@astrale-os/kernel-client 0.2.0

package/dist/delegation/cache.js

@@ -0,0 +1,258 @@
+import { DelegationMintError } from './errors';
+/**
+ * TTL-keyed credential cache with concurrent-mint deduplication. Spec §9.2.
+ *
+ * **Concurrent-mint invariant:** two concurrent `get(audience, delegation,
+ * attestation)` calls for the same structural triple share a single mint
+ * dispatch. On success, every waiter receives the same credential and the
+ * result is cached. On rejection, every waiter sees the rejection and the
+ * cache is NOT populated — subsequent calls re-attempt minting.
+ *
+ * **Structural key:** `delegation` and `attestation` are canonicalized
+ * by a deterministic JSON encoding (sorted keys; array order preserved —
+ * see `canonicalEncode` docstring). Policies returning fresh-but-equal
+ * objects on every call hit the same cache entry.
+ *
+ * **Attestation distinct from undefined:** `undefined` attestation and
+ * `{ kind: 'identity', self: true }` attestation are distinct keys (§9.2.1)
+ * even though the kernel adapter defaults the former to the latter at
+ * the wire — they produce distinguishable outer-envelope claims.
+ */
+export class DelegationCache {
+    entries = new Map();
+    inFlight = new Map();
+    // Secondary index: audience → set of canonical cache keys. Maintained on
+    // every insert / evict / clear so `evictAudience` is O(entries-for-audience)
+    // instead of O(all-entries). Invariant: every entry in `entries` has its
+    // key in `byAudience.get(entry.audience)`, and vice versa.
+    byAudience = new Map();
+    mint;
+    defaultTtl;
+    maxSize;
+    now;
+    clock = 0;
+    // Bumped by `clear()`. Mints captured before the bump skip the post-resolve
+    // insert so an intentional reset actually clears — preserves the docstring
+    // invariant "results bypass the now-cleared cache."
+    clearEpoch = 0;
+    constructor(config) {
+        this.mint = config.mint;
+        this.defaultTtl = config.ttl ?? 300;
+        this.maxSize = config.maxSize ?? 64;
+        this.now = config.now ?? (() => Date.now() / 1000);
+        if (this.maxSize < 1) {
+            throw new Error(`DelegationCache.maxSize must be >= 1 (got ${this.maxSize})`);
+        }
+    }
+    /**
+     * Returns a delegated credential for `(audience, delegation, attestation)`.
+     * Cache hit returns synchronously-resolved; miss coalesces a single mint
+     * across concurrent callers on the same structural key.
+     *
+     * Throws `DelegationMintError` (wrapping the mint's cause) on mint
+     * failure. The failure is NOT cached.
+     */
+    async get(audience, delegation, attestation) {
+        const key = delegationCacheKey(audience, delegation, attestation);
+        const now = this.now();
+        const cached = this.entries.get(key);
+        if (cached && cached.expiresAt > now) {
+            cached.lastUsed = ++this.clock;
+            return cached.credential;
+        }
+        if (cached)
+            this.deleteEntry(key);
+        const pending = this.inFlight.get(key);
+        if (pending)
+            return (await pending.promise).credential;
+        const mintEpoch = this.clearEpoch;
+        const promise = this.mint(audience, delegation, attestation)
+            .then((result) => {
+            // undefined → use default; 0 → don't cache (explicit mint opt-out).
+            const ttl = result.ttl === undefined ? this.defaultTtl : result.ttl;
+            // Skip the insert if clear() ran after this mint was launched —
+            // repopulating would undo the consumer's explicit reset.
+            if (ttl > 0 && this.clearEpoch === mintEpoch) {
+                this.insert(key, {
+                    credential: result.credential,
+                    expiresAt: this.now() + ttl,
+                    lastUsed: ++this.clock,
+                    audience,
+                });
+            }
+            return result;
+        })
+            .catch((cause) => {
+            throw new DelegationMintError(audience, delegation, attestation, {
+                cause: cause,
+            });
+        })
+            .finally(() => {
+            // Evict the in-flight record regardless of outcome so the next call
+            // retries on failure ("don't cache rejection") and observes the
+            // fresh cache entry on success.
+            this.inFlight.delete(key);
+        });
+        this.inFlight.set(key, { promise });
+        const result = await promise;
+        return result.credential;
+    }
+    /**
+     * Manually insert an entry. Used by consumers minting through a
+     * custom path outside `get`'s default mint flow.
+     */
+    set(audience, credential, ttl, delegation, attestation) {
+        if (ttl <= 0)
+            return;
+        const key = delegationCacheKey(audience, delegation, attestation);
+        this.insert(key, {
+            credential,
+            expiresAt: this.now() + ttl,
+            lastUsed: ++this.clock,
+            audience,
+        });
+    }
+    /** Remove one entry. Idempotent — no-op for absent keys. */
+    evict(audience, delegation, attestation) {
+        const key = delegationCacheKey(audience, delegation, attestation);
+        this.deleteEntry(key);
+    }
+    /**
