@atlasauth/pca-gnap 0.0.0-stage → 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,454 @@
+/**
+ * @atlasauth/pca-gnap — a GNAP (RFC 9635) bridge for Proof-Carrying Authority, defining the
+ * ================= AGENT-GNAP PROFILE =================
+ *
+ * GNAP (Grant Negotiation and Authorization Protocol, RFC 9635) negotiates an access grant between a
+ * client instance and an authorization server (AS) using a rich, structured `access` rights model,
+ * key-bound requests, and a stateful *continuation* handle. No agent-delegation profile of GNAP exists
+ * publicly yet. This package DEFINES one, because GNAP's primitives map almost 1:1 onto PCA's:
+ *
+ *   GNAP concept                          PCA concept
+ *   ------------------------------------  ---------------------------------------------------------
+ *   `access` rights array (§8)            Policy-envelope `Predicate[]` (verb/resource/where)
+ *     - type                               → resource namespace  `gnap:<type>:<location>`
+ *     - actions                            → predicate `verb` (list, or `*`)
+ *     - locations                          → predicate `resource` (exact / prefix)
+ *     - datatypes / identifier             → predicate `where` conditions on `action.params.*`
+ *   client instance key (§7.1)            Capability `holder` (the bound key, `cnf`)
+ *   grant request (§2)                    `mintGrant` (root) / `delegate` (a delegated hop)
+ *   grant response access_token (§3.2)    A verifiable PCA capability chain (bound, attenuated)
+ *   `continue` handle (§3.1, §5)          A PCA step-up: a FROST/CIBA co-signature folded into a PCActn
+ *   `interact` (§3.3, §4)                 The tier-2/3 human/guardian step-up prompt
+ *   key-bound proof `jwsd` (§7.3.4)       Detached-JWS proof that the request was signed by `holder`
+ *
+ * THE AGENT-GNAP PROFILE (multi-hop delegation). An agent-to-agent (A2A) task is a chain of grants:
+ * each hop is a GNAP grant request from one agent to the next, and the AS issues a PCA capability that
+ * is ATTENUATED — never wider than the issuing agent's own authority. Attenuation is structural: PCA
+ * capability caveats are append-only and conjunctive (see `@atlasauth/pca` capability.ts), so a child
+ * can only ever NARROW. Each hop records its granted `access` as a signed `gnap_access` caveat, and the
+ * EFFECTIVE authority of the chain is the INTERSECTION of the root policy envelope and every hop's
+ * recorded rights. A hop that requests more than its issuer held is clamped at issue time
+ * (`clampToIssuer`) AND denied at action time (the issuer's narrower rights still gate every action),
+ * so "never wider than the issuer" holds by construction across any number of hops.
+ *
+ * All verification FAILS CLOSED: a malformed token, a broken chain, a bad jwsd proof, a stale request,
+ * or an action outside the granted rights denies. The machine-readable profile spec is exported as
+ * {@link AGENT_GNAP_PROFILE}.
+ */
+import { type AgentBinding, type Capability, type CapabilityChain, type Caveat, type PCActn, type PCActnBody, type PlanNode, type Predicate, type RiskPolicy, type Signer, type SignerRole, type ThresholdShare, type ThresholdSignature, type ThresholdVerdict } from '@atlasauth/pca';
+/** A JWK (RFC 7517). This profile binds grants to an OKP/Ed25519 client key. */
+export interface GnapJwk {
+    kty: string;
+    crv?: string;
+    x?: string;
+    kid?: string;
+    alg?: string;
+    use?: string;
+}
+/** A client's key-proof binding (§7.1). This profile implements the `jwsd` detached-JWS method. */
+export interface GnapKeyProof {
+    /** The proof method. This profile verifies `jwsd`. */
+    proof: 'jwsd' | 'httpsig' | 'mtls' | 'jwsd-vc' | string;
+    /** The client instance's public key, as a JWK. */
+    jwk?: GnapJwk;
+}
+/** A GNAP client instance (§2.3). */
+export interface GnapClient {
+    key: GnapKeyProof | string;
+    class_id?: string;
+    display?: {
+        name?: string;
+        uri?: string;
+    };
+}
+/** A single resource-access right (§8). A string is a reference to a named/pre-registered access. */
+export type GnapAccessItem = GnapResourceAccess | string;
+/** The object form of a resource-access right (§8.1). */
+export interface GnapResourceAccess {
+    type: string;
+    actions?: string[];
+    locations?: string[];
+    datatypes?: string[];
+    identifier?: string;
+    privileges?: string[];
+}
+/** A single-access-token request (§2.1). Multi-token requests are out of this profile's scope. */
+export interface GnapTokenRequest {
+    access: GnapAccessItem[];
+    label?: string;
+    flags?: string[];
+}
+/** A GNAP interaction request (§2.5). */
+export interface GnapInteractRequest {
+    start: string[];
+    finish?: {
+        method: string;
+        uri: string;
+        nonce: string;
+    };
+}
+/** A GNAP subject request (§2.4). */
+export interface GnapSubjectRequest {
+    sub_id_formats?: string[];
+    assertion_formats?: string[];
+}
+/** A GNAP grant request (§2). */
+export interface GnapGrantRequest {
+    access_token: GnapTokenRequest;
+    client: GnapClient | string;
+    subject?: GnapSubjectRequest;
+    interact?: GnapInteractRequest;
+}
+/** An issued GNAP access token (§3.2). In this profile `value` carries a PCA capability chain. */
+export interface GnapAccessToken {
+    value: string;
+    label?: string;
+    access: GnapResourceAccess[];
+    expires_in?: number;
+    /** The bound key: the holder JWK, or `false` for a bearer token. */
+    key?: GnapJwk | false;
+    manage?: {
+        uri: string;
+    };
+}
+/** A GNAP continuation handle (§3.1). The client returns here to complete a step-up. */
+export interface GnapContinue {
+    uri: string;
+    wait?: number;
+    access_token: {
+        value: string;
+        bound?: boolean;
+    };
+}
+/** A GNAP grant response (§3). */
+export interface GnapGrantResponse {
+    access_token?: GnapAccessToken;
+    continue?: GnapContinue;
+    instance_id?: string;
+}
+/** Thrown by the issuance paths on a malformed request (the verify paths fail closed instead). */
+export declare class GnapError extends Error {
+    constructor(message: string);
+}
+/** The PCA `resource` string for a GNAP (type, location) pair — the namespace actions are matched in. */
+export declare function gnapActionResource(type: string, location: string): string;
+/** Normalize an access array for issuance (throws on any malformed entry). */
+export declare function normalizeAccess(items: readonly unknown[]): GnapResourceAccess[];
+/**
+ * Map a GNAP access right onto PCA predicates (one per location). `type` namespaces the resource,
+ * `actions` become verbs, `locations` become resources, and `datatypes`/`identifier` become `where`
+ * conditions on the action's params. An absent `actions`/`locations` means "any" (verb `*` / a
+ * prefix-matching `*` resource).
+ */
+export declare function accessToPredicates(access: GnapResourceAccess): Predicate[];
+/** Does the issuer's granted right `g` fully contain the requested right `r`? */
+export declare function accessContains(g: GnapResourceAccess, r: GnapResourceAccess): boolean;
+/** Is `r` within the issuer's granted set `G` (covered by at least one of its rights)? */
+export declare function accessWithin(G: GnapResourceAccess[], r: GnapResourceAccess): boolean;
+/** Split a requested access array into the subset within the issuer's authority and the rest. */
+export declare function clampAccess(issuerGranted: GnapResourceAccess[], requested: GnapResourceAccess[]): {
+    granted: GnapResourceAccess[];
+    dropped: GnapResourceAccess[];
+};
+/** The caveat recorded inside a ROOT GNAP grant's policy envelope (grant provenance). */
+export declare const GNAP_GRANT_CAVEAT = "gnap_grant";
+/** The caveat appended on each DELEGATED GNAP hop (the rights that hop was granted). */
+export declare const GNAP_ACCESS_CAVEAT = "gnap_access";
+export interface GnapGrantCaveat extends Caveat {
+    type: typeof GNAP_GRANT_CAVEAT;
+    /** The client key this grant was issued to (the bound holder, b64u). */
+    client_id: string;
+    granted_access: GnapResourceAccess[];
+    /** `hashCanonical` of the normalized request (tamper-evident provenance). */
+    request_digest: string;
+    /** Whether the grant followed a GNAP interaction. */
+    interacted: boolean;
+    ts: number;
+}
+export interface GnapAccessCaveat extends Caveat {
+    type: typeof GNAP_ACCESS_CAVEAT;
+    access: GnapResourceAccess[];
+    predicates: Predicate[];
+    request_digest: string;
+    client_id: string;
+    ts: number;
+}
+/**
+ * The EFFECTIVE granted access of a chain: the most-recent delegated hop's recorded rights, or (for a
+ * root-only grant) the root's recorded rights. Because every hop is clamped to its issuer at issue
+ * time, the leaf's recorded rights are the narrowest in the chain.
