@devlab.group/agent-commerce 2.0.0 → 2.1.0

package/dist/ap2.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/authorization/ap2/errors.ts","../src/authorization/ap2/sha256.ts","../src/authorization/ap2/profile.ts","../src/authorization/ap2/checkout-signer.ts","../src/authorization/ap2/descriptor.ts","../src/authorization/ap2/replay-store.ts","../src/authorization/ap2/checkout-jwt.ts","../src/authorization/ap2/sd-jwt.ts","../src/authorization/ap2/trust.ts","../src/authorization/ap2/verifier.ts","../src/authorization/ap2/provider.ts"],"names":["jwtVerify"],"mappings":";;;;;;;;;AAqBO,IAAM,qBAAA,GAAwB;AAAA,EACnC,wBAAA;AAAA,EACA,kBAAA;AAAA,EACA,aAAA;AAAA,EACA,mBAAA;AAAA,EACA,gBAAA;AAAA,EACA,SAAA;AAAA,EACA,gBAAA;AAAA,EACA,0BAAA;AAAA,EACA,yBAAA;AAAA,EACA;AACF;AAIA,IAAM,QAAA,GAAyD;AAAA,EAC7D,sBAAA,EAAwB,6DAAA;AAAA,EACxB,gBAAA,EAAkB,iEAAA;AAAA,EAClB,WAAA,EAAa,+DAAA;AAAA,EACb,iBAAA,EAAmB,uCAAA;AAAA,EACnB,cAAA,EAAgB,+DAAA;AAAA,EAChB,OAAA,EAAS,0CAAA;AAAA,EACT,cAAA,EAAgB,mDAAA;AAAA,EAChB,wBAAA,EAA0B,sDAAA;AAAA,EAC1B,uBAAA,EAAyB,qEAAA;AAAA,EACzB,iBAAA,EAAmB;AACrB,CAAA;AASO,SAAS,WAAA,CACd,MAAA,EACA,OAAA,GAA2B,EAAC,EACb;AACf,EAAA,OAAO,IAAI,aAAA,CAAc,uBAAA,EAAyB,QAAA,CAAS,MAAM,CAAA,EAAG;AAAA,IAClE,OAAA,EAAS,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAA,EAAO;AAAA,IACjC,GAAI,QAAQ,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,EAAW,OAAA,CAAQ,SAAA,EAAU,GAAI,EAAC;AAAA,IAC1E,GAAI,QAAQ,UAAA,KAAe,MAAA,GAAY,EAAE,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAW,GAAI,EAAC;AAAA,IAC7E,GAAI,QAAQ,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAM,GAAI;AAAC,GAC/D,CAAA;AACH;AAMO,SAAS,WAAA,CAAY,KAAA,EAAe,OAAA,GAA2B,EAAC,EAAkB;AACvF,EAAA,OAAO,IAAI,aAAA;AAAA,IACT,wBAAA;AAAA,IACA,gFAAA;AAAA,IACA;AAAA,MACE,SAAS,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAA,EAAQ,YAAY,KAAA,EAAM;AAAA,MACpD,GAAI,QAAQ,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,EAAW,OAAA,CAAQ,SAAA,EAAU,GAAI,EAAC;AAAA,MAC1E,GAAI,QAAQ,UAAA,KAAe,MAAA,GAAY,EAAE,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAW,GAAI;AAAC;AAC/E,GACF;AACF;AAMO,SAAS,cAAA,CAAe,MAAA,EAAgB,OAAA,GAA2B,EAAC,EAAkB;AAC3F,EAAA,OAAO,IAAI,aAAA;AAAA,IACT,oCAAA;AAAA,IACA,yHAAA;AAAA,IACA;AAAA,MACE,SAAS,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAA,EAAQ,wBAAwB,MAAA,EAAO;AAAA,MACjE,GAAI,QAAQ,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,EAAW,OAAA,CAAQ,SAAA,EAAU,GAAI,EAAC;AAAA,MAC1E,GAAI,QAAQ,UAAA,KAAe,MAAA,GAAY,EAAE,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAW,GAAI,EAAC;AAAA,MAC7E,GAAI,QAAQ,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAM,GAAI;AAAC;AAChE,GACF;AACF;AChGO,SAAS,OAAO,IAAA,EAAmC;AACxD,EAAA,OAAO,WAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,IAAI,EAAE,MAAA,EAAO;AAClD;;;ACeA,IAAM,uBAAA,GAA0B;AAAA,EAC9B,SAAA;AAAA,EACA,aAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA;AAgBO,SAAS,iBAAiB,KAAA,EAAwB;AACvD,EAAA,MAAM,SAAA,GAAY,YAAA,CAAa,KAAA,IAAS,EAAE,CAAA;AAI1C,EAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,IAAA,MAAM,IAAI,aAAA,CAAc,gBAAA,EAAkB,4CAA4C,CAAA;AAAA,EACxF;AACA,EAAA,OAAO,MAAA,CAAO,SAAS,CAAA,CAAE,QAAA,CAAS,WAAW,CAAA;AAC/C;AAEA,IAAM,WAAA,GAAc,mBAAA;AAIpB,SAAS,cAAA,CAAe,UAAmB,QAAA,EAAuC;AAChF,EAAA,IAAI,OAAO,QAAA,KAAa,QAAA,IAAY,QAAA,KAAa,MAAA,EAAW;AAC1D,IAAA,IAAI,YAAY,IAAA,CAAK,QAAQ,KAAK,WAAA,CAAY,IAAA,CAAK,QAAQ,CAAA,EAAG;AAC5D,MAAA,OAAO,QAAA,CAAS,WAAA,EAAY,KAAM,QAAA,CAAS,WAAA,EAAY;AAAA,IACzD;AAAA,EACF;AACA,EAAA,OAAO,QAAA,KAAa,QAAA;AACtB;AAOA,eAAsB,qBAAA,CACpB,OAAA,EACA,OAAA,EACA,YAAA,EACe;AACf,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,cAAA,CAAe,gBAAgB,CAAA;AACvD,EAAA,IAAI,CAAC,QAAA,CAAS,OAAO,GAAG,MAAM,WAAA,CAAY,qBAAqB,YAAY,CAAA;AAE3E,EAAA,KAAA,MAAW,SAAS,uBAAA,EAAyB;AAC3C,IAAA,MAAM,KAAA,GAAQ,QAAQ,KAAK,CAAA;AAC3B,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,WAAW,CAAA,EAAG;AACnD,MAAA,MAAM,WAAA,CAAY,qBAAqB,YAAY,CAAA;AAAA,IACrD;AAAA,EACF;AAEA,EAAA,MAAM,cAAc,OAAA,CAAQ,WAAA;AAC5B,EAAA,MAAM,iBAAA,GAAoB,gBAAA,CAAiB,OAAA,CAAQ,KAAK,CAAA;AAExD,EAAA,MAAM,SAAA,GAAqD;AAAA,IACzD,CAAC,WAAW,oBAAoB,CAAA;AAAA,IAChC,CAAC,aAAA,EAAe,OAAA,CAAQ,UAAU,CAAA;AAAA,IAClC,CAAC,cAAc,iBAAiB,CAAA;AAAA;AAAA;AAAA,IAGhC,CAAC,QAAA,EAAU,WAAA,CAAY,MAAM,CAAA;AAAA,IAC7B,CAAC,UAAA,EAAY,WAAA,CAAY,QAAQ,CAAA;AAAA,IACjC,CAAC,gBAAA,EAAkB,WAAA,CAAY,QAAQ;AAAA,GACzC;AAEA,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,QAAQ,CAAA,IAAK,SAAA,EAAW;AACzC,IAAA,IAAI,QAAQ,KAAK,CAAA,KAAM,UAAU,MAAM,WAAA,CAAY,qBAAqB,YAAY,CAAA;AAAA,EACtF;AAKA,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,QAAQ,CAAA,IAAK;AAAA,IAC9B,CAAC,aAAA,EAAe,WAAA,CAAY,WAAW,CAAA;AAAA,IACvC,CAAC,SAAA,EAAW,WAAA,CAAY,OAAO,CAAA;AAAA,IAC/B,CAAC,OAAA,EAAS,WAAA,CAAY,KAAK;AAAA,GAC7B,EAAY;AACV,IAAA,MAAM,QAAA,GAAW,QAAQ,KAAK,CAAA;AAC9B,IAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,KAAa,MAAA,EAAW;AACtD,IAAA,IAAI,CAAC,eAAe,QAAA,EAAU,QAAQ,GAAG,MAAM,WAAA,CAAY,qBAAqB,YAAY,CAAA;AAAA,EAC9F;AACF;;;AC/CA,IAAM,0BAAA,GAA6B,GAAA;AAEnC,SAAS,WAAA,CAAY,OAAgB,KAAA,EAAuB;AAC1D,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,WAAW,CAAA,EAAG;AACnD,IAAA,MAAM,IAAI,SAAA;AAAA,MACR,CAAA,mBAAA,EAAsB,KAAK,CAAA,sCAAA,EAAyC,QAAA,CAAS,KAAK,CAAC,CAAA;AAAA,KACrF;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,SAAS,KAAA,EAAwB;AACxC,EAAA,OAAO,KAAA,KAAU,IAAA,GAAO,MAAA,GAAS,OAAO,KAAA;AAC1C;AAOA,eAAe,WACb,GAAA,EACwD;AACxD,EAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,IAAA,IAAI,CAAC,GAAA,CAAI,QAAA,CAAS,mBAAmB,CAAA,EAAG;AACtC,MAAA,MAAM,IAAI,SAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO,WAAA,CAAY,KAAK,qBAAqB,CAAA;AAAA,EAC/C;AACA,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,IAAA,EAAM;AAC3C,IAAA,MAAM,IAAI,UAAU,qEAAqE,CAAA;AAAA,EAC3F;AACA,EAAA,IAAI,GAAA,CAAI,GAAG,CAAA,KAAM,MAAA,EAAW;AAC1B,IAAA,MAAM,IAAI,SAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,IAAI,KAAK,CAAA,KAAM,gBAAgB,GAAA,CAAI,KAAK,MAAM,aAAA,EAAe;AAC/D,IAAA,MAAM,IAAI,SAAA;AAAA,MACR,CAAA,sCAAA,EAAyC,YAAY,CAAA,CAAA,EAAI,aAAa,cAAc,qBAAqB,CAAA,QAAA;AAAA,KAC3G;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAMA,eAAsB,kBAAkB,OAAA,EAAoD;AAC1F,EAAA,MAAM,GAAA,GAAM,WAAA,CAAY,OAAA,CAAQ,GAAA,EAAK,KAAK,CAAA;AAC1C,EAAA,MAAM,MAAA,GAAS,WAAA,CAAY,OAAA,CAAQ,MAAA,EAAQ,QAAQ,CAAA;AACnD,EAAA,MAAM,QAAA,GAAW,WAAA,CAAY,OAAA,CAAQ,QAAA,EAAU,UAAU,CAAA;AACzD,EAAA,MAAM,UAAA,GAAa,WAAA,CAAY,OAAA,CAAQ,UAAA,EAAY,YAAY,CAAA;AAC/D,EAAA,MAAM,QAAA,GAAW,WAAA,CAAY,OAAA,CAAQ,QAAA,EAAU,UAAU,CAAA;AACzD,EAAA,MAAM,aAAA,GAAgB,WAAA,CAAY,OAAA,CAAQ,aAAA,EAAe,eAAe,CAAA;AAExE,EAAA,IAAI,OAAO,OAAA,CAAQ,MAAA,KAAW,QAAA,EAAU;AACtC,IAAA,MAAM,IAAI,SAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAS,WAAA,CAAY,OAAA,CAAQ,MAAA,EAAQ,QAAQ,CAAA;AAEnD,EAAA,MAAM,GAAA,GAAM,MAAM,UAAA,CAAW,OAAA,CAAQ,UAAU,CAAA;AAC/C,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAA,CAAO,OAAA,CAAQ,GAAA,wBAAW,IAAA,EAAK,EAAG,OAAA,EAAQ,GAAI,GAAI,CAAA;AACxE,EAAA,MAAM,SAAA,GAAY,QAAQ,gBAAA,IAAoB,0BAAA;AAC9C,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,SAAS,CAAA,IAAK,aAAa,CAAA,EAAG;AAClD,IAAA,MAAM,IAAI,UAAU,qEAAqE,CAAA;AAAA,EAC3F;AAEA,EAAA,MAAM,aAAA,GAAwC;AAAA,IAC5C,OAAA,EAAS,oBAAA;AAAA,IACT,WAAA,EAAa,UAAA;AAAA,IACb,UAAA,EAAY,gBAAA,CAAiB,OAAA,CAAQ,KAAK,CAAA;AAAA,IAC1C,MAAA;AAAA,IACA,QAAA;AAAA,IACA,cAAA,EAAgB,aAAA;AAAA,IAChB,GAAI,QAAQ,WAAA,KAAgB,MAAA,GAAY,EAAE,WAAA,EAAa,OAAA,CAAQ,WAAA,EAAY,GAAI,EAAC;AAAA,IAChF,GAAI,QAAQ,OAAA,KAAY,MAAA,GAAY,EAAE,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAQ,GAAI,EAAC;AAAA,IACpE,GAAI,QAAQ,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAM,GAAI;AAAC,GAChE;AAEA,EAAA,OAAO,IAAI,OAAA,CAAQ,EAAE,cAAA,EAAgB,aAAA,EAAe,CAAA,CACjD,kBAAA,CAAmB,EAAE,GAAA,EAAK,uBAAuB,GAAA,EAAK,GAAA,EAAK,KAAA,EAAO,EAClE,SAAA,CAAU,MAAM,CAAA,CAChB,WAAA,CAAY,QAAQ,CAAA,CACpB,WAAA,CAAY,QAAQ,CAAA,CACpB,kBAAkB,QAAA,GAAW,SAAS,CAAA,CACtC,MAAA,CAAO,QAAQ,KAAA,IAAS,MAAA,CAAO,YAAY,CAAA,CAC3C,KAAK,GAAG,CAAA;AACb;;;ACnJO,IAAM,gBAAA,GAAsC;AAAA,EACjD,aAAA;AAAA,EACA,wBAAA;AAAA,EACA,wBAAA;AAAA,EACA,qBAAA;AAAA,EACA,qBAAA;AAAA,EACA,oBAAA;AAAA,EACA,qBAAA;AAAA,EACA,+BAAA;AAAA,EACA,oBAAA;AAAA,EACA,kBAAA;AAAA,EACA;AACF;AAOO,IAAM,eAAA,GAAqC;AAAA;AAAA,EAEhD,iBAAA;AAAA,EACA,kDAAA;AAAA,EACA,sCAAA;AAAA,EACA,gCAAA;AAAA,EACA,sBAAA;AAAA;AAAA,EAEA,wCAAA;AAAA,EACA,wCAAA;AAAA;AAAA,EAEA,8CAAA;AAAA,EACA,0BAAA;AAAA,EACA,sCAAA;AAAA;AAAA,EAEA,uCAAA;AAAA,EACA,sCAAA;AAAA;AAAA,EAEA,kBAAA;AAAA,EACA,mBAAA;AAAA,EACA;AACF;AAEO,SAAS,mBAAmB,qBAAA,EAAkD;AACnF,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,KAAA;AAAA,IACN,IAAA,EAAM,eAAA;AAAA,IACN,qBAAA;AAAA,IACA,aAAA,EAAe,QAAQ,gBAAgB,CAAA,YAAA,CAAA;AAAA,IACvC,YAAA,EAAc,gBAAA;AAAA,IACd,MAAA,EAAQ,cAAA;AAAA,IACR,WAAA,EAAa;AAAA,GACf;AACF;;;ACQO,SAAS,qBAAqB,OAAA,EAAgD;AACnF,EAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,IAAU,WAAA;AACjC,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,KAAQ,MAAM,KAAK,GAAA,EAAI,CAAA;AAE3C,EAAA,MAAM,KAAe,kBAAA,CAAmB;AAAA,IACtC,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,KAAA,EAAO,4BAAA;AAAA,IACP;AAAA,GACD,CAAA;AACD,EAAA,OAAA,CAAQ,EAAE,CAAA;AAEV,EAAA,MAAM,oBAAoB,EAAA,CAAG,OAAA;AAAA,IAC3B;AAAA,GACF;AAGA,EAAA,MAAM,kBAAkB,EAAA,CAAG,OAAA;AAAA,IACzB,CAAA;AAAA,uEAAA;AAAA,GAEF;AACA,EAAA,MAAM,SAAS,EAAA,CAAG,OAAA;AAAA,IAChB,CAAA;AAAA;AAAA;AAAA;AAAA,+CAAA;AAAA,GAKF;AACA,EAAA,MAAM,YAAY,EAAA,CAAG,OAAA;AAAA,IACnB,CAAA;AAAA;AAAA,yDAAA;AAAA,GAGF;AAGA,EAAA,MAAM,aAAa,EAAA,CAAG,OAAA;AAAA,IACpB,CAAA;AAAA,yDAAA;AAAA,GAEF;AAEA,EAAA,MAAM,SAAA,GAAY,EAAA,CAAG,WAAA,CAAY,CAAC,OAAA,KAAyD;AACzF,IAAA,MAAM,KAAK,IAAI,IAAA,CAAK,GAAA,EAAK,EAAE,WAAA,EAAY;AAEvC,IAAA,MAAM,QAAA,GAAW,iBAAA,CAAkB,GAAA,CAAI,OAAA,CAAQ,SAAS,CAAA;AACxD,IAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,CAAS,KAAA,KAAU,UAAA,EAAY;AAC3D,MAAA,OAAO,EAAE,IAAA,EAAM,UAAA,EAAY,KAAA,EAAO,SAAS,KAAA,EAA+B