'uint256' },
+    ],
+};
+/** EIP-712 domain — no `verifyingContract` (this is an off-chain proof). */
+export function invocationProofDomain(chainId) {
+    return { name: 'AgenticInvocationProof', version: '1', chainId };
+}
+/**
+ * The digest the session key signs (and the verifier recomputes). Building it is
+ * pure — importable client-side to build + sign a proof.
+ */
+export function hashInvocationProof(p) {
+    return hashTypedData({
+        domain: invocationProofDomain(p.chainId),
+        types: INVOCATION_PROOF_EIP712_TYPES,
+        primaryType: 'AgenticInvocationProofV1',
+        message: {
+            audience: p.audience,
+            operation: p.operation,
+            argumentsHash: p.argumentsHash,
+            delegationTokenHash: p.delegationTokenHash,
+            requestId: p.requestId,
+            issuedAt: BigInt(p.issuedAt),
+            expiresAt: BigInt(p.expiresAt),
+        },
+    });
+}
+/**
+ * Canonical hash of the EXACT tool arguments (spec 287 §4). Uses the repo's
+ * cross-runtime-stable `canonicalJSON` so the client's signed hash and the
+ * runtime's recomputed hash are byte-identical. The runtime MUST recompute this
+ * from the args it actually received — never trust the client's stated value.
+ */
+export function canonicalArgumentsHash(args) {
+    return keccak256(toBytes(canonicalJSON(args)));
+}
+/** Bind the proof to the presented delegation token (spec 287 §4). */
+export function hashDelegationTokenString(rawToken) {
+    return keccak256(toBytes(rawToken));
+}
+/**
+ * Client-side builder: assemble + sign an invocation proof. The caller supplies
+ * a `sign(digest)` that produces the session key's signature over the EIP-712
+ * digest (e.g. `account.sign({ hash })` for an EOA session key, or any SA
+ * `Signer`). `args` MUST be the exact tool arguments the call will
+ * carry — the runtime recomputes `canonicalArgumentsHash(args)` from what it
+ * receives and rejects a mismatch. Pure (no chain); importable in the browser.
+ */
+export async function buildInvocationProof(input) {
+    const signed = {
+        chainId: input.chainId,
+        audience: input.audience,
+        operation: input.operation,
+        argumentsHash: canonicalArgumentsHash(input.args),
+        delegationTokenHash: hashDelegationTokenString(input.rawDelegationToken),
+        requestId: input.requestId,
+        issuedAt: input.issuedAt,
+        expiresAt: input.expiresAt,
+    };
+    const signature = await input.sign(hashInvocationProof(signed));
+    return {
+        version: INVOCATION_PROOF_VERSION,
+        principal: input.principal,
+        sessionKey: input.sessionKey,
+        signature,
+        ...signed,
+    };
+}
+function hexEq(a, b) {
+    return a.toLowerCase() === b.toLowerCase();
+}
+/**
+ * Verify an invocation proof. Cheap local checks gate first; the (potentially
+ * chain-bound) signature verify runs next; the one-shot `requestId` is reserved
+ * ONLY after the signature verifies (so an unauthenticated party can't burn a
+ * victim's requestId). Fail-closed: every failure returns `{ ok: false, reason }`.
+ * Callers MUST NOT echo `reason` to external clients — log it, return a generic
+ * error (spec 287 §5, ADR-0013).
+ */
+export async function verifyInvocationProofClaims(input) {
+    const { proof, expected } = input;
+    const now = (input.now ?? Date.now)();
+    const maxTtl = input.maxProofTtlMs ?? DEFAULT_MAX_PROOF_TTL_MS;
+    const skew = input.clockSkewMs ?? DEFAULT_PROOF_CLOCK_SKEW_MS;
+    if (proof.version !== INVOCATION_PROOF_VERSION)
+        return { ok: false, reason: 'version' };
+    if (proof.chainId !== expected.chainId)
+        return { ok: false, reason: 'chain_mismatch' };
+    if (proof.audience !== expected.audience)
+        return { ok: false, reason: 'audience_mismatch' };
+    if (proof.operation !== expected.operation)
+        return { ok: false, reason: 'operation_mismatch' };
+    if (!hexEq(proof.argumentsHash, expected.argumentsHash))
+        return { ok: false, reason: 'arguments_mismatch' };
+    if (!hexEq(proof.delegationTokenHash, expected.delegationTokenHash)) {
+        return { ok: false, reason: 'delegation_token_mismatch' };
+    }
+    // Bounded window (spec 287 §5).
+    if (!Number.isFinite(proof.issuedAt) || !Number.isFinite(proof.expiresAt)) {
+        return { ok: false, reason: 'window_malformed' };
+    }
+    if (proof.expiresAt <= proof.issuedAt)
+        return { ok: false, reason: 'window_inverted' };
+    if (proof.expiresAt - proof.issuedAt > maxTtl)
+        return { ok: false, reason: 'window_too_long' };
+    if (proof.issuedAt > now + skew)
+        return { ok: false, reason: 'not_yet_valid' };
+    if (now > proof.expiresAt)
+        return { ok: false, reason: 'expired' };
+    // Proof-of-possession over the exact digest. Injected verifier → any credential
+    // strategy (EOA ECDSA, ERC-1271, ERC-6492) via UniversalSignatureValidator.
+    const digest = hashInvocationProof(proof);
+    let sigOk = false;
+    try {
+        sigOk = await input.verifySignature({ signer: proof.sessionKey, digest, signature: proof.signature });
+    }
+    catch {
+        return { ok: false, reason: 'signature_error' };
+    }
+    if (!sigOk)
+        return { ok: false, reason: 'signature_invalid' };
+    // One-shot requestId reservation — ONLY after the signature verified.
+    const jti = `invproof:${proof.audience}:${proof.requestId}`;
+    const tracked = await input.jtiStore.trackUsage(jti, 1);
+    if (!tracked.allowed)
+        return { ok: false, reason: 'request_replayed' };
+    return { ok: true };
+}
+//# sourceMappingURL=invocation-proof.js.map

