@agenticprimitives/delegation 1.0.0-alpha.46 → 1.0.0-alpha.48

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (53) hide show
  1. package/README.md +21 -7
  2. package/dist/authority-chain.d.ts +77 -7
  3. package/dist/authority-chain.d.ts.map +1 -1
  4. package/dist/authority-chain.js +144 -18
  5. package/dist/authority-chain.js.map +1 -1
  6. package/dist/caveats.d.ts +166 -3
  7. package/dist/caveats.d.ts.map +1 -1
  8. package/dist/caveats.js +65 -7
  9. package/dist/caveats.js.map +1 -1
  10. package/dist/evaluator.d.ts.map +1 -1
  11. package/dist/evaluator.js +9 -7
  12. package/dist/evaluator.js.map +1 -1
  13. package/dist/hash.d.ts +8 -0
  14. package/dist/hash.d.ts.map +1 -1
  15. package/dist/hash.js +17 -0
  16. package/dist/hash.js.map +1 -1
  17. package/dist/index.d.ts +11 -8
  18. package/dist/index.d.ts.map +1 -1
  19. package/dist/index.js +14 -5
  20. package/dist/index.js.map +1 -1
  21. package/dist/invocation-proof.d.ts.map +1 -1
  22. package/dist/invocation-proof.js +2 -0
  23. package/dist/invocation-proof.js.map +1 -1
  24. package/dist/mandate-handlers.d.ts.map +1 -1
  25. package/dist/mandate-handlers.js +2 -0
  26. package/dist/mandate-handlers.js.map +1 -1
  27. package/dist/mandate.d.ts +106 -1
  28. package/dist/mandate.d.ts.map +1 -1
  29. package/dist/mandate.js +189 -34
  30. package/dist/mandate.js.map +1 -1
  31. package/dist/method-authorization.d.ts +6 -0
  32. package/dist/method-authorization.d.ts.map +1 -1
  33. package/dist/method-authorization.js.map +1 -1
  34. package/dist/onchain.d.ts +150 -1
  35. package/dist/onchain.d.ts.map +1 -1
  36. package/dist/onchain.js +94 -2
  37. package/dist/onchain.js.map +1 -1
  38. package/dist/presentation-release.d.ts +7 -0
  39. package/dist/presentation-release.d.ts.map +1 -1
  40. package/dist/presentation-release.js +49 -17
  41. package/dist/presentation-release.js.map +1 -1
  42. package/dist/quorum.d.ts +71 -3
  43. package/dist/quorum.d.ts.map +1 -1
  44. package/dist/quorum.js +112 -22
  45. package/dist/quorum.js.map +1 -1
  46. package/dist/standing.d.ts.map +1 -1
  47. package/dist/standing.js +10 -4
  48. package/dist/standing.js.map +1 -1
  49. package/dist/token.d.ts +23 -14
  50. package/dist/token.d.ts.map +1 -1
  51. package/dist/token.js +46 -17
  52. package/dist/token.js.map +1 -1
  53. package/package.json +6 -6
@@ -1 +1 @@
1
- {"version":3,"file":"mandate-handlers.js","sourceRoot":"","sources":["../src/mandate-handlers.ts"],"names":[],"mappings":"AAAA,wGAAwG;AACxG,8FAA8F;AAC9F,+FAA+F;AAC/F,qGAAqG;AACrG,4BAA4B;AAC5B,OAAO,EAAE,mBAAmB,EAAY,MAAM,MAAM,CAAC;AAErD,OAAO,EACL,WAAW,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,yBAAyB,EAC7G,yBAAyB,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,yBAAyB,EAC3K,2BAA2B,EAAE,4BAA4B,EAAE,4BAA4B,GACxF,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAgF,MAAM,cAAc,CAAC;AAEjJ,MAAM,EAAE,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAC1C,MAAM,UAAU,GAAG,CAAC,OAA0B,EAAE,QAA6B,EAAE,EAAE,CAC/E,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAE9E,sGAAsG;AACtG,EAAE;AACF,sGAAsG;AACtG,0GAA0G;AAC1G,8FAA8F;AAE9F,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAE3D,MAAM,CAAC,MAAM,iBAAiB,GAAyB;IACrD,IAAI,EAAE,mBAAmB;IACzB,QAAQ,EAAE,YAAY;IACtB,SAAS,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QAChH,MAAM,OAAO,GAAa;YACxB,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,oBAAoB,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;YACnF,8FAA8F;YAC9F,8FAA8F;YAC9F,sEAAsE;YACtE,WAAW,CAAC,CAAC,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACtH,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC;SAC3C,CAAC;QACF,IAAI,GAAG,CAAC,SAAS,EAAE,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,EAAE,yBAAyB,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAChI,wFAAwF;QACxF,IAAI,GAAG,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;YAC/B,IAAI,CAAC,CAAC,CAAC,cAAc;gBAAE,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;YACjI,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC,cAAc,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,WAAW,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,OAAO,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,oBAAoB,CAAC,EAAE,CAAC,KAAY,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,yBAAyB,CAAC,OAAO,CAAC,KAAY,CAAC,CAAC;QAClE,kGAAkG;QAClG,+FAA+F;QAC/F,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC;QACtD,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,yBAAyB,CAAC,OAAO,CAAC,KAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,yBAAyB,CAAC,OAAO,CAAC,KAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;YAC9B,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;SAC/B,CAAC;IACJ,CAAC;CACF,CAAC;AAEF;mGACmG;AACnG,iBAAiB,CAAC,WAAW,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAE5D;yFACyF;AACzF,iBAAiB,CAAC,QAAQ,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;IAC7C,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAChH,OAAO,YAAY,CACjB,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAC9C,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACjD,CAAC;AACJ,CAAC,CAAC;AAEF,sGAAsG;AACtG,EAAE;AACF,iGAAiG;AACjG,mGAAmG;AACnG,yFAAyF;AAEzF,MAAM,CAAC,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAItE,SAAS,aAAa,CAAC,GAAyB;IAC9C,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5J,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/F,uBAAuB,EAAE,MAAM,CAAC,CAAC,CAAC,uBAAuB,IAAI,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,IAAI,MAAM,CAAC;KAClH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAyB;IAClD,4GAA4G;IAC5G,8FAA8F;IAC9F,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,IAAI,EAAE,gBAAgB;IACtB,sGAAsG;IACtG,sGAAsG;IACtG,kGAAkG;IAClG,6DAA6D;IAC7D,UAAU,CAAC,IAAI;QACb,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QACpI,mGAAmG;QACnG,8FAA8F;QAC9F,oGAAoG;QACpG,qEAAqE;QACrE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,wFAAwF,MAAM,GAAG,CAAC,CAAC;QACrH,CAAC;QACD,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;YAC3E,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,EAAE,aAAa,EAAE,IAAI;SACzF,CAAC;IACJ,CAAC;IACD,QAAQ,CAAC,KAAK,EAAE,MAAM;QACpB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,mGAAmG;QACnG,2FAA2F;QAC3F,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtI,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,GAAG,CAAC,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC1D,IAAI,EAAE,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,YAAY;YAAE,OAAO,KAAK,CAAC;QACpG,IAAI,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACjF,IAAI,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACjF,IAAI,EAAE,CAAC,uBAAuB,KAAK,SAAS,IAAI,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,uBAAuB;YAAE,OAAO,KAAK,CAAC;QAC7H,OAAO,IAAI,CAAC;IACd,CAAC;IACD,SAAS,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACpG,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO;YACL,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,uBAAuB,EAAE,CAAC,CAAC,uBAAuB,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;YACjO,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,oBAAoB,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;YACnF,WAAW,CAAC,CAAC,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACnE,WAAW,CAAC,CAAC,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,yBAAyB,EAAE,cAAc,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC;SAClI,CAAC;IACJ,CAAC;IACD,WAAW,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC7B,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,GAAG,mBAAmB,CAC3F,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAC5H,GAAG,CAAC,KAAY,CACqC,CAAC;QACxD,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,oBAAoB,CAAC,EAAE,CAAC,KAAY,CAAC,CAAC;QACzE,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,CAAC,SAAS,CAAC;YACpB,SAAS,EAAE,CAAC,KAAK,CAAC;YAClB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE,EAAE,uBAAuB,EAAE,SAAS,EAAE,aAAa,EAAE;YACnJ,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;SAC/D,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,SAAS,SAAS,CAAC,CAAS;IAC1B,MAAM,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAG,2DAA2D;IACrG,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,EAAE,CAAC,CAAC;IACnE,OAAO,CAAC,CAAC,CAAC,CAAY,CAAC;AACzB,CAAC;AAED,+GAA+G;AAC/G,EAAE;AACF,6GAA6G;AAC7G,oGAAoG;AACpG,+GAA+G;AAC/G,gHAAgH;AAChH,iHAAiH;AACjH,iHAAiH;AACjH,EAAE;AACF,4GAA4G;AAC5G,8GAA8G;AAC9G,gHAAgH;AAEhH,MAAM,CAAC,MAAM,qBAAqB,GAAG,+BAA+B,CAAC;AACrE,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAI5D,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,IAAY,EAAY,EAAE;IAClD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAY,CAAC;YAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC;IAC1K,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,iBAAiB,CAAC,CAAC;AACzE,CAAC,CAAC;AAEF,SAAS,kBAAkB,CAAC,GAAyB;IACnD,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,EAAE,CAAC;IAC7R,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oGAAoG,CAAC,CAAC;IAC7M,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,gBAAgB;QAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,8BAA8B,CAAC,CAAC;IACjK,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAyB;IACvD,IAAI,EAAE,qBAAqB;IAC3B,+GAA+G;IAC/G,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC,2BAA2B,CAAC;IACpD,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC;IAC9B,UAAU,CAAC,IAAI;QACb,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,EAAE,aAAa,CAAU,EAAE,CAAC;YACxE,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,8CAA8C,CAAC,CAAC;QACrI,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,gBAAgB,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;IACtJ,CAAC;IACD,QAAQ,CAAC,KAAK,EAAE,MAAM;QACpB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,QAAQ,IAAI,EAAE,EAAE,WAAW,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE,CAAC,gBAAgB,IAAI,EAAE,CAAC,eAAe,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,YAAY,IAAI,EAAE,CAAC,WAAW,IAAI,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC;QACnQ,6GAA6G;QAC7G,wGAAwG;QACxG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACxE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACtF,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9E,IAAI,EAAE,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,CAAC,gBAAgB,KAAK,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,gBAAgB;YAAE,OAAO,KAAK,CAAC;QACpI,OAAO,IAAI,CAAC;IACd,CAAC;IACD,SAAS,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO;YACL,4BAA4B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAyB,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC;YAC3K,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,oBAAoB,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;YACnF,WAAW,CAAC,CAAC,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,cAAc,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;YACnG,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC;SAC3C,CAAC;IACJ,CAAC;IACD,WAAW,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,CAAC,GAAG,4BAA4B,CAAC,KAAK,CAAC,KAAY,CAAC,CAAC;QAC3D,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,oBAAoB,CAAC,EAAE,CAAC,KAAY,CAAC,CAAC;QACzE,OAAO;YACL,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,CAAC,SAAS,CAAC;YACpB,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE;YAC5L,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;SAC/D,CAAC;IACJ,CAAC;CACF,CAAC;AAEF;2FAC2F;AAC3F,MAAM,CAAC,MAAM,uBAAuB,GAA8C,IAAI,GAAG,CAAC;IACxF,CAAC,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAC3C,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC;IACrC,CAAC,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,CAAC;CAChD,CAAC,CAAC;AAEH,iGAAiG;AACjG,IAAI,UAAU,GAAG,KAAK,CAAC;AACvB,MAAM,UAAU,6BAA6B;IAC3C,IAAI,UAAU;QAAE,OAAO;IACvB,qBAAqB,CAAC,iBAAiB,CAAC,CAAC;IACzC,qBAAqB,CAAC,cAAc,CAAC,CAAC;IACtC,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;IAC3C,UAAU,GAAG,IAAI,CAAC;AACpB,CAAC;AACD,qDAAqD;AACrD,MAAM,UAAU,yBAAyB,KAAW,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC"}
1
+ {"version":3,"file":"mandate-handlers.js","sourceRoot":"","sources":["../src/mandate-handlers.ts"],"names":[],"mappings":"AAAA,wGAAwG;AACxG,8FAA8F;AAC9F,+FAA+F;AAC/F,qGAAqG;AACrG,4BAA4B;AAC5B,OAAO,EAAE,mBAAmB,EAAY,MAAM,MAAM,CAAC;AAErD,OAAO,EACL,WAAW,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,yBAAyB,EAC7G,yBAAyB,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,yBAAyB,EAC3K,2BAA2B,EAAE,4BAA4B,EAAE,4BAA4B,GACxF,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAgF,MAAM,cAAc,CAAC;AAEjJ,MAAM,EAAE,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAC1C,MAAM,UAAU,GAAG,CAAC,OAA0B,EAAE,QAA6B,EAAE,EAAE,CAC/E,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAE9E,sGAAsG;AACtG,EAAE;AACF,sGAAsG;AACtG,0GAA0G;AAC1G,8FAA8F;AAE9F,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAE3D,MAAM,CAAC,MAAM,iBAAiB,GAAyB;IACrD,IAAI,EAAE,mBAAmB;IACzB,QAAQ,EAAE,YAAY;IACtB,SAAS,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QAChH,MAAM,OAAO,GAAa;YACxB,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,oBAAoB,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;YACnF,8FAA8F;YAC9F,8FAA8F;YAC9F,sEAAsE;YACtE,WAAW,CAAC,CAAC,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACtH,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC;SAC3C,CAAC;QACF,IAAI,GAAG,CAAC,SAAS,EAAE,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,EAAE,yBAAyB,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAChI,wFAAwF;QACxF,IAAI,GAAG,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;YAC/B,IAAI,CAAC,CAAC,CAAC,cAAc;gBAAE,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;YACjI,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC,cAAc,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,WAAW,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,OAAO,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,oBAAoB,CAAC,EAAE,CAAC,KAAY,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,yBAAyB,CAAC,OAAO,CAAC,KAAY,CAAC,CAAC;QAClE,kGAAkG;QAClG,+FAA+F;QAC/F,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC;QACtD,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,yBAAyB,CAAC,OAAO,CAAC,KAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,yBAAyB,CAAC,OAAO,CAAC,KAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;YAC9B,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;SAC/B,CAAC;IACJ,CAAC;CACF,CAAC;AAEF;mGACmG;AACnG,iBAAiB,CAAC,WAAW,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAE5D;yFACyF;AACzF,iBAAiB,CAAC,QAAQ,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;IAC7C,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAChH,OAAO,YAAY,CACjB,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAC9C,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACjD,CAAC;AACJ,CAAC,CAAC;AAEF,sGAAsG;AACtG,EAAE;AACF,iGAAiG;AACjG,mGAAmG;AACnG,yFAAyF;AAEzF,MAAM,CAAC,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAItE,SAAS,aAAa,CAAC,GAAyB;IAC9C,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5J,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/F,uBAAuB,EAAE,MAAM,CAAC,CAAC,CAAC,uBAAuB,IAAI,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,IAAI,MAAM,CAAC;KAClH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAyB;IAClD,4GAA4G;IAC5G,8FAA8F;IAC9F,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,IAAI,EAAE,gBAAgB;IACtB,sGAAsG;IACtG,sGAAsG;IACtG,kGAAkG;IAClG,6DAA6D;IAC7D,UAAU,CAAC,IAAI;QACb,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QACpI,mGAAmG;QACnG,8FAA8F;QAC9F,oGAAoG;QACpG,qEAAqE;QACrE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,wFAAwF,MAAM,GAAG,CAAC,CAAC;QACrH,CAAC;QACD,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;YAC3E,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,EAAE,aAAa,EAAE,IAAI;SACzF,CAAC;IACJ,CAAC;IACD,QAAQ,CAAC,KAAK,EAAE,MAAM;QACpB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,mGAAmG;QACnG,2FAA2F;QAC3F,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtI,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,GAAG,CAAC,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC1D,IAAI,EAAE,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,YAAY;YAAE,OAAO,KAAK,CAAC;QACpG,IAAI,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACjF,IAAI,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACjF,IAAI,EAAE,CAAC,uBAAuB,KAAK,SAAS,IAAI,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,uBAAuB;YAAE,OAAO,KAAK,CAAC;QAC7H,OAAO,IAAI,CAAC;IACd,CAAC;IACD,SAAS,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACpG,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO;YACL,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,uBAAuB,EAAE,CAAC,CAAC,uBAAuB,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;YACjO,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,oBAAoB,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;YACnF,WAAW,CAAC,CAAC,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACnE,WAAW,CAAC,CAAC,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,yBAAyB,EAAE,cAAc,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC;SAClI,CAAC;IACJ,CAAC;IACD,WAAW,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC7B,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,GAAG,mBAAmB,CAC3F,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAC5H,GAAG,CAAC,KAAY,CACqC,CAAC;QACxD,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,oBAAoB,CAAC,EAAE,CAAC,KAAY,CAAC,CAAC;QACzE,