@agenticprimitives/delegation 1.0.0-alpha.6 → 1.0.0-alpha.8

package/README.md

@@ -1,12 +1,19 @@
 # @agenticprimitives/delegation
 
-EIP-712 smart-account delegations spanning web app → agent → MCP. **Now also owns session lifecycle** — `SessionManager` binds a delegation to its session-signing key, persisted via `@agenticprimitives/key-custody` envelope encryption.
+**One delegation model, everywhere — permissions, never keys.**
+
+When an agent acts for a human, most stacks hand it a key and hope. This package hands it a delegation instead: an EIP-712 signed grant from a Smart Agent, constrained by caveats that on-chain enforcers actually check — time windows, value caps, allowed targets and methods, quorums — and revocable on-chain at any moment. The same primitive spans the whole stack: a web app session, an agent-to-agent call, and an MCP tool invocation all verify against the same `Delegation` struct. "This session may call these two tools until tomorrow, and I can kill it instantly" is one signed object, not three products.
+
+The package also owns session lifecycle: `SessionManager` binds a delegation to its session-signing key, with the private key envelope-encrypted via `@agenticprimitives/key-custody` before it ever touches storage. Verification is fail-closed by design — an unknown enforcer is a rejection, not a warning — and minted tokens carry JTI replay protection. Because the principal is the Smart Agent address, not a credential, every delegation survives the issuer's credential rotation; and because custody is firewalled from delegation, no delegate can ever escalate into account control ([ADR-0011](../../docs/architecture/decisions/0011-credential-recovery-and-re-association.md)).
+
+> Part of [agenticprimitives](../../README.md) — the trust substrate for the agent economy: one canonical Smart Agent identity with custody, delegation, naming, credentials, and audit evidence designed as one system.
 
 See [`spec.md`](./spec.md) → [`specs/202-delegation.md`](../../specs/202-delegation.md) for the full contract: 8 on-chain enforcers, 3 off-chain sentinels, token envelope, cross-delegation, two session variants.
 
 ## Quick start
 
 Browser (issuance):
+
 ```ts
 import { DelegationClient, buildMcpToolScopeCaveat, encodeTimestampTerms, buildCaveat } from '@agenticprimitives/delegation';
 
@@ -21,6 +28,7 @@ const delegation = await client.issueDelegation({
 ```
 
 Node (session lifecycle):
+
 ```ts
 import { SessionManager } from '@agenticprimitives/delegation';
 
@@ -31,6 +39,7 @@ await sessions.package(sessionId, signedDelegation);
 ```
 
 Node (token mint + verify):
+
 ```ts
 import { mintDelegationToken, verifyDelegationToken } from '@agenticprimitives/delegation';
 
@@ -41,6 +50,12 @@ if ('error' in result) throw new Error(result.error);
 const { principal, grants } = result;
 ```
 
+`principal` is the verified delegator's Smart Agent address — every downstream action is attributable to a canonical on-chain identity, not an API key.
+
+## How it's different
+
+The closest neighbors are MetaMask's Delegation Toolkit and the session-key features in smart-account SDKs — both real, both well-built, and the caveat-enforcer shape here deliberately mirrors the ERC-7710 direction so the models stay interoperable. The differences are scope and posture. Session keys typically live and die inside one wallet stack and one transport; this delegation crosses transports — the token a browser session mints is the token an MCP server or A2A endpoint verifies, against the same on-chain enforcer registry. And the evaluator's posture is fail-closed as a hard invariant: unknown enforcer means reject, with no permissive default to quietly widen authority. Custody operations are structurally excluded — a delegation here cannot rotate credentials or change account control, ever, because that path doesn't exist in this package.
+
 ## Status
 
-Alpha track — testnet-only. Spec + API stable; do not deploy to production until the gates listed in the root [`README.md` Status section](../../README.md#status) are cleared.
+**Alpha track — testnet-only.** Spec + API stable; do not deploy to production until the gates listed in the root [`README.md` Status section](../../README.md#status) are cleared — including third-party contract audit and governance key rotation. Track every security finding live in [`docs/audits/findings.yaml`](../../docs/audits/findings.yaml).

package/dist/caveats.d.ts

@@ -52,4 +52,63 @@ export interface QuorumCaveatOpts {
  * into the on-chain caveat evaluation.
  */
 export declare function buildQuorumCaveat(opts: QuorumCaveatOpts): Caveat;
+/** The ONLY method an x402 payment delegation may invoke: `IERC20.transfer(address,uint256)`. */
+export declare const PAYMENT_TRANSFER_SELECTOR: Hex;
+export interface PaymentMandateCaveatOpts {
+    /** Deployed enforcer addresses: the PaymentEnforcer + the timestamp / allowedTargets /
+     *  allowedMethods enforcers it composes with (from `EnforcerAddressMap`). */
+    enforcers: {
+        payment: Address;
+        timestamp: Address;
+        allowedTargets: Address;
+        allowedMethods: Address;
+    };
+    /** Treasury SA that receives every charge (payee). */
+    payee: Address;
+    /** Fee asset (USDC). */
+    asset: Address;
+    /** Smallest-unit caps. `maxAggregate` is the session budget (X402-D5). */
+    maxAmountPerCharge: bigint;
+    maxAggregate: bigint;
+    maxRedemptionsPerWindow: number;
+    windowSeconds: number;
+    validAfter?: number;
+    validUntil: number;
+}
+/** Encode the immutable `PaymentEnforcer` terms. MUST match `PaymentEnforcer.sol` `abi.decode`
+ *  order/types: (treasury, asset, maxAmountPerCharge, maxAggregate, maxRedemptionsPerWindow,
+ *  windowSeconds) → 192 bytes. */
+export declare function encodePaymentTerms(opts: {
+    payee: Address;
+    asset: Address;
+    maxAmountPerCharge: bigint;
+    maxAggregate: bigint;
+    maxRedemptionsPerWindow: number;
+    windowSeconds: number;
+}): Hex;
+/**
+ * PAY-DEL-1 — the caveat set for an x402 PAYMENT delegation (delegator = reader, delegate = the
+ * paid service agent). Composes the stateful `PaymentEnforcer` (spend + windowed-frequency cap +
+ * transfer-only + single-use nonce) with `timestamp` (expiry), `allowedTargets` (USDC only), and
+ * `allowedMethods` (transfer only) so the on-chain enforcers and the off-chain mandate agree.
+ *
+ * Caveat `args` are left `'0x'` at mint; the rail executor fills the PaymentEnforcer caveat's `args`
+ * with `abi.encode(mandateId, nonce, resourceHash)` at REDEMPTION time (terms = mint, args = redeem).
+ * Resource/skill binding rides the mandate's `contextBinding`, not an on-chain caveat (PAY-WIRE-5).
+ */
+export declare function buildPaymentMandateCaveats(opts: PaymentMandateCaveatOpts): Caveat[];
+/** PAY-DEL-4 — human-readable consent for the connect UI ("Allow X to charge your agent wallet?").
+ *  The UI renders THIS, never raw `delegate execute to contract`. Amounts are smallest-unit; the
+ *  caller formats with the token's decimals. */
+export interface PaymentMandateConsent {
+    recipient: Address;
+    asset: Address;
+    maxAmountPerCharge: bigint;
+    sessionBudget: bigint;
+    maxRedemptionsPerWindow: number;
+    windowSeconds: number;
+    expiresAt: number;
+    revocable: true;
+}
+export declare function describePaymentMandate(opts: PaymentMandateCaveatOpts): PaymentMandateConsent;
 //# sourceMappingURL=caveats.d.ts.map

package/dist/caveats.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"caveats.d.ts","sourceRoot":"","sources":["../src/caveats.ts"],"names":[],"mappings":"AAQA,OAAO,EAAkC,KAAK,GAAG,EAAE,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AAE9E,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAWtD,eAAO,MAAM,uBAAuB,EAAE,OAA2D,CAAC;AAClG,eAAO,MAAM,mBAAmB,EAAE,OAAuD,CAAC;AAC1F,eAAO,MAAM,yBAAyB,EAAE,OAA6D,CAAC;AAItG,wBAAgB,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,GAAG,MAAM,CAE7E;AAID,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,GAAG,CAWhF;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAGtD;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,GAAG,CAGjE;AAED,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,GAAG,CAQ/D;AAED;;;oGAGoG;AACpG,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,GAAG,GAAG,GAAG,CAK1D;AAID,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,CAItE;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,CAgBrE;AAED,wBAAgB,0BAA0B,CACxC,oBAAoB,EAAE,OAAO,EAC7B,mBAAmB,EAAE,OAAO,GAC3B,MAAM,CAMR;AAWD,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;yDAEqD;IACrD,OAAO,EAAE,OAAO,EAAE,CAAC;IACnB;;kDAE8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB;kEAC8D;IAC9D,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAwBhE"}
+{"version":3,"file":"caveats.d.ts","sourceRoot":"","sources":["../src/caveats.ts"],"names":[],"mappings":"AAQA,OAAO,EAAkC,KAAK,GAAG,EAAE,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AAE9E,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAWtD,eAAO,MAAM,uBAAuB,EAAE,OAA2D,CAAC;AAClG,eAAO,MAAM,mBAAmB,EAAE,OAAuD,CAAC;AAC1F,eAAO,MAAM,yBAAyB,EAAE,OAA6D,CAAC;AAItG,wBAAgB,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,GAAG,MAAM,CAE7E;AAID,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,GAAG,CAWhF;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAGtD;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,GAAG,CAGjE;AAED,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,GAAG,CAQ/D;AAED;;;oGAGoG;AACpG,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,GAAG,GAAG,GAAG,CAK1D;AAID,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,CAItE;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,CAgBrE;AAED,wBAAgB,0BAA0B,CACxC,oBAAoB,EAAE,OAAO,EAC7B,mBAAmB,EAAE,OAAO,GAC3B,MAAM,CAMR;AAWD,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;yDAEqD;IACrD,OAAO,EAAE,OAAO,EAAE,CAAC;IACnB;;kDAE8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB;kEAC8D;IAC9D,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAwBhE;AAID,iGAAiG;AACjG,eAAO,MAAM,yBAAyB,EAAE,GAAkB,CAAC;AAE3D,MAAM,WAAW,wBAAwB;IACvC;iFAC6E;IAC7E,SAAS,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,cAAc,EAAE,OAAO,CAAC;QAAC,cAAc,EAAE,OAAO,CAAA;KAAE,CAAC;IACtG,sDAAsD;IACtD,KAAK,EAAE,OAAO,CAAC;IACf,wBAAwB;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,0EAA0E;IAC1E,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,uBAAuB,EAAE,MAAM,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;kCAEkC;AAClC,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,uBAAuB,EAAE,MAAM,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG,GAAG,CA6BN;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,wBAAwB,GAAG,MAAM,EAAE,CAOnF;AAED;;gDAEgD;AAChD,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,MAAM,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,wBAAwB,GAAG,qBAAqB,CAW5F"}

package/dist/caveats.js

@@ -123,4 +123,68 @@ export function buildQuorumCaveat(opts) {
     ], [opts.signers, opts.threshold, opts.approvedHashRegistry]);
     return { enforcer: opts.enforcer, terms, args: '0x' };
 }
+// ── Spec 272 (PAY-DEL-1) — x402 payment-mandate caveats ───────────────────────────────────────────
+/** The ONLY method an x402 payment delegation may invoke: `IERC20.transfer(address,uint256)`. */
+export const PAYMENT_TRANSFER_SELECTOR = '0xa9059cbb';
+/** Encode the immutable `PaymentEnforcer` terms. MUST match `PaymentEnforcer.sol` `abi.decode`
+ *  order/types: (treasury, asset, maxAmountPerCharge, maxAggregate, maxRedemptionsPerWindow,
+ *  windowSeconds) → 192 bytes. */
+export function encodePaymentTerms(opts) {
+    if (opts.maxAmountPerCharge <= 0n)
+        throw new Error('encodePaymentTerms: maxAmountPerCharge must be > 0');
+    if (opts.maxAggregate < opts.maxAmountPerCharge) {
+        throw new Error('encodePaymentTerms: maxAggregate must be >= maxAmountPerCharge');
+    }
+    if (!Number.isInteger(opts.maxRedemptionsPerWindow) || opts.maxRedemptionsPerWindow <= 0) {
+        throw new Error('encodePaymentTerms: maxRedemptionsPerWindow must be a positive integer');
+    }
+    if (!Number.isInteger(opts.windowSeconds) || opts.windowSeconds <= 0) {
+        throw new Error('encodePaymentTerms: windowSeconds must be a positive integer');
+    }
+    return encodeAbiParameters([
+        { type: 'address' },
+        { type: 'address' },
+        { type: 'uint256' },
+        { type: 'uint256' },
+        { type: 'uint32' },
+        { type: 'uint32' },
+    ], [
+        opts.payee,
+        opts.asset,
+        opts.maxAmountPerCharge,
+        opts.maxAggregate,
+        opts.maxRedemptionsPerWindow,
+        opts.windowSeconds,
+    ]);
+}
+/**
+ * PAY-DEL-1 — the caveat set for an x402 PAYMENT delegation (delegator = reader, delegate = the
+ * paid service agent). Composes the stateful `PaymentEnforcer` (spend + windowed-frequency cap +
+ * transfer-only + single-use nonce) with `timestamp` (expiry), `allowedTargets` (USDC only), and
+ * `allowedMethods` (transfer only) so the on-chain enforcers and the off-chain mandate agree.
+ *
+ * Caveat `args` are left `'0x'` at mint; the rail executor fills the PaymentEnforcer caveat's `args`
+ * with `abi.encode(mandateId, nonce, resourceHash)` at REDEMPTION time (terms = mint, args = redeem).
+ * Resource/skill binding rides the mandate's `contextBinding`, not an on-chain caveat (PAY-WIRE-5).
+ */
+export function buildPaymentMandateCaveats(opts) {
+    return [
+        buildCaveat(opts.enforcers.payment, encodePaymentTerms(opts)),
+        buildCaveat(opts.enforcers.timestamp, encodeTimestampTerms(opts.validAfter ?? 0, opts.validUntil)),
+        buildCaveat(opts.enforcers.allowedTargets, encodeAllowedTargetsTerms([opts.asset])),
+        buildCaveat(opts.enforcers.allowedMethods, encodeAllowedMethodsTerms([PAYMENT_TRANSFER_SELECTOR])),
+    ];
+}
+export function describePaymentMandate(opts) {
+    return {
+        recipient: opts.payee,
+        asset: opts.asset,
+        maxAmountPerCharge: opts.maxAmountPerCharge,
+        sessionBudget: opts.maxAggregate,
+        maxRedemptionsPerWindow: opts.maxRedemptionsPerWindow,
+        windowSeconds: opts.windowSeconds,
+        expiresAt: opts.validUntil,
+        revocable: true,
+    };
+}
 //# sourceMappingURL=caveats.js.map