+     * Remove every entry for `audience`, regardless of delegation /
+     * attestation shape. Returns the number of entries removed.
+     * Idempotent — returns `0` for unknown audiences.
+     *
+     * Bulk invalidation primitive: a host whose user revokes consent for
+     * an audience calls this without enumerating every
+     * `(delegation, attestation)` combination it minted.
+     */
+    evictAudience(audience) {
+        const keys = this.byAudience.get(audience);
+        if (!keys)
+            return 0;
+        const removed = keys.size;
+        for (const key of keys)
+            this.entries.delete(key);
+        this.byAudience.delete(audience);
+        return removed;
+    }
+    /**
+     * Drop every cached entry. Does NOT abort in-flight mints — they
+     * resolve as usual but their results bypass the now-cleared cache.
+     */
+    clear() {
+        this.entries.clear();
+        this.byAudience.clear();
+        this.clearEpoch++;
+    }
+    /** Entry count. Useful for tests; not a contract for production flow. */
+    get size() {
+        return this.entries.size;
+    }
+    insert(key, entry) {
+        if (this.entries.has(key)) {
+            // Overwrite-in-place: byAudience already tracks this key under the
+            // same audience (cache key is a function of audience; audience can't
+            // change for a given key).
+            this.entries.set(key, entry);
+            return;
+        }
+        if (this.entries.size >= this.maxSize)
+            this.evictLeastRecentlyUsed();
+        this.entries.set(key, entry);
+        this.indexKey(entry.audience, key);
+    }
+    indexKey(audience, key) {
+        let set = this.byAudience.get(audience);
+        if (!set) {
+            set = new Set();
+            this.byAudience.set(audience, set);
+        }
+        set.add(key);
+    }
+    deleteEntry(key) {
+        const entry = this.entries.get(key);
+        if (!entry)
+            return;
+        this.entries.delete(key);
+        const set = this.byAudience.get(entry.audience);
+        if (set) {
+            set.delete(key);
+            if (set.size === 0)
+                this.byAudience.delete(entry.audience);
+        }
+    }
+    evictLeastRecentlyUsed() {
+        let oldestKey;
+        let oldestTs = Number.POSITIVE_INFINITY;
+        for (const [key, entry] of this.entries) {
+            if (entry.lastUsed < oldestTs) {
+                oldestTs = entry.lastUsed;
+                oldestKey = key;
+            }
+        }
+        if (oldestKey !== undefined)
+            this.deleteEntry(oldestKey);
+    }
+}
+/**
+ * Build a deterministic cache key from `(audience, delegation, attestation)`.
+ *
+ * The `delegation` and `attestation` trees are serialised through
+ * `canonicalEncode`, which:
+ *   - Sorts object keys alphabetically at every node (so
+ *     `{ kind, expr }` and `{ expr, kind }` collide).
+ *   - Preserves array order (union/intersect/exclude operands are
+ *     position-sensitive in the canonical form; `Scope[]` inside
+ *     `{ kind: 'scope' }` is also position-preserving — scope sorting
+ *     is the caller's choice, not the cache's, per spec §9.2.1).
+ *   - Emits `#none` for absent attestation (distinct from any present
+ *     `SelfIdentityExpr` including `{ kind: 'identity', self: true }`).
+ *
+ * Exported so ClientSession's `#pendingMints` table stays keyed identically
+ * without duplicating the key-shape logic.
+ */
+export function delegationCacheKey(audience, delegation, attestation) {
+    const delPart = canonicalEncode(delegation);
+    const attPart = attestation === undefined ? '#none' : canonicalEncode(attestation);
+    return `${audience}|d=${delPart}|a=${attPart}`;
+}
+/**
+ * Canonical JSON-ish encoder: object keys sorted alphabetically, arrays
+ * preserve order, primitives stringified. Used only for cache keying;
+ * consumers never parse the output.
+ *
+ * We don't reach for `JSON.stringify` directly because its key order
+ * tracks insertion, not alphabetical. A custom walk is ~25 LOC and
+ * eliminates the whole class of "policy returned equal-but-reordered
+ * objects → cache miss" bugs.
+ *
+ * `Uint8Array` gets an explicit `#bytes:` prefix + hex encoding. Without
+ * it, a bytes credential (`CredentialInput = string | Uint8Array`) would
+ * fall through the generic object branch — `Object.keys(uint8)` returns
+ * stringified numeric indices — and collide with a literal
+ * `Record<string, number>` leaf. The prefix is a sentinel that cannot
+ * appear in a valid `JSON.stringify(object)` output.
+ */
+function canonicalEncode(value) {
+    if (value === null)
+        return 'null';
+    if (typeof value !== 'object')
+        return JSON.stringify(value);
+    if (value instanceof Uint8Array)
+        return `#bytes:${bytesToHex(value)}`;
+    if (Array.isArray(value)) {
+        return `[${value.map(canonicalEncode).join(',')}]`;
+    }
+    const obj = value;
+    const keys = Object.keys(obj).sort();
+    const parts = keys.map((k) => `${JSON.stringify(k)}:${canonicalEncode(obj[k])}`);
+    return `{${parts.join(',')}}`;
+}
+function bytesToHex(bytes) {
+    let s = '';
+    for (let i = 0; i < bytes.length; i++)
+        s += bytes[i].toString(16).padStart(2, '0');
+    return s;
+}
+//# sourceMappingURL=cache.js.map

