@agenticprimitives/delegation 1.0.0-alpha.4 → 1.0.0-alpha.41

package/dist/caveats.js

@@ -5,8 +5,8 @@
 // addresses are derived via keccak256('urn:smart-agent:<name>')[0:20]. The
 // sentinels never live on-chain; their semantics live in this package's
 // evaluator (off-chain only).
-import { encodeAbiParameters } from 'viem';
-import { keccak_256 } from '@noble/hashes/sha3';
+import { encodeAbiParameters, decodeAbiParameters, keccak256 } from 'viem';
+import { keccak_256 } from '@noble/hashes/sha3.js';
 // ─── Off-chain sentinel addresses ────────────────────────────────────────
 function sentinelAddress(urn) {
     const hash = keccak_256(new TextEncoder().encode(urn));
@@ -18,6 +18,32 @@ function sentinelAddress(urn) {
 export const MCP_TOOL_SCOPE_ENFORCER = sentinelAddress('urn:smart-agent:mcp-tool-scope');
 export const DATA_SCOPE_ENFORCER = sentinelAddress('urn:smart-agent:data-scope');
 export const DELEGATE_BINDING_ENFORCER = sentinelAddress('urn:smart-agent:delegate-binding');
+/** Spec 278 — vault-key-use authorization sentinel. Off-chain only; the KAS
+ *  (key-authorization) enforces the grant's scope. Inert in the on-chain evaluator. */
+export const VAULT_KEY_USE_ENFORCER = sentinelAddress('urn:smart-agent:vault-key-use');
+/** Spec 317 — vault-record-scope sentinel. Off-chain only; the resource server (demo-mcp vault
+ *  runtime) enforces the grant's resource+op scope on every vault op. Inert in the on-chain evaluator. */
+export const VAULT_RECORD_SCOPE_ENFORCER = sentinelAddress('urn:smart-agent:vault-record-scope');
+/** Spec 408 §2.1 (R917-P-2) — session-audience sentinel. Off-chain only: tags the DEL-001 session leaf
+ *  with the DELEGATES the session key may present the principal's delegations to. Judged in
+ *  `sessionDelegateBindingError`; shape-checked in the evaluator; never redeemed on chain. */
+export const SESSION_AUDIENCE_ENFORCER = sentinelAddress('urn:smart-agent:session-audience');
+/** Spec 305 W2 / zkID alignment §3 (Z2) — presentation-scope sentinel. Off-chain only: the bounds of a
+ *  `credential.present` wire — which verifier AUDIENCES, which PREDICATE programs (by digest), which ISSUER facets
+ *  (by keyId) a delegate key may cause a device signature for. Judged by the presentation mandate handler
+ *  (`presentationHandler.isSubset`) before the key signs; shape-checked in the evaluator; never redeemed on chain
+ *  (a presentation never reaches the chain — the KEY is what enforces it, zkID alignment §3). */
+export const PRESENTATION_SCOPE_ENFORCER = sentinelAddress('urn:smart-agent:presentation-scope');
+export function encodePresentationScopeTerms(t) {
+    return encodeAbiParameters([{ type: 'string[]' }, { type: 'bytes32[]' }, { type: 'string[]' }, { type: 'uint32' }], [t.audiences, t.predicateDigests, t.issuerKeyIds, t.maxPresentations]);
+}
+export function decodePresentationScopeTerms(terms) {
+    const [audiences, predicateDigests, issuerKeyIds, maxPresentations] = decodeAbiParameters([{ type: 'string[]' }, { type: 'bytes32[]' }, { type: 'string[]' }, { type: 'uint32' }], terms);
+    return { audiences: [...audiences], predicateDigests: [...predicateDigests], issuerKeyIds: [...issuerKeyIds], maxPresentations: Number(maxPresentations) };
+}
+export function buildPresentationScopeCaveat(t) {
+    return buildCaveat(PRESENTATION_SCOPE_ENFORCER, encodePresentationScopeTerms(t));
+}
 // ─── Generic caveat builder ──────────────────────────────────────────────
 export function buildCaveat(enforcer, terms, args) {
     return { enforcer, terms, args: args ?? '0x' };
@@ -32,6 +58,27 @@ export function encodeTimestampTerms(validAfter, validUntil) {
     }
     return encodeAbiParameters([{ type: 'uint256' }, { type: 'uint256' }], [BigInt(validAfter), BigInt(validUntil)]);
 }
+/**
+ * Read back what `encodeTimestampTerms` wrote.
+ *
+ * DECODERS LIVE WITH THEIR ENCODERS. These three were in `@agenticprimitives/a2a`, one package away
+ * from the functions that produce the bytes, under a comment reading "must mirror delegation's
+ * encoders byte-for-byte" — which is the comment you write when the compiler cannot check it for you.
+ * That split is not theoretical: `demo-sso-next` hand-rolled its own timestamp decode against a
+ * comment claiming `uint128`, when the encoder emits `uint256`.
+ */
+export function decodeTimestampTerms(terms) {
+    const [validAfter, validUntil] = decodeAbiParameters([{ type: 'uint256' }, { type: 'uint256' }], terms);
+    return { validAfter, validUntil };
+}
+export function decodeAllowedTargetsTerms(terms) {
+    const [targets] = decodeAbiParameters([{ type: 'address[]' }], terms);
+    return targets;
+}
+export function decodeAllowedMethodsTerms(terms) {
+    const [selectors] = decodeAbiParameters([{ type: 'bytes4[]' }], terms);
+    return selectors;
+}
 export function encodeValueTerms(maxValue) {
     if (maxValue < 0n)
         throw new Error('encodeValueTerms: maxValue must be non-negative');
@@ -52,6 +99,16 @@ export function encodeAllowedMethodsTerms(selectors) {
     }
     return encodeAbiParameters([{ type: 'bytes4[]' }], [selectors]);
 }
+/** Exact-calldata pinning (CallDataHashEnforcer — ADR-0027 / spec 249 RW1-4b): terms =
+ *  abi.encode(bytes32 keccak256(callData)). Binds a (sub-)delegation to EXACTLY one call so a
+ *  registry checking `verifyAuthorizationForCall` authorizes only that precise payload — not
+ *  merely its target + selector. Pass the exact `execute(...)`/inner calldata the grant permits. */
+export function encodeCallDataHashTerms(callData) {
+    if (!/^0x([0-9a-fA-F]{2})*$/.test(callData)) {
+        throw new Error('encodeCallDataHashTerms: callData must be 0x-prefixed even-length hex');
+    }
+    return encodeAbiParameters([{ type: 'bytes32' }], [keccak256(callData)]);
+}
 // ─── Off-chain sentinel caveat builders ──────────────────────────────────
 export function buildMcpToolScopeCaveat(allowedTools) {
     if (allowedTools.length === 0)
@@ -74,6 +131,141 @@ export function buildDataScopeCaveat(grants) {
     ], [grants]);
     return { enforcer: DATA_SCOPE_ENFORCER, terms, args: '0x' };
 }
+const DATA_SCOPE_ABI = [
+    {