package/dist/caveats.js.map

@@ -1 +1 @@
-{"version":3,"file":"caveats.js","sourceRoot":"","sources":["../src/caveats.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,8BAA8B;AAE9B,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAA0B,MAAM,MAAM,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAGnD,4EAA4E;AAE5E,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1E,OAAO,GAAc,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAY,eAAe,CAAC,gCAAgC,CAAC,CAAC;AAClG,MAAM,CAAC,MAAM,mBAAmB,GAAY,eAAe,CAAC,4BAA4B,CAAC,CAAC;AAC1F,MAAM,CAAC,MAAM,yBAAyB,GAAY,eAAe,CAAC,kCAAkC,CAAC,CAAC;AAEtG,4EAA4E;AAE5E,MAAM,UAAU,WAAW,CAAC,QAAiB,EAAE,KAAU,EAAE,IAAU;IACnE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;AACjD,CAAC;AAED,4EAA4E;AAE5E,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,UAAkB;IACzE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,UAAU,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,mBAAmB,CACxB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAC1C,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CACzC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,QAAQ,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACtF,OAAO,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAkB;IAC1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IACrG,OAAO,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,SAAgB;IACxD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACzG,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,sCAAsC,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;IACD,OAAO,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;oGAGoG;AACpG,MAAM,UAAU,uBAAuB,CAAC,QAAa;IACnD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,4EAA4E;AAE5E,MAAM,UAAU,uBAAuB,CAAC,YAAsB;IAC5D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACtG,MAAM,KAAK,GAAG,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAC1E,OAAO,EAAE,QAAQ,EAAE,uBAAuB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAwB;IAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC9F,MAAM,KAAK,GAAG,mBAAmB,CAC/B;QACE;YACE,IAAI,EAAE,SAAS;YACf,UAAU,EAAE;gBACV,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAClC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE;gBACvC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE;aACrC;SACF;KACF,EACD,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,oBAA6B,EAC7B,mBAA4B;IAE5B,MAAM,KAAK,GAAG,mBAAmB,CAC/B,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAC1C,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,CAC5C,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,yBAAyB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACpE,CAAC;AAgCD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAsB;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,CAAC,SAAS,8BAA8B,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CACpG,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,CAC/B;QACE,EAAE,IAAI,EAAE,WAAW,EAAE;QACrB,EAAE,IAAI,EAAE,OAAO,EAAE;QACjB,EAAE,IAAI,EAAE,SAAS,EAAE;KACpB,EACD,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAC1D,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxD,CAAC"}
+{"version":3,"file":"caveats.js","sourceRoot":"","sources":["../src/caveats.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,8BAA8B;AAE9B,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAA0B,MAAM,MAAM,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAGnD,4EAA4E;AAE5E,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1E,OAAO,GAAc,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAY,eAAe,CAAC,gCAAgC,CAAC,CAAC;AAClG,MAAM,CAAC,MAAM,mBAAmB,GAAY,eAAe,CAAC,4BAA4B,CAAC,CAAC;AAC1F,MAAM,CAAC,MAAM,yBAAyB,GAAY,eAAe,CAAC,kCAAkC,CAAC,CAAC;AAEtG,4EAA4E;AAE5E,MAAM,UAAU,WAAW,CAAC,QAAiB,EAAE,KAAU,EAAE,IAAU;IACnE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;AACjD,CAAC;AAED,4EAA4E;AAE5E,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,UAAkB;IACzE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,UAAU,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,mBAAmB,CACxB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAC1C,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CACzC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,QAAQ,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACtF,OAAO,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAkB;IAC1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IACrG,OAAO,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,SAAgB;IACxD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACzG,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,sCAAsC,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;IACD,OAAO,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;oGAGoG;AACpG,MAAM,UAAU,uBAAuB,CAAC,QAAa;IACnD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,4EAA4E;AAE5E,MAAM,UAAU,uBAAuB,CAAC,YAAsB;IAC5D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACtG,MAAM,KAAK,GAAG,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAC1E,OAAO,EAAE,QAAQ,EAAE,uBAAuB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAwB;IAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC9F,MAAM,KAAK,GAAG,mBAAmB,CAC/B;QACE;YACE,IAAI,EAAE,SAAS;YACf,UAAU,EAAE;gBACV,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAClC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE;gBACvC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE;aACrC;SACF;KACF,EACD,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,oBAA6B,EAC7B,mBAA4B;IAE5B,MAAM,KAAK,GAAG,mBAAmB,CAC/B,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAC1C,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,CAC5C,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,yBAAyB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACpE,CAAC;AAgCD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAsB;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,CAAC,SAAS,8BAA8B,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CACpG,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,CAC/B;QACE,EAAE,IAAI,EAAE,WAAW,EAAE;QACrB,EAAE,IAAI,EAAE,OAAO,EAAE;QACjB,EAAE,IAAI,EAAE,SAAS,EAAE;KACpB,EACD,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAC1D,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxD,CAAC;AAED,qGAAqG;AAErG,iGAAiG;AACjG,MAAM,CAAC,MAAM,yBAAyB,GAAQ,YAAY,CAAC;AAmB3D;;kCAEkC;AAClC,MAAM,UAAU,kBAAkB,CAAC,IAOlC;IACC,IAAI,IAAI,CAAC,kBAAkB,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACzG,IAAI,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC,uBAAuB,IAAI,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,mBAAmB,CACxB;QACE,EAAE,IAAI,EAAE,SAAS,EAAE;QACnB,EAAE,IAAI,EAAE,SAAS,EAAE;QACnB,EAAE,IAAI,EAAE,SAAS,EAAE;QACnB,EAAE,IAAI,EAAE,SAAS,EAAE;QACnB,EAAE,IAAI,EAAE,QAAQ,EAAE;QAClB,EAAE,IAAI,EAAE,QAAQ,EAAE;KACnB,EACD;QACE,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,kBAAkB;QACvB,IAAI,CAAC,YAAY;QACjB,IAAI,CAAC,uBAAuB;QAC5B,IAAI,CAAC,aAAa;KACnB,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAA8B;IACvE,OAAO;QACL,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC7D,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAClG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACnF,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC;KACnG,CAAC;AACJ,CAAC;AAgBD,MAAM,UAAU,sBAAsB,CAAC,IAA8B;IACnE,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,KAAK;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,aAAa,EAAE,IAAI,CAAC,YAAY;QAChC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,7 +1,9 @@
 export { ROOT_AUTHORITY } from './types';
-export { buildCaveat, buildMcpToolScopeCaveat, buildDataScopeCaveat, buildDelegateBindingCaveat, buildQuorumCaveat, encodeTimestampTerms, encodeValueTerms, encodeAllowedTargetsTerms, encodeAllowedMethodsTerms, encodeCallDataHashTerms, MCP_TOOL_SCOPE_ENFORCER, DATA_SCOPE_ENFORCER, DELEGATE_BINDING_ENFORCER, } from './caveats';
-export type { QuorumCaveatOpts } from './caveats';
+export { buildCaveat, buildMcpToolScopeCaveat, buildDataScopeCaveat, buildDelegateBindingCaveat, buildQuorumCaveat, encodeTimestampTerms, encodeValueTerms, encodeAllowedTargetsTerms, encodeAllowedMethodsTerms, encodeCallDataHashTerms, MCP_TOOL_SCOPE_ENFORCER, DATA_SCOPE_ENFORCER, DELEGATE_BINDING_ENFORCER, PAYMENT_TRANSFER_SELECTOR, encodePaymentTerms, buildPaymentMandateCaveats, describePaymentMandate, } from './caveats';
+export type { QuorumCaveatOpts, PaymentMandateCaveatOpts, PaymentMandateConsent } from './caveats';
 export { hashDelegation, hashCaveats, DELEGATION_EIP712_TYPES, delegationDomain } from './hash';
+export { buildSessionDelegation } from './session-delegation';
+export type { SessionDelegationParams } from './session-delegation';
 export { evaluateCaveats } from './evaluator';
 export { DelegationClient } from './client';
 export { SessionManager, createMemorySessionStore } from './session-manager';
@@ -12,8 +14,8 @@ export { SessionManager, createMemorySessionStore } from './session-manager';
  */
 export { verifyAuthorization } from './verify-authorization';
 export type { VerifyAuthorizationResult } from './verify-authorization';
-export { mintDelegationToken, verifyDelegationToken } from './token';
-export { isRevoked, revokeDelegation } from './onchain';
+export { mintDelegationToken, verifyDelegationToken, sessionDelegateBindingError } from './token';
+export { isRevoked, buildRevokeDelegationCall } from './onchain';
 export type { Address, Hex, Caveat, CaveatContext, CaveatVerdict, Delegation, DataScopeGrant, DelegationClientOpts, DelegationTokenClaims, EnforcerAddressMap, EvaluateOpts, JtiStore, SessionMeta, SessionPackage, SessionRow, SessionStore, TxContext, VerifyError, VerifyOpts, } from './types';
 export type { VerifyOptsExt } from './token';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,oBAAoB,EACpB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAChG,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAE7E;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,YAAY,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAMxE,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAExD,YAAY,EACV,OAAO,EACP,GAAG,EACH,MAAM,EACN,aAAa,EACb,aAAa,EACb,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,cAAc,EACd,UAAU,EACV,YAAY,EACZ,SAAS,EACT,WAAW,EACX,UAAU,GACX,MAAM,SAAS,CAAC;AAKjB,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,oBAAoB,EACpB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,EACzB,yBAAyB,EACzB,kBAAkB,EAClB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAEnG,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAEhG,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,YAAY,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAE7E;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,YAAY,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAMxE,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAClG,OAAO,EAAE,SAAS,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAEjE,YAAY,EACV,OAAO,EACP,GAAG,EACH,MAAM,EACN,aAAa,EACb,aAAa,EACb,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,cAAc,EACd,UAAU,EACV,YAAY,EACZ,SAAS,EACT,WAAW,EACX,UAAU,GACX,MAAM,SAAS,CAAC;AAKjB,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -2,8 +2,10 @@
 //
 // See ../../specs/202-delegation.md for the full contract.
 export { ROOT_AUTHORITY } from './types';
-export { buildCaveat, buildMcpToolScopeCaveat, buildDataScopeCaveat, buildDelegateBindingCaveat, buildQuorumCaveat, encodeTimestampTerms, encodeValueTerms, encodeAllowedTargetsTerms, encodeAllowedMethodsTerms, encodeCallDataHashTerms, MCP_TOOL_SCOPE_ENFORCER, DATA_SCOPE_ENFORCER, DELEGATE_BINDING_ENFORCER, } from './caveats';
+export { buildCaveat, buildMcpToolScopeCaveat, buildDataScopeCaveat, buildDelegateBindingCaveat, buildQuorumCaveat, encodeTimestampTerms, encodeValueTerms, encodeAllowedTargetsTerms, encodeAllowedMethodsTerms, encodeCallDataHashTerms, MCP_TOOL_SCOPE_ENFORCER, DATA_SCOPE_ENFORCER, DELEGATE_BINDING_ENFORCER, PAYMENT_TRANSFER_SELECTOR, encodePaymentTerms, buildPaymentMandateCaveats, describePaymentMandate, } from './caveats';
 export { hashDelegation, hashCaveats, DELEGATION_EIP712_TYPES, delegationDomain } from './hash';
+// DEL-001 session-delegation leaf builder (spec 270 v4 W2) — every connect flow uses this.
+export { buildSessionDelegation } from './session-delegation';
 export { evaluateCaveats } from './evaluator';
 export { DelegationClient } from './client';
 export { SessionManager, createMemorySessionStore } from './session-manager';
@@ -17,6 +19,6 @@ export { verifyAuthorization } from './verify-authorization';
 // EXT-024 closure). The stub unconditionally returned a "not implemented"
 // error string — a public symbol that lies about runtime capability. When the
 // work resumes it lands behind `./experimental` per spec 100 §6.
-export { mintDelegationToken, verifyDelegationToken } from './token';
-export { isRevoked, revokeDelegation } from './onchain';
+export { mintDelegationToken, verifyDelegationToken, sessionDelegateBindingError } from './token';
+export { isRevoked, buildRevokeDelegationCall } from './onchain';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,EAAE;AACF,2DAA2D;AAE3D,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,oBAAoB,EACpB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAChG,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAE7E;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAG7D,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAC9E,iEAAiE;AACjE,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,EAAE;AACF,2DAA2D;AAE3D,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,oBAAoB,EACpB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,EACzB,yBAAyB,EACzB,kBAAkB,EAClB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAChG,2FAA2F;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAE7E;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAG7D,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAC9E,iEAAiE;AACjE,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAClG,OAAO,EAAE,SAAS,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC"}

package/dist/onchain.d.ts

@@ -1,8 +1,21 @@
-import type { Hex, Address } from '@agenticprimitives/types';
-import type { TxContext } from './types';
-export declare function isRevoked(_hash: Hex, _opts: {
+import { type Hex, type Address } from 'viem';
+import type { Delegation } from './types';
+/** Is this delegation hash revoked on-chain? The canonical, single mechanism (ADR-0013): reads the
+ *  DelegationManager's `_revoked` map. Returns `false` if absent — never escalates to a second path. */
+export declare function isRevoked(hash: Hex, opts: {
     delegationManager: Address;
     rpcUrl: string;
 }): Promise<boolean>;
-export declare function revokeDelegation(_hash: Hex, _ctx: TxContext): Promise<Hex>;
+/**
+ * Build the call that revokes a delegation on-chain: `DelegationManager.revokeDelegationByOwner(d)`.
+ * The caller (the delegator OR the delegate) submits this through their Smart Account's `execute`
+ * (this package owns delegation semantics, not tx/UserOp submission — agent-account/app layer does).
+ * Once mined, `isRevoked(hash)` is true and `redeemDelegation` reverts. The on-chain function
+ * re-verifies the delegation's signature, so a forged hash cannot be marked revoked.
+ */
+export declare function buildRevokeDelegationCall(delegation: Delegation, delegationManager: Address): {
+    to: Address;
+    value: bigint;
+    data: Hex;
+};
 //# sourceMappingURL=onchain.d.ts.map

