@cotal-ai/core 0.89.0 → 0.90.1

package/dist/remote-service-authority.js

@@ -0,0 +1,415 @@
+import { createHash } from "node:crypto";
+import { canonicalJson, contractDigest, isContractDigest } from "./canonical.js";
+import { CONTRACT_CLOSURE_MAX_ARTIFACTS } from "./contract-manifest.js";
+import { CONTRACT_ARTIFACT_MAX_BYTES } from "./endpoint-contract-store.js";
+import { EpEnvelopeError } from "./endpoint-error.js";
+import { endpointToken, assertBoundedOwner, assertCommandToken, parseEpSubject, MAX_EP_SUBJECT_BYTES } from "./endpoint-subjects.js";
+import { parseServiceSpec } from "./endpoint-service.js";
+import { isAccountNkey } from "./identity.js";
+import { assertDerivedOwnerToken, assertLifecycleToken, spacePrefix } from "./subjects.js";
+import { SERVICE_AUTHORITY_MAX_BYTES, SERVICE_DESCRIBE_QUERY_BUDGET_MS } from "./service-authority-limits.js";
+export { SERVICE_ACCESS_TTL_SECONDS, SERVICE_RENEWAL_TTL_SECONDS, SERVICE_AUTHORITY_MAX_BYTES, SERVICE_DESCRIBE_QUERY_BUDGET_MS } from "./service-authority-limits.js";
+/** A transport failure never permits a new mutation identity or an unqualified replay. */
+export class ServiceAuthorityTransportError extends Error {
+    outcome;
+    httpStatus;
+    constructor(message, outcome, httpStatus) {
+        super(message);
+        this.outcome = outcome;
+        this.httpStatus = httpStatus;
+        this.name = "ServiceAuthorityTransportError";
+    }
+}
+const COMMON = ["v", "kind", "operation", "requestId", "space", "accountPublicKey", "endpoint", "instanceId"];
+const WITNESS = ["accountPublicKey", "space", "endpoint", "instanceId", "principal", "rootCredentialId", "approvalDigest", "processEpoch", "registrationRevision", "nameAuthorityRevision", "registrationRequestId", "registrationProof"];
+const OPERATIONS = ["register", "activate", "renew", "ready", "revoke", "status", "describe-view"];
+const RESULT_STATES = {
+    register: ["approval-required", "pending", "registered", "denied"],
+    activate: ["credential", "denied"],
+    renew: ["credential", "denied"],
+    ready: ["ready", "denied"],
+    revoke: ["pending", "retired", "denied"],
+    status: ["status", "denied"],
+    "describe-view": ["view", "denied"],
+};
+const PROOFS = {
+    register: ["idp"], activate: ["idp", "service-renewal"], renew: ["service-renewal"],
+    ready: ["service-access"], revoke: ["idp", "service-renewal"],
+    status: ["idp", "service-renewal", "service-access"],
+    "describe-view": ["service-access"],
+};
+function invalid(detail) {
+    throw new EpEnvelopeError("bad-request", `service-endpoint authority: ${detail}`);
+}
+function record(raw, what) {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        invalid(`${what} must be an object`);
+    const proto = Object.getPrototypeOf(raw);
+    if (proto !== Object.prototype && proto !== null)
+        invalid(`${what} must be a plain object`);
+    return raw;
+}
+function closed(o, required, optional = []) {
+    if (required.some((k) => !Object.hasOwn(o, k)) ||
+        Reflect.ownKeys(o).some((k) => typeof k !== "string" || (!required.includes(k) && !optional.includes(k))))
+        invalid("object has missing or unsupported fields");
+}
+function text(raw, what, max = 128) {
+    if (typeof raw !== "string" || raw.length === 0 || raw.length > max)
+        invalid(`${what} must be bounded nonempty text`);
+    return raw;
+}
+function integer(raw, what) {
+    if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw < 0)
+        invalid(`${what} must be an unsigned safe integer`);
+    return raw;
+}
+function requestId(raw) {
+    if (typeof raw !== "string" || !/^[0-9a-f]{32}$/.test(raw))
+        invalid("requestId must be 32 lowercase hex characters");
+    return raw;
+}
+function digest(raw, what) {
+    if (typeof raw !== "string" || !isContractDigest(raw))
+        invalid(`${what} must be a canonical sha256 digest`);
+    return raw;
+}
+function coordinates(o) {
+    if (o.v !== 1 || o.kind !== "service-endpoint-authority")
+        invalid("unsupported version or kind");
+    if (!OPERATIONS.includes(o.operation))
+        invalid("unsupported operation");
+    requestId(o.requestId);
+    spacePrefix(text(o.space, "space"));
+    if (typeof o.accountPublicKey !== "string" || !isAccountNkey(o.accountPublicKey))
+        invalid("invalid account public key");
+    endpointToken(text(o.endpoint, "endpoint", 512));
+    assertLifecycleToken(text(o.instanceId, "instanceId"), "instanceId");
+}
+function boundedJson(raw) {
+    let bytes;
+    try {
+        bytes = canonicalJson(raw);
+    }
+    catch {
+        invalid("input must be canonicalizable JSON");
+    }
+    if (Buffer.byteLength(bytes, "utf8") > SERVICE_AUTHORITY_MAX_BYTES)
+        invalid("JSON exceeds the authority envelope limit");
+    return bytes;
+}
+function artifacts(raw, closureCount) {
+    // Each native closure counts documents separately from its manifest. The HTTP byte bound
+    // still caps the union, and the host must verify each closure's own walk limits.