+        type: 'tuple[]',
+        components: [
+            { name: 'server', type: 'string' },
+            { name: 'resources', type: 'string[]' },
+            { name: 'fields', type: 'string[]' },
+        ],
+    },
+];
+/** Decode a `DATA_SCOPE` caveat's terms back to its grants. Used OFF-CHAIN by the resource server (the
+ *  vault/MCP runtime) to scope the field projection — the on-chain evaluator treats the sentinel as inert. */
+export function decodeDataScopeTerms(terms) {
+    const [grants] = decodeAbiParameters(DATA_SCOPE_ABI, terms);
+    return grants;
+}
+// VAULT_KEY_USE (spec 278 §3.2): the person SA authorizes a host to wield a KEK
+// for bounded resources/ops. ABI shape mirrors `VaultKeyUseGrant`; the KAS decodes
+// it (via `decodeVaultKeyUseTerms`) to check scope ⊇ request before releasing a key.
+const VAULT_KEY_USE_COMPONENTS = [
+    { name: 'vaultId', type: 'string' },
+    { name: 'kmsKeyRef', type: 'string' },
+    { name: 'resources', type: 'string[]' },
+    { name: 'classificationCeiling', type: 'string' },
+    { name: 'ops', type: 'string[]' },
+    { name: 'noSubdelegation', type: 'bool' },
+];
+const VAULT_KEY_USE_ABI = [{ type: 'tuple', components: VAULT_KEY_USE_COMPONENTS }];
+export function buildVaultKeyUseCaveat(grant) {
+    if (!grant.vaultId)
+        throw new Error('buildVaultKeyUseCaveat: vaultId required');
+    if (!grant.kmsKeyRef)
+        throw new Error('buildVaultKeyUseCaveat: kmsKeyRef required');
+    if (grant.resources.length === 0)
+        throw new Error('buildVaultKeyUseCaveat: at least one resource required');
+    if (grant.ops.length === 0)
+        throw new Error('buildVaultKeyUseCaveat: at least one op required');
+    if (!grant.classificationCeiling)
+        throw new Error('buildVaultKeyUseCaveat: classificationCeiling required');
+    if (grant.noSubdelegation !== true)
+        throw new Error('buildVaultKeyUseCaveat: noSubdelegation must be true (vault-key authorizations are non-subdelegable, spec 278 VKB-D5)');
+    const terms = encodeAbiParameters(VAULT_KEY_USE_ABI, [grant]);
+    return { enforcer: VAULT_KEY_USE_ENFORCER, terms, args: '0x' };
+}
+/** Decode a `VAULT_KEY_USE` caveat's terms back to its grant. Used by the KAS
+ *  (key-authorization, P2) to evaluate the authorization's scope against a request. */
+export function decodeVaultKeyUseTerms(terms) {
+    const [g] = decodeAbiParameters(VAULT_KEY_USE_ABI, terms);
+    return g;
+}
+// VAULT_RECORD_SCOPE (spec 317 §3.2): the delegator authorizes a delegate to perform bounded ops on
+// bounded vault resources at a named server. Enforced OFF-CHAIN by the resource server (demo-mcp),
+// intersected deny-by-default with the owner's vault-key binding. ABI mirrors `VaultRecordScopeGrant`.
+const VAULT_RECORD_SCOPE_COMPONENTS = [
+    { name: 'server', type: 'string' },
+    { name: 'resources', type: 'string[]' },
+    { name: 'ops', type: 'string[]' },
+];
+const VAULT_RECORD_SCOPE_ABI = [{ type: 'tuple[]', components: VAULT_RECORD_SCOPE_COMPONENTS }];
+const VAULT_RECORD_SCOPE_OPS = new Set(['read', 'write', 'delete']);
+export function buildVaultRecordScopeCaveat(grants) {
+    if (grants.length === 0)
+        throw new Error('buildVaultRecordScopeCaveat: at least one grant required');
+    for (const g of grants) {
+        if (!g.server)
+            throw new Error('buildVaultRecordScopeCaveat: grant.server required');
+        if (g.resources.length === 0)
+            throw new Error('buildVaultRecordScopeCaveat: at least one resource required');
+        for (const r of g.resources) {
+            // Namespace safety (spec 317 F3): resources are matched against the server's `vault:<recordType>`
+            // resource string, so they MUST be `vault:`-prefixed; a bare `*` is refused (no full-vault glob).
+            if (!r.startsWith('vault:'))
+                throw new Error(`buildVaultRecordScopeCaveat: resource "${r}" must be vault:-prefixed`);
+            if (r === 'vault:*' || r === 'vault:')
+                throw new Error(`buildVaultRecordScopeCaveat: resource "${r}" is too broad (whole-vault); scope to a record family`);
+        }
+        if (g.ops.length === 0)
+            throw new Error('buildVaultRecordScopeCaveat: at least one op required');
+        for (const op of g.ops) {
+            if (!VAULT_RECORD_SCOPE_OPS.has(op))
+                throw new Error(`buildVaultRecordScopeCaveat: unknown op "${op}" (expected read|write|delete)`);
+        }
+    }
+    const terms = encodeAbiParameters(VAULT_RECORD_SCOPE_ABI, [grants]);
+    return { enforcer: VAULT_RECORD_SCOPE_ENFORCER, terms, args: '0x' };
+}
+/** Decode a `VAULT_RECORD_SCOPE` caveat's terms back to its grants. Used OFF-CHAIN by the resource
+ *  server (demo-mcp vault runtime) to gate each vault op — the on-chain evaluator treats it as inert. */
+export function decodeVaultRecordScopeTerms(terms) {
+    const [grants] = decodeAbiParameters(VAULT_RECORD_SCOPE_ABI, terms);
+    return grants;
+}
+/**
+ * The CANONICAL off-chain enforcement decision for `VAULT_RECORD_SCOPE` grants (spec 317 §3.2). Every
+ * resource server MUST use this one matcher rather than re-implementing it — a divergent re-implementation
+ * is exactly where a widening bug creeps in (security-audit F3). Decision:
+ *   - `recordScopes` absent/empty ⇒ `true` (the delegation carried no record-scope caveat → this gate is
+ *     inert; the resource server's own per-owner authorization still applies — the two gates AND).
+ *   - present ⇒ authorized ONLY if some grant (a) names `req.server` exactly (a grant for another server
+ *     confers nothing here — F2), (b) whose `ops` include `req.op`, AND (c) whose `resources` cover
+ *     `req.resource` by an ANCHORED match: exact string, or a single trailing-`*` prefix (`a.slice(0,-1)`
+ *     is a `startsWith` prefix; a bare `*` is NOT honored). So `vault:message.body:*` matches
+ *     `vault:message.body:<id>` but NOT `vault:message.body-evil` — F3. Deny-by-default otherwise.
+ * `req.resource`/`req.op` MUST be the server-recovered values (never client-supplied), and the grants MUST