;AAAA,IAC5E;AAIA,IAAA,MAAM,eAAe,eAAA,CAAgB,GAAA,CAAI,OAAA,CAAQ,WAAA,EAAa,QAAQ,SAAS,CAAA;AAC/E,IAAA,IAAI,iBAAiB,MAAA,EAAW;AAC9B,MAAA,OAAO,EAAE,IAAA,EAAM,UAAA,EAAY,KAAA,EAAO,aAAa,KAAA,EAA+B;AAAA,IAChF;AAEA,IAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,MAAA,SAAA,CAAU,GAAA,CAAI,EAAE,SAAA,EAAW,OAAA,CAAQ,WAAW,UAAA,EAAY,OAAA,CAAQ,SAAA,EAAW,EAAA,EAAI,CAAA;AACjF,MAAA,OAAO,EAAE,MAAM,UAAA,EAAW;AAAA,IAC5B;AAEA,IAAA,MAAA,CAAO,GAAA,CAAI;AAAA,MACT,WAAW,OAAA,CAAQ,SAAA;AAAA,MACnB,cAAc,OAAA,CAAQ,WAAA;AAAA,MACtB,gBAAgB,OAAA,CAAQ,aAAA;AAAA,MACxB,iBAAiB,OAAA,CAAQ,cAAA;AAAA,MACzB,aAAa,OAAA,CAAQ,UAAA;AAAA,MACrB,YAAY,OAAA,CAAQ,SAAA;AAAA,MACpB;AAAA,KACD,CAAA;AACD,IAAA,OAAO,EAAE,MAAM,UAAA,EAAW;AAAA,EAC5B,CAAC,CAAA;AAED,EAAA,MAAM,IAAA,GAAO,CAAC,SAAA,EAAmB,KAAA,KAAuC;AACtE,IAAA,UAAA,CAAW,GAAA,CAAI,EAAE,SAAA,EAAW,KAAA,EAAO,EAAA,EAAI,IAAI,IAAA,CAAK,GAAA,EAAK,CAAA,CAAE,WAAA,EAAY,EAAG,CAAA;AAAA,EACxE,CAAA;AAEA,EAAA,IAAI,MAAA,GAAS,KAAA;AACb,EAAA,OAAO;AAAA,IACL,QAAQ,OAAA,EAAS;AACf,MAAA,OAAO,UAAU,OAAO,CAAA;AAAA,IAC1B,CAAA;AAAA,IACA,QAAQ,SAAA,EAAW;AACjB,MAAA,IAAA,CAAK,WAAW,UAAU,CAAA;AAAA,IAC5B,CAAA;AAAA,IACA,QAAQ,SAAA,EAAW;AACjB,MAAA,IAAA,CAAK,WAAW,UAAU,CAAA;AAAA,IAC5B,CAAA;AAAA,IACA,cAAc,SAAA,EAAW;AACvB,MAAA,IAAA,CAAK,WAAW,WAAW,CAAA;AAAA,IAC7B,CAAA;AAAA,IACA,QAAQ,SAAA,EAAW;AACjB,MAAA,OAAO,iBAAA,CAAkB,GAAA,CAAI,SAAS,CAAA,EAAG,KAAA;AAAA,IAC3C,CAAA;AAAA,IACA,KAAA,GAAQ;AACN,MAAA,IAAI,MAAA,EAAQ;AACZ,MAAA,MAAA,GAAS,IAAA;AACT,MAAA,EAAA,CAAG,KAAA,EAAM;AAAA,IACX;AAAA,GACF;AACF;AAGA,SAAS,QAAQ,EAAA,EAAoB;AACnC,EAAA,MAAM,UAAU,EAAA,CAAG,MAAA,CAAO,gBAAgB,EAAE,MAAA,EAAQ,MAAM,CAAA;AAC1D,EAAA,IAAI,WAAW,CAAA,EAAG;AAClB,EAAA,MAAM,KAAA,GAAQ,EAAA,CAAG,WAAA,CAAY,MAAM;AACjC,IAAA,EAAA,CAAG,IAAA,CAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAAA,CAeP,CAAA;AACD,IAAA,EAAA,CAAG,OAAO,kBAAkB,CAAA;AAAA,EAC9B,CAAC,CAAA;AACD,EAAA,KAAA,EAAM;AACR;AC/KA,eAAsB,iBAAA,CACpB,aAAA,EACA,IAAA,EACA,OAAA,EAC8B;AAC9B,EAAA,MAAM,OAAA,GAAU,cAAc,cAAc,CAAA;AAC5C,EAAA,MAAM,YAAA,GAAe,cAAc,eAAe,CAAA;AAClD,EAAA,IAAI,OAAO,OAAA,KAAY,QAAA,IAAY,OAAA,CAAQ,WAAW,CAAA,EAAG;AACvD,IAAA,MAAM,WAAA,CAAY,kBAAkB,OAAO,CAAA;AAAA,EAC7C;AACA,EAAA,IAAI,OAAO,YAAA,KAAiB,QAAA,IAAY,YAAA,CAAa,WAAW,CAAA,EAAG;AACjE,IAAA,MAAM,WAAA,CAAY,kBAAkB,OAAO,CAAA;AAAA,EAC7C;AAEA,EAAA,mBAAA,CAAoB,OAAA,EAAS,cAAc,OAAO,CAAA;AAGlD,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,iBAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,sBAAsB,OAAO,CAAA;AACtC,IAAA,iBAAA,GAAoB,UAAU,OAAO,CAAA;AAAA,EACvC,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,YAAY,yBAAA,EAA2B,EAAE,GAAG,OAAA,EAAS,OAAO,CAAA;AAAA,EACpE;AAEA,EAAA,MAAM,EAAE,MAAA,EAAQ,GAAA,EAAI,GAAI,MAAM,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,iBAAA,CAAkB,GAAA,EAAK,MAAA,CAAO,GAAA,EAAK,OAAO,CAAA;AAE3F,EAAA,MAAM,OAAA,GAA4B;AAAA,IAChC,UAAA,EAAY,CAAC,qBAAqB,CAAA;AAAA,IAClC,QAAQ,MAAA,CAAO,MAAA;AAAA,IACf,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,gBAAgB,IAAA,CAAK,gBAAA;AAAA,IACrB,WAAA,EAAa,IAAA,CAAK,KAAA,CAAM,GAAA;AAAI,GAC9B;AAEA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAM,SAAA,CAAU,OAAA,EAAS,KAAK,OAAO,CAAA;AACpD,IAAA,MAAA,GAAS,MAAA,CAAO,OAAA;AAAA,EAClB,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,YAAY,yBAAA,EAA2B,EAAE,GAAG,OAAA,EAAS,OAAO,CAAA;AAAA,EACpE;AAEA,EAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AACxB,EAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AACxB,EAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AAExB,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,OAAO,QAAQ,QAAA,EAAU;AACtD,IAAA,MAAM,WAAA,CAAY,kBAAkB,OAAO,CAAA;AAAA,EAC7C;AAEA,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,WAAW,CAAA,EAAG;AAC/C,IAAA,MAAM,WAAA,CAAY,kBAAkB,OAAO,CAAA;AAAA,EAC7C;AACA,EAAA,MAAM,UAAA,GAAa,KAAK,KAAA,CAAM,IAAA,CAAK,MAAM,GAAA,EAAI,CAAE,OAAA,EAAQ,GAAI,GAAI,CAAA;AAC/D,EAAA,IAAI,MAAM,UAAA,GAAa,IAAA,CAAK,kBAAkB,MAAM,WAAA,CAAY,WAAW,OAAO,CAAA;AAElF,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,CAAO,MAAA,EAAQ,KAAA,EAAO,KAAK,MAAA,EAAO;AACrD;AAMA,SAAS,mBAAA,CAAoB,OAAA,EAAiB,QAAA,EAAkB,OAAA,EAAgC;AAE9F,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,OAAO,CAAA,CAAE,SAAS,WAAW,CAAA;AAGnD,EAAA,IAAI,MAAA,KAAW,QAAA,EAAU,MAAM,WAAA,CAAY,2BAA2B,OAAO,CAAA;AAC/E;AC7DA,SAAS,MAAA,CAAO,MAA4B,SAAA,EAA+B;AACzE,EAAA,IAAI,SAAA,CAAU,WAAA,EAAY,KAAM,oBAAA,EAAsB;AACpD,IAAA,MAAM,YAAY,wBAAwB,CAAA;AAAA,EAC5C;AACA,EAAA,OAAO,MAAA,CAAO,OAAO,IAAA,KAAS,QAAA,GAAW,OAAO,IAAI,UAAA,CAAW,IAAI,CAAC,CAAA;AACtE;AAQA,IAAM,eAAA,uBAA2C,GAAA,CAAI;AAAA,EACnD,WAAA;AAAA,EACA,WAAA;AAAA,EACA,cAAA;AAAA,EACA;AACF,CAAC,CAAA;AAED,eAAsB,aAAA,CACpB,YAAA,EACA,IAAA,EACA,OAAA,EAC0B;AAE1B,EAAA,IAAI,YAAA,CAAa,QAAA,CAAS,IAAI,CAAA,EAAG;AAC/B,IAAA,MAAM,WAAA,CAAY,4BAA4B,OAAO,CAAA;AAAA,EACvD;AAEA,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,UAAA;AACJ,EAAA,IAAI;AAGF,IAAA,OAAA,GAAU,MAAM,WAAA,CAAY,YAAA,EAAc,MAAM,CAAA;AAChD,IAAA,UAAA,GAAa,UAAA,CAAW,YAAY,CAAA,CAAE,GAAA;AAAA,EACxC,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,YAAY,wBAAA,EAA0B,EAAE,GAAG,OAAA,EAAS,OAAO,CAAA;AAAA,EACnE;AAKA,EAAA,IAAI,OAAA,CAAQ,UAAU,MAAA,EAAW;AAC/B,IAAA,MAAM,WAAA,CAAY,4BAA4B,OAAO,CAAA;AAAA,EACvD;AAEA,EAAA,MAAM,UAAA,GAAa,QAAQ,GAAA,CAAI,OAAA;AAC/B,EAAA,MAAM,MAAA,GAAS,QAAQ,GAAA,CAAI,MAAA;AAC3B,EAAA,IAAI,CAAC,QAAA,CAAS,UAAU,KAAK,CAAC,QAAA,CAAS,MAAM,CAAA,EAAG;AAC9C,IAAA,MAAM,WAAA,CAAY,0BAA0B,OAAO,CAAA;AAAA,EACrD;AAIA,EAAA,IACE,eAAA,CAAgB,GAAA,CAAI,MAAA,CAAO,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA,IACzC,UAAA,CAAW,SAAS,CAAA,KAAM,MAAA,IAC1B,UAAA,CAAW,iBAAiB,MAAM,MAAA,EAClC;AACA,IAAA,MAAM,WAAA,CAAY,4BAA4B,OAAO,CAAA;AAAA,EACvD;AAEA,EAAA,MAAM,EAAE,MAAA,EAAQ,GAAA,EAAI,GAAI,MAAM,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,UAAA,CAAW,KAAK,CAAA,EAAG,MAAA,CAAO,KAAK,GAAG,OAAO,CAAA;AAI1F,EAAA,MAAM,WAAA,GAAc,UAAA,CAAW,KAAK,CAAA,KAAM,MAAA;AAC1C,EAAA,IAAI,CAAC,WAAA,IAAe,IAAA,CAAK,eAAA,KAAoB,IAAA,EAAM;AACjD,IAAA,MAAM,WAAA,CAAY,kBAAkB,OAAO,CAAA;AAAA,EAC7C;AAEA,EAAA,MAAM,OAAA,GAA4B;AAAA;AAAA;AAAA;AAAA,IAIhC,UAAA,EAAY,CAAC,qBAAqB,CAAA;AAAA;AAAA;AAAA,IAGlC,GAAI,UAAA,CAAW,KAAK,CAAA,KAAM,MAAA,GAAY,EAAE,MAAA,EAAQ,MAAA,CAAO,MAAA,EAAO,GAAI,EAAC;AAAA;AAAA;AAAA,IAGnE,GAAI,WAAA,GAAc,EAAE,UAAU,MAAA,CAAO,QAAA,KAAa,EAAC;AAAA,IACnD,gBAAgB,IAAA,CAAK,gBAAA;AAAA;AAAA,IAErB,WAAA,EAAa,IAAA,CAAK,KAAA,CAAM,GAAA;AAAI,GAC9B;AAEA,EAAA,IAAI,eAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAMA,SAAAA,CAAU,UAAA,EAAY,KAAK,OAAO,CAAA;AACvD,IAAA,eAAA,GAAkB,MAAA,CAAO,OAAA;AAAA,EAC3B,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,WAAA,CAAY,oBAAoB,KAAK,CAAA,EAAG,EAAE,GAAG,OAAA,EAAS,OAAO,CAAA;AAAA,EACrE;AAEA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AAGF,IAAA,MAAA,GAAU,MAAM,SAAA,CAAU,eAAA,EAAiB,OAAA,CAAQ,aAAa,MAAM,CAAA;AAAA,EAIxE,SAAS,KAAA,EAAO;AAEd,IAAA,MAAM,YAAY,wBAAA,EAA0B,EAAE,GAAG,OAAA,EAAS,OAAO,CAAA;AAAA,EACnE;AAEA,EAAA,MAAM,OAAA,GAAU,gBAAA,CAAiB,MAAA,EAAQ,OAAO,CAAA;AAGhD,EAAA,IAAI,OAAO,KAAK,CAAA,KAAM,UAAa,OAAA,CAAQ,KAAK,MAAM,MAAA,EAAW;AAC/D,IAAA,MAAM,WAAA,CAAY,4BAA4B,OAAO,CAAA;AAAA,EACvD;AACA,EAAA,4BAAA,CAA6B,SAAS,OAAO,CAAA;AAE7C,EAAA,IAAI,OAAA,CAAQ,aAAa,CAAA,KAAM,MAAA,EAAW;AACxC,IAAA,MAAM,WAAA,CAAY,4BAA4B,OAAO,CAAA;AAAA,EACvD;AACA,EAAA,gBAAA,CAAiB,CAAC,eAAA,EAAiB,OAAO,CAAA,EAAG,MAAM,OAAO,CAAA;AAE1D,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,CAAO,QAAQ,MAAA,EAAQ,OAAA,EAAS,aAAa,UAAA,EAAW;AAC3E;AAkBA,SAAS,gBAAA,CACP,QACA,OAAA,EACyB;AACzB,EAAA,MAAM,SAAA,GAAY,OAAO,kBAAkB,CAAA;AAE3C,EAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,SAAS,GAAG,MAAM,WAAA,CAAY,4BAA4B,OAAO,CAAA;AACpF,EAAA,MAAM,SAAA,GAAY,SAAA,CAAU,MAAA,CAAO,QAAQ,CAAA;AAC3C,EAAA,MAAM,CAAC,IAAI,CAAA,GAAI,SAAA;AACf,EAAA,IAAI,SAAA,CAAU,WAAW,CAAA,IAAK,IAAA,KAAS,QAAW,MAAM,WAAA,CAAY,kBAAkB,OAAO,CAAA;AAC7F,EAAA,OAAO,IAAA;AACT;AAOA,SAAS,oBACP,KAAA,EACuE;AACvE,EAAA,MAAM,OAAQ,KAAA,EAA8B,IAAA;AAC5C,EAAA,IAAI,IAAA,KAAS,mBAAmB,OAAO,SAAA;AACvC,EAAA,IAAI,SAAS,iCAAA,EAAmC;AAC9C,IAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAO,GAAI,KAAA;AAC1B,IAAA,IAAI,KAAA,KAAU,OAAO,OAAO,gBAAA;AAE5B,IAAA,IAAI,KAAA,KAAU,SAAS,KAAA,KAAU,KAAA;AAC/B,MAAA,OAAO,MAAA,KAAW,YAAY,gBAAA,GAAmB,SAAA;AAAA,EACrD;AACA,EAAA,OAAO,mBAAA;AACT;AAOA,SAAS,gBAAA,CACP,OAAA,EACA,IAAA,EACA,OAAA,EACM;AACN,EAAA,MAAM,UAAA,GAAa,KAAK,KAAA,CAAM,IAAA,CAAK,MAAM,GAAA,EAAI,CAAE,OAAA,EAAQ,GAAI,GAAI,CAAA;AAC/D,EAAA,IAAI,OAAA,GAAU,KAAA;AACd,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,IAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AACxB,IAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AACxB,IAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,MAAM,WAAA,CAAY,kBAAkB,OAAO,CAAA;AACxE,MAAA,IAAI,OAAO,UAAA,GAAa,IAAA,CAAK,kBAAkB,MAAM,WAAA,CAAY,WAAW,OAAO,CAAA;AACnF,MAAA,OAAA,GAAU,IAAA;AAAA,IACZ;AACA,IAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AACxB,IAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,MAAM,WAAA,CAAY,kBAAkB,OAAO,CAAA;AACxE,MAAA,IAAI,MAAM,UAAA,GAAa,IAAA,CAAK,kBAAkB,MAAM,WAAA,CAAY,WAAW,OAAO,CAAA;AAAA,IACpF;AACA,IAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,MAAM,WAAA,CAAY,kBAAkB,OAAO,CAAA;AAGxE,MAAA,IAAI,MAAM,UAAA,GAAa,IAAA,CAAK,kBAAkB,MAAM,WAAA,CAAY,WAAW,OAAO,CAAA;AAAA,IACpF;AAAA,EACF;AACA,EAAA,IAAI,CAAC,WAAW,IAAA,CAAK,aAAA,KAAkB,MAAM,MAAM,WAAA,CAAY,kBAAkB,OAAO,CAAA;AAC1F;AAGA,SAAS,4BAAA,CACP,QACA,OAAA,EACM;AACN,EAAA,IAAI,MAAA,CAAO,KAAK,CAAA,KAAM,wBAAA,EAA0B;AAC9C,IAAA,MAAM,WAAA,CAAY,4BAA4B,OAAO,CAAA;AAAA,EACvD;AACF;ACjOO,SAAS,iBAAiB,OAAA,EAAsC;AACrE,EAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,CAAC,KAAA,KAAU,CAAC,KAAA,CAAM,MAAA,EAAQ,KAAK,CAAC,CAAC,CAAA;AACtE,EAAA,MAAM,QAAA,uBAAe,GAAA,EAAsC;AAE3D,EAAA,SAAS,YAAA,CAAa,KAAc,OAAA,EAA4C;AAC9E,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,WAAW,CAAA,EAAG;AAC/C,MAAA,MAAM,WAAA,CAAY,kBAAkB,OAAO,CAAA;AAAA,IAC7C;AACA,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA;AAC/B,IAAA,IAAI,MAAA,KAAW,MAAA,EAAW,MAAM,WAAA,CAAY,oBAAoB,OAAO,CAAA;AACvE,IAAA,OAAO,MAAA;AAAA,EACT;AAIA,EAAA,SAAS,WAAA,CAAY,KAAa,OAAA,EAA4C;AAC5E,IAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,MAAA,CAAO,CAAC,KAAA,KAAU,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,CAAC,GAAA,KAAQ,GAAA,CAAI,GAAA,KAAQ,GAAG,CAAC,CAAA;AACnF,IAAA,MAAM,CAAC,IAAI,CAAA,GAAI,OAAA;AACf,IAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,IAAK,IAAA,KAAS,QAAW,MAAM,WAAA,CAAY,eAAe,OAAO,CAAA;AACxF,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,OAAO;AAAA;AAAA,IAEL,SAAA,GAA+B;AAC7B,MAAA,OAAO,CAAC,GAAG,QAAA,CAAS,IAAA,EAAM,CAAA;AAAA,IAC5B,CAAA;AAAA,IAEA,MAAM,OAAA,CAAQ,GAAA,EAAc,GAAA,EAAc,OAAA,EAAgD;AAGxF,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,WAAW,CAAA,EAAG;AAC/C,QAAA,MAAM,WAAA,CAAY,eAAe,OAAO,CAAA;AAAA,MAC1C;AACA,MAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,GAAY,WAAA,CAAY,KAAK,OAAO,CAAA,GAAI,YAAA,CAAa,GAAA,EAAK,OAAO,CAAA;AACxF,MAAA,MAAM,OAAA,GAAU,OAAO,IAAA,CAAK,IAAA,CAAK,CAAC,SAAA,KAAc,SAAA,CAAU,QAAQ,GAAG,CAAA;AACrE,MAAA,IAAI,OAAA,KAAY,MAAA,EAAW,MAAM,WAAA,CAAY,eAAe,OAAO,CAAA;AAInE,MAAA,MAAM,WAAW,IAAA,CAAK,SAAA,CAAU,CAAC,GAAA,EAAK,GAAG,CAAC,CAAA;AAC1C,MAAA,IAAI,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,QAAQ,CAAA;AACnC,MAAA,IAAI,YAAY,MAAA,EAAW;AACzB,QAAA,OAAA,GAAU,SAAA,CAAU,OAAA,CAAQ,GAAA,EAAY,qBAAqB,CAAA;AAC7D,QAAA,QAAA,CAAS,GAAA,CAAI,UAAU,OAAO,CAAA;AAAA,MAChC;AAEA,MAAA,IAAI;AACF,QAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,MAAM,OAAA,EAAQ;AAAA,MACtC,SAAS,KAAA,EAAO;AAId,QAAA,QAAA,CAAS,OAAO,QAAQ,CAAA;AACxB,QAAA,MAAM,eAAe,mDAAA,EAAqD;AAAA,UACxE,GAAG,OAAA;AAAA,UACH;AAAA,SACD,CAAA;AAAA,MACH;AAAA,IACF;AAAA,GACF;AACF;;;ACzDA,SAAS,iBAAiB,WAAA,EAA6B;AACrD,EAAA,OAAO,UAAU,MAAA,CAAO,WAAW,CAAA,CAAE,QAAA,CAAS,WAAW,CAAC,CAAA,CAAA;AAC5D;AAEO,SAAS,yBAAyB,OAAA,EAAiD;AAGxF,EAAA,MAAM,YAAA,GAAe,gBAAA,CAAiB,OAAA,CAAQ,MAAA,CAAO,MAAM,cAAc,CAAA;AACzE,EAAA,MAAM,aAAA,GAAgB,gBAAA,CAAiB,OAAA,CAAQ,MAAA,CAAO,MAAM,eAAe,CAAA;AAC3E,EAAA,MAAM,IAAA,GAAO,EAAE,KAAA,EAAO,OAAA,CAAQ,OAAO,gBAAA,EAAkB,OAAA,CAAQ,OAAO,gBAAA,EAAiB;AACvF,EAAA,MAAM,aAAA,GAAgB;AAAA,IACpB,GAAG,IAAA;AAAA,IACH,KAAA,EAAO,YAAA;AAAA,IACP,eAAA,EAAiB,OAAA,CAAQ,MAAA,CAAO,sBAAA,KAA2B,IAAA;AAAA,IAC3D,aAAA,EAAe,OAAA,CAAQ,MAAA,CAAO,oBAAA,KAAyB;AAAA,GACzD;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,MAAA,CACJ,YAAA,EACA,OAAA,GAA2B,EAAC,EACM;AAClC,MAAA,IAAI,OAAO,YAAA,KAAiB,QAAA,IAAY,YAAA,CAAa,WAAW,CAAA,EAAG;AACjE,QAAA,MAAM,WAAA,CAAY,0BAA0B,OAAO,CAAA;AAAA,MACrD;AAEA,MAAA,MAAM,OAAA,GAAU,MAAM,aAAA,CAAc,YAAA,EAAc,eAAe,OAAO,CAAA;AACxE,MAAA,MAAM,WAAW,MAAM,iBAAA;AAAA,QACrB,OAAA,CAAQ,MAAA;AAAA,QACR,EAAE,GAAG,IAAA,EAAM,KAAA,EAAO,aAAA,EAAc;AAAA,QAChC;AAAA,OACF;AAEA,MAAA,OAAO;AAAA,QACL,SAAA,EAAW,gBAAA,CAAiB,OAAA,CAAQ,WAAW,CAAA;AAAA,QAC/C,eAAe,OAAA,CAAQ,MAAA;AAAA,QACvB,gBAAgB,QAAA,CAAS,MAAA;AAAA,QACzB,eAAe,QAAA,CAAS,KAAA;AAAA,QACxB,gBAAgB,QAAA,CAAS;AAAA,OAC3B;AAAA,IACF,CAAA;AAAA,IAEA,cAAA,GAAiB;AACf,MAAA,OAAO,EAAE,SAAS,YAAA,CAAa,SAAA,IAAa,QAAA,EAAU,aAAA,CAAc,WAAU,EAAE;AAAA,IAClF;AAAA,GACF;AACF;;;ACtCO,SAAS,+BACd,OAAA,EAC0B;AAC1B,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,IAAS,WAAA;AAC/B,EAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,IAAU,WAAA;AAEjC,EAAA,MAAM,WAAW,wBAAA,CAAyB,EAAE,QAAQ,OAAA,CAAQ,MAAA,EAAQ,OAAO,CAAA;AAC3E,EAAA,MAAM,MAAA,GACJ,OAAA,CAAQ,WAAA,IAAe,oBAAA,CAAqB,EAAE,IAAA,EAAM,OAAA,CAAQ,MAAA,CAAO,MAAA,CAAO,IAAA,EAAM,MAAA,EAAQ,CAAA;AAE1F,EAAA,MAAM,WAAA,GAAwC;AAAA,IAC5C,MAAA,EAAQ,KAAA;AAAA,IACR,OAAA,EAAS,gBAAA;AAAA,IACT,OAAA,EAAS;AAAA,GACX;AAEA,EAAA,eAAe,iBACb,OAAA,EACoC;AACpC,IAAA,MAAM,YAAA,GAAgC;AAAA,MACpC,WAAW,OAAA,CAAQ,SAAA;AAAA,MACnB,YAAY,OAAA,CAAQ;AAAA,KACtB;AAEA,IAAA,MAAM,UAAU,MAAM,QAAA,CAAS,OAAO,OAAA,CAAQ,UAAA,CAAW,SAAS,YAAY,CAAA;AAG9E,IAAA,MAAM,qBAAA,CAAsB,OAAA,EAAS,OAAA,EAAS,YAAY,CAAA;AAE1D,IAAA,IAAI,WAAA;AACJ,IAAA,IAAI;AACF,MAAA,WAAA,GAAc,OAAO,OAAA,CAAQ;AAAA,QAC3B,WAAW,OAAA,CAAQ,SAAA;AAAA,QACnB,aAAa,OAAA,CAAQ,aAAA;AAAA,QACrB,eAAe,OAAA,CAAQ,aAAA;AAAA,QACvB,gBAAgB,OAAA,CAAQ,cAAA;AAAA,QACxB,YAAY,OAAA,CAAQ,UAAA;AAAA,QACpB,WAAW,OAAA,CAAQ;AAAA,OACpB,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,eAAe,mCAAA,EAAqC,EAAE,GAAG,YAAA,EAAc,OAAO,CAAA;AAAA,IACtF;AAEA,IAAA,IAAI,WAAA,CAAY,SAAS,UAAA,EAAY;AACnC,MAAA,MAAM,WAAA,CAAY,WAAA,CAAY,KAAA,EAAO,YAAY,CAAA;AAAA,IACnD;AAEA,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,UAAA;AAAA,MACR,MAAA,EAAQ,KAAA;AAAA,MACR,WAAW,OAAA,CAAQ,SAAA;AAAA;AAAA;AAAA,MAGnB,eAAe,OAAA,CAAQ,SAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAKvB,QAAA,EAAU;AAAA,QACR,eAAe,OAAA,CAAQ,aAAA;AAAA,QACvB,gBAAgB,OAAA,CAAQ,cAAA;AAAA,QACxB,YAAY,OAAA,CAAQ;AAAA;AACtB,KACF;AAAA,EACF;AAEA,EAAA,MAAM,QAAA,GAAW,CACf,MAAA,EACA,aAAA,EACA,OAAA,KACS;AACT,IAAA,IAAI;AACF,MAAA,MAAA,CAAO,MAAM,EAAE,aAAa,CAAA;AAAA,IAC9B,