@agenticprimitives/delegation 1.0.0-alpha.45 → 1.0.0-alpha.47
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +21 -7
- package/dist/authority-chain.d.ts +77 -7
- package/dist/authority-chain.d.ts.map +1 -1
- package/dist/authority-chain.js +144 -18
- package/dist/authority-chain.js.map +1 -1
- package/dist/caveats.d.ts +166 -3
- package/dist/caveats.d.ts.map +1 -1
- package/dist/caveats.js +65 -7
- package/dist/caveats.js.map +1 -1
- package/dist/evaluator.d.ts.map +1 -1
- package/dist/evaluator.js +9 -7
- package/dist/evaluator.js.map +1 -1
- package/dist/hash.d.ts +8 -0
- package/dist/hash.d.ts.map +1 -1
- package/dist/hash.js +17 -0
- package/dist/hash.js.map +1 -1
- package/dist/index.d.ts +11 -8
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +14 -5
- package/dist/index.js.map +1 -1
- package/dist/invocation-proof.d.ts.map +1 -1
- package/dist/invocation-proof.js +2 -0
- package/dist/invocation-proof.js.map +1 -1
- package/dist/mandate-handlers.d.ts.map +1 -1
- package/dist/mandate-handlers.js +2 -0
- package/dist/mandate-handlers.js.map +1 -1
- package/dist/mandate.d.ts +106 -1
- package/dist/mandate.d.ts.map +1 -1
- package/dist/mandate.js +189 -34
- package/dist/mandate.js.map +1 -1
- package/dist/method-authorization.d.ts +6 -0
- package/dist/method-authorization.d.ts.map +1 -1
- package/dist/method-authorization.js.map +1 -1
- package/dist/onchain.d.ts +150 -1
- package/dist/onchain.d.ts.map +1 -1
- package/dist/onchain.js +94 -2
- package/dist/onchain.js.map +1 -1
- package/dist/presentation-release.d.ts +7 -0
- package/dist/presentation-release.d.ts.map +1 -1
- package/dist/presentation-release.js +49 -17
- package/dist/presentation-release.js.map +1 -1
- package/dist/quorum.d.ts +71 -3
- package/dist/quorum.d.ts.map +1 -1
- package/dist/quorum.js +112 -22
- package/dist/quorum.js.map +1 -1
- package/dist/standing.d.ts.map +1 -1
- package/dist/standing.js +10 -4
- package/dist/standing.js.map +1 -1
- package/dist/token.d.ts +23 -14
- package/dist/token.d.ts.map +1 -1
- package/dist/token.js +46 -17
- package/dist/token.js.map +1 -1
- package/package.json +6 -6
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"mandate-handlers.js","sourceRoot":"","sources":["../src/mandate-handlers.ts"],"names":[],"mappings":"AAAA,wGAAwG;AACxG,8FAA8F;AAC9F,+FAA+F;AAC/F,qGAAqG;AACrG,4BAA4B;AAC5B,OAAO,EAAE,mBAAmB,EAAY,MAAM,MAAM,CAAC;AAErD,OAAO,EACL,WAAW,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,yBAAyB,EAC7G,yBAAyB,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,yBAAyB,EAC3K,2BAA2B,EAAE,4BAA4B,EAAE,4BAA4B,GACxF,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAgF,MAAM,cAAc,CAAC;AAEjJ,MAAM,EAAE,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAC1C,MAAM,UAAU,GAAG,CAAC,OAA0B,EAAE,QAA6B,EAAE,EAAE,CAC/E,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAE9E,sGAAsG;AACtG,EAAE;AACF,sGAAsG;AACtG,0GAA0G;AAC1G,8FAA8F;AAE9F,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAE3D,MAAM,CAAC,MAAM,iBAAiB,GAAyB;IACrD,IAAI,EAAE,mBAAmB;IACzB,QAAQ,EAAE,YAAY;IACtB,SAAS,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QAChH,MAAM,OAAO,GAAa;YACxB,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,oBAAoB,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;YACnF,8FAA8F;YAC9F,8FAA8F;YAC9F,sEAAsE;YACtE,WAAW,CAAC,CAAC,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACtH,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC;SAC3C,CAAC;QACF,IAAI,GAAG,CAAC,SAAS,EAAE,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,EAAE,yBAAyB,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAChI,wFAAwF;QACxF,IAAI,GAAG,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;YAC/B,IAAI,CAAC,CAAC,CAAC,cAAc;gBAAE,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;YACjI,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC,cAAc,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,WAAW,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,OAAO,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,oBAAoB,CAAC,EAAE,CAAC,KAAY,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,yBAAyB,CAAC,OAAO,CAAC,KAAY,CAAC,CAAC;QAClE,kGAAkG;QAClG,+FAA+F;QAC/F,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC;QACtD,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,yBAAyB,CAAC,OAAO,CAAC,KAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,yBAAyB,CAAC,OAAO,CAAC,KAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;YAC9B,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;SAC/B,CAAC;IACJ,CAAC;CACF,CAAC;AAEF;mGACmG;AACnG,iBAAiB,CAAC,WAAW,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAE5D;yFACyF;AACzF,iBAAiB,CAAC,QAAQ,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;IAC7C,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAChH,OAAO,YAAY,CACjB,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAC9C,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACjD,CAAC;AACJ,CAAC,CAAC;AAEF,sGAAsG;AACtG,EAAE;AACF,iGAAiG;AACjG,mGAAmG;AACnG,yFAAyF;AAEzF,MAAM,CAAC,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAItE,SAAS,aAAa,CAAC,GAAyB;IAC9C,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5J,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/F,uBAAuB,EAAE,MAAM,CAAC,CAAC,CAAC,uBAAuB,IAAI,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,IAAI,MAAM,CAAC;KAClH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAyB;IAClD,4GAA4G;IAC5G,8FAA8F;IAC9F,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,IAAI,EAAE,gBAAgB;IACtB,sGAAsG;IACtG,sGAAsG;IACtG,kGAAkG;IAClG,6DAA6D;IAC7D,UAAU,CAAC,IAAI;QACb,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QACpI,mGAAmG;QACnG,8FAA8F;QAC9F,oGAAoG;QACpG,qEAAqE;QACrE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,wFAAwF,MAAM,GAAG,CAAC,CAAC;QACrH,CAAC;QACD,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;YAC3E,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,EAAE,aAAa,EAAE,IAAI;SACzF,CAAC;IACJ,CAAC;IACD,QAAQ,CAAC,KAAK,EAAE,MAAM;QACpB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,mGAAmG;QACnG,2FAA2F;QAC3F,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtI,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,GAAG,CAAC,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC1D,IAAI,EAAE,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,YAAY;YAAE,OAAO,KAAK,CAAC;QACpG,IAAI,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACjF,IAAI,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACjF,IAAI,EAAE,CAAC,uBAAuB,KAAK,SAAS,IAAI,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,uBAAuB;YAAE,OAAO,KAAK,CAAC;QAC7H,OAAO,IAAI,CAAC;IACd,CAAC;IACD,SAAS,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACpG,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO;YACL,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,uBAAuB,EAAE,CAAC,CAAC,uBAAuB,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;YACjO,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,oBAAoB,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;YACnF,WAAW,CAAC,CAAC,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACnE,WAAW,CAAC,CAAC,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,yBAAyB,EAAE,cAAc,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC;SAClI,CAAC;IACJ,CAAC;IACD,WAAW,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC7B,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,GAAG,mBAAmB,CAC3F,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAC5H,GAAG,CAAC,KAAY,CACqC,CAAC;QACxD,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,oBAAoB,CAAC,EAAE,CAAC,KAAY,CAAC,CAAC;QACzE,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,CAAC,SAAS,CAAC;YACpB,SAAS,EAAE,CAAC,KAAK,CAAC;YAClB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE,EAAE,uBAAuB,EAAE,SAAS,EAAE,aAAa,EAAE;YACnJ,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;SAC/D,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,SAAS,SAAS,CAAC,CAAS;IAC1B,MAAM,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAG,2DAA2D;IACrG,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,EAAE,CAAC,CAAC;IACnE,OAAO,CAAC,CAAC,CAAC,CAAY,CAAC;AACzB,CAAC;AAED,+GAA+G;AAC/G,EAAE;AACF,6GAA6G;AAC7G,oGAAoG;AACpG,+GAA+G;AAC/G,gHAAgH;AAChH,iHAAiH;AACjH,iHAAiH;AACjH,EAAE;AACF,4GAA4G;AAC5G,8GAA8G;AAC9G,gHAAgH;AAEhH,MAAM,CAAC,MAAM,qBAAqB,GAAG,+BAA+B,CAAC;AACrE,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAI5D,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,IAAY,EAAY,EAAE;IAClD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAY,CAAC;YAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC;IAC1K,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,iBAAiB,CAAC,CAAC;AACzE,CAAC,CAAC;AAEF,SAAS,kBAAkB,CAAC,GAAyB;IACnD,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,EAAE,CAAC;IAC7R,