+ * be the POST-VERIFY grants (decoded only after the delegation signature verified — never raw caveats).
+ */
+export function vaultRecordScopeAllows(recordScopes, req) {
+    // `undefined` = the delegation carries NO record-scope caveat: this matcher is inert and the vault-key
+    // binding alone decides (spec 317 §3.2). An EMPTY LIST is different (R917-P-8, spec 408 §2.8): a scope
+    // caveat that names no resource is a grant of nothing, never of everything.
+    if (recordScopes === undefined)
+        return true;
+    if (recordScopes.length === 0)
+        return false;
+    for (const g of recordScopes) {
+        if (g.server !== req.server)
+            continue;
+        if (!g.ops.includes(req.op))
+            continue;
+        for (const a of g.resources) {
+            if (a === req.resource)
+                return true;
+            if (a.endsWith('*') && wildcardPrefixNamesARecordType(a.slice(0, -1)) && req.resource.startsWith(a.slice(0, -1)))
+                return true;
+        }
+    }
+    return false;
+}
+/** R917-P-8 (spec 408 §2.8): a trailing-`*` pattern is honoured only when its prefix names a record type —
+ *  `vault:message.body:*` and `vault:message.body*` do; `*`, `v*` and `vault:*` (a whole namespace) do not.
+ *  The prefix must have a non-empty namespace AND a non-empty type segment. */
+export function wildcardPrefixNamesARecordType(prefix) {
+    const seg = prefix.split(':');
+    return seg.length >= 2 && seg[0].length > 0 && seg[1].length > 0;
+}
 export function buildDelegateBindingCaveat(delegateSmartAccount, delegatePersonAgent) {
     const terms = encodeAbiParameters([{ type: 'address' }, { type: 'address' }], [delegateSmartAccount, delegatePersonAgent]);
     return { enforcer: DELEGATE_BINDING_ENFORCER, terms, args: '0x' };
@@ -113,4 +305,184 @@ export function buildQuorumCaveat(opts) {
     ], [opts.signers, opts.threshold, opts.approvedHashRegistry]);
     return { enforcer: opts.enforcer, terms, args: '0x' };
 }
+// ── Spec 272 (PAY-DEL-1) — x402 payment-mandate caveats ───────────────────────────────────────────
+/** The ONLY method an x402 payment delegation may invoke: `IERC20.transfer(address,uint256)`. */
+export const PAYMENT_TRANSFER_SELECTOR = '0xa9059cbb';
+/** Encode the immutable `PaymentEnforcer` terms. MUST match `PaymentEnforcer.sol` `abi.decode`
+ *  order/types: (treasury, asset, maxAmountPerCharge, maxAggregate, maxRedemptionsPerWindow,
+ *  windowSeconds) → 192 bytes. */
+export function encodePaymentTerms(opts) {
+    if (opts.maxAmountPerCharge <= 0n)
+        throw new Error('encodePaymentTerms: maxAmountPerCharge must be > 0');
+    if (opts.maxAggregate < opts.maxAmountPerCharge) {
+        throw new Error('encodePaymentTerms: maxAggregate must be >= maxAmountPerCharge');
+    }
+    if (!Number.isInteger(opts.maxRedemptionsPerWindow) || opts.maxRedemptionsPerWindow <= 0) {
+        throw new Error('encodePaymentTerms: maxRedemptionsPerWindow must be a positive integer');
+    }
+    if (!Number.isInteger(opts.windowSeconds) || opts.windowSeconds <= 0) {
+        throw new Error('encodePaymentTerms: windowSeconds must be a positive integer');
+    }
+    return encodeAbiParameters([
+        { type: 'address' },
+        { type: 'address' },
+        { type: 'uint256' },
+        { type: 'uint256' },
+        { type: 'uint32' },
+        { type: 'uint32' },
+    ], [
+        opts.payee,
+        opts.asset,
+        opts.maxAmountPerCharge,
+        opts.maxAggregate,
+        opts.maxRedemptionsPerWindow,
+        opts.windowSeconds,
+    ]);
+}
+/** The inverse — spec 358 W4's keyring selector reads WHICH payee a payment mandate binds, so a
+ *  fanned-out step can be judged under the mandate that names ITS payee. Reading terms is not verifying
+ *  them: the verifier still judges the selected mandate alone. */
+export function decodePaymentTerms(terms) {
+    const [payee, asset, maxAmountPerCharge, maxAggregate, maxRedemptionsPerWindow, windowSeconds] = decodeAbiParameters([{ type: 'address' }, { type: 'address' }, { type: 'uint256' }, { type: 'uint256' }, { type: 'uint256' }, { type: 'uint256' }], terms);
+    return { payee, asset, maxAmountPerCharge, maxAggregate, maxRedemptionsPerWindow: Number(maxRedemptionsPerWindow), windowSeconds: Number(windowSeconds) };
+}
+/**
+ * PAY-DEL-1 — the caveat set for an x402 PAYMENT delegation (delegator = reader, delegate = the
+ * paid service agent). Composes the stateful `PaymentEnforcer` (spend + windowed-frequency cap +
+ * transfer-only + single-use nonce) with `timestamp` (expiry), `allowedTargets` (USDC only), and
+ * `allowedMethods` (transfer only) so the on-chain enforcers and the off-chain mandate agree.
+ *
+ * Caveat `args` are left `'0x'` at mint; the rail executor fills the PaymentEnforcer caveat's `args`
+ * with `abi.encode(mandateId, nonce, resourceHash)` at REDEMPTION time (terms = mint, args = redeem).
+ * Resource/skill binding rides the mandate's `contextBinding`, not an on-chain caveat (PAY-WIRE-5).
+ */
+export function buildPaymentMandateCaveats(opts) {
+    return [
+        buildCaveat(opts.enforcers.payment, encodePaymentTerms(opts)),
+        buildCaveat(opts.enforcers.timestamp, encodeTimestampTerms(opts.validAfter ?? 0, opts.validUntil)),
+        buildCaveat(opts.enforcers.allowedTargets, encodeAllowedTargetsTerms([opts.asset])),
+        buildCaveat(opts.enforcers.allowedMethods, encodeAllowedMethodsTerms([PAYMENT_TRANSFER_SELECTOR])),
+    ];
+}
+export function describePaymentMandate(opts) {
+    return {
+        recipient: opts.payee,
+        asset: opts.asset,
+        maxAmountPerCharge: opts.maxAmountPerCharge,
+        sessionBudget: opts.maxAggregate,
+        maxRedemptionsPerWindow: opts.maxRedemptionsPerWindow,
+        windowSeconds: opts.windowSeconds,
+        expiresAt: opts.validUntil,
+        revocable: true,
+    };
+}
+/** The `kind` word in the terms — keccak256 of a short name, so a reader can tell bindings apart. */
+export const DIGEST_BINDING_KIND = {
+    intent: keccak256(new TextEncoder().encode('ap:intent')),
+    projection: keccak256(new TextEncoder().encode('ap:projection')),
+    offer: keccak256(new TextEncoder().encode('ap:offer')),