package/dist/invocation-proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invocation-proof.js","sourceRoot":"","sources":["../src/invocation-proof.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,8EAA8E;AAC9E,+EAA+E;AAC/E,8EAA8E;AAC9E,+DAA+D;AAC/D,EAAE;AACF,8EAA8E;AAC9E,iFAAiF;AACjF,yEAAyE;AACzE,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,wEAAwE;AAExE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAGzD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,CAAC,MAAM,wBAAwB,GAAG,uBAAgC,CAAC;AAEzE,gDAAgD;AAChD,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAChD,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAoClD,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,wBAAwB,EAAE;QACxB,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE;QACpC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE;QACrC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE;QAC1C,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,SAAS,EAAE;QAChD,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE;QACrC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;QACrC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE;KACvC;CACO,CAAC;AAEX,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAW,CAAC;AAC5E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,CAA8B;IAChE,OAAO,aAAa,CAAC;QACnB,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC;QACxC,KAAK,EAAE,6BAA6B;QACpC,WAAW,EAAE,0BAA0B;QACvC,OAAO,EAAE;YACP,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;YAC1C,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC5B,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;SAC/B;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAa;IAClD,OAAO,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,yBAAyB,CAAC,QAAgB;IACxD,OAAO,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAc1C;IACC,MAAM,MAAM,GAAgC;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa,EAAE,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC;QACjD,mBAAmB,EAAE,yBAAyB,CAAC,KAAK,CAAC,kBAAkB,CAAC;QACxE,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IAChE,OAAO;QACL,OAAO,EAAE,wBAAwB;QACjC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS;QACT,GAAG,MAAM;KACV,CAAC;AACJ,CAAC;AA4BD,SAAS,KAAK,CAAC,CAAS,EAAE,CAAS;IACjC,OAAO,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAiC;IAEjC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAClC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,IAAI,wBAAwB,CAAC;IAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,IAAI,2BAA2B,CAAC;IAE9D,IAAI,KAAK,CAAC,OAAO,KAAK,wBAAwB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACxF,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACvF,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC5F,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC/F,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC5G,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAC5D,CAAC;IAED,gCAAgC;IAChC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACvF,IAAI,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,QAAQ,GAAG,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC/F,IAAI,KAAK,CAAC,QAAQ,GAAG,GAAG,GAAG,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC/E,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAEnE,gFAAgF;IAChF,4EAA4E;IAC5E,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IACxG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAE9D,sEAAsE;IACtE,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAEvE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/onchain.d.ts