+ */
+export declare function grantedAccessOf(chain: CapabilityChain): GnapResourceAccess[];
+/** Resolve the b64u Ed25519 holder key from a request's client key (or an explicit override). */
+export declare function resolveHolder(req: GnapGrantRequest, holderOverride?: string): string;
+/** The holder key, rendered as a GNAP JWK (for a bound access-token response). */
+export declare function holderJwk(holder: string): GnapJwk;
+export interface GrantToCapabilityOptions {
+    /** The key that signs this hop: the principal secret for a root grant, or the parent holder's secret. */
+    issuerSecret: Uint8Array;
+    /** The issuer's b64u public key (principal public for root; = `parent.holder` for a delegation). */
+    issuerPublic: string;
+    /** Present → DELEGATE from this capability; absent → MINT a new root grant. */
+    parent?: Capability;
+    /** The full issuer chain, used to compute the issuer's effective authority for clamping. */
+    issuerChain?: CapabilityChain;
+    /** Drop requested rights that exceed the issuer's authority (default true). */
+    clampToIssuer?: boolean;
+    /** Explicit holder override (else derived from the request's client key). */
+    holder?: string;
+    /** Whether this grant followed a GNAP interaction (recorded in provenance). */
+    interacted?: boolean;
+    now?: number;
+    goal?: string;
+    riskPolicy?: RiskPolicy;
+    agentBinding?: AgentBinding;
+    salt?: string;
+}
+export interface GrantToCapabilityResult {
+    /** The newly issued hop (a root grant, or a delegated child). */
+    grant: Capability;
+    /** The full capability chain (issuer chain + the new hop). */
+    chain: CapabilityChain;
+    /** The bound holder key (b64u). */
+    holder: string;
+    /** The rights actually granted (after clamping). */
+    grantedAccess: GnapResourceAccess[];
+    /** Requested rights that exceeded the issuer's authority and were dropped. */
+    droppedAccess: GnapResourceAccess[];
+    /** The GNAP provenance caveat written into the capability. */
+    provenance: GnapGrantCaveat | GnapAccessCaveat;
+}
+/**
+ * Convert a GNAP grant request into a PCA capability bound to the client key, ATTENUATED to never
+ * exceed the issuer. With no `parent` this MINTS a root grant whose policy-envelope predicates ARE the
+ * requested access rights. With a `parent` it DELEGATES a narrower hop, recording the (clamped) rights
+ * as an append-only `gnap_access` caveat — so the effective authority is the intersection of the whole
+ * chain, and no hop can widen.
+ */
+export declare function grantRequestToCapability(req: GnapGrantRequest, opts: GrantToCapabilityOptions): GrantToCapabilityResult;
+export interface GnapAction {
+    verb: string;
+    resource: string;
+    params?: Record<string, unknown>;
+    reversibility_class?: string;
+}
+export interface GnapAuthorizeResult {
+    allowed: boolean;
+    reason?: string;
+}
+/**
+ * Decide whether `action` is authorized by a GNAP-issued capability chain. FAILS CLOSED. The chain must
+ * verify structurally, the root policy envelope must permit the action, AND every delegated hop's
+ * recorded `gnap_access` rights must permit it too (the per-hop intersection that enforces "never wider
+ * than the issuer" across the whole chain).
+ */
+export declare function authorizeGnapAction(chain: CapabilityChain, action: GnapAction, opts?: {
+    expectedRootIssuer?: string;
+}): GnapAuthorizeResult;
+/** Encode a capability chain as a GNAP access-token `value` (self-contained, re-verified on use). */
+export declare function encodeBoundToken(chain: CapabilityChain): string;
+export interface CapabilityToResponseOptions {
+    expiresIn?: number;
+    /** Emit the token as bearer (`key:false`) instead of key-bound to the holder. */
+    bearer?: boolean;
+    instanceId?: string;
+    manageUri?: string;
+    /** Attach a continuation handle to the response. */
+    continue?: GnapContinue;
+}
+/** Render a (verified) PCA capability chain as a GNAP grant response with a bound access token. */
+export declare function capabilityToGrantResponse(chain: CapabilityChain, opts?: CapabilityToResponseOptions): GnapGrantResponse;
+export type GnapTokenVerifyResult = {
+    ok: true;
+    principal: string;
+    capability: Capability;
+    chain: CapabilityChain;
+    access: GnapResourceAccess[];
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Verify an incoming GNAP bound token, mapping it back to a PCA principal + capability. FAILS CLOSED:
+ * a token that is not a decodable chain, or whose chain does not verify (optionally against
+ * `expectedRootIssuer`), returns `{ ok:false }`. The `principal` is the chain's root issuer key.
+ */
+export declare function verifyGnapToken(value: string, opts?: {
+    expectedRootIssuer?: string;
+}): GnapTokenVerifyResult;
+/** The protected header of a GNAP `jwsd` detached JWS (§7.3.4). `created` is epoch SECONDS. */
+export interface GnapJwsdHeader {
+    alg: 'EdDSA';
+    typ: 'gnap-binding-jwsd';
+    kid?: string;
+    htm: string;
+    uri: string;
+    created: number;
+    /** base64url(SHA-256(access-token value)) — binds the proof to a token when one is in play. */
+    ath?: string;
+}
+/** A raw Ed25519 key pair (the PCA key format: 32-byte seed secret, 32-byte public). */
+export interface RawEd25519KeyPair {
+    secretKey: Uint8Array;
+    publicKey: Uint8Array;
+}
+export interface SignGnapRequestArgs {
+    /** The request body the proof covers (typically the GNAP grant request). */
+    body: unknown;
+    key: RawEd25519KeyPair;
+    htm: string;
+    uri: string;
+    /** Epoch SECONDS (default: now). */
+    created?: number;
+    kid?: string;
+    /** When an access token is in play, bind the proof to it via the `ath` claim. */
+    accessTokenValue?: string;
+}
+export interface SignGnapRequestResult {
+    /** The compact detached JWS: `BASE64URL(header)..BASE64URL(signature)`. */
+    detachedJws: string;
+    header: GnapJwsdHeader;
+    /** The b64u holder key this proof binds the request to. */
+    holder: string;
+}
+/**
+ * Produce a GNAP `jwsd` detached-JWS proof over `body`, signed by the client key (via `jose`). The JWS
+ * payload is the canonical body; the compact detached form (payload omitted) is what travels in the
+ * `Detached-JWS` header. The signing key's public half IS the PCA holder the grant binds to.
+ */
+export declare function signGnapRequest(args: SignGnapRequestArgs): Promise<SignGnapRequestResult>;
+export interface VerifyGnapRequestArgs {
+    detachedJws: string;
+    body: unknown;
+    /** The b64u Ed25519 holder key the proof must verify under. */
+    holder: string;
+    htm: string;
+    uri: string;
+    /** Max accepted age of `created` in seconds (default 300). */
+    maxAgeSec?: number;
+    /** Epoch ms clock (default now). */
+    now?: number;
+    /** When set, the proof's `ath` must bind exactly this access-token value. */
+    accessTokenValue?: string;
+}
+export type VerifyGnapRequestResult = {
+    ok: true;
+    holder: string;
+    header: GnapJwsdHeader;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Verify a GNAP `jwsd` detached-JWS proof (via `jose`) and bind the request to the holder key. FAILS
+ * CLOSED on any deviation: a bad signature, a tampered body, a wrong holder, a mismatched `htm`/`uri`,
+ * a stale/future `created`, or an `ath` that does not bind the named access token.
+ */
+export declare function verifyGnapRequest(args: VerifyGnapRequestArgs): Promise<VerifyGnapRequestResult>;
+/** A GNAP continuation mapped onto a PCA step-up (the tier-2/3 co-signature required to proceed). */
+export interface GnapStepUpDescriptor {
+    /** The PCA step-up tier: 2 = + guardian co-sign, 3 = + principal co-sign. */
+    tier: 2 | 3;
+    /** The threshold `t` the folded PCActn must reach. */
+    t: 1 | 2 | 3;
+    /** The signer set the co-signatures are verified against. */
+    signerSet: Signer[];
+    reason: string;
+    /** The continuation access-token value the client returns with. */
+    continueToken: string;
+}
+export interface GnapContinuationResult {
+    /** A GNAP grant response carrying ONLY a `continue` handle (no token yet). */
+    response: GnapGrantResponse;
+    stepUp: GnapStepUpDescriptor;
+}
+export interface StepUpAssessment {
+    required: boolean;
+    reason: string;
+    /** Requested rights that exceed the issuer's authority (each needs escalated authority). */
+    beyond: GnapResourceAccess[];
+    tier: 2 | 3;
+}
+/**
+ * Decide whether a grant request needs a continuation/step-up: it does when GNAP interaction is
+ * requested, when an explicit higher tier is asked for, or when (given the issuer's chain) the request
+ * asks for rights BEYOND the issuer's own authority — which can only be unlocked by a human/guardian
+ * co-signature, not minted by the agent alone.
+ */
+export declare function gnapRequestRequiresStepUp(req: GnapGrantRequest, opts?: {
+    issuerChain?: CapabilityChain;
+    tier?: 2 | 3;
+}): StepUpAssessment;
+export interface BeginContinuationArgs {
+    signerSet: Signer[];
+    t: 1 | 2 | 3;
+    tier: 2 | 3;
+    continueUri: string;
+    continueToken: string;
+    wait?: number;
+    reason?: string;
+}
+/** Begin a GNAP continuation: emit the `continue` handle + the PCA step-up it resolves through. */
+export declare function beginGnapContinuation(args: BeginContinuationArgs): GnapContinuationResult;
+/**
+ * Produce one role's step-up co-signature share over the action's PCActn — the co-signature a
+ * guardian/principal device returns through the GNAP continuation. For 'guardian'/'principal' it binds
+ * the signer set + `t` (replay-safe); the 'agent' share is the PCActn's own leaf signature.
