@agenticprimitives/delegation 1.0.0-alpha.4 → 1.0.0-alpha.41

package/dist/mandate-handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mandate-handlers.js","sourceRoot":"","sources":["../src/mandate-handlers.ts"],"names":[],"mappings":"AAAA,wGAAwG;AACxG,8FAA8F;AAC9F,+FAA+F;AAC/F,qGAAqG;AACrG,4BAA4B;AAC5B,OAAO,EAAE,mBAAmB,EAAY,MAAM,MAAM,CAAC;AAErD,OAAO,EACL,WAAW,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,yBAAyB,EAC7G,yBAAyB,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,yBAAyB,EAC3K,2BAA2B,EAAE,4BAA4B,EAAE,4BAA4B,GACxF,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAgF,MAAM,cAAc,CAAC;AAEjJ,MAAM,EAAE,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAC1C,MAAM,UAAU,GAAG,CAAC,OAA0B,EAAE,QAA6B,EAAE,EAAE,CAC/E,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAE9E,sGAAsG;AACtG,EAAE;AACF,sGAAsG;AACtG,0GAA0G;AAC1G,8FAA8F;AAE9F,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAE3D,MAAM,CAAC,MAAM,iBAAiB,GAAyB;IACrD,IAAI,EAAE,mBAAmB;IACzB,QAAQ,EAAE,YAAY;IACtB,SAAS,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QAChH,MAAM,OAAO,GAAa;YACxB,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,oBAAoB,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;YACnF,8FAA8F;YAC9F,8FAA8F;YAC9F,sEAAsE;YACtE,WAAW,CAAC,CAAC,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACtH,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC;SAC3C,CAAC;QACF,IAAI,GAAG,CAAC,SAAS,EAAE,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,EAAE,yBAAyB,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAChI,wFAAwF;QACxF,IAAI,GAAG,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;YAC/B,IAAI,CAAC,CAAC,CAAC,cAAc;gBAAE,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;YACjI,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC,cAAc,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,WAAW,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,OAAO,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,oBAAoB,CAAC,EAAE,CAAC,KAAY,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,yBAAyB,CAAC,OAAO,CAAC,KAAY,CAAC,CAAC;QAClE,kGAAkG;QAClG,+FAA+F;QAC/F,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC;QACtD,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,yBAAyB,CAAC,OAAO,CAAC,KAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,yBAAyB,CAAC,OAAO,CAAC,KAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;YAC9B,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;SAC/B,CAAC;IACJ,CAAC;CACF,CAAC;AAEF;mGACmG;AACnG,iBAAiB,CAAC,WAAW,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAE5D;yFACyF;AACzF,iBAAiB,CAAC,QAAQ,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;IAC7C,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAChH,OAAO,YAAY,CACjB,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAC9C,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACjD,CAAC;AACJ,CAAC,CAAC;AAEF,sGAAsG;AACtG,EAAE;AACF,iGAAiG;AACjG,mGAAmG;AACnG,yFAAyF;AAEzF,MAAM,CAAC,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAItE,SAAS,aAAa,CAAC,GAAyB;IAC9C,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5J,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/F,uBAAuB,EAAE,MAAM,CAAC,CAAC,CAAC,uBAAuB,IAAI,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,IAAI,MAAM,CAAC;KAClH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAyB;IAClD,4GAA4G;IAC5G,8FAA8F;IAC9F,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,IAAI,EAAE,gBAAgB;IACtB,sGAAsG;IACtG,sGAAsG;IACtG,kGAAkG;IAClG,6DAA6D;IAC7D,UAAU,CAAC,IAAI;QACb,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QACpI,mGAAmG;QACnG,8FAA8F;QAC9F,oGAAoG;QACpG,qEAAqE;QACrE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,wFAAwF,MAAM,GAAG,CAAC,CAAC;QACrH,CAAC;QACD,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;YAC3E,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,EAAE,aAAa,EAAE,IAAI;SACzF,CAAC;IACJ,CAAC;IACD,QAAQ,CAAC,KAAK,EAAE,MAAM;QACpB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,mGAAmG;QACnG,2FAA2F;QAC3F,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtI,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,GAAG,CAAC,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC1D,IAAI,EAAE,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,YAAY;YAAE,OAAO,KAAK,CAAC;QACpG,IAAI,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACjF,IAAI,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACjF,IAAI,EAAE,CAAC,uBAAuB,KAAK,SAAS,IAAI,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,uBAAuB;YAAE,OAAO,KAAK,CAAC;QAC7H,OAAO,IAAI,CAAC;IACd,CAAC;IACD,SAAS,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACpG,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO;YACL,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,uBAAuB,EAAE,CAAC,CAAC,uBAAuB,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;YACjO,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,oBAAoB,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;YACnF,WAAW,CAAC,CAAC,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACnE,WAAW,CAAC,CAAC,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,yBAAyB,EAAE,cAAc,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC;SAClI,CAAC;IACJ,CAAC;IACD,WAAW,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC7B,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,GAAG,mBAAmB,CAC3F,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAC5H,GAAG,CAAC,KAAY,CACqC,CAAC;QACxD,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,oBAAoB,CAAC,EAAE,CAAC,KAAY,CAAC,CAAC;QACzE,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,CAAC,SAAS,CAAC;YACpB,SAAS,EAAE,CAAC,KAAK,CAAC;YAClB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE,EAAE,uBAAuB,EAAE,SAAS,EAAE,aAAa,EAAE;YACnJ,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;SAC/D,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,SAAS,SAAS,CAAC,CAAS;IAC1B,MAAM,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAG,2DAA2D;IACrG,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,EAAE,CAAC,CAAC;IACnE,OAAO,CAAC,CAAC,CAAC,CAAY,CAAC;AACzB,CAAC;AAED,+GAA+G;AAC/G,EAAE;AACF,6GAA6G;AAC7G,oGAAoG;AACpG,+GAA+G;AAC/G,gHAAgH;AAChH,iHAAiH;AACjH,iHAAiH;AACjH,EAAE;AACF,4GAA4G;AAC5G,8GAA8G;AAC9G,gHAAgH;AAEhH,MAAM,CAAC,MAAM,qBAAqB,GAAG,+BAA+B,CAAC;AACrE,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAI5D,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,IAAY,EAAY,EAAE;IAClD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAY,CAAC;YAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC;IAC1K,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,iBAAiB,CAAC,CAAC;AACzE,CAAC,CAAC;AAEF,SAAS,kBAAkB,CAAC,GAAyB;IACnD,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,EAAE,CAAC;IAC7R,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oGAAoG,CAAC,CAAC;IAC7M,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,gBAAgB;QAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,8BAA8B,CAAC,CAAC;IACjK,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAyB;IACvD,IAAI,EAAE,qBAAqB;IAC3B,+GAA+G;IAC/G,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC,2BAA2B,CAAC;IACpD,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC;IAC9B,UAAU,CAAC,IAAI;QACb,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,EAAE,aAAa,CAAU,EAAE,CAAC;YACxE,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,8CAA8C,CAAC,CAAC;QACrI,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,gBAAgB,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;IACtJ,CAAC;IACD,QAAQ,CAAC,KAAK,EAAE,MAAM;QACpB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,QAAQ,IAAI,EAAE,EAAE,WAAW,