package/dist/delegation/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../src/delegation/cache.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAgE9C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,eAAe;IACT,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAA;IACvC,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAA;IAC5D,yEAAyE;IACzE,6EAA6E;IAC7E,yEAAyE;IACzE,2DAA2D;IAC1C,UAAU,GAAG,IAAI,GAAG,EAAuB,CAAA;IAC3C,IAAI,CAAkB;IACtB,UAAU,CAAQ;IAClB,OAAO,CAAQ;IACf,GAAG,CAAc;IAC1B,KAAK,GAAG,CAAC,CAAA;IACjB,4EAA4E;IAC5E,2EAA2E;IAC3E,oDAAoD;IAC5C,UAAU,GAAG,CAAC,CAAA;IAEtB,YAAY,MAA6B;QACvC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;QACvB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,GAAG,IAAI,GAAG,CAAA;QACnC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAA;QACnC,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QAClD,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,CAAC,OAAO,GAAG,CAAC,CAAA;QAC/E,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG,CACP,QAAgB,EAChB,UAAkC,EAClC,WAA8B;QAE9B,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAC,CAAA;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAEtB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YACrC,MAAM,CAAC,QAAQ,GAAG,EAAE,IAAI,CAAC,KAAK,CAAA;YAC9B,OAAO,MAAM,CAAC,UAAU,CAAA;QAC1B,CAAC;QACD,IAAI,MAAM;YAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAEjC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACtC,IAAI,OAAO;YAAE,OAAO,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,UAAU,CAAA;QAEtD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAA;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAC;aACzD,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACf,oEAAoE;YACpE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAA;YACnE,gEAAgE;YAChE,yDAAyD;YACzD,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;oBACf,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG;oBAC3B,QAAQ,EAAE,EAAE,IAAI,CAAC,KAAK;oBACtB,QAAQ;iBACT,CAAC,CAAA;YACJ,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,MAAM,IAAI,mBAAmB,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE;gBAC/D,KAAK,EAAE,KAAc;aACtB,CAAC,CAAA;QACJ,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,oEAAoE;YACpE,gEAAgE;YAChE,gCAAgC;YAChC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC3B,CAAC,CAAC,CAAA;QAEJ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;QACnC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAA;QAC5B,OAAO,MAAM,CAAC,UAAU,CAAA;IAC1B,CAAC;IAED;;;OAGG;IACH,GAAG,CACD,QAAgB,EAChB,UAA2B,EAC3B,GAAW,EACX,UAAkC,EAClC,WAA8B;QAE9B,IAAI,GAAG,IAAI,CAAC;YAAE,OAAM;QACpB,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAC,CAAA;QACjE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YACf,UAAU;YACV,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG;YAC3B,QAAQ,EAAE,EAAE,IAAI,CAAC,KAAK;YACtB,QAAQ;SACT,CAAC,CAAA;IACJ,CAAC;IAED,4DAA4D;IAC5D,KAAK,CACH,QAAgB,EAChB,UAAkC,EAClC,WAA8B;QAE9B,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAC,CAAA;QACjE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACvB,CAAC;IAED;;;;;;;;OAQG;IACH,aAAa,CAAC,QAAgB;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC1C,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAA;QACnB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAA;QACzB,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAChD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAChC,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;OAGG;IACH,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAA;QACpB,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAA;QACvB,IAAI,CAAC,UAAU,EAAE,CAAA;IACnB,CAAC;IAED,yEAAyE;IACzE,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAA;IAC1B,CAAC;IAEO,MAAM,CAAC,GAAW,EAAE,KAAiB;QAC3C,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,mEAAmE;YACnE,qEAAqE;YACrE,2BAA2B;YAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YAC5B,OAAM;QACR,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,sBAAsB,EAAE,CAAA;QACpE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAC5B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IACpC,CAAC;IAEO,QAAQ,CAAC,QAAgB,EAAE,GAAW;QAC5C,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACvC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,GAAG,IAAI,GAAG,EAAE,CAAA;YACf,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;QACpC,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACd,CAAC;IAEO,WAAW,CAAC,GAAW;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,CAAC,KAAK;YAAE,OAAM;QAClB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,GAAG,EAAE,CAAC;YACR,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACf,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC;gBAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC5D,CAAC;IACH,CAAC;IAEO,sBAAsB;QAC5B,IAAI,SAA6B,CAAA;QACjC,IAAI,QAAQ,GAAG,MAAM,CAAC,iBAAiB,CAAA;QACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,QAAQ,GAAG,QAAQ,EAAE,CAAC;gBAC9B,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;gBACzB,SAAS,GAAG,GAAG,CAAA;YACjB,CAAC;QACH,CAAC;QACD,IAAI,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAA;IAC1D,CAAC;CACF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAgB,EAChB,UAAkC,EAClC,WAAyC;IAEzC,MAAM,OAAO,GAAG,eAAe,CAAC,UAAU,CAAC,CAAA;IAC3C,MAAM,OAAO,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,CAAA;IAClF,OAAO,GAAG,QAAQ,MAAM,OAAO,MAAM,OAAO,EAAE,CAAA;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAA;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC3D,IAAI,KAAK,YAAY,UAAU;QAAE,OAAO,UAAU,UAAU,CAAC,KAAK,CAAC,EAAE,CAAA;IACrE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IACpD,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAA;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAChF,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;AAC/B,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,IAAI,CAAC,GAAG,EAAE,CAAA;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAClF,OAAO,CAAC,CAAA;AACV,CAAC"}