+ */
+export declare function gnapStepUpShare(body: PCActnBody, role: SignerRole, secret: Uint8Array, signerSet: Signer[], t: 1 | 2 | 3): ThresholdShare;
+export interface CompleteContinuationArgs {
+    grant: Capability;
+    chain: CapabilityChain;
+    plan: PlanNode[];
+    nodeId: string;
+    params?: Record<string, unknown>;
+    counter: number;
+    aud: string;
+    now?: number;
+    ttlMs?: number;
+    /** The agent-leaf holder secret (produces the PCActn leaf signature = the 'agent' share). */
+    agentLeafSecret: Uint8Array;
+    signerSet: Signer[];
+    t: 1 | 2 | 3;
+    /** The guardian/principal secrets reached via the continuation, each folded in as a threshold share. */
+    cosignSecrets: {
+        role: SignerRole;
+        secret: Uint8Array;
+    }[];
+}
+export interface CompleteContinuationResult {
+    pcactn: PCActn;
+    threshold: ThresholdSignature;
+    verdict: ThresholdVerdict;
+}
+/**
+ * Resolve a continuation: build the action's PCActn (agent leaf signature) and FOLD the step-up
+ * co-signatures into its `threshold`, then verify the threshold `t` is reached. This is the concrete
+ * realization of "a grant that needs more authority continues via a step-up co-signature folded into
+ * the PCActn" — the multi-signature carrier; a FROST aggregate share slots in the same `agent`/group
+ * position without changing the property.
+ */
+export declare function completeGnapContinuation(args: CompleteContinuationArgs): CompleteContinuationResult;
+export interface AgentGnapMapping {
+    gnap: string;
+    pca: string;
+    note: string;
+}
+export interface AgentGnapProfile {
+    name: string;
+    version: string;
+    rfc: string;
+    summary: string;
+    /** How each GNAP primitive maps onto a PCA concept. */
+    mapping: AgentGnapMapping[];
+    /** Supported key-proof methods (§7.3). */
+    proofMethods: string[];
+    /** The multi-hop agent-delegation model. */
+    multiHop: string;
+    /** How a continuation resolves. */
+    stepUp: string;
+    /** The security properties this profile guarantees. */
+    security: string[];
+}
+/** The machine-readable Agent-GNAP profile spec (see the module header for the full narrative). */
+export declare const AGENT_GNAP_PROFILE: AgentGnapProfile;

package/dist/index.js

@@ -0,0 +1,697 @@
+"use strict";
+/**
+ * @atlasauth/pca-gnap — a GNAP (RFC 9635) bridge for Proof-Carrying Authority, defining the
+ * ================= AGENT-GNAP PROFILE =================
+ *
+ * GNAP (Grant Negotiation and Authorization Protocol, RFC 9635) negotiates an access grant between a
+ * client instance and an authorization server (AS) using a rich, structured `access` rights model,
+ * key-bound requests, and a stateful *continuation* handle. No agent-delegation profile of GNAP exists
+ * publicly yet. This package DEFINES one, because GNAP's primitives map almost 1:1 onto PCA's:
+ *
+ *   GNAP concept                          PCA concept
+ *   ------------------------------------  ---------------------------------------------------------
+ *   `access` rights array (§8)            Policy-envelope `Predicate[]` (verb/resource/where)
+ *     - type                               → resource namespace  `gnap:<type>:<location>`
+ *     - actions                            → predicate `verb` (list, or `*`)
+ *     - locations                          → predicate `resource` (exact / prefix)
+ *     - datatypes / identifier             → predicate `where` conditions on `action.params.*`
+ *   client instance key (§7.1)            Capability `holder` (the bound key, `cnf`)
+ *   grant request (§2)                    `mintGrant` (root) / `delegate` (a delegated hop)
+ *   grant response access_token (§3.2)    A verifiable PCA capability chain (bound, attenuated)
+ *   `continue` handle (§3.1, §5)          A PCA step-up: a FROST/CIBA co-signature folded into a PCActn
+ *   `interact` (§3.3, §4)                 The tier-2/3 human/guardian step-up prompt
+ *   key-bound proof `jwsd` (§7.3.4)       Detached-JWS proof that the request was signed by `holder`
+ *
+ * THE AGENT-GNAP PROFILE (multi-hop delegation). An agent-to-agent (A2A) task is a chain of grants:
+ * each hop is a GNAP grant request from one agent to the next, and the AS issues a PCA capability that
+ * is ATTENUATED — never wider than the issuing agent's own authority. Attenuation is structural: PCA
+ * capability caveats are append-only and conjunctive (see `@atlasauth/pca` capability.ts), so a child
+ * can only ever NARROW. Each hop records its granted `access` as a signed `gnap_access` caveat, and the
+ * EFFECTIVE authority of the chain is the INTERSECTION of the root policy envelope and every hop's
+ * recorded rights. A hop that requests more than its issuer held is clamped at issue time
+ * (`clampToIssuer`) AND denied at action time (the issuer's narrower rights still gate every action),
+ * so "never wider than the issuer" holds by construction across any number of hops.
+ *
+ * All verification FAILS CLOSED: a malformed token, a broken chain, a bad jwsd proof, a stale request,
+ * or an action outside the granted rights denies. The machine-readable profile spec is exported as
+ * {@link AGENT_GNAP_PROFILE}.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENT_GNAP_PROFILE = exports.GNAP_ACCESS_CAVEAT = exports.GNAP_GRANT_CAVEAT = exports.GnapError = void 0;
+exports.gnapActionResource = gnapActionResource;
+exports.normalizeAccess = normalizeAccess;
+exports.accessToPredicates = accessToPredicates;
+exports.accessContains = accessContains;
+exports.accessWithin = accessWithin;
+exports.clampAccess = clampAccess;
+exports.grantedAccessOf = grantedAccessOf;
+exports.resolveHolder = resolveHolder;
+exports.holderJwk = holderJwk;
+exports.grantRequestToCapability = grantRequestToCapability;
+exports.authorizeGnapAction = authorizeGnapAction;
+exports.encodeBoundToken = encodeBoundToken;
+exports.capabilityToGrantResponse = capabilityToGrantResponse;
+exports.verifyGnapToken = verifyGnapToken;
+exports.signGnapRequest = signGnapRequest;
+exports.verifyGnapRequest = verifyGnapRequest;
+exports.gnapRequestRequiresStepUp = gnapRequestRequiresStepUp;
+exports.beginGnapContinuation = beginGnapContinuation;
+exports.gnapStepUpShare = gnapStepUpShare;
+exports.completeGnapContinuation = completeGnapContinuation;
+const jose_1 = require("jose");
+const pca_1 = require("@atlasauth/pca");
+// ============================================================================================
+// Errors + small guards
+// ============================================================================================
+/** Thrown by the issuance paths on a malformed request (the verify paths fail closed instead). */
+class GnapError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'GnapError';
+    }
+}
+exports.GnapError = GnapError;
+const isRecord = (x) => x !== null && typeof x === 'object' && !Array.isArray(x);
+const strArr = (u) => Array.isArray(u) ? u.filter((s) => typeof s === 'string') : undefined;
+/** A canonical, unpadded base64url Ed25519 public key (exactly 32 bytes), or null. */
+function asEd25519(x) {
+    return typeof x === 'string' && (0, pca_1.decodeB64uStrict)(x, 32) !== null ? x : null;
+}
+const GNAP_RESOURCE_PREFIX = 'gnap';
+/** The PCA `resource` string for a GNAP (type, location) pair — the namespace actions are matched in. */
+function gnapActionResource(type, location) {
+    return `${GNAP_RESOURCE_PREFIX}:${type}:${location}`;
+}
+// ============================================================================================
+// Access-rights normalization + mapping onto PCA predicates
+// ============================================================================================
+/** Total, fail-closed normalization of one access item. Returns null for anything malformed. */
+function tryNormalizeAccessItem(item) {
+    if (typeof item === 'string')
+        return item.length > 0 ? { type: item } : null;
+    if (!isRecord(item))
+        return null;
+    const type = item.type;
+    if (typeof type !== 'string' || type.length === 0)
+        return null;
+    const out = { type };
+    const actions = strArr(item.actions);
+    if (actions && actions.length > 0)
+        out.actions = actions;
+    const locations = strArr(item.locations);
+    if (locations && locations.length > 0)
+        out.locations = locations;
+    const datatypes = strArr(item.datatypes);
+    if (datatypes && datatypes.length > 0)
+        out.datatypes = datatypes;
+    if (typeof item.identifier === 'string')
+        out.identifier = item.identifier;
+    const privileges = strArr(item.privileges);
+    if (privileges && privileges.length > 0)
+        out.privileges = privileges;
+    return out;
+}
+/** Normalize one access item, THROWING on malformed input (issuance path). */
+function normalizeAccessItem(item) {
+    const n = tryNormalizeAccessItem(item);
+    if (n === null)
+        throw new GnapError('malformed access item (needs a non-empty string `type`)');
+    return n;
+}
+/** Normalize an access array for issuance (throws on any malformed entry). */
+function normalizeAccess(items) {
+    if (!Array.isArray(items))
+        throw new GnapError('access must be an array');
+    return items.map(normalizeAccessItem);
+}
+/** Total, fail-closed read of a stored access array (reading signed caveats). Skips malformed entries. */
+function readAccessArray(u) {
+    if (!Array.isArray(u))
+        return [];
+    const out = [];
+    for (const item of u) {
+        const n = tryNormalizeAccessItem(item);
+        if (n !== null)
+            out.push(n);
+    }
+    return out;
+}
+/**
+ * Map a GNAP access right onto PCA predicates (one per location). `type` namespaces the resource,
+ * `actions` become verbs, `locations` become resources, and `datatypes`/`identifier` become `where`
+ * conditions on the action's params. An absent `actions`/`locations` means "any" (verb `*` / a
+ * prefix-matching `*` resource).
