@agenticprimitives/delegation 1.0.0-alpha.4 → 1.0.0-alpha.40

package/dist/presentation-release.js

@@ -0,0 +1,81 @@
+// THE KEY RELEASE — delegated presentation (spec 305 W2 · zkID alignment §3 · wave Z2).
+//
+// The person's credential is bound to a DEVICE KEY (`cnf.jwk`), and OpenAC's `Show` must be signed by it. If her
+// agent held that key it would BE the holder (zkID alignment §8). So the key is custodied for her (a JwsSignerPort),
+// and this module is the only road to its signature: a caller presents the mandate (a child of her standing
+// `credential.present` wire, bound to the statement it is about to prove), and the release judges it PER SIGNATURE
+// — live, unrevoked, in window, the actor its delegate, the reason (intent) equal, the audience / predicate program /
+// issuer facet within the wire's scope — before the signer sees a byte. Refusal is typed. The signature is then over
+// the AUDIENCE-BOUND challenge, and the release reads the audience out of the challenge it is asked to sign and
+// requires it to be the one the mandate covers: a caller cannot name one audience to the judge and sign for another.
+//
+// This is the port of smart-agent's `SessionGrantV1` + `WalletAction` + `evaluateProofPolicy` with the delegate moved
+// from a session EOA to a custodied P-256 key and the policy moved from code the MCP ran to a caveat the key enforces.
+// Where a managed KMS holds the key (AKCS, once it has a P-256 kind), THIS check is what it runs before releasing the
+// signature; until then it runs in front of the local signer, with the same wire and the same reasons.
+import { verifyMandateForStep } from './mandate.js';
+import { PRESENTATION_CAPABILITY, PRESENTATION_RAR_TYPE, DEFAULT_SUBSET_HANDLERS } from './mandate-handlers.js';
+export const presentationIntent = (i) => ({ type: 'PresentationIntentV1', audience: i.audience, predicateDigest: i.predicateDigest.toLowerCase(), issuerKeyId: i.issuerKeyId });
+/** An audience-bound challenge: `<scheme>:<audience>:<nonce>`. The audience is everything between the first and the
+ *  last colon, so a URL audience with its own colon survives; the nonce never contains one. */
+export function parseAudienceBoundChallenge(message) {
+    let text;
+    try {
+        text = new TextDecoder('utf-8', { fatal: true }).decode(message);
+    }
+    catch {
+        return null;
+    }
+    const first = text.indexOf(':'), last = text.lastIndexOf(':');
+    if (first <= 0 || last <= first + 1 || last === text.length - 1)
+        return null;
+    return { scheme: text.slice(0, first), audience: text.slice(first + 1, last), nonce: text.slice(last + 1) };
+}
+export class PresentationReleaseRefused extends Error {
+    code;
+    decision;
+    constructor(code, message, decision) {
+        super(message);
+        this.code = code;
+        this.decision = decision;
+        this.name = 'PresentationReleaseRefused';
+    }
+}
+export function createPresentationRelease(input) {
+    const judge = async (step) => {
+        const decision = await verifyMandateForStep({
+            presented: input.mandate,
+            requirementType: PRESENTATION_RAR_TYPE,
+            actor: input.actor,
+            step: {
+                capability: PRESENTATION_CAPABILITY,
+                action: 'present',
+                intent: presentationIntent(step),
+                args: { audience: step.audience, predicateDigest: step.predicateDigest.toLowerCase(), issuerKeyId: step.issuerKeyId },
+            },
+            enforcers: input.enforcers,
+            checks: input.checks,
+            now: input.now(),
+            handlers: input.handlers ?? DEFAULT_SUBSET_HANDLERS,
+        });
+        input.onDecision?.({ step, decision });
+        return decision;
+    };
+    return {
+        judge,
+        async sign(step, message) {
+            const bound = parseAudienceBoundChallenge(message);
+            if (!bound)
+                throw new PresentationReleaseRefused('challenge-unbound', 'the message is not an audience-bound challenge (<scheme>:<audience>:<nonce>); the key signs nothing else');
+            if (bound.audience !== step.audience)
+                throw new PresentationReleaseRefused('audience-mismatch', `the challenge is bound to ${bound.audience}; the mandate presented covers ${step.audience}`);
+            const decision = await judge(step);
+            if (decision.decision === 'deny')
+                throw new PresentationReleaseRefused('mandate-denied', decision.reasons.map((r) => `${r.code}: ${r.message}`).join('; '), decision);
+            if (decision.decision === 'approval-required')
+                throw new PresentationReleaseRefused('approval-required', 'the mandate requires an approval this release cannot collect', decision);
+            return input.signer.sign(message);
+        },
+    };
+}
+//# sourceMappingURL=presentation-release.js.map