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,cAAA,CAAe,iCAAiC,MAAM,CAAA,CAAA,EAAI,EAAE,GAAG,OAAA,EAAS,OAAO,CAAA;AAAA,IACvF;AAAA,EACF,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,KAAA;AAAA,IACN,UAAA,EAAY,mBAAmB,eAAe,CAAA;AAAA,IAC9C,WAAA;AAAA,IACA,gBAAA;AAAA,IAEA,MAAM,OAAA,CAAQ,aAAA,EAAe,OAAA,EAAS;AACpC,MAAA,QAAA,CAAS,SAAA,EAAW,eAAe,OAAO,CAAA;AAAA,IAC5C,CAAA;AAAA,IACA,MAAM,OAAA,CAAQ,aAAA,EAAe,OAAA,EAAS;AACpC,MAAA,QAAA,CAAS,SAAA,EAAW,eAAe,OAAO,CAAA;AAAA,IAC5C,CAAA;AAAA,IACA,MAAM,aAAA,CAAc,aAAA,EAAe,OAAA,EAAS;AAC1C,MAAA,QAAA,CAAS,eAAA,EAAiB,eAAe,OAAO,CAAA;AAAA,IAClD,CAAA;AAAA,IAEA,MAAM,MAAA,GAAiC;AACrC,MAAA,MAAM,SAAA,GAAY,MAAM,WAAA,EAAY;AACpC,MAAA,MAAM,SAAA,GAAY,MAAM,MAAA,EAAO;AAC/B,MAAA,IAAI,SAAA,GAAY,IAAA;AAChB,MAAA,IAAI;AAGF,QAAA,MAAA,CAAO,QAAQ,cAAc,CAAA;AAAA,MAC/B,CAAA,CAAA,MAAQ;AACN,QAAA,SAAA,GAAY,KAAA;AAAA,MACd;AACA,MAAA,MAAM,aAAa,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,WAAA,KAAgB,SAAS,CAAA;AAC7D,MAAA,IAAI,CAAC,SAAA,EAAW;AAEd,QAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAA,EAAW,UAAA,EAAY,QAAQ,0BAAA,EAA2B;AAAA,MACrF;AACA,MAAA,MAAM,OAAA,GAAU,SAAS,cAAA,EAAe;AACxC,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,MAAA;AAAA,QACR,SAAA;AAAA,QACA,UAAA;AAAA,QACA,MAAA,EAAQ,mBAAmB,OAAA,CAAQ,OAAA,CAAQ,MAAM,CAAA,kBAAA,EAAqB,OAAA,CAAQ,SAAS,MAAM,CAAA;AAAA,OAC/F;AAAA,IACF,CAAA;AAAA,IAEA,KAAA,GAAQ;AACN,MAAA,MAAA,CAAO,KAAA,EAAM;AAAA,IACf;AAAA,GACF;AACF","file":"ap2.js","sourcesContent":["/**\n * Every failure the AP2 verifier can report.\n *\n * `CommerceError.message` reaches the client, and a mandate carries the\n * buyer's purchase and often personal data, so messages are fixed phrases from\n * the list below. The machine-readable code goes in `details.reason` and the\n * original exception on `cause`, which is never serialized.\n *\n * Three codes: AUTHORIZATION_INVALID when the buyer's mandate is bad,\n * AUTHORIZATION_REPLAYED when it is good but spent, and\n * AUTHORIZATION_PROVIDER_UNAVAILABLE when our verifier never reached a\n * verdict. Blaming the buyer for our outage refuses a good mandate.\n */\nimport { CommerceError } from '../../core';\n\n/**\n * Coarse on purpose: a client learns roughly where its mandate was refused,\n * not which check failed. Finer detail is an oracle for probing trust policy,\n * so a mandate signed with a disallowed algorithm reports `invalid_signature`\n * and one declaring a digest other than sha-256 `malformed_presentation`.\n */\nexport const AP2_REJECTION_REASONS = [\n  'malformed_presentation',\n  'untrusted_issuer',\n  'unknown_key',\n  'invalid_signature',\n  'invalid_claims',\n  'expired',\n  'wrong_audience',\n  'unsupported_mandate_type',\n  'checkout_binding_failed',\n  'purchase_mismatch',\n] as const;\n\nexport type Ap2RejectionReason = (typeof AP2_REJECTION_REASONS)[number];\n\nconst MESSAGES: Readonly<Record<Ap2RejectionReason, string>> = {\n  malformed_presentation: 'The authorization is not a well-formed SD-JWT presentation.',\n  untrusted_issuer: 'The mandate was issued by a party this merchant does not trust.',\n  unknown_key: 'The mandate names a signing key this merchant does not trust.',\n  invalid_signature: 'The mandate signature did not verify.',\n  invalid_claims: 'The mandate is missing required claims or they are malformed.',\n  expired: 'The mandate is expired or not yet valid.',\n  wrong_audience: 'The mandate is addressed to a different audience.',\n  unsupported_mandate_type: 'The mandate is not a closed Direct Checkout Mandate.',\n  checkout_binding_failed: 'The merchant checkout document bound to the mandate did not verify.',\n  purchase_mismatch: 'The mandate does not authorize this purchase.',\n};\n\nexport interface Ap2ErrorContext {\n  readonly requestId?: string;\n  readonly resourceId?: string;\n  readonly cause?: unknown;\n}\n\n/** The buyer's mandate is bad. Fail closed */\nexport function ap2Rejected(\n  reason: Ap2RejectionReason,\n  context: Ap2ErrorContext = {},\n): CommerceError {\n  return new CommerceError('AUTHORIZATION_INVALID', MESSAGES[reason], {\n    details: { method: 'ap2', reason },\n    ...(context.requestId !== undefined ? { requestId: context.requestId } : {}),\n    ...(context.resourceId !== undefined ? { resourceId: context.resourceId } : {}),\n    ...(context.cause !== undefined ? { cause: context.cause } : {}),\n  });\n}\n\n/**\n * The mandate verified but has already been presented. A separate code from\n * a bad mandate: nothing is wrong with this mandate except that it is spent.\n */\nexport function ap2Replayed(state: string, context: Ap2ErrorContext = {}): CommerceError {\n  return new CommerceError(\n    'AUTHORIZATION_REPLAYED',\n    'This mandate has already been presented and cannot authorize another purchase.',\n    {\n      details: { method: 'ap2', reason: 'replayed', state },\n      ...