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oGAAoG,CAAC,CAAC;IAC7M,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,gBAAgB;QAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,8BAA8B,CAAC,CAAC;IACjK,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAyB;IACvD,IAAI,EAAE,qBAAqB;IAC3B,+GAA+G;IAC/G,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC,2BAA2B,CAAC;IACpD,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC;IAC9B,UAAU,CAAC,IAAI;QACb,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,EAAE,aAAa,CAAU,EAAE,CAAC;YACxE,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,8CAA8C,CAAC,CAAC;QACrI,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,gBAAgB,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;IACtJ,CAAC;IACD,QAAQ,CAAC,KAAK,EAAE,MAAM;QACpB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,QAAQ,IAAI,EAAE,EAAE,WAAW,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE,CAAC,gBAAgB,IAAI,EAAE,CAAC,eAAe,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,YAAY,IAAI,EAAE,CAAC,WAAW,IAAI,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC;QACnQ,6GAA6G;QAC7G,wGAAwG;QACxG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACxE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACtF,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9E,IAAI,EAAE,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,CAAC,gBAAgB,KAAK,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,gBAAgB;YAAE,OAAO,KAAK,CAAC;QACpI,OAAO,IAAI,CAAC;IACd,CAAC;IACD,SAAS,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO;YACL,4BAA4B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAyB,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC;YAC3K,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,oBAAoB,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;YACnF,WAAW,CAAC,CAAC,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,cAAc,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;YACnG,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC;SAC3C,CAAC;IACJ,CAAC;IACD,WAAW,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,CAAC,GAAG,4BAA4B,CAAC,KAAK,CAAC,KAAY,CAAC,CAAC;QAC3D,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,oBAAoB,CAAC,EAAE,CAAC,KAAY,CAAC,CAAC;QACzE,OAAO;YACL,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,CAAC,SAAS,CAAC;YACpB,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE;YAC5L,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;SAC/D,CAAC;IACJ,CAAC;CACF,CAAC;AAEF;2FAC2F;AAC3F,MAAM,CAAC,MAAM,uBAAuB,GAA8C,IAAI,GAAG,CAAC;IACxF,CAAC,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAC3C,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC;IACrC,CAAC,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,CAAC;CAChD,CAAC,CAAC;AAEH,iGAAiG;AACjG,IAAI,UAAU,GAAG,KAAK,CAAC;AACvB,MAAM,UAAU,6BAA6B;IAC3C,IAAI,UAAU;QAAE,OAAO;IACvB,qBAAqB,CAAC,iBAAiB,CAAC,CAAC;IACzC,qBAAqB,CAAC,cAAc,CAAC,CAAC;IACtC,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;IAC3C,UAAU,GAAG,IAAI,CAAC;AACpB,CAAC;AACD,qDAAqD;AACrD,MAAM,UAAU,yBAAyB,KAAW,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC"}
|
|
1
|
+
{"version":3,"file":"mandate-handlers.js","sourceRoot":"","sources":["../src/mandate-handlers.ts"],"names":[],"mappings":"AAAA,wGAAwG;AACxG,8FAA8F;AAC9F,+FAA+F;AAC/F,qGAAqG;AACrG,4BAA4B;AAC5B,OAAO,EAAE,mBAAmB,EAAY,MAAM,MAAM,CAAC;AAErD,OAAO,EACL,WAAW,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,yBAAyB,EAC7G,yBAAyB,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,yBAAyB,EAC3K,2BAA2B,EAAE,4BAA4B,EAAE,4BAA4B,GACxF,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAgF,MAAM,cAAc,CAAC;AAEjJ,MAAM,EAAE,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAC1C,MAAM,UAAU,GAAG,CAAC,OAA0B,EAAE,QAA6B,EAAE,EAAE,CAC/E,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAE9E,sGAAsG;AACtG,EAAE;AACF,sGAAsG;AACtG,0GAA0G;AAC1G,8FAA8F;AAE9F,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAE3D,MAAM,CAAC,MAAM,iBAAiB,GAAyB;IACrD,IAAI,EAAE,mBAAmB;IACzB,QAAQ,EAAE,YAAY;IACtB,SAAS,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QAChH,MAAM,OAAO,GAAa;YACxB,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,oBAAoB,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;YACnF,8FAA8F;YAC9F,8FAA8F;YAC9F,sEAAsE;YACtE,WAAW,CAAC,CAAC,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACtH,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC;SAC3C,CAAC;QACF,IAAI,GAAG,CAAC,SAAS,EAAE,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,EAAE,yBAAyB,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAChI,wFAAwF;QACxF,IAAI,GAAG,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;YAC/B,IAAI,CAAC,CAAC,CAAC,cAAc;gBAAE,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;YACjI,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC,cAAc,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,WAAW,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,OAAO,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,oBAAoB,CAAC,EAAE,CAAC,KAAY,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,yBAAyB,CAAC,OAAO,CAAC,KAAY,CAAC,CAAC;QAClE,kGAAkG;QAClG,+FAA+F;QAC/F,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC;QACtD,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,yBAAyB,CAAC,OAAO,CAAC,KAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,yBAAyB,CAAC,OAAO,CAAC,KAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;YAC9B,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;SAC/B,CAAC;IACJ,CAAC;CACF,CAAC;AAEF;mGACmG;AACnG,iBAAiB,CAAC,WAAW,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAE5D;yFACyF;AACzF,iBAAiB,CAAC,QAAQ,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;IAC7C,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAChH,OAAO,YAAY,CACjB,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAC9C,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACjD,CAAC;AACJ,CAAC,CAAC;AAEF,sGAAsG;AACtG,EAAE;AACF,iGAAiG;AACjG,mGAAmG;AACnG,yFAAyF;AAEzF,MAAM,CAAC,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAItE,SAAS,aAAa,CAAC,GAAyB;IAC9C,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5J,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/F,uBAAuB,EAAE,MAAM,CAAC,CAAC,CAAC,uBAAuB,IAAI,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,IAAI,MAAM,CAAC;KAClH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAyB;IAClD,4GAA4G;IAC5G,8FAA8F;IAC9F,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,IAAI,EAAE,gBAAgB;IACtB,sGAAsG;IACtG,sGAAsG;IACtG,kGAAkG;IAClG,6DAA6D;IAC7D,UAAU,CAAC,IAAI;QACb,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QACpI,mGAAmG;QACnG,8FAA8F;QAC9F,oGAAoG;QACpG,qEAAqE;QACrE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,wFAAwF,MAAM,GAAG,CAAC,CAAC;QACrH,CAAC;QACD,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;YAC3E,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,EAAE,aAAa,EAAE,IAAI;SACzF,CAAC;IACJ,CAAC;IACD,QAAQ,CAAC,KAAK,EAAE,MAAM;QACpB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,mGAAmG;QACnG,2FAA2F;QAC3F,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtI,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,GAAG,CAAC,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC1D,IAAI,EAAE,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,YAAY;YAAE,OAAO,KAAK,CAAC;QACpG,IAAI,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACjF,IAAI,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACjF,IAAI,EAAE,CAAC,uBAAuB,KAAK,SAAS,IAAI,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,uBAAuB;YAAE,OAAO,KAAK,CAAC;QAC7H,OAAO,IAAI,CAAC;IACd,CAAC;IACD,SAAS,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACpG,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO;YACL,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,uBAAuB,EAAE,CAAC,CAAC,uBAAuB,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;YACjO,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,oBAAoB,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;YACnF,WAAW,CAAC,CAAC,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACnE,WAAW,CAAC,CAAC,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,yBAAyB,EAAE,cAAc,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC;SAClI,CAAC;IACJ,CAAC;IACD,WAAW,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC7B,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,GAAG,mBAAmB,CAC3F,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAC5H,GAAG,CAAC,KAAY,CACqC,CAAC;QACxD,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,oBAAoB,CAAC,EAAE,CAAC,KAAY,CAAC,CAAC;QACzE,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,CAAC,SAAS,CAAC;YACpB,SAAS,EAAE,CAAC,KAAK,CAAC;YAClB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE,EAAE,uBAAuB,EAAE,SAAS,EAAE,aAAa,EAAE;YACnJ,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;SAC/D,