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,CAAC,SAAS,CAAC;YACpB,SAAS,EAAE,CAAC,KAAK,CAAC;YAClB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE,EAAE,uBAAuB,EAAE,SAAS,EAAE,aAAa,EAAE;YACnJ,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;SAC/D,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,SAAS,SAAS,CAAC,CAAS;IAC1B,MAAM,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAG,2DAA2D;IACrG,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,EAAE,CAAC,CAAC;IACnE,OAAO,CAAC,CAAC,CAAC,CAAY,CAAC;AACzB,CAAC;AAED,+GAA+G;AAC/G,EAAE;AACF,6GAA6G;AAC7G,oGAAoG;AACpG,+GAA+G;AAC/G,gHAAgH;AAChH,iHAAiH;AACjH,iHAAiH;AACjH,EAAE;AACF,4GAA4G;AAC5G,8GAA8G;AAC9G,gHAAgH;AAEhH,MAAM,CAAC,MAAM,qBAAqB,GAAG,+BAA+B,CAAC;AACrE,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAI5D,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,IAAY,EAAY,EAAE;IAClD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAY,CAAC;YAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC;IAC1K,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,iBAAiB,CAAC,CAAC;AACzE,CAAC,CAAC;AAEF,SAAS,kBAAkB,CAAC,GAAyB;IACnD,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,EAAE,CAAC;IAC7R,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oGAAoG,CAAC,CAAC;IAC7M,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,gBAAgB;QAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,8BAA8B,CAAC,CAAC;IACjK,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAyB;IACvD,IAAI,EAAE,qBAAqB;IAC3B,4GAA4G;IAC5G,mBAAmB,EAAE,IAAI;IACzB,+GAA+G;IAC/G,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC,2BAA2B,CAAC;IACpD,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC;IAC9B,UAAU,CAAC,IAAI;QACb,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,EAAE,aAAa,CAAU,EAAE,CAAC;YACxE,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,8CAA8C,CAAC,CAAC;QACrI,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,gBAAgB,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;IACtJ,CAAC;IACD,QAAQ,CAAC,KAAK,EAAE,MAAM;QACpB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,QAAQ,IAAI,EAAE,EAAE,WAAW,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE,CAAC,gBAAgB,IAAI,EAAE,CAAC,eAAe,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,YAAY,IAAI,EAAE,CAAC,WAAW,IAAI,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC;QACnQ,6GAA6G;QAC7G,wGAAwG;QACxG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACxE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACtF,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9E,IAAI,EAAE,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,CAAC,gBAAgB,KAAK,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,gBAAgB;YAAE,OAAO,KAAK,CAAC;QACpI,OAAO,IAAI,CAAC;IACd,CAAC;IACD,SAAS,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO;YACL,4BAA4B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAyB,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC;YAC3K,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,oBAAoB,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;YACnF,WAAW,CAAC,CAAC,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,cAAc,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;YACnG,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC;SAC3C,CAAC;IACJ,CAAC;IACD,WAAW,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,CAAC,GAAG,4BAA4B,CAAC,KAAK,CAAC,KAAY,CAAC,CAAC;QAC3D,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,oBAAoB,CAAC,EAAE,CAAC,KAAY,CAAC,CAAC;QACzE,OAAO;YACL,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,CAAC,SAAS,CAAC;YACpB,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE;YAC5L,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;SAC/D,CAAC;IACJ,CAAC;CACF,CAAC;AAEF;2FAC2F;AAC3F,MAAM,CAAC,MAAM,uBAAuB,GAA8C,IAAI,GAAG,CAAC;IACxF,CAAC,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAC3C,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC;IACrC,CAAC,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,CAAC;CAChD,CAAC,CAAC;AAEH,iGAAiG;AACjG,IAAI,UAAU,GAAG,KAAK,CAAC;AACvB,MAAM,UAAU,6BAA6B;IAC3C,IAAI,UAAU;QAAE,OAAO;IACvB,qBAAqB,CAAC,iBAAiB,CAAC,CAAC;IACzC,qBAAqB,CAAC,cAAc,CAAC,CAAC;IACtC,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;IAC3C,UAAU,GAAG,IAAI,CAAC;AACpB,CAAC;AACD,qDAAqD;AACrD,MAAM,UAAU,yBAAyB,KAAW,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC"}
package/dist/mandate.d.ts CHANGED
@@ -48,6 +48,15 @@ export interface MandateRequirementV1 {
48
48
  * WHERE) but it is what makes the authority honest about WHAT it does, and the card can name it.
49
49
  */
50
50
  methods?: Hex[];
51
+ /**
52
+ * Spec 445 / generation 4 / B1 (audit DLG-3) — HOW MANY ON-CHAIN REDEMPTIONS THIS MANDATE COVERS, signed into
53
+ * every digest binding's terms (`DigestBindingEnforcer`: the (N+1)-th redemption reverts `UsesExhausted`,
54
+ * whatever step nonce it brings). Count one per plan step whose capability `redeemsOnChain`, TIMES the calls
55
+ * that step makes. Absent ⇒ ONE (the 64-byte single-use terms) — never inferred larger. Intent, projection,
56
+ * offer and plan bindings all carry the same number (each counts the same redemptions). Only for a generation-4
57
+ * estate: an older enforcer bounds nothing by count.
58
+ */
59
+ maxRedemptions?: number;
51
60
  }
52
61
  /** RFC 8785 JCS → keccak256. The ONE way an intent digest is computed, so grantor, verifier and receipt
53
62
  * cannot disagree about which bytes were bound. */
@@ -104,6 +113,11 @@ export interface MandateSubsetHandler {
104
113
  * `isSubset` (the payment handler bounds the PaymentEnforcer's payee/asset/amount itself). Those are
105
114
  * recorded `judged-by-handler`, never `enforced-on-chain`. Default: none. */
106
115
  judgesEnforcers?(enforcers: EnforcerAddresses): Address[];
116
+ /** Spec 445 / AUTH-5 — A MANDATE OF THIS TYPE IS A SCOPE ANSWERED PER CHALLENGE, not one act. Declared only by
117
+ * the presentation type: each signature answers a fresh, audience-bound challenge the VENUE minted, so the
118
+ * same mandate legitimately covers many statements and a replayed one yields a signature over a challenge the
119
+ * venue already spent. Every other type is single-use per step off chain (`MandateUseLedger`). Default: false. */
120
+ answersPerChallenge?: true;
107
121
  }
108
122
  /** The handlers a verification consults. Passed EXPLICITLY (`SubsetHandlers`) wherever possible: the
109
123
  * ambient registry below is module-level state, and a bundle that ends up with two copies of this
@@ -178,7 +192,47 @@ export interface MandateStep {
178
192
  * Only then may a caveat with no off-chain judge be recorded `enforced-on-chain`; every other step is
179
193
  * judged strictly. Declared by the tool (`ToolSpec.capability.redeemsOnChain`), never by the planner. */
180
194
  redeemsOnChain?: boolean;
195
+ /** Spec 445 / AUTH-5 — THIS USE, for a step that does not redeem on chain: `operation` is the step's LOGICAL
196
+ * request identity (its declared idempotency key, else its stable step ref — the same value
197
+ * `digestBindingStepNonce` takes on chain; never a run id, or every new run would be a new use) and `holder`
198
+ * is the run using it (so a resume or retry of the SAME run re-verifies; another run is refused). */
199
+ use?: {
200
+ operation: string;
201
+ holder: string;
202
+ };
203
+ /** Spec 445 / generation 4 / B1 (audit DLG-2) — THE CONTRACT THE REDEMPTION CALLS (the `target` passed to
204
+ * `DelegationManager.redeemDelegation`), when the step redeems and the caller knows it. Distinct from `resource`,
205
+ * which is the agent acted FOR (what `allowedTargets` was encoded against). When given and equal to the chain's
206
+ * ROOT delegator, the step is refused `self-target`, exactly as the manager reverts `SelfTargetedRedemption`:
207
+ * a redemption that makes the delegator's own account call itself (`executeBatch`) escapes every caveat. */
208
+ callTarget?: Address;
181
209
  }
210
+ /** The manager's rule, off chain (spec 445 / DLG-2): a redemption whose call target is the ROOT delegator of the
211
+ * chain (leaf first, so the last link's delegator) is refused. An intermediate link's delegator is an ordinary
212
+ * target. `DelegationManager.verifyAuthorizationForCall` answers `(false, "self-target")` for the same input. */
213
+ export declare function isSelfTargetedRedemption(chainLeafFirst: readonly Pick<Delegation, 'delegator'>[], target: Address): boolean;
214
+ /** The reason string the chain's `verifyAuthorizationForCall` returns for a self-targeted call. */
215
+ export declare const SELF_TARGET_REASON = "self-target";
216
+ /**
217
+ * Spec 445 / AUTH-5 (the single-use half of R917-P-3) — THE OFF-CHAIN TWIN OF THE ENFORCER NONCE.