package/dist/presentation-release.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"presentation-release.js","sourceRoot":"","sources":["../src/presentation-release.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,EAAE;AACF,iHAAiH;AACjH,qHAAqH;AACrH,4GAA4G;AAC5G,mHAAmH;AACnH,sHAAsH;AACtH,qHAAqH;AACrH,gHAAgH;AAChH,qHAAqH;AACrH,EAAE;AACF,sHAAsH;AACtH,uHAAuH;AACvH,sHAAsH;AACtH,uGAAuG;AAGvG,OAAO,EAAE,oBAAoB,EAAqE,MAAM,cAAc,CAAC;AAEvH,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAchH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAkE,EAAwB,EAAE,CAC7H,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,CAAC,WAAW,EAAS,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAEhJ;+FAC+F;AAC/F,MAAM,UAAU,2BAA2B,CAAC,OAAmB;IAC7D,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QAAC,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAChG,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9D,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;AAC9G,CAAC;AAGD,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC9B;IAAyD;IAA9E,YAAqB,IAA6B,EAAE,OAAe,EAAW,QAA0B;QACtG,KAAK,CAAC,OAAO,CAAC,CAAC;QADI,SAAI,GAAJ,IAAI,CAAyB;QAA4B,aAAQ,GAAR,QAAQ,CAAkB;QAEtG,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AA+BD,MAAM,UAAU,yBAAyB,CAAC,KAA+B;IACvE,MAAM,KAAK,GAAG,KAAK,EAAE,IAAwB,EAA4B,EAAE;QACzE,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC;YAC1C,SAAS,EAAE,KAAK,CAAC,OAAO;YACxB,eAAe,EAAE,qBAAqB;YACtC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE;gBACJ,UAAU,EAAE,uBAAuB;gBACnC,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,kBAAkB,CAAC,IAAI,CAAC;gBAChC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;aACtH;YACD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,uBAAuB;SACpD,CAAC,CAAC;QACH,KAAK,CAAC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvC,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACF,OAAO;QACL,KAAK;QACL,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO;YACtB,MAAM,KAAK,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,0BAA0B,CAAC,mBAAmB,EAAE,0GAA0G,CAAC,CAAC;YAClL,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,0BAA0B,CAAC,mBAAmB,EAAE,6BAA6B,KAAK,CAAC,QAAQ,kCAAkC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC9L,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM;gBAAE,MAAM,IAAI,0BAA0B,CAAC,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;YACtK,IAAI,QAAQ,CAAC,QAAQ,KAAK,mBAAmB;gBAAE,MAAM,IAAI,0BAA0B,CAAC,mBAAmB,EAAE,8DAA8D,EAAE,QAAQ,CAAC,CAAC;YACnL,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/quorum.d.ts

@@ -0,0 +1,26 @@
+import { type Address, type Hex } from 'viem';
+export interface OffChainQuorumProof {
+    mode: 'off-chain';
+    /** The hash the signers signed — MUST equal the bound payload (the delegation hash). */
+    payloadHash: Hex;
+    /** Concatenated 65-byte ECDSA/packed signatures (Safe-style packing). */
+    packedSignatures: Hex;
+}
+export interface VerifyOffChainQuorumInput {
+    /** The QuorumCaveat `terms`: abi(address[] signers, uint8 threshold, address approvedHashRegistry). */
+    caveatTerms: Hex;
+    proof: OffChainQuorumProof;
+    /** The hash the quorum MUST have signed (bound to this delegation). */
+    expectedPayloadHash: Hex;
+    /** Connection-agnostic signature verifier (token.ts wires `verifyUniversalSignature`). */
+    verifySignature: (signer: Address, digest: Hex, signature: Hex) => Promise<boolean>;
+}
+export type OffChainQuorumResult = {
+    ok: true;
+    matched: Address[];
+} | {
+    ok: false;
+    reason: string;
+};
+export declare function verifyOffChainQuorum(input: VerifyOffChainQuorumInput): Promise<OffChainQuorumResult>;
+//# sourceMappingURL=quorum.d.ts.map

package/dist/quorum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quorum.d.ts","sourceRoot":"","sources":["../src/quorum.ts"],"names":[],"mappings":"AAeA,OAAO,EAAuB,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAEnE,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,WAAW,CAAC;IAClB,wFAAwF;IACxF,WAAW,EAAE,GAAG,CAAC;IACjB,yEAAyE;IACzE,gBAAgB,EAAE,GAAG,CAAC;CACvB;AAED,MAAM,WAAW,yBAAyB;IACxC,uGAAuG;IACvG,WAAW,EAAE,GAAG,CAAC;IACjB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,uEAAuE;IACvE,mBAAmB,EAAE,GAAG,CAAC;IACzB,0FAA0F;IAC1F,eAAe,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACrF;AAED,MAAM,MAAM,oBAAoB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAWpG,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAoD1G"}

package/dist/quorum.js

@@ -0,0 +1,80 @@
+// Off-chain quorum verification (spec 291 §6b). For MCP-only operations that never
+// redeem on chain, verify a QuorumCaveat off-chain: threshold satisfied, every
+// signer authorized (in the caveat whitelist), every signature valid over the
+// bound payload — via the connection-agnostic signature verifier (EOA ECDSA /
+// ERC-1271 / ERC-6492). Fail-closed: any decode error, unbound payload, or
+// sub-threshold match rejects.
+//
+// Binding: the quorum signs over `expectedPayloadHash` (the delegation's EIP-712
+// hash) — i.e. the quorum approves THIS exact delegation. A proof minted for one
+// delegation cannot be replayed onto another (each has a unique hash).
+//
+// Port: smart-agent RecoveryEnforcer.sol (guardian threshold + per-signer +
+// intent-bound). Divergence: that verifies on-chain at redeem; this is the
+// off-chain equivalent for tools that never redeem.
+import { decodeAbiParameters } from 'viem';
+/** Split a 0x-prefixed blob of concatenated 65-byte signatures; null if malformed. */
+function splitPackedSignatures(packed) {
+    const hex = packed.startsWith('0x') ? packed.slice(2) : packed;
+    if (hex.length === 0 || hex.length % 130 !== 0)
+        return null; // 65 bytes = 130 hex chars
+    const out = [];
+    for (let i = 0; i < hex.length; i += 130)
+        out.push(`0x${hex.slice(i, i + 130)}`);
+    return out;
+}
+export async function verifyOffChainQuorum(input) {
+    // 1. Payload binding — the quorum must have signed THIS delegation's hash.
+    if (input.proof.payloadHash.toLowerCase() !== input.expectedPayloadHash.toLowerCase()) {
+        return { ok: false, reason: 'payload_unbound' };
+    }
+    // 2. Decode the caveat's authorized signer set + threshold.
+    let signers;
+    let threshold;
+    try {
+        const [s, t] = decodeAbiParameters([{ type: 'address[]' }, { type: 'uint8' }, { type: 'address' }], input.caveatTerms);
+        signers = s.map((a) => a);
+        threshold = Number(t);
+    }
+    catch {
+        return { ok: false, reason: 'bad_caveat_terms' };
+    }
+    if (!Number.isFinite(threshold) || threshold <= 0)
+        return { ok: false, reason: 'bad_threshold' };
+    if (signers.length < threshold)
+        return { ok: false, reason: 'whitelist_smaller_than_threshold' };
+    // 3. Split the packed signatures.
+    const sigs = splitPackedSignatures(input.proof.packedSignatures);
+    if (sigs === null)
+        return { ok: false, reason: 'bad_signatures' };
+    if (sigs.length < threshold)
+        return { ok: false, reason: 'insufficient_signatures' };
+    // 4. Match each signature to a UNIQUE authorized signer (no double-count).
+    const remaining = new Set(signers.map((a) => a.toLowerCase()));
+    const matched = [];
+    for (const sig of sigs) {
+        for (const signer of signers) {
+            if (!remaining.has(signer.toLowerCase()))
+                continue;
+            let ok = false;
+            try {
+                ok = await input.verifySignature(signer, input.proof.payloadHash, sig);
+            }
+            catch {
+                ok = false; // a throwing verifier is a failed check (fail-closed)
+            }
+            if (ok) {
+                remaining.delete(signer.toLowerCase());
+                matched.push(signer);
+                break;
+            }
+        }
+        if (matched.length >= threshold)
+            break;
+    }
+    if (matched.length < threshold) {
+        return { ok: false, reason: `threshold_unmet (${matched.length}/${threshold})` };
+    }
+    return { ok: true, matched };
+}
+//# sourceMappingURL=quorum.js.map