package/dist/delegation/errors.d.ts

@@ -0,0 +1,44 @@
+import type { SelfIdentityExpr, UnresolvedIdentityExpr } from '@astrale-os/kernel-core/expression';
+import { ClientSessionError } from '../errors/session-error';
+/**
+ * Delegation policy refused to mint for an audience.
+ *
+ * Thrown by ClientSession's dispatch loop when `DelegationPolicy.decide` returns
+ * `{ allow: false, reason }`. The `audience`, `delegation`, and
+ * `attestation` the call was about to mint for are preserved so a UI can
+ * re-prompt with the full context of what was being proposed. The values
+ * are **pre-refine** — if the policy conceptually considered a refined
+ * shape before refusing, the pre-refine shape is what's reported here
+ * (that's what was proposed to `decide`). Spec §9.3.1 / §10.3.
+ */
+export declare class DelegationRefusedError extends ClientSessionError {
+    readonly audience: string;
+    readonly delegation: UnresolvedIdentityExpr;
+    readonly attestation: SelfIdentityExpr | undefined;
+    readonly reason: string;
+    constructor(audience: string, delegation: UnresolvedIdentityExpr, attestation: SelfIdentityExpr | undefined, reason: string, options?: ErrorOptions);
+}
+/**
+ * `DelegationCache.get` dispatched a mint that threw.
+ *
+ * Wraps the underlying error (kernel auth error, network failure, etc.)
+ * as `cause`. The cache does NOT retain a failed mint — subsequent
+ * calls re-attempt minting. Spec §9.2 "don't cache rejection" + §10.3.
+ */
+export declare class DelegationMintError extends ClientSessionError {
+    readonly audience: string;
+    readonly delegation: UnresolvedIdentityExpr;
+    readonly attestation: SelfIdentityExpr | undefined;
+    constructor(audience: string, delegation: UnresolvedIdentityExpr, attestation: SelfIdentityExpr | undefined, options?: ErrorOptions);
+}
+/**
+ * A `DelegationPolicy.decide` implementation itself threw.
+ *
+ * Programmer error at the policy layer. Wraps the thrown error as
+ * `cause`. Consumers treating this as "refused" is safe. Spec §10.3.
+ */
+export declare class DelegationPolicyError extends ClientSessionError {
+    readonly audience: string | undefined;
+    constructor(audience: string | undefined, options?: ErrorOptions);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/delegation/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/delegation/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAElG,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAE5D;;;;;;;;;;GAUG;AACH,qBAAa,sBAAuB,SAAQ,kBAAkB;aAE1C,QAAQ,EAAE,MAAM;aAChB,UAAU,EAAE,sBAAsB;aAClC,WAAW,EAAE,gBAAgB,GAAG,SAAS;aACzC,MAAM,EAAE,MAAM;IAJhC,YACkB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,sBAAsB,EAClC,WAAW,EAAE,gBAAgB,GAAG,SAAS,EACzC,MAAM,EAAE,MAAM,EAC9B,OAAO,CAAC,EAAE,YAAY,EAIvB;CACF;AAED;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,kBAAkB;aAEvC,QAAQ,EAAE,MAAM;aAChB,UAAU,EAAE,sBAAsB;aAClC,WAAW,EAAE,gBAAgB,GAAG,SAAS;IAH3D,YACkB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,sBAAsB,EAClC,WAAW,EAAE,gBAAgB,GAAG,SAAS,EACzD,OAAO,CAAC,EAAE,YAAY,EAIvB;CACF;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,kBAAkB;aAEzC,QAAQ,EAAE,MAAM,GAAG,SAAS;IAD9C,YACkB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5C,OAAO,CAAC,EAAE,YAAY,EAUvB;CACF"}