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE,CAAC,gBAAgB,IAAI,EAAE,CAAC,eAAe,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,YAAY,IAAI,EAAE,CAAC,WAAW,IAAI,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC;QACnQ,6GAA6G;QAC7G,wGAAwG;QACxG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACxE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACtF,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9E,IAAI,EAAE,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,CAAC,gBAAgB,KAAK,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,gBAAgB;YAAE,OAAO,KAAK,CAAC;QACpI,OAAO,IAAI,CAAC;IACd,CAAC;IACD,SAAS,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO;YACL,4BAA4B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAyB,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC;YAC3K,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,oBAAoB,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;YACnF,WAAW,CAAC,CAAC,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,cAAc,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;YACnG,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC;SAC3C,CAAC;IACJ,CAAC;IACD,WAAW,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,CAAC,GAAG,4BAA4B,CAAC,KAAK,CAAC,KAAY,CAAC,CAAC;QAC3D,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,oBAAoB,CAAC,EAAE,CAAC,KAAY,CAAC,CAAC;QACzE,OAAO;YACL,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,CAAC,SAAS,CAAC;YACpB,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE;YAC5L,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;SAC/D,CAAC;IACJ,CAAC;CACF,CAAC;AAEF;2FAC2F;AAC3F,MAAM,CAAC,MAAM,uBAAuB,GAA8C,IAAI,GAAG,CAAC;IACxF,CAAC,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAC3C,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC;IACrC,CAAC,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,CAAC;CAChD,CAAC,CAAC;AAEH,iGAAiG;AACjG,IAAI,UAAU,GAAG,KAAK,CAAC;AACvB,MAAM,UAAU,6BAA6B;IAC3C,IAAI,UAAU;QAAE,OAAO;IACvB,qBAAqB,CAAC,iBAAiB,CAAC,CAAC;IACzC,qBAAqB,CAAC,cAAc,CAAC,CAAC;IACtC,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;IAC3C,UAAU,GAAG,IAAI,CAAC;AACpB,CAAC;AACD,qDAAqD;AACrD,MAAM,UAAU,yBAAyB,KAAW,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC"}

package/dist/mandate.d.ts

@@ -0,0 +1,265 @@
+import { type Hex } from 'viem';
+import type { Address, Caveat, Delegation, EnforcerAddressMap } from './types.js';
+import { type MethodAuthorizationChecks } from './method-authorization.js';
+import { type DigestBindingKind } from './caveats.js';
+import { ROOT_AUTHORITY } from './types.js';
+/**
+ * What authority a step NEEDS, in RFC 9396 `authorization_details` shape. A proposal: it grants nothing.
+ * `type` is collision-resistant and owns its own subset semantics via a registered handler.
+ */
+export interface MandateRequirementV1 {
+    /** e.g. `urn:ap:rar:treasury.payment.execute`. Chooses the subset handler. */
+    type: string;
+    /** Capability-level actions, e.g. `['execute']`, `['add','remove']`. */
+    actions: string[];
+    /** Resources, as URNs / CAIP-10 — the treasury, the org, the team. */
+    locations?: string[];
+    /** Type-specific ceilings: `{ maxAmount: '500', currency: 'USDC' }`. Interpreted by the handler. */
+    limits?: Record<string, string | number>;
+    /** THE REASON. Digest of the canonical intent (§ intentDigest). Required — without it this is a capability. */
+    intentDigest: Hex;
+    /** What was disclosed to the grantee (spec 336 §4), when the mandate followed a projection. */
+    projectionDigest?: Hex;
+    /** The accepted offer (spec 336 §5), when the mandate followed an engagement. */
+    offerDigest?: Hex;
+    /** Spec 408 §2.3 — THE ADMITTED PLAN (`orchestration.planDigest`): the steps as written, tool ids and
+     *  arguments with `$ref`s unresolved. Bound so a session holder cannot present a signed mandate for the
+     *  same goal with a different plan, and so every step's arguments are a function of the plan the person
+     *  saw and the results before it. Set whenever a requirement is raised from a parked run. */
+    planDigest?: Hex;
+    /** Spec 410 §7 — the information-flow caveat: what a write under this mandate may carry, as ontology classes.
+     *  Raised from the tool contract's `carries` over the arguments the step presents; pinned into the signed wire. */
+    payloadClasses?: string[];
+    /** Unix seconds. */
+    validAfter?: number;
+    validUntil: number;
+    /**
+     * THE ON-CHAIN CALLS THIS AUTHORITY MAKES — real 4-byte EVM selectors, when the capability is exercised
+     * by redeeming this mandate against a contract.
+     *
+     * `actions` are CAPABILITY ids, and `methodSelector` turns each into a synthetic selector the OFF-CHAIN
+     * verifier compares. The `AllowedMethodsEnforcer` sees the actual transaction, so a mandate carrying
+     * only capability selectors reverts every real call with `MethodNotAllowed` — which is exactly what
+     * happened to `treasury.fund` through the Ask: the mandate verified, the person signed, and the chain
+     * refused a call the caveat had never been told to expect.
+     *
+     * WHO SAYS WHICH SELECTORS: the app that owns the call, never a planner and never the person — the
+     * bytes are a deployment fact. Listing them NARROWS nothing on its own (`allowedTargets` still bounds
+     * WHERE) but it is what makes the authority honest about WHAT it does, and the card can name it.
+     */
+    methods?: Hex[];
+}
+/** RFC 8785 JCS → keccak256. The ONE way an intent digest is computed, so grantor, verifier and receipt
+ *  cannot disagree about which bytes were bound. */
+export declare function intentDigest(intent: unknown): Hex;
+/** The versions an intent was approved under. `ontologyManifestDigest` = `ONTOLOGY_MANIFEST_DIGEST` from
+ *  `@agenticprimitives/ontology` (the T-box manifest, spec 410 §5); `semanticsDigest` = the `definitionDigest`
+ *  of the compiled `AgentHarnessDefinitionV1` the act runs under (spec 354), which pins every tool contract
+ *  and adapter declaration — or `NO_SEMANTICS_DIGEST` for the bare harness, which has no compiled definition. */
+export interface VersionBindingV1 {
+    ontologyManifestDigest: Hex;
+    semanticsDigest: Hex;
+    /** Spec 410 §10 — the LOCAL MEANINGS the acting organization declared for common terms this intent uses
+     *  (`ontology.meaningRef`: `meaning:<org>:<termIri>`), so a third party reading the receipt sees which meaning the
+     *  grant used. Stated by the intent, bound by the digest; a verifier never substitutes them. */
+    meaningRefs?: string[];
+}
+/** The bare harness: no compiled definition to bind. Stated, never omitted, so the preimage shape is one. */
+export declare const NO_SEMANTICS_DIGEST: Hex;
+/** The intent with its versions folded in — what a Home mints a mandate over and what a verifier recomputes. */
+export declare function withVersions<T extends object>(intent: T, versions: VersionBindingV1): T & {
+    versions: VersionBindingV1;
+};
+/** The versions an intent states, or null when it states none (a pre-spec-410 intent). */
+export declare function versionsOf(intent: unknown): VersionBindingV1 | null;
+/** The enforcer addresses a handler may encode caveats against. */
+export type EnforcerAddresses = EnforcerAddressMap & {
+    digestBinding: Address;
+};
+/**
+ * One per `type`. RFC 9396: "there is no universal way to determine whether one authorization_details
+ * object is a subset of another" — so every type says for itself.