+    plan: keccak256(new TextEncoder().encode('ap:plan')),
+};
+/** Reverse map for decoders (lowercased kind hash → name). */
+export const DIGEST_KIND_NAMES = new Map(Object.entries(DIGEST_BINDING_KIND).map(([k, v]) => [v.toLowerCase(), k]));
+export function encodeDigestBindingTerms(kind, digest) {
+    if (!/^0x[0-9a-fA-F]{64}$/.test(digest))
+        throw new Error(`encodeDigestBindingTerms: ${kind} digest must be a bytes32 hex string`);
+    return encodeAbiParameters([{ type: 'bytes32' }, { type: 'bytes32' }], [DIGEST_BINDING_KIND[kind], digest]);
+}
+export function decodeDigestBindingTerms(terms) {
+    const [kindHash, digest] = decodeAbiParameters([{ type: 'bytes32' }, { type: 'bytes32' }], terms);
+    const kind = DIGEST_KIND_NAMES.get(kindHash.toLowerCase());
+    if (!kind)
+        throw new Error(`decodeDigestBindingTerms: unknown binding kind ${kindHash}`);
+    return { kind, digest };
+}
+export function encodeDigestBindingArgs(digest, scheme) {
+    // Generation 1 (an estate whose DigestBindingEnforcer predates spec 408) takes the presented digest alone —
+    // 32 bytes, no nonce, not single-use. A deployment fact the caller states; never inferred from a revert.
+    if (scheme.generation === 1)
+        return encodeAbiParameters([{ type: 'bytes32' }], [digest]);
+    if (!/^0x[0-9a-fA-F]{64}$/.test(scheme.stepNonce))
+        throw new Error('encodeDigestBindingArgs: stepNonce must be a bytes32 hex string');
+    return encodeAbiParameters([{ type: 'bytes32' }, { type: 'bytes32' }], [digest, scheme.stepNonce]);
+}
+/** THE ONE derivation of a step's redemption nonce: `keccak256("<intentDigest>:<operation>")` where `operation`
+ *  is the step's LOGICAL request identity — its declared idempotency key when the step carries one, else its
+ *  stable step ref (spec 410 §3). Two deliberately identical payments are two operations (distinct ids); one
+ *  payment retried after a lost response is one (the same id, the same nonce, consumed once on chain). The same
+ *  derivation `PaymentEnforcer`'s nonce uses, so a step's on-chain identity is one value everywhere. */
+export function digestBindingStepNonce(intentDigest, operation) {
+    return keccak256(new TextEncoder().encode(`${intentDigest}:${operation}`));
+}
+// ─── Spec 410 §7 — the information-flow caveat ──────────────────────────────────────────────────────
+/** terms = abi.encode(string[] classIris): what a write under this mandate MAY CARRY, as ontology classes. */
+export function encodePayloadClassesTerms(classIris) {
+    const list = [...new Set(classIris.map((c) => c.trim()).filter(Boolean))].sort();
+    if (!list.length)
+        throw new Error('encodePayloadClassesTerms: at least one class IRI');
+    for (const c of list)
+        if (!/^https?:\/\/\S+#\S+$|^[a-z][a-z0-9]*:[A-Za-z][\w-]*$/.test(c))
+            throw new Error(`encodePayloadClassesTerms: not an ontology class IRI or CURIE: ${c}`);
+    return encodeAbiParameters([{ type: 'string[]' }], [list]);
+}
+export function decodePayloadClassesTerms(terms) {
+    const [list] = decodeAbiParameters([{ type: 'string[]' }], terms);
+    return [...list];
+}
+export function buildPayloadClassesCaveat(enforcer, classIris) {
+    return buildCaveat(enforcer, encodePayloadClassesTerms(classIris));
+}
+/** One digest-binding caveat. Args are NOT pre-filled: they are the redeemer's per-step commitment
+ *  (`encodeDigestBindingArgs`), set at redemption — a pre-filled value would be one nonce for every step. */
+export function buildDigestBindingCaveat(enforcer, kind, digest) {
+    return buildCaveat(enforcer, encodeDigestBindingTerms(kind, digest));
+}
+/** Every digest binding a delegation carries, by kind. Empty ⇒ a standing capability, not a mandate. */
+export function readDigestBindings(caveats, enforcer) {
+    const out = {};
+    for (const c of caveats) {
+        if (c.enforcer.toLowerCase() !== enforcer.toLowerCase())
+            continue;
+        const { kind, digest } = decodeDigestBindingTerms(c.terms);
+        out[kind] = digest;
+    }
+    return out;
+}
+// ─── Spec 408 §2.1 — the session leaf's AUDIENCE ─────────────────────────────────────────────────
+//
+// A DEL-001 leaf says "the principal's SA vouches for this session key". Before this caveat it said
+// nothing about WHERE: any leaf a principal ever signed (a relying app's session, a runtime key's)
+// could present ANY delegation the principal ever signed, to anyone — narrow leaf + broad root = broad
+// (R917-P-2). The leaf now names the delegates it may present to, and the verifier refuses a
+// delegation whose delegate is not among them. terms = abi.encode(address[] delegates).
+export function encodeSessionAudienceTerms(delegates) {
+    if (!delegates.length)
+        throw new Error('encodeSessionAudienceTerms: a session leaf must name at least one delegate it may present to');
+    for (const d of delegates)
+        if (!/^0x[0-9a-fA-F]{40}$/.test(d))
+            throw new Error(`encodeSessionAudienceTerms: ${d} is not an address`);
+    // Lowercased: viem refuses a mixed-case address that is not its checksum form, and case is not identity.
+    return encodeAbiParameters([{ type: 'address[]' }], [delegates.map((d) => d.toLowerCase())]);
+}
+export function decodeSessionAudienceTerms(terms) {
+    const [out] = decodeAbiParameters([{ type: 'address[]' }], terms);
+    if (!out.length)
+        throw new Error('decodeSessionAudienceTerms: empty audience');
+    return [...out];
+}
+export function buildSessionAudienceCaveat(delegates) {
+    return buildCaveat(SESSION_AUDIENCE_ENFORCER, encodeSessionAudienceTerms(delegates));
+}
+/** The audience a leaf carries (lowercased), or null when it carries none — which the verifier refuses. */
+export function readSessionAudience(caveats) {
+    const c = caveats.find((x) => x.enforcer.toLowerCase() === SESSION_AUDIENCE_ENFORCER.toLowerCase());
+    if (!c)
+        return null;
+    try {
+        return decodeSessionAudienceTerms(c.terms).map((a) => a.toLowerCase());
+    }
+    catch {
+        return null;
+    }
+}
 //# sourceMappingURL=caveats.js.map