package/dist/onchain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"onchain.d.ts","sourceRoot":"","sources":["../src/onchain.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC,wBAAsB,SAAS,CAC7B,KAAK,EAAE,GAAG,EACV,KAAK,EAAE;IAAE,iBAAiB,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpD,OAAO,CAAC,OAAO,CAAC,CAIlB;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAIhF"}
+{"version":3,"file":"onchain.d.ts","sourceRoot":"","sources":["../src/onchain.ts"],"names":[],"mappings":"AAIA,OAAO,EAAgD,KAAK,GAAG,EAAE,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AAC5F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AA4C1C;wGACwG;AACxG,wBAAsB,SAAS,CAC7B,IAAI,EAAE,GAAG,EACT,IAAI,EAAE;IAAE,iBAAiB,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnD,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,UAAU,EACtB,iBAAiB,EAAE,OAAO,GACzB;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,GAAG,CAAA;CAAE,CAgB3C"}

package/dist/onchain.js

@@ -1,9 +1,80 @@
-// On-chain revocation helpers. v0 demo doesn't exercise revocation (step 2
-// just packages a session). Stubs preserve the public-export surface.
-export async function isRevoked(_hash, _opts) {
-    throw new Error('isRevoked: not implemented in v0 demo step 2 (lands with demo step 3 / mcp-runtime commit).');
+// On-chain revocation helpers (spec 272 PAY-DEL-3). `isRevoked` is the read the x402 rail executor
+// MUST run before settling (off-chain check); the DelegationManager ALSO enforces revocation in
+// `redeemDelegation` (on-chain), so revocation is checked twice and is never off-chain-only.
+import { createPublicClient, http, encodeFunctionData } from 'viem';
+const IS_REVOKED_ABI = [
+    {
+        type: 'function',
+        name: 'isRevoked',
+        stateMutability: 'view',
+        inputs: [{ name: 'delegationHash', type: 'bytes32' }],
+        outputs: [{ type: 'bool' }],
+    },
+];
+// Matches IDelegationManager.Delegation / Caveat (enforcer, terms, args).
+const REVOKE_BY_OWNER_ABI = [
+    {
+        type: 'function',
+        name: 'revokeDelegationByOwner',
+        stateMutability: 'nonpayable',
+        inputs: [
+            {
+                name: 'delegation',
+                type: 'tuple',
+                components: [
+                    { name: 'delegator', type: 'address' },
+                    { name: 'delegate', type: 'address' },
+                    { name: 'authority', type: 'bytes32' },
+                    {
+                        name: 'caveats',
+                        type: 'tuple[]',
+                        components: [
+                            { name: 'enforcer', type: 'address' },
+                            { name: 'terms', type: 'bytes' },
+                            { name: 'args', type: 'bytes' },
+                        ],
+                    },
+                    { name: 'salt', type: 'uint256' },
+                    { name: 'signature', type: 'bytes' },
+                ],
+            },
+        ],
+        outputs: [],
+    },
+];
+/** Is this delegation hash revoked on-chain? The canonical, single mechanism (ADR-0013): reads the
+ *  DelegationManager's `_revoked` map. Returns `false` if absent — never escalates to a second path. */
+export async function isRevoked(hash, opts) {
+    const client = createPublicClient({ transport: http(opts.rpcUrl) });
+    return (await client.readContract({
+        address: opts.delegationManager,
+        abi: IS_REVOKED_ABI,
+        functionName: 'isRevoked',
+        args: [hash],
+    }));
 }
-export async function revokeDelegation(_hash, _ctx) {
-    throw new Error('revokeDelegation: not implemented in v0 demo step 2 (lands with on-chain redeem path).');
+/**
+ * Build the call that revokes a delegation on-chain: `DelegationManager.revokeDelegationByOwner(d)`.
+ * The caller (the delegator OR the delegate) submits this through their Smart Account's `execute`
+ * (this package owns delegation semantics, not tx/UserOp submission — agent-account/app layer does).
+ * Once mined, `isRevoked(hash)` is true and `redeemDelegation` reverts. The on-chain function
+ * re-verifies the delegation's signature, so a forged hash cannot be marked revoked.
+ */
+export function buildRevokeDelegationCall(delegation, delegationManager) {
+    const data = encodeFunctionData({
+        abi: REVOKE_BY_OWNER_ABI,
+        functionName: 'revokeDelegationByOwner',
+        args: [
+            {
+                delegator: delegation.delegator,
+                delegate: delegation.delegate,
+                authority: delegation.authority,
+                caveats: delegation.caveats.map((c) => ({ enforcer: c.enforcer, terms: c.terms, args: c.args ?? '0x' })),
+                salt: delegation.salt,
+                signature: delegation.signature,
+            },
+        ],
+    });
+    return { to: delegationManager, value: 0n, data };
 }
 //# sourceMappingURL=onchain.js.map

package/dist/onchain.js.map

@@ -1 +1 @@
-{"version":3,"file":"onchain.js","sourceRoot":"","sources":["../src/onchain.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,sEAAsE;AAKtE,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAU,EACV,KAAqD;IAErD,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAU,EAAE,IAAe;IAChE,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"onchain.js","sourceRoot":"","sources":["../src/onchain.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,gGAAgG;AAChG,6FAA6F;AAE7F,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,kBAAkB,EAA0B,MAAM,MAAM,CAAC;AAG5F,MAAM,cAAc,GAAG;IACrB;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,WAAW;QACjB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACrD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;KAC5B;CACO,CAAC;AAEX,0EAA0E;AAC1E,MAAM,mBAAmB,GAAG;IAC1B;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,yBAAyB;QAC/B,eAAe,EAAE,YAAY;QAC7B,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,OAAO;gBACb,UAAU,EAAE;oBACV,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE;oBACtC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;oBACrC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE;oBACtC;wBACE,IAAI,EAAE,SAAS;wBACf,IAAI,EAAE,SAAS;wBACf,UAAU,EAAE;4BACV,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;4BACrC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;4BAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE;yBAChC;qBACF;oBACD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;oBACjC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;iBACrC;aACF;SACF;QACD,OAAO,EAAE,EAAE;KACZ;CACO,CAAC;AAEX;wGACwG;AACxG,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAS,EACT,IAAoD;IAEpD,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACpE,OAAO,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC;QAChC,OAAO,EAAE,IAAI,CAAC,iBAAiB;QAC/B,GAAG,EAAE,cAAc;QACnB,YAAY,EAAE,WAAW;QACzB,IAAI,EAAE,CAAC,IAAI,CAAC;KACb,CAAC,CAAY,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAAsB,EACtB,iBAA0B;IAE1B,MAAM,IAAI,GAAG,kBAAkB,CAAC;QAC9B,GAAG,EAAE,mBAAmB;QACxB,YAAY,EAAE,yBAAyB;QACvC,IAAI,EAAE;YACJ;gBACE,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;gBACxG,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,SAAS,EAAE,UAAU,CAAC,SAAS;aAChC;SACF;KACF,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC"}

package/dist/session-delegation.d.ts

@@ -0,0 +1,30 @@
+import type { Address, Hex } from '@agenticprimitives/types';
+import type { Delegation } from './types';
+export interface SessionDelegationParams {
+    /** The principal's Smart Account — the leaf delegator (the canonical identity that authorizes the key). */
+    delegator: Address;
+    /** The freshly-generated session key the token will be signed by. */
+    sessionKeyAddress: Address;
+    /** Unix seconds the session-key authorization is valid until (bound by a timestamp caveat). */
+    validUntil: number;
+    /** Deployed enforcer addresses (timestamp + value). */
+    enforcers: {
+        timestamp: Address;
+        value: Address;
+    };
+    chainId: number;
+    delegationManager: Address;
+    /** Random salt; supply a fixed value for deterministic tests. */
+    salt?: bigint;
+}
+/**
+ * Build the session-delegation leaf `delegator (principal SA) → sessionKey`, with a timestamp (TTL) +
+ * value-0 caveat, UNSIGNED. Returns `{ leaf, digest }`; the caller signs `digest` with the member's live
+ * credential and sets `leaf.signature`. v4 binds to the DELEGATOR (the principal's canonical identity), so
+ * the same credential that signs the `member→relying` delegation at connect also authorizes the session key.
+ */
+export declare function buildSessionDelegation(p: SessionDelegationParams): {
+    leaf: Delegation;
+    digest: Hex;
+};
+//# sourceMappingURL=session-delegation.d.ts.map

package/dist/session-delegation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-delegation.d.ts","sourceRoot":"","sources":["../src/session-delegation.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAK1C,MAAM,WAAW,uBAAuB;IACtC,2GAA2G;IAC3G,SAAS,EAAE,OAAO,CAAC;IACnB,qEAAqE;IACrE,iBAAiB,EAAE,OAAO,CAAC;IAC3B,+FAA+F;IAC/F,UAAU,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,SAAS,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAUD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,uBAAuB,GAAG;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAapG"}

package/dist/session-delegation.js

@@ -0,0 +1,32 @@
+import { ROOT_AUTHORITY } from './types';
+import { buildCaveat, encodeTimestampTerms, encodeValueTerms } from './caveats';
+import { hashDelegation } from './hash';
+function randomSalt() {
+    const b = new Uint8Array(16);
+    globalThis.crypto.getRandomValues(b);
+    let s = 0n;
+    for (const x of b)
+        s = (s << 8n) | BigInt(x);
+    return s;
+}
+/**
+ * Build the session-delegation leaf `delegator (principal SA) → sessionKey`, with a timestamp (TTL) +
+ * value-0 caveat, UNSIGNED. Returns `{ leaf, digest }`; the caller signs `digest` with the member's live
+ * credential and sets `leaf.signature`. v4 binds to the DELEGATOR (the principal's canonical identity), so
+ * the same credential that signs the `member→relying` delegation at connect also authorizes the session key.
+ */
+export function buildSessionDelegation(p) {
+    const leaf = {
+        delegator: p.delegator,
+        delegate: p.sessionKeyAddress,
+        authority: ROOT_AUTHORITY,
+        caveats: [
+            buildCaveat(p.enforcers.timestamp, encodeTimestampTerms(0, p.validUntil)),
+            buildCaveat(p.enforcers.value, encodeValueTerms(0n)),
+        ],
+        salt: p.salt ?? randomSalt(),
+        signature: '0x',
+    };
+    return { leaf, digest: hashDelegation(leaf, p.chainId, p.delegationManager) };
+}
+//# sourceMappingURL=session-delegation.js.map

package/dist/session-delegation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-delegation.js","sourceRoot":"","sources":["../src/session-delegation.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AAiBxC,SAAS,UAAU;IACjB,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC7B,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7C,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,CAA0B;IAC/D,MAAM,IAAI,GAAe;QACvB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,QAAQ,EAAE,CAAC,CAAC,iBAAiB;QAC7B,SAAS,EAAE,cAAc;QACzB,OAAO,EAAE;YACP,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;YACzE,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC;SACrD;QACD,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,UAAU,EAAE;QAC5B,SAAS,EAAE,IAAI;KAChB,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC;AAChF,CAAC"}

package/dist/session-manager.d.ts

@@ -6,7 +6,6 @@ export interface SessionResolveResult {
     delegation: Delegation | null;
     signer: {
         address: Address;
-        privateKey: Hex;
         signMessage(msg: string | {
             raw: Hex;
         }): Promise<Hex>;

package/dist/session-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-manager.d.ts","sourceRoot":"","sources":["../src/session-manager.ts"],"names":[],"mappings":"AAeA,OAAO,EAGL,SAAS,EAET,KAAK,OAAO,EACZ,KAAK,GAAG,EACT,MAAM,MAAM,CAAC;AACd,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,KAAK,EACV,UAAU,EACV,WAAW,EAGX,YAAY,EACb,MAAM,SAAS,CAAC;AA2EjB,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,WAAW,CAAC;IAClB,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE;QACN,OAAO,EAAE,OAAO,CAAC;QACjB,UAAU,EAAE,GAAG,CAAC;QAChB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG;YAAE,GAAG,EAAE,GAAG,CAAA;SAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;KACvD,CAAC;CACH;AAED,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE;QACrB,UAAU,EAAE,cAAc,CAAC;QAC3B,KAAK,EAAE,YAAY,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,uDAAuD;QACvD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;KACpB;IAGH,OAAO,CAAC,KAAK;IAIb;;;;OAIG;IACG,IAAI,CACR,cAAc,EAAE,OAAO,EACvB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,OAAO,CAAA;KAAE,CAAC;IA4C7D;;;OAGG;IACG,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAuCvE;;;;;OAKG;IACG,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAyEzD,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAIhC,cAAc;CAQ7B;AAID,wBAAgB,wBAAwB,IAAI,YAAY,CAkBvD;AAeD,OAAO,EAAE,SAAS,EAAE,CAAC"}
+{"version":3,"file":"session-manager.d.ts","sourceRoot":"","sources":["../src/session-manager.ts"],"names":[],"mappings":"AAeA,OAAO,EAGL,SAAS,EAET,KAAK,OAAO,EACZ,KAAK,GAAG,EACT,MAAM,MAAM,CAAC;AACd,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,KAAK,EACV,UAAU,EACV,WAAW,EAGX,YAAY,EACb,MAAM,SAAS,CAAC;AA2EjB,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,WAAW,CAAC;IAClB,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE;QACN,OAAO,EAAE,OAAO,CAAC;QAIjB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG;YAAE,GAAG,EAAE,GAAG,CAAA;SAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;KACvD,CAAC;CACH;AAED,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE;QACrB,UAAU,EAAE,cAAc,CAAC;QAC3B,KAAK,EAAE,YAAY,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,uDAAuD;QACvD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;KACpB;IAGH,OAAO,CAAC,KAAK;IAIb;;;;OAIG;IACG,IAAI,CACR,cAAc,EAAE,OAAO,EACvB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,OAAO,CAAA;KAAE,CAAC;IA4C7D;;;OAGG;IACG,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAuCvE;;;;;OAKG;IACG,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAwEzD,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAIhC,cAAc;CAQ7B;AAID,wBAAgB,wBAAwB,IAAI,YAAY,CAkBvD;AAeD,OAAO,EAAE,SAAS,EAAE,CAAC"}