package/dist/quorum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quorum.js","sourceRoot":"","sources":["../src/quorum.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,2EAA2E;AAC3E,+BAA+B;AAC/B,EAAE;AACF,iFAAiF;AACjF,iFAAiF;AACjF,uEAAuE;AACvE,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,oDAAoD;AAEpD,OAAO,EAAE,mBAAmB,EAA0B,MAAM,MAAM,CAAC;AAsBnE,sFAAsF;AACtF,SAAS,qBAAqB,CAAC,MAAW;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/D,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,2BAA2B;IACxF,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,GAAG;QAAE,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,EAAS,CAAC,CAAC;IACxF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAgC;IACzE,2EAA2E;IAC3E,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,mBAAmB,CAAC,WAAW,EAAE,EAAE,CAAC;QACtF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAClD,CAAC;IAED,4DAA4D;IAC5D,IAAI,OAAkB,CAAC;IACvB,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,mBAAmB,CAChC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAC/D,KAAK,CAAC,WAAW,CAClB,CAAC;QACF,OAAO,GAAI,CAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAClD,SAAS,GAAG,MAAM,CAAC,CAAoB,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACjG,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IAEjG,kCAAkC;IAClC,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACjE,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAClE,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAErF,2EAA2E;IAC3E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAc,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBAAE,SAAS;YACnD,IAAI,EAAE,GAAG,KAAK,CAAC;YACf,IAAI,CAAC;gBACH,EAAE,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YACzE,CAAC;YAAC,MAAM,CAAC;gBACP,EAAE,GAAG,KAAK,CAAC,CAAC,sDAAsD;YACpE,CAAC;YACD,IAAI,EAAE,EAAE,CAAC;gBACP,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrB,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,IAAI,SAAS;YAAE,MAAM;IACzC,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,OAAO,CAAC,MAAM,IAAI,SAAS,GAAG,EAAE,CAAC;IACnF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC"}

package/dist/session-delegation.d.ts

@@ -0,0 +1,34 @@
+import type { Address, Hex } from '@agenticprimitives/types';
+import type { Delegation } from './types.js';
+export interface SessionDelegationParams {
+    /** The principal's Smart Account — the leaf delegator (the canonical identity that authorizes the key). */
+    delegator: Address;
+    /** The freshly-generated session key the token will be signed by. */
+    sessionKeyAddress: Address;
+    /** Spec 408 §2.1 (R917-P-2) — THE DELEGATES this session key may present the principal's delegations to:
+     *  the relying app's SA at a connect, the Home's service agents at the Home's own session, the agent
+     *  itself for a runtime key. Required and non-empty: a leaf that names nobody is refused by the verifier. */
+    presentsTo: readonly Address[];
+    /** Unix seconds the session-key authorization is valid until (bound by a timestamp caveat). */
+    validUntil: number;
+    /** Deployed enforcer addresses (timestamp + value). */
+    enforcers: {
+        timestamp: Address;
+        value: Address;
+    };
+    chainId: number;
+    delegationManager: Address;
+    /** Random salt; supply a fixed value for deterministic tests. */
+    salt?: bigint;
+}
+/**
+ * Build the session-delegation leaf `delegator (principal SA) → sessionKey`, with a timestamp (TTL) +
+ * value-0 + session-audience caveat (spec 408 §2.1), UNSIGNED. Returns `{ leaf, digest }`; the caller signs `digest` with the member's live
+ * credential and sets `leaf.signature`. v4 binds to the DELEGATOR (the principal's canonical identity), so
+ * the same credential that signs the `member→relying` delegation at connect also authorizes the session key.
+ */
+export declare function buildSessionDelegation(p: SessionDelegationParams): {
+    leaf: Delegation;
+    digest: Hex;
+};
+//# sourceMappingURL=session-delegation.d.ts.map