@@ -1,5 +1,28 @@
 import { type Hex, type Address } from 'viem';
 import type { Delegation } from './types.js';
+/**
+ * Validate a signature by `signer` over `digest`, connection-agnostically
+ * (spec 270 v4 / spec 287 §7). The verification primitive is selected by the
+ * signer's TYPE — a deterministic branch on whether the signer has code, NOT a
+ * try-strong-catch-weak fallback (ADR-0013):
+ *   - **EOA** (no code) → local ECDSA `recoverAddress` (the deployed
+ *     `UniversalSignatureValidator` reverts on bare EOAs, and a session-key
+ *     delegate is typically an EOA — same local-recover path `token.ts` uses for
+ *     the token's own session-key signature).
+ *   - **Contract** (has code) → on-chain `UniversalSignatureValidator.isValidSig`
+ *     (ERC-1271 deployed / ERC-6492 counterfactual) via one `eth_call`.
+ *
+ * Reusable signature surface (spec 287 injects this as the invocation-proof
+ * verifier). `readContract` only — no log scans (ADR-0012). Returns `false` on a
+ * recover/RPC error rather than throwing, so callers fail closed cleanly.
+ */
+export declare function verifyUniversalSignature(args: {
+    signer: Address;
+    digest: Hex;
+    signature: Hex;
+    rpcUrl: string;
+    universalSignatureValidator: Address;
+}): Promise<boolean>;
 /** Is this delegation hash revoked on-chain? The canonical, single mechanism (ADR-0013): reads the
  *  DelegationManager's `_revoked` map. Returns `false` if absent — never escalates to a second path. */
 export declare function isRevoked(hash: Hex, opts: {

package/dist/onchain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"onchain.d.ts","sourceRoot":"","sources":["../src/onchain.ts"],"names":[],"mappings":"AAIA,OAAO,EAAgD,KAAK,GAAG,EAAE,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AAC5F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA4C7C;wGACwG;AACxG,wBAAsB,SAAS,CAC7B,IAAI,EAAE,GAAG,EACT,IAAI,EAAE;IAAE,iBAAiB,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnD,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,UAAU,EACtB,iBAAiB,EAAE,OAAO,GACzB;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,GAAG,CAAA;CAAE,CAgB3C"}
+{"version":3,"file":"onchain.d.ts","sourceRoot":"","sources":["../src/onchain.ts"],"names":[],"mappings":"AAIA,OAAO,EAAgE,KAAK,GAAG,EAAE,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AAC5G,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA2B7C;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAAE;IACnD,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,GAAG,CAAC;IACZ,SAAS,EAAE,GAAG,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,2BAA2B,EAAE,OAAO,CAAC;CACtC,GAAG,OAAO,CAAC,OAAO,CAAC,CA6BnB;AAkCD;wGACwG;AACxG,wBAAsB,SAAS,CAC7B,IAAI,EAAE,GAAG,EACT,IAAI,EAAE;IAAE,iBAAiB,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnD,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,UAAU,EACtB,iBAAiB,EAAE,OAAO,GACzB;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,GAAG,CAAA;CAAE,CAgB3C"}