218
+ * On chain a step's redemption is consumed under (delegator, delegationHash, kind, stepNonce). A step that
219
+ * never redeems had no such record: the same mandate + intent + plan verified again in any new run until
220
+ * `validUntil`, re-executing messages, records, credential issuance. This port is that record.
221
+ *
222
+ * `claim` MUST be atomic and durable across every process that verifies for this agent (a per-isolate map is
223
+ * not a ledger). It returns true when `holder` is the FIRST to claim (mandateRef, stepNonce) or already holds
224
+ * it, false when another holder does. A throw is a refusal.
225
+ */
226
+ export interface MandateUseLedger {
227
+ claim(use: {
228
+ mandateRef: Hex;
229
+ stepNonce: Hex;
230
+ holder: string;
231
+ }): Promise<boolean>;
232
+ }
233
+ /** A single-process ledger for tests and one-process tools. NOT a deployment's ledger: it forgets on restart
234
+ * and is not shared between isolates. */
235
+ export declare function createMemoryMandateUseLedger(): MandateUseLedger;
182
236
  export interface VerifyMandateInput {
183
237
  /** The wire the caller presented. */
184
238
  presented: Delegation;
@@ -198,6 +252,9 @@ export interface VerifyMandateInput {
198
252
  * compiled definition is refused (`version-moved`, naming which). Absent ⇒ the intent is digested as
199
253
  * presented (a runtime that has not adopted version binding). */
200
254
  currentVersions?: VersionBindingV1;
255
+ /** Spec 445 / AUTH-5 — the single-use record. REQUIRED for every step that does not redeem on chain (with
256
+ * `step.use`): absent ⇒ `single-use-unrecorded`, a denial. There is no knob that waives it. */
257
+ uses?: MandateUseLedger;
201
258
  }
202
259
  export interface DecisionReason {
203
260
  code: string;
@@ -253,13 +310,61 @@ export type MandateDecision = {
253
310
  * 4. the step's capability selector satisfies allowedMethods, and its value the value cap — STRICTLY
254
311
  * (spec 408 §2.2): a caveat no off-chain judge can answer denies, unless the step redeems on chain
255
312
  * (`redeemsOnChain`, where the enforcer fires) or the type handler declares it judges that caveat;
256
- * 5. the handler's type-specific limits admit the step's args.
313
+ * 5. the handler's type-specific limits admit the step's args;
314
+ * 6. the use is recorded (spec 445 / AUTH-5): a step that does not redeem on chain claims
315
+ * (mandateRef, stepNonce) in the `MandateUseLedger` — required, and a second run's claim is refused.
316
+ *
317
+ * THIS JUDGES ONE LINK — the presented one. A mandate whose `authority` names a parent is authority only
318
+ * together with `verifyAuthorityChain`, which judges the SAME step against every link above it and requires
319
+ * child ⊆ parent (spec 445 §3.1). The harness composition and the presentation release run both; a caller
320
+ * that runs only this one on a child has verified what the child's own signer wrote.
257
321
  *
258
322
  * Obligations are NOT decided here — they come from policy (spec 350 §3.4) and are attached by the
259
323
  * `MandateVerifier` port implementation that composes this with a `PolicyEvaluator`. This function
260
324
  * answers one question: is the authority present and does it cover the step.
261
325
  */
262
326
  export declare function verifyMandateForStep(input: VerifyMandateInput): Promise<MandateDecision>;
327
+ /** The digest of the intent THIS step acts under — recomputed under the versions the verifier runs with
328
+ * (spec 410 §5) when given. One definition, so the leaf and its parents are compared to the same bytes. */
329
+ export declare function stepIntentDigest(step: MandateStep, currentVersions?: VersionBindingV1): Hex;
330
+ /** The call TARGET a step's `allowedTargets` caveats are judged against: the step's resource (the agent being
331
+ * acted for, or the asset contract of a payment), else the LEAF's delegator. Computed once from the leaf and
332
+ * used for every link — a parent is not judged against a kinder target than its child. */
333
+ export declare function stepTarget(step: MandateStep, leaf: Delegation): Address;
334
+ /** What a link GRANTS, read by the type's handler — a mandate (intent-bound) or a standing wire (none). Null
335
+ * when the link does not decode as `type`, or its terms cannot be read: unreadable is never "unbounded". */
336
+ export declare function readGrant(d: Delegation, type: string, enforcers: EnforcerAddresses, from?: SubsetHandlers): (Omit<MandateRequirementV1, 'intentDigest'> & {
337
+ intentDigest?: Hex;
338
+ }) | null;
339
+ export interface JudgeLinkInput {
340
+ link: Delegation;
341
+ requirementType: string;
342
+ step: MandateStep;
343
+ /** `stepTarget(step, leaf)` — the same for every link of one chain. */
344
+ target: Address;
345
+ /** `stepIntentDigest(step, currentVersions)` — the same for every link of one chain. */
346
+ digestOfIntent: Hex;
347
+ enforcers: EnforcerAddresses;
348
+ now: number;
349
+ handlers?: SubsetHandlers;
350
+ /** The LEAF must decode as a mandate of the type (`not-a-mandate` otherwise). A PARENT may be a standing
351
+ * wire, or a wire of another shape: its caveats are still judged strictly, with no handler to vouch for
352
+ * any of them. */
353
+ mustBeMandate: boolean;
354
+ }
355
+ /**
356
+ * Is this step within THIS link? The caveats, strictly, against the step (capability selector, target, value,
357
+ * intent / offer / projection / plan digests, payload classes), then the handler's type-specific limits
358
+ * (amount and payee; audience, predicate program and issuer facet).
359
+ *
360
+ * STRICT means: a caveat no off-chain judge can answer DENIES — unless the step redeems on chain
361
+ * (`redeemsOnChain`, where every link's enforcer fires and the chain itself holds the parent) or the type
362
+ * handler compares that caveat's terms itself, which it can only do for a link that decodes as its type.