package/dist/session-delegation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-delegation.d.ts","sourceRoot":"","sources":["../src/session-delegation.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAK7C,MAAM,WAAW,uBAAuB;IACtC,2GAA2G;IAC3G,SAAS,EAAE,OAAO,CAAC;IACnB,qEAAqE;IACrE,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;iHAE6G;IAC7G,UAAU,EAAE,SAAS,OAAO,EAAE,CAAC;IAC/B,+FAA+F;IAC/F,UAAU,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,SAAS,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAUD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,uBAAuB,GAAG;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAcpG"}

package/dist/session-delegation.js

@@ -0,0 +1,33 @@
+import { ROOT_AUTHORITY } from './types.js';
+import { buildCaveat, buildSessionAudienceCaveat, encodeTimestampTerms, encodeValueTerms } from './caveats.js';
+import { hashDelegation } from './hash.js';
+function randomSalt() {
+    const b = new Uint8Array(16);
+    globalThis.crypto.getRandomValues(b);
+    let s = 0n;
+    for (const x of b)
+        s = (s << 8n) | BigInt(x);
+    return s;
+}
+/**
+ * Build the session-delegation leaf `delegator (principal SA) → sessionKey`, with a timestamp (TTL) +
+ * value-0 + session-audience caveat (spec 408 §2.1), UNSIGNED. Returns `{ leaf, digest }`; the caller signs `digest` with the member's live
+ * credential and sets `leaf.signature`. v4 binds to the DELEGATOR (the principal's canonical identity), so
+ * the same credential that signs the `member→relying` delegation at connect also authorizes the session key.
+ */
+export function buildSessionDelegation(p) {
+    const leaf = {
+        delegator: p.delegator,
+        delegate: p.sessionKeyAddress,
+        authority: ROOT_AUTHORITY,
+        caveats: [
+            buildCaveat(p.enforcers.timestamp, encodeTimestampTerms(0, p.validUntil)),
+            buildCaveat(p.enforcers.value, encodeValueTerms(0n)),
+            buildSessionAudienceCaveat(p.presentsTo),
+        ],
+        salt: p.salt ?? randomSalt(),
+        signature: '0x',
+    };
+    return { leaf, digest: hashDelegation(leaf, p.chainId, p.delegationManager) };
+}
+//# sourceMappingURL=session-delegation.js.map

package/dist/session-delegation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-delegation.js","sourceRoot":"","sources":["../src/session-delegation.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC/G,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAqB3C,SAAS,UAAU;IACjB,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC7B,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7C,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,CAA0B;IAC/D,MAAM,IAAI,GAAe;QACvB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,QAAQ,EAAE,CAAC,CAAC,iBAAiB;QAC7B,SAAS,EAAE,cAAc;QACzB,OAAO,EAAE;YACP,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;YACzE,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC;YACpD,0BAA0B,CAAC,CAAC,CAAC,UAAU,CAAC;SACzC;QACD,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,UAAU,EAAE;QAC5B,SAAS,EAAE,IAAI;KAChB,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC;AAChF,CAAC"}

package/dist/session-manager.d.ts

@@ -1,12 +1,11 @@
 import { keccak256, type Address, type Hex } from 'viem';
 import type { A2AKeyProvider } from '@agenticprimitives/key-custody';
-import type { Delegation, SessionMeta, SessionStore } from './types';
+import type { Delegation, SessionMeta, SessionStore } from './types.js';
 export interface SessionResolveResult {
     meta: SessionMeta;
     delegation: Delegation | null;
     signer: {
         address: Address;
-        privateKey: Hex;
         signMessage(msg: string | {
             raw: Hex;
         }): Promise<Hex>;

package/dist/session-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-manager.d.ts","sourceRoot":"","sources":["../src/session-manager.ts"],"names":[],"mappings":"AAeA,OAAO,EAGL,SAAS,EAET,KAAK,OAAO,EACZ,KAAK,GAAG,EACT,MAAM,MAAM,CAAC;AACd,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,KAAK,EACV,UAAU,EACV,WAAW,EAGX,YAAY,EACb,MAAM,SAAS,CAAC;AA2EjB,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,WAAW,CAAC;IAClB,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE;QACN,OAAO,EAAE,OAAO,CAAC;QACjB,UAAU,EAAE,GAAG,CAAC;QAChB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG;YAAE,GAAG,EAAE,GAAG,CAAA;SAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;KACvD,CAAC;CACH;AAED,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE;QACrB,UAAU,EAAE,cAAc,CAAC;QAC3B,KAAK,EAAE,YAAY,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,uDAAuD;QACvD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;KACpB;IAGH,OAAO,CAAC,KAAK;IAIb;;;;OAIG;IACG,IAAI,CACR,cAAc,EAAE,OAAO,EACvB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,OAAO,CAAA;KAAE,CAAC;IA4C7D;;;OAGG;IACG,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAuCvE;;;;;OAKG;IACG,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAoEzD,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAIhC,cAAc;CAQ7B;AAID,wBAAgB,wBAAwB,IAAI,YAAY,CAkBvD;AAeD,OAAO,EAAE,SAAS,EAAE,CAAC"}
+{"version":3,"file":"session-manager.d.ts","sourceRoot":"","sources":["../src/session-manager.ts"],"names":[],"mappings":"AAeA,OAAO,EAGL,SAAS,EAET,KAAK,OAAO,EACZ,KAAK,GAAG,EACT,MAAM,MAAM,CAAC;AACd,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,KAAK,EACV,UAAU,EACV,WAAW,EAGX,YAAY,EACb,MAAM,YAAY,CAAC;AA2EpB,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,WAAW,CAAC;IAClB,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE;QACN,OAAO,EAAE,OAAO,CAAC;QAIjB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG;YAAE,GAAG,EAAE,GAAG,CAAA;SAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;KACvD,CAAC;CACH;AAED,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE;QACrB,UAAU,EAAE,cAAc,CAAC;QAC3B,KAAK,EAAE,YAAY,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,uDAAuD;QACvD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;KACpB;IAGH,OAAO,CAAC,KAAK;IAIb;;;;OAIG;IACG,IAAI,CACR,cAAc,EAAE,OAAO,EACvB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,OAAO,CAAA;KAAE,CAAC;IAoD7D;;;OAGG;IACG,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAuCvE;;;;;OAKG;IACG,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAwEzD,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAIhC,cAAc;CAQ7B;AAID,wBAAgB,wBAAwB,IAAI,YAAY,CAkBvD;AAeD,OAAO,EAAE,SAAS,EAAE,CAAC"}