package/dist/session-manager.js

@@ -191,7 +191,6 @@ export class SessionManager {
             delegation: pkg.delegation ? deserializeDelegation(pkg.delegation) : null,
             signer: {
                 address,
-                privateKey: pkg.sessionPrivateKey,
                 signMessage: async (msg) => {
                     let digest;
                     if (typeof msg === 'string') {

package/dist/session-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-manager.js","sourceRoot":"","sources":["../src/session-manager.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,EAAE;AACF,0DAA0D;AAC1D,2EAA2E;AAC3E,sEAAsE;AACtE,kEAAkE;AAClE,qEAAqE;AACrE,qEAAqE;AACrE,4CAA4C;AAC5C,uEAAuE;AACvE,sEAAsE;AACtE,qEAAqE;AAErE,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EACL,UAAU,EACV,UAAU,EACV,SAAS,EACT,OAAO,GAGR,MAAM,MAAM,CAAC;AAEd,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AASvE,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG,KAAK,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,GAAG;QAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAe;IACzC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACnD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAY,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB;IACtC,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACrE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,QAAQ,CAAC,IAAiB,EAAE,UAAkB;IACrD,OAAO;QACL,YAAY,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;QAC3C,eAAe,EAAE,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE;QAClD,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAC9B,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,WAAW,EAAE,UAAU;KACxB,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,gFAAgF;AAChF,gEAAgE;AAChE,SAAS,cAAc,CAAC,CAAa;IACnC,OAAO,CAA4B,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAe,EACf,EAAc,EACd,SAAqB,EACrB,GAAe;IAEf,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACtH,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAC/C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC,EAAE,cAAc,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,EAChF,SAAS,EACT,cAAc,CAAC,SAAS,CAAC,CAC1B,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAe,EACf,EAAc,EACd,UAAsB,EACtB,GAAe;IAEf,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACtH,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAC/C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC,EAAE,cAAc,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,EAChF,SAAS,EACT,cAAc,CAAC,UAAU,CAAC,CAC3B,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;AAC5B,CAAC;AAYD,MAAM,OAAO,cAAc;IAEN;IADnB,YACmB,IAMhB;QANgB,SAAI,GAAJ,IAAI,CAMpB;IACA,CAAC;IAEI,KAAK;QACX,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI,CACR,cAAuB,EACvB,OAAe;QAEf,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAE7D,0BAA0B;QAC1B,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC7B,0EAA0E;QAC1E,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,6BAA6B;QAC1E,CAAC;QACD,MAAM,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChD,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAElD,MAAM,IAAI,GAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAE5E,0EAA0E;QAC1E,sBAAsB;QACtB,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAC7C,IAAI,CAAC,SAAS,CAAC,EAAE,iBAAiB,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CACxD,CAAC;QACF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;QACvF,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,gBAAgB,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;QAElG,MAAM,GAAG,GAAe;YACtB,EAAE,EAAE,SAAS;YACb,cAAc;YACd,OAAO;YACP,iBAAiB;YACjB,MAAM,EAAE,SAAS;YACjB,gBAAgB;YAChB,EAAE;YACF,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS;YACT,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE;SAChD,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,UAAsB;QACrD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,IAAI,GAAgB;YACxB,SAAS;YACT,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC;QACF,wEAAwE;QACxE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC;YAC1D,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,UAAU,EAAE,MAAM;YAClB,KAAK,EAAE,cAAc;YACrB,UAAU,EAAE,GAAG,CAAC,UAAU;SAC3B,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAA+B,CAAC;QAE3F,yEAAyE;QACzE,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAC1C,IAAI,CAAC,SAAS,CAAC;YACb,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,UAAU,EAAE,sBAAsB,CAAC,UAAU,CAAC;SAC/C,CAAC,CACH,CAAC;QACF,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,gBAAgB,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAE/E,MAAM,OAAO,GAAe;YAC1B,GAAG,GAAG;YACN,MAAM,EAAE,QAAQ;YAChB,gBAAgB;YAChB,EAAE,EAAE,KAAK;SACV,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,SAAS,aAAa,CAAC,CAAC;QACtF,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,uCAAuC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,GAAG,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,IAAI,GAAgB;YACxB,SAAS;YACT,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC;QACF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC;YAC1D,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,UAAU,EAAE,MAAM;YAClB,KAAK,EAAE,cAAc;YACrB,UAAU,EAAE,GAAG,CAAC,UAAU;SAC3B,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAGlD,CAAC;QACF,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAExE,OAAO;YACL,IAAI;YACJ,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI;YACzE,MAAM,EAAE;gBACN,OAAO;gBACP,UAAU,EAAE,GAAG,CAAC,iBAAiB;gBACjC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;oBACzB,IAAI,MAAkB,CAAC;oBACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;wBAC5B,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;wBAC5C,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,iCAAiC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;wBACzF,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;wBAC9D,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;wBACxB,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;wBACnC,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;oBAChC,CAAC;yBAAM,CAAC;wBACN,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC5B,CAAC;oBACD,8DAA8D;oBAC9D,6DAA6D;oBAC7D,6DAA6D;oBAC7D,8DAA8D;oBAC9D,8DAA8D;oBAC9D,yDAAyD;oBACzD,yDAAyD;oBACzD,oCAAoC;oBACpC,iEAAiE;oBACjE,qCAAqC;oBACrC,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,SAAS,CACvC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,EACjF,WAAW,CACZ,CAAC;oBACF,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;oBAC/C,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;oBAC/C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;oBACnC,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAQ,CAAC;gBACjE,CAAC;aACF;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,SAAiB;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,SAAS,aAAa,CAAC,CAAC;QAC9E,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,uCAAuC,GAAG,CAAC,MAAM,uBAAuB,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAED,6EAA6E;AAE7E,MAAM,UAAU,wBAAwB;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC3C,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,GAAG;YACZ,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,EAAE;YACV,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,cAAc;YACvB,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,EAAE;YACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzB,IAAI,CAAC,GAAG;gBAAE,OAAO;YACjB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;KACF,CAAC;AACJ,CAAC;AAMD,SAAS,sBAAsB,CAAC,CAAa;IAC3C,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAyB;IACtD,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,6EAA6E;AAC7E,OAAO,EAAE,SAAS,EAAE,CAAC"}
+{"version":3,"file":"session-manager.js","sourceRoot":"","sources":["../src/session-manager.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,EAAE;AACF,0DAA0D;AAC1D,2EAA2E;AAC3E,sEAAsE;AACtE,kEAAkE;AAClE,qEAAqE;AACrE,qEAAqE;AACrE,4CAA4C;AAC5C,uEAAuE;AACvE,sEAAsE;AACtE,qEAAqE;AAErE,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EACL,UAAU,EACV,UAAU,EACV,SAAS,EACT,OAAO,GAGR,MAAM,MAAM,CAAC;AAEd,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AASvE,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG,KAAK,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,GAAG;QAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAe;IACzC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACnD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAY,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB;IACtC,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACrE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,QAAQ,CAAC,IAAiB,EAAE,UAAkB;IACrD,OAAO;QACL,YAAY,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;QAC3C,eAAe,EAAE,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE;QAClD,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAC9B,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,WAAW,EAAE,UAAU;KACxB,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,gFAAgF;AAChF,gEAAgE;AAChE,SAAS,cAAc,CAAC,CAAa;IACnC,OAAO,CAA4B,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAe,EACf,EAAc,EACd,SAAqB,EACrB,GAAe;IAEf,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACtH,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAC/C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC,EAAE,cAAc,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,EAChF,SAAS,EACT,cAAc,CAAC,SAAS,CAAC,CAC1B,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAe,EACf,EAAc,EACd,UAAsB,EACtB,GAAe;IAEf,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACtH,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAC/C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC,EAAE,cAAc,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,EAChF,SAAS,EACT,cAAc,CAAC,UAAU,CAAC,CAC3B,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;AAC5B,CAAC;AAcD,MAAM,OAAO,cAAc;IAEN;IADnB,YACmB,IAMhB;QANgB,SAAI,GAAJ,IAAI,CAMpB;IACA,CAAC;IAEI,KAAK;QACX,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI,CACR,cAAuB,EACvB,OAAe;QAEf,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAE7D,0BAA0B;QAC1B,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC7B,0EAA0E;QAC1E,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,6BAA6B;QAC1E,CAAC;QACD,MAAM,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChD,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAElD,MAAM,IAAI,GAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAE5E,0EAA0E;QAC1E,sBAAsB;QACtB,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAC7C,IAAI,CAAC,SAAS,CAAC,EAAE,iBAAiB,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CACxD,CAAC;QACF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;QACvF,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,gBAAgB,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;QAElG,MAAM,GAAG,GAAe;YACtB,EAAE,EAAE,SAAS;YACb,cAAc;YACd,OAAO;YACP,iBAAiB;YACjB,MAAM,EAAE,SAAS;YACjB,gBAAgB;YAChB,EAAE;YACF,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS;YACT,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE;SAChD,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,UAAsB;QACrD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,IAAI,GAAgB;YACxB,SAAS;YACT,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC;QACF,wEAAwE;QACxE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC;YAC1D,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,UAAU,EAAE,MAAM;YAClB,KAAK,EAAE,cAAc;YACrB,UAAU,EAAE,GAAG,CAAC,UAAU;SAC3B,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAA+B,CAAC;QAE3F,yEAAyE;QACzE,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAC1C,IAAI,CAAC,SAAS,CAAC;YACb,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,UAAU,EAAE,sBAAsB,CAAC,UAAU,CAAC;SAC/C,CAAC,CACH,CAAC;QACF,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,gBAAgB,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAE/E,MAAM,OAAO,GAAe;YAC1B,GAAG,GAAG;YACN,MAAM,EAAE,QAAQ;YAChB,gBAAgB;YAChB,EAAE,EAAE,KAAK;SACV,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,SAAS,aAAa,CAAC,CAAC;QACtF,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,uCAAuC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,GAAG,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,IAAI,GAAgB;YACxB,SAAS;YACT,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC;QACF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC;YAC1D,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,UAAU,EAAE,MAAM;YAClB,KAAK,EAAE,cAAc;YACrB,UAAU,EAAE,GAAG,CAAC,UAAU;SAC3B,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAGlD,CAAC;QACF,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAExE,OAAO;YACL,IAAI;YACJ,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI;YACzE,MAAM,EAAE;gBACN,OAAO;gBACP,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;oBACzB,IAAI,MAAkB,CAAC;oBACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;wBAC5B,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;wBAC5C,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,iCAAiC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;wBACzF,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;wBAC9D,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;wBACxB,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;wBACnC,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;oBAChC,CAAC;yBAAM,CAAC;wBACN,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC5B,CAAC;oBACD,8DAA8D;oBAC9D,6DAA6D;oBAC7D,6DAA6D;oBAC7D,8DAA8D;oBAC9D,8DAA8D;oBAC9D,yDAAyD;oBACzD,yDAAyD;oBACzD,oCAAoC;oBACpC,iEAAiE;oBACjE,qCAAqC;oBACrC,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,SAAS,CACvC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,EACjF,WAAW,CACZ,CAAC;oBACF,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;oBAC/C,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;oBAC/C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;oBACnC,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAQ,CAAC;gBACjE,CAAC;aACF;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,SAAiB;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,SAAS,aAAa,CAAC,CAAC;QAC9E,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,uCAAuC,GAAG,CAAC,MAAM,uBAAuB,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAED,6EAA6E;AAE7E,MAAM,UAAU,wBAAwB;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC3C,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,GAAG;YACZ,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,EAAE;YACV,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,cAAc;YACvB,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,EAAE;YACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzB,IAAI,CAAC,GAAG;gBAAE,OAAO;YACjB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;KACF,CAAC;AACJ,CAAC;AAMD,SAAS,sBAAsB,CAAC,CAAa;IAC3C,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAyB;IACtD,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,6EAA6E;AAC7E,OAAO,EAAE,SAAS,EAAE,CAAC"}

package/dist/token.d.ts

@@ -1,5 +1,5 @@
 import { type Address, type Hex } from 'viem';
-import type { DelegationTokenClaims, VerifyError, VerifyOpts, DataScopeGrant } from './types';
+import type { Delegation, DelegationTokenClaims, VerifyError, VerifyOpts, DataScopeGrant } from './types';
 import { type AuditSink } from '@agenticprimitives/audit';
 /** Sorted-key JSON; BigInt → numeric string. Both sides must produce the
  *  exact same bytes for the signature to round-trip.
@@ -147,6 +147,18 @@ export interface VerifyOptsExt extends VerifyOpts {
      */
     requireAcceptedOnChain?: boolean;
 }
+/**
+ * DEL-001 (spec 270 v4) — the chain-free part of the session-key binding (testable without an RPC).
+ * Returns an error reason, or `null` when the leaf links correctly: `sessionDelegation` present, its
+ * delegator is the outer delegation's DELEGATOR (the principal's SA — the canonical identity every
+ * connection strategy signs for), and its delegate is the presenting session key. The signature proof
+ * (the delegator SA authorized the leaf — validated via the UniversalSignatureValidator, so any
+ * credential type works) is checked separately in `verifyDelegationToken`.
+ *
+ * v4 binds to the DELEGATOR (was the delegate in v3): the SA's own authority — recoverable at connect
+ * under every credential strategy alike — vouches for the session key.
+ */
+export declare function sessionDelegateBindingError(delegation: Delegation, sessionDelegation: Delegation | undefined, sessionKeyAddress: Address): string | null;
 /**
  * Full verification pipeline. Caller passes `toolName` in opts for tool-scope
  * caveat evaluation; without it the mcp-tool-scope caveat denies.