363
+ */
364
+ export declare function judgeLinkForStep(input: JudgeLinkInput): {
365
+ verdicts: DecisionEvidence['verdicts'];
366
+ denial: DecisionReason | null;
367
+ };
263
368
  export { ROOT_AUTHORITY };
264
369
  export type { DigestBindingKind };
265
370
  //# sourceMappingURL=mandate.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"mandate.d.ts","sourceRoot":"","sources":["../src/mandate.ts"],"names":[],"mappings":"AAoBA,OAAO,EAA4B,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAE1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAElF,OAAO,EAAwC,KAAK,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEjH,OAAO,EAAgD,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAI5C;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;IACzC,+GAA+G;IAC/G,YAAY,EAAE,GAAG,CAAC;IAClB,+FAA+F;IAC/F,gBAAgB,CAAC,EAAE,GAAG,CAAC;IACvB,iFAAiF;IACjF,WAAW,CAAC,EAAE,GAAG,CAAC;IAClB;;;iGAG6F;IAC7F,UAAU,CAAC,EAAE,GAAG,CAAC;IACjB;uHACmH;IACnH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,oBAAoB;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;CACjB;AAED;oDACoD;AACpD,wBAAgB,YAAY,CAAC,MAAM,EAAE,OAAO,GAAG,GAAG,CAEjD;AAYD;;;iHAGiH;AACjH,MAAM,WAAW,gBAAgB;IAC/B,sBAAsB,EAAE,GAAG,CAAC;IAC5B,eAAe,EAAE,GAAG,CAAC;IACrB;;oGAEgG;IAChG,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,6GAA6G;AAC7G,eAAO,MAAM,mBAAmB,EAA6B,GAAG,CAAC;AAEjE,gHAAgH;AAChH,wBAAgB,YAAY,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,gBAAgB,GAAG,CAAC,GAAG;IAAE,QAAQ,EAAE,gBAAgB,CAAA;CAAE,CAIxH;AAED,0FAA0F;AAC1F,wBAAgB,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,gBAAgB,GAAG,IAAI,CAKnE;AAID,mEAAmE;AACnE,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG;IAAE,aAAa,EAAE,OAAO,CAAA;CAAE,CAAC;AAEhF;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,QAAQ,CAAC,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC;IAC7E,+GAA+G;IAC/G,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,SAAS,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAAC;IAC7E,kGAAkG;IAClG,WAAW,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,iBAAiB,GAAG,IAAI,CAAC,oBAAoB,EAAE,cAAc,GAAG,kBAAkB,GAAG,aAAa,CAAC,GAAG,IAAI,CAAC;IAC9J;;;sGAGkG;IAClG,UAAU,CAAC,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;IAChE;;;+EAG2E;IAC3E,WAAW,CAAC,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,CAAC;IAC1C;;;;kFAI8E;IAC9E,eAAe,CAAC,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,EAAE,CAAC;CAC3D;AAED;;;sFAGsF;AACtF,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;AAIvE,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAGnE;AACD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,cAAyB,GAAG,oBAAoB,GAAG,IAAI,CAE3G;AACD,iBAAiB;AACjB,wBAAgB,oBAAoB,IAAI,IAAI,CAAsB;AAElE;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAc/F;AAID,MAAM,WAAW,kBAAkB;IACjC,wGAAwG;IACxG,MAAM,EAAE,UAAU,CAAC;IACnB;kCAC8B;IAC9B,iBAAiB,EAAE,oBAAoB,CAAC;IACxC,mFAAmF;IACnF,WAAW,EAAE,oBAAoB,CAAC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,GACjD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,mBAAmB,CAuB5E;AAED;gEACgE;AAChE,wBAAgB,WAAW,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,oBAAoB,GAAG,IAAI,CAQzI;AAID,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B;+CAC2C;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yGAAyG;IACzG,MAAM,EAAE,OAAO,CAAC;IAChB,oFAAoF;IACpF,gBAAgB,CAAC,EAAE,GAAG,CAAC;IACvB,WAAW,CAAC,EAAE,GAAG,CAAC;IAClB;iFAC6E;IAC7E,UAAU,CAAC,EAAE,GAAG,CAAC;IACjB,iHAAiH;IACjH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B;mEAC+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;8GAE0G;IAC1G,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,qCAAqC;IACrC,SAAS,EAAE,UAAU,CAAC;IACtB,6FAA6F;IAC7F,eAAe,EAAE,MAAM,CAAC;IACxB,8CAA8C;IAC9C,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,MAAM,EAAE,yBAAyB,CAAC;IAClC,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,qGAAqG;IACrG,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B;;;sEAGkE;IAClE,eAAe,CAAC,EAAE,gBAAgB,CAAC;CACpC;AAED,MAAM,WAAW,cAAc;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAEjE,uGAAuG;AACvG,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,uBAAuB,GAAG,QAAQ,GAAG,qBAAqB,GAAG,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAChG,eAAe,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3E,mGAAmG;IACnG,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,GAAG,CAAC;IAChB,YAAY,EAAE,GAAG,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,sFAAsF;IACtF,QAAQ,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1E;gHAC4G;IAC5G,KAAK,CAAC,EAAE,OAAO,sBAAsB,EAAE,gBAAgB,CAAC;CACzD;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GAC5E;IAAE,QAAQ,EAAE,mBAAmB,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GACxF;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,cAAc,EAAE,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAIhF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,eAAe,CAAC,CAyG9F;AAsBD,OAAO,EAAE,cAAc,EAAE,CAAC;AAC1B,YAAY,EAAE,iBAAiB,EAAE,CAAC"}
1
+ {"version":3,"file":"mandate.d.ts","sourceRoot":"","sources":["../src/mandate.ts"],"names":[],"mappings":"AAuBA,OAAO,EAA4B,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAE1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAElF,OAAO,EAAwC,KAAK,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEjH,OAAO,EAA+F,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACnJ,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAI5C;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;IACzC,+GAA+G;IAC/G,YAAY,EAAE,GAAG,CAAC;IAClB,+FAA+F;IAC/F,gBAAgB,CAAC,EAAE,GAAG,CAAC;IACvB,iFAAiF;IACjF,WAAW,CAAC,EAAE,GAAG,CAAC;IAClB;;;iGAG6F;IAC7F,UAAU,CAAC,EAAE,GAAG,CAAC;IACjB;uHACmH;IACnH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,oBAAoB;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IAChB;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;oDACoD;AACpD,wBAAgB,YAAY,CAAC,MAAM,EAAE,OAAO,GAAG,GAAG,CAEjD;AAYD;;;iHAGiH;AACjH,MAAM,WAAW,gBAAgB;IAC/B,sBAAsB,EAAE,GAAG,CAAC;IAC5B,eAAe,EAAE,GAAG,CAAC;IACrB;;oGAEgG;IAChG,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,6GAA6G;AAC7G,eAAO,MAAM,mBAAmB,EAA6B,GAAG,CAAC;AAEjE,gHAAgH;AAChH,wBAAgB,YAAY,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,gBAAgB,GAAG,CAAC,GAAG;IAAE,QAAQ,EAAE,gBAAgB,CAAA;CAAE,CAIxH;AAED,0FAA0F;AAC1F,wBAAgB,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,gBAAgB,GAAG,IAAI,CAKnE;AAID,mEAAmE;AACnE,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG;IAAE,aAAa,EAAE,OAAO,CAAA;CAAE,CAAC;AAEhF;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,QAAQ,CAAC,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC;IAC7E,+GAA+G;IAC/G,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,SAAS,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAAC;IAC7E,kGAAkG;IAClG,WAAW,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,iBAAiB,GAAG,IAAI,CAAC,oBAAoB,EAAE,cAAc,GAAG,kBAAkB,GAAG,aAAa,CAAC,GAAG,IAAI,CAAC;IAC9J;;;sGAGkG;IAClG,UAAU,CAAC,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;IAChE;;;+EAG2E;IAC3E,WAAW,CAAC,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,CAAC;IAC1C;;;;kFAI8E;IAC9E,eAAe,CAAC,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,EAAE,CAAC;IAC1D;;;uHAGmH;IACnH,mBAAmB,CAAC,EAAE,IAAI,CAAC;CAC5B;AAED;;;sFAGsF;AACtF,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;AAIvE,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAGnE;AACD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,cAAyB,GAAG,oBAAoB,GAAG,IAAI,CAE3G;AACD,iBAAiB;AACjB,wBAAgB,oBAAoB,IAAI,IAAI,CAAsB;AAElE;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAgB/F;AAID,MAAM,WAAW,kBAAkB;IACjC,wGAAwG;IACxG,MAAM,EAAE,UAAU,CAAC;IACnB;kCAC8B;IAC9B,iBAAiB,EAAE,oBAAoB,CAAC;IACxC,mFAAmF;IACnF,WAAW,EAAE,oBAAoB,CAAC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,GACjD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,mBAAmB,CA0B5E;AAED;gEACgE;AAChE,wBAAgB,WAAW,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,oBAAoB,GAAG,IAAI,CAQzI;AAWD,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B;+CAC2C;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yGAAyG;IACzG,MAAM,EAAE,OAAO,CAAC;IAChB,oFAAoF;IACpF,gBAAgB,CAAC,EAAE,GAAG,CAAC;IACvB,WAAW,CAAC,EAAE,GAAG,CAAC;IAClB;iFAC6E;IAC7E,UAAU,CAAC,EAAE,GAAG,CAAC;IACjB,iHAAiH;IACjH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B;mEAC+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;8GAE0G;IAC1G,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;0GAGsG;IACtG,GAAG,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C;;;;iHAI6G;IAC7G,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;kHAEkH;AAClH,wBAAgB,wBAAwB,CAAC,cAAc,EAAE,SAAS,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAI3H;AAED,mGAAmG;AACnG,eAAO,MAAM,kBAAkB,gBAAgB,CAAC;AAEhD;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,GAAG,EAAE;QAAE,UAAU,EAAE,GAAG,CAAC;QAAC,SAAS,EAAE,GAAG,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnF;AAED;0CAC0C;AAC1C,wBAAgB,4BAA4B,IAAI,gBAAgB,CAU/D;AAED,MAAM,WAAW,kBAAkB;IACjC,qCAAqC;IACrC,SAAS,EAAE,UAAU,CAAC;IACtB,6FAA6F;IAC7F,eAAe,EAAE,MAAM,CAAC;IACxB,8CAA8C;IAC9C,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,MAAM,EAAE,yBAAyB,CAAC;IAClC,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,qGAAqG;IACrG,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B;;;sEAGkE;IAClE,eAAe,CAAC,EAAE,gBAAgB,CAAC;IACnC;oGACgG;IAChG,IAAI,CAAC,EAAE,gBAAgB,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAEjE,uGAAuG;AACvG,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,uBAAuB,GAAG,QAAQ,GAAG,qBAAqB,GAAG,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAChG,eAAe,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3E,mGAAmG;IACnG,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,GAAG,CAAC;IAChB,YAAY,EAAE,GAAG,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,sFAAsF;IACtF,QAAQ,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1E;gHAC4G;IAC5G,KAAK,CAAC,EAAE,OAAO,sBAAsB,EAAE,gBAAgB,CAAC;CACzD;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GAC5E;IAAE,QAAQ,EAAE,mBAAmB,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GACxF;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,cAAc,EAAE,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAIhF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,eAAe,CAAC,CA+E9F;AASD;4GAC4G;AAC5G,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,EAAE,eAAe,CAAC,EAAE,gBAAgB,GAAG,GAAG,CAE3F;AAED;;2FAE2F;AAC3F,wBAAgB,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAEvE;AAED;6GAC6G;AAC7G,wBAAgB,SAAS,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,cAAc,CAAC,GAAG;IAAE,YAAY,CAAC,EAAE,GAAG,CAAA;CAAE,CAAC,GAAG,IAAI,CASxL;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,WAAW,CAAC;IAClB,uEAAuE;IACvE,MAAM,EAAE,OAAO,CAAC;IAChB,wFAAwF;IACxF,cAAc,EAAE,GAAG,CAAC;IACpB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B;;uBAEmB;IACnB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,cAAc,GAAG;IAAE,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAA;CAAE,CA4EjI;AAsBD,OAAO,EAAE,cAAc,EAAE,CAAC;AAC1B,YAAY,EAAE,iBAAiB,EAAE,CAAC"}
package/dist/mandate.js CHANGED
@@ -12,9 +12,12 @@
12
12
  // • the subset-handler registry — RFC 9396 is explicit that NO universal "narrower-than" exists across
13
13
  // authorization-detail types, so each `type` registers its own `isSubset` / `toCaveats` / `fromCaveats`.