+ */
+function accessToPredicates(access) {
+    const verb = access.actions && access.actions.length > 0 ? [...access.actions] : '*';
+    const locations = access.locations && access.locations.length > 0 ? access.locations : ['*'];
+    const where = [];
+    if (access.datatypes && access.datatypes.length > 0) {
+        where.push({ field: 'action.params.datatype', op: 'in', value: [...access.datatypes] });
+    }
+    if (typeof access.identifier === 'string') {
+        where.push({ field: 'action.params.identifier', op: 'eq', value: access.identifier });
+    }
+    return locations.map((loc) => {
+        const p = { verb, resource: gnapActionResource(access.type, loc) };
+        if (where.length > 0)
+            p.where = where.map((c) => ({ ...c }));
+        return p;
+    });
+}
+/** All predicates for an access array. */
+function accessArrayToPredicates(access) {
+    return access.flatMap(accessToPredicates);
+}
+// ============================================================================================
+// Access-level containment (the AS's "is this request within my authority?" check)
+// ============================================================================================
+function coversStrings(sup, sub) {
+    if (sup === undefined)
+        return true; // issuer allows all
+    if (sub === undefined)
+        return false; // request wants all, issuer has a concrete set
+    return sub.every((s) => sup.includes(s));
+}
+function coversLocations(sup, sub) {
+    if (sup === undefined)
+        return true;
+    if (sub === undefined)
+        return sup.includes('*');
+    return sub.every((s) => sup.some((g) => g === s || g === '*' || (g.endsWith('*') && s.startsWith(g.slice(0, -1)))));
+}
+/** Does the issuer's granted right `g` fully contain the requested right `r`? */
+function accessContains(g, r) {
+    if (g.type !== r.type)
+        return false;
+    if (!coversStrings(g.actions, r.actions))
+        return false;
+    if (!coversLocations(g.locations, r.locations))
+        return false;
+    if (!coversStrings(g.datatypes, r.datatypes))
+        return false;
+    if (r.identifier !== undefined && g.identifier !== undefined && g.identifier !== r.identifier)
+        return false;
+    return true;
+}
+/** Is `r` within the issuer's granted set `G` (covered by at least one of its rights)? */
+function accessWithin(G, r) {
+    return G.some((g) => accessContains(g, r));
+}
+/** Split a requested access array into the subset within the issuer's authority and the rest. */
+function clampAccess(issuerGranted, requested) {
+    const granted = [];
+    const dropped = [];
+    for (const r of requested)
+        (accessWithin(issuerGranted, r) ? granted : dropped).push(r);
+    return { granted, dropped };
+}
+// ============================================================================================
+// GNAP provenance caveats (recorded in the signed capability)
+// ============================================================================================
+/** The caveat recorded inside a ROOT GNAP grant's policy envelope (grant provenance). */
+exports.GNAP_GRANT_CAVEAT = 'gnap_grant';
+/** The caveat appended on each DELEGATED GNAP hop (the rights that hop was granted). */
+exports.GNAP_ACCESS_CAVEAT = 'gnap_access';
+/** Read the root grant's GNAP provenance caveat (inside the policy envelope), or null. */
+function readGnapGrant(root) {
+    const env = (0, pca_1.readEnvelope)(root);
+    const cv = env?.caveats.find((c) => c?.type === exports.GNAP_GRANT_CAVEAT);
+    if (!cv)
+        return null;
+    const clientId = cv.client_id;
+    const digest = cv.request_digest;
+    if (typeof clientId !== 'string' || typeof digest !== 'string')
+        return null;
+    return {
+        type: exports.GNAP_GRANT_CAVEAT,
+        client_id: clientId,
+        granted_access: readAccessArray(cv.granted_access),
+        request_digest: digest,
+        interacted: cv.interacted === true,
+        ts: typeof cv.ts === 'number' ? cv.ts : 0,
+    };
+}
+/**
+ * The EFFECTIVE granted access of a chain: the most-recent delegated hop's recorded rights, or (for a
+ * root-only grant) the root's recorded rights. Because every hop is clamped to its issuer at issue
+ * time, the leaf's recorded rights are the narrowest in the chain.
+ */
+function grantedAccessOf(chain) {
+    if (!Array.isArray(chain) || chain.length === 0)
+        return [];
+    const leaf = chain[chain.length - 1];
+    const caveats = Array.isArray(leaf.caveats) ? leaf.caveats : [];
+    for (let i = caveats.length - 1; i >= 0; i--) {
+        const cv = caveats[i];
+        if (cv?.type === exports.GNAP_ACCESS_CAVEAT)
+            return readAccessArray(cv.access);
+    }
+    const grant = readGnapGrant(chain[0]);
+    return grant ? grant.granted_access : [];
+}
+// ============================================================================================
+// Holder resolution (the GNAP client key becomes the PCA holder)
+// ============================================================================================
+/** Resolve the b64u Ed25519 holder key from a request's client key (or an explicit override). */
+function resolveHolder(req, holderOverride) {
+    if (holderOverride !== undefined) {
+        const h = asEd25519(holderOverride);
+        if (h === null)
+            throw new GnapError('holder override is not a canonical base64url Ed25519 public key');
+        return h;
+    }
+    const client = req.client;
+    const key = typeof client === 'object' && client !== null ? client.key : undefined;
+    if (key && typeof key === 'object' && key.jwk && key.jwk.kty === 'OKP' && key.jwk.crv === 'Ed25519') {
+        const x = asEd25519(key.jwk.x);
+        if (x !== null)
+            return x;
+    }
+    throw new GnapError('cannot resolve holder: supply client.key.jwk (OKP/Ed25519) or a holder override');
+}
+/** The holder key, rendered as a GNAP JWK (for a bound access-token response). */
+function holderJwk(holder) {
+    return { kty: 'OKP', crv: 'Ed25519', x: holder, use: 'sig', alg: 'EdDSA' };
+}
+function accessOf(req) {
+    const at = req.access_token;
+    if (isRecord(at) && Array.isArray(at.access))
+        return at.access;
+    throw new GnapError('grant request must carry access_token.access (single-token request)');
+}
+function requestDigestOf(holder, granted, interact) {
+    return (0, pca_1.hashCanonical)({
+        d: 'atlas-pca/gnap/request/v1',
+        client_id: holder,
+        access: granted,
+        interact: interact ?? null,
+    });
+}
+/**
+ * Convert a GNAP grant request into a PCA capability bound to the client key, ATTENUATED to never
+ * exceed the issuer. With no `parent` this MINTS a root grant whose policy-envelope predicates ARE the
+ * requested access rights. With a `parent` it DELEGATES a narrower hop, recording the (clamped) rights
+ * as an append-only `gnap_access` caveat — so the effective authority is the intersection of the whole
+ * chain, and no hop can widen.
+ */
+function grantRequestToCapability(req, opts) {
+    const holder = resolveHolder(req, opts.holder);
+    const requested = normalizeAccess(accessOf(req));
+    const now = Math.floor(opts.now ?? Date.now());
+    const interacted = opts.interacted === true;
+    let granted = requested;
+    let dropped = [];
+    if (opts.parent) {
+        const issuerChain = opts.issuerChain ?? [opts.parent];
+        if (opts.clampToIssuer !== false) {
+            const split = clampAccess(grantedAccessOf(issuerChain), requested);
+            granted = split.granted;
+            dropped = split.dropped;
+        }
+    }
+    const requestDigest = requestDigestOf(holder, granted, req.interact);
+    if (opts.parent) {
+        const issuerChain = opts.issuerChain ?? [opts.parent];
+        const provenance = {
+            type: exports.GNAP_ACCESS_CAVEAT,
+            access: granted,
+            predicates: accessArrayToPredicates(granted),
+            request_digest: requestDigest,
+            client_id: holder,
+            ts: now,
+        };
+        const child = (0, pca_1.delegate)(opts.parent, holder, [provenance], opts.issuerSecret);
+        return { grant: child, chain: [...issuerChain, child], holder, grantedAccess: granted, droppedAccess: dropped, provenance };
+    }
+    const provenance = {
+        type: exports.GNAP_GRANT_CAVEAT,
+        client_id: holder,
+        granted_access: granted,
+        request_digest: requestDigest,
+        interacted,
+        ts: now,
+    };
+    const { grant } = (0, pca_1.mintGrant)({
+        principalSecret: opts.issuerSecret,
+        principalPublic: opts.issuerPublic,
+        holder,
+        goal: opts.goal ?? `gnap:grant:${holder}`,
+        envelope: {
+            predicates: accessArrayToPredicates(granted),
+            caveats: [provenance],
+            agent_binding: opts.agentBinding ?? {},
+            risk_policy: opts.riskPolicy ?? pca_1.DEFAULT_RISK_POLICY,
+        },
+        ...(opts.salt !== undefined ? { salt: opts.salt } : {}),
+    });
+    return { grant, chain: [grant], holder, grantedAccess: granted, droppedAccess: dropped, provenance };
+}
+/**
+ * Decide whether `action` is authorized by a GNAP-issued capability chain. FAILS CLOSED. The chain must
+ * verify structurally, the root policy envelope must permit the action, AND every delegated hop's
+ * recorded `gnap_access` rights must permit it too (the per-hop intersection that enforces "never wider
+ * than the issuer" across the whole chain).