+ */
+export interface MandateSubsetHandler {
+    type: string;
+    /** Is `child` ⊆ `parent`? Pure; deterministic. Must be conservative: unsure ⇒ false. */
+    isSubset(child: MandateRequirementV1, parent: MandateRequirementV1): boolean;
+    /** The caveats that ENFORCE the requirement on chain (not counting the digest bindings, added generically). */
+    toCaveats(req: MandateRequirementV1, enforcers: EnforcerAddresses): Caveat[];
+    /** Read the requirement back out of a delegation's caveats — for verification and for display. */
+    fromCaveats(caveats: readonly Caveat[], enforcers: EnforcerAddresses): Omit<MandateRequirementV1, 'intentDigest' | 'projectionDigest' | 'offerDigest'> | null;
+    /** The LIMITS a mandate would need to carry for this step to be within it — the type's own quantities,
+     *  read off the step. Payment turns `{payee, asset, amount}` into a ceiling; the generic capability type
+     *  bounds nothing beyond its actions and locations. Used when ASKING for authority (§3.6): a person
+     *  granting a payment is granting an amount, and a requirement that omits it cannot be minted. */
+    stepLimits?(step: MandateStep): Record<string, string | number>;
+    /** What a step's ACTIONS are, in this type's vocabulary. A step carries both a capability id
+     *  (`organization.team.create`) and a verb (`create`); which of them a mandate's `actions` name is the
+     *  type's convention — the generic capability type grants capability IDS, the payment type grants the
+     *  verb `execute`. Default: the verb. A type that grants ids overrides. */
+    stepActions?(step: MandateStep): string[];
+    /** Spec 408 §2.2 (R917-P-1) — THE ENFORCERS THIS HANDLER JUDGES ITSELF. `verifyMandateForStep` runs the
+     *  caveat evaluator STRICTLY for a step that does not redeem on chain, so a caveat with no off-chain judge
+     *  denies (`context-required`) — unless the handler declares that it compares that caveat's terms in
+     *  `isSubset` (the payment handler bounds the PaymentEnforcer's payee/asset/amount itself). Those are
+     *  recorded `judged-by-handler`, never `enforced-on-chain`. Default: none. */
+    judgesEnforcers?(enforcers: EnforcerAddresses): Address[];
+}
+/** The handlers a verification consults. Passed EXPLICITLY (`SubsetHandlers`) wherever possible: the
+ *  ambient registry below is module-level state, and a bundle that ends up with two copies of this
+ *  module has two registries — one that was registered into and one that is consulted. That is how a
+ *  live verifier once answered "no handler" for a type its process had registered. */
+export type SubsetHandlers = ReadonlyMap<string, MandateSubsetHandler>;
+export declare function registerSubsetHandler(h: MandateSubsetHandler): void;
+export declare function subsetHandlerFor(type: string, from?: SubsetHandlers): MandateSubsetHandler | null;
+/** Test seam. */
+export declare function _resetSubsetHandlers(): void;
+/**
+ * The base rule every handler can build on: actions ⊆, locations ⊆ (when the parent names any),
+ * window ⊆, and the intent must be the SAME — a mandate for one intent never derives one for another.
+ */
+export declare function baseIsSubset(child: MandateRequirementV1, parent: MandateRequirementV1): boolean;
+export interface DeriveMandateInput {
+    /** The standing authority. Its hash becomes the child's `authority`, which is what makes it a CHAIN. */
+    parent: Delegation;
+    /** What the parent allows, as read by its handler. Supplied by the caller who resolved it (or read
+     *  it with `readMandate`). */
+    parentRequirement: MandateRequirementV1;
+    /** What the child asks for. Must be ⊆ parent, per the handler, or this refuses. */
+    requirement: MandateRequirementV1;
+    grantee: Address;
+    enforcers: EnforcerAddresses;
+    chainId: number;
+    delegationManager: Address;
+    /** Random 128-bit salt; injected so a test can be deterministic. */
+    salt: bigint;
+    /** The handler set to consult. Defaults to the ambient registry. */
+    handlers?: SubsetHandlers;
+}
+export type DeriveMandateResult = {
+    ok: true;
+    delegation: Delegation;
+    digest: Hex;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * A child mandate from a standing delegation. Unsigned: the caller signs `digest` with the parent's
+ * DELEGATE's credential (the party attenuating its own authority onward).
+ */
+export declare function deriveMandate(input: DeriveMandateInput): DeriveMandateResult;
+/** Read a mandate's requirement back out of a delegation, or null when it carries no intent binding —
+ *  in which case it is a standing capability, not a mandate. */
+export declare function readMandate(d: Delegation, type: string, enforcers: EnforcerAddresses, from?: SubsetHandlers): MandateRequirementV1 | null;
+/** The step, as the verifier sees it. */
+export interface MandateStep {
+    /** ADR-0051 capability id the step exercises, e.g. `treasury.payment.execute`. Its selector is what
+     *  `allowedMethods` is checked against. */
+    capability: string;
+    action: string;
+    resource?: string;
+    /** The intent THIS RUN is acting under. Compared to the mandate's binding — this is the reason check. */
+    intent: unknown;
+    /** Optional: the projection / offer digests when the run followed an engagement. */
+    projectionDigest?: Hex;
+    offerDigest?: Hex;
+    /** Spec 408 §2.3 — the digest of the plan THIS RUN is executing (`orchestration.planDigest`). A mandate
+     *  that binds a plan is refused for a step that presents none or another. */
+    planDigest?: Hex;
+    /** Spec 410 §7 — the ontology classes this step's write carries (the tool's `carries` over the args present). */
+    payloadClasses?: readonly string[];
+    /** Type-specific arguments the handler may bound (amount, payee…). */
+    args?: Record<string, unknown>;
+    /** For the `value` caveat. The ETH value this step sends; a step that sends none is judged at 0 — a known
+     *  fact about the step, not an assumption about the caveat. */
+    value?: bigint;
+    /** Spec 408 §2.2 (R917-P-1) — does this step REDEEM the mandate on chain, where every enforcer fires?