(context.requestId !== undefined ? { requestId: context.requestId } : {}),\n      ...(context.resourceId !== undefined ? { resourceId: context.resourceId } : {}),\n    },\n  );\n}\n\n/**\n * The check never ran (a configured key that will not import, say). Retryable,\n * and never recorded against the payer: the mandate may be perfectly good.\n */\nexport function ap2Unavailable(detail: string, context: Ap2ErrorContext = {}): CommerceError {\n  return new CommerceError(\n    'AUTHORIZATION_PROVIDER_UNAVAILABLE',\n    'Authorization could not be verified right now. This is a merchant-side fault, not a problem with the presented mandate.',\n    {\n      details: { method: 'ap2', reason: 'verifier_unavailable', detail },\n      ...(context.requestId !== undefined ? { requestId: context.requestId } : {}),\n      ...(context.resourceId !== undefined ? { resourceId: context.resourceId } : {}),\n      ...(context.cause !== undefined ? { cause: context.cause } : {}),\n    },\n  );\n}\n","import { createHash } from 'node:crypto';\n\n/** SHA-256, the only digest AP2 verification and signing use. A string is hashed as UTF-8 */\nexport function sha256(data: string | Uint8Array): Buffer {\n  return createHash('sha256').update(data).digest();\n}\n","/**\n * Binds a verified mandate to the purchase in front of us. Without this\n * comparison a mandate approved for a $0.01 report would settle a $500 one.\n *\n * Everything is compared against the ALREADY RESOLVED request. Nothing is\n * taken from the mandate to shape the purchase, which would invert the\n * control.\n */\nimport canonicalize from 'canonicalize';\nimport { type AuthorizationVerificationContext, CommerceError } from '../../core';\nimport { isRecord } from '../../core/is-record';\nimport { AP2_CHECKOUT_PROFILE } from './constants';\nimport { type Ap2ErrorContext, ap2Rejected } from './errors';\nimport { sha256 } from './sha256';\nimport type { VerifiedCheckoutMandate } from './types';\n\n/**\n * All required. Absent is a mismatch, never a skipped check: a mandate that\n * will not say which resource or how much authorizes nothing in particular.\n */\nconst REQUIRED_PROFILE_CLAIMS = [\n  'profile',\n  'resource_id',\n  'input_hash',\n  'amount',\n  'currency',\n  'payment_method',\n] as const;\n\n/**\n * RFC 8785 (JCS) digest of the validated resource input.\n *\n * Binds a mandate to the exact request, not just to a resource and a price:\n * without it, one mandate for `translate` would authorize any translation.\n *\n * The merchant's signer, possibly in another language, agrees with this digest\n * only if it follows RFC 8785's number formatting and UTF-16 key ordering too;\n * sorting keys is not enough.\n *\n * The caller passes what the backend will receive: validated, reserved fields\n * stripped, no request id or transport metadata (the buyer could not have\n * known those when they approved).\n */\nexport function computeInputHash(input: unknown): string {\n  const canonical = canonicalize(input ?? {});\n  // undefined means JSON cannot represent the value (a function, say). On the\n  // gateway path the input already passed schema validation, so this is not a\n  // buyer error.\n  if (canonical === undefined) {\n    throw new CommerceError('INTERNAL_ERROR', 'resource input is not canonicalizable JSON');\n  }\n  return sha256(canonical).toString('base64url');\n}\n\nconst EVM_ADDRESS = /^0x[0-9a-f]{40}$/i;\n\n// EIP-55 encodes an address checksum through letter casing, so lowercase and\n// checksummed forms identify the same account. Other values compare exactly.\nfunction sameCoordinate(declared: unknown, expected: string | undefined): boolean {\n  if (typeof declared === 'string' && expected !== undefined) {\n    if (EVM_ADDRESS.test(declared) && EVM_ADDRESS.test(expected)) {\n      return declared.toLowerCase() === expected.toLowerCase();\n    }\n  }\n  return declared === expected;\n}\n\n/**\n * Throws on the first mismatch with one coarse reason. Which field disagreed\n * is not reported: a caller able to ask about one field at a time can read a\n * mandate's contents out of the gateway by elimination.\n */\nexport async function bindMandateToPurchase(\n  mandate: VerifiedCheckoutMandate,\n  context: AuthorizationVerificationContext,\n  errorContext: Ap2ErrorContext,\n): Promise<void> {\n  const profile = mandate.checkoutClaims['agent_commerce'];\n  if (!isRecord(profile)) throw ap2Rejected('purchase_mismatch', errorContext);\n\n  for (const claim of REQUIRED_PROFILE_CLAIMS) {\n    const value = profile[claim];\n    if (typeof value !