package/dist/onchain.js

@@ -1,7 +1,7 @@
 // On-chain revocation helpers (spec 272 PAY-DEL-3). `isRevoked` is the read the x402 rail executor
 // MUST run before settling (off-chain check); the DelegationManager ALSO enforces revocation in
 // `redeemDelegation` (on-chain), so revocation is checked twice and is never off-chain-only.
-import { createPublicClient, http, encodeFunctionData } from 'viem';
+import { createPublicClient, http, encodeFunctionData, recoverAddress } from 'viem';
 const IS_REVOKED_ABI = [
     {
         type: 'function',
@@ -11,6 +11,69 @@ const IS_REVOKED_ABI = [
         outputs: [{ type: 'bool' }],
     },
 ];
+// spec 270 v4 — the one connection-agnostic signature surface (ERC-1271 / ERC-6492 / ECDSA).
+const UNIVERSAL_SIG_VALIDATOR_ABI = [
+    {
+        type: 'function',
+        name: 'isValidSig',
+        stateMutability: 'view',
+        inputs: [
+            { name: 'signer', type: 'address' },
+            { name: 'hash', type: 'bytes32' },
+            { name: 'sig', type: 'bytes' },
+        ],
+        outputs: [{ name: '', type: 'bool' }],
+    },
+];
+/**
+ * Validate a signature by `signer` over `digest`, connection-agnostically
+ * (spec 270 v4 / spec 287 §7). The verification primitive is selected by the
+ * signer's TYPE — a deterministic branch on whether the signer has code, NOT a
+ * try-strong-catch-weak fallback (ADR-0013):
+ *   - **EOA** (no code) → local ECDSA `recoverAddress` (the deployed
+ *     `UniversalSignatureValidator` reverts on bare EOAs, and a session-key
+ *     delegate is typically an EOA — same local-recover path `token.ts` uses for
+ *     the token's own session-key signature).
+ *   - **Contract** (has code) → on-chain `UniversalSignatureValidator.isValidSig`
+ *     (ERC-1271 deployed / ERC-6492 counterfactual) via one `eth_call`.
+ *
+ * Reusable signature surface (spec 287 injects this as the invocation-proof
+ * verifier). `readContract` only — no log scans (ADR-0012). Returns `false` on a
+ * recover/RPC error rather than throwing, so callers fail closed cleanly.
+ */
+export async function verifyUniversalSignature(args) {
+    const client = createPublicClient({ transport: http(args.rpcUrl) });
+    let code;
+    try {
+        code = await client.getCode({ address: args.signer });
+    }
+    catch {
+        return false;
+    }
+    const isContract = !!code && code !== '0x' && code.length > 2;
+    if (!isContract) {
+        // EOA signer → local ECDSA recovery.
+        try {
+            const recovered = await recoverAddress({ hash: args.digest, signature: args.signature });
+            return recovered.toLowerCase() === args.signer.toLowerCase();
+        }
+        catch {
+            return false;
+        }
+    }
+    // Contract signer → ERC-1271 / ERC-6492 via the on-chain validator.
+    try {
+        return (await client.readContract({
+            address: args.universalSignatureValidator,
+            abi: UNIVERSAL_SIG_VALIDATOR_ABI,
+            functionName: 'isValidSig',
+            args: [args.signer, args.digest, args.signature],
+        }));
+    }
+    catch {
+        return false;
+    }
+}
 // Matches IDelegationManager.Delegation / Caveat (enforcer, terms, args).
 const REVOKE_BY_OWNER_ABI = [
     {

package/dist/onchain.js.map

@@ -1 +1 @@
-{"version":3,"file":"onchain.js","sourceRoot":"","sources":["../src/onchain.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,gGAAgG;AAChG,6FAA6F;AAE7F,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,kBAAkB,EAA0B,MAAM,MAAM,CAAC;AAG5F,MAAM,cAAc,GAAG;IACrB;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,WAAW;QACjB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACrD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;KAC5B;CACO,CAAC;AAEX,0EAA0E;AAC1E,MAAM,mBAAmB,GAAG;IAC1B;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,yBAAyB;QAC/B,eAAe,EAAE,YAAY;QAC7B,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,OAAO;gBACb,UAAU,EAAE;oBACV,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE;oBACtC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;oBACrC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE;oBACtC;wBACE,IAAI,EAAE,SAAS;wBACf,IAAI,EAAE,SAAS;wBACf,UAAU,EAAE;4BACV,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;4BACrC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;4BAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE;yBAChC;qBACF;oBACD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;oBACjC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;iBACrC;aACF;SACF;QACD,OAAO,EAAE,EAAE;KACZ;CACO,CAAC;AAEX;wGACwG;AACxG,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAS,EACT,IAAoD;IAEpD,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACpE,OAAO,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC;QAChC,OAAO,EAAE,IAAI,CAAC,iBAAiB;QAC/B,GAAG,EAAE,cAAc;QACnB,YAAY,EAAE,WAAW;QACzB,IAAI,EAAE,CAAC,IAAI,CAAC;KACb,CAAC,CAAY,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAAsB,EACtB,iBAA0B;IAE1B,MAAM,IAAI,GAAG,kBAAkB,CAAC;QAC9B,GAAG,EAAE,mBAAmB;QACxB,YAAY,EAAE,yBAAyB;QACvC,IAAI,EAAE;YACJ;gBACE,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;gBACxG,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,SAAS,EAAE,UAAU,CAAC,SAAS;aAChC;SACF;KACF,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC"}
+{"version":3,"file":"onchain.js","sourceRoot":"","sources":["../src/onchain.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,gGAAgG;AAChG,6FAA6F;AAE7F,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,kBAAkB,EAAE,cAAc,EAA0B,MAAM,MAAM,CAAC;AAG5G,MAAM,cAAc,GAAG;IACrB;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,WAAW;QACjB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACrD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;KAC5B;CACO,CAAC;AAEX,6FAA6F;AAC7F,MAAM,2BAA2B,GAAG;IAClC;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,YAAY;QAClB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;YACnC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;YACjC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE;SAC/B;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;KACtC;CACO,CAAC;AAEX;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAM9C;IACC,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACpE,IAAI,IAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,qCAAqC;QACrC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YACzF,OAAO,SAAS,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,oEAAoE;IACpE,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC;YAChC,OAAO,EAAE,IAAI,CAAC,2BAA2B;YACzC,GAAG,EAAE,2BAA2B;YAChC,YAAY,EAAE,YAAY;YAC1B,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACjD,CAAC,CAAY,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,mBAAmB,GAAG;IAC1B;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,yBAAyB;QAC/B,eAAe,EAAE,YAAY;QAC7B,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,OAAO;gBACb,UAAU,EAAE;oBACV,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE;oBACtC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;oBACrC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE;oBACtC;wBACE,IAAI,EAAE,SAAS;wBACf,IAAI,EAAE,SAAS;wBACf,UAAU,EAAE;4BACV,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;4BACrC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;4BAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE;yBAChC;qBACF;oBACD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;oBACjC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;iBACrC;aACF;SACF;QACD,OAAO,EAAE,EAAE;KACZ;CACO,CAAC;AAEX;wGACwG;AACxG,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAS,EACT,IAAoD;IAEpD,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACpE,OAAO,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC;QAChC,OAAO,EAAE,IAAI,CAAC,iBAAiB;QAC/B,GAAG,EAAE,cAAc;QACnB,YAAY,EAAE,WAAW;QACzB,IAAI,EAAE,CAAC,IAAI,CAAC;KACb,CAAC,CAAY,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAAsB,EACtB,iBAA0B;IAE1B,MAAM,IAAI,GAAG,kBAAkB,CAAC;QAC9B,GAAG,EAAE,mBAAmB;QACxB,YAAY,EAAE,yBAAyB;QACvC,IAAI,EAAE;YACJ;gBACE,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;gBACxG,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,SAAS,EAAE,UAAU,CAAC,SAAS;aAChC;SACF;KACF,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC"}