14
14
  // • `deriveMandate` — a child delegation from a standing one. It refuses EARLY (via the handler) so a
15
- // doomed child is never signed; the chain would refuse it anyway, because the child's `authority` is
16
- // the parent's hash and DelegationManager evaluates the whole chain at redemption. Attenuation is a
17
- // property of the representation, not a policy this file remembers to enforce.
15
+ // doomed child is never signed. That refusal is a courtesy to the honest minter and NOTHING MORE: the
16
+ // holder of the parent's delegate key is free not to call this function and to sign any child it likes.
17
+ // Attenuation is therefore enforced where the chain is USED — on chain, DelegationManager runs every
18
+ // link's enforcers at redemption; off chain, `verifyAuthorityChain` judges the step against every link
19
+ // and requires child ⊆ parent per adjacent pair (spec 445 §3.1). Before spec 445 this comment said the
20
+ // chain "would refuse it anyway"; for a step that never redeems, nothing did (audit H-7 / AUTH-1).
18
21
  // • `verifyMandateForStep` — THE per-step check. Called before every consequential step of a run, never
19
22
  // once at admission, so a revocation between step 2 and step 3 stops step 3. Returns a decision with
20
23
  // reasons; it never falls back to a weaker check (ADR-0013).
@@ -23,7 +26,7 @@ import { jcsCanonicalize } from '@agenticprimitives/types';
23
26
  import { hashDelegation } from './hash.js';
24
27
  import { verifyLiveDelegation, methodSelector } from './method-authorization.js';
25
28
  import { evaluateCaveats } from './evaluator.js';
26
- import { buildDigestBindingCaveat, readDigestBindings } from './caveats.js';
29
+ import { buildDigestBindingCaveat, readDigestBindings, readDigestBindingUses, digestBindingStepNonce } from './caveats.js';
27
30
  import { ROOT_AUTHORITY } from './types.js';
28
31
  /** RFC 8785 JCS → keccak256. The ONE way an intent digest is computed, so grantor, verifier and receipt
29
32
  * cannot disagree about which bytes were bound. */
@@ -81,6 +84,9 @@ export function baseIsSubset(child, parent) {
81
84
  return false;
82
85
  if (child.validUntil > parent.validUntil)
83
86
  return false;
87
+ // Spec 445 / DLG-3 — a parent that states a redemption count bounds the child's (absent on the child ⇒ one).
88
+ if (parent.maxRedemptions !== undefined && (child.maxRedemptions ?? 1) > parent.maxRedemptions)
89
+ return false;
84
90
  return true;
85
91
  }
86
92
  /**
@@ -96,12 +102,16 @@ export function deriveMandate(input) {
96
102
  if (!h.isSubset(input.requirement, input.parentRequirement)) {
97
103
  return { ok: false, reason: `requested authority is not a subset of the parent's (${h.type})` };
98
104
  }
105
+ // Spec 445 / DLG-3 — the redemption count the requirement states, on every binding; absent ⇒ single use.
106
+ const n = input.requirement.maxRedemptions;
107
+ if (n !== undefined && (!Number.isSafeInteger(n) || n < 1))
108
+ return { ok: false, reason: `maxRedemptions must be an integer >= 1 (got ${String(n)})` };
99
109
  const caveats = [
100
110
  ...h.toCaveats(input.requirement, input.enforcers),
101
- buildDigestBindingCaveat(input.enforcers.digestBinding, 'intent', input.requirement.intentDigest),
102
- ...(input.requirement.projectionDigest ? [buildDigestBindingCaveat(input.enforcers.digestBinding, 'projection', input.requirement.projectionDigest)] : []),
103
- ...(input.requirement.offerDigest ? [buildDigestBindingCaveat(input.enforcers.digestBinding, 'offer', input.requirement.offerDigest)] : []),
104
- ...(input.requirement.planDigest ? [buildDigestBindingCaveat(input.enforcers.digestBinding, 'plan', input.requirement.planDigest)] : []),
111
+ buildDigestBindingCaveat(input.enforcers.digestBinding, 'intent', input.requirement.intentDigest, n),
112
+ ...(input.requirement.projectionDigest ? [buildDigestBindingCaveat(input.enforcers.digestBinding, 'projection', input.requirement.projectionDigest, n)] : []),
113
+ ...(input.requirement.offerDigest ? [buildDigestBindingCaveat(input.enforcers.digestBinding, 'offer', input.requirement.offerDigest, n)] : []),
114
+ ...(input.requirement.planDigest ? [buildDigestBindingCaveat(input.enforcers.digestBinding, 'plan', input.requirement.planDigest, n)] : []),
105
115
  ];
106
116
  const delegation = {
107
117
  delegator: input.parent.delegate, // the party attenuating ITS authority onward
@@ -125,7 +135,40 @@ export function readMandate(d, type, enforcers, from) {
125
135
  const base = h.fromCaveats(d.caveats, enforcers);
126
136
  if (!base)
127
137
  return null;
128
- return { ...base, intentDigest: bindings.intent, ...(bindings.projection ? { projectionDigest: bindings.projection } : {}), ...(bindings.offer ? { offerDigest: bindings.offer } : {}), ...(bindings.plan ? { planDigest: bindings.plan } : {}) };
138
+ return { ...base, intentDigest: bindings.intent, ...(bindings.projection ? { projectionDigest: bindings.projection } : {}), ...(bindings.offer ? { offerDigest: bindings.offer } : {}), ...(bindings.plan ? { planDigest: bindings.plan } : {}), ...redemptionsOf(d, enforcers) };
139
+ }
140
+ /** The signed redemption count, as a requirement field: present only when it is above one (64-byte terms and a
141
+ * 96-byte one stating 1 both read as single use, so a round trip of a single-use requirement is unchanged). */
142
+ function redemptionsOf(d, enforcers) {
143
+ const n = readDigestBindingUses(d.caveats, enforcers.digestBinding).intent;
144
+ return n !== undefined && n > 1 ? { maxRedemptions: n } : {};
145
+ }
146
+ /** The manager's rule, off chain (spec 445 / DLG-2): a redemption whose call target is the ROOT delegator of the
147
+ * chain (leaf first, so the last link's delegator) is refused. An intermediate link's delegator is an ordinary
148
+ * target. `DelegationManager.verifyAuthorizationForCall` answers `(false, "self-target")` for the same input. */
149
+ export function isSelfTargetedRedemption(chainLeafFirst, target) {
150
+ const root = chainLeafFirst[chainLeafFirst.length - 1];
151
+ if (!root)
152
+ return false;
153
+ return root.delegator.toLowerCase() === target.toLowerCase();
154
+ }
155
+ /** The reason string the chain's `verifyAuthorizationForCall` returns for a self-targeted call. */
156
+ export const SELF_TARGET_REASON = 'self-target';
157
+ /** A single-process ledger for tests and one-process tools. NOT a deployment's ledger: it forgets on restart
158
+ * and is not shared between isolates. */
159
+ export function createMemoryMandateUseLedger() {
160
+ const held = new Map();
161
+ return {
162
+ async claim({ mandateRef, stepNonce, holder }) {
163
+ const k = `${mandateRef.toLowerCase()}:${stepNonce.toLowerCase()}`;
164
+ const h = held.get(k);
165
+ if (h === undefined) {
166
+ held.set(k, holder);
167
+ return true;
168
+ }
169
+ return h === holder;
170
+ },
171
+ };
129
172
  }
130
173
  const lc = (s) => s.toLowerCase();
131
174
  /**
@@ -140,7 +183,14 @@ const lc = (s) => s.toLowerCase();
140
183
  * 4. the step's capability selector satisfies allowedMethods, and its value the value cap — STRICTLY
141
184
  * (spec 408 §2.2): a caveat no off-chain judge can answer denies, unless the step redeems on chain
142
185
  * (`redeemsOnChain`, where the enforcer fires) or the type handler declares it judges that caveat;
143
- * 5. the handler's type-specific limits admit the step's args.