package/dist/caveats.js.map

@@ -1 +1 @@
-{"version":3,"file":"caveats.js","sourceRoot":"","sources":["../src/caveats.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,8BAA8B;AAE9B,OAAO,EAAE,mBAAmB,EAA0B,MAAM,MAAM,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGhD,4EAA4E;AAE5E,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1E,OAAO,GAAc,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAY,eAAe,CAAC,gCAAgC,CAAC,CAAC;AAClG,MAAM,CAAC,MAAM,mBAAmB,GAAY,eAAe,CAAC,4BAA4B,CAAC,CAAC;AAC1F,MAAM,CAAC,MAAM,yBAAyB,GAAY,eAAe,CAAC,kCAAkC,CAAC,CAAC;AAEtG,4EAA4E;AAE5E,MAAM,UAAU,WAAW,CAAC,QAAiB,EAAE,KAAU,EAAE,IAAU;IACnE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;AACjD,CAAC;AAED,4EAA4E;AAE5E,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,UAAkB;IACzE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,UAAU,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,mBAAmB,CACxB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAC1C,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CACzC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,QAAQ,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACtF,OAAO,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAkB;IAC1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IACrG,OAAO,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,SAAgB;IACxD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACzG,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,sCAAsC,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;IACD,OAAO,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,4EAA4E;AAE5E,MAAM,UAAU,uBAAuB,CAAC,YAAsB;IAC5D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACtG,MAAM,KAAK,GAAG,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAC1E,OAAO,EAAE,QAAQ,EAAE,uBAAuB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAwB;IAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC9F,MAAM,KAAK,GAAG,mBAAmB,CAC/B;QACE;YACE,IAAI,EAAE,SAAS;YACf,UAAU,EAAE;gBACV,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAClC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE;gBACvC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE;aACrC;SACF;KACF,EACD,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,oBAA6B,EAC7B,mBAA4B;IAE5B,MAAM,KAAK,GAAG,mBAAmB,CAC/B,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAC1C,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,CAC5C,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,yBAAyB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACpE,CAAC;AAgCD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAsB;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,CAAC,SAAS,8BAA8B,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CACpG,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,CAC/B;QACE,EAAE,IAAI,EAAE,WAAW,EAAE;QACrB,EAAE,IAAI,EAAE,OAAO,EAAE;QACjB,EAAE,IAAI,EAAE,SAAS,EAAE;KACpB,EACD,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAC1D,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxD,CAAC"}
+{"version":3,"file":"caveats.js","sourceRoot":"","sources":["../src/caveats.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,8BAA8B;AAE9B,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,SAAS,EAA0B,MAAM,MAAM,CAAC;AACnG,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAGnD,4EAA4E;AAE5E,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1E,OAAO,GAAc,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAY,eAAe,CAAC,gCAAgC,CAAC,CAAC;AAClG,MAAM,CAAC,MAAM,mBAAmB,GAAY,eAAe,CAAC,4BAA4B,CAAC,CAAC;AAC1F,MAAM,CAAC,MAAM,yBAAyB,GAAY,eAAe,CAAC,kCAAkC,CAAC,CAAC;AACtG;uFACuF;AACvF,MAAM,CAAC,MAAM,sBAAsB,GAAY,eAAe,CAAC,+BAA+B,CAAC,CAAC;AAChG;0GAC0G;AAC1G,MAAM,CAAC,MAAM,2BAA2B,GAAY,eAAe,CAAC,oCAAoC,CAAC,CAAC;AAC1G;;8FAE8F;AAC9F,MAAM,CAAC,MAAM,yBAAyB,GAAY,eAAe,CAAC,kCAAkC,CAAC,CAAC;AACtG;;;;iGAIiG;AACjG,MAAM,CAAC,MAAM,2BAA2B,GAAY,eAAe,CAAC,oCAAoC,CAAC,CAAC;AAY1G,MAAM,UAAU,4BAA4B,CAAC,CAAyB;IACpE,OAAO,mBAAmB,CACxB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EACvF,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,gBAAgB,CAAC,CACtE,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,4BAA4B,CAAC,KAAU;IACrD,MAAM,CAAC,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,gBAAgB,CAAC,GAAG,mBAAmB,CACvF,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EACvF,KAAK,CAC4D,CAAC;IACpE,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE,gBAAgB,EAAE,CAAC,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAC7J,CAAC;AACD,MAAM,UAAU,4BAA4B,CAAC,CAAyB;IACpE,OAAO,WAAW,CAAC,2BAA2B,EAAE,4BAA4B,CAAC,CAAC,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,4EAA4E;AAE5E,MAAM,UAAU,WAAW,CAAC,QAAiB,EAAE,KAAU,EAAE,IAAU;IACnE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;AACjD,CAAC;AAED,4EAA4E;AAE5E,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,UAAkB;IACzE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,UAAU,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,mBAAmB,CACxB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAC1C,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CACzC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAU;IAC7C,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IACxG,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAU;IAClD,MAAM,CAAC,OAAO,CAAC,GAAG,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IACtE,OAAO,OAA6B,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAU;IAClD,MAAM,CAAC,SAAS,CAAC,GAAG,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IACvE,OAAO,SAA2B,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,QAAQ,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACtF,OAAO,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAkB;IAC1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IACrG,OAAO,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,SAAgB;IACxD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACzG,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,sCAAsC,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;IACD,OAAO,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;oGAGoG;AACpG,MAAM,UAAU,uBAAuB,CAAC,QAAa;IACnD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,4EAA4E;AAE5E,MAAM,UAAU,uBAAuB,CAAC,YAAsB;IAC5D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACtG,MAAM,KAAK,GAAG,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAC1E,OAAO,EAAE,QAAQ,EAAE,uBAAuB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAwB;IAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC9F,MAAM,KAAK,GAAG,mBAAmB,CAC/B;QACE;YACE,IAAI,EAAE,SAAS;YACf,UAAU,EAAE;gBACV,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAClC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE;gBACvC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE;aACrC;SACF;KACF,EACD,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,cAAc,GAAG;IACrB;QACE,IAAI,EAAE,SAAS;QACf,UAAU,EAAE;YACV,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;YAClC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE;YACvC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE;SACrC;KACF;CACO,CAAC;AAEX;8GAC8G;AAC9G,MAAM,UAAU,oBAAoB,CAAC,KAAU;IAC7C,MAAM,CAAC,MAAM,CAAC,GAAG,mBAAmB,CAAC,cAAc,EAAE,KAAK,CAAgC,CAAC;IAC3F,OAAO,MAA0B,CAAC;AACpC,CAAC;AAED,gFAAgF;AAChF,mFAAmF;AACnF,qFAAqF;AACrF,MAAM,wBAAwB,GAAG;IAC/B,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE;IACrC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE;IACvC,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjD,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE;IACjC,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,EAAE;CACjC,CAAC;AACX,MAAM,iBAAiB,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,CAAU,CAAC;AAE7F,MAAM,UAAU,sBAAsB,CAAC,KAAuB;IAC5D,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAChF,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACpF,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5G,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAChG,IAAI,CAAC,KAAK,CAAC,qBAAqB;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5G,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,uHAAuH,CAAC,CAAC;IAC7K,MAAM,KAAK,GAAG,mBAAmB,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACjE,CAAC;AAED;uFACuF;AACvF,MAAM,UAAU,sBAAsB,CAAC,KAAU;IAC/C,MAAM,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC,iBAAiB,EAAE,KAAK,CAAgC,CAAC;IACzF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,oGAAoG;AACpG,mGAAmG;AACnG,uGAAuG;AACvG,MAAM,6BAA6B,GAAG;IACpC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE;IACvC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE;CACzB,CAAC;AACX,MAAM,sBAAsB,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,6BAA6B,EAAE,CAAU,CAAC;AAEzG,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEpE,MAAM,UAAU,2BAA2B,CAAC,MAA+B;IACzE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACrG,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACrF,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QAC7G,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;YAC5B,kGAAkG;YAClG,kGAAkG;YAClG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,2BAA2B,CAAC,CAAC;YACrH,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,wDAAwD,CAAC,CAAC;QAC9J,CAAC;QACD,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACjG,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,EAAE,gCAAgC,CAAC,CAAC;QACvI,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,sBAAsB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACpE,OAAO,EAAE,QAAQ,EAAE,2BAA2B,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACtE,CAAC;AAED;yGACyG;AACzG,MAAM,UAAU,2BAA2B,CAAC,KAAU;IACpD,MAAM,CAAC,MAAM,CAAC,GAAG,mBAAmB,CAAC,sBAAsB,EAAE,KAAK,CAAuC,CAAC;IAC1G,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CACpC,YAAiD,EACjD,GAA0E;IAE1E,uGAAuG;IACvG,uGAAuG;IACvG,4EAA4E;IAC5E,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;YAAE,SAAS;QACtC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QACtC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,GAAG,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACpC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,8BAA8B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAChI,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;+EAE+E;AAC/E,MAAM,UAAU,8BAA8B,CAAC,MAAc;IAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAE,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,oBAA6B,EAC7B,mBAA4B;IAE5B,MAAM,KAAK,GAAG,mBAAmB,CAC/B,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAC1C,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,CAC5C,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,yBAAyB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACpE,CAAC;AAgCD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAsB;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,CAAC,SAAS,8BAA8B,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CACpG,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,CAC/B;QACE,EAAE,IAAI,EAAE,WAAW,EAAE;QACrB,EAAE,IAAI,EAAE,OAAO,EAAE;QACjB,EAAE,IAAI,EAAE,SAAS,EAAE;KACpB,EACD,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAC1D,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxD,CAAC;AAED,qGAAqG;AAErG,iGAAiG;AACjG,MAAM,CAAC,MAAM,yBAAyB,GAAQ,YAAY,CAAC;AAmB3D;;kCAEkC;AAClC,MAAM,UAAU,kBAAkB,CAAC,IAOlC;IACC,IAAI,IAAI,CAAC,kBAAkB,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACzG,IAAI,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC,uBAAuB,IAAI,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,mBAAmB,CACxB;QACE,EAAE,IAAI,EAAE,SAAS,EAAE;QACnB,EAAE,IAAI,EAAE,SAAS,EAAE;QACnB,EAAE,IAAI,EAAE,SAAS,EAAE;QACnB,EAAE,IAAI,EAAE,SAAS,EAAE;QACnB,EAAE,IAAI,EAAE,QAAQ,EAAE;QAClB,EAAE,IAAI,EAAE,QAAQ,EAAE;KACnB,EACD;QACE,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,kBAAkB;QACvB,IAAI,CAAC,YAAY;QACjB,IAAI,CAAC,uBAAuB;QAC5B,IAAI,CAAC,aAAa;KACnB,CACF,CAAC;AACJ,CAAC;AAED;;kEAEkE;AAClE,MAAM,UAAU,kBAAkB,CAAC,KAAU;IAI3C,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,uBAAuB,EAAE,aAAa,CAAC,GAAG,mBAAmB,CAClH,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAC9H,KAAK,CACgD,CAAC;IACxD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,CAAC,uBAAuB,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;AAC5J,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAA8B;IACvE,OAAO;QACL,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC7D,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAClG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACnF,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC;KACnG,CAAC;AACJ,CAAC;AAgBD,MAAM,UAAU,sBAAsB,CAAC,IAA8B;IACnE,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,KAAK;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,aAAa,EAAE,IAAI,CAAC,YAAY;QAChC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC;AAeD,qGAAqG;AACrG,MAAM,CAAC,MAAM,mBAAmB,GAAmC;IACjE,MAAM,EAAE,SAAS,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACxD,UAAU,EAAE,SAAS,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAChE,KAAK,EAAE,SAAS,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,EAAE,SAAS,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;CACrD,CAAC;AACF,8DAA8D;AAC9D,MAAM,CAAC,MAAM,iBAAiB,GAA2C,IAAI,GAAG,CAC7E,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAqC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAC/G,CAAC;AAEF,MAAM,UAAU,wBAAwB,CAAC,IAAuB,EAAE,MAAW;IAC3E,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,sCAAsC,CAAC,CAAC;IAClI,OAAO,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAC9G,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAU;IACjD,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,CAAe,CAAC;IAChH,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,QAAQ,EAAE,CAAC,CAAC;IACzF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAQD,MAAM,UAAU,uBAAuB,CAAC,MAAW,EAAE,MAA+B;IAClF,4GAA4G;IAC5G,yGAAyG;IACzG,IAAI,MAAM,CAAC,UAAU,KAAK,CAAC;QAAE,OAAO,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACzF,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACtI,OAAO,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;AACrG,CAAC;AAED;;;;wGAIwG;AACxG,MAAM,UAAU,sBAAsB,CAAC,YAAiB,EAAE,SAAiB;IACzE,OAAO,SAAS,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,YAAY,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,uGAAuG;AAEvG,8GAA8G;AAC9G,MAAM,UAAU,yBAAyB,CAAC,SAA4B;IACpE,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjF,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvF,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,IAAI,CAAC,sDAAsD,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,EAAE,CAAC,CAAC;IAClL,OAAO,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7D,CAAC;AACD,MAAM,UAAU,yBAAyB,CAAC,KAAU;IAClD,MAAM,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,CAAwB,CAAC;IACzF,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AACD,MAAM,UAAU,yBAAyB,CAAC,QAAiB,EAAE,SAA4B;IACvF,OAAO,WAAW,CAAC,QAAQ,EAAE,yBAAyB,CAAC,SAAS,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;6GAC6G;AAC7G,MAAM,UAAU,wBAAwB,CAAC,QAAiB,EAAE,IAAuB,EAAE,MAAW;IAC9F,OAAO,WAAW,CAAC,QAAQ,EAAE,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,kBAAkB,CAAC,OAA0B,EAAE,QAAiB;IAC9E,MAAM,GAAG,GAA4C,EAAE,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE;YAAE,SAAS;QAClE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,wBAAwB,CAAC,CAAC,CAAC,KAAY,CAAC,CAAC;QAClE,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oGAAoG;AACpG,EAAE;AACF,oGAAoG;AACpG,mGAAmG;AACnG,uGAAuG;AACvG,6FAA6F;AAC7F,wFAAwF;AAExF,MAAM,UAAU,0BAA0B,CAAC,SAA6B;IACtE,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;IACvI,KAAK,MAAM,CAAC,IAAI,SAAS;QAAE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,oBAAoB,CAAC,CAAC;IACrI,yGAAyG;IACzG,OAAO,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAa,CAAC,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAU;IACnD,MAAM,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,KAAK,CAAyB,CAAC;IAC1F,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,SAA6B;IACtE,OAAO,WAAW,CAAC,yBAAyB,EAAE,0BAA0B,CAAC,SAAS,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,mBAAmB,CAAC,OAA0B;IAC5D,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,yBAAyB,CAAC,WAAW,EAAE,CAAC,CAAC;IACpG,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC;QAAC,OAAO,0BAA0B,CAAC,CAAC,CAAC,KAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC/G,CAAC"}