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,SAAS,SAAS,CAAC,CAAS;IAC1B,MAAM,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAG,2DAA2D;IACrG,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,EAAE,CAAC,CAAC;IACnE,OAAO,CAAC,CAAC,CAAC,CAAY,CAAC;AACzB,CAAC;AAED,+GAA+G;AAC/G,EAAE;AACF,6GAA6G;AAC7G,oGAAoG;AACpG,+GAA+G;AAC/G,gHAAgH;AAChH,iHAAiH;AACjH,iHAAiH;AACjH,EAAE;AACF,4GAA4G;AAC5G,8GAA8G;AAC9G,gHAAgH;AAEhH,MAAM,CAAC,MAAM,qBAAqB,GAAG,+BAA+B,CAAC;AACrE,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAI5D,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,IAAY,EAAY,EAAE;IAClD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAY,CAAC;YAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC;IAC1K,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,iBAAiB,CAAC,CAAC;AACzE,CAAC,CAAC;AAEF,SAAS,kBAAkB,CAAC,GAAyB;IACnD,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,EAAE,CAAC;IAC7R,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oGAAoG,CAAC,CAAC;IAC7M,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,gBAAgB;QAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,8BAA8B,CAAC,CAAC;IACjK,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAyB;IACvD,IAAI,EAAE,qBAAqB;IAC3B,4GAA4G;IAC5G,mBAAmB,EAAE,IAAI;IACzB,+GAA+G;IAC/G,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC,2BAA2B,CAAC;IACpD,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC;IAC9B,UAAU,CAAC,IAAI;QACb,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,EAAE,aAAa,CAAU,EAAE,CAAC;YACxE,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,8CAA8C,CAAC,CAAC;QACrI,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,gBAAgB,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;IACtJ,CAAC;IACD,QAAQ,CAAC,KAAK,EAAE,MAAM;QACpB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,QAAQ,IAAI,EAAE,EAAE,WAAW,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE,CAAC,gBAAgB,IAAI,EAAE,CAAC,eAAe,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,YAAY,IAAI,EAAE,CAAC,WAAW,IAAI,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC;QACnQ,6GAA6G;QAC7G,wGAAwG;QACxG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACxE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACtF,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9E,IAAI,EAAE,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,CAAC,gBAAgB,KAAK,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,gBAAgB;YAAE,OAAO,KAAK,CAAC;QACpI,OAAO,IAAI,CAAC;IACd,CAAC;IACD,SAAS,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO;YACL,4BAA4B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAyB,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC;YAC3K,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,oBAAoB,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;YACnF,WAAW,CAAC,CAAC,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,cAAc,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;YACnG,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC;SAC3C,CAAC;IACJ,CAAC;IACD,WAAW,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,CAAC,GAAG,4BAA4B,CAAC,KAAK,CAAC,KAAY,CAAC,CAAC;QAC3D,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,oBAAoB,CAAC,EAAE,CAAC,KAAY,CAAC,CAAC;QACzE,OAAO;YACL,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,CAAC,SAAS,CAAC;YACpB,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE;YAC5L,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;SAC/D,CAAC;IACJ,CAAC;CACF,CAAC;AAEF;2FAC2F;AAC3F,MAAM,CAAC,MAAM,uBAAuB,GAA8C,IAAI,GAAG,CAAC;IACxF,CAAC,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAC3C,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC;IACrC,CAAC,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,CAAC;CAChD,CAAC,CAAC;AAEH,iGAAiG;AACjG,IAAI,UAAU,GAAG,KAAK,CAAC;AACvB,MAAM,UAAU,6BAA6B;IAC3C,IAAI,UAAU;QAAE,OAAO;IACvB,qBAAqB,CAAC,iBAAiB,CAAC,CAAC;IACzC,qBAAqB,CAAC,cAAc,CAAC,CAAC;IACtC,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;IAC3C,UAAU,GAAG,IAAI,CAAC;AACpB,CAAC;AACD,qDAAqD;AACrD,MAAM,UAAU,yBAAyB,KAAW,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC"}
|
package/dist/mandate.d.ts
CHANGED
|
@@ -48,6 +48,15 @@ export interface MandateRequirementV1 {
|
|
|
48
48
|
* WHERE) but it is what makes the authority honest about WHAT it does, and the card can name it.
|
|
49
49
|
*/
|
|
50
50
|
methods?: Hex[];
|
|
51
|
+
/**
|
|
52
|
+
* Spec 445 / generation 4 / B1 (audit DLG-3) — HOW MANY ON-CHAIN REDEMPTIONS THIS MANDATE COVERS, signed into
|
|
53
|
+
* every digest binding's terms (`DigestBindingEnforcer`: the (N+1)-th redemption reverts `UsesExhausted`,
|
|
54
|
+
* whatever step nonce it brings). Count one per plan step whose capability `redeemsOnChain`, TIMES the calls
|
|
55
|
+
* that step makes. Absent ⇒ ONE (the 64-byte single-use terms) — never inferred larger. Intent, projection,
|
|
56
|
+
* offer and plan bindings all carry the same number (each counts the same redemptions). Only for a generation-4
|
|
57
|
+
* estate: an older enforcer bounds nothing by count.
|
|
58
|
+
*/
|
|
59
|
+
maxRedemptions?: number;
|
|
51
60
|
}
|
|
52
61
|
/** RFC 8785 JCS → keccak256. The ONE way an intent digest is computed, so grantor, verifier and receipt
|
|
53
62
|
* cannot disagree about which bytes were bound. */
|
|
@@ -104,6 +113,11 @@ export interface MandateSubsetHandler {
|
|
|
104
113
|
* `isSubset` (the payment handler bounds the PaymentEnforcer's payee/asset/amount itself). Those are
|
|
105
114
|
* recorded `judged-by-handler`, never `enforced-on-chain`. Default: none. */
|
|
106
115
|
judgesEnforcers?(enforcers: EnforcerAddresses): Address[];
|
|
116
|
+
/** Spec 445 / AUTH-5 — A MANDATE OF THIS TYPE IS A SCOPE ANSWERED PER CHALLENGE, not one act. Declared only by
|
|
117
|
+
* the presentation type: each signature answers a fresh, audience-bound challenge the VENUE minted, so the
|
|
118
|
+
* same mandate legitimately covers many statements and a replayed one yields a signature over a challenge the
|
|
119
|
+
* venue already spent. Every other type is single-use per step off chain (`MandateUseLedger`). Default: false. */
|
|
120
|
+
answersPerChallenge?: true;
|
|
107
121
|
}
|
|
108
122
|
/** The handlers a verification consults. Passed EXPLICITLY (`SubsetHandlers`) wherever possible: the
|
|
109
123
|
* ambient registry below is module-level state, and a bundle that ends up with two copies of this
|
|
@@ -178,7 +192,47 @@ export interface MandateStep {
|
|
|
178
192
|
* Only then may a caveat with no off-chain judge be recorded `enforced-on-chain`; every other step is
|
|
179
193
|
* judged strictly. Declared by the tool (`ToolSpec.capability.redeemsOnChain`), never by the planner. */
|
|
180
194
|
redeemsOnChain?: boolean;
|
|
195
|
+
/** Spec 445 / AUTH-5 — THIS USE, for a step that does not redeem on chain: `operation` is the step's LOGICAL
|
|
196
|
+
* request identity (its declared idempotency key, else its stable step ref — the same value
|
|
197
|
+
* `digestBindingStepNonce` takes on chain; never a run id, or every new run would be a new use) and `holder`
|
|
198
|
+
* is the run using it (so a resume or retry of the SAME run re-verifies; another run is refused). */
|
|
199
|
+
use?: {
|
|
200
|
+
operation: string;
|
|
201
|
+
holder: string;
|
|
202
|
+
};
|
|
203
|
+
/** Spec 445 / generation 4 / B1 (audit DLG-2) — THE CONTRACT THE REDEMPTION CALLS (the `target` passed to
|
|
204
|
+
* `DelegationManager.redeemDelegation`), when the step redeems and the caller knows it. Distinct from `resource`,
|
|
205
|
+
* which is the agent acted FOR (what `allowedTargets` was encoded against). When given and equal to the chain's
|
|
206
|
+
* ROOT delegator, the step is refused `self-target`, exactly as the manager reverts `SelfTargetedRedemption`:
|
|
207
|
+
* a redemption that makes the delegator's own account call itself (`executeBatch`) escapes every caveat. */
|
|
208
|
+
callTarget?: Address;
|
|
181
209
|
}
|
|
210
|
+
/** The manager's rule, off chain (spec 445 / DLG-2): a redemption whose call target is the ROOT delegator of the
|
|
211
|
+
* chain (leaf first, so the last link's delegator) is refused. An intermediate link's delegator is an ordinary
|
|
212
|
+
* target. `DelegationManager.verifyAuthorizationForCall` answers `(false, "self-target")` for the same input. */
|
|
213
|
+
export declare function isSelfTargetedRedemption(chainLeafFirst: readonly Pick<Delegation, 'delegator'>[], target: Address): boolean;
|
|
214
|
+
/** The reason string the chain's `verifyAuthorizationForCall` returns for a self-targeted call. */
|
|
215
|
+
export declare const SELF_TARGET_REASON = "self-target";
|
|
216
|
+
/**
|
|
217
|
+
* Spec 445 / AUTH-5 (the single-use half of R917-P-3) — THE OFF-CHAIN TWIN OF THE ENFORCER NONCE.