package/dist/delegation/errors.js

@@ -0,0 +1,62 @@
+import { ClientSessionError } from '../errors/session-error';
+/**
+ * Delegation policy refused to mint for an audience.
+ *
+ * Thrown by ClientSession's dispatch loop when `DelegationPolicy.decide` returns
+ * `{ allow: false, reason }`. The `audience`, `delegation`, and
+ * `attestation` the call was about to mint for are preserved so a UI can
+ * re-prompt with the full context of what was being proposed. The values
+ * are **pre-refine** — if the policy conceptually considered a refined
+ * shape before refusing, the pre-refine shape is what's reported here
+ * (that's what was proposed to `decide`). Spec §9.3.1 / §10.3.
+ */
+export class DelegationRefusedError extends ClientSessionError {
+    audience;
+    delegation;
+    attestation;
+    reason;
+    constructor(audience, delegation, attestation, reason, options) {
+        super(`Delegation refused for "${audience}": ${reason}`, 'DELEGATION_REFUSED', options);
+        this.audience = audience;
+        this.delegation = delegation;
+        this.attestation = attestation;
+        this.reason = reason;
+        this.name = 'DelegationRefusedError';
+    }
+}
+/**
+ * `DelegationCache.get` dispatched a mint that threw.
+ *
+ * Wraps the underlying error (kernel auth error, network failure, etc.)
+ * as `cause`. The cache does NOT retain a failed mint — subsequent
+ * calls re-attempt minting. Spec §9.2 "don't cache rejection" + §10.3.
+ */
+export class DelegationMintError extends ClientSessionError {
+    audience;
+    delegation;
+    attestation;
+    constructor(audience, delegation, attestation, options) {
+        super(`Delegation mint failed for "${audience}"`, 'DELEGATION_MINT_FAILED', options);
+        this.audience = audience;
+        this.delegation = delegation;
+        this.attestation = attestation;
+        this.name = 'DelegationMintError';
+    }
+}
+/**
+ * A `DelegationPolicy.decide` implementation itself threw.
+ *
+ * Programmer error at the policy layer. Wraps the thrown error as
+ * `cause`. Consumers treating this as "refused" is safe. Spec §10.3.
+ */
+export class DelegationPolicyError extends ClientSessionError {
+    audience;
+    constructor(audience, options) {
+        super(audience === undefined
+            ? 'Delegation policy threw during audience derivation'
+            : `Delegation policy threw for audience "${audience}"`, 'DELEGATION_POLICY_THREW', options);
+        this.audience = audience;
+        this.name = 'DelegationPolicyError';
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/delegation/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/delegation/errors.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAE5D;;;;;;;;;;GAUG;AACH,MAAM,OAAO,sBAAuB,SAAQ,kBAAkB;IAE1C,QAAQ;IACR,UAAU;IACV,WAAW;IACX,MAAM;IAJxB,YACkB,QAAgB,EAChB,UAAkC,EAClC,WAAyC,EACzC,MAAc,EAC9B,OAAsB;QAEtB,KAAK,CAAC,2BAA2B,QAAQ,MAAM,MAAM,EAAE,EAAE,oBAAoB,EAAE,OAAO,CAAC,CAAA;wBANvE,QAAQ;0BACR,UAAU;2BACV,WAAW;sBACX,MAAM;QAItB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,mBAAoB,SAAQ,kBAAkB;IAEvC,QAAQ;IACR,UAAU;IACV,WAAW;IAH7B,YACkB,QAAgB,EAChB,UAAkC,EAClC,WAAyC,EACzD,OAAsB;QAEtB,KAAK,CAAC,+BAA+B,QAAQ,GAAG,EAAE,wBAAwB,EAAE,OAAO,CAAC,CAAA;wBALpE,QAAQ;0BACR,UAAU;2BACV,WAAW;QAI3B,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,qBAAsB,SAAQ,kBAAkB;IAEzC,QAAQ;IAD1B,YACkB,QAA4B,EAC5C,OAAsB;QAEtB,KAAK,CACH,QAAQ,KAAK,SAAS;YACpB,CAAC,CAAC,oDAAoD;YACtD,CAAC,CAAC,yCAAyC,QAAQ,GAAG,EACxD,yBAAyB,EACzB,OAAO,CACR,CAAA;wBATe,QAAQ;QAUxB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAA;IACrC,CAAC;CACF"}