package/dist/client.d.ts

@@ -1,5 +1,5 @@
 import type { Address, Hex } from '@agenticprimitives/types';
-import type { Caveat, Delegation, DelegationClientOpts } from './types';
+import type { Caveat, Delegation, DelegationClientOpts } from './types.js';
 export declare class DelegationClient {
     private readonly opts;
     constructor(opts: DelegationClientOpts);

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAaxE,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAuB;gBAChC,IAAI,EAAE,oBAAoB;IAItC;;;;OAIG;IACG,eAAe,CAAC,MAAM,EAAE;QAC5B,QAAQ,EAAE,OAAO,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,GAAG,CAAC;KACjB,GAAG,OAAO,CAAC,UAAU,CAAC;CA6BxB"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAa3E,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAuB;gBAChC,IAAI,EAAE,oBAAoB;IAItC;;;;OAIG;IACG,eAAe,CAAC,MAAM,EAAE;QAC5B,QAAQ,EAAE,OAAO,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,GAAG,CAAC;KACjB,GAAG,OAAO,CAAC,UAAU,CAAC;CA6BxB"}

package/dist/client.js

@@ -5,8 +5,8 @@
 // resulting signature, paired with the Delegation struct, becomes a
 // fully-formed Delegation that the DelegationManager + ERC-1271 path on
 // the smart account can validate.
-import { ROOT_AUTHORITY } from './types';
-import { DELEGATION_EIP712_TYPES, delegationDomain } from './hash';
+import { ROOT_AUTHORITY } from './types.js';
+import { DELEGATION_EIP712_TYPES, delegationDomain } from './hash.js';
 function randomSalt() {
     const buf = new Uint8Array(32);
     // 32-byte random; high bit cleared to keep BigInt sign-safe (uint256 still has full range).

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,oEAAoE;AACpE,wEAAwE;AACxE,kCAAkC;AAIlC,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAEnE,SAAS,UAAU;IACjB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,4FAA4F;IAC5F,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,GAAG;QAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,OAAO,gBAAgB;IACV,IAAI,CAAuB;IAC5C,YAAY,IAA0B;QACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,MAKrB;QACC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,cAAc,CAAC;QACrD,MAAM,UAAU,GAAkC;YAChD,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;YACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS;YACT,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI;SACL,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YACrD,MAAM,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC;YACxE,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,YAAY;YACzB,OAAO,EAAE;gBACP,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACtC,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,KAAK,EAAE,CAAC,CAAC,KAAK;iBACf,CAAC,CAAC;gBACH,IAAI,EAAE,UAAU,CAAC,IAAI;aACtB;SACF,CAAC,CAAC;QAEH,OAAO,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,CAAC;IACtC,CAAC;CACF"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,oEAAoE;AACpE,wEAAwE;AACxE,kCAAkC;AAIlC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAEtE,SAAS,UAAU;IACjB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,4FAA4F;IAC5F,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,GAAG;QAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,OAAO,gBAAgB;IACV,IAAI,CAAuB;IAC5C,YAAY,IAA0B;QACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,MAKrB;QACC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,cAAc,CAAC;QACrD,MAAM,UAAU,GAAkC;YAChD,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;YACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS;YACT,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI;SACL,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YACrD,MAAM,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC;YACxE,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,YAAY;YACzB,OAAO,EAAE;gBACP,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACtC,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,KAAK,EAAE,CAAC,CAAC,KAAK;iBACf,CAAC,CAAC;gBACH,IAAI,EAAE,UAAU,CAAC,IAAI;aACtB;SACF,CAAC,CAAC;QAEH,OAAO,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,CAAC;IACtC,CAAC;CACF"}

package/dist/es256-evidence-minter.d.ts

@@ -0,0 +1,28 @@
+export interface Es256EvidenceMinterInput {
+    /** The attestation key's P-256 private scalar (32 bytes, hex). */
+    privateKeyHex: string;
+    /** `iss`, as the key service pins it. */
+    issuer: string;
+    /** `aud`, as the key service pins it. */
+    audience: string;
+    /** Statement lifetime; the key service checks `exp`. Default 120 s. */
+    ttlSeconds?: number;
+    /** Clock skew the statement tolerates backwards (`nbf`/`iat` = now − skew); the pilot CVM's clock lags. Default 120 s. */
+    skewSeconds?: number;
+    now?: () => number;
+    randomId?: () => string;
+}
+export interface Es256EvidenceMinter {
+    readonly kid: string;
+    publicJwk(): {
+        kty: 'EC';
+        crv: 'P-256';
+        x: string;
+        y: string;
+        kid: string;
+    };
+    /** A signed statement for `subject` carrying `claims` beside iss/aud/sub/iat/nbf/exp/jti. */
+    mint(subject: string, claims: Record<string, string | number | boolean>): Promise<string>;
+}
+export declare function createEs256EvidenceMinter(input: Es256EvidenceMinterInput): Es256EvidenceMinter;
+//# sourceMappingURL=es256-evidence-minter.d.ts.map