package/dist/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAeA,OAAO,EAA4B,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AACxE,OAAO,KAAK,EAEV,qBAAqB,EACrB,WAAW,EACX,UAAU,EACV,cAAc,EACf,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAwBtE;;;;;;;gBAOgB;AAChB,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAsBpD;AAiDD,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,IAAI,CAAC,qBAAqB,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,EAClG,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,EAC1C,IAAI,CAAC,EAAE;IACL,iEAAiE;IACjE,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,GACA,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CA4EzC;AAuCD,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IACvC;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,mDAAmD;IACnD,aAAa,CAAC,EAAE,MAAM,CAAC;IASvB;;;;;;;;;;;;;;OAcG;IACH,mBAAmB,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,WAAW,CAAC,EACR;QAAE,IAAI,EAAE,mBAAmB,CAAA;KAAE,GAC7B;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,WAAW,EAAE,GAAG,CAAC;QAAC,gBAAgB,EAAE,GAAG,CAAA;KAAE,CAAC;IAEnE;;;;;;;;;;;OAWG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AA+BD;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,cAAc,EAAE,CAAA;CAAE,GAAG,WAAW,CAAC,CA4P1E"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAeA,OAAO,EAA4B,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AACxE,OAAO,KAAK,EACV,UAAU,EACV,qBAAqB,EACrB,WAAW,EACX,UAAU,EACV,cAAc,EACf,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAkDtE;;;;;;;gBAOgB;AAChB,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAsBpD;AAiDD,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,IAAI,CAAC,qBAAqB,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,EAClG,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,EAC1C,IAAI,CAAC,EAAE;IACL,iEAAiE;IACjE,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,GACA,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CA8EzC;AA2DD,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IACvC;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,mDAAmD;IACnD,aAAa,CAAC,EAAE,MAAM,CAAC;IASvB;;;;;;;;;;;;;;OAcG;IACH,mBAAmB,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,WAAW,CAAC,EACR;QAAE,IAAI,EAAE,mBAAmB,CAAA;KAAE,GAC7B;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,WAAW,EAAE,GAAG,CAAC;QAAC,gBAAgB,EAAE,GAAG,CAAA;KAAE,CAAC;IAEnE;;;;;;;;;;;OAWG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AA+BD;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,UAAU,EACtB,iBAAiB,EAAE,UAAU,GAAG,SAAS,EACzC,iBAAiB,EAAE,OAAO,GACzB,MAAM,GAAG,IAAI,CASf;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,cAAc,EAAE,CAAA;CAAE,GAAG,WAAW,CAAC,CAmU1E"}

package/dist/token.js

@@ -17,23 +17,48 @@ import { hashDelegation } from './hash';
 import { evaluateCaveats } from './evaluator';
 import { buildEvent } from '@agenticprimitives/audit';
 // ─── base64url + canonical JSON helpers ──────────────────────────────────
-function base64urlEncode(s) {
-    return Buffer.from(s, 'utf8').toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+//
+// ISOMORPHIC base64 — `btoa`/`atob` + `TextEncoder/Decoder` are available in every target runtime
+// (browser, Cloudflare Workers, Node ≥16). Node's `Buffer` is NOT defined in the browser, and demo-jp
+// now mints tokens CLIENT-SIDE (spec 270 v4 client-mint), so a `Buffer.from(...)` here threw
+// `ReferenceError: Buffer is not defined` before any network call. The byte output is identical to the
+// old Buffer path (standard base64), so existing signatures still verify — byte-stability is a SECURITY
+// invariant (see `canonicalJSON`), and standard base64 is the same across all runtimes.
+function bytesToBase64url(bytes) {
+    let bin = '';
+    for (let i = 0; i < bytes.length; i++)
+        bin += String.fromCharCode(bytes[i]);
+    return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
 }
-function base64urlDecodeStr(s) {
+function base64urlToBytes(s) {
     let padded = s.replace(/-/g, '+').replace(/_/g, '/');
     while (padded.length % 4)
         padded += '=';
-    return Buffer.from(padded, 'base64').toString('utf8');
+    const bin = atob(padded);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}
+function base64urlEncode(s) {
+    return bytesToBase64url(new TextEncoder().encode(s));
+}
+function base64urlDecodeStr(s) {
+    return new TextDecoder().decode(base64urlToBytes(s));
 }
 function base64urlEncodeBytes(b) {
-    return Buffer.from(b).toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+    return bytesToBase64url(b);
 }
 function base64urlDecodeBytes(s) {
-    let padded = s.replace(/-/g, '+').replace(/_/g, '/');
-    while (padded.length % 4)
-        padded += '=';
-    return new Uint8Array(Buffer.from(padded, 'base64'));
+    return base64urlToBytes(s);
+}
+/** Isomorphic hex → bytes (replaces `Buffer.from(hex, 'hex')`, which is Node-only). */
+function hexToBytes(hex) {
+    const clean = hex.startsWith('0x') ? hex.slice(2) : hex;
+    const out = new Uint8Array(clean.length >> 1);
+    for (let i = 0; i < out.length; i++)
+        out[i] = parseInt(clean.substr(i * 2, 2), 16);
+    return out;
 }
 /** Sorted-key JSON; BigInt → numeric string. Both sides must produce the
  *  exact same bytes for the signature to round-trip.
@@ -148,6 +173,8 @@ export async function mintDelegationToken(claims, signMessage, opts) {
         sub: claims.sub,
         delegation: claims.delegation,
         sessionKeyAddress: claims.sessionKeyAddress,
+        // DEL-001: carry the session-delegate-binding leaf when the minter produced one.
+        ...(claims.sessionDelegation ? { sessionDelegation: claims.sessionDelegation } : {}),
         jti,
         iat,
         exp,
@@ -156,7 +183,7 @@ export async function mintDelegationToken(claims, signMessage, opts) {
     const canonical = canonicalJSON(full);
     const sig = await signMessage(canonical);
     const sigHex = sig.startsWith('0x') ? sig.slice(2) : sig;
-    const sigBytes = new Uint8Array(Buffer.from(sigHex, 'hex'));
+    const sigBytes = hexToBytes(sigHex);
     const token = `${base64urlEncode(canonical)}.${base64urlEncodeBytes(sigBytes)}`;
     // Audit emit (C3 pass 3c). R11.1 / N16: NO try/catch around the sink
     // write — the sink composition (`composeSinks` fail-soft vs
@@ -206,6 +233,25 @@ const ACCOUNT_ABI_ERC1271 = [
         outputs: [{ name: '', type: 'bytes4' }],
     },
 ];
+/** spec 270 v4 — the deployed UniversalSignatureValidator: ONE connection-agnostic surface that validates
+ *  a signature for a deployed SA (ERC-1271), a counterfactual SA (ERC-6492 deploy-on-verify), or a raw EOA
+ *  (ECDSA). `isValidSig` is state-changing on-chain (the 6492 path may deploy), but we call it via
+ *  `eth_call` — marking it `view` here makes viem `readContract` execute it ephemerally + decode the bool,
+ *  the standard off-chain ERC-6492 pattern. Routing the delegation + leaf checks through this is what makes
+ *  the verifier never branch on HOW the user connected — every credential strategy validates via one surface. */
+const UNIVERSAL_SIG_VALIDATOR_ABI = [
+    {
+        type: 'function',
+        name: 'isValidSig',
+        stateMutability: 'view',
+        inputs: [
+            { name: 'signer', type: 'address' },
+            { name: 'hash', type: 'bytes32' },
+            { name: 'sig', type: 'bytes' },
+        ],
+        outputs: [{ name: '', type: 'bool' }],
+    },
+];
 const ACCEPTED_SESSION_DELEGATION_ABI = [
     {
         type: 'function',
@@ -239,6 +285,28 @@ function decodeToken(token) {
         sigHex += b.toString(16).padStart(2, '0');
     return { claims, canonical, signature: sigHex };
 }
+/**
+ * DEL-001 (spec 270 v4) — the chain-free part of the session-key binding (testable without an RPC).
+ * Returns an error reason, or `null` when the leaf links correctly: `sessionDelegation` present, its
+ * delegator is the outer delegation's DELEGATOR (the principal's SA — the canonical identity every
+ * connection strategy signs for), and its delegate is the presenting session key. The signature proof
+ * (the delegator SA authorized the leaf — validated via the UniversalSignatureValidator, so any
+ * credential type works) is checked separately in `verifyDelegationToken`.
+ *
+ * v4 binds to the DELEGATOR (was the delegate in v3): the SA's own authority — recoverable at connect
+ * under every credential strategy alike — vouches for the session key.
+ */
+export function sessionDelegateBindingError(delegation, sessionDelegation, sessionKeyAddress) {
+    if (!sessionDelegation)
+        return 'session-delegation required (DEL-001)';
+    if (sessionDelegation.delegator.toLowerCase() !== delegation.delegator.toLowerCase()) {
+        return 'session-delegation delegator != delegation delegator (DEL-001)';
+    }
+    if (sessionDelegation.delegate.toLowerCase() !== sessionKeyAddress.toLowerCase()) {
+        return 'session key is not the session-delegation delegate (DEL-001)';
+    }
+    return null;
+}
 /**
  * Full verification pipeline. Caller passes `toolName` in opts for tool-scope
  * caveat evaluation; without it the mcp-tool-scope caveat denies.
@@ -302,6 +370,16 @@ export async function verifyDelegationToken(token, opts) {
     // permissive behavior MUST set `revocationFailMode: 'open'` explicitly.
     const revocationFailMode = opts.revocationFailMode ?? 'closed';
     const publicClient = createPublicClient({ transport: http(opts.rpcUrl) });
+    // spec 270 v4 — validate an SA's signature through the UniversalSignatureValidator (one surface for
+    // ERC-1271 / ERC-6492 / ECDSA), called via eth_call. `null` when no USV is configured (legacy path).
+    const validateSaSig = opts.universalSignatureValidator
+        ? async (signer, hash, sig) => (await publicClient.readContract({
+            address: opts.universalSignatureValidator,
+            abi: UNIVERSAL_SIG_VALIDATOR_ABI,
+            functionName: 'isValidSig',
+            args: [signer, hash, sig],
+        }))
+        : null;
     try {
         const revoked = (await publicClient.readContract({
             address: opts.delegationManager,
@@ -319,29 +397,94 @@ export async function verifyDelegationToken(token, opts) {
         }
         void e;
     }
-    try {
-        const code = await publicClient.getCode({ address: claims.delegation.delegator });
-        const isDeployed = !!(code && code !== '0x' && code.length > 2);
-        if (!isDeployed) {
-            if (requireDeployed) {
-                return rejectWith(`delegator smart account ${claims.delegation.delegator} is not deployed — cannot verify ERC-1271. Set verifyDelegationToken opt requireDeployed=false only for explicit counterfactual-demo use cases.`, claims.delegation.delegator, eip712Hash);
+    if (validateSaSig) {
+        // spec 270 v4 — one connection-agnostic surface; counterfactual delegators verify via ERC-6492, so
+        // no requireDeployed hard-reject.
+        try {
+            if (!(await validateSaSig(claims.delegation.delegator, eip712Hash, claims.delegation.signature))) {
+                return rejectWith('signature validation failed', claims.delegation.delegator, eip712Hash);
             }
-            // Tolerated: caller opted into the undeployed path explicitly.
         }
-        else {
-            const magic = (await publicClient.readContract({
-                address: claims.delegation.delegator,
-                abi: ACCOUNT_ABI_ERC1271,
-                functionName: 'isValidSignature',
-                args: [eip712Hash, claims.delegation.signature],
-            }));
-            if (magic.toLowerCase() !== ERC1271_MAGIC) {
-                return rejectWith('erc1271 validation failed', claims.delegation.delegator, eip712Hash);
+        catch (e) {
+            return rejectWith(`signature validation reverted: ${e instanceof Error ? e.message : e}`, claims.delegation.delegator, eip712Hash);
+        }
+    }
+    else {
+        try {
+            const code = await publicClient.getCode({ address: claims.delegation.delegator });
+            const isDeployed = !!(code && code !== '0x' && code.length > 2);
+            if (!isDeployed) {
+                if (requireDeployed) {
+                    return rejectWith(`delegator smart account ${claims.delegation.delegator} is not deployed — cannot verify ERC-1271. Set verifyDelegationToken opt requireDeployed=false only for explicit counterfactual-demo use cases.`, claims.delegation.delegator, eip712Hash);
+                }
+                // Tolerated: caller opted into the undeployed path explicitly.
             }
+            else {
+                const magic = (await publicClient.readContract({
+                    address: claims.delegation.delegator,
+                    abi: ACCOUNT_ABI_ERC1271,
+                    functionName: 'isValidSignature',
+                    args: [eip712Hash, claims.delegation.signature],
+                }));
+                if (magic.toLowerCase() !== ERC1271_MAGIC) {
+                    return rejectWith('erc1271 validation failed', claims.delegation.delegator, eip712Hash);
+                }
+            }
+        }
+        catch (e) {
+            return rejectWith(`erc1271 call reverted: ${e instanceof Error ? e.message : e}`, claims.delegation.delegator, eip712Hash);
         }
     }
-    catch (e) {
-        return rejectWith(`erc1271 call reverted: ${e instanceof Error ? e.message : e}`, claims.delegation.delegator, eip712Hash);
+    // 3.5. DEL-001 (spec 270 v4) — session-key↔identity binding.
+    //
+    // The full signed `delegation` travels in cleartext inside every token, so a verifier that only
+    // checks "some session key signed these claims" lets anyone who OBSERVES a token re-mint it with their
+    // own session key and impersonate the delegator. We close that by requiring a `sessionDelegation` LEAF
+    // whose delegator is `delegation.delegator` (the principal's SA — the canonical identity, v4) and whose
+    // delegate IS the presenting session key, signed by that SA. The signature is validated through the
+    // UniversalSignatureValidator (ERC-1271 / ERC-6492 / ECDSA), so it works for ANY connection strategy and
+    // an attacker can't forge the SA's authorization of THEIR key. `principal` stays `delegation.delegator`.
+    // DEL-001 (ADR-0036): binding is ENFORCED BY DEFAULT — fail-closed. Only an explicit
+    // `allowUnboundSessionToken: true` (legacy / non-client-minted path) skips it.
+    if (!opts.allowUnboundSessionToken) {
+        // Chain-free checks: leaf present, delegator-link, delegate === presenting session key.
+        const bindErr = sessionDelegateBindingError(claims.delegation, claims.sessionDelegation, recovered);
+        if (bindErr)
+            return rejectWith(bindErr, claims.delegation.delegator, eip712Hash);
+        const sd = claims.sessionDelegation;
+        // The delegator SA (the principal's canonical identity) actually authorized THIS session key. Validated
+        // via the UniversalSignatureValidator when configured (v4 — connection-agnostic: every credential
+        // strategy passes through one surface), else legacy deployed-ERC-1271.
+        const sdHash = hashDelegation(sd, opts.chainId, opts.delegationManager);
+        try {
+            if (validateSaSig) {
+                if (!(await validateSaSig(sd.delegator, sdHash, sd.signature))) {
+                    return rejectWith('session-delegation signature validation failed (DEL-001)', claims.delegation.delegator, eip712Hash);
+                }
+            }
+            else {
+                const sdCode = await publicClient.getCode({ address: sd.delegator });
+                if (!sdCode || sdCode === '0x' || sdCode.length <= 2) {
+                    if (requireDeployed) {
+                        return rejectWith('session-delegation delegator SA not deployed — cannot verify ERC-1271 (DEL-001)', claims.delegation.delegator, eip712Hash);
+                    }
+                }
+                else {
+                    const magic = (await publicClient.readContract({
+                        address: sd.delegator,
+                        abi: ACCOUNT_ABI_ERC1271,
+                        functionName: 'isValidSignature',
+                        args: [sdHash, sd.signature],
+                    }));
+                    if (magic.toLowerCase() !== ERC1271_MAGIC) {
+                        return rejectWith('session-delegation erc1271 validation failed (DEL-001)', claims.delegation.delegator, eip712Hash);
+                    }
+                }
+            }
+        }
+        catch (e) {
+            return rejectWith(`session-delegation signature check reverted: ${e instanceof Error ? e.message : e}`, claims.delegation.delegator, eip712Hash);
+        }
     }
     // 4. caveat evaluation
     //