186
+ * 5. the handler's type-specific limits admit the step's args;
187
+ * 6. the use is recorded (spec 445 / AUTH-5): a step that does not redeem on chain claims
188
+ * (mandateRef, stepNonce) in the `MandateUseLedger` — required, and a second run's claim is refused.
189
+ *
190
+ * THIS JUDGES ONE LINK — the presented one. A mandate whose `authority` names a parent is authority only
191
+ * together with `verifyAuthorityChain`, which judges the SAME step against every link above it and requires
192
+ * child ⊆ parent (spec 445 §3.1). The harness composition and the presentation release run both; a caller
193
+ * that runs only this one on a child has verified what the child's own signer wrote.
144
194
  *
145
195
  * Obligations are NOT decided here — they come from policy (spec 350 §3.4) and are attached by the
146
196
  * `MandateVerifier` port implementation that composes this with a `PolicyEvaluator`. This function
@@ -150,7 +200,7 @@ export async function verifyMandateForStep(input) {
150
200
  const d = input.presented;
151
201
  // Spec 410 §5 — recompute under the versions this verifier RUNS WITH, never the ones the intent states.
152
202
  const cur = input.currentVersions;
153
- const digestOfIntent = intentDigest(cur && input.step.intent && typeof input.step.intent === 'object' ? withVersions(input.step.intent, cur) : input.step.intent);
203
+ const digestOfIntent = stepIntentDigest(input.step, cur);
154
204
  const evidence = {
155
205
  mandateRef: input.checks.delegationDigest(d),
156
206
  intentDigest: digestOfIntent,
@@ -161,6 +211,11 @@ export async function verifyMandateForStep(input) {
161
211
  // 1. actor
162
212
  if (lc(d.delegate) !== lc(input.actor))
163
213
  return deny('actor-not-delegate', 'the acting party is not the mandate\'s delegate');
214
+ // 1b. Spec 445 / DLG-2 — a ROOT mandate's delegator is the chain's root: a call back into it is refused before any
215
+ // caveat is read, as the manager refuses it. (A child's root is judged by `verifyAuthorityChain`.)
216
+ if (input.step.callTarget && d.authority.toLowerCase() === ROOT_AUTHORITY.toLowerCase() && isSelfTargetedRedemption([d], input.step.callTarget)) {
217
+ return deny(SELF_TARGET_REASON, 'the redemption would make the delegator\'s own account call itself — the DelegationManager refuses a self-targeted redemption (SelfTargetedRedemption)');
218
+ }
164
219
  // 2. live
165
220
  const live = await verifyLiveDelegation({ delegation: d, expectedDelegate: input.actor, enforcers: input.enforcers, checks: input.checks, now: input.now });
166
221
  if (!live.ok)
@@ -197,21 +252,98 @@ export async function verifyMandateForStep(input) {
197
252
  if (bindings.plan && (!input.step.planDigest || lc(bindings.plan) !== lc(input.step.planDigest))) {
198
253
  return deny('plan-mismatch', input.step.planDigest ? 'the mandate was granted over a different plan for this intent' : 'the mandate binds a plan and this step presents none');
199
254
  }
200
- // The handler first: it decides the type-specific limits (5) AND which caveats it judges itself (4).
255
+ // 4 + 5. The caveats against the step, strictly, and the handler's type-specific limits — the SAME judgement
256
+ // `verifyAuthorityChain` applies to every parent of this leaf (spec 445 §3.1), so a link is never held to a
257
+ // different step than the one above or below it.
258
+ const judged = judgeLinkForStep({
259
+ link: d, requirementType: input.requirementType, step: input.step, target: stepTarget(input.step, d),
260
+ digestOfIntent, enforcers: input.enforcers, now: input.now, handlers: input.handlers, mustBeMandate: true,
261
+ });
262
+ evidence.verdicts = judged.verdicts;
263
+ if (judged.denial)
264
+ return deny(judged.denial.code, judged.denial.message);
265
+ // 6. SINGLE USE (spec 445 / AUTH-5) — last, so a step refused for any other reason spends nothing. A step
266
+ // that redeems on chain is consumed THERE (the enforcer nonce); a presentation answers the venue's challenge;
267
+ // every other step is recorded here or it does not run.
268
+ if (input.step.redeemsOnChain !== true && subsetHandlerFor(input.requirementType, input.handlers)?.answersPerChallenge !== true) {
269
+ const use = input.step.use;
270
+ if (!input.uses || !use || typeof use.operation !== 'string' || !use.operation || typeof use.holder !== 'string' || !use.holder) {
271
+ return deny('single-use-unrecorded', 'this step does not redeem on chain, so its single use must be recorded off chain — the verifier was given no use ledger, or the step no operation and holder; a mandate nobody counts is not single-use');
272
+ }
273
+ let claimed = false;
274
+ try {
275
+ claimed = (await input.uses.claim({ mandateRef: evidence.mandateRef, stepNonce: digestBindingStepNonce(digestOfIntent, use.operation), holder: use.holder })) === true;
276
+ }
277
+ catch (e) {
278
+ return deny('single-use-unrecorded', `the use ledger could not record this step (${e instanceof Error ? e.message : 'unavailable'}) — refused rather than run uncounted`);
279
+ }
280
+ if (!claimed)
281
+ return deny('mandate-already-used', 'this mandate was already used for this step by another run — a mandate authorizes each step once');
282
+ }
283
+ return { decision: 'allow', obligations: [], evidence };
284
+ }
285
+ // ─── One link, one step (spec 445 §3.1) ────────────────────────────────────────────────────────────
286
+ //
287
+ // THE RULE: a step is judged against EVERY link of the chain it is presented under, by one function, in one
288
+ // context. WHY: the leaf is written by whoever holds the parent's delegate key. A verifier that reads only the
289
+ // leaf has asked the party under suspicion what it is allowed to do (audit H-7 / AUTH-1). On chain the
290
+ // DelegationManager runs every link's enforcers against the one call; this is its off-chain twin.
291
+ /** The digest of the intent THIS step acts under — recomputed under the versions the verifier runs with
292
+ * (spec 410 §5) when given. One definition, so the leaf and its parents are compared to the same bytes. */
293
+ export function stepIntentDigest(step, currentVersions) {
294
+ return intentDigest(currentVersions && step.intent && typeof step.intent === 'object' ? withVersions(step.intent, currentVersions) : step.intent);
295
+ }
296
+ /** The call TARGET a step's `allowedTargets` caveats are judged against: the step's resource (the agent being
297
+ * acted for, or the asset contract of a payment), else the LEAF's delegator. Computed once from the leaf and
298
+ * used for every link — a parent is not judged against a kinder target than its child. */
299
+ export function stepTarget(step, leaf) {
300
+ return (step.resource ?? leaf.delegator);
301
+ }
302
+ /** What a link GRANTS, read by the type's handler — a mandate (intent-bound) or a standing wire (none). Null
303
+ * when the link does not decode as `type`, or its terms cannot be read: unreadable is never "unbounded". */
304
+ export function readGrant(d, type, enforcers, from) {
305
+ const h = subsetHandlerFor(type, from);
306
+ if (!h)
307
+ return null;
308
+ try {
309
+ const base = h.fromCaveats(d.caveats, enforcers);
310
+ if (!base)
311
+ return null;
312
+ const bindings = readDigestBindings(d.caveats, enforcers.digestBinding);
313
+ return { ...base, ...(bindings.intent ? { intentDigest: bindings.intent } : {}), ...(bindings.projection ? { projectionDigest: bindings.projection } : {}), ...(bindings.offer ? { offerDigest: bindings.offer } : {}), ...(bindings.plan ? { planDigest: bindings.plan } : {}), ...redemptionsOf(d, enforcers) };
314
+ }
315
+ catch {
316
+ return null;
317
+ }
318
+ }
319
+ /**
320
+ * Is this step within THIS link? The caveats, strictly, against the step (capability selector, target, value,
321
+ * intent / offer / projection / plan digests, payload classes), then the handler's type-specific limits
322
+ * (amount and payee; audience, predicate program and issuer facet).