package/dist/es256-evidence-minter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"es256-evidence-minter.d.ts","sourceRoot":"","sources":["../src/es256-evidence-minter.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,wBAAwB;IACvC,kEAAkE;IAClE,aAAa,EAAE,MAAM,CAAC;IACtB,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0HAA0H;IAC1H,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,SAAS,IAAI;QAAE,GAAG,EAAE,IAAI,CAAC;QAAC,GAAG,EAAE,OAAO,CAAC;QAAC,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5E,6FAA6F;IAC7F,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3F;AASD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,wBAAwB,GAAG,mBAAmB,CAuB9F"}

package/dist/es256-evidence-minter.js

@@ -0,0 +1,48 @@
+// THE RELEASE'S OWN ATTESTATION KEY — the ES256 key a runtime signs its bound-evidence statements with (faithkms ADR-0012 /
+// zkID alignment Z6). It lives beside `createPresentationRelease` because the statement IS the release's: what it judged. A key service's P-256 device key signs only under a statement naming the digest, the venue and the
+// predicate digest the presentation release judged; this is the minter of that statement, as a compact JWS (RFC 7515)
+// with JWT claims (RFC 7519): `iss` / `aud` pinned by the key service's `[authority_evidence]` section, `sub` = the actor
+// the release acted for, `jti` fresh, a short window, and the caller's claims beside them.
+//
+// NOT a device key and NOT a person's key: it is a secret the runtime holds the way it holds its relay key, so it carries
+// no local-provider production guard — the guard is the key service's: it verifies the statement against the JWKS the
+// operator pinned, and refuses any other issuer. `kid` = RFC 7638 thumbprint, published beside the public JWK.
+import { p256 } from '@noble/curves/nist.js';
+import { hexToBytes } from 'viem';
+import { p256JwkThumbprint } from '@agenticprimitives/key-custody';
+const b64url = (b) => {
+    const bytes = typeof b === 'string' ? new TextEncoder().encode(b) : b;
+    let s = '';
+    for (let i = 0; i < bytes.length; i++)
+        s += String.fromCharCode(bytes[i]);
+    return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+};
+export function createEs256EvidenceMinter(input) {
+    const hex = input.privateKeyHex.startsWith('0x') ? input.privateKeyHex : `0x${input.privateKeyHex}`;
+    const priv = hexToBytes(hex);
+    if (priv.length !== 32)
+        throw new Error(`[es256-evidence] a P-256 private key is 32 bytes; got ${priv.length}`);
+    if (!input.issuer || !input.audience)
+        throw new Error('[es256-evidence] issuer and audience are pinned by the key service and must be named');
+    const pub = p256.getPublicKey(priv, false);
+    const x = b64url(pub.slice(1, 33)), y = b64url(pub.slice(33, 65));
+    const kid = p256JwkThumbprint({ x, y });
+    const now = input.now ?? (() => Math.floor(Date.now() / 1000));
+    const randomId = input.randomId ?? (() => crypto.randomUUID());
+    const ttl = input.ttlSeconds ?? 120, skew = input.skewSeconds ?? 120;
+    const header = b64url(JSON.stringify({ alg: 'ES256', typ: 'JWT', kid }));
+    return {
+        kid,
+        publicJwk: () => ({ kty: 'EC', crv: 'P-256', x, y, kid }),
+        async mint(subject, claims) {
+            for (const k of ['iss', 'aud', 'sub', 'iat', 'nbf', 'exp', 'jti'])
+                if (k in claims)
+                    throw new Error(`[es256-evidence] ${k} is the minter's, not the caller's`);
+            const t = now();
+            const body = b64url(JSON.stringify({ iss: input.issuer, aud: input.audience, sub: subject, iat: t - skew, nbf: t - skew, exp: t + ttl, jti: randomId(), ...claims }));
+            const sig = p256.sign(new TextEncoder().encode(`${header}.${body}`), priv, { prehash: true, lowS: true });
+            return `${header}.${body}.${b64url(sig)}`;
+        },
+    };
+}
+//# sourceMappingURL=es256-evidence-minter.js.map

package/dist/es256-evidence-minter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"es256-evidence-minter.js","sourceRoot":"","sources":["../src/es256-evidence-minter.ts"],"names":[],"mappings":"AAAA,4HAA4H;AAC5H,6NAA6N;AAC7N,sHAAsH;AACtH,0HAA0H;AAC1H,2FAA2F;AAC3F,EAAE;AACF,0HAA0H;AAC1H,sHAAsH;AACtH,+GAA+G;AAC/G,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAwBnE,MAAM,MAAM,GAAG,CAAC,CAAsB,EAAU,EAAE;IAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC,CAAC;AAEF,MAAM,UAAU,yBAAyB,CAAC,KAA+B;IACvE,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;IACpG,MAAM,IAAI,GAAG,UAAU,CAAC,GAAoB,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAChH,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;IAC9I,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE,IAAI,GAAG,KAAK,CAAC,WAAW,IAAI,GAAG,CAAC;IACrE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACzE,OAAO;QACL,GAAG;QACH,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM;YACxB,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;gBAAE,IAAI,CAAC,IAAI,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,oCAAoC,CAAC,CAAC;YAC/J,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;YACtK,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1G,OAAO,GAAG,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/evaluator.d.ts

@@ -1,4 +1,4 @@
-import type { Caveat, CaveatContext, CaveatVerdict, EnforcerAddressMap, EvaluateOpts } from './types';
+import type { Caveat, CaveatContext, CaveatVerdict, EnforcerAddressMap, EvaluateOpts } from './types.js';
 /**
  * Evaluate every caveat in the array. Returns one verdict per caveat,
  * in input order. Caller decides what to do on the first deny.

package/dist/evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../src/evaluator.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EACV,MAAM,EACN,aAAa,EACb,aAAa,EACb,kBAAkB,EAClB,YAAY,EACb,MAAM,SAAS,CAAC;AAgJjB;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EAAE,EACjB,GAAG,EAAE,aAAa,EAClB,WAAW,EAAE,kBAAkB,EAC/B,IAAI,GAAE,YAAiB,GACtB,aAAa,EAAE,CA2BjB"}
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../src/evaluator.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EACV,MAAM,EACN,aAAa,EACb,aAAa,EACb,kBAAkB,EAClB,YAAY,EACb,MAAM,YAAY,CAAC;AA8MpB;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EAAE,EACjB,GAAG,EAAE,aAAa,EAClB,WAAW,EAAE,kBAAkB,EAC/B,IAAI,GAAE,YAAiB,GACtB,aAAa,EAAE,CAwDjB"}