|
|
218
|
+
* On chain a step's redemption is consumed under (delegator, delegationHash, kind, stepNonce). A step that
|
|
219
|
+
* never redeems had no such record: the same mandate + intent + plan verified again in any new run until
|
|
220
|
+
* `validUntil`, re-executing messages, records, credential issuance. This port is that record.
|
|
221
|
+
*
|
|
222
|
+
* `claim` MUST be atomic and durable across every process that verifies for this agent (a per-isolate map is
|
|
223
|
+
* not a ledger). It returns true when `holder` is the FIRST to claim (mandateRef, stepNonce) or already holds
|
|
224
|
+
* it, false when another holder does. A throw is a refusal.
|
|
225
|
+
*/
|
|
226
|
+
export interface MandateUseLedger {
|
|
227
|
+
claim(use: {
|
|
228
|
+
mandateRef: Hex;
|
|
229
|
+
stepNonce: Hex;
|
|
230
|
+
holder: string;
|
|
231
|
+
}): Promise<boolean>;
|
|
232
|
+
}
|
|
233
|
+
/** A single-process ledger for tests and one-process tools. NOT a deployment's ledger: it forgets on restart
|
|
234
|
+
* and is not shared between isolates. */
|
|
235
|
+
export declare function createMemoryMandateUseLedger(): MandateUseLedger;
|
|
182
236
|
export interface VerifyMandateInput {
|
|
183
237
|
/** The wire the caller presented. */
|
|
184
238
|
presented: Delegation;
|
|
@@ -198,6 +252,9 @@ export interface VerifyMandateInput {
|
|
|
198
252
|
* compiled definition is refused (`version-moved`, naming which). Absent ⇒ the intent is digested as
|
|
199
253
|
* presented (a runtime that has not adopted version binding). */
|
|
200
254
|
currentVersions?: VersionBindingV1;
|
|
255
|
+
/** Spec 445 / AUTH-5 — the single-use record. REQUIRED for every step that does not redeem on chain (with
|
|
256
|
+
* `step.use`): absent ⇒ `single-use-unrecorded`, a denial. There is no knob that waives it. */
|
|
257
|
+
uses?: MandateUseLedger;
|
|
201
258
|
}
|
|
202
259
|
export interface DecisionReason {
|
|
203
260
|
code: string;
|
|
@@ -253,13 +310,61 @@ export type MandateDecision = {
|
|
|
253
310
|
* 4. the step's capability selector satisfies allowedMethods, and its value the value cap — STRICTLY
|
|
254
311
|
* (spec 408 §2.2): a caveat no off-chain judge can answer denies, unless the step redeems on chain
|
|
255
312
|
* (`redeemsOnChain`, where the enforcer fires) or the type handler declares it judges that caveat;
|
|
256
|
-
* 5. the handler's type-specific limits admit the step's args
|
|
313
|
+
* 5. the handler's type-specific limits admit the step's args;
|
|
314
|
+
* 6. the use is recorded (spec 445 / AUTH-5): a step that does not redeem on chain claims
|
|
315
|
+
* (mandateRef, stepNonce) in the `MandateUseLedger` — required, and a second run's claim is refused.
|
|
316
|
+
*
|
|
317
|
+
* THIS JUDGES ONE LINK — the presented one. A mandate whose `authority` names a parent is authority only
|
|
318
|
+
* together with `verifyAuthorityChain`, which judges the SAME step against every link above it and requires
|
|
319
|
+
* child ⊆ parent (spec 445 §3.1). The harness composition and the presentation release run both; a caller
|
|
320
|
+
* that runs only this one on a child has verified what the child's own signer wrote.
|
|
257
321
|
*
|
|
258
322
|
* Obligations are NOT decided here — they come from policy (spec 350 §3.4) and are attached by the
|
|
259
323
|
* `MandateVerifier` port implementation that composes this with a `PolicyEvaluator`. This function
|
|
260
324
|
* answers one question: is the authority present and does it cover the step.
|
|
261
325
|
*/
|
|
262
326
|
export declare function verifyMandateForStep(input: VerifyMandateInput): Promise<MandateDecision>;
|
|
327
|
+
/** The digest of the intent THIS step acts under — recomputed under the versions the verifier runs with
|
|
328
|
+
* (spec 410 §5) when given. One definition, so the leaf and its parents are compared to the same bytes. */
|
|
329
|
+
export declare function stepIntentDigest(step: MandateStep, currentVersions?: VersionBindingV1): Hex;
|
|
330
|
+
/** The call TARGET a step's `allowedTargets` caveats are judged against: the step's resource (the agent being
|
|
331
|
+
* acted for, or the asset contract of a payment), else the LEAF's delegator. Computed once from the leaf and
|
|
332
|
+
* used for every link — a parent is not judged against a kinder target than its child. */
|
|
333
|
+
export declare function stepTarget(step: MandateStep, leaf: Delegation): Address;
|
|
334
|
+
/** What a link GRANTS, read by the type's handler — a mandate (intent-bound) or a standing wire (none). Null
|
|
335
|
+
* when the link does not decode as `type`, or its terms cannot be read: unreadable is never "unbounded". */
|
|
336
|
+
export declare function readGrant(d: Delegation, type: string, enforcers: EnforcerAddresses, from?: SubsetHandlers): (Omit<MandateRequirementV1, 'intentDigest'> & {
|
|
337
|
+
intentDigest?: Hex;
|
|
338
|
+
}) | null;
|
|
339
|
+
export interface JudgeLinkInput {
|
|
340
|
+
link: Delegation;
|
|
341
|
+
requirementType: string;
|
|
342
|
+
step: MandateStep;
|
|
343
|
+
/** `stepTarget(step, leaf)` — the same for every link of one chain. */
|
|
344
|
+
target: Address;
|
|
345
|
+
/** `stepIntentDigest(step, currentVersions)` — the same for every link of one chain. */
|
|
346
|
+
digestOfIntent: Hex;
|
|
347
|
+
enforcers: EnforcerAddresses;
|
|
348
|
+
now: number;
|
|
349
|
+
handlers?: SubsetHandlers;
|
|
350
|
+
/** The LEAF must decode as a mandate of the type (`not-a-mandate` otherwise). A PARENT may be a standing
|
|
351
|
+
* wire, or a wire of another shape: its caveats are still judged strictly, with no handler to vouch for
|
|
352
|
+
* any of them. */
|
|
353
|
+
mustBeMandate: boolean;
|
|
354
|
+
}
|
|
355
|
+
/**
|
|
356
|
+
* Is this step within THIS link? The caveats, strictly, against the step (capability selector, target, value,
|
|
357
|
+
* intent / offer / projection / plan digests, payload classes), then the handler's type-specific limits
|
|
358
|
+
* (amount and payee; audience, predicate program and issuer facet).
|
|
359
|
+
*
|
|
360
|
+
* STRICT means: a caveat no off-chain judge can answer DENIES — unless the step redeems on chain
|
|
361
|
+
* (`redeemsOnChain`, where every link's enforcer fires and the chain itself holds the parent) or the type
|
|
362
|
+
* handler compares that caveat's terms itself, which it can only do for a link that decodes as its type.