323
+ *
324
+ * STRICT means: a caveat no off-chain judge can answer DENIES — unless the step redeems on chain
325
+ * (`redeemsOnChain`, where every link's enforcer fires and the chain itself holds the parent) or the type
326
+ * handler compares that caveat's terms itself, which it can only do for a link that decodes as its type.
327
+ */
328
+ export function judgeLinkForStep(input) {
329
+ const d = input.link;
201
330
  const h = subsetHandlerFor(input.requirementType, input.handlers);
202
331
  if (!h)
203
- return deny('no-handler', `no subset handler for ${input.requirementType} — an authority nobody can bound is not verified`);
204
- const selector = methodSelector(input.step.capability);
205
- const verdicts = evaluateCaveats(d.caveats, {
332
+ return { verdicts: [], denial: { code: 'no-handler', message: `no subset handler for ${input.requirementType} — an authority nobody can bound is not verified` } };
333
+ // A parent is read FIRST: the handler may vouch for a caveat (`judgesEnforcers`) only on a link it can read.
334
+ // The leaf is read after its caveats, as it always was — if it does not decode it is refused below.
335
+ const grant = input.mustBeMandate ? null : readGrant(d, input.requirementType, input.enforcers, input.handlers);
336
+ const handlerJudges = input.mustBeMandate || grant !== null;
337
+ const raw = evaluateCaveats(d.caveats, {
206
338
  timestamp: input.now,
207
339
  // The call TARGET is the step's resource: the agent being acted for (a membership add on an org),
208
340
  // or the asset contract (a payment). Both are what `allowedTargets` was encoded against.
209
- target: (input.step.resource ?? d.delegator),
210
- selector,
341
+ target: input.target,
342
+ selector: methodSelector(input.step.capability),
211
343
  // The ETH value the step sends — 0 when it sends none. A fact about the step (spec 408 §2.2).
212
344
  value: input.step.value ?? 0n,
213
345
  digests: {
214
- intent: digestOfIntent,
346
+ intent: input.digestOfIntent,
215
347
  ...(input.step.projectionDigest ? { projection: input.step.projectionDigest } : {}),
216
348
  ...(input.step.offerDigest ? { offer: input.step.offerDigest } : {}),
217
349
  ...(input.step.planDigest ? { plan: input.step.planDigest } : {}),
@@ -221,35 +353,58 @@ export async function verifyMandateForStep(input) {
221
353
  // R917-P-1 (spec 408 §2.2): STRICT unless this step redeems on chain, where every enforcer fires. The
222
354
  // previous `enforceOnChain: true` on every step let a caveat nobody judged off chain pass as
223
355
  // "enforced-on-chain" for steps that never reached the chain — the evaluator's own contract forbids
224
- // that for an off-chain gate, and this IS one.
356
+ // that for an off-chain gate, and this IS one. Spec 445 §3.1: the same holds for every PARENT, which
357
+ // until then was read with a timestamp-only context and passed whatever it said.
225
358
  enforceOnChain: input.step.redeemsOnChain === true,
226
- judgedElsewhere: new Set((h.judgesEnforcers?.(input.enforcers) ?? []).map(lc)),
359
+ judgedElsewhere: new Set(handlerJudges ? (h.judgesEnforcers?.(input.enforcers) ?? []).map(lc) : []),
227
360
  });
228
- evidence.verdicts = verdicts.map((v) => ({ enforcer: v.enforcer, allowed: v.allowed, ...(v.reason ? { reason: v.reason } : {}) }));
229
- const denied = verdicts.find((v) => !v.allowed);
361
+ const verdicts = raw.map((v) => ({ enforcer: v.enforcer, allowed: v.allowed, ...(v.reason ? { reason: v.reason } : {}) }));
362
+ const denied = raw.find((v) => !v.allowed);
230
363
  if (denied) {
231
364
  const isReason = /digest mismatch|binding present/.test(denied.reason ?? '');
232
- return deny(isReason ? 'intent-mismatch' : 'caveat-denied', denied.reason ?? 'caveat denied');
365
+ return { verdicts, denial: { code: isReason ? 'intent-mismatch' : 'caveat-denied', message: denied.reason ?? 'caveat denied' } };
366
+ }
367
+ // Type-specific limits.
368
+ let req;
369
+ if (input.mustBeMandate) {
370
+ const m = readMandate(d, input.requirementType, input.enforcers, input.handlers);
371
+ if (!m)
372
+ return { verdicts, denial: { code: 'not-a-mandate', message: `the presented delegation does not decode as a ${input.requirementType} mandate` } };
373
+ req = m;
374
+ }
375
+ else {
376
+ // A parent the handler cannot read grants nothing the handler can compare: its caveats were judged
377
+ // strictly above with nobody vouching for any of them, and that is the whole of its judgement.
378
+ if (!grant)
379
+ return { verdicts, denial: null };
380
+ // A standing wire binds no intent: any reason is within it. One that binds a reason was compared above.
381
+ req = { ...grant, intentDigest: grant.intentDigest ?? input.digestOfIntent };
233
382
  }
234
- // 5. type-specific limits
235
- const req = readMandate(d, input.requirementType, input.enforcers, input.handlers);
236
- if (!req)
237
- return deny('not-a-mandate', `the presented delegation does not decode as a ${input.requirementType} mandate`);
238
383
  // Actions, resources and limits are ALL the handler's to judge — a read-back capability mandate
239
384
  // carries `sel:<hex>` actions while a step carries the id, and only the handler knows they are the
240
385
  // same. Asking it "would a requirement shaped like this step be a subset?" gives every type-specific
241
386
  // comparison exactly one definition. The reason names what failed so a denial is actionable.
387
+ const within = (child) => {
388
+ if (input.mustBeMandate)
389
+ return h.isSubset(child, req);
390
+ try {
391
+ return h.isSubset(child, req);
392
+ }
393
+ catch {
394
+ return false;
395
+ } // a parent whose limits cannot be read admits nothing
396
+ };
242
397
  const shaped = stepAsRequirement(req, input.step, h);
243
- if (!h.isSubset(shaped, req)) {
244
- if (!h.isSubset({ ...shaped, locations: req.locations, limits: req.limits }, req)) {
245
- return deny('action-not-granted', `${shaped.actions.map((a) => `"${a}"`).join(', ')} is not among the mandate's actions`);
398
+ if (!within(shaped)) {
399
+ if (!within({ ...shaped, locations: req.locations, limits: req.limits })) {
400
+ return { verdicts, denial: { code: 'action-not-granted', message: `${shaped.actions.map((a) => `"${a}"`).join(', ')} is not among the mandate's actions` } };
246
401
  }
247
- if (input.step.resource && !h.isSubset({ ...shaped, limits: req.limits }, req)) {
248
- return deny('resource-not-granted', `resource ${input.step.resource} is not among the mandate's locations`);
402
+ if (input.step.resource && !within({ ...shaped, limits: req.limits })) {
403
+ return { verdicts, denial: { code: 'resource-not-granted', message: `resource ${input.step.resource} is not among the mandate's locations` } };
249
404
  }
250
- return deny('limit-exceeded', `step exceeds the mandate's ${h.type} limits`);
405
+ return { verdicts, denial: { code: 'limit-exceeded', message: `step exceeds the mandate's ${h.type} limits` } };
251
406
  }
252
- return { decision: 'allow', obligations: [], evidence };
407
+ return { verdicts, denial: null };
253
408
  }
254
409
  /** The step, re-expressed as a requirement, so the handler can compare like with like. */
255
410
  function stepAsRequirement(req, step, h) {