package/dist/delegation/index.d.ts

@@ -0,0 +1,6 @@
+export type { DelegationCacheConfig, DelegationMintFn, DelegationMintResult } from './cache';
+export { DelegationCache } from './cache';
+export type { DelegationContext, DelegationDecision, DelegationPolicy } from './policy';
+export { allowAllDelegations, allowlistDelegations, promptDelegations, scopedSelf } from './policy';
+export { DelegationMintError, DelegationPolicyError, DelegationRefusedError } from './errors';
+//# sourceMappingURL=index.d.ts.map

package/dist/delegation/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAC5F,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AACzC,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AACvF,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AACnG,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA"}

package/dist/delegation/index.js

@@ -0,0 +1,4 @@
+export { DelegationCache } from './cache';
+export { allowAllDelegations, allowlistDelegations, promptDelegations, scopedSelf } from './policy';
+export { DelegationMintError, DelegationPolicyError, DelegationRefusedError } from './errors';
+//# sourceMappingURL=index.js.map

package/dist/delegation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAEzC,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AACnG,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA"}

package/dist/delegation/policy.d.ts

@@ -0,0 +1,175 @@
+import type { Scope, SelfIdentityExpr, UnresolvedIdentityExpr } from '@astrale-os/kernel-core/expression';
+/**
+ * Context passed to every `DelegationPolicy` method. Carries hop history
+ * and correlation id so policies can branch on "are we on a redirect
+ * hop?" or thread the correlation id into an external audit stream
+ * without closure tracking.
+ */
+export type DelegationContext = {
+    /** URL the call is about to dispatch to. */
+    target: string;
+    /** Method name being dispatched. */
+    method: string;
+    /** Params the call carries. */
+    params: unknown;
+    /** Correlation id of the top-level `session.call`. */
+    correlationId: string;
+    /**
+     * Hop chain so far. `hops[0]` is the initial target; the last entry is
+     * the *current* hop being dispatched. On the first iteration of the
+     * dispatch loop the array has one element; each followed redirect
+     * appends one more before the next iteration re-runs the policy.
+     */
+    hops: ReadonlyArray<{
+        url: string;
+        at: number;
+    }>;
+};
+/**
+ * Consent decision for a single mint.
+ *
+ * - `{ allow: true }` — accept the pre-computed `(delegation, attestation)` as-is.
+ * - `{ allow: true, delegation?, attestation? }` — accept with refinement:
+ *   substitute the provided field(s) before `DelegationCache.get`. The
+ *   post-refine values become the cache key and what `onDelegationMint`
+ *   reports. Either field is optional; the unrefined fields stay
+ *   pre-computed. Refinement is one-shot — ClientSession does not re-invoke
+ *   `decide` on the refined shape.
+ * - `{ allow: false, reason }` — causes ClientSession to throw
+ *   `DelegationRefusedError`. The error carries the pre-refine shape.
+ *
+ * Spec §9.3 / §9.3.1. A single-branch `allow: true` with optional
+ * refinement fields is what TypeScript narrows cleanly — a two-branch
+ * union of `{ allow: true }` and `{ allow: true, delegation?, attestation? }`
+ * would be indistinguishable to the narrower and forces `as` casts at
+ * every read site.
+ */
+export type DelegationDecision = {
+    allow: true;
+    delegation?: UnresolvedIdentityExpr;
+    attestation?: SelfIdentityExpr;
+} | {
+    allow: false;
+    reason: string;
+};
+/**
+ * Audience + delegation + attestation + consent surface. Spec §9.3.
+ *
+ * Mirrors the server-side `MintDelegationParams` triple in
+ * `kernel/ports/authentication/authentication.port.ts` one-for-one. Owns
+ * ONLY decision-layer concerns. Does NOT own the cache (that's
+ * `DelegationCache`), the mint itself (injected via cache config),
+ * credential-chaining resolution (kernel-side at mint/auth time), or
+ * iterated negotiation (`decide` is one-shot).
+ */
+export interface DelegationPolicy {
+    /**
+     * Map a target to an audience. Returning `undefined` skips delegation
+     * — the dispatch uses the base credential directly. Sync, cheap, pure
+     * (runs on every wire dispatch).
+     *
+     * `ctx` carries hop history and correlation id — the first three args
+     * are duplicated into `ctx` so a 3-arg policy still type-checks (the
+     * fourth arg is additive, not a breaking rename).
+     */
+    audienceFor(target: string, method: string, params: unknown, ctx: DelegationContext): string | undefined;
+    /**
+     * Derive the `UnresolvedIdentityExpr` this mint should carry. Return
+     * `undefined` to use ClientSession's default `{ kind: 'identity', self: true }`.