+     *  Only then may a caveat with no off-chain judge be recorded `enforced-on-chain`; every other step is
+     *  judged strictly. Declared by the tool (`ToolSpec.capability.redeemsOnChain`), never by the planner. */
+    redeemsOnChain?: boolean;
+}
+export interface VerifyMandateInput {
+    /** The wire the caller presented. */
+    presented: Delegation;
+    /** The RAR type the step requires — selects the handler that judges type-specific limits. */
+    requirementType: string;
+    /** The party acting. MUST be the delegate. */
+    actor: Address;
+    step: MandateStep;
+    enforcers: EnforcerAddresses;
+    checks: MethodAuthorizationChecks;
+    /** Unix seconds; injected. */
+    now: number;
+    /** The handler set to consult. Defaults to the ambient registry — pass it explicitly in a bundle. */
+    handlers?: SubsetHandlers;
+    /** Spec 410 §5 — the versions THIS verifier runs with. When given, the intent digest is recomputed with
+     *  these substituted for whatever the intent states, so a mandate approved under a moved T-box or a moved
+     *  compiled definition is refused (`version-moved`, naming which). Absent ⇒ the intent is digested as
+     *  presented (a runtime that has not adopted version binding). */
+    currentVersions?: VersionBindingV1;
+}
+export interface DecisionReason {
+    code: string;
+    message: string;
+}
+/** An UNSATISFIED condition attached to the authority. Not a UI prompt: a fact the mandate carries. */
+export interface Obligation {
+    kind: 'second-party-approval' | 'quorum' | 'fresh-authorization' | 'disclosure' | (string & {});
+    dischargeableBy: {
+        role?: string;
+        agents?: Address[];
+        threshold?: number;
+    };
+    /** The policy or caveat that imposed it, by reference — so the record of discharge can name it. */
+    imposedBy: string;
+}
+export interface DecisionEvidence {
+    mandateRef: Hex;
+    intentDigest: Hex;
+    evaluatedAt: number;
+    /** Every caveat verdict, so a denial names the caveat and a permit is inspectable. */
+    verdicts: Array<{
+        enforcer: Address;
+        allowed: boolean;
+        reason?: string;
+    }>;
+    /** Spec 383 — THE CHAIN the leaf descends from, verified whole: every link by digest, the accountability
+     *  root (the root delegator) and the acting agent (the leaf delegate). A root mandate is a chain of one. */
+    chain?: import('./authority-chain.js').AuthorityChainV1;
+}
+export type MandateDecision = {
+    decision: 'allow';
+    obligations: Obligation[];
+    evidence: DecisionEvidence;
+} | {
+    decision: 'approval-required';
+    obligations: Obligation[];
+    evidence: DecisionEvidence;
+} | {
+    decision: 'deny';
+    reasons: DecisionReason[];
+    evidence: DecisionEvidence;
+};
+/**
+ * Is THIS step covered by the presented mandate, RIGHT NOW?
+ *
+ * Order — and every stage fails closed:
+ *   1. the actor is the delegate;
+ *   2. the delegation is live: signed by its delegator, unrevoked, in window (verifyLiveDelegation);
+ *   3. it IS a mandate: it carries an intent binding, and that binding equals the digest computed from
+ *      the step's intent — the reason check (evaluateCaveats with `digests`, strict); a plan binding, when
+ *      the mandate carries one, must equal the plan this run is executing (spec 408 §2.3);
+ *   4. the step's capability selector satisfies allowedMethods, and its value the value cap — STRICTLY
+ *      (spec 408 §2.2): a caveat no off-chain judge can answer denies, unless the step redeems on chain
+ *      (`redeemsOnChain`, where the enforcer fires) or the type handler declares it judges that caveat;
+ *   5. the handler's type-specific limits admit the step's args.
+ *
+ * Obligations are NOT decided here — they come from policy (spec 350 §3.4) and are attached by the
+ * `MandateVerifier` port implementation that composes this with a `PolicyEvaluator`. This function
+ * answers one question: is the authority present and does it cover the step.
+ */
+export declare function verifyMandateForStep(input: VerifyMandateInput): Promise<MandateDecision>;
+export { ROOT_AUTHORITY };
+export type { DigestBindingKind };
+//# sourceMappingURL=mandate.d.ts.map

package/dist/mandate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mandate.d.ts","sourceRoot":"","sources":["../src/mandate.ts"],"names":[],"mappings":"AAoBA,OAAO,EAA4B,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAE1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAElF,OAAO,EAAwC,KAAK,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEjH,OAAO,EAAgD,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAI5C;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;IACzC,+GAA+G;IAC/G,YAAY,EAAE,GAAG,CAAC;IAClB,+FAA+F;IAC/F,gBAAgB,CAAC,EAAE,GAAG,CAAC;IACvB,iFAAiF;IACjF,WAAW,CAAC,EAAE,GAAG,CAAC;IAClB;;;iGAG6F;IAC7F,UAAU,CAAC,EAAE,GAAG,CAAC;IACjB;uHACmH;IACnH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,oBAAoB;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;CACjB;AAED;oDACoD;AACpD,wBAAgB,YAAY,CAAC,MAAM,EAAE,OAAO,GAAG,GAAG,CAEjD;AAYD;;;iHAGiH;AACjH,MAAM,WAAW,gBAAgB;IAC/B,sBAAsB,EAAE,GAAG,CAAC;IAC5B,eAAe,EAAE,GAAG,CAAC;IACrB;;oGAEgG;IAChG,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,6GAA6G;AAC7G,eAAO,MAAM,mBAAmB,EAA6B,GAAG,CAAC;AAEjE,gHAAgH;AAChH,wBAAgB,YAAY,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,gBAAgB,GAAG,CAAC,GAAG;IAAE,QAAQ,EAAE,gBAAgB,CAAA;CAAE,CAIxH;AAED,0FAA0F;AAC1F,wBAAgB,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,gBAAgB,GAAG,IAAI,CAKnE;AAID,mEAAmE;AACnE,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG;IAAE,aAAa,EAAE,OAAO,CAAA;CAAE,CAAC;AAEhF;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,QAAQ,CAAC,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC;IAC7E,+GAA+G;IAC/G,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,SAAS,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAAC;IAC7E,kGAAkG;IAClG,WAAW,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,iBAAiB,GAAG,IAAI,CAAC,oBAAoB,EAAE,cAAc,GAAG,kBAAkB,GAAG,aAAa,CAAC,GAAG,IAAI,CAAC;IAC9J;;;sGAGkG;IAClG,UAAU,CAAC,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;IAChE;;;+EAG2E;IAC3E,WAAW,CAAC,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,CAAC;IAC1C;;;;kFAI8E;IAC9E,eAAe,CAAC,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,EAAE,CAAC;CAC3D;AAED;;;sFAGsF;AACtF,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;AAIvE,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAGnE;AACD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,cAAyB,GAAG,oBAAoB,GAAG,IAAI,CAE3G;AACD,iBAAiB;AACjB,wBAAgB,oBAAoB,IAAI,IAAI,CAAsB;AAElE;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAc/F;AAID,MAAM,WAAW,kBAAkB;IACjC,wGAAwG;IACxG,MAAM,EAAE,UAAU,CAAC;IACnB;kCAC8B;IAC9B,iBAAiB,EAAE,oBAAoB,CAAC;IACxC,mFAAmF;IACnF,WAAW,EAAE,oBAAoB,CAAC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,GACjD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,mBAAmB,CAuB5E;AAED;gEACgE;AAChE,wBAAgB,WAAW,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,oBAAoB,GAAG,IAAI,CAQzI;AAID,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B;+CAC2C;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yGAAyG;IACzG,MAAM,EAAE,OAAO,CAAC;IAChB,oFAAoF;IACpF,gBAAgB,CAAC,EAAE,GAAG,CAAC;IACvB,WAAW,CAAC,EAAE,GAAG,CAAC;IAClB;iFAC6E;IAC7E,UAAU,CAAC,EAAE,GAAG,CAAC;IACjB,iHAAiH;IACjH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B;mEAC+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;8GAE0G;IAC1G,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,qCAAqC;IACrC,SAAS,EAAE,UAAU,CAAC;IACtB,6FAA6F;IAC7F,eAAe,EAAE,MAAM,CAAC;IACxB,8CAA8C;IAC9C,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,MAAM,EAAE,yBAAyB,CAAC;IAClC,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,qGAAqG;IACrG,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B;;;sEAGkE;IAClE,eAAe,CAAC,EAAE,gBAAgB,CAAC;CACpC;AAED,MAAM,WAAW,cAAc;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAEjE,uGAAuG;AACvG,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,uBAAuB,GAAG,QAAQ,GAAG,qBAAqB,GAAG,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAChG,eAAe,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3E,mGAAmG;IACnG,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,GAAG,CAAC;IAChB,YAAY,EAAE,GAAG,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,sFAAsF;IACtF,QAAQ,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1E;gHAC4G;IAC5G,KAAK,CAAC,EAAE,OAAO,sBAAsB,EAAE,gBAAgB,CAAC;CACzD;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GAC5E;IAAE,QAAQ,EAAE,mBAAmB,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GACxF;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,cAAc,EAAE,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAIhF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,eAAe,CAAC,CAyG9F;AAsBD,OAAO,EAAE,cAAc,EAAE,CAAC;AAC1B,YAAY,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/mandate.js

@@ -0,0 +1,275 @@
+// Mandates — spec 350 §2 / spec 336 §8.3 + E4.
+//
+// A MANDATE IS A DELEGATION WITH A REASON. Not a new authority mechanism, not a token format, not a
+// package of its own: a standing `Delegation` (EIP-712, ERC-1271-verified, on-chain revocable) whose
+// caveats ALSO bind it to the digest of the intent it serves. `allowedMethods` + a window says WHAT the
+// delegate may call; the intent binding says WHY, and a step whose intent differs is refused even though
+// the method is identical. That is the whole difference between a standing capability and a mandate.
+//
+// This module is the missing half of spec 336 wave E4:
+//   • `MandateRequirementV1` — the RAR-shaped (RFC 9396) PROPOSAL a mandate is derived from. It grants
+//     nothing; it is what an offer can state openly and what a grantor approves.
+//   • the subset-handler registry — RFC 9396 is explicit that NO universal "narrower-than" exists across
+//     authorization-detail types, so each `type` registers its own `isSubset` / `toCaveats` / `fromCaveats`.
+//   • `deriveMandate` — a child delegation from a standing one. It refuses EARLY (via the handler) so a
+//     doomed child is never signed; the chain would refuse it anyway, because the child's `authority` is
+//     the parent's hash and DelegationManager evaluates the whole chain at redemption. Attenuation is a
+//     property of the representation, not a policy this file remembers to enforce.
+//   • `verifyMandateForStep` — THE per-step check. Called before every consequential step of a run, never
+//     once at admission, so a revocation between step 2 and step 3 stops step 3. Returns a decision with
+//     reasons; it never falls back to a weaker check (ADR-0013).
+import { keccak256, stringToBytes } from 'viem';
+import { jcsCanonicalize } from '@agenticprimitives/types';
+import { hashDelegation } from './hash.js';
+import { verifyLiveDelegation, methodSelector } from './method-authorization.js';
+import { evaluateCaveats } from './evaluator.js';
+import { buildDigestBindingCaveat, readDigestBindings } from './caveats.js';
+import { ROOT_AUTHORITY } from './types.js';
+/** RFC 8785 JCS → keccak256. The ONE way an intent digest is computed, so grantor, verifier and receipt
+ *  cannot disagree about which bytes were bound. */
+export function intentDigest(intent) {
+    return keccak256(stringToBytes(jcsCanonicalize(intent)));
+}
+/** The bare harness: no compiled definition to bind. Stated, never omitted, so the preimage shape is one. */
+export const NO_SEMANTICS_DIGEST = `0x${'00'.repeat(32)}`;
+/** The intent with its versions folded in — what a Home mints a mandate over and what a verifier recomputes. */
+export function withVersions(intent, versions) {
+    const prior = intent.versions?.meaningRefs;
+    const meaningRefs = versions.meaningRefs ?? prior;
+    return { ...intent, versions: { ontologyManifestDigest: versions.ontologyManifestDigest, semanticsDigest: versions.semanticsDigest, ...(meaningRefs?.length ? { meaningRefs: [...meaningRefs].sort() } : {}) } };
+}
+/** The versions an intent states, or null when it states none (a pre-spec-410 intent). */
+export function versionsOf(intent) {
+    const v = intent?.versions;
+    if (!v || typeof v !== 'object')
+        return null;
+    const ok = (x) => typeof x === 'string' && /^0x[0-9a-fA-F]{64}$/.test(x);
+    return ok(v.ontologyManifestDigest) && ok(v.semanticsDigest) ? { ontologyManifestDigest: v.ontologyManifestDigest, semanticsDigest: v.semanticsDigest, ...(Array.isArray(v.meaningRefs) && v.meaningRefs.length ? { meaningRefs: [...v.meaningRefs] } : {}) } : null;
+}
+const handlers = new Map();
+export function registerSubsetHandler(h) {
+    if (handlers.has(h.type))
+        throw new Error(`registerSubsetHandler: a handler for ${h.type} is already registered`);
+    handlers.set(h.type, h);
+}
+export function subsetHandlerFor(type, from = handlers) {
+    return from.get(type) ?? null;
+}
+/** Test seam. */
+export function _resetSubsetHandlers() { handlers.clear(); }
+/**
+ * The base rule every handler can build on: actions ⊆, locations ⊆ (when the parent names any),
+ * window ⊆, and the intent must be the SAME — a mandate for one intent never derives one for another.