|
|
363
|
+
*/
|
|
364
|
+
export declare function judgeLinkForStep(input: JudgeLinkInput): {
|
|
365
|
+
verdicts: DecisionEvidence['verdicts'];
|
|
366
|
+
denial: DecisionReason | null;
|
|
367
|
+
};
|
|
263
368
|
export { ROOT_AUTHORITY };
|
|
264
369
|
export type { DigestBindingKind };
|
|
265
370
|
//# sourceMappingURL=mandate.d.ts.map
|
package/dist/mandate.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"mandate.d.ts","sourceRoot":"","sources":["../src/mandate.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"mandate.d.ts","sourceRoot":"","sources":["../src/mandate.ts"],"names":[],"mappings":"AAuBA,OAAO,EAA4B,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAE1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAElF,OAAO,EAAwC,KAAK,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEjH,OAAO,EAA+F,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACnJ,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAI5C;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;IACzC,+GAA+G;IAC/G,YAAY,EAAE,GAAG,CAAC;IAClB,+FAA+F;IAC/F,gBAAgB,CAAC,EAAE,GAAG,CAAC;IACvB,iFAAiF;IACjF,WAAW,CAAC,EAAE,GAAG,CAAC;IAClB;;;iGAG6F;IAC7F,UAAU,CAAC,EAAE,GAAG,CAAC;IACjB;uHACmH;IACnH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,oBAAoB;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IAChB;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;oDACoD;AACpD,wBAAgB,YAAY,CAAC,MAAM,EAAE,OAAO,GAAG,GAAG,CAEjD;AAYD;;;iHAGiH;AACjH,MAAM,WAAW,gBAAgB;IAC/B,sBAAsB,EAAE,GAAG,CAAC;IAC5B,eAAe,EAAE,GAAG,CAAC;IACrB;;oGAEgG;IAChG,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,6GAA6G;AAC7G,eAAO,MAAM,mBAAmB,EAA6B,GAAG,CAAC;AAEjE,gHAAgH;AAChH,wBAAgB,YAAY,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,gBAAgB,GAAG,CAAC,GAAG;IAAE,QAAQ,EAAE,gBAAgB,CAAA;CAAE,CAIxH;AAED,0FAA0F;AAC1F,wBAAgB,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,gBAAgB,GAAG,IAAI,CAKnE;AAID,mEAAmE;AACnE,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG;IAAE,aAAa,EAAE,OAAO,CAAA;CAAE,CAAC;AAEhF;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,QAAQ,CAAC,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC;IAC7E,+GAA+G;IAC/G,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,SAAS,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAAC;IAC7E,kGAAkG;IAClG,WAAW,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,iBAAiB,GAAG,IAAI,CAAC,oBAAoB,EAAE,cAAc,GAAG,kBAAkB,GAAG,aAAa,CAAC,GAAG,IAAI,CAAC;IAC9J;;;sGAGkG;IAClG,UAAU,CAAC,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;IAChE;;;+EAG2E;IAC3E,WAAW,CAAC,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,CAAC;IAC1C;;;;kFAI8E;IAC9E,eAAe,CAAC,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,EAAE,CAAC;IAC1D;;;uHAGmH;IACnH,mBAAmB,CAAC,EAAE,IAAI,CAAC;CAC5B;AAED;;;sFAGsF;AACtF,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;AAIvE,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAGnE;AACD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,cAAyB,GAAG,oBAAoB,GAAG,IAAI,CAE3G;AACD,iBAAiB;AACjB,wBAAgB,oBAAoB,IAAI,IAAI,CAAsB;AAElE;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAgB/F;AAID,MAAM,WAAW,kBAAkB;IACjC,wGAAwG;IACxG,MAAM,EAAE,UAAU,CAAC;IACnB;kCAC8B;IAC9B,iBAAiB,EAAE,oBAAoB,CAAC;IACxC,mFAAmF;IACnF,WAAW,EAAE,oBAAoB,CAAC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,GACjD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,mBAAmB,CA0B5E;AAED;gEACgE;AAChE,wBAAgB,WAAW,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,oBAAoB,GAAG,IAAI,CAQzI;AAWD,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B;+CAC2C;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yGAAyG;IACzG,MAAM,EAAE,OAAO,CAAC;IAChB,oFAAoF;IACpF,gBAAgB,CAAC,EAAE,GAAG,CAAC;IACvB,WAAW,CAAC,EAAE,GAAG,CAAC;IAClB;iFAC6E;IAC7E,UAAU,CAAC,EAAE,GAAG,CAAC;IACjB,iHAAiH;IACjH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B;mEAC+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;8GAE0G;IAC1G,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;0GAGsG;IACtG,GAAG,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C;;;;iHAI6G;IAC7G,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;kHAEkH;AAClH,wBAAgB,wBAAwB,CAAC,cAAc,EAAE,SAAS,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAI3H;AAED,mGAAmG;AACnG,eAAO,MAAM,kBAAkB,gBAAgB,CAAC;AAEhD;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,GAAG,EAAE;QAAE,UAAU,EAAE,GAAG,CAAC;QAAC,SAAS,EAAE,GAAG,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnF;AAED;0CAC0C;AAC1C,wBAAgB,4BAA4B,IAAI,gBAAgB,CAU/D;AAED,MAAM,WAAW,kBAAkB;IACjC,qCAAqC;IACrC,SAAS,EAAE,UAAU,CAAC;IACtB,6FAA6F;IAC7F,eAAe,EAAE,MAAM,CAAC;IACxB,8CAA8C;IAC9C,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,MAAM,EAAE,yBAAyB,CAAC;IAClC,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,qGAAqG;IACrG,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B;;;sEAGkE;IAClE,eAAe,CAAC,EAAE,gBAAgB,CAAC;IACnC;oGACgG;IAChG,IAAI,CAAC,EAAE,gBAAgB,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAEjE,uGAAuG;AACvG,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,uBAAuB,GAAG,QAAQ,GAAG,qBAAqB,GAAG,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAChG,eAAe,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3E,mGAAmG;IACnG,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,GAAG,CAAC;IAChB,YAAY,EAAE,GAAG,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,sFAAsF;IACtF,QAAQ,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1E;gHAC4G;IAC5G,KAAK,CAAC,EAAE,OAAO,sBAAsB,EAAE,gBAAgB,CAAC;CACzD;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GAC5E;IAAE,QAAQ,EAAE,mBAAmB,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GACxF;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,cAAc,EAAE,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAIhF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,eAAe,CAAC,CA+E9F;AASD;4GAC4G;AAC5G,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,EAAE,eAAe,CAAC,EAAE,gBAAgB,GAAG,GAAG,CAE3F;AAED;;2FAE2F;AAC3F,wBAAgB,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAEvE;AAED;6GAC6G;AAC7G,wBAAgB,SAAS,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,cAAc,CAAC,GAAG;IAAE,YAAY,CAAC,EAAE,GAAG,CAAA;CAAE,CAAC,GAAG,IAAI,CASxL;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,WAAW,CAAC;IAClB,uEAAuE;IACvE,MAAM,EAAE,OAAO,CAAC;IAChB,wFAAwF;IACxF,cAAc,EAAE,GAAG,CAAC;IACpB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B;;uBAEmB;IACnB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,cAAc,GAAG;IAAE,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAA;CAAE,CA4EjI;AAsBD,OAAO,EAAE,cAAc,EAAE,CAAC;AAC1B,YAAY,EAAE,iBAAiB,EAAE,CAAC"}
|
package/dist/mandate.js
CHANGED
|
@@ -12,9 +12,12 @@
|
|
|
12
12
|
// • the subset-handler registry — RFC 9396 is explicit that NO universal "narrower-than" exists across
|
|
13
13
|
// authorization-detail types, so each `type` registers its own `isSubset` / `toCaveats` / `fromCaveats`.
|
|
14
14
|
// • `deriveMandate` — a child delegation from a standing one. It refuses EARLY (via the handler) so a
|
|
15
|
-
// doomed child is never signed
|
|
16
|
-
// the parent's
|
|
17
|
-
//
|
|
15
|
+
// doomed child is never signed. That refusal is a courtesy to the honest minter and NOTHING MORE: the
|
|
16
|
+
// holder of the parent's delegate key is free not to call this function and to sign any child it likes.
|
|
17
|
+
// Attenuation is therefore enforced where the chain is USED — on chain, DelegationManager runs every
|
|
18
|
+
// link's enforcers at redemption; off chain, `verifyAuthorityChain` judges the step against every link
|
|
19
|
+
// and requires child ⊆ parent per adjacent pair (spec 445 §3.1). Before spec 445 this comment said the
|
|
20
|
+
// chain "would refuse it anyway"; for a step that never redeems, nothing did (audit H-7 / AUTH-1).