+ */
+function authorizeGnapAction(chain, action, opts = {}) {
+    if (!Array.isArray(chain) || chain.length === 0)
+        return { allowed: false, reason: 'empty chain' };
+    const vc = (0, pca_1.verifyChain)(chain, opts.expectedRootIssuer);
+    if (!vc.ok)
+        return { allowed: false, reason: `capability chain invalid: ${vc.reason ?? 'unknown'}` };
+    const env = (0, pca_1.readEnvelope)(chain[0]);
+    if (!env)
+        return { allowed: false, reason: 'root grant carries no policy envelope' };
+    const ctx = {
+        action: {
+            verb: action.verb,
+            resource: action.resource,
+            ...(action.params !== undefined ? { params: action.params } : {}),
+            ...(action.reversibility_class !== undefined ? { reversibility_class: action.reversibility_class } : {}),
+        },
+    };
+    const rootDecision = (0, pca_1.evaluatePredicates)(env.predicates, ctx);
+    if (!rootDecision.allowed) {
+        return { allowed: false, reason: `root authority denies: ${rootDecision.reason ?? 'no predicate matched'}` };
+    }
+    const leaf = chain[chain.length - 1];
+    const caveats = Array.isArray(leaf.caveats) ? leaf.caveats : [];
+    for (const cv of caveats) {
+        if (cv?.type !== exports.GNAP_ACCESS_CAVEAT)
+            continue;
+        const hopPreds = accessArrayToPredicates(readAccessArray(cv.access));
+        const hopDecision = (0, pca_1.evaluatePredicates)(hopPreds, ctx);
+        if (!hopDecision.allowed) {
+            return { allowed: false, reason: `delegated hop denies: ${hopDecision.reason ?? 'no predicate matched'}` };
+        }
+    }
+    return { allowed: true };
+}
+// ============================================================================================
+// Bound token: PCA capability chain ↔ GNAP access token
+// ============================================================================================
+/** Encode a capability chain as a GNAP access-token `value` (self-contained, re-verified on use). */
+function encodeBoundToken(chain) {
+    return (0, pca_1.b64u)((0, pca_1.utf8)(JSON.stringify(chain)));
+}
+/** Structural guard: the required shape of a serialized capability hop (verifyChain re-checks crypto). */
+function isCapabilityShape(x) {
+    if (!isRecord(x))
+        return false;
+    return (typeof x.id === 'string' &&
+        typeof x.issuer === 'string' &&
+        typeof x.holder === 'string' &&
+        typeof x.body_digest === 'string' &&
+        typeof x.sig === 'string' &&
+        Array.isArray(x.caveats) &&
+        (x.parent === undefined || typeof x.parent === 'string') &&
+        (x.alg === undefined || typeof x.alg === 'string') &&
+        (x.pq_pk === undefined || typeof x.pq_pk === 'string') &&
+        (x.pq_sig === undefined || typeof x.pq_sig === 'string'));
+}
+/** Total, fail-closed decode of a bound token back into a capability chain (null on any deviation). */
+function decodeBoundToken(value) {
+    try {
+        const text = new TextDecoder('utf-8', { fatal: true }).decode((0, pca_1.unb64u)(value));
+        const parsed = (0, pca_1.strictParse)(text);
+        if (!Array.isArray(parsed))
+            return null;
+        const chain = [];
+        for (const hop of parsed) {
+            if (!isCapabilityShape(hop))
+                return null;
+            chain.push(hop);
+        }
+        return chain;
+    }
+    catch {
+        return null;
+    }
+}
+/** Render a (verified) PCA capability chain as a GNAP grant response with a bound access token. */
+function capabilityToGrantResponse(chain, opts = {}) {
+    if (!Array.isArray(chain) || chain.length === 0)
+        throw new GnapError('capabilityToGrantResponse: empty chain');
+    const leaf = chain[chain.length - 1];
+    const token = {
+        value: encodeBoundToken(chain),
+        access: grantedAccessOf(chain),
+        key: opts.bearer === true ? false : holderJwk(leaf.holder),
+        ...(opts.expiresIn !== undefined ? { expires_in: opts.expiresIn } : {}),
+        ...(opts.manageUri !== undefined ? { manage: { uri: opts.manageUri } } : {}),
+    };
+    return {
+        access_token: token,
+        ...(opts.continue !== undefined ? { continue: opts.continue } : {}),
+        ...(opts.instanceId !== undefined ? { instance_id: opts.instanceId } : {}),
+    };
+}
+/**
+ * Verify an incoming GNAP bound token, mapping it back to a PCA principal + capability. FAILS CLOSED:
+ * a token that is not a decodable chain, or whose chain does not verify (optionally against
+ * `expectedRootIssuer`), returns `{ ok:false }`. The `principal` is the chain's root issuer key.
+ */
+function verifyGnapToken(value, opts = {}) {
+    if (typeof value !== 'string' || value.length === 0)
+        return { ok: false, reason: 'token value is empty' };
+    const chain = decodeBoundToken(value);
+    if (chain === null || chain.length === 0)
+        return { ok: false, reason: 'token is not a decodable PCA capability chain' };
+    const vc = (0, pca_1.verifyChain)(chain, opts.expectedRootIssuer);
+    if (!vc.ok)
+        return { ok: false, reason: `capability chain invalid: ${vc.reason ?? 'unknown'}` };
+    const root = chain[0];
+    const leaf = chain[chain.length - 1];
+    return { ok: true, principal: root.issuer, capability: leaf, chain, access: grantedAccessOf(chain) };
+}
+const JWSD_TYP = 'gnap-binding-jwsd';
+function athOf(accessTokenValue) {
+    return (0, pca_1.b64u)((0, pca_1.sha256)((0, pca_1.utf8)(accessTokenValue)));
+}
+function toPlain(value) {
+    return JSON.parse(JSON.stringify(value));
+}
+function canonicalPayloadBytes(body) {
+    return (0, pca_1.utf8)((0, pca_1.canonicalizeStrict)(toPlain(body)));
+}
+/**
+ * Produce a GNAP `jwsd` detached-JWS proof over `body`, signed by the client key (via `jose`). The JWS
+ * payload is the canonical body; the compact detached form (payload omitted) is what travels in the
+ * `Detached-JWS` header. The signing key's public half IS the PCA holder the grant binds to.
+ */
+async function signGnapRequest(args) {
+    const created = args.created ?? Math.floor(Date.now() / 1000);
+    const holder = (0, pca_1.b64u)(args.key.publicKey);
+    const header = {
+        alg: 'EdDSA',
+        typ: JWSD_TYP,
+        htm: args.htm.toUpperCase(),
+        uri: args.uri,
+        created,
+        ...(args.kid !== undefined ? { kid: args.kid } : {}),
+        ...(args.accessTokenValue !== undefined ? { ath: athOf(args.accessTokenValue) } : {}),
+    };
+    const payload = canonicalPayloadBytes(args.body);
+    const privateJwk = { kty: 'OKP', crv: 'Ed25519', x: holder, d: (0, pca_1.b64u)(args.key.secretKey) };
+    const signingKey = await (0, jose_1.importJWK)(privateJwk, 'EdDSA');
+    // JWSHeaderParameters carries an index signature; copy the typed header into an object literal that
+    // satisfies it (GnapJwsdHeader is a closed interface and is not directly assignable).
+    const protectedHeader = {
+        alg: header.alg,
+        typ: header.typ,
+        htm: header.htm,
+        uri: header.uri,
+        created: header.created,
+        ...(header.kid !== undefined ? { kid: header.kid } : {}),
+        ...(header.ath !== undefined ? { ath: header.ath } : {}),
+    };
+    const jws = await new jose_1.FlattenedSign(payload).setProtectedHeader(protectedHeader).sign(signingKey);
+    return { detachedJws: `${jws.protected}..${jws.signature}`, header, holder };
+}
+/**
+ * Verify a GNAP `jwsd` detached-JWS proof (via `jose`) and bind the request to the holder key. FAILS
+ * CLOSED on any deviation: a bad signature, a tampered body, a wrong holder, a mismatched `htm`/`uri`,
+ * a stale/future `created`, or an `ath` that does not bind the named access token.