package/dist/session-manager.js

@@ -10,8 +10,8 @@
 //   resolve  decrypts the package, hands back a viem-compatible signer
 //            over the session private key, plus the bound delegation.
 //   revoke   marks the row revoked; callers must mint a new session.
-import { secp256k1 } from '@noble/curves/secp256k1';
-import { keccak_256 } from '@noble/hashes/sha3';
+import { secp256k1 } from '@noble/curves/secp256k1.js';
+import { keccak_256 } from '@noble/hashes/sha3.js';
 import { bytesToHex, hexToBytes, keccak256, toBytes, } from 'viem';
 import { canonicalContextBytes } from '@agenticprimitives/key-custody';
 function randomBytes(n) {
@@ -83,7 +83,7 @@ export class SessionManager {
         // Fresh secp256k1 keypair
         const priv = randomBytes(32);
         // secp256k1 priv keys MUST be in [1, n-1]. Retry on rare overflow / zero.
-        if (!secp256k1.utils.isValidPrivateKey(priv)) {
+        if (!secp256k1.utils.isValidSecretKey(priv)) {
             return this.init(accountAddress, chainId); // recurse — vanishingly rare
         }
         const pub = secp256k1.getPublicKey(priv, false);
@@ -106,7 +106,15 @@ export class SessionManager {
             encryptedPackage,
             iv,
             encryptedDataKey: wrap.encryptedDataKey,
-            keyVersion: wrap.keyVersion,
+            // Store the keyVersion that the ENCRYPT AAD was built with (the provider's stable
+            // `keyVersion` getter, used at line ~163), NOT `wrap.keyVersion`. For the GCP KMS backend the
+            // getter is a constant ('gcp-kms:unknown') while `wrap.keyVersion` is the version PARSED
+            // from the encrypt response ('gcp-kms:v1'); storing the parsed value made package()/resolve()
+            // rebuild the AAD with a DIFFERENT key_version than encrypt used → Cloud KMS :decrypt
+            // "Decryption failed" (EncryptionContext mismatch). GCP resolves the real version from the
+            // ciphertext, so the AAD only needs a STABLE marker bound identically at both ends. (The vault
+            // solves the same problem by excluding keyVersion from its wrap context — envelope.ts wrapContext.)
+            keyVersion: this.opts.keyCustody.keyVersion,
             expiresAt,
             createdAt: new Date(this.nowMs()).toISOString(),
         };
@@ -191,7 +199,6 @@ export class SessionManager {
             delegation: pkg.delegation ? deserializeDelegation(pkg.delegation) : null,
             signer: {
                 address,
-                privateKey: pkg.sessionPrivateKey,
                 signMessage: async (msg) => {
                     let digest;
                     if (typeof msg === 'string') {
@@ -213,7 +220,9 @@ export class SessionManager {
                     // either way, but every signing path makes the invariant
                     // load-bearing at the call site so future auditors don't
                     // have to read noble release notes.
-                    const sig = secp256k1.sign(digest, priv, { lowS: true });
+                    // noble v2: sign() returns raw bytes; request recovered form and
+                    // parse into an r/s/recovery object.
+                    const sig = secp256k1.Signature.fromBytes(secp256k1.sign(digest, priv, { lowS: true, prehash: false, format: "recovered" }), "recovered");
                     const r = sig.r.toString(16).padStart(64, '0');
                     const s = sig.s.toString(16).padStart(64, '0');
                     const v = (sig.recovery ?? 0) + 27;