+    if (!Number.isSafeInteger(closureCount) || closureCount < 1 || closureCount > CONTRACT_CLOSURE_MAX_ARTIFACTS)
+        invalid("clusterDigests must be a bounded nonempty array");
+    if (!Array.isArray(raw) || raw.length === 0 || raw.length > closureCount * (CONTRACT_CLOSURE_MAX_ARTIFACTS + 1))
+        invalid("contractArtifacts must be a bounded nonempty array");
+    const seen = new Set();
+    for (const artifact of raw) {
+        record(artifact, "contract artifact");
+        const bytes = boundedJson(artifact);
+        if (Buffer.byteLength(bytes, "utf8") > CONTRACT_ARTIFACT_MAX_BYTES)
+            invalid("contract artifact exceeds the native byte limit");
+        const id = contractDigest(artifact);
+        if (seen.has(id))
+            invalid("duplicate contract artifact");
+        seen.add(id);
+    }
+}
+export function parseServiceAuthorityInfo(raw, expectedSpace) {
+    const o = record(raw, "authority info");
+    closed(o, ["v", "kind", "space", "accountPublicKey"]);
+    spacePrefix(expectedSpace);
+    if (o.v !== 1 || o.kind !== "service-endpoint-authority-info" || o.space !== expectedSpace)
+        invalid("authority info does not match this space and protocol");
+    if (typeof o.accountPublicKey !== "string" || !isAccountNkey(o.accountPublicKey))
+        invalid("invalid DATA-account public key");
+    return { v: 1, kind: "service-endpoint-authority-info", space: expectedSpace, accountPublicKey: o.accountPublicKey };
+}
+export function parseServiceRegistrationWitness(raw) {
+    const o = record(raw, "registration witness");
+    closed(o, WITNESS);
+    coordinates({ ...o, v: 1, kind: "service-endpoint-authority", operation: "activate", requestId: o.registrationRequestId });
+    const principal = record(o.principal, "service principal");
+    closed(principal, ["owner", "actor", "lifecycleUid"]);
+    assertDerivedOwnerToken(text(principal.owner, "owner"));
+    assertBoundedOwner(text(principal.actor, "actor"), "service actor");
+    assertLifecycleToken(text(principal.lifecycleUid, "lifecycleUid"), "lifecycleUid");
+    assertLifecycleToken(text(o.rootCredentialId, "rootCredentialId"), "rootCredentialId");
+    digest(o.approvalDigest, "approvalDigest");
+    digest(o.registrationProof, "registrationProof");
+    for (const key of ["processEpoch", "registrationRevision", "nameAuthorityRevision"])
+        integer(o[key], key);
+    const expectedActor = serviceEndpointActor({
+        accountPublicKey: o.accountPublicKey, space: o.space, owner: principal.owner,
+        endpoint: o.endpoint, instanceId: o.instanceId,
+    });
+    if (principal.actor !== expectedActor)
+        invalid("serving actor does not match the assigned tuple");
+    return JSON.parse(boundedJson(o));
+}
+function boundWitness(raw, request) {
+    const witness = parseServiceRegistrationWitness(raw);
+    for (const key of ["accountPublicKey", "space", "endpoint", "instanceId"])
+        if (witness[key] !== request[key])
+            invalid("witness belongs to a different service assignment");
+    return witness;
+}
+function observation(raw, outer) {
+    const o = record(raw, "Describe observation");
+    closed(o, ["subject", "fingerprint"]);
+    const subject = text(o.subject, "Describe subject", MAX_EP_SUBJECT_BYTES);
+    const parsed = parseEpSubject(subject);
+    if (!subject.startsWith(`${spacePrefix(outer.space)}.ep.`) || !parsed || parsed.plane !== "request"
+        || parsed.command !== "describe" || parsed.endpoint !== outer.endpoint || parsed.target !== null
+        || (parsed.route === "inst" && parsed.instanceId !== outer.instanceId))
+        invalid("Describe observation does not name this service");
+    return { subject, fingerprint: digest(o.fingerprint, "Describe fingerprint") };
+}
+/** Parsing binds shape and identity only. Authentication and current native state remain host checks. */
+export function parseServiceAuthorityRequest(raw) {
+    const o = record(raw, "request");
+    coordinates(o);
+    switch (o.operation) {
+        case "register": {
+            closed(o, [...COMMON, "registration", "expected"]);
+            const registration = record(o.registration, "registration");
+            closed(registration, ["clusterDigests", "contractArtifacts"]);
+            const digests = registration.clusterDigests;
+            if (!Array.isArray(digests) || digests.length === 0 || digests.length > CONTRACT_CLOSURE_MAX_ARTIFACTS)
+                invalid("clusterDigests must be a bounded nonempty array");
+            digests.forEach((d) => digest(d, "cluster digest"));
+            if (new Set(digests).size !== digests.length)
+                invalid("duplicate cluster digest");
+            artifacts(registration.contractArtifacts, digests.length);
+            const expected = record(o.expected, "expected registration");
+            if (expected.state === "unregistered")
+                closed(expected, ["state"]);
+            else if (expected.state === "registered") {
+                closed(expected, ["state", "witness"]);
+                boundWitness(expected.witness, o);
+            }
+            else
+                invalid("unsupported expected registration state");
+            break;
+        }
+        case "describe-view":
+            closed(o, [...COMMON, "witness", "observation"]);
+            boundWitness(o.witness, o);
+            observation(o.observation, o);
+            break;
+        case "status": {
+            closed(o, [...COMMON, "target"]);
+            const target = record(o.target, "status target");
+            if (target.kind === "instance")
+                closed(target, ["kind"]);
+            else if (target.kind === "operation") {
+                closed(target, ["kind", "requestId"]);
+                requestId(target.requestId);
+            }
+            else
+                invalid("unsupported status target");
+            break;
+        }
+        default:
+            closed(o, [...COMMON, "witness"]);
+            boundWitness(o.witness, o);
+    }
+    return JSON.parse(boundedJson(o));
+}
+export function parseServiceAuthorityEnvelope(raw) {
+    const o = record(raw, "envelope");
+    closed(o, ["request", "proof"]);
+    const request = parseServiceAuthorityRequest(o.request);
+    const proof = record(o.proof, "proof");
+    closed(proof, ["kind", "token"]);
+    if (!PROOFS[request.operation].includes(proof.kind))
+        invalid("proof kind is not admitted for this operation");
+    text(proof.token, "proof token", 64 * 1024);
+    boundedJson(o);
+    return { request, proof: { kind: proof.kind, token: proof.token } };
+}