+ */
+export function baseIsSubset(child, parent) {
+    if (child.type !== parent.type)
+        return false;
+    if (child.intentDigest.toLowerCase() !== parent.intentDigest.toLowerCase())
+        return false;
+    if (!child.actions.every((a) => parent.actions.includes(a)))
+        return false;
+    if (parent.locations?.length) {
+        // Locations are addresses / CAIP-10 accounts; viem checksums on decode, callers pass lowercase.
+        // Case is not identity.
+        const p = parent.locations.map((l) => l.toLowerCase());
+        if (!child.locations?.length)
+            return false;
+        if (!child.locations.every((l) => p.includes(l.toLowerCase())))
+            return false;
+    }
+    if ((child.validAfter ?? 0) < (parent.validAfter ?? 0))
+        return false;
+    if (child.validUntil > parent.validUntil)
+        return false;
+    return true;
+}
+/**
+ * A child mandate from a standing delegation. Unsigned: the caller signs `digest` with the parent's
+ * DELEGATE's credential (the party attenuating its own authority onward).
+ */
+export function deriveMandate(input) {
+    const h = subsetHandlerFor(input.requirement.type, input.handlers);
+    if (!h)
+        return { ok: false, reason: `no subset handler registered for ${input.requirement.type} — refusing to derive an authority nobody can bound` };
+    if (input.requirement.type !== input.parentRequirement.type)
+        return { ok: false, reason: 'child and parent requirement types differ' };
+    if (!h.isSubset(input.requirement, input.parentRequirement)) {
+        return { ok: false, reason: `requested authority is not a subset of the parent's (${h.type})` };
+    }
+    const caveats = [
+        ...h.toCaveats(input.requirement, input.enforcers),
+        buildDigestBindingCaveat(input.enforcers.digestBinding, 'intent', input.requirement.intentDigest),
+        ...(input.requirement.projectionDigest ? [buildDigestBindingCaveat(input.enforcers.digestBinding, 'projection', input.requirement.projectionDigest)] : []),
+        ...(input.requirement.offerDigest ? [buildDigestBindingCaveat(input.enforcers.digestBinding, 'offer', input.requirement.offerDigest)] : []),
+        ...(input.requirement.planDigest ? [buildDigestBindingCaveat(input.enforcers.digestBinding, 'plan', input.requirement.planDigest)] : []),
+    ];
+    const delegation = {
+        delegator: input.parent.delegate, // the party attenuating ITS authority onward
+        delegate: input.grantee,
+        authority: hashDelegation(input.parent, input.chainId, input.delegationManager), // the chain link
+        caveats,
+        salt: input.salt,
+        signature: '0x',
+    };
+    return { ok: true, delegation, digest: hashDelegation(delegation, input.chainId, input.delegationManager) };
+}
+/** Read a mandate's requirement back out of a delegation, or null when it carries no intent binding —
+ *  in which case it is a standing capability, not a mandate. */
+export function readMandate(d, type, enforcers, from) {
+    const h = subsetHandlerFor(type, from);
+    if (!h)
+        return null;
+    const bindings = readDigestBindings(d.caveats, enforcers.digestBinding);
+    if (!bindings.intent)
+        return null;
+    const base = h.fromCaveats(d.caveats, enforcers);
+    if (!base)
+        return null;
+    return { ...base, intentDigest: bindings.intent, ...(bindings.projection ? { projectionDigest: bindings.projection } : {}), ...(bindings.offer ? { offerDigest: bindings.offer } : {}), ...(bindings.plan ? { planDigest: bindings.plan } : {}) };
+}
+const lc = (s) => s.toLowerCase();
+/**
+ * Is THIS step covered by the presented mandate, RIGHT NOW?
+ *
+ * Order — and every stage fails closed:
+ *   1. the actor is the delegate;
+ *   2. the delegation is live: signed by its delegator, unrevoked, in window (verifyLiveDelegation);
+ *   3. it IS a mandate: it carries an intent binding, and that binding equals the digest computed from
+ *      the step's intent — the reason check (evaluateCaveats with `digests`, strict); a plan binding, when
+ *      the mandate carries one, must equal the plan this run is executing (spec 408 §2.3);
+ *   4. the step's capability selector satisfies allowedMethods, and its value the value cap — STRICTLY
+ *      (spec 408 §2.2): a caveat no off-chain judge can answer denies, unless the step redeems on chain
+ *      (`redeemsOnChain`, where the enforcer fires) or the type handler declares it judges that caveat;
+ *   5. the handler's type-specific limits admit the step's args.
+ *
+ * Obligations are NOT decided here — they come from policy (spec 350 §3.4) and are attached by the
+ * `MandateVerifier` port implementation that composes this with a `PolicyEvaluator`. This function
+ * answers one question: is the authority present and does it cover the step.
+ */
+export async function verifyMandateForStep(input) {
+    const d = input.presented;
+    // Spec 410 §5 — recompute under the versions this verifier RUNS WITH, never the ones the intent states.
+    const cur = input.currentVersions;
+    const digestOfIntent = intentDigest(cur && input.step.intent && typeof input.step.intent === 'object' ? withVersions(input.step.intent, cur) : input.step.intent);
+    const evidence = {
+        mandateRef: input.checks.delegationDigest(d),
+        intentDigest: digestOfIntent,
+        evaluatedAt: input.now,
+        verdicts: [],
+    };
+    const deny = (code, message) => ({ decision: 'deny', reasons: [{ code, message }], evidence });
+    // 1. actor
+    if (lc(d.delegate) !== lc(input.actor))
+        return deny('actor-not-delegate', 'the acting party is not the mandate\'s delegate');
+    // 2. live
+    const live = await verifyLiveDelegation({ delegation: d, expectedDelegate: input.actor, enforcers: input.enforcers, checks: input.checks, now: input.now });
+    if (!live.ok)
+        return deny('not-live', live.reason);
+    // 3. it is a mandate, and the reason matches
+    const bindings = readDigestBindings(d.caveats, input.enforcers.digestBinding);
+    if (!bindings.intent)
+        return deny('not-a-mandate', 'the presented delegation carries no intent binding — it is a standing capability, and a step needs a mandate');
+    // Spec 410 §5 — A MOVED VERSION IS NAMED, not left as a bare digest mismatch. The intent states the versions it
+    // was approved under; if they differ from the ones this verifier runs with, the recomputed digest cannot
+    // match the binding, and the person is told which world moved so the re-approval is an informed one.