package/dist/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,sEAAsE;AACtE,EAAE;AACF,kCAAkC;AAClC,gFAAgF;AAChF,wEAAwE;AACxE,8BAA8B;AAC9B,4CAA4C;AAC5C,yDAAyD;AACzD,6EAA6E;AAC7E,iCAAiC;AACjC,uCAAuC;AAEvC,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAA0B,MAAM,MAAM,CAAC;AAQxE,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAkB,MAAM,0BAA0B,CAAC;AAEtE,4EAA4E;AAE5E,SAAS,eAAe,CAAC,CAAS;IAChC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9G,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAS;IACnC,IAAI,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,GAAG,CAAC;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,oBAAoB,CAAC,CAAa;IACzC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACtG,CAAC;AAED,SAAS,oBAAoB,CAAC,CAAS;IACrC,IAAI,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,GAAG,CAAC;IACxC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;gBAOgB;AAChB,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IACnC,MAAM,SAAS,GAAG,CAAC,CAAU,EAAU,EAAE;QACvC,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;QAC9B,IAAI,OAAO,CAAC,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1E,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACpD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,OAAO,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QACvF,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,IAAI,CAAC,GAAG,CAAC,CAAW,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YAChF,IAAI,CAAC,GAAG,CAAC,CAAW,CAAC,CAAC;YACtB,MAAM,GAAG,GAAG,CAA4B,CAAC;YACzC,gDAAgD;YAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;YACzE,OAAO,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QAC5F,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC;IACF,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,iCAAiC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9D,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAe,EAAE,SAAc;IAC9D,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACzG,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5C,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACvE,OAAO,GAAc,CAAC;AACxB,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,GAAG,MAAM,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,GAAG;QAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS;AAClD,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAkG,EAClG,WAA0C,EAC1C,IAsBC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,SAAS,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,6CAA6C;IAEnF,kCAAkC;IAClC,MAAM,UAAU,GAAG,IAAI,EAAE,oBAAoB,IAAI,uBAAuB,CAAC;IACzE,IAAI,GAAG,GAAG,UAAU,IAAI,CAAC,IAAI,EAAE,kBAAkB,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,mCAAmC,GAAG,oBAAoB,UAAU,IAAI;YACtE,iEAAiE;YACjE,kDAAkD,CACrD,CAAC;IACJ,CAAC;IACD,IACE,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;QACrC,MAAM,CAAC,UAAU,GAAG,CAAC,IAAI,EAAE,oBAAoB,IAAI,uBAAuB,CAAC;QAC3E,CAAC,IAAI,EAAE,kBAAkB,EACzB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,CAAC,UAAU,mBAAmB;YACrE,GAAG,IAAI,EAAE,oBAAoB,IAAI,uBAAuB,IAAI;YAC5D,yDAAyD,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,yDAAyD,GAAG,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,kEAAkE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACzG,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACtB,MAAM,IAAI,GAA0B;QAClC,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,GAAG;QACH,GAAG;QACH,GAAG;QACH,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC;IACF,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;IAChF,qEAAqE;IACrE,4DAA4D;IAC5D,mEAAmE;IACnE,oEAAoE;IACpE,oEAAoE;IACpE,+DAA+D;IAC/D,mEAAmE;IACnE,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CACxB,UAAU,CAAC;YACT,MAAM,EAAE,iBAAiB;YACzB,OAAO,EAAE,SAAS;YAClB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE;YACxD,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE;YACjC,QAAQ,EAAE,MAAM,CAAC,GAAG;YACpB,OAAO,EAAE;gBACP,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,UAAU,EAAE,GAAG;gBACf,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;aACtC;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACxB,CAAC;AAED,8EAA8E;AAE9E,MAAM,sBAAsB,GAAG;IAC7B;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,WAAW;QACjB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC3C,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;KACtC;CACO,CAAC;AAEX,MAAM,mBAAmB,GAAG;IAC1B;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,kBAAkB;QACxB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;YACjC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;SACrC;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;KACxC;CACO,CAAC;AAEX,MAAM,+BAA+B,GAAG;IACtC;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,6BAA6B;QACnC,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC5D,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;KACtC;CACO,CAAC;AAEX,MAAM,aAAa,GAAG,YAAY,CAAC;AAyHnC,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,SAAiB,CAAC;IACtB,IAAI,MAA6B,CAAC;IAClC,IAAI,CAAC;QACH,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAElC,CAAC;QACF,IAAI,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,CAAC,UAAU,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrF,CAAC;QACD,MAAM,GAAG,MAAM,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACjD,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAa,EAAE,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAa,EACb,IAAmB;IAEnB,mEAAmE;IACnE,gCAAgC;IAChC,MAAM,IAAI,GAAG,KAAK,EAChB,OAA6B,EAC7B,MAA0B,EAC1B,SAA8B,EAC9B,gBAAiC,EACjC,EAAE;QACF,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO;QAC5B,oEAAoE;QACpE,qEAAqE;QACrE,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CACxB,UAAU,CAAC;YACT,MAAM,EACJ,OAAO,KAAK,SAAS;gBACnB,CAAC,CAAC,0BAA0B;gBAC5B,CAAC,CAAC,0BAA0B;YAChC,OAAO;YACP,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE;YACxE,OAAO,EAAE,gBAAgB;gBACvB,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,gBAAgB,EAAE;gBAC9C,CAAC,CAAC,SAAS;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,gBAAgB;YACxB,MAAM;YACN,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC7D,CAAC,CACH,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,KAAK,EACtB,MAAc,EACd,SAAmB,EACnB,gBAAsB,EACA,EAAE;QACxB,MAAM,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAC1D,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO;QAAE,OAAO,UAAU,CAAC,iBAAiB,CAAC,CAAC;IACnD,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAEjD,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAC,mBAAmB,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IACxD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG;QAAE,OAAO,UAAU,CAAC,eAAe,CAAC,CAAC;IAE3F,yBAAyB;IACzB,IAAI,SAAkB,CAAC;IACvB,IAAI,CAAC;QACH,SAAS,GAAG,uBAAuB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,UAAU,CAAC,8BAA8B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,iBAAiB,CAAC,WAAW,EAAE,EAAE,CAAC;QACvE,OAAO,UAAU,CAAC,gCAAgC,CAAC,CAAC;IACtD,CAAC;IAED,kBAAkB;IAClB,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAE3F,qBAAqB;IACrB,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC;IACrD,oEAAoE;IACpE,gEAAgE;IAChE,sEAAsE;IACtE,wEAAwE;IACxE,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,IAAI,QAAQ,CAAC;IAC/D,MAAM,YAAY,GAAG,kBAAkB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC;YAC/C,OAAO,EAAE,IAAI,CAAC,iBAAiB;YAC/B,GAAG,EAAE,sBAAsB;YAC3B,YAAY,EAAE,WAAW;YACzB,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB,CAAC,CAAY,CAAC;QACf,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,UAAU,CAAC,oBAAoB,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,UAAU,CACf,iHAAiH,EACjH,MAAM,CAAC,UAAU,CAAC,SAAS,EAC3B,UAAU,CACX,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,CAAC;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;QAClF,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,eAAe,EAAE,CAAC;gBACpB,OAAO,UAAU,CACf,2BAA2B,MAAM,CAAC,UAAU,CAAC,SAAS,iJAAiJ,EACvM,MAAM,CAAC,UAAU,CAAC,SAAS,EAC3B,UAAU,CACX,CAAC;YACJ,CAAC;YACD,+DAA+D;QACjE,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC;gBAC7C,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS;gBACpC,GAAG,EAAE,mBAAmB;gBACxB,YAAY,EAAE,kBAAkB;gBAChC,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;aAChD,CAAC,CAAQ,CAAC;YACX,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,aAAa,EAAE,CAAC;gBAC1C,OAAO,UAAU,CAAC,2BAA2B,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,UAAU,CACf,0BAA0B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAC9D,MAAM,CAAC,UAAU,CAAC,SAAS,EAC3B,UAAU,CACX,CAAC;IACJ,CAAC;IAED,uBAAuB;IACvB,EAAE;IACF,mEAAmE;IACnE,uEAAuE;IACvE,qEAAqE;IACrE,yEAAyE;IACzE,wEAAwE;IACxE,qEAAqE;IACrE,gFAAgF;IAChF,MAAM,QAAQ,GAAG,eAAe,CAC9B,MAAM,CAAC,UAAU,CAAC,OAAO,EACzB,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,EAC1C,IAAI,CAAC,WAAW,EAChB,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CACjD,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,kBAAkB,CAAC,CAAC,MAAM,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,oEAAoE;IACpE,qEAAqE;IACrE,qEAAqE;IACrE,oEAAoE;IACpE,sDAAsD;IACtD,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAC9C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,MAAM,CAC3C,CAAC;QACF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,UAAU,CACf,sDAAsD,EACtD,MAAM,CAAC,UAAU,CAAC,SAAS,EAC3B,UAAU,CACX,CAAC;QACJ,CAAC;QAED,+DAA+D;QAC/D,+DAA+D;QAC/D,sCAAsC;QACtC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,OAAO,UAAU,CACf,6FAA6F,EAC7F,MAAM,CAAC,UAAU,CAAC,SAAS,EAC3B,UAAU,CACX,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC1C,4DAA4D;YAC5D,iEAAiE;YACjE,4DAA4D;YAC5D,4DAA4D;YAC5D,OAAO,UAAU,CACf,kCAAkC,EAClC,MAAM,CAAC,UAAU,CAAC,SAAS,EAC3B,UAAU,CACX,CAAC;QACJ,CAAC;QACD,8DAA8D;QAC9D,+DAA+D;QAC/D,gEAAgE;IAClE,CAAC;IAED,wEAAwE;IACxE,oEAAoE;IACpE,mEAAmE;IACnE,uCAAuC;IACvC,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,eAAe,GAAG,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC;gBACjD,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS;gBACpC,GAAG,EAAE,+BAA+B;gBACpC,YAAY,EAAE,6BAA6B;gBAC3C,IAAI,EAAE,CAAC,UAAU,CAAC;aACnB,CAAC,CAAY,CAAC;QACjB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,UAAU,CACf,2CAA2C,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAC/E,MAAM,CAAC,UAAU,CAAC,SAAS,EAC3B,UAAU,CACX,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,OAAO,UAAU,CACf,sEAAsE,EACtE,MAAM,CAAC,UAAU,CAAC,SAAS,EAC3B,UAAU,CACX,CAAC;QACJ,CAAC;IACH,CAAC;IAED,gBAAgB;IAChB,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAChE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,UAAU,CAAC,4BAA4B,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC3F,CAAC;IAED,iEAAiE;IACjE,qEAAqE;IACrE,sEAAsE;IACtE,oEAAoE;IACpE,gBAAgB;IAChB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,OAAO,GAAqD,EAAE,CAAC;QACrE,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC;QAChD,IAAI,IAAI,CAAC,sBAAsB,KAAK,SAAS,EAAE,CAAC;YAC9C,OAAO,CAAC,eAAe,GAAG,eAAe,CAAC;QAC5C,CAAC;QACD,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CACxB,UAAU,CAAC;YACT,MAAM,EAAE,0BAA0B;YAClC,OAAO,EAAE,SAAS;YAClB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE;YACxD,OAAO,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE;YAC/C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SAC/D,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;AACpD,CAAC;AAED,sEAAsE;AACtE,sEAAsE;AACtE,0EAA0E;AAC1E,uEAAuE;AACvE,iEAAiE;AACjE,qEAAqE;AACrE,sEAAsE;AACtE,wDAAwD;AACxD,+DAA+D;AAC/D,kEAAkE"}
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,sEAAsE;AACtE,EAAE;AACF,kCAAkC;AAClC,gFAAgF;AAChF,wEAAwE;AACxE,8BAA8B;AAC9B,4CAA4C;AAC5C,yDAAyD;AACzD,6EAA6E;AAC7E,iCAAiC;AACjC,uCAAuC;AAEvC,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAA0B,MAAM,MAAM,CAAC;AAQxE,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAkB,MAAM,0BAA0B,CAAC;AAEtE,4EAA4E;AAC5E,EAAE;AACF,kGAAkG;AAClG,sGAAsG;AACtG,6FAA6F;AAC7F,uGAAuG;AACvG,wGAAwG;AACxG,wFAAwF;AAExF,SAAS,gBAAgB,CAAC,KAAiB;IACzC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAS;IACjC,IAAI,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,GAAG,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,OAAO,gBAAgB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAS;IACnC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,oBAAoB,CAAC,CAAa;IACzC,OAAO,gBAAgB,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,oBAAoB,CAAC,CAAS;IACrC,OAAO,gBAAgB,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,uFAAuF;AACvF,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACxD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;gBAOgB;AAChB,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IACnC,MAAM,SAAS,GAAG,CAAC,CAAU,EAAU,EAAE;QACvC,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;QAC9B,IAAI,OAAO,CAAC,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1E,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACpD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,OAAO,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QACvF,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,IAAI,CAAC,GAAG,CAAC,CAAW,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YAChF,IAAI,CAAC,GAAG,CAAC,CAAW,CAAC,CAAC;YACtB,MAAM,GAAG,GAAG,CAA4B,CAAC;YACzC,gDAAgD;YAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;YACzE,OAAO,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QAC5F,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC;IACF,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,iCAAiC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9D,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAe,EAAE,SAAc;IAC9D,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACzG,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5C,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACvE,OAAO,GAAc,CAAC;AACxB,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,GAAG,MAAM,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,GAAG;QAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS;AAClD,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAkG,EAClG,WAA0C,EAC1C,IAsBC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,SAAS,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,6CAA6C;IAEnF,kCAAkC;IAClC,MAAM,UAAU,GAAG,IAAI,EAAE,oBAAoB,IAAI,uBAAuB,CAAC;IACzE,IAAI,GAAG,GAAG,UAAU,IAAI,CAAC,IAAI,EAAE,kBAAkB,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,mCAAmC,GAAG,oBAAoB,UAAU,IAAI;YACtE,iEAAiE;YACjE,kDAAkD,CACrD,CAAC;IACJ,CAAC;IACD,IACE,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;QACrC,MAAM,CAAC,UAAU,GAAG,CAAC,IAAI,EAAE,oBAAoB,IAAI,uBAAuB,CAAC;QAC3E,CAAC,IAAI,EAAE,kBAAkB,EACzB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,CAAC,UAAU,mBAAmB;YACrE,GAAG,IAAI,EAAE,oBAAoB,IAAI,uBAAuB,IAAI;YAC5D,yDAAyD,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,yDAAyD,GAAG,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,kEAAkE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACzG,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACtB,MAAM,IAAI,GAA0B;QAClC,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,iFAAiF;QACjF,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG;QACH,GAAG;QACH,GAAG;QACH,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC;IACF,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;IAChF,qEAAqE;IACrE,4DAA4D;IAC5D,mEAAmE;IACnE,oEAAoE;IACpE,oEAAoE;IACpE,+DAA+D;IAC/D,mEAAmE;IACnE,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CACxB,UAAU,CAAC;YACT,MAAM,EAAE,iBAAiB;YACzB,OAAO,EAAE,SAAS;YAClB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE;YACxD,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE;YACjC,QAAQ,EAAE,MAAM,CAAC,GAAG;YACpB,OAAO,EAAE;gBACP,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,UAAU,EAAE,GAAG;gBACf,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;aACtC;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACxB,CAAC;AAED,8EAA8E;AAE9E,MAAM,sBAAsB,GAAG;IAC7B;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,WAAW;QACjB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC3C,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;KACtC;CACO,CAAC;AAEX,MAAM,mBAAmB,GAAG;IAC1B;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,kBAAkB;QACxB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;YACjC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;SACrC;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;KACxC;CACO,CAAC;AAEX;;;;;iHAKiH;AACjH,MAAM,2BAA2B,GAAG;IAClC;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,YAAY;QAClB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;YACnC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;YACjC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE;SAC/B;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;KACtC;CACO,CAAC;AAEX,MAAM,+BAA+B,GAAG;IACtC;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,6BAA6B;QACnC,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC5D,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;KACtC;CACO,CAAC;AAEX,MAAM,aAAa,GAAG,YAAY,CAAC;AAyHnC,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,SAAiB,CAAC;IACtB,IAAI,MAA6B,CAAC;IAClC,IAAI,CAAC;QACH,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAElC,CAAC;QACF,IAAI,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,CAAC,UAAU,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrF,CAAC;QACD,MAAM,GAAG,MAAM,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACjD,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAa,EAAE,CAAC;AACzD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CACzC,UAAsB,EACtB,iBAAyC,EACzC,iBAA0B;IAE1B,IAAI,CAAC,iBAAiB;QAAE,OAAO,uCAAuC,CAAC;IACvE,IAAI,iBAAiB,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QACrF,OAAO,gEAAgE,CAAC;IAC1E,CAAC;IACD,IAAI,iBAAiB,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,iBAAiB,CAAC,WAAW,EAAE,EAAE,CAAC;QACjF,OAAO,8DAA8D,CAAC;IACxE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAa,EACb,IAAmB;IAEnB,mEAAmE;IACnE,gCAAgC;IAChC,MAAM,IAAI,GAAG,KAAK,EAChB,OAA6B,EAC7B,MAA0B,EAC1B,SAA8B,EAC9B,gBAAiC,EACjC,EAAE;QACF,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO;QAC5B,oEAAoE;QACpE,qEAAqE;QACrE,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CACxB,UAAU,CAAC;YACT,MAAM,EACJ,OAAO,KAAK,SAAS;gBACnB,CAAC,CAAC,0BAA0B;gBAC5B,CAAC,CAAC,0BAA0B;YAChC,OAAO;YACP,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE;YACxE,OAAO,EAAE,gBAAgB;gBACvB,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,gBAAgB,EAAE;gBAC9C,CAAC,CAAC,SAAS;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,gBAAgB;YACxB,MAAM;YACN,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC7D,CAAC,CACH,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,KAAK,EACtB,MAAc,EACd,SAAmB,EACnB,gBAAsB,EACA,EAAE;QACxB,MAAM,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAC1D,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO;QAAE,OAAO,UAAU,CAAC,iBAAiB,CAAC,CAAC;IACnD,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAEjD,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAC,mBAAmB,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IACxD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG;QAAE,OAAO,UAAU,CAAC,eAAe,CAAC,CAAC;IAE3F,yBAAyB;IACzB,IAAI,SAAkB,CAAC;IACvB,IAAI,CAAC;QACH,SAAS,GAAG,uBAAuB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,UAAU,CAAC,8BAA8B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,iBAAiB,CAAC,WAAW,EAAE,EAAE,CAAC;QACvE,OAAO,UAAU,CAAC,gCAAgC,CAAC,CAAC;IACtD,CAAC;IAED,kBAAkB;IAClB,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAE3F,qBAAqB;IACrB,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC;IACrD,oEAAoE;IACpE,gEAAgE;IAChE,sEAAsE;IACtE,wEAAwE;IACxE,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,IAAI,QAAQ,CAAC;IAC/D,MAAM,YAAY,GAAG,kBAAkB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1E,oGAAoG;IACpG,qGAAqG;IACrG,MAAM,aAAa,GAAG,IAAI,CAAC,2BAA2B;QACpD,CAAC,CAAC,KAAK,EAAE,MAAe,EAAE,IAAS,EAAE,GAAQ,EAAoB,EAAE,CAC/D,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC;YAC/B,OAAO,EAAE,IAAI,CAAC,2BAAsC;YACpD,GAAG,EAAE,2BAA2B;YAChC,YAAY,EAAE,YAAY;YAC1B,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC;SAC1B,CAAC,CAAY;QAClB,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC;YAC/C,OAAO,EAAE,IAAI,CAAC,iBAAiB;YAC/B,GAAG,EAAE,sBAAsB;YAC3B,YAAY,EAAE,WAAW;YACzB,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB,CAAC,CAAY,CAAC;QACf,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,UAAU,CAAC,oBAAoB,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,UAAU,CACf,iHAAiH,EACjH,MAAM,CAAC,UAAU,CAAC,SAAS,EAC3B,UAAU,CACX,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,CAAC;IACT,CAAC;IAED,IAAI,aAAa,EAAE,CAAC;QAClB,mGAAmG;QACnG,kCAAkC;QAClC,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;gBACjG,OAAO,UAAU,CAAC,6BAA6B,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,UAAU,CAAC,kCAAkC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACrI,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;YAClF,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAChE,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,IAAI,eAAe,EAAE,CAAC;oBACpB,OAAO,UAAU,CACf,2BAA2B,MAAM,CAAC,UAAU,CAAC,SAAS,iJAAiJ,EACvM,MAAM,CAAC,UAAU,CAAC,SAAS,EAC3B,UAAU,CACX,CAAC;gBACJ,CAAC;gBACD,+DAA+D;YACjE,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC;oBAC7C,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS;oBACpC,GAAG,EAAE,mBAAmB;oBACxB,YAAY,EAAE,kBAAkB;oBAChC,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;iBAChD,CAAC,CAAQ,CAAC;gBACX,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,aAAa,EAAE,CAAC;oBAC1C,OAAO,UAAU,CAAC,2BAA2B,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;gBAC1F,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,UAAU,CACf,0BAA0B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAC9D,MAAM,CAAC,UAAU,CAAC,SAAS,EAC3B,UAAU,CACX,CAAC;QACJ,CAAC;IACH,CAAC;IAED,6DAA6D;IAC7D,EAAE;IACF,gGAAgG;IAChG,uGAAuG;IACvG,uGAAuG;IACvG,wGAAwG;IACxG,oGAAoG;IACpG,yGAAyG;IACzG,yGAAyG;IACzG,qFAAqF;IACrF,+EAA+E;IAC/E,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACnC,wFAAwF;QACxF,MAAM,OAAO,GAAG,2BAA2B,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;QACpG,IAAI,OAAO;YAAE,OAAO,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACjF,MAAM,EAAE,GAAG,MAAM,CAAC,iBAA+B,CAAC;QAClD,wGAAwG;QACxG,kGAAkG;QAClG,uEAAuE;QACvE,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACxE,IAAI,CAAC;YACH,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;oBAC/D,OAAO,UAAU,CAAC,0DAA0D,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;gBACzH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;gBACrE,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;oBACrD,IAAI,eAAe,EAAE,CAAC;wBACpB,OAAO,UAAU,CAAC,iFAAiF,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;oBAChJ,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,KAAK,GAAG,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC;wBAC7C,OAAO,EAAE,EAAE,CAAC,SAAS;wBACrB,GAAG,EAAE,mBAAmB;wBACxB,YAAY,EAAE,kBAAkB;wBAChC,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC;qBAC7B,CAAC,CAAQ,CAAC;oBACX,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,aAAa,EAAE,CAAC;wBAC1C,OAAO,UAAU,CAAC,wDAAwD,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;oBACvH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,UAAU,CAAC,gDAAgD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACnJ,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,EAAE;IACF,mEAAmE;IACnE,uEAAuE;IACvE,qEAAqE;IACrE,yEAAyE;IACzE,wEAAwE;IACxE,qEAAqE;IACrE,gFAAgF;IAChF,MAAM,QAAQ,GAAG,eAAe,CAC9B,MAAM,CAAC,UAAU,CAAC,OAAO,EACzB,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,EAC1C,IAAI,CAAC,WAAW,EAChB,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CACjD,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,kBAAkB,CAAC,CAAC,MAAM,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,oEAAoE;IACpE,qEAAqE;IACrE,qEAAqE;IACrE,oEAAoE;IACpE,sDAAsD;IACtD,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAC9C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,MAAM,CAC3C,CAAC;QACF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,UAAU,CACf,sDAAsD,EACtD,MAAM,CAAC,UAAU,CAAC,SAAS,EAC3B,UAAU,CACX,CAAC;QACJ,CAAC;QAED,+DAA+D;QAC/D,+DAA+D;QAC/D,sCAAsC;QACtC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,OAAO,UAAU,CACf,6FAA6F,EAC7F,MAAM,CAAC,UAAU,CAAC,SAAS,EAC3B,UAAU,CACX,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC1C,4DAA4D;YAC5D,iEAAiE;YACjE,4DAA4D;YAC5D,4DAA4D;YAC5D,OAAO,UAAU,CACf,kCAAkC,EAClC,MAAM,CAAC,UAAU,CAAC,SAAS,EAC3B,UAAU,CACX,CAAC;QACJ,CAAC;QACD,8DAA8D;QAC9D,+DAA+D;QAC/D,gEAAgE;IAClE,CAAC;IAED,wEAAwE;IACxE,oEAAoE;IACpE,mEAAmE;IACnE,uCAAuC;IACvC,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,eAAe,GAAG,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC;gBACjD,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS;gBACpC,GAAG,EAAE,+BAA+B;gBACpC,YAAY,EAAE,6BAA6B;gBAC3C,IAAI,EAAE,CAAC,UAAU,CAAC;aACnB,CAAC,CAAY,CAAC;QACjB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,UAAU,CACf,2CAA2C,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAC/E,MAAM,CAAC,UAAU,CAAC,SAAS,EAC3B,UAAU,CACX,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,OAAO,UAAU,CACf,sEAAsE,EACtE,MAAM,CAAC,UAAU,CAAC,SAAS,EAC3B,UAAU,CACX,CAAC;QACJ,CAAC;IACH,CAAC;IAED,gBAAgB;IAChB,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAChE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,UAAU,CAAC,4BAA4B,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC3F,CAAC;IAED,iEAAiE;IACjE,qEAAqE;IACrE,sEAAsE;IACtE,oEAAoE;IACpE,gBAAgB;IAChB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,OAAO,GAAqD,EAAE,CAAC;QACrE,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC;QAChD,IAAI,IAAI,CAAC,sBAAsB,KAAK,SAAS,EAAE,CAAC;YAC9C,OAAO,CAAC,eAAe,GAAG,eAAe,CAAC;QAC5C,CAAC;QACD,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CACxB,UAAU,CAAC;YACT,MAAM,EAAE,0BAA0B;YAClC,OAAO,EAAE,SAAS;YAClB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE;YACxD,OAAO,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE;YAC/C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SAC/D,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;AACpD,CAAC;AAED,sEAAsE;AACtE,sEAAsE;AACtE,0EAA0E;AAC1E,uEAAuE;AACvE,iEAAiE;AACjE,qEAAqE;AACrE,sEAAsE;AACtE,wDAAwD;AACxD,+DAA+D;AAC/D,kEAAkE"}