package/dist/session-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-manager.js","sourceRoot":"","sources":["../src/session-manager.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,EAAE;AACF,0DAA0D;AAC1D,2EAA2E;AAC3E,sEAAsE;AACtE,kEAAkE;AAClE,qEAAqE;AACrE,qEAAqE;AACrE,4CAA4C;AAC5C,uEAAuE;AACvE,sEAAsE;AACtE,qEAAqE;AAErE,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EACL,UAAU,EACV,UAAU,EACV,SAAS,EACT,OAAO,GAGR,MAAM,MAAM,CAAC;AAEd,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AASvE,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG,KAAK,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,GAAG;QAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAe;IACzC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACnD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAY,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB;IACtC,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACrE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,QAAQ,CAAC,IAAiB,EAAE,UAAkB;IACrD,OAAO;QACL,YAAY,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;QAC3C,eAAe,EAAE,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE;QAClD,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAC9B,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,WAAW,EAAE,UAAU;KACxB,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,gFAAgF;AAChF,gEAAgE;AAChE,SAAS,cAAc,CAAC,CAAa;IACnC,OAAO,CAA4B,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAe,EACf,EAAc,EACd,SAAqB,EACrB,GAAe;IAEf,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACtH,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAC/C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC,EAAE,cAAc,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,EAChF,SAAS,EACT,cAAc,CAAC,SAAS,CAAC,CAC1B,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAe,EACf,EAAc,EACd,UAAsB,EACtB,GAAe;IAEf,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACtH,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAC/C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC,EAAE,cAAc,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,EAChF,SAAS,EACT,cAAc,CAAC,UAAU,CAAC,CAC3B,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;AAC5B,CAAC;AAYD,MAAM,OAAO,cAAc;IAEN;IADnB,YACmB,IAMhB;QANgB,SAAI,GAAJ,IAAI,CAMpB;IACA,CAAC;IAEI,KAAK;QACX,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI,CACR,cAAuB,EACvB,OAAe;QAEf,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAE7D,0BAA0B;QAC1B,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC7B,0EAA0E;QAC1E,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,6BAA6B;QAC1E,CAAC;QACD,MAAM,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChD,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAElD,MAAM,IAAI,GAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAE5E,0EAA0E;QAC1E,sBAAsB;QACtB,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAC7C,IAAI,CAAC,SAAS,CAAC,EAAE,iBAAiB,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CACxD,CAAC;QACF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;QACvF,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,gBAAgB,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;QAElG,MAAM,GAAG,GAAe;YACtB,EAAE,EAAE,SAAS;YACb,cAAc;YACd,OAAO;YACP,iBAAiB;YACjB,MAAM,EAAE,SAAS;YACjB,gBAAgB;YAChB,EAAE;YACF,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS;YACT,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE;SAChD,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,UAAsB;QACrD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,IAAI,GAAgB;YACxB,SAAS;YACT,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC;QACF,wEAAwE;QACxE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC;YAC1D,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,UAAU,EAAE,MAAM;YAClB,KAAK,EAAE,cAAc;YACrB,UAAU,EAAE,GAAG,CAAC,UAAU;SAC3B,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAA+B,CAAC;QAE3F,yEAAyE;QACzE,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAC1C,IAAI,CAAC,SAAS,CAAC;YACb,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,UAAU,EAAE,sBAAsB,CAAC,UAAU,CAAC;SAC/C,CAAC,CACH,CAAC;QACF,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,gBAAgB,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAE/E,MAAM,OAAO,GAAe;YAC1B,GAAG,GAAG;YACN,MAAM,EAAE,QAAQ;YAChB,gBAAgB;YAChB,EAAE,EAAE,KAAK;SACV,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,SAAS,aAAa,CAAC,CAAC;QACtF,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,uCAAuC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,GAAG,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,IAAI,GAAgB;YACxB,SAAS;YACT,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC;QACF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC;YAC1D,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,UAAU,EAAE,MAAM;YAClB,KAAK,EAAE,cAAc;YACrB,UAAU,EAAE,GAAG,CAAC,UAAU;SAC3B,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAGlD,CAAC;QACF,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAExE,OAAO;YACL,IAAI;YACJ,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI;YACzE,MAAM,EAAE;gBACN,OAAO;gBACP,UAAU,EAAE,GAAG,CAAC,iBAAiB;gBACjC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;oBACzB,IAAI,MAAkB,CAAC;oBACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;wBAC5B,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;wBAC5C,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,iCAAiC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;wBACzF,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;wBAC9D,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;wBACxB,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;wBACnC,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;oBAChC,CAAC;yBAAM,CAAC;wBACN,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC5B,CAAC;oBACD,8DAA8D;oBAC9D,6DAA6D;oBAC7D,6DAA6D;oBAC7D,8DAA8D;oBAC9D,8DAA8D;oBAC9D,yDAAyD;oBACzD,yDAAyD;oBACzD,oCAAoC;oBACpC,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBACzD,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;oBAC/C,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;oBAC/C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;oBACnC,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAQ,CAAC;gBACjE,CAAC;aACF;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,SAAiB;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,SAAS,aAAa,CAAC,CAAC;QAC9E,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,uCAAuC,GAAG,CAAC,MAAM,uBAAuB,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAED,6EAA6E;AAE7E,MAAM,UAAU,wBAAwB;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC3C,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,GAAG;YACZ,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,EAAE;YACV,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,cAAc;YACvB,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,EAAE;YACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzB,IAAI,CAAC,GAAG;gBAAE,OAAO;YACjB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;KACF,CAAC;AACJ,CAAC;AAMD,SAAS,sBAAsB,CAAC,CAAa;IAC3C,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAyB;IACtD,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,6EAA6E;AAC7E,OAAO,EAAE,SAAS,EAAE,CAAC"}