+ */
+async function verifyGnapRequest(args) {
+    const fail = (reason) => ({ ok: false, reason });
+    try {
+        const parts = args.detachedJws.split('.');
+        if (parts.length !== 3)
+            return fail('not a compact JWS (expected three dot-separated parts)');
+        const [protectedB64u, mid, signature] = parts;
+        if (protectedB64u === undefined || signature === undefined || mid !== '')
+            return fail('not a DETACHED compact JWS');
+        const holder = asEd25519(args.holder);
+        if (holder === null)
+            return fail('holder is not a canonical base64url Ed25519 public key');
+        const payloadB64u = jose_1.base64url.encode(canonicalPayloadBytes(args.body));
+        const verifyKey = await (0, jose_1.importJWK)({ kty: 'OKP', crv: 'Ed25519', x: holder }, 'EdDSA');
+        let header;
+        try {
+            const res = await (0, jose_1.flattenedVerify)({ protected: protectedB64u, payload: payloadB64u, signature }, verifyKey);
+            header = res.protectedHeader;
+        }
+        catch {
+            return fail('jwsd signature does not verify under the holder key (or body was tampered)');
+        }
+        if (header === undefined)
+            return fail('jwsd carries no protected header');
+        if (header.typ !== JWSD_TYP)
+            return fail('unexpected typ (not gnap-binding-jwsd)');
+        if (header.alg !== 'EdDSA')
+            return fail('unexpected alg (not EdDSA)');
+        const htm = header.htm;
+        if (typeof htm !== 'string' || htm.toUpperCase() !== args.htm.toUpperCase())
+            return fail('htm does not match the request method');
+        const uri = header.uri;
+        if (typeof uri !== 'string' || uri !== args.uri)
+            return fail('uri does not match the request target');
+        const created = header.created;
+        if (typeof created !== 'number' || !Number.isFinite(created))
+            return fail('missing or malformed created');
+        const nowSec = Math.floor((args.now ?? Date.now()) / 1000);
+        const maxAge = args.maxAgeSec ?? 300;
+        if (created > nowSec + 60)
+            return fail('created is in the future');
+        if (nowSec - created > maxAge)
+            return fail('jwsd proof is stale');
+        const ath = header.ath;
+        if (args.accessTokenValue !== undefined) {
+            if (typeof ath !== 'string' || ath !== athOf(args.accessTokenValue))
+                return fail('ath does not bind the named access token');
+        }
+        const out = {
+            alg: 'EdDSA',
+            typ: JWSD_TYP,
+            htm,
+            uri,
+            created,
+            ...(typeof header.kid === 'string' ? { kid: header.kid } : {}),
+            ...(typeof ath === 'string' ? { ath } : {}),
+        };
+        return { ok: true, holder, header: out };
+    }
+    catch {
+        return fail('malformed jwsd request');
+    }
+}
+/**
+ * Decide whether a grant request needs a continuation/step-up: it does when GNAP interaction is
+ * requested, when an explicit higher tier is asked for, or when (given the issuer's chain) the request
+ * asks for rights BEYOND the issuer's own authority — which can only be unlocked by a human/guardian
+ * co-signature, not minted by the agent alone.
+ */
+function gnapRequestRequiresStepUp(req, opts = {}) {
+    const beyond = [];
+    if (opts.issuerChain) {
+        const G = grantedAccessOf(opts.issuerChain);
+        for (const r of normalizeAccess(accessOf(req)))
+            if (!accessWithin(G, r))
+                beyond.push(r);
+    }
+    const interactRequested = req.interact !== undefined && Array.isArray(req.interact.start) && req.interact.start.length > 0;
+    const required = interactRequested || beyond.length > 0 || (opts.tier !== undefined && opts.tier > 1);
+    const tier = opts.tier ?? (beyond.length > 0 ? 3 : 2);
+    const reason = !required
+        ? 'no step-up required'
+        : beyond.length > 0
+            ? `requested rights exceed the issuer's authority (${beyond.length} right(s) beyond)`
+            : interactRequested
+                ? 'GNAP interaction requested'
+                : `tier ${tier} step-up required`;
+    return { required, reason, beyond, tier };
+}
+/** Begin a GNAP continuation: emit the `continue` handle + the PCA step-up it resolves through. */
+function beginGnapContinuation(args) {
+    const cont = {
+        uri: args.continueUri,
+        access_token: { value: args.continueToken, bound: true },
+        ...(args.wait !== undefined ? { wait: args.wait } : {}),
+    };
+    return {
+        response: { continue: cont },
+        stepUp: {
+            tier: args.tier,
+            t: args.t,
+            signerSet: args.signerSet,
+            reason: args.reason ?? `tier ${args.tier} co-signature required to continue`,
+            continueToken: args.continueToken,
+        },
+    };
+}
+/**
+ * Produce one role's step-up co-signature share over the action's PCActn — the co-signature a
+ * guardian/principal device returns through the GNAP continuation. For 'guardian'/'principal' it binds
+ * the signer set + `t` (replay-safe); the 'agent' share is the PCActn's own leaf signature.
+ */
+function gnapStepUpShare(body, role, secret, signerSet, t) {
+    return (0, pca_1.signShare)(role, secret, (0, pca_1.thresholdMessage)(body), { signerSet, t });
+}
+/**
+ * Resolve a continuation: build the action's PCActn (agent leaf signature) and FOLD the step-up
+ * co-signatures into its `threshold`, then verify the threshold `t` is reached. This is the concrete
+ * realization of "a grant that needs more authority continues via a step-up co-signature folded into
+ * the PCActn" — the multi-signature carrier; a FROST aggregate share slots in the same `agent`/group
+ * position without changing the property.
+ */
+function completeGnapContinuation(args) {
+    if (!Array.isArray(args.chain) || args.chain.length === 0)
+        throw new GnapError('completeGnapContinuation: empty chain');
+    const leaf = args.chain[args.chain.length - 1];
+    const pcactn = (0, pca_1.buildPCActn)({
+        grant: args.grant,
+        chain: args.chain,
+        plan: args.plan,
+        nodeId: args.nodeId,
+        counter: args.counter,
+        signerSecret: args.agentLeafSecret,
+        aud: args.aud,
+        ...(args.params !== undefined ? { params: args.params } : {}),
+        ...(args.now !== undefined ? { now: args.now } : {}),
+        ...(args.ttlMs !== undefined ? { ttlMs: args.ttlMs } : {}),
+    });
+    const message = (0, pca_1.thresholdMessage)(pcactn);
+    const agentShare = { role: 'agent', publicKey: leaf.holder, sig: pcactn.sig };
+    const cosignShares = args.cosignSecrets.map((cs) => (0, pca_1.signShare)(cs.role, cs.secret, message, { signerSet: args.signerSet, t: args.t }));
+    const threshold = (0, pca_1.assembleThreshold)([agentShare, ...cosignShares]);
+    const verdict = (0, pca_1.verifyThreshold)(threshold, message, args.signerSet, args.t);
+    return { pcactn: { ...pcactn, threshold }, threshold, verdict };
+}
+/** The machine-readable Agent-GNAP profile spec (see the module header for the full narrative). */
+exports.AGENT_GNAP_PROFILE = {
+    name: 'agent-gnap',
+    version: '1.0',
+    rfc: 'RFC 9635',
+    summary: 'A GNAP profile for autonomous-agent delegation: each A2A hop is a GNAP grant whose authority is ' +
+        'issued as an attenuated, key-bound PCA capability, never wider than the issuing agent.',
+    mapping: [
+        { gnap: 'access[].type', pca: 'predicate resource namespace gnap:<type>:<location>', note: 'the resource family the rights live in' },
+        { gnap: 'access[].actions', pca: 'predicate.verb (list, or * for any)', note: 'the operations permitted' },
+        { gnap: 'access[].locations', pca: 'predicate.resource (exact or trailing-* prefix)', note: 'the resource targets' },
+        { gnap: 'access[].datatypes / identifier', pca: "predicate.where on action.params.*", note: 'value-level constraints' },
+        { gnap: 'client.key.jwk (OKP/Ed25519)', pca: 'capability.holder (cnf-bound key)', note: 'the proof-of-possession key' },
+        { gnap: 'grant request (no prior grant)', pca: 'mintGrant → root capability', note: 'envelope predicates = requested access' },
+        { gnap: 'grant request (delegated hop)', pca: 'delegate → child capability + gnap_access caveat', note: 'append-only attenuation' },
+        { gnap: 'access_token (§3.2)', pca: 'a verifiable PCA capability chain (encodeBoundToken)', note: 'bound, self-verifying token' },
+        { gnap: 'continue (§3.1) + interact (§3.3)', pca: 'PCA step-up: FROST/threshold co-signature folded into a PCActn', note: 'tier-2/3 escalation' },
+        { gnap: 'jwsd detached JWS (§7.3.4)', pca: 'request proof binding the body to capability.holder', note: 'verified with jose' },
+    ],
+    proofMethods: ['jwsd'],
+    multiHop: 'An A2A task is a chain of GNAP grants. Each hop delegates from the issuing agent to the next, ' +