+    if (cur) {
+        const stated = versionsOf(input.step.intent);
+        const moved = [];
+        if (stated && lc(stated.ontologyManifestDigest) !== lc(cur.ontologyManifestDigest))
+            moved.push(`the ontology manifest (approved under ${stated.ontologyManifestDigest.slice(0, 12)}…, this runtime binds ${cur.ontologyManifestDigest.slice(0, 12)}…)`);
+        if (stated && lc(stated.semanticsDigest) !== lc(cur.semanticsDigest))
+            moved.push(`the compiled definition (approved under ${stated.semanticsDigest.slice(0, 12)}…, this runtime runs ${cur.semanticsDigest.slice(0, 12)}…)`);
+        if (moved.length)
+            return deny('version-moved', `the intent was approved under a version that has since moved: ${moved.join('; ')} — re-approve the same intent under the current versions`);
+        if (!stated)
+            return deny('version-unbound', 'this runtime binds the ontology and definition versions into every mandate, and the presented intent states none — re-approve the intent under the current versions');
+    }
+    // Spec 384 (336 §3.8) — A STEP THAT FULFILS AN ACCEPTED OFFER runs only under a mandate that NAMES that offer.
+    // The digest-binding caveat compares an `offer` binding when the mandate carries one; a mandate that
+    // carries none would pass the comparison by default, and that is exactly how an offer would become a
+    // commitment without the signature that accepted it. Required here, before the caveats are read.
+    if (input.step.offerDigest && !bindings.offer)
+        return deny('offer-not-bound', 'this step fulfils an accepted offer, and the presented mandate names no offer — an offer becomes a commitment only under the mandate that binds it');
+    if (input.step.projectionDigest && bindings.projection && lc(bindings.projection) !== lc(input.step.projectionDigest))
+        return deny('projection-mismatch', 'the mandate was granted over another projection of the intent');
+    // Spec 408 §2.3 — THE PLAN. A mandate that binds one was signed over THAT plan; a step from another plan
+    // (or from no plan the verifier was told of) is not what the person authorized, whatever its goal says.
+    if (bindings.plan && (!input.step.planDigest || lc(bindings.plan) !== lc(input.step.planDigest))) {
+        return deny('plan-mismatch', input.step.planDigest ? 'the mandate was granted over a different plan for this intent' : 'the mandate binds a plan and this step presents none');
+    }
+    // The handler first: it decides the type-specific limits (5) AND which caveats it judges itself (4).
+    const h = subsetHandlerFor(input.requirementType, input.handlers);
+    if (!h)
+        return deny('no-handler', `no subset handler for ${input.requirementType} — an authority nobody can bound is not verified`);
+    const selector = methodSelector(input.step.capability);
+    const verdicts = evaluateCaveats(d.caveats, {
+        timestamp: input.now,
+        // The call TARGET is the step's resource: the agent being acted for (a membership add on an org),
+        // or the asset contract (a payment). Both are what `allowedTargets` was encoded against.
+        target: (input.step.resource ?? d.delegator),
+        selector,
+        // The ETH value the step sends — 0 when it sends none. A fact about the step (spec 408 §2.2).
+        value: input.step.value ?? 0n,
+        digests: {
+            intent: digestOfIntent,
+            ...(input.step.projectionDigest ? { projection: input.step.projectionDigest } : {}),
+            ...(input.step.offerDigest ? { offer: input.step.offerDigest } : {}),
+            ...(input.step.planDigest ? { plan: input.step.planDigest } : {}),
+        },
+        ...(input.step.payloadClasses ? { payloadClasses: input.step.payloadClasses } : {}),
+    }, input.enforcers, {
+        // R917-P-1 (spec 408 §2.2): STRICT unless this step redeems on chain, where every enforcer fires. The
+        // previous `enforceOnChain: true` on every step let a caveat nobody judged off chain pass as
+        // "enforced-on-chain" for steps that never reached the chain — the evaluator's own contract forbids
+        // that for an off-chain gate, and this IS one.
+        enforceOnChain: input.step.redeemsOnChain === true,
+        judgedElsewhere: new Set((h.judgesEnforcers?.(input.enforcers) ?? []).map(lc)),
+    });
+    evidence.verdicts = verdicts.map((v) => ({ enforcer: v.enforcer, allowed: v.allowed, ...(v.reason ? { reason: v.reason } : {}) }));
+    const denied = verdicts.find((v) => !v.allowed);
+    if (denied) {
+        const isReason = /digest mismatch|binding present/.test(denied.reason ?? '');
+        return deny(isReason ? 'intent-mismatch' : 'caveat-denied', denied.reason ?? 'caveat denied');
+    }
+    // 5. type-specific limits
+    const req = readMandate(d, input.requirementType, input.enforcers, input.handlers);
+    if (!req)
+        return deny('not-a-mandate', `the presented delegation does not decode as a ${input.requirementType} mandate`);
+    // Actions, resources and limits are ALL the handler's to judge — a read-back capability mandate
+    // carries `sel:<hex>` actions while a step carries the id, and only the handler knows they are the
+    // same. Asking it "would a requirement shaped like this step be a subset?" gives every type-specific
+    // comparison exactly one definition. The reason names what failed so a denial is actionable.
+    const shaped = stepAsRequirement(req, input.step, h);
+    if (!h.isSubset(shaped, req)) {
+        if (!h.isSubset({ ...shaped, locations: req.locations, limits: req.limits }, req)) {
+            return deny('action-not-granted', `${shaped.actions.map((a) => `"${a}"`).join(', ')} is not among the mandate's actions`);
+        }
+        if (input.step.resource && !h.isSubset({ ...shaped, limits: req.limits }, req)) {
+            return deny('resource-not-granted', `resource ${input.step.resource} is not among the mandate's locations`);
+        }
+        return deny('limit-exceeded', `step exceeds the mandate's ${h.type} limits`);
+    }
+    return { decision: 'allow', obligations: [], evidence };
+}
+/** The step, re-expressed as a requirement, so the handler can compare like with like. */
+function stepAsRequirement(req, step, h) {
+    return {
+        ...req,
+        actions: h.stepActions ? h.stepActions(step) : [step.action],
+        ...(step.resource ? { locations: [step.resource] } : {}),
+        limits: stepLimits(step),
+    };
+}
+/** The step's bounded quantities as `limits`, so the handler compares like with like. */
+function stepLimits(step) {
+    const out = {};
+    for (const [k, v] of Object.entries(step.args ?? {})) {
+        if (typeof v === 'string' || typeof v === 'number')
+            out[k] = v;
+        else if (typeof v === 'bigint')
+            out[k] = v.toString();
+    }
+    return out;
+}
+export { ROOT_AUTHORITY };
+//# sourceMappingURL=mandate.js.map