+function snapshot(raw, witness) {
+    const o = record(raw, "registration snapshot");
+    closed(o, ["spec", "name", "processEpoch", "contractArtifacts"]);
+    const spec = record(o.spec, "spec snapshot"), name = record(o.name, "name snapshot");
+    closed(spec, ["value", "revision"]);
+    closed(name, ["authorized", "revision"]);
+    const value = parseServiceSpec(spec.value, { endpoint: witness.endpoint });
+    if (value.owner !== witness.principal.owner || spec.revision !== witness.registrationRevision ||
+        name.authorized !== true || name.revision !== witness.nameAuthorityRevision || o.processEpoch !== witness.processEpoch)
+        invalid("snapshot disagrees with the registration witness");
+    artifacts(o.contractArtifacts, value.clusterDigests.length);
+    return value;
+}
+function status(raw, outer) {
+    const o = record(raw, "status result");
+    switch (o.state) {
+        case "proposed":
+            closed(o, ["state", "proposalId", "proposalDigest"]);
+            text(o.proposalId, "proposalId");
+            digest(o.proposalDigest, "proposalDigest");
+            break;
+        case "approved-unregistered":
+            closed(o, ["state", "approvalDigest"]);
+            digest(o.approvalDigest, "approvalDigest");
+            break;
+        case "registering":
+        case "revoking":
+            closed(o, ["state", "operationId", "phase"], ["notBefore"]);
+            text(o.operationId, "operationId");
+            text(o.phase, "phase");
+            if (o.notBefore !== undefined)
+                integer(o.notBefore, "notBefore");
+            break;
+        case "registered":
+        case "ready": {
+            closed(o, ["state", "witness", "snapshot", ...(o.state === "ready" ? ["reportedAt"] : [])]);
+            snapshot(o.snapshot, boundWitness(o.witness, outer));
+            if (o.state === "ready")
+                integer(o.reportedAt, "reportedAt");
+            break;
+        }
+        case "retired":
+            closed(o, ["state", "operationId", "witness"]);
+            text(o.operationId, "operationId");
+            boundWitness(o.witness, outer);
+            break;
+        case "refused":
+            closed(o, ["state", "proposalId", "reason"]);
+            text(o.proposalId, "proposalId");
+            text(o.reason, "reason");
+            break;
+        case "superseded":
+            closed(o, ["state", "registrationRequestId", "currentRegistrationRequestId"]);
+            requestId(o.registrationRequestId);
+            requestId(o.currentRegistrationRequestId);
+            break;
+        default: invalid("unsupported status state");
+    }
+}
+/** Check a response against the request actually sent, not a response-supplied request echo. */
+export function parseServiceAuthorityResult(raw, expected) {
+    const request = parseServiceAuthorityRequest(expected);
+    const o = record(raw, "result");
+    coordinates(o);
+    for (const key of COMMON)
+        if (o[key] !== request[key])
+            invalid("result does not echo the submitted request");
+    if (!RESULT_STATES[request.operation].includes(o.state))
+        invalid("result state is not admitted for this operation");
+    const common = [...COMMON, "state"];
+    switch (o.state) {
+        case "approval-required": {
+            closed(o, [...common, "proposalId", "proposalDigest"], ["approvalUrl"]);
+            text(o.proposalId, "proposalId");
+            digest(o.proposalDigest, "proposalDigest");
+            if (o.approvalUrl !== undefined) {
+                let url;
+                try {
+                    url = new URL(text(o.approvalUrl, "approvalUrl", 2048));
+                }
+                catch {
+                    invalid("invalid approval URL");
+                }
+                if (url.protocol !== "https:" || url.username || url.password || url.hash)
+                    invalid("invalid approval URL");
+            }
+            break;
+        }
+        case "pending":
+            closed(o, [...common, "operationId", "phase"], ["notBefore"]);
+            text(o.operationId, "operationId");
+            text(o.phase, "phase");
+            if (o.notBefore !== undefined)
+                integer(o.notBefore, "notBefore");
+            break;
+        case "registered": {
+            closed(o, [...common, "witness", "snapshot"]);
+            const witness = boundWitness(o.witness, o);
+            if (witness.registrationRequestId !== request.requestId)
+                invalid("registered result belongs to another operation");
+            const spec = snapshot(o.snapshot, witness);
+            if (request.operation !== "register" || canonicalJson([...spec.clusterDigests].sort()) !== canonicalJson([...request.registration.clusterDigests].sort()))
+                invalid("registered result does not bind the submitted closure set");
+            break;
+        }
+        case "credential": {
+            closed(o, [...common, "witness", "snapshot", "duty", "accessBearer", "accessExpiresAt", "renewalProof", "renewalExpiresAt"]);
+            if (o.duty !== "serve")
+                invalid("unsupported service duty");
+            const witness = boundWitness(o.witness, o);
+            if (!("witness" in request) || serviceWitnessDigest(witness) !== serviceWitnessDigest(request.witness))
+                invalid("credential does not bind the submitted registration witness");
+            snapshot(o.snapshot, witness);
+            text(o.accessBearer, "access bearer", 64 * 1024);
+            text(o.renewalProof, "renewal proof", 64 * 1024);
+            integer(o.accessExpiresAt, "accessExpiresAt");
+            integer(o.renewalExpiresAt, "renewalExpiresAt");
+            break;
+        }
+        case "ready": {
+            closed(o, [...common, "witness", "reportedAt"]);
+            const witness = boundWitness(o.witness, o);
+            if (!("witness" in request) || serviceWitnessDigest(witness) !== serviceWitnessDigest(request.witness))
+                invalid("ready result does not bind the submitted witness");
+            integer(o.reportedAt, "reportedAt");
+            break;
+        }
+        case "view": {
+            closed(o, [...common, "witness", "observation", "basis", "commands", "validForMs"]);
+            if (request.operation !== "describe-view")
+                invalid("view result requires a Describe query");
+            const witness = boundWitness(o.witness, o), observed = observation(o.observation, o);
+            if (serviceWitnessDigest(witness) !== serviceWitnessDigest(request.witness)