+{"version":3,"file":"session-manager.js","sourceRoot":"","sources":["../src/session-manager.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,EAAE;AACF,0DAA0D;AAC1D,2EAA2E;AAC3E,sEAAsE;AACtE,kEAAkE;AAClE,qEAAqE;AACrE,qEAAqE;AACrE,4CAA4C;AAC5C,uEAAuE;AACvE,sEAAsE;AACtE,qEAAqE;AAErE,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EACL,UAAU,EACV,UAAU,EACV,SAAS,EACT,OAAO,GAGR,MAAM,MAAM,CAAC;AAEd,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AASvE,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG,KAAK,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,GAAG;QAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAe;IACzC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACnD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAY,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB;IACtC,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACrE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,QAAQ,CAAC,IAAiB,EAAE,UAAkB;IACrD,OAAO;QACL,YAAY,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;QAC3C,eAAe,EAAE,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE;QAClD,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAC9B,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,WAAW,EAAE,UAAU;KACxB,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,gFAAgF;AAChF,gEAAgE;AAChE,SAAS,cAAc,CAAC,CAAa;IACnC,OAAO,CAA4B,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAe,EACf,EAAc,EACd,SAAqB,EACrB,GAAe;IAEf,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACtH,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAC/C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC,EAAE,cAAc,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,EAChF,SAAS,EACT,cAAc,CAAC,SAAS,CAAC,CAC1B,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAe,EACf,EAAc,EACd,UAAsB,EACtB,GAAe;IAEf,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACtH,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAC/C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC,EAAE,cAAc,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,EAChF,SAAS,EACT,cAAc,CAAC,UAAU,CAAC,CAC3B,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;AAC5B,CAAC;AAcD,MAAM,OAAO,cAAc;IAEN;IADnB,YACmB,IAMhB;QANgB,SAAI,GAAJ,IAAI,CAMpB;IACA,CAAC;IAEI,KAAK;QACX,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI,CACR,cAAuB,EACvB,OAAe;QAEf,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAE7D,0BAA0B;QAC1B,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC7B,0EAA0E;QAC1E,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,6BAA6B;QAC1E,CAAC;QACD,MAAM,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChD,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAElD,MAAM,IAAI,GAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAE5E,0EAA0E;QAC1E,sBAAsB;QACtB,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAC7C,IAAI,CAAC,SAAS,CAAC,EAAE,iBAAiB,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CACxD,CAAC;QACF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;QACvF,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,gBAAgB,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;QAElG,MAAM,GAAG,GAAe;YACtB,EAAE,EAAE,SAAS;YACb,cAAc;YACd,OAAO;YACP,iBAAiB;YACjB,MAAM,EAAE,SAAS;YACjB,gBAAgB;YAChB,EAAE;YACF,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,kFAAkF;YAClF,8FAA8F;YAC9F,yFAAyF;YACzF,8FAA8F;YAC9F,sFAAsF;YACtF,2FAA2F;YAC3F,+FAA+F;YAC/F,oGAAoG;YACpG,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU;YAC3C,SAAS;YACT,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE;SAChD,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,UAAsB;QACrD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,IAAI,GAAgB;YACxB,SAAS;YACT,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC;QACF,wEAAwE;QACxE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC;YAC1D,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,UAAU,EAAE,MAAM;YAClB,KAAK,EAAE,cAAc;YACrB,UAAU,EAAE,GAAG,CAAC,UAAU;SAC3B,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAA+B,CAAC;QAE3F,yEAAyE;QACzE,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAC1C,IAAI,CAAC,SAAS,CAAC;YACb,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,UAAU,EAAE,sBAAsB,CAAC,UAAU,CAAC;SAC/C,CAAC,CACH,CAAC;QACF,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,gBAAgB,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAE/E,MAAM,OAAO,GAAe;YAC1B,GAAG,GAAG;YACN,MAAM,EAAE,QAAQ;YAChB,gBAAgB;YAChB,EAAE,EAAE,KAAK;SACV,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,SAAS,aAAa,CAAC,CAAC;QACtF,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,uCAAuC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,GAAG,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,IAAI,GAAgB;YACxB,SAAS;YACT,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC;QACF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC;YAC1D,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,UAAU,EAAE,MAAM;YAClB,KAAK,EAAE,cAAc;YACrB,UAAU,EAAE,GAAG,CAAC,UAAU;SAC3B,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAGlD,CAAC;QACF,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAExE,OAAO;YACL,IAAI;YACJ,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI;YACzE,MAAM,EAAE;gBACN,OAAO;gBACP,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;oBACzB,IAAI,MAAkB,CAAC;oBACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;wBAC5B,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;wBAC5C,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,iCAAiC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;wBACzF,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;wBAC9D,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;wBACxB,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;wBACnC,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;oBAChC,CAAC;yBAAM,CAAC;wBACN,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC5B,CAAC;oBACD,8DAA8D;oBAC9D,6DAA6D;oBAC7D,6DAA6D;oBAC7D,8DAA8D;oBAC9D,8DAA8D;oBAC9D,yDAAyD;oBACzD,yDAAyD;oBACzD,oCAAoC;oBACpC,iEAAiE;oBACjE,qCAAqC;oBACrC,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,SAAS,CACvC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,EACjF,WAAW,CACZ,CAAC;oBACF,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;oBAC/C,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;oBAC/C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;oBACnC,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAQ,CAAC;gBACjE,CAAC;aACF;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,SAAiB;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,SAAS,aAAa,CAAC,CAAC;QAC9E,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,uCAAuC,GAAG,CAAC,MAAM,uBAAuB,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAED,6EAA6E;AAE7E,MAAM,UAAU,wBAAwB;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC3C,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,GAAG;YACZ,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,EAAE;YACV,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,cAAc;YACvB,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,EAAE;YACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzB,IAAI,CAAC,GAAG;gBAAE,OAAO;YACjB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;KACF,CAAC;AACJ,CAAC;AAMD,SAAS,sBAAsB,CAAC,CAAa;IAC3C,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAyB;IACtD,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,6EAA6E;AAC7E,OAAO,EAAE,SAAS,EAAE,CAAC"}