+     * Invoked only when `audienceFor` returned a non-undefined audience.
+     *
+     * The full expression tree the kernel accepts — `union`, `intersect`,
+     * `exclude`, `scope`-wrapped sub-expressions, `Cred(...)` leaves. For
+     * the common "narrow self-delegation by scope" case use `scopedSelf`.
+     *
+     * Sync — delegation shape is a rule, not an I/O lookup. Consumers who
+     * need async derivation compute outside and pass
+     * `ClientSessionCallOptions.delegation`; `decide` can also refine the shape
+     * asynchronously (§9.3.1).
+     */
+    delegationFor?(target: string, method: string, params: unknown, ctx: DelegationContext): UnresolvedIdentityExpr | undefined;
+    /**
+     * Derive the `SelfIdentityExpr` attestation for the mint's outer
+     * envelope. Return `undefined` to omit the attestation param (kernel
+     * adapter defaults it to `{ kind: 'identity', self: true }`). Invoked
+     * only when `audienceFor` returned a non-undefined audience.
+     *
+     * Attestation asserts something about the delegator; it is signed into
+     * the outer envelope as metadata and is NOT enforced at authentication.
+     * Most consumers leave this absent.
+     */
+    attestationFor?(target: string, method: string, params: unknown, ctx: DelegationContext): SelfIdentityExpr | undefined;
+    /**
+     * Consent hook. Called AFTER `audienceFor` / `delegationFor` /
+     * `attestationFor` resolved and BEFORE `DelegationCache.get` issues the
+     * mint. Default when absent: implicit allow.
+     *
+     * `signal` propagates from the caller's `ClientSessionCallOptions.signal` —
+     * implementations that await UI input MUST race against it.
+     *
+     * May refine the mint shape (§9.3.1): returning
+     * `{ allow: true, delegation?, attestation? }` substitutes the
+     * provided field(s) before cache lookup. Plain `{ allow: true }` uses
+     * the pre-computed shape unchanged.
+     */
+    decide?(audience: string, delegation: UnresolvedIdentityExpr, attestation: SelfIdentityExpr | undefined, ctx: DelegationContext, signal: AbortSignal | undefined): DelegationDecision | Promise<DelegationDecision>;
+}
+/**
+ * Default policy: mint for any target whose origin differs from the
+ * default kernel's origin, allow implicitly.
+ *
+ * `default` is the `ClientSessionConfig.default` URL; same-origin targets skip
+ * delegation (the base credential is valid). Used when `ClientSessionConfig`
+ * omits `delegationPolicy`.
+ */
+export declare function allowAllDelegations(opts: {
+    default: string;
+}): DelegationPolicy;
+/**
+ * Allowlist: only mint for audiences `allow` returns true for. Matches
+ * `RedirectPolicy`'s `allowlistPolicy` shape for symmetry.
+ *
+ * `delegation`, when supplied, is the expression applied to every mint
+ * this policy produces; per-call overrides via `ClientSessionCallOptions.delegation`
+ * still win. Same for `attestation`.
+ */
+export declare function allowlistDelegations(opts: {
+    default: string;
+    allow: (audience: string) => boolean;
+    delegation?: UnresolvedIdentityExpr;
+    attestation?: SelfIdentityExpr;
+}): DelegationPolicy;
+/**
+ * UI prompt: ask the consumer for each new audience. Races `onPrompt`
+ * against the caller's `signal` so aborting the top-level call cancels
+ * the prompt.
+ *
+ * `allow` is a fast-path predicate (pre-approved audiences). Returning
+ * `false` from `allow` falls through to `onPrompt`.
+ *
+ * `onPrompt` receives the full mint shape (audience + delegation +
+ * attestation + ctx) so the UI can render what's actually being minted,
+ * not just the audience. This matters when the policy narrows by method:
+ * the user should see "write to partner kernel as self with READ | WRITE
+ * on nodes [X, Y]," not just "trust partner kernel."
+ */
+export declare function promptDelegations(opts: {
+    default: string;
+    onPrompt: (audience: string, delegation: UnresolvedIdentityExpr, attestation: SelfIdentityExpr | undefined, ctx: DelegationContext) => Promise<boolean>;
+    allow?: (audience: string) => boolean;
+    delegation?: UnresolvedIdentityExpr;
+    attestation?: SelfIdentityExpr;
+}): DelegationPolicy;
+/**
+ * Build `{ kind: 'scope', scopes, expr: { kind: 'identity', self: true } }`
+ * — a self-delegation narrowed to the given scope set. This is the shape
+ * that was the *entire* delegation surface in an earlier draft of the
+ * spec, now expressible as one case of the full `UnresolvedIdentityExpr`
+ * algebra.
+ *
+ * Use for the common "vary perms by method" pattern. Reach for the raw
+ * `UnresolvedIdentityExpr` constructors when composing identities
+ * (union/intersect/exclude) or chaining credentials.
+ */
+export declare function scopedSelf(scopes: readonly Scope[]): UnresolvedIdentityExpr;
+//# sourceMappingURL=policy.d.ts.map