+                || canonicalJson(observed) !== canonicalJson(request.observation) || o.basis !== "principal-policy-v1")
+                invalid("view result does not bind this query and principal-policy basis");
+            if (!Array.isArray(o.commands) || new Set(o.commands).size !== o.commands.length)
+                invalid("view commands must be a unique array");
+            for (const command of o.commands)
+                assertCommandToken(text(command, "view command", 32));
+            const validity = integer(o.validForMs, "view validity");
+            if (validity === 0 || validity > SERVICE_DESCRIBE_QUERY_BUDGET_MS)
+                invalid("view validity exceeds its query budget");
+            break;
+        }
+        case "status":
+            closed(o, [...common, "status"]);
+            status(o.status, o);
+            break;
+        case "retired": {
+            closed(o, [...common, "operationId", "witness"]);
+            text(o.operationId, "operationId");
+            const witness = boundWitness(o.witness, o);
+            if (!("witness" in request) || serviceWitnessDigest(witness) !== serviceWitnessDigest(request.witness))
+                invalid("retired result does not bind the submitted witness");
+            break;
+        }
+        case "denied":
+            closed(o, [...common, "reason"]);
+            text(o.reason, "reason");
+            break;
+    }
+    return JSON.parse(boundedJson(o));
+}
+/** Deterministic bounded spelling; the host must also reject persisted tuple/alias collisions. */
+export function serviceEndpointActor(tuple) {
+    if (!isAccountNkey(tuple.accountPublicKey))
+        invalid("invalid service account public key");
+    spacePrefix(tuple.space);
+    assertDerivedOwnerToken(tuple.owner);
+    endpointToken(tuple.endpoint);
+    assertLifecycleToken(tuple.instanceId, "instanceId");
+    const bytes = canonicalJson([1, tuple.accountPublicKey, tuple.space, tuple.owner, tuple.endpoint, tuple.instanceId, "serve"]);
+    const hash = createHash("sha256").update(bytes, "utf8").digest("hex");
+    return assertBoundedOwner(`svc_${BigInt(`0x${hash}`).toString(36).padStart(50, "0")}`, "service actor");
+}
+export function serviceWitnessDigest(witness) {
+    return contractDigest(parseServiceRegistrationWitness(witness));
+}
+/** Proof secrets are excluded; changing a request body under its persisted id is a conflict. */
+export function serviceAuthorityRequestDigest(request) {
+    return contractDigest(parseServiceAuthorityRequest(request));
+}
+//# sourceMappingURL=remote-service-authority.js.map

package/dist/remote-service-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-service-authority.js","sourceRoot":"","sources":["../src/remote-service-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACjF,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACrI,OAAO,EAAE,gBAAgB,EAAoB,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE3F,OAAO,EAAE,2BAA2B,EAAE,gCAAgC,EAAE,MAAM,+BAA+B,CAAC;AAC9G,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,gCAAgC,EAAE,MAAM,+BAA+B,CAAC;AAUvK,0FAA0F;AAC1F,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACjB;IAA8C;IAApF,YAAY,OAAe,EAAW,OAAmC,EAAW,UAAmB;QACrG,KAAK,CAAC,OAAO,CAAC,CAAC;QADqB,YAAO,GAAP,OAAO,CAA4B;QAAW,eAAU,GAAV,UAAU,CAAS;QAErG,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AAgGD,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,YAAY,CAAU,CAAC;AACvH,MAAM,OAAO,GAAG,CAAC,kBAAkB,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,mBAAmB,CAAU,CAAC;AACnP,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,CAAU,CAAC;AAC5G,MAAM,aAAa,GAAoE;IACrF,QAAQ,EAAE,CAAC,mBAAmB,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC;IAClE,QAAQ,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAC;IAClC,KAAK,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAC;IAC/B,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;IAC1B,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC;IACxC,MAAM,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,eAAe,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;CACpC,CAAC;AACF,MAAM,MAAM,GAA2F;IACrG,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC,EAAE,KAAK,EAAE,CAAC,iBAAiB,CAAC;IACnF,KAAK,EAAE,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAC7D,MAAM,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,CAAC;IACpD,eAAe,EAAE,CAAC,gBAAgB,CAAC;CACpC,CAAC;AAEF,SAAS,OAAO,CAAC,MAAc;IAC7B,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,+BAA+B,MAAM,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,MAAM,CAAC,GAAY,EAAE,IAAY;IACxC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IACxG,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,CAAC,GAAG,IAAI,yBAAyB,CAAC,CAAC;IAC5F,OAAO,GAA8B,CAAC;AACxC,CAAC;AAED,SAAS,MAAM,CAAC,CAA0B,EAAE,QAA2B,EAAE,WAA8B,EAAE;IACvG,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5C,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACzG,OAAO,CAAC,0CAA0C,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,IAAI,CAAC,GAAY,EAAE,IAAY,EAAE,GAAG,GAAG,GAAG;IACjD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,CAAC,GAAG,IAAI,gCAAgC,CAAC,CAAC;IACtH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,GAAY,EAAE,IAAY;IACzC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,IAAI,mCAAmC,CAAC,CAAC;IAC1H,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,+CAA+C,CAAC,CAAC;IACrH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,MAAM,CAAC,GAAY,EAAE,IAAY;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,IAAI,oCAAoC,CAAC,CAAC;IAC5G,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,CAA0B;IAC7C,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,4BAA4B;QAAE,OAAO,CAAC,6BAA6B,CAAC,CAAC;IACjG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAiD,CAAC;QAAE,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAChH,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvB,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IACpC,IAAI,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAAE,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACxH,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;IACjD,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QAAC,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC;IAAC,CAAC;IAC5F,IAAI,MAAM,CAAC,UAAU,CAAC,KAAM,EAAE,MAAM,CAAC,GAAG,2BAA2B;QAAE,OAAO,CAAC,2CAA2C,CAAC,CAAC;IAC1H,OAAO,KAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,GAAY,EAAE,YAAoB;IACnD,yFAAyF;IACzF,iFAAiF;IACjF,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,CAAC,IAAI,YAAY,GAAG,8BAA8B;QAC1G,OAAO,CAAC,iDAAiD,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,YAAY,GAAG,CAAC,8BAA8B,GAAG,CAAC,CAAC;QAC7G,OAAO,CAAC,oDAAoD,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