|
|
18
21
|
// • `verifyMandateForStep` — THE per-step check. Called before every consequential step of a run, never
|
|
19
22
|
// once at admission, so a revocation between step 2 and step 3 stops step 3. Returns a decision with
|
|
20
23
|
// reasons; it never falls back to a weaker check (ADR-0013).
|
|
@@ -23,7 +26,7 @@ import { jcsCanonicalize } from '@agenticprimitives/types';
|
|
|
23
26
|
import { hashDelegation } from './hash.js';
|
|
24
27
|
import { verifyLiveDelegation, methodSelector } from './method-authorization.js';
|
|
25
28
|
import { evaluateCaveats } from './evaluator.js';
|
|
26
|
-
import { buildDigestBindingCaveat, readDigestBindings } from './caveats.js';
|
|
29
|
+
import { buildDigestBindingCaveat, readDigestBindings, readDigestBindingUses, digestBindingStepNonce } from './caveats.js';
|
|
27
30
|
import { ROOT_AUTHORITY } from './types.js';
|
|
28
31
|
/** RFC 8785 JCS → keccak256. The ONE way an intent digest is computed, so grantor, verifier and receipt
|
|
29
32
|
* cannot disagree about which bytes were bound. */
|
|
@@ -81,6 +84,9 @@ export function baseIsSubset(child, parent) {
|
|
|
81
84
|
return false;
|
|
82
85
|
if (child.validUntil > parent.validUntil)
|
|
83
86
|
return false;
|
|
87
|
+
// Spec 445 / DLG-3 — a parent that states a redemption count bounds the child's (absent on the child ⇒ one).
|
|
88
|
+
if (parent.maxRedemptions !== undefined && (child.maxRedemptions ?? 1) > parent.maxRedemptions)
|
|
89
|
+
return false;
|
|
84
90
|
return true;
|
|
85
91
|
}
|
|
86
92
|
/**
|
|
@@ -96,12 +102,16 @@ export function deriveMandate(input) {
|
|
|
96
102
|
if (!h.isSubset(input.requirement, input.parentRequirement)) {
|
|
97
103
|
return { ok: false, reason: `requested authority is not a subset of the parent's (${h.type})` };
|
|
98
104
|
}
|
|
105
|
+
// Spec 445 / DLG-3 — the redemption count the requirement states, on every binding; absent ⇒ single use.
|
|
106
|
+
const n = input.requirement.maxRedemptions;
|
|
107
|
+
if (n !== undefined && (!Number.isSafeInteger(n) || n < 1))
|
|
108
|
+
return { ok: false, reason: `maxRedemptions must be an integer >= 1 (got ${String(n)})` };
|
|
99
109
|
const caveats = [
|
|
100
110
|
...h.toCaveats(input.requirement, input.enforcers),
|
|
101
|
-
buildDigestBindingCaveat(input.enforcers.digestBinding, 'intent', input.requirement.intentDigest),
|
|
102
|
-
...(input.requirement.projectionDigest ? [buildDigestBindingCaveat(input.enforcers.digestBinding, 'projection', input.requirement.projectionDigest)] : []),
|
|
103
|
-
...(input.requirement.offerDigest ? [buildDigestBindingCaveat(input.enforcers.digestBinding, 'offer', input.requirement.offerDigest)] : []),
|
|
104
|
-
...(input.requirement.planDigest ? [buildDigestBindingCaveat(input.enforcers.digestBinding, 'plan', input.requirement.planDigest)] : []),
|
|
111
|
+
buildDigestBindingCaveat(input.enforcers.digestBinding, 'intent', input.requirement.intentDigest, n),
|
|
112
|
+
...(input.requirement.projectionDigest ? [buildDigestBindingCaveat(input.enforcers.digestBinding, 'projection', input.requirement.projectionDigest, n)] : []),
|
|
113
|
+
...(input.requirement.offerDigest ? [buildDigestBindingCaveat(input.enforcers.digestBinding, 'offer', input.requirement.offerDigest, n)] : []),
|
|
114
|
+
...(input.requirement.planDigest ? [buildDigestBindingCaveat(input.enforcers.digestBinding, 'plan', input.requirement.planDigest, n)] : []),
|
|
105
115
|
];
|
|
106
116
|
const delegation = {
|
|
107
117
|
delegator: input.parent.delegate, // the party attenuating ITS authority onward
|
|
@@ -125,7 +135,40 @@ export function readMandate(d, type, enforcers, from) {
|
|
|
125
135
|
const base = h.fromCaveats(d.caveats, enforcers);
|
|
126
136
|
if (!base)
|
|
127
137
|
return null;
|
|
128
|
-
return { ...base, intentDigest: bindings.intent, ...(bindings.projection ? { projectionDigest: bindings.projection } : {}), ...(bindings.offer ? { offerDigest: bindings.offer } : {}), ...(bindings.plan ? { planDigest: bindings.plan } : {}) };
|
|
138
|
+
return { ...base, intentDigest: bindings.intent, ...(bindings.projection ? { projectionDigest: bindings.projection } : {}), ...(bindings.offer ? { offerDigest: bindings.offer } : {}), ...(bindings.plan ? { planDigest: bindings.plan } : {}), ...redemptionsOf(d, enforcers) };
|
|
139
|
+
}
|
|
140
|
+
/** The signed redemption count, as a requirement field: present only when it is above one (64-byte terms and a
|
|
141
|
+
* 96-byte one stating 1 both read as single use, so a round trip of a single-use requirement is unchanged). */
|
|
142
|
+
function redemptionsOf(d, enforcers) {
|
|
143
|
+
const n = readDigestBindingUses(d.caveats, enforcers.digestBinding).intent;
|
|
144
|
+
return n !== undefined && n > 1 ? { maxRedemptions: n } : {};
|
|
145
|
+
}
|
|
146
|
+
/** The manager's rule, off chain (spec 445 / DLG-2): a redemption whose call target is the ROOT delegator of the
|
|
147
|
+
* chain (leaf first, so the last link's delegator) is refused. An intermediate link's delegator is an ordinary
|
|
148
|
+
* target. `DelegationManager.verifyAuthorizationForCall` answers `(false, "self-target")` for the same input. */
|
|
149
|
+
export function isSelfTargetedRedemption(chainLeafFirst, target) {
|
|
150
|
+
const root = chainLeafFirst[chainLeafFirst.length - 1];
|
|
151
|
+
if (!root)
|
|
152
|
+
return false;
|
|
153
|
+
return root.delegator.toLowerCase() === target.toLowerCase();
|
|
154
|
+
}
|
|
155
|
+
/** The reason string the chain's `verifyAuthorizationForCall` returns for a self-targeted call. */
|
|
156
|
+
export const SELF_TARGET_REASON = 'self-target';
|
|
157
|
+
/** A single-process ledger for tests and one-process tools. NOT a deployment's ledger: it forgets on restart
|
|
158
|
+
* and is not shared between isolates. */
|
|
159
|
+
export function createMemoryMandateUseLedger() {
|
|
160
|
+
const held = new Map();
|
|
161
|
+
return {
|
|
162
|
+
async claim({ mandateRef, stepNonce, holder }) {
|
|
163
|
+
const k = `${mandateRef.toLowerCase()}:${stepNonce.toLowerCase()}`;
|
|
164
|
+
const h = held.get(k);
|
|
165
|
+
if (h === undefined) {
|
|
166
|
+
held.set(k, holder);
|
|
167
|
+
return true;
|
|
168
|
+
}
|
|
169
|
+
return h === holder;
|
|
170
|
+
},
|
|
171
|
+
};
|
|
129
172
|
}
|
|
130
173
|
const lc = (s) => s.toLowerCase();
|
|
131
174
|
/**
|
|
@@ -140,7 +183,14 @@ const lc = (s) => s.toLowerCase();
|
|
|
140
183
|
* 4. the step's capability selector satisfies allowedMethods, and its value the value cap — STRICTLY
|
|
141
184
|
* (spec 408 §2.2): a caveat no off-chain judge can answer denies, unless the step redeems on chain
|
|
142
185
|
* (`redeemsOnChain`, where the enforcer fires) or the type handler declares it judges that caveat;
|
|
143
|
-
* 5. the handler's type-specific limits admit the step's args
|
|
186
|
+
* 5. the handler's type-specific limits admit the step's args;
|
|
187
|
+
* 6. the use is recorded (spec 445 / AUTH-5): a step that does not redeem on chain claims
|
|
188
|
+
* (mandateRef, stepNonce) in the `MandateUseLedger` — required, and a second run's claim is refused.