package/dist/standing.d.ts

@@ -0,0 +1,101 @@
+import { type Address, type Hex } from 'viem';
+import { type Delegation } from './types.js';
+import { type EnforcerAddresses, type MandateRequirementV1, type SubsetHandlers } from './mandate.js';
+/** The wire as it travels (salt as a decimal string), beside what it allows and where it is hashed. */
+export interface StandingWireV1 {
+    v: 1;
+    /** The template that minted it (`act-as-me`), for the surface that lists it. */
+    template: string;
+    /** The ONE capability it covers. */
+    capability: string;
+    /** The standing delegation: principal → delegate key. Wire-shaped. */
+    wire: Record<string, unknown>;
+    /** Its EIP-712 digest on `chainId` / `delegationManager`. */
+    ref: Hex;
+    /** What it allows, as the capability's handler reads it — the parent requirement a child is bounded by. */
+    requirement: Omit<MandateRequirementV1, 'intentDigest'>;
+    enforcers: EnforcerAddresses;
+    chainId: number;
+    delegationManager: Address;
+    grantedAt: string;
+}
+export interface BuildStandingWireInput {
+    template: string;
+    /** The principal whose authority this is: the person (a capability), or her TREASURY (a payment — assets live only in treasuries). */
+    delegator: Address;
+    /** The delegate KEY (a Worker's custody key, a runtime's key) — never the person, never a session. */
+    delegate: Address;
+    capability: string;
+    /** A payment's bounds. Required for `treasury.payment.execute`; refused for anything else. */
+    payment?: {
+        payee: Address;
+        asset: Address;
+        maxAmount: bigint;
+        maxAggregate?: bigint;
+        maxRedemptionsPerWindow?: number;
+        windowSeconds?: number;
+    };
+    /** A presentation's bounds (spec 305 W2 / zkID alignment §3): which verifiers, which predicate programs, which issuer
+     *  facets the delegate may cause her DEVICE KEY to sign for. Required for `credential.present`; refused for anything else. */
+    presentation?: {
+        audiences: string[];
+        predicateDigests: Hex[];
+        issuerKeyIds: string[];
+        maxPresentations?: number;
+    };
+    validForSeconds: number;
+    enforcers: EnforcerAddresses;
+    chainId: number;
+    delegationManager: Address;
+    /** Random 128-bit salt; injected so a test can be deterministic. */
+    salt?: bigint;
+    handlers?: SubsetHandlers;
+}
+/** The RAR type a capability is bounded by — the verifier's own map. */
+export declare const standingRequirementType: (capability: string) => string;
+/**
+ * The UNSIGNED standing wire and its digest. The caller signs `ref` with the delegator's custodian (an off-chain
+ * signature, or the approved-digest sentinel after a batch approval) and sets `wire.signature`.
+ */
+export declare function buildStandingWire(i: BuildStandingWireInput): {
+    standing: StandingWireV1;
+    delegation: Delegation;
+};
+/** Attach the signature the custodian produced over `ref` (or the approved-digest sentinel). */
+export declare function signedStandingWire(s: StandingWireV1, signature: Hex): StandingWireV1;
+/** What a parked run said it needs — the `authority_required` reply's three fields. */
+export interface ParkedNeedV1 {
+    requirement: MandateRequirementV1;
+    delegator: Address;
+    delegate: Address;
+}
+export declare function parkedNeedOf(data: unknown): ParkedNeedV1 | null;
+/** Does this standing wire cover the capability a step needs? Type and capability, not yet the bounds. */
+export declare function standingCovers(s: StandingWireV1, capabilityId: string): boolean;
+/** Pick the standing wire for a parked need: the one whose capability matches AND whose principal is the need's delegator. */
+export declare function standingFor(set: readonly StandingWireV1[], need: ParkedNeedV1, capabilityId: string): StandingWireV1 | null;
+export type DerivedChain = {
+    ok: true;
+    presented: Array<Record<string, unknown>>;
+    childRef: Hex;
+    parentRef: Hex;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * The child for THIS intent, from the standing wire, signed with the delegate key — or why not. The need must be an
+ * act OF the wire's principal and ⊆ the wire (the capability's handler judges: for a payment, the amount against
+ * the cap, the payee and the asset against the wire's); its window is clamped into the wire's. Anything else stays
+ * parked for the person — the surface's `grant_link` still works.
+ */
+export declare function deriveFromStanding(s: StandingWireV1, need: ParkedNeedV1, sign: (digest: Hex) => Promise<Hex>, handlers?: SubsetHandlers): Promise<DerivedChain>;
+/** Is this wire STANDING — no intent binding among its caveats? (A mandate always carries one.) */
+export declare function isStandingWire(wire: {
+    caveats?: ReadonlyArray<{
+        enforcer: string;
+        terms: string;
+        args?: string;
+    }>;
+}, digestBindingEnforcer: Address): boolean;
+//# sourceMappingURL=standing.d.ts.map

package/dist/standing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"standing.d.ts","sourceRoot":"","sources":["../src/standing.ts"],"names":[],"mappings":"AAeA,OAAO,EAAS,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AACrD,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAG7D,OAAO,EAAmC,KAAK,iBAAiB,EAAE,KAAK,oBAAoB,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAGvI,uGAAuG;AACvG,MAAM,WAAW,cAAc;IAC7B,CAAC,EAAE,CAAC,CAAC;IACL,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,6DAA6D;IAC7D,GAAG,EAAE,GAAG,CAAC;IACT,2GAA2G;IAC3G,WAAW,EAAE,IAAI,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC;IACxD,SAAS,EAAE,iBAAiB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,sIAAsI;IACtI,SAAS,EAAE,OAAO,CAAC;IACnB,sGAAsG;IACtG,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,8FAA8F;IAC9F,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjJ;kIAC8H;IAC9H,YAAY,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnH,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED,wEAAwE;AACxE,eAAO,MAAM,uBAAuB,eAAgB,MAAM,KAAG,MAA+J,CAAC;AAE7N;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,sBAAsB,GAAG;IAAE,QAAQ,EAAE,cAAc,CAAC;IAAC,UAAU,EAAE,UAAU,CAAA;CAAE,CAsCjH;AAED,gGAAgG;AAChG,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,GAAG,cAAc,CAEpF;AAED,uFAAuF;AACvF,MAAM,WAAW,YAAY;IAAG,WAAW,EAAE,oBAAoB,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE;AAE1G,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,YAAY,GAAG,IAAI,CAK/D;AAED,0GAA0G;AAC1G,wBAAgB,cAAc,CAAC,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAE/E;AAED,8HAA8H;AAC9H,wBAAgB,WAAW,CAAC,GAAG,EAAE,SAAS,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAG3H;AAED,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAAC,QAAQ,EAAE,GAAG,CAAC;IAAC,SAAS,EAAE,GAAG,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElJ;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,GAAE,cAAwC,GAAG,OAAO,CAAC,YAAY,CAAC,CAoB9L;AAED,mGAAmG;AACnG,wBAAgB,cAAc,CAAC,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,aAAa,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,EAAE,qBAAqB,EAAE,OAAO,GAAG,OAAO,CAG7J"}