,QAAQ,IAAI,GAAG,EAAE,CAAC;QAC3B,MAAM,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,2BAA2B;YAAE,OAAO,CAAC,iDAAiD,CAAC,CAAC;QAC/H,MAAM,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,CAAC,6BAA6B,CAAC,CAAC;QACzD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,GAAY,EAAE,aAAqB;IAC3E,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACxC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACtD,WAAW,CAAC,aAAa,CAAC,CAAC;IAC3B,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,iCAAiC,IAAI,CAAC,CAAC,KAAK,KAAK,aAAa;QACxF,OAAO,CAAC,uDAAuD,CAAC,CAAC;IACnE,IAAI,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAAE,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAC7H,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,iCAAiC,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC;AACvH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,GAAY;IAC1D,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;IAC9C,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACnB,WAAW,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC3H,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAC3D,MAAM,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;IACtD,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,eAAe,CAAC,CAAC;IACpE,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,cAAc,CAAC,CAAC;IACnF,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACvF,MAAM,CAAC,CAAC,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IAC3C,MAAM,CAAC,CAAC,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IACjD,KAAK,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,sBAAsB,EAAE,uBAAuB,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1G,MAAM,aAAa,GAAG,oBAAoB,CAAC;QACzC,gBAAgB,EAAE,CAAC,CAAC,gBAA0B,EAAE,KAAK,EAAE,CAAC,CAAC,KAAe,EAAE,KAAK,EAAE,SAAS,CAAC,KAAe;QAC1G,QAAQ,EAAE,CAAC,CAAC,QAAkB,EAAE,UAAU,EAAE,CAAC,CAAC,UAAoB;KACnE,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,KAAK,KAAK,aAAa;QAAE,OAAO,CAAC,iDAAiD,CAAC,CAAC;IAClG,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAA+B,CAAC;AAClE,CAAC;AAED,SAAS,YAAY,CAAC,GAAY,EAAE,OAAgC;IAClE,MAAM,OAAO,GAAG,+BAA+B,CAAC,GAAG,CAAC,CAAC;IACrD,KAAK,MAAM,GAAG,IAAI,CAAC,kBAAkB,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,CAAU;QAChF,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,mDAAmD,CAAC,CAAC;IAClG,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,GAAY,EAAE,KAA8B;IAC/D,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;IAC9C,MAAM,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,KAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;WACxG,MAAM,CAAC,OAAO,KAAK,UAAU,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;WAC7F,CAAC,MAAM,CAAC,KAAK,KAAK,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC;QACtE,OAAO,CAAC,iDAAiD,CAAC,CAAC;IAC7D,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,sBAAsB,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,4BAA4B,CAAC,GAAY;IACvD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACjC,WAAW,CAAC,CAAC,CAAC,CAAC;IACf,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC;QACpB,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC;YACnD,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;YAC5D,MAAM,CAAC,YAAY,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,YAAY,CAAC,cAAc,CAAC;YAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,8BAA8B;gBACpG,OAAO,CAAC,iDAAiD,CAAC,CAAC;YAC7D,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC;YACpD,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM;gBAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC;YAClF,SAAS,CAAC,YAAY,CAAC,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;YAC7D,IAAI,QAAQ,CAAC,KAAK,KAAK,cAAc;gBAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;iBAC9D,IAAI,QAAQ,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;gBACzC,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;gBACvC,YAAY,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACpC,CAAC;;gBAAM,OAAO,CAAC,yCAAyC,CAAC,CAAC;YAC1D,MAAM;QACR,CAAC;QACD,KAAK,eAAe;YAClB,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;YACjD,YAAY,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAAC,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAAC,MAAM;QACnE,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;YACjD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;gBAAE,MAAM,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;iBACpD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBACrC,MAAM,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;gBACtC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9B,CAAC;;gBAAM,OAAO,CAAC,2BAA2B,CAAC,CAAC;YAC5C,MAAM;QACR,CAAC;QACD;YACE,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;YAClC,YAAY,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAA4B,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,GAAY;IACxD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAClC,MAAM,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,4BAA4B,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAqC,CAAC;QAClF,OAAO,CAAC,+CAA+C,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;IAC5C,WAAW,CAAC,CAAC,CAAC,CAAC;IACf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAA2B,EAAE,CAAC;AAC/F,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY,EAAE,OAAmC;IACjE,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAC/C,MAAM,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACrF,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;IACpC,MAAM,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3E,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,oBAAoB;QAC3F,IAAI,CAAC,UAAU,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,qBAAqB,IAAI,CAAC,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY;QACtH,OAAO,CAAC,kDAAkD,CAAC,CAAC;IAC9D,SAAS,CAAC,CAAC,CAAC,iBAAiB,EAAE,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,GAAY,EAAE,KAA8B;IAC1D,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACvC,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,KAAK,UAAU;YACb,MAAM,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC,CAAC;YACrD,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YAAC,MAAM,CAAC,CAAC,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;YAAC,MAAM;QACtF,KAAK,uBAAuB;YAC1B,MAAM,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;YAAC,MAAM,CAAC,CAAC,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;YAAC,MAAM;QAC5F,KAAK,aAAa,CAAC;QAAC,KAAK,UAAU;YACjC,MAAM,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;YAC5D,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC3D,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;gBAAE,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YAAC,MAAM;QAC1E,KAAK,YAAY,CAAC;QAAC,KAAK,OAAO,CAAC,CAAC,CAAC;YAChC,MAAM,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5F,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;YACrD,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO;gBAAE,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YAAC,MAAM;QACtE,CAAC;QACD,KAAK,SAAS;YACZ,MAAM,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;YAC/C,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAAC,YAAY,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAAC,MAAM;QAC5E,KAAK,SAAS;YACZ,MAAM,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAAC,MAAM;QACpE,KAAK,YAAY;YACf,MAAM,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,uBAAuB,EAAE,8BAA8B,CAAC,CAAC,CAAC;YAC9E,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;YAAC,SAAS,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC;YAAC,MAAM;QACvF,OAAO,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,2BAA2B,CAAC,GAAY,EAAE,QAAiC;IACzF,MAAM,OAAO,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAChC,WAAW,CAAC,CAAC,CAAC,CAAC;IACf,KAAK,MAAM,GAAG,IAAI,MAAM;QAAE,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,4CAA4C,CAAC,CAAC;IAC7G,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAe,CAAC;QAAE,OAAO,CAAC,iDAAiD,CAAC,CAAC;IAC9H,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,KAAK,mBAAmB,CAAC,CAAC,CAAC;YACzB,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,YAAY,EAAE,gBAAgB,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;YACxE,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YAAC,MAAM,CAAC,CAAC,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;YAC7E,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBAChC,IAAI,GAAQ,CAAC;gBACb,IAAI,CAAC;oBAAC,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;gBAAC,CAAC;gBAC3G,IAAI,GAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAI,CAAC,QAAQ,IAAI,GAAI,CAAC,QAAQ,IAAI,GAAI,CAAC,IAAI;oBAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;YACjH,CAAC;YACD,MAAM;QACR,CAAC;QACD,KAAK,SAAS;YACZ,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC3D,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;gBAAE,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YAAC,MAAM;QAC1E,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC3C,IAAI,OAAO,CAAC,qBAAqB,KAAK,OAAO,CAAC,SAAS;gBAAE,OAAO,CAAC,gDAAgD,CAAC,CAAC;YACnH,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC3C,IAAI,OAAO,CAAC,SAAS,KAAK,UAAU,IAAI,aAAa,CAAC,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,aAAa,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC;gBACvJ,OAAO,CAAC,2DAA2D,CAAC,CAAC;YACvE,MAAM;QACR,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC,CAAC;YAC7H,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;gBAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,IAAI,oBAAoB,CAAC,OAAO,CAAC,KAAK,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC;gBACpG,OAAO,CAAC,6DAA6D,CAAC,CAAC;YACzE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC9B,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;YAAC,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;YACnG,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;YAC/F,MAAM;QACR,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,IAAI,oBAAoB,CAAC,OAAO,CAAC,KAAK,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC;gBACpG,OAAO,CAAC,kDAAkD,CAAC,CAAC;YAC9D,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YAAC,MAAM;QAC7C,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;YACpF,IAAI,OAAO,CAAC,SAAS,KAAK,eAAe;gBAAE,OAAO,CAAC,uCAAuC,CAAC,CAAC;YAC5F,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YACrF,IAAI,oBAAoB,CAAC,OAAO,CAAC,KAAK,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC;mBACtE,aAAa,CAAC,QAAQ,CAAC,KAAK,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,qBAAqB;gBACtG,OAAO,CAAC,iEAAiE,CAAC,CAAC;YAC7E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM;gBAAE,OAAO,CAAC,sCAAsC,CAAC,CAAC;YAClI,KAAK,MAAM,OAAO,IAAI,CAAC,CAAC,QAAQ;gBAAE,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;YACxF,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;YACxD,IAAI,QAAQ,KAAK,CAAC,IAAI,QAAQ,GAAG,gCAAgC;gBAAE,OAAO,CAAC,wCAAwC,CAAC,CAAC;YACrH,MAAM;QACR,CAAC;QACD,KAAK,QAAQ;YACX,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;YAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAAC,MAAM;QAC/D,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;YACjD,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YACnC,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,IAAI,oBAAoB,CAAC,OAAO,CAAC,KAAK,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC;gBACpG,OAAO,CAAC,oDAAoD,CAAC,CAAC;YAChE,MAAM;QACR,CAAC;QACD,KAAK,QAAQ;YACX,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;YAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAAC,MAAM;IACtE,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAA2B,CAAC;AAC9D,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,oBAAoB,CAAC,KAEpC;IACC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,gBAAgB,CAAC;QAAE,OAAO,CAAC,oCAAoC,CAAC,CAAC;IAC1F,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAAC,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9F,oBAAoB,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9H,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,OAAO,kBAAkB,CAAC,OAAO,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;AAC1G,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAmC;IACtE,OAAO,cAAc,CAAC,+BAA+B,CAAC,OAAO,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,6BAA6B,CAAC,OAAgC;IAC5E,OAAO,cAAc,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/dist/service-authority-limits.d.ts

@@ -0,0 +1,5 @@
+export declare const SERVICE_ACCESS_TTL_SECONDS = 60;
+export declare const SERVICE_RENEWAL_TTL_SECONDS: number;
+export declare const SERVICE_AUTHORITY_MAX_BYTES: number;
+export declare const SERVICE_DESCRIBE_QUERY_BUDGET_MS = 2000;
+//# sourceMappingURL=service-authority-limits.d.ts.map

package/dist/service-authority-limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-authority-limits.d.ts","sourceRoot":"","sources":["../src/service-authority-limits.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAC7C,eAAO,MAAM,2BAA2B,QAAe,CAAC;AACxD,eAAO,MAAM,2BAA2B,QAAkB,CAAC;AAC3D,eAAO,MAAM,gCAAgC,OAAQ,CAAC"}

package/dist/service-authority-limits.js

@@ -0,0 +1,5 @@
+export const SERVICE_ACCESS_TTL_SECONDS = 60;
+export const SERVICE_RENEWAL_TTL_SECONDS = 24 * 60 * 60;
+export const SERVICE_AUTHORITY_MAX_BYTES = 2 * 1024 * 1024;
+export const SERVICE_DESCRIBE_QUERY_BUDGET_MS = 2_000;
+//# sourceMappingURL=service-authority-limits.js.map