|
|
189
|
+
*
|
|
190
|
+
* THIS JUDGES ONE LINK — the presented one. A mandate whose `authority` names a parent is authority only
|
|
191
|
+
* together with `verifyAuthorityChain`, which judges the SAME step against every link above it and requires
|
|
192
|
+
* child ⊆ parent (spec 445 §3.1). The harness composition and the presentation release run both; a caller
|
|
193
|
+
* that runs only this one on a child has verified what the child's own signer wrote.
|
|
144
194
|
*
|
|
145
195
|
* Obligations are NOT decided here — they come from policy (spec 350 §3.4) and are attached by the
|
|
146
196
|
* `MandateVerifier` port implementation that composes this with a `PolicyEvaluator`. This function
|
|
@@ -150,7 +200,7 @@ export async function verifyMandateForStep(input) {
|
|
|
150
200
|
const d = input.presented;
|
|
151
201
|
// Spec 410 §5 — recompute under the versions this verifier RUNS WITH, never the ones the intent states.
|
|
152
202
|
const cur = input.currentVersions;
|
|
153
|
-
const digestOfIntent =
|
|
203
|
+
const digestOfIntent = stepIntentDigest(input.step, cur);
|
|
154
204
|
const evidence = {
|
|
155
205
|
mandateRef: input.checks.delegationDigest(d),
|
|
156
206
|
intentDigest: digestOfIntent,
|
|
@@ -161,6 +211,11 @@ export async function verifyMandateForStep(input) {
|
|
|
161
211
|
// 1. actor
|
|
162
212
|
if (lc(d.delegate) !== lc(input.actor))
|
|
163
213
|
return deny('actor-not-delegate', 'the acting party is not the mandate\'s delegate');
|
|
214
|
+
// 1b. Spec 445 / DLG-2 — a ROOT mandate's delegator is the chain's root: a call back into it is refused before any
|
|
215
|
+
// caveat is read, as the manager refuses it. (A child's root is judged by `verifyAuthorityChain`.)
|
|
216
|
+
if (input.step.callTarget && d.authority.toLowerCase() === ROOT_AUTHORITY.toLowerCase() && isSelfTargetedRedemption([d], input.step.callTarget)) {
|
|
217
|
+
return deny(SELF_TARGET_REASON, 'the redemption would make the delegator\'s own account call itself — the DelegationManager refuses a self-targeted redemption (SelfTargetedRedemption)');
|
|
218
|
+
}
|
|
164
219
|
// 2. live
|
|
165
220
|
const live = await verifyLiveDelegation({ delegation: d, expectedDelegate: input.actor, enforcers: input.enforcers, checks: input.checks, now: input.now });
|
|
166
221
|
if (!live.ok)
|
|
@@ -197,21 +252,98 @@ export async function verifyMandateForStep(input) {
|
|
|
197
252
|
if (bindings.plan && (!input.step.planDigest || lc(bindings.plan) !== lc(input.step.planDigest))) {
|
|
198
253
|
return deny('plan-mismatch', input.step.planDigest ? 'the mandate was granted over a different plan for this intent' : 'the mandate binds a plan and this step presents none');
|
|
199
254
|
}
|
|
200
|
-
// The
|
|
255
|
+
// 4 + 5. The caveats against the step, strictly, and the handler's type-specific limits — the SAME judgement
|
|
256
|
+
// `verifyAuthorityChain` applies to every parent of this leaf (spec 445 §3.1), so a link is never held to a
|
|
257
|
+
// different step than the one above or below it.
|
|
258
|
+
const judged = judgeLinkForStep({
|
|
259
|
+
link: d, requirementType: input.requirementType, step: input.step, target: stepTarget(input.step, d),
|
|
260
|
+
digestOfIntent, enforcers: input.enforcers, now: input.now, handlers: input.handlers, mustBeMandate: true,
|
|
261
|
+
});
|
|
262
|
+
evidence.verdicts = judged.verdicts;
|
|
263
|
+
if (judged.denial)
|
|
264
|
+
return deny(judged.denial.code, judged.denial.message);
|
|
265
|
+
// 6. SINGLE USE (spec 445 / AUTH-5) — last, so a step refused for any other reason spends nothing. A step
|
|
266
|
+
// that redeems on chain is consumed THERE (the enforcer nonce); a presentation answers the venue's challenge;
|
|
267
|
+
// every other step is recorded here or it does not run.
|
|
268
|
+
if (input.step.redeemsOnChain !== true && subsetHandlerFor(input.requirementType, input.handlers)?.answersPerChallenge !== true) {
|
|
269
|
+
const use = input.step.use;
|
|
270
|
+
if (!input.uses || !use || typeof use.operation !== 'string' || !use.operation || typeof use.holder !== 'string' || !use.holder) {
|
|
271
|
+
return deny('single-use-unrecorded', 'this step does not redeem on chain, so its single use must be recorded off chain — the verifier was given no use ledger, or the step no operation and holder; a mandate nobody counts is not single-use');
|
|
272
|
+
}
|
|
273
|
+
let claimed = false;
|
|
274
|
+
try {
|
|
275
|
+
claimed = (await input.uses.claim({ mandateRef: evidence.mandateRef, stepNonce: digestBindingStepNonce(digestOfIntent, use.operation), holder: use.holder })) === true;
|
|
276
|
+
}
|
|
277
|
+
catch (e) {
|
|
278
|
+
return deny('single-use-unrecorded', `the use ledger could not record this step (${e instanceof Error ? e.message : 'unavailable'}) — refused rather than run uncounted`);
|
|
279
|
+
}
|
|
280
|
+
if (!claimed)
|
|
281
|
+
return deny('mandate-already-used', 'this mandate was already used for this step by another run — a mandate authorizes each step once');
|
|
282
|
+
}
|
|
283
|
+
return { decision: 'allow', obligations: [], evidence };
|
|
284
|
+
}
|
|
285
|
+
// ─── One link, one step (spec 445 §3.1) ────────────────────────────────────────────────────────────
|
|
286
|
+
//
|
|
287
|
+
// THE RULE: a step is judged against EVERY link of the chain it is presented under, by one function, in one
|
|
288
|
+
// context. WHY: the leaf is written by whoever holds the parent's delegate key. A verifier that reads only the
|
|
289
|
+
// leaf has asked the party under suspicion what it is allowed to do (audit H-7 / AUTH-1). On chain the
|
|
290
|
+
// DelegationManager runs every link's enforcers against the one call; this is its off-chain twin.
|
|
291
|
+
/** The digest of the intent THIS step acts under — recomputed under the versions the verifier runs with
|
|
292
|
+
* (spec 410 §5) when given. One definition, so the leaf and its parents are compared to the same bytes. */
|
|
293
|
+
export function stepIntentDigest(step, currentVersions) {
|
|
294
|
+
return intentDigest(currentVersions && step.intent && typeof step.intent === 'object' ? withVersions(step.intent, currentVersions) : step.intent);
|
|
295
|
+
}
|
|
296
|
+
/** The call TARGET a step's `allowedTargets` caveats are judged against: the step's resource (the agent being
|
|
297
|
+
* acted for, or the asset contract of a payment), else the LEAF's delegator. Computed once from the leaf and
|
|
298
|
+
* used for every link — a parent is not judged against a kinder target than its child. */
|
|
299
|
+
export function stepTarget(step, leaf) {
|
|
300
|
+
return (step.resource ?? leaf.delegator);
|
|
301
|
+
}
|
|
302
|
+
/** What a link GRANTS, read by the type's handler — a mandate (intent-bound) or a standing wire (none). Null
|
|
303
|
+
* when the link does not decode as `type`, or its terms cannot be read: unreadable is never "unbounded". */
|
|
304
|
+
export function readGrant(d, type, enforcers, from) {
|
|
305
|
+
const h = subsetHandlerFor(type, from);
|
|
306
|
+
if (!h)
|
|
307
|
+
return null;
|
|
308
|
+
try {
|
|
309
|
+
const base = h.fromCaveats(d.caveats, enforcers);
|
|
310
|
+
if (!base)
|
|
311
|
+
return null;
|
|
312
|
+
const bindings = readDigestBindings(d.caveats, enforcers.digestBinding);
|
|
313
|
+
return { ...base, ...(bindings.intent ? { intentDigest: bindings.intent } : {}), ...(bindings.projection ? { projectionDigest: bindings.projection } : {}), ...(bindings.offer ? { offerDigest: bindings.offer } : {}), ...(bindings.plan ? { planDigest: bindings.plan } : {}), ...redemptionsOf(d, enforcers) };
|
|
314
|
+
}
|
|
315
|
+
catch {
|
|
316
|
+
return null;
|
|
317
|
+
}
|
|
318
|
+
}
|
|
319
|
+
/**
|
|
320
|
+
* Is this step within THIS link? The caveats, strictly, against the step (capability selector, target, value,
|
|
321
|
+
* intent / offer / projection / plan digests, payload classes), then the handler's type-specific limits
|
|
322
|
+
* (amount and payee; audience, predicate program and issuer facet).