package/dist/delegation/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/delegation/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,oCAAoC,CAAA;AAI3C;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAA;IACd,oCAAoC;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,+BAA+B;IAC/B,MAAM,EAAE,OAAO,CAAA;IACf,sDAAsD;IACtD,aAAa,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,IAAI,EAAE,aAAa,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACjD,CAAA;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,UAAU,CAAC,EAAE,sBAAsB,CAAC;IAAC,WAAW,CAAC,EAAE,gBAAgB,CAAA;CAAE,GACpF;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpC;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;OAQG;IACH,WAAW,CACT,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,OAAO,EACf,GAAG,EAAE,iBAAiB,GACrB,MAAM,GAAG,SAAS,CAAA;IAErB;;;;;;;;;;;;;OAaG;IACH,aAAa,CAAC,CACZ,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,OAAO,EACf,GAAG,EAAE,iBAAiB,GACrB,sBAAsB,GAAG,SAAS,CAAA;IAErC;;;;;;;;;OASG;IACH,cAAc,CAAC,CACb,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,OAAO,EACf,GAAG,EAAE,iBAAiB,GACrB,gBAAgB,GAAG,SAAS,CAAA;IAE/B;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,CACL,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,sBAAsB,EAClC,WAAW,EAAE,gBAAgB,GAAG,SAAS,EACzC,GAAG,EAAE,iBAAiB,EACtB,MAAM,EAAE,WAAW,GAAG,SAAS,GAC9B,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;CACpD;AAID;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAE/E;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAA;IACpC,UAAU,CAAC,EAAE,sBAAsB,CAAA;IACnC,WAAW,CAAC,EAAE,gBAAgB,CAAA;CAC/B,GAAG,gBAAgB,CAUnB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,CACR,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,sBAAsB,EAClC,WAAW,EAAE,gBAAgB,GAAG,SAAS,EACzC,GAAG,EAAE,iBAAiB,KACnB,OAAO,CAAC,OAAO,CAAC,CAAA;IACrB,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAA;IACrC,UAAU,CAAC,EAAE,sBAAsB,CAAA;IACnC,WAAW,CAAC,EAAE,gBAAgB,CAAA;CAC/B,GAAG,gBAAgB,CAmBnB;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,GAAG,sBAAsB,CAM3E"}