package/dist/service-authority-limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-authority-limits.js","sourceRoot":"","sources":["../src/service-authority-limits.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAC7C,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACxD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC3D,MAAM,CAAC,MAAM,gCAAgC,GAAG,KAAK,CAAC"}

package/dist/service-gate.d.ts

@@ -0,0 +1,42 @@
+import type { EpCapability } from "./endpoint-grants.js";
+/** Broker-authenticated connection coordinates. The client inbox nonce is not this identity. */
+export interface ServiceConnectionBinding {
+    userNkey: string;
+    serverId: string;
+    clientId: number;
+}
+/** Syntax and checksum checks only; the encrypted callout authenticates these coordinates. */
+export declare function parseServiceConnectionBinding(raw: unknown): ServiceConnectionBinding;
+export interface ServiceRegistrationIdentity {
+    operationId: string;
+    requestId: string;
+    requestDigest: string;
+}
+export interface ServiceRegistrationStamp extends ServiceRegistrationIdentity {
+    processEpoch: number;
+    registrationRevision: number;
+    nameAuthorityRevision: number;
+    registrationProof: string;
+}
+/** Native service approval coordinates on the endpoint's own release-fence key. Expiries are Unix seconds. */
+export interface ServiceGateAuthority {
+    v: 1;
+    assignmentDigest: string;
+    lifecycleUid: string;
+    state: "pending-root" | "approved" | "revoked";
+    rootCredentialId: string | null;
+    rootExpiresAt: number | null;
+    approvalDigest: string | null;
+    approvalExpiresAt: number | null;
+    callerCeiling: EpCapability[];
+    activationIssued: boolean;
+    registration?: ServiceRegistrationStamp;
+    pendingRegistration?: ServiceRegistrationIdentity;
+}
+/** The identity persisted under the registration freeze, before any spec write. */
+export declare function parseServiceRegistrationIdentity(raw: unknown): ServiceRegistrationIdentity;
+/** Stored-row syntax only. Native root custody and owner consent are checked by the host. */
+export declare function parseServiceGateAuthority(raw: unknown): ServiceGateAuthority;
+/** An expired or revoked approval never becomes usable merely because a registration reopens its gate. */
+export declare function serviceGateApprovalLive(authority: ServiceGateAuthority, nowSeconds: number): boolean;
+//# sourceMappingURL=service-gate.d.ts.map

package/dist/service-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-gate.d.ts","sourceRoot":"","sources":["../src/service-gate.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGzD,gGAAgG;AAChG,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,8FAA8F;AAC9F,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,OAAO,GAAG,wBAAwB,CAUpF;AAED,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB;AACD,MAAM,WAAW,wBAAyB,SAAQ,2BAA2B;IAC3E,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,8GAA8G;AAC9G,MAAM,WAAW,oBAAoB;IACnC,CAAC,EAAE,CAAC,CAAC;IACL,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,GAAG,UAAU,GAAG,SAAS,CAAC;IAC/C,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,wBAAwB,CAAC;IACxC,mBAAmB,CAAC,EAAE,2BAA2B,CAAC;CACnD;AAMD,mFAAmF;AACnF,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,OAAO,GAAG,2BAA2B,CAS1F;AAED,6FAA6F;AAC7F,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,oBAAoB,CAiC5E;AAED,0GAA0G;AAC1G,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAIpG"}

package/dist/service-gate.js

@@ -0,0 +1,99 @@
+import { fromPublic } from "@nats-io/nkeys";
+import { isContractDigest } from "./canonical.js";
+import { EpEnvelopeError } from "./endpoint-error.js";
+import { parseEndpointCapabilities } from "./endpoint-capability-policy.js";
+import { assertLifecycleToken } from "./endpoint-subjects.js";
+/** Syntax and checksum checks only; the encrypted callout authenticates these coordinates. */
+export function parseServiceConnectionBinding(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        bad();
+    const o = raw;
+    if (Object.getPrototypeOf(raw) !== Object.prototype && Object.getPrototypeOf(raw) !== null)
+        bad();
+    if (Reflect.ownKeys(o).length !== 3 || Object.keys(o).some((k) => !["userNkey", "serverId", "clientId"].includes(k))
+        || typeof o.userNkey !== "string" || !/^U[A-Z2-7]{55}$/.test(o.userNkey)
+        || typeof o.serverId !== "string" || !/^N[A-Z2-7]{55}$/.test(o.serverId)
+        || typeof o.clientId !== "number" || !Number.isSafeInteger(o.clientId) || o.clientId <= 0)
+        bad();
+    try {
+        fromPublic(o.userNkey);
+        fromPublic(o.serverId);
+    }
+    catch {
+        bad();
+    }
+    return { userNkey: o.userNkey, serverId: o.serverId, clientId: o.clientId };
+}
+function bad() { throw new EpEnvelopeError("internal", "invalid native service gate authority"); }
+function digest(raw) { return typeof raw === "string" && isContractDigest(raw); }
+function expiry(raw) { return typeof raw === "number" && Number.isSafeInteger(raw) && raw > 0; }
+/** The identity persisted under the registration freeze, before any spec write. */
+export function parseServiceRegistrationIdentity(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        bad();
+    const r = raw;
+    if (Object.getPrototypeOf(raw) !== Object.prototype && Object.getPrototypeOf(raw) !== null)
+        bad();
+    if (Reflect.ownKeys(r).some((k) => typeof k !== "string" || !["operationId", "requestId", "requestDigest"].includes(k)))
+        bad();
+    if (Reflect.ownKeys(r).length !== 3 || typeof r.operationId !== "string" || typeof r.requestId !== "string"
+        || !/^[a-f0-9]{32}$/.test(r.requestId) || !digest(r.requestDigest))
+        bad();
+    assertLifecycleToken(r.operationId, "service registration operationId");
+    return r;
+}
+/** Stored-row syntax only. Native root custody and owner consent are checked by the host. */
+export function parseServiceGateAuthority(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        bad();
+    const proto = Object.getPrototypeOf(raw);
+    if (proto !== Object.prototype && proto !== null)
+        bad();
+    const o = raw;
+    const required = ["v", "assignmentDigest", "lifecycleUid", "state", "rootCredentialId", "rootExpiresAt", "approvalDigest", "approvalExpiresAt", "callerCeiling", "activationIssued"];
+    if (required.some((k) => !Object.hasOwn(o, k)) || Reflect.ownKeys(o).some((k) => typeof k !== "string" || ![...required, "registration", "pendingRegistration"].includes(k)))
+        bad();
+    if (o.v !== 1 || !digest(o.assignmentDigest) || typeof o.lifecycleUid !== "string" || typeof o.activationIssued !== "boolean")
+        bad();
+    assertLifecycleToken(o.lifecycleUid, "service lifecycleUid");
+    if (o.state !== "pending-root" && o.state !== "approved" && o.state !== "revoked")