package/dist/quorum.d.ts

@@ -0,0 +1,26 @@
+import { type Address, type Hex } from 'viem';
+export interface OffChainQuorumProof {
+    mode: 'off-chain';
+    /** The hash the signers signed — MUST equal the bound payload (the delegation hash). */
+    payloadHash: Hex;
+    /** Concatenated 65-byte ECDSA/packed signatures (Safe-style packing). */
+    packedSignatures: Hex;
+}
+export interface VerifyOffChainQuorumInput {
+    /** The QuorumCaveat `terms`: abi(address[] signers, uint8 threshold, address approvedHashRegistry). */
+    caveatTerms: Hex;
+    proof: OffChainQuorumProof;
+    /** The hash the quorum MUST have signed (bound to this delegation). */
+    expectedPayloadHash: Hex;
+    /** Connection-agnostic signature verifier (token.ts wires `verifyUniversalSignature`). */
+    verifySignature: (signer: Address, digest: Hex, signature: Hex) => Promise<boolean>;
+}
+export type OffChainQuorumResult = {
+    ok: true;
+    matched: Address[];
+} | {
+    ok: false;
+    reason: string;
+};
+export declare function verifyOffChainQuorum(input: VerifyOffChainQuorumInput): Promise<OffChainQuorumResult>;
+//# sourceMappingURL=quorum.d.ts.map

package/dist/quorum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quorum.d.ts","sourceRoot":"","sources":["../src/quorum.ts"],"names":[],"mappings":"AAeA,OAAO,EAAuB,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAEnE,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,WAAW,CAAC;IAClB,wFAAwF;IACxF,WAAW,EAAE,GAAG,CAAC;IACjB,yEAAyE;IACzE,gBAAgB,EAAE,GAAG,CAAC;CACvB;AAED,MAAM,WAAW,yBAAyB;IACxC,uGAAuG;IACvG,WAAW,EAAE,GAAG,CAAC;IACjB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,uEAAuE;IACvE,mBAAmB,EAAE,GAAG,CAAC;IACzB,0FAA0F;IAC1F,eAAe,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACrF;AAED,MAAM,MAAM,oBAAoB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAWpG,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAoD1G"}