+        'recording its (clamped) rights as an append-only gnap_access caveat. Effective authority is the ' +
+        'intersection of the root policy envelope and every hop; PCA caveats are conjunctive and ' +
+        'append-only, so no hop can widen — "never wider than the issuer" holds across any depth.',
+    stepUp: 'A request for authority beyond the issuer (or an explicit interaction) returns a GNAP continue ' +
+        'handle instead of a token. The client returns with the action PCActn plus a guardian/principal ' +
+        'co-signature, which is folded into the PCActn threshold and verified at tier 2/3 (FROST or ' +
+        'multi-signature) before the action is admitted.',
+    security: [
+        'Attenuation is structural and append-only: a delegated hop can only ever narrow authority.',
+        'Every grant is key-bound (cnf): the holder key must prove possession via a jwsd detached JWS.',
+        'All verification fails closed: bad token, broken chain, bad proof, stale request, or out-of-scope action denies.',
+        'Rights beyond the issuer are clamped at issue time and denied at action time (defense in depth).',
+        'Elevation beyond the agent requires a human/guardian co-signature, not a self-minted grant.',
+    ],
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;;;AAgKH,gDAEC;AAiCD,0CAGC;AAmBD,gDAeC;AA0BD,wCAOC;AAGD,oCAEC;AAGD,kCAQC;AAuDD,0CAUC;AAOD,sCAaC;AAGD,8BAEC;AAkED,4DAuDC;AAwBD,kDAqCC;AAOD,4CAEC;AA+CD,8DAeC;AAWD,0CASC;AAgED,0CA4BC;AAwBD,8CAwDC;AAuCD,8DAoBC;AAaD,sDAgBC;AAOD,0CAQC;AAiCD,4DAqBC;AA38BD,+BAAsG;AACtG,wCAmCwB;AAgGxB,+FAA+F;AAC/F,wBAAwB;AACxB,+FAA+F;AAE/F,kGAAkG;AAClG,MAAa,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AALD,8BAKC;AAED,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CAC5D,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAE3D,MAAM,MAAM,GAAG,CAAC,CAAU,EAAwB,EAAE,CAClD,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAErF,sFAAsF;AACtF,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,IAAA,sBAAgB,EAAC,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9E,CAAC;AAED,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAEpC,yGAAyG;AACzG,SAAgB,kBAAkB,CAAC,IAAY,EAAE,QAAgB;IAC/D,OAAO,GAAG,oBAAoB,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;AACvD,CAAC;AAED,+FAA+F;AAC/F,4DAA4D;AAC5D,+FAA+F;AAE/F,gGAAgG;AAChG,SAAS,sBAAsB,CAAC,IAAa;IAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,GAAG,GAAuB,EAAE,IAAI,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;IACzD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,SAAS,GAAG,SAAS,CAAC;IACjE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,SAAS,GAAG,SAAS,CAAC;IACjE,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;QAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IAC1E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC;IACrE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,SAAS,mBAAmB,CAAC,IAAa;IACxC,MAAM,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,yDAAyD,CAAC,CAAC;IAC/F,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8EAA8E;AAC9E,SAAgB,eAAe,CAAC,KAAyB;IACvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,yBAAyB,CAAC,CAAC;IAC1E,OAAO,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AACxC,CAAC;AAED,0GAA0G;AAC1G,SAAS,eAAe,CAAC,CAAU;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,GAAG,GAAyB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,MAA0B;IAC3D,MAAM,IAAI,GAAsB,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACxG,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC1C,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC3B,MAAM,CAAC,GAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;QAC9E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0CAA0C;AAC1C,SAAS,uBAAuB,CAAC,MAA4B;IAC3D,OAAO,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED,+FAA+F;AAC/F,mFAAmF;AACnF,+FAA+F;AAE/F,SAAS,aAAa,CAAC,GAAyB,EAAE,GAAyB;IACzE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,CAAC,oBAAoB;IACxD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,+CAA+C;IACpF,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,eAAe,CAAC,GAAyB,EAAE,GAAyB;IAC3E,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAChD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CACrB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC3F,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAgB,cAAc,CAAC,CAAqB,EAAE,CAAqB;IACzE,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC5G,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0FAA0F;AAC1F,SAAgB,YAAY,CAAC,CAAuB,EAAE,CAAqB;IACzE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,iGAAiG;AACjG,SAAgB,WAAW,CACzB,aAAmC,EACnC,SAA+B;IAE/B,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,SAAS;QAAE,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxF,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,+FAA+F;AAC/F,8DAA8D;AAC9D,+FAA+F;AAE/F,yFAAyF;AAC5E,QAAA,iBAAiB,GAAG,YAAY,CAAC;AAC9C,wFAAwF;AAC3E,QAAA,kBAAkB,GAAG,aAAa,CAAC;AAuBhD,0FAA0F;AAC1F,SAAS,aAAa,CAAC,IAAgB;IACrC,MAAM,GAAG,GAAG,IAAA,kBAAY,EAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,yBAAiB,CAAC,CAAC;IACnE,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC;IAC9B,MAAM,MAAM,GAAG,EAAE,CAAC,cAAc,CAAC;IACjC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO;QACL,IAAI,EAAE,yBAAiB;QACvB,SAAS,EAAE,QAAQ;QACnB,cAAc,EAAE,eAAe,CAAC,EAAE,CAAC,cAAc,CAAC;QAClD,cAAc,EAAE,MAAM;QACtB,UAAU,EAAE,EAAE,CAAC,UAAU,KAAK,IAAI;QAClC,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,KAAsB;IACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,EAAE,EAAE,IAAI,KAAK,0BAAkB;YAAE,OAAO,eAAe,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,+FAA+F;AAC/F,iEAAiE;AACjE,+FAA+F;AAE/F,iGAAiG;AACjG,SAAgB,aAAa,CAAC,GAAqB,EAAE,cAAuB;IAC1E,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,iEAAiE,CAAC,CAAC;QACvG,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACpG,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,SAAS,CAAC,iFAAiF,CAAC,CAAC;AACzG,CAAC;AAED,kFAAkF;AAClF,SAAgB,SAAS,CAAC,MAAc;IACtC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC7E,CAAC;AAED,SAAS,QAAQ,CAAC,GAAqB;IACrC,MAAM,EAAE,GAAY,GAAG,CAAC,YAAY,CAAC;IACrC,IAAI,QAAQ,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC,MAAM,CAAC;IAC/D,MAAM,IAAI,SAAS,CAAC,qEAAqE,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,eAAe,CAAC,MAAc,EAAE,OAA6B,EAAE,QAAyC;IAC/G,OAAO,IAAA,mBAAa,EAAC;QACnB,CAAC,EAAE,2BAA2B;QAC9B,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,QAAQ,IAAI,IAAI;KAC3B,CAAC,CAAC;AACL,CAAC;AA4CD;;;;;;GAMG;AACH,SAAgB,wBAAwB,CAAC,GAAqB,EAAE,IAA8B;IAC5F,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC;IAE5C,IAAI,OAAO,GAAG,SAAS,CAAC;IACxB,IAAI,OAAO,GAAyB,EAAE,CAAC;IACvC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,WAAW,CAAC,eAAe,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,CAAC;YACnE,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YACxB,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAErE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,UAAU,GAAqB;YACnC,IAAI,EAAE,0BAAkB;YACxB,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,uBAAuB,CAAC,OAAO,CAAC;YAC5C,cAAc,EAAE,aAAa;YAC7B,SAAS,EAAE,MAAM;YACjB,EAAE,EAAE,GAAG;SACR,CAAC;QACF,MAAM,KAAK,GAAG,IAAA,cAAQ,EAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAC7E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,GAAG,WAAW,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IAC9H,CAAC;IAED,MAAM,UAAU,GAAoB;QAClC,IAAI,EAAE,yBAAiB;QACvB,SAAS,EAAE,MAAM;QACjB,cAAc,EAAE,OAAO;QACvB,cAAc,EAAE,aAAa;QAC7B,UAAU;QACV,EAAE,EAAE,GAAG;KACR,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,GAAG,IAAA,eAAS,EAAC;QAC1B,eAAe,EAAE,IAAI,CAAC,YAAY;QAClC,eAAe,EAAE,IAAI,CAAC,YAAY;QAClC,MAAM;QACN,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,cAAc,MAAM,EAAE;QACzC,QAAQ,EAAE;YACR,UAAU,EAAE,uBAAuB,CAAC,OAAO,CAAC;YAC5C,OAAO,EAAE,CAAC,UAAU,CAAC;YACrB,aAAa,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;YACtC,WAAW,EAAE,IAAI,CAAC,UAAU,IAAI,yBAAmB;SACpD;QACD,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACvG,CAAC;AAkBD;;;;;GAKG;AACH,SAAgB,mBAAmB,CACjC,KAAsB,EACtB,MAAkB,EAClB,OAAwC,EAAE;IAE1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAClG,MAAM,EAAE,GAAG,IAAA,iBAAW,EAAC,KAAK,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACvD,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC,MAAM,IAAI,SAAS,EAAE,EAAE,CAAC;IAErG,MAAM,GAAG,GAAG,IAAA,kBAAY,EAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IAErF,MAAM,GAAG,GAAG;QACV,MAAM,EAAE;YACN,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzG;KACF,CAAC;IAEF,MAAM,YAAY,GAAG,IAAA,wBAAkB,EAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC7D,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,YAAY,CAAC,MAAM,IAAI,sBAAsB,EAAE,EAAE,CAAC;IAC/G,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,EAAE,EAAE,IAAI,KAAK,0BAAkB;YAAE,SAAS;QAC9C,MAAM,QAAQ,GAAG,uBAAuB,CAAC,eAAe,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,MAAM,WAAW,GAAG,IAAA,wBAAkB,EAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,WAAW,CAAC,MAAM,IAAI,sBAAsB,EAAE,EAAE,CAAC;QAC7G,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,+FAA+F;AAC/F,wDAAwD;AACxD,+FAA+F;AAE/F,qGAAqG;AACrG,SAAgB,gBAAgB,CAAC,KAAsB;IACrD,OAAO,IAAA,UAAI,EAAC,IAAA,UAAI,EAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,0GAA0G;AAC1G,SAAS,iBAAiB,CAAC,CAAU;IACnC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/B,OAAO,CACL,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QACjC,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACxB,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC;QACxD,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC;QAClD,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC;QACtD,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAA,YAAM,EAAC,KAAK,CAAC,CAAC,CAAC;QAC7E,MAAM,MAAM,GAAG,IAAA,iBAAW,EAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,KAAK,GAAiB,EAAE,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAYD,mGAAmG;AACnG,SAAgB,yBAAyB,CAAC,KAAsB,EAAE,OAAoC,EAAE;IACtG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;IAC/G,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IACtC,MAAM,KAAK,GAAoB;QAC7B,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC;QAC9B,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC;QAC9B,GAAG,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC;IACF,OAAO;QACL,YAAY,EAAE,KAAK;QACnB,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC;AACJ,CAAC;AAMD;;;;GAIG;AACH,SAAgB,eAAe,CAAC,KAAa,EAAE,OAAwC,EAAE;IACvF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC1G,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;IACxH,MAAM,EAAE,GAAG,IAAA,iBAAW,EAAC,KAAK,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACvD,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC,MAAM,IAAI,SAAS,EAAE,EAAE,CAAC;IAChG,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACvB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IACtC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;AACvG,CAAC;AAwBD,MAAM,QAAQ,GAAG,mBAAmB,CAAC;AAErC,SAAS,KAAK,CAAC,gBAAwB;IACrC,OAAO,IAAA,UAAI,EAAC,IAAA,YAAM,EAAC,IAAA,UAAI,EAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAY,CAAC;AACtD,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAa;IAC1C,OAAO,IAAA,UAAI,EAAC,IAAA,wBAAkB,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC;AAuBD;;;;GAIG;AACI,KAAK,UAAU,eAAe,CAAC,IAAyB;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAA,UAAI,EAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,MAAM,GAAmB;QAC7B,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,QAAQ;QACb,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE;QAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,OAAO;QACP,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtF,CAAC;IACF,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAA,UAAI,EAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;IAC1F,MAAM,UAAU,GAAG,MAAM,IAAA,gBAAS,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACxD,oGAAoG;IACpG,sFAAsF;IACtF,MAAM,eAAe,GAAwB;QAC3C,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,IAAI,oBAAa,CAAC,OAAO,CAAC,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAClG,OAAO,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC/E,CAAC;AAmBD;;;;GAIG;AACI,KAAK,UAAU,iBAAiB,CAAC,IAA2B;IACjE,MAAM,IAAI,GAAG,CAAC,MAAc,EAA2B,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAClF,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,wDAAwD,CAAC,CAAC;QAC9F,MAAM,CAAC,aAAa,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;QAC9C,IAAI,aAAa,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAEpH,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,wDAAwD,CAAC,CAAC;QAE3F,MAAM,WAAW,GAAG,gBAAS,CAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACvE,MAAM,SAAS,GAAG,MAAM,IAAA,gBAAS,EAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC;QAEtF,IAAI,MAAuC,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAA,sBAAe,EAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,SAAS,CAAC,CAAC;YAC5G,MAAM,GAAG,GAAG,CAAC,eAAe,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,4EAA4E,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAE1E,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,wCAAwC,CAAC,CAAC;QACnF,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAEtE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE;YAAE,OAAO,IAAI,CAAC,uCAAuC,CAAC,CAAC;QAClI,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,uCAAuC,CAAC,CAAC;QACtG,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAE1G,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC;QACrC,IAAI,OAAO,GAAG,MAAM,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACnE,IAAI,MAAM,GAAG,OAAO,GAAG,MAAM;YAAE,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAElE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC;gBAAE,OAAO,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAC/H,CAAC;QAED,MAAM,GAAG,GAAmB;YAC1B,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,QAAQ;YACb,GAAG;YACH,GAAG;YACH,OAAO;YACP,GAAG,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAiCD;;;;;GAKG;AACH,SAAgB,yBAAyB,CACvC,GAAqB,EACrB,OAAwD,EAAE;IAE1D,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAAE,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,iBAAiB,GAAG,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC3H,MAAM,QAAQ,GAAG,iBAAiB,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IACtG,MAAM,IAAI,GAAU,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,CAAC,QAAQ;QACtB,CAAC,CAAC,qBAAqB;QACvB,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YACjB,CAAC,CAAC,mDAAmD,MAAM,CAAC,MAAM,mBAAmB;YACrF,CAAC,CAAC,iBAAiB;gBACjB,CAAC,CAAC,4BAA4B;gBAC9B,CAAC,CAAC,QAAQ,IAAI,mBAAmB,CAAC;IACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC5C,CAAC;AAYD,mGAAmG;AACnG,SAAgB,qBAAqB,CAAC,IAA2B;IAC/D,MAAM,IAAI,GAAiB;QACzB,GAAG,EAAE,IAAI,CAAC,WAAW;QACrB,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE;QACxD,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC;IACF,OAAO;QACL,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC5B,MAAM,EAAE;YACN,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,CAAC,EAAE,IAAI,CAAC,CAAC;YACT,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,QAAQ,IAAI,CAAC,IAAI,oCAAoC;YAC5E,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAC7B,IAAgB,EAChB,IAAgB,EAChB,MAAkB,EAClB,SAAmB,EACnB,CAAY;IAEZ,OAAO,IAAA,eAAS,EAAC,IAAI,EAAE,MAAM,EAAE,IAAA,sBAAgB,EAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;AAC3E,CAAC;AA0BD;;;;;;GAMG;AACH,SAAgB,wBAAwB,CAAC,IAA8B;IACrE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;IACxH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IAChD,MAAM,MAAM,GAAG,IAAA,iBAAW,EAAC;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,YAAY,EAAE,IAAI,CAAC,eAAe;QAClC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAA,sBAAgB,EAAC,MAAM,CAAC,CAAC;IACzC,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;IAC9F,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAA,eAAS,EAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtI,MAAM,SAAS,GAAG,IAAA,uBAAiB,EAAC,CAAC,UAAU,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,IAAA,qBAAe,EAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5E,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAClE,CAAC;AA6BD,mGAAmG;AACtF,QAAA,kBAAkB,GAAqB;IAClD,IAAI,EAAE,YAAY;IAClB,OAAO,EAAE,KAAK;IACd,GAAG,EAAE,UAAU;IACf,OAAO,EACL,kGAAkG;QAClG,wFAAwF;IAC1F,OAAO,EAAE;QACP,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,qDAAqD,EAAE,IAAI,EAAE,wCAAwC,EAAE;QACrI,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,qCAAqC,EAAE,IAAI,EAAE,0BAA0B,EAAE;QAC1G,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,iDAAiD,EAAE,IAAI,EAAE,sBAAsB,EAAE;QACpH,EAAE,IAAI,EAAE,iCAAiC,EAAE,GAAG,EAAE,oCAAoC,EAAE,IAAI,EAAE,yBAAyB,EAAE;QACvH,EAAE,IAAI,EAAE,8BAA8B,EAAE,GAAG,EAAE,mCAAmC,EAAE,IAAI,EAAE,6BAA6B,EAAE;QACvH,EAAE,IAAI,EAAE,gCAAgC,EAAE,GAAG,EAAE,6BAA6B,EAAE,IAAI,EAAE,wCAAwC,EAAE;QAC9H,EAAE,IAAI,EAAE,+BAA+B,EAAE,GAAG,EAAE,kDAAkD,EAAE,IAAI,EAAE,yBAAyB,EAAE;QACnI,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,sDAAsD,EAAE,IAAI,EAAE,6BAA6B,EAAE;QACjI,EAAE,IAAI,EAAE,mCAAmC,EAAE,GAAG,EAAE,gEAAgE,EAAE,IAAI,EAAE,qBAAqB,EAAE;QACjJ,EAAE,IAAI,EAAE,4BAA4B,EAAE,GAAG,EAAE,qDAAqD,EAAE,IAAI,EAAE,oBAAoB,EAAE;KAC/H;IACD,YAAY,EAAE,CAAC,MAAM,CAAC;IACtB,QAAQ,EACN,gGAAgG;QAChG,kGAAkG;QAClG,0FAA0F;QAC1F,0FAA0F;IAC5F,MAAM,EACJ,iGAAiG;QACjG,iGAAiG;QACjG,6FAA6F;QAC7F,iDAAiD;IACnD,QAAQ,EAAE;QACR,4FAA4F;QAC5F,+FAA+F;QAC/F,kHAAkH;QAClH,kGAAkG;QAClG,6FAA6F;KAC9F;CACF,CAAC"}

package/package.json

@@ -1,6 +1,34 @@
 {
   "name": "@atlasauth/pca-gnap",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "GNAP (RFC 9635) bridge for PCA, defining an agent-GNAP profile: map a GNAP grant request/response + continuation to an attenuated PCA capability, with GNAP continuation mapped to FROST/CIBA step-up and key-bound (jwsd) requests.",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "jose": "^5.9.6",
+    "@atlasauth/pca": "0.1.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.4"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
 }

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.