+        bad();
+    const ceiling = parseEndpointCapabilities(o.callerCeiling);
+    if (o.rootCredentialId === null) {
+        if (o.rootExpiresAt !== null || o.approvalDigest !== null || o.approvalExpiresAt !== null || ceiling.length || o.activationIssued || o.registration !== undefined || o.pendingRegistration !== undefined || o.state === "approved")
+            bad();
+    }
+    else {
+        if (typeof o.rootCredentialId !== "string" || !expiry(o.rootExpiresAt) || !digest(o.approvalDigest) || (o.approvalExpiresAt !== null && !expiry(o.approvalExpiresAt)) || o.state === "pending-root")
+            bad();
+        assertLifecycleToken(o.rootCredentialId, "service root credentialId");
+    }
+    if (o.registration !== undefined) {
+        if (!o.registration || typeof o.registration !== "object" || Array.isArray(o.registration))
+            bad();
+        const r = o.registration;
+        if (Reflect.ownKeys(r).length !== 7 || Reflect.ownKeys(r).some((k) => typeof k !== "string"
+            || !["operationId", "requestId", "requestDigest", "registrationProof", "processEpoch", "registrationRevision", "nameAuthorityRevision"].includes(k))
+            || !digest(r.registrationProof))
+            bad();
+        parseServiceRegistrationIdentity({ operationId: r.operationId, requestId: r.requestId, requestDigest: r.requestDigest });
+        if (typeof r.processEpoch !== "number" || !Number.isSafeInteger(r.processEpoch) || r.processEpoch < 0
+            || !expiry(r.registrationRevision) || !expiry(r.nameAuthorityRevision))
+            bad();
+    }
+    if (o.pendingRegistration !== undefined) {
+        parseServiceRegistrationIdentity(o.pendingRegistration);
+        if (o.activationIssued)
+            bad();
+    }
+    if (o.activationIssued && o.registration === undefined)
+        bad();
+    return o;
+}
+/** An expired or revoked approval never becomes usable merely because a registration reopens its gate. */
+export function serviceGateApprovalLive(authority, nowSeconds) {
+    return Number.isSafeInteger(nowSeconds) && nowSeconds >= 0 && authority.state === "approved"
+        && authority.rootExpiresAt !== null && authority.rootExpiresAt > nowSeconds
+        && (authority.approvalExpiresAt === null || authority.approvalExpiresAt > nowSeconds);
+}
+//# sourceMappingURL=service-gate.js.map

package/dist/service-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-gate.js","sourceRoot":"","sources":["../src/service-gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAE5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,8FAA8F;AAC9F,MAAM,UAAU,6BAA6B,CAAC,GAAY;IACxD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,GAAG,EAAE,CAAC;IACjE,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,IAAI;QAAE,GAAG,EAAE,CAAC;IAClG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;WAC/G,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;WACrE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;WACrE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC;QAAE,GAAG,EAAE,CAAC;IACnG,IAAI,CAAC;QAAC,UAAU,CAAC,CAAC,CAAC,QAAkB,CAAC,CAAC;QAAC,UAAU,CAAC,CAAC,CAAC,QAAkB,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,GAAG,EAAE,CAAC;IAAC,CAAC;IAC5F,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAkB,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAkB,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAkB,EAAE,CAAC;AAC5G,CAAC;AA8BD,SAAS,GAAG,KAAY,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,uCAAuC,CAAC,CAAC,CAAC,CAAC;AACzG,SAAS,MAAM,CAAC,GAAY,IAAa,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACnG,SAAS,MAAM,CAAC,GAAY,IAAa,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;AAElH,mFAAmF;AACnF,MAAM,UAAU,gCAAgC,CAAC,GAAY;IAC3D,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,GAAG,EAAE,CAAC;IACjE,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,IAAI;QAAE,GAAG,EAAE,CAAC;IAClG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,GAAG,EAAE,CAAC;IAC/H,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;WACtG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC;QAAE,GAAG,EAAE,CAAC;IAC5E,oBAAoB,CAAC,CAAC,CAAC,WAAqB,EAAE,kCAAkC,CAAC,CAAC;IAClF,OAAO,CAA2C,CAAC;AACrD,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,yBAAyB,CAAC,GAAY;IACpD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,GAAG,EAAE,CAAC;IACjE,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,GAAG,EAAE,CAAC;IACxD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,kBAAkB,EAAE,cAAc,EAAE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,eAAe,EAAE,kBAAkB,CAAC,CAAC;IACrL,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,QAAQ,EAAE,cAAc,EAAE,qBAAqB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,GAAG,EAAE,CAAC;IACpL,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,gBAAgB,KAAK,SAAS;QAAE,GAAG,EAAE,CAAC;IACrI,oBAAoB,CAAC,CAAC,CAAC,YAAsB,EAAE,sBAAsB,CAAC,CAAC;IACvE,IAAI,CAAC,CAAC,KAAK,KAAK,cAAc,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;QAAE,GAAG,EAAE,CAAC;IACzF,MAAM,OAAO,GAAG,yBAAyB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IAC3D,IAAI,CAAC,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,CAAC,iBAAiB,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,CAAC,mBAAmB,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU;YAAE,GAAG,EAAE,CAAC;IAC5O,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,cAAc;YAAE,GAAG,EAAE,CAAC;QAC3M,oBAAoB,CAAC,CAAC,CAAC,gBAA0B,EAAE,2BAA2B,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;YAAE,GAAG,EAAE,CAAC;QAClG,MAAM,CAAC,GAAG,CAAC,CAAC,YAAuC,CAAC;QACpD,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ;eACtF,CAAC,CAAC,aAAa,EAAE,WAAW,EAAE,eAAe,EAAE,mBAAmB,EAAE,cAAc,EAAE,sBAAsB,EAAE,uBAAuB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;eACjJ,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC;YAAE,GAAG,EAAE,CAAC;QACzC,gCAAgC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;QACzH,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,YAAY,GAAG,CAAC;eAChG,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC;YAAE,GAAG,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACxC,gCAAgC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;QACxD,IAAI,CAAC,CAAC,gBAAgB;YAAE,GAAG,EAAE,CAAC;IAChC,CAAC;IACD,IAAI,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS;QAAE,GAAG,EAAE,CAAC;IAC9D,OAAO,CAAoC,CAAC;AAC9C,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,uBAAuB,CAAC,SAA+B,EAAE,UAAkB;IACzF,OAAO,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,IAAI,SAAS,CAAC,KAAK,KAAK,UAAU;WACvF,SAAS,CAAC,aAAa,KAAK,IAAI,IAAI,SAAS,CAAC,aAAa,GAAG,UAAU;WACxE,CAAC,SAAS,CAAC,iBAAiB,KAAK,IAAI,IAAI,SAAS,CAAC,iBAAiB,GAAG,UAAU,CAAC,CAAC;AAC1F,CAAC"}