package/dist/types.d.ts

@@ -25,6 +25,16 @@ export interface DelegationTokenClaims {
     sub: Address;
     delegation: Delegation;
     sessionKeyAddress: Address;
+    /**
+     * DEL-001 (audit 2026-06-09) — the session-scoped leaf delegation that BINDS the session key to the
+     * delegator. v4 binds to the DELEGATOR (the principal's canonical SA), not the delegate: its
+     * `delegator` MUST equal `delegation.delegator` and its `delegate` MUST equal `sessionKeyAddress`;
+     * the delegator SA authorized it (validated via the UniversalSignatureValidator, so any credential
+     * strategy works). Without this leaf the full `delegation` travels in cleartext and anyone observing a
+     * token re-mints it with their own session key (permanent delegator impersonation). `principal` stays
+     * `delegation.delegator` — the leaf proves the presenting session key was authorized by that principal.
+     */
+    sessionDelegation?: Delegation;
     jti: string;
     iat: number;
     exp: number;
@@ -40,6 +50,8 @@ export interface EnforcerAddressMap {
     callDataHash?: Address;
     recovery?: Address;
     rateLimit?: Address;
+    /** Spec 272 PAY-CON-1 — the x402 PaymentEnforcer (spend + frequency cap + transfer-only). */
+    payment?: Address;
 }
 export interface CaveatContext {
     timestamp: number;
@@ -87,6 +99,29 @@ export interface VerifyOpts {
      * Off-chain JTI / session-token verify uses strict mode. Spec 202 §11.
      */
     enforceOnChain?: boolean;
+    /**
+     * DEL-001 (ADR-0036) — explicit opt-OUT of the session-key↔delegator binding. FAIL-CLOSED BY DEFAULT:
+     * with `allowUnboundSessionToken` unset/false, `verifyDelegationToken` REQUIRES the token to carry a
+     * valid `sessionDelegation` leaf binding the presenting session key to the DELEGATOR — the principal SA
+     * (`leaf.delegator === delegation.delegator` + `leaf.delegate === sessionKeyAddress` + the delegator
+     * SA's signature, validated via the UniversalSignatureValidator / deployed-ERC-1271). This closes the
+     * observe-and-re-mint vector on EVERY verify path, including one that forgets to configure it — the
+     * whole point of the flip (a critical authz control is not a per-call soft option a route can drop).
+     *
+     * Set `true` ONLY for an explicit legacy / non-client-minted path that issues UNBOUND tokens (e.g. a
+     * trusted-relayer / persona path where the relayer — not a client — signed the token). It is the
+     * greppable, audit-worthy escape hatch; a token without a leaf is REJECTED unless this is set.
+     */
+    allowUnboundSessionToken?: boolean;
+    /**
+     * spec 270 v4 — the deployed `UniversalSignatureValidator` address. When set, the delegation AND the
+     * `sessionDelegation` leaf signatures are validated through it (ERC-1271 deployed / ERC-6492
+     * counterfactual / ECDSA EOA) instead of a raw `isValidSignature` against a deployed SA — making the
+     * verifier connection-agnostic (every credential strategy validates via one
+     * surface) and removing the `requireDeployed` hard-reject for counterfactual SAs. Omit ⇒ legacy
+     * deployed-ERC-1271-only path (non-breaking).
+     */
+    universalSignatureValidator?: Address;
 }
 /**
  * H7-B.2 — options for `evaluateCaveats`. Mirrors the `enforceOnChain` flag

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAE7D,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAE7B,eAAO,MAAM,cAAc,EAAE,GACyC,CAAC;AAEvE,MAAM,WAAW,MAAM;IACrB,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,GAAG,CAAC;IACX,IAAI,CAAC,EAAE,GAAG,CAAC;CACZ;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,GAAG,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,GAAG,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,OAAO,CAAC;IACb,UAAU,EAAE,UAAU,CAAC;IACvB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,GAAG,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D,MAAM,MAAM,WAAW,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5C,MAAM,WAAW,QAAQ;IACvB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACtF;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,kBAAkB,CAAC;IAChC,QAAQ,EAAE,QAAQ,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE;QACN,OAAO,EAAE,OAAO,CAAC;QACjB,aAAa,CAAC,IAAI,EAAE;YAClB,MAAM,EAAE;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,OAAO,EAAE,MAAM,CAAC;gBAAC,OAAO,EAAE,MAAM,CAAC;gBAAC,iBAAiB,EAAE,OAAO,CAAA;aAAE,CAAC;YACvF,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAA;aAAE,CAAC,CAAC,CAAC;YACrE,WAAW,EAAE,MAAM,CAAC;YACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SAClC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;KAClB,CAAC;IACF,YAAY,EAAE,OAAO,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,iBAAiB,EAAE,GAAG,CAAC;IACvB,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IACrD,gBAAgB,EAAE,UAAU,CAAC;IAC7B,EAAE,EAAE,UAAU,CAAC;IACf,gBAAgB,EAAE,UAAU,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,cAAc,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACrD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,MAAM,EAAE;QACN,OAAO,EAAE,OAAO,CAAC;QACjB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG;YAAE,GAAG,EAAE,GAAG,CAAA;SAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;KACvD,CAAC;CACH"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAE7D,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAQ7B,eAAO,MAAM,cAAc,EAAE,GACyC,CAAC;AAEvE,MAAM,WAAW,MAAM;IACrB,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,GAAG,CAAC;IACX,IAAI,CAAC,EAAE,GAAG,CAAC;CACZ;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,GAAG,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,GAAG,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,OAAO,CAAC;IACb,UAAU,EAAE,UAAU,CAAC;IACvB,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,UAAU,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6FAA6F;IAC7F,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,GAAG,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D,MAAM,MAAM,WAAW,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5C,MAAM,WAAW,QAAQ;IACvB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACtF;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,kBAAkB,CAAC;IAChC,QAAQ,EAAE,QAAQ,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;;;;;;OAYG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;;;;;OAOG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE;QACN,OAAO,EAAE,OAAO,CAAC;QACjB,aAAa,CAAC,IAAI,EAAE;YAClB,MAAM,EAAE;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,OAAO,EAAE,MAAM,CAAC;gBAAC,OAAO,EAAE,MAAM,CAAC;gBAAC,iBAAiB,EAAE,OAAO,CAAA;aAAE,CAAC;YACvF,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAA;aAAE,CAAC,CAAC,CAAC;YACrE,WAAW,EAAE,MAAM,CAAC;YACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SAClC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;KAClB,CAAC;IACF,YAAY,EAAE,OAAO,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,iBAAiB,EAAE,GAAG,CAAC;IACvB,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IACrD,gBAAgB,EAAE,UAAU,CAAC;IAC7B,EAAE,EAAE,UAAU,CAAC;IACf,gBAAgB,EAAE,UAAU,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,cAAc,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACrD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,MAAM,EAAE;QACN,OAAO,EAAE,OAAO,CAAC;QACjB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG;YAAE,GAAG,EAAE,GAAG,CAAA;SAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;KACvD,CAAC;CACH"}

package/dist/types.js

@@ -1,3 +1,9 @@
 // Shared types for @agenticprimitives/delegation.
-export const ROOT_AUTHORITY = '0x0000000000000000000000000000000000000000000000000000000000000000';
+// MUST equal DelegationManager.ROOT_AUTHORITY (the root-delegation sentinel the
+// on-chain authority-chain check compares against). The contract uses
+// bytes32(type(uint256).max) — the DeleGator-framework convention — NOT the zero
+// hash. A root delegation carrying any other authority reverts `InvalidAuthority`
+// on redeemDelegation. (Was 0x00…00, which silently broke every on-chain
+// redemption; off-chain token paths never exercised the on-chain chain check.)
+export const ROOT_AUTHORITY = '0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff';
 //# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAMlD,MAAM,CAAC,MAAM,cAAc,GACzB,oEAAoE,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAMlD,gFAAgF;AAChF,sEAAsE;AACtE,iFAAiF;AACjF,kFAAkF;AAClF,yEAAyE;AACzE,+EAA+E;AAC/E,MAAM,CAAC,MAAM,cAAc,GACzB,oEAAoE,CAAC"}

package/dist/verify-authorization.d.ts

@@ -10,6 +10,12 @@ export interface VerifyAuthorizationResult {
  * View-only verification of a delegation chain. Returns whether the chain
  * authorizes `sender` to redeem WITHOUT executing it.
  *
+ * ⚠️ DANGER — chain-only. This does NOT evaluate caveats, so a `true` result is
+ * NOT permission to perform any specific (target, value, calldata). To authorize a
+ * concrete call use `verifyAuthorizationForCall` (fail-closed, evaluates every
+ * caveat) or live redemption. Treating this boolean as call authorization re-opens
+ * the exact over-trust the caveats exist to prevent.
+ *
  * Spec 242 §6 uses this to validate bilateral-consent delegations as signed
  * authorization predicates rather than as cross-account execution.
  */

package/dist/verify-authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify-authorization.d.ts","sourceRoot":"","sources":["../src/verify-authorization.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,MAAM,CAAC;AAEzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAqC1C,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,OAAO,CAAC;IACZ,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE;IAC9C,YAAY,EAAE,YAAY,CAAC;IAC3B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAuBrC"}
+{"version":3,"file":"verify-authorization.d.ts","sourceRoot":"","sources":["../src/verify-authorization.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,MAAM,CAAC;AAEzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAqC1C,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,OAAO,CAAC;IACZ,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE;IAC9C,YAAY,EAAE,YAAY,CAAC;IAC3B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAuBrC"}

package/dist/verify-authorization.js

@@ -39,6 +39,12 @@ const VERIFY_AUTHORIZATION_ABI = [
  * View-only verification of a delegation chain. Returns whether the chain
  * authorizes `sender` to redeem WITHOUT executing it.
  *
+ * ⚠️ DANGER — chain-only. This does NOT evaluate caveats, so a `true` result is
+ * NOT permission to perform any specific (target, value, calldata). To authorize a
+ * concrete call use `verifyAuthorizationForCall` (fail-closed, evaluates every
+ * caveat) or live redemption. Treating this boolean as call authorization re-opens
+ * the exact over-trust the caveats exist to prevent.
+ *
  * Spec 242 §6 uses this to validate bilateral-consent delegations as signed
  * authorization predicates rather than as cross-account execution.
  */

package/dist/verify-authorization.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify-authorization.js","sourceRoot":"","sources":["../src/verify-authorization.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,iFAAiF;AACjF,yCAAyC;AAOzC,MAAM,wBAAwB,GAAG;IAC/B;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,qBAAqB;QAC3B,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,aAAa;gBACnB,IAAI,EAAE,SAAS;gBACf,UAAU,EAAE;oBACV,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE;oBACtC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;oBACrC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE;oBACtC;wBACE,IAAI,EAAE,SAAS;wBACf,IAAI,EAAE,SAAS;wBACf,UAAU,EAAE;4BACV,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;4BACrC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;4BAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE;yBAChC;qBACF;oBACD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;oBACjC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;iBACrC;aACF;YACD,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;SACpC;QACD,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE;YAC5B,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;SACnC;KACF;CACO,CAAC;AAQX;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAKzC;IACC,MAAM,kBAAkB,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtD,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,qEAAqE;YACrE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAkB;SACxC,CAAC,CAAC;QACH,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;QACzD,OAAO,EAAE,IAAI,CAAC,iBAAiB;QAC/B,GAAG,EAAE,wBAAwB;QAC7B,YAAY,EAAE,qBAAqB;QACnC,IAAI,EAAE,CAAC,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC;KACxC,CAAC,CAA+B,CAAC;IAElC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;AACxB,CAAC"}
+{"version":3,"file":"verify-authorization.js","sourceRoot":"","sources":["../src/verify-authorization.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,iFAAiF;AACjF,yCAAyC;AAOzC,MAAM,wBAAwB,GAAG;IAC/B;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,qBAAqB;QAC3B,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,aAAa;gBACnB,IAAI,EAAE,SAAS;gBACf,UAAU,EAAE;oBACV,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE;oBACtC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;oBACrC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE;oBACtC;wBACE,IAAI,EAAE,SAAS;wBACf,IAAI,EAAE,SAAS;wBACf,UAAU,EAAE;4BACV,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;4BACrC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;4BAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE;yBAChC;qBACF;oBACD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;oBACjC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;iBACrC;aACF;YACD,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;SACpC;QACD,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE;YAC5B,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;SACnC;KACF;CACO,CAAC;AAQX;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAKzC;IACC,MAAM,kBAAkB,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtD,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,qEAAqE;YACrE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAkB;SACxC,CAAC,CAAC;QACH,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;QACzD,OAAO,EAAE,IAAI,CAAC,iBAAiB;QAC/B,GAAG,EAAE,wBAAwB;QAC7B,YAAY,EAAE,qBAAqB;QACnC,IAAI,EAAE,CAAC,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC;KACxC,CAAC,CAA+B,CAAC;IAElC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;AACxB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticprimitives/delegation",
-  "version": "1.0.0-alpha.6",
+  "version": "1.0.0-alpha.8",
   "description": "EIP-712 smart-account delegations with caveats; web→agent→MCP token flow; session lifecycle.",
   "license": "MIT",
   "repository": {
@@ -36,11 +36,11 @@
   },
   "peerDependencies": {
     "viem": "^2.52.2",
-    "@agenticprimitives/agent-account": "1.0.0-alpha.6",
-    "@agenticprimitives/audit": "1.0.0-alpha.6",
-    "@agenticprimitives/connect-auth": "1.0.0-alpha.6",
-    "@agenticprimitives/key-custody": "1.0.0-alpha.6",
-    "@agenticprimitives/types": "1.0.0-alpha.6"
+    "@agenticprimitives/agent-account": "1.0.0-alpha.8",
+    "@agenticprimitives/audit": "1.0.0-alpha.8",
+    "@agenticprimitives/connect-auth": "1.0.0-alpha.8",
+    "@agenticprimitives/key-custody": "1.0.0-alpha.8",
+    "@agenticprimitives/types": "1.0.0-alpha.8"
   },
   "devDependencies": {
     "vitest": "^4.1.8"
@@ -58,7 +58,7 @@
     "build": "tsc -p tsconfig.build.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "vitest run",
-    "test:unit": "vitest run test/unit",
+    "test:unit": "vitest run test/unit --passWithNoTests",
     "test:integration": "vitest run test/integration --passWithNoTests",
     "test:watch": "vitest",
     "clean": "rm -rf dist"