package/dist/mandate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mandate.js","sourceRoot":"","sources":["../src/mandate.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,EAAE;AACF,oGAAoG;AACpG,qGAAqG;AACrG,wGAAwG;AACxG,yGAAyG;AACzG,qGAAqG;AACrG,EAAE;AACF,uDAAuD;AACvD,uGAAuG;AACvG,iFAAiF;AACjF,yGAAyG;AACzG,6GAA6G;AAC7G,wGAAwG;AACxG,yGAAyG;AACzG,wGAAwG;AACxG,mFAAmF;AACnF,0GAA0G;AAC1G,yGAAyG;AACzG,iEAAiE;AACjE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAY,MAAM,MAAM,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE3D,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAkC,MAAM,2BAA2B,CAAC;AACjH,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAA0B,MAAM,cAAc,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAmD5C;oDACoD;AACpD,MAAM,UAAU,YAAY,CAAC,MAAe;IAC1C,OAAO,SAAS,CAAC,aAAa,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AAyBD,6GAA6G;AAC7G,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAS,CAAC;AAEjE,gHAAgH;AAChH,MAAM,UAAU,YAAY,CAAmB,MAAS,EAAE,QAA0B;IAClF,MAAM,KAAK,GAAI,MAAoD,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC1F,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,IAAI,KAAK,CAAC;IAClD,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,EAAE,sBAAsB,EAAE,QAAQ,CAAC,sBAAsB,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;AACnN,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,UAAU,CAAC,MAAe;IACxC,MAAM,CAAC,GAAI,MAAoD,EAAE,QAAiD,CAAC;IACnH,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,EAAE,GAAG,CAAC,CAAU,EAAY,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5F,OAAO,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAC,sBAAsB,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvQ,CAAC;AA2CD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;AAEzD,MAAM,UAAU,qBAAqB,CAAC,CAAuB;IAC3D,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC,IAAI,wBAAwB,CAAC,CAAC;IAClH,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC1B,CAAC;AACD,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAAuB,QAAQ;IAC5E,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AAChC,CAAC;AACD,iBAAiB;AACjB,MAAM,UAAU,oBAAoB,KAAW,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AAElE;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAA2B,EAAE,MAA4B;IACpF,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE;QAAE,OAAO,KAAK,CAAC;IACzF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;QAC7B,gGAAgG;QAChG,wBAAwB;QACxB,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM;YAAE,OAAO,KAAK,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrE,IAAI,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AA0BD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAyB;IACrD,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,KAAK,CAAC,WAAW,CAAC,IAAI,qDAAqD,EAAE,CAAC;IACtJ,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,KAAK,CAAC,iBAAiB,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;IACvI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wDAAwD,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;IAClG,CAAC;IACD,MAAM,OAAO,GAAa;QACxB,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC;QAClD,wBAAwB,CAAC,KAAK,CAAC,SAAS,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC;QACjG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,SAAS,CAAC,aAAa,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1J,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,SAAS,CAAC,aAAa,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3I,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACzI,CAAC;IACF,MAAM,UAAU,GAAe;QAC7B,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAW,6CAA6C;QACxF,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,SAAS,EAAE,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,EAAG,iBAAiB;QACnG,OAAO;QACP,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,IAAI;KAChB,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;AAC9G,CAAC;AAED;gEACgE;AAChE,MAAM,UAAU,WAAW,CAAC,CAAa,EAAE,IAAY,EAAE,SAA4B,EAAE,IAAqB;IAC1G,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACpP,CAAC;AA+ED,MAAM,EAAE,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAE1C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAyB;IAClE,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC;IAC1B,wGAAwG;IACxG,MAAM,GAAG,GAAG,KAAK,CAAC,eAAe,CAAC;IAClC,MAAM,cAAc,GAAG,YAAY,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,MAAgB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5K,MAAM,QAAQ,GAAqB;QACjC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC5C,YAAY,EAAE,cAAc;QAC5B,WAAW,EAAE,KAAK,CAAC,GAAG;QACtB,QAAQ,EAAE,EAAE;KACb,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,OAAe,EAAmB,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAEhI,WAAW;IACX,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,oBAAoB,EAAE,iDAAiD,CAAC,CAAC;IAE7H,UAAU;IACV,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5J,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAEnD,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAC9E,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,8GAA8G,CAAC,CAAC;IACnK,gHAAgH;IAChH,yGAAyG;IACzG,qGAAqG;IACrG,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,MAAM,IAAI,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,sBAAsB,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,yCAAyC,MAAM,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,yBAAyB,GAAG,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QACxP,IAAI,MAAM,IAAI,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,2CAA2C,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAC7N,IAAI,KAAK,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,eAAe,EAAE,iEAAiE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;QAC5L,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,iBAAiB,EAAE,qKAAqK,CAAC,CAAC;IACrN,CAAC;IACD,+GAA+G;IAC/G,qGAAqG;IACrG,qGAAqG;IACrG,iGAAiG;IACjG,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,iBAAiB,EAAE,oJAAoJ,CAAC,CAAC;IACpO,IAAI,KAAK,CAAC,IAAI,CAAC,gBAAgB,IAAI,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC,qBAAqB,EAAE,+DAA+D,CAAC,CAAC;IAC3N,yGAAyG;IACzG,wGAAwG;IACxG,IAAI,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACjG,OAAO,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,+DAA+D,CAAC,CAAC,CAAC,sDAAsD,CAAC,CAAC;IACjL,CAAC;IAED,qGAAqG;IACrG,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,YAAY,EAAE,yBAAyB,KAAK,CAAC,eAAe,kDAAkD,CAAC,CAAC;IAEpI,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,eAAe,CAC9B,CAAC,CAAC,OAAmB,EACrB;QACE,SAAS,EAAE,KAAK,CAAC,GAAG;QACpB,kGAAkG;QAClG,yFAAyF;QACzF,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAY;QACvD,QAAQ;QACR,8FAA8F;QAC9F,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;QAC7B,OAAO,EAAE;YACP,MAAM,EAAE,cAAc;YACtB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnF,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE;QACD,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpF,EACD,KAAK,CAAC,SAAS,EACf;QACE,sGAAsG;QACtG,6FAA6F;QAC7F,oGAAoG;QACpG,+CAA+C;QAC/C,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,cAAc,KAAK,IAAI;QAClD,eAAe,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;KAC/E,CACF,CAAC;IACF,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACnI,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,iCAAiC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC;IAChG,CAAC;IAED,0BAA0B;IAC1B,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnF,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,iDAAiD,KAAK,CAAC,eAAe,UAAU,CAAC,CAAC;IACzH,gGAAgG;IAChG,mGAAmG;IACnG,qGAAqG;IACrG,6FAA6F;IAC7F,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;YAClF,OAAO,IAAI,CAAC,oBAAoB,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QAC5H,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;YAC/E,OAAO,IAAI,CAAC,sBAAsB,EAAE,YAAY,KAAK,CAAC,IAAI,CAAC,QAAQ,uCAAuC,CAAC,CAAC;QAC9G,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,EAAE,8BAA8B,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;AAC1D,CAAC;AAED,0FAA0F;AAC1F,SAAS,iBAAiB,CAAC,GAAyB,EAAE,IAAiB,EAAE,CAAuB;IAC9F,OAAO;QACL,GAAG,GAAG;QACN,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QAC5D,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC;KACzB,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,SAAS,UAAU,CAAC,IAAiB;IACnC,MAAM,GAAG,GAAoC,EAAE,CAAC;IAChD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QACrD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;aAC1D,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,OAAO,EAAE,cAAc,EAAE,CAAC"}