|
|
323
|
+
*
|
|
324
|
+
* STRICT means: a caveat no off-chain judge can answer DENIES — unless the step redeems on chain
|
|
325
|
+
* (`redeemsOnChain`, where every link's enforcer fires and the chain itself holds the parent) or the type
|
|
326
|
+
* handler compares that caveat's terms itself, which it can only do for a link that decodes as its type.
|
|
327
|
+
*/
|
|
328
|
+
export function judgeLinkForStep(input) {
|
|
329
|
+
const d = input.link;
|
|
201
330
|
const h = subsetHandlerFor(input.requirementType, input.handlers);
|
|
202
331
|
if (!h)
|
|
203
|
-
return
|
|
204
|
-
|
|
205
|
-
|
|
332
|
+
return { verdicts: [], denial: { code: 'no-handler', message: `no subset handler for ${input.requirementType} — an authority nobody can bound is not verified` } };
|
|
333
|
+
// A parent is read FIRST: the handler may vouch for a caveat (`judgesEnforcers`) only on a link it can read.
|
|
334
|
+
// The leaf is read after its caveats, as it always was — if it does not decode it is refused below.
|
|
335
|
+
const grant = input.mustBeMandate ? null : readGrant(d, input.requirementType, input.enforcers, input.handlers);
|
|
336
|
+
const handlerJudges = input.mustBeMandate || grant !== null;
|
|
337
|
+
const raw = evaluateCaveats(d.caveats, {
|
|
206
338
|
timestamp: input.now,
|
|
207
339
|
// The call TARGET is the step's resource: the agent being acted for (a membership add on an org),
|
|
208
340
|
// or the asset contract (a payment). Both are what `allowedTargets` was encoded against.
|
|
209
|
-
target:
|
|
210
|
-
selector,
|
|
341
|
+
target: input.target,
|
|
342
|
+
selector: methodSelector(input.step.capability),
|
|
211
343
|
// The ETH value the step sends — 0 when it sends none. A fact about the step (spec 408 §2.2).
|
|
212
344
|
value: input.step.value ?? 0n,
|
|
213
345
|
digests: {
|
|
214
|
-
intent: digestOfIntent,
|
|
346
|
+
intent: input.digestOfIntent,
|
|
215
347
|
...(input.step.projectionDigest ? { projection: input.step.projectionDigest } : {}),
|
|
216
348
|
...(input.step.offerDigest ? { offer: input.step.offerDigest } : {}),
|
|
217
349
|
...(input.step.planDigest ? { plan: input.step.planDigest } : {}),
|
|
@@ -221,35 +353,58 @@ export async function verifyMandateForStep(input) {
|
|
|
221
353
|
// R917-P-1 (spec 408 §2.2): STRICT unless this step redeems on chain, where every enforcer fires. The
|
|
222
354
|
// previous `enforceOnChain: true` on every step let a caveat nobody judged off chain pass as
|
|
223
355
|
// "enforced-on-chain" for steps that never reached the chain — the evaluator's own contract forbids
|
|
224
|
-
// that for an off-chain gate, and this IS one.
|
|
356
|
+
// that for an off-chain gate, and this IS one. Spec 445 §3.1: the same holds for every PARENT, which
|
|
357
|
+
// until then was read with a timestamp-only context and passed whatever it said.
|
|
225
358
|
enforceOnChain: input.step.redeemsOnChain === true,
|
|
226
|
-
judgedElsewhere: new Set((h.judgesEnforcers?.(input.enforcers) ?? []).map(lc)),
|
|
359
|
+
judgedElsewhere: new Set(handlerJudges ? (h.judgesEnforcers?.(input.enforcers) ?? []).map(lc) : []),
|
|
227
360
|
});
|
|
228
|
-
|
|
229
|
-
const denied =
|
|
361
|
+
const verdicts = raw.map((v) => ({ enforcer: v.enforcer, allowed: v.allowed, ...(v.reason ? { reason: v.reason } : {}) }));
|
|
362
|
+
const denied = raw.find((v) => !v.allowed);
|
|
230
363
|
if (denied) {
|
|
231
364
|
const isReason = /digest mismatch|binding present/.test(denied.reason ?? '');
|
|
232
|
-
return
|
|
365
|
+
return { verdicts, denial: { code: isReason ? 'intent-mismatch' : 'caveat-denied', message: denied.reason ?? 'caveat denied' } };
|
|
366
|
+
}
|
|
367
|
+
// Type-specific limits.
|
|
368
|
+
let req;
|
|
369
|
+
if (input.mustBeMandate) {
|
|
370
|
+
const m = readMandate(d, input.requirementType, input.enforcers, input.handlers);
|
|
371
|
+
if (!m)
|
|
372
|
+
return { verdicts, denial: { code: 'not-a-mandate', message: `the presented delegation does not decode as a ${input.requirementType} mandate` } };
|
|
373
|
+
req = m;
|
|
374
|
+
}
|
|
375
|
+
else {
|
|
376
|
+
// A parent the handler cannot read grants nothing the handler can compare: its caveats were judged
|
|
377
|
+
// strictly above with nobody vouching for any of them, and that is the whole of its judgement.
|
|
378
|
+
if (!grant)
|
|
379
|
+
return { verdicts, denial: null };
|
|
380
|
+
// A standing wire binds no intent: any reason is within it. One that binds a reason was compared above.
|
|
381
|
+
req = { ...grant, intentDigest: grant.intentDigest ?? input.digestOfIntent };
|
|
233
382
|
}
|
|
234
|
-
// 5. type-specific limits
|
|
235
|
-
const req = readMandate(d, input.requirementType, input.enforcers, input.handlers);
|
|
236
|
-
if (!req)
|
|
237
|
-
return deny('not-a-mandate', `the presented delegation does not decode as a ${input.requirementType} mandate`);
|
|
238
383
|
// Actions, resources and limits are ALL the handler's to judge — a read-back capability mandate
|
|
239
384
|
// carries `sel:<hex>` actions while a step carries the id, and only the handler knows they are the
|
|
240
385
|
// same. Asking it "would a requirement shaped like this step be a subset?" gives every type-specific
|
|
241
386
|
// comparison exactly one definition. The reason names what failed so a denial is actionable.
|
|
387
|
+
const within = (child) => {
|
|
388
|
+
if (input.mustBeMandate)
|
|
389
|
+
return h.isSubset(child, req);
|
|
390
|
+
try {
|
|
391
|
+
return h.isSubset(child, req);
|
|
392
|
+
}
|
|
393
|
+
catch {
|
|
394
|
+
return false;
|
|
395
|
+
} // a parent whose limits cannot be read admits nothing
|
|
396
|
+
};
|
|
242
397
|
const shaped = stepAsRequirement(req, input.step, h);
|
|
243
|
-
if (!
|
|
244
|
-
if (!
|
|
245
|
-
return
|
|
398
|
+
if (!within(shaped)) {
|
|
399
|
+
if (!within({ ...shaped, locations: req.locations, limits: req.limits })) {
|
|
400
|
+
return { verdicts, denial: { code: 'action-not-granted', message: `${shaped.actions.map((a) => `"${a}"`).join(', ')} is not among the mandate's actions` } };
|
|
246
401
|
}
|
|
247
|
-
if (input.step.resource && !
|
|
248
|
-
return
|
|
402
|
+
if (input.step.resource && !within({ ...shaped, limits: req.limits })) {
|
|
403
|
+
return { verdicts, denial: { code: 'resource-not-granted', message: `resource ${input.step.resource} is not among the mandate's locations` } };
|
|
249
404
|
}
|
|
250
|
-
return
|
|
405
|
+
return { verdicts, denial: { code: 'limit-exceeded', message: `step exceeds the mandate's ${h.type} limits` } };
|
|
251
406
|
}
|
|
252
|
-
return {
|
|
407
|
+
return { verdicts, denial: null };
|
|
253
408
|
}
|
|
254
409
|
/** The step, re-expressed as a requirement, so the handler can compare like with like. */
|
|
255
410
|
function stepAsRequirement(req, step, h) {
|