== 'string' || value.length === 0) {\n      throw ap2Rejected('purchase_mismatch', errorContext);\n    }\n  }\n\n  const requirement = context.requirement;\n  const expectedInputHash = computeInputHash(context.input);\n\n  const mustMatch: readonly (readonly [string, unknown])[] = [\n    ['profile', AP2_CHECKOUT_PROFILE],\n    ['resource_id', context.resourceId],\n    ['input_hash', expectedInputHash],\n    // Decimal strings on both sides. Comparing numerically would make \"0.10\"\n    // and \"0.1\" equal, and a mandate says what it says.\n    ['amount', requirement.amount],\n    ['currency', requirement.currency],\n    ['payment_method', requirement.provider],\n  ];\n\n  for (const [claim, expected] of mustMatch) {\n    if (profile[claim] !== expected) throw ap2Rejected('purchase_mismatch', errorContext);\n  }\n\n  // Checked whenever EITHER side names one, which is the fail-closed reading.\n  // A mandate silent about the chain must not unlock a mainnet settlement, and\n  // one naming a chain the requirement lacks was approved for another rail.\n  for (const [claim, expected] of [\n    ['destination', requirement.destination],\n    ['network', requirement.network],\n    ['asset', requirement.asset],\n  ] as const) {\n    const declared = profile[claim];\n    if (declared === undefined && expected === undefined) continue;\n    if (!sameCoordinate(declared, expected)) throw ap2Rejected('purchase_mismatch', errorContext);\n  }\n}\n","/**\n * Merchant-side helper: mints the checkout JWT a Checkout Mandate binds.\n *\n * A merchant runs it in their own process, with their own key, to produce the\n * document the buyer approves; the gateway never calls it. It mirrors\n * `createPaymentProof`, which a buyer runs to produce a payment proof.\n *\n * It exists mainly for `input_hash`, an RFC 8785 digest. A serializer that\n * only sorts keys, as many non-JavaScript JSON libraries do, can disagree with\n * it on floats and non-ASCII keys, and the mandate is then refused with a\n * reason that does not name the field.\n */\nimport { importPKCS8, type JWK, SignJWT } from 'jose';\nimport {\n  AP2_CHECKOUT_PROFILE,\n  AP2_JWK_CURVE,\n  AP2_KEY_TYPE,\n  AP2_SIGNING_ALGORITHM,\n} from './constants';\nimport { computeInputHash } from './profile';\n\n/**\n * A private ES256 key: either a private JWK (the pair of the public one in the\n * gateway's `checkoutIssuers`) or a PKCS#8 PEM, as `openssl` emits it\n */\nexport type Ap2SigningKey = Readonly<Record<string, unknown>> | string;\n\nexport interface CreateCheckoutJwtOptions {\n  readonly privateKey: Ap2SigningKey;\n  /** Must match a `kid` configured under the gateway's `checkoutIssuers` */\n  readonly kid: string;\n  /** Must match that issuer's configured `issuer` */\n  readonly issuer: string;\n  /** Must match that issuer's configured `audience` */\n  readonly audience: string;\n\n  readonly resourceId: string;\n  /**\n   * The resource input this purchase is for, exactly as the buyer will send\n   * it: no reserved fields, no request id, no transport metadata\n   */\n  readonly input: unknown;\n\n  /**\n   * Decimal string, never a number, and compared as a string: `0.10` and `0.1`\n   * are different mandates. Take it from your own catalog rather than from\n   * whatever the agent asked for.\n   */\n  readonly amount: string;\n  readonly currency: string;\n  /** The rail that will settle, e.g. `x402` */\n  readonly paymentMethod: string;\n\n  /**\n   * Settlement coordinates. Required whenever the gateway's requirement names\n   * them, which under x402 is always. A mandate silent about the chain will\n   * not unlock a settlement on one.\n   */\n  readonly destination?: string;\n  readonly network?: string;\n  readonly asset?: string;\n\n  /** Defaults to a random UUID. Recorded on the receipt and used for replay defense */\n  readonly jwtId?: string;\n  /** Defaults to 900: a human approval sits inside this window */\n  readonly expiresInSeconds?: number;\n  /** Injectable so a test need not move the wall clock */\n  readonly now?: Date;\n}\n\nconst DEFAULT_EXPIRES_IN_SECONDS = 900;\n\nfunction requireText(value: unknown, field: string): string {\n  if (typeof value !== 'string' || value.length === 0) {\n    throw new TypeError(\n      `createCheckoutJwt: ${field} must be a non-empty string, received ${describe(value)}`,\n    );\n  }\n  return value;\n}\n\nfunction describe(value: unknown): string {\n  return value === null ? 'null' : typeof value;\n}\n\n/**\n * Every rejection here is a mistake that would otherwise surface as an opaque\n * verification failure much later: the public half of the pair, the wrong key\n * type, or a PEM that is not PKCS#8\n */\nasync function resolveKey(\n  key: Ap2SigningKey,\n): Promise<JWK | Awaited<ReturnType<typeof importPKCS8>>> {\n  if (typeof key === 'string') {\n    if (!key.includes('BEGIN PRIVATE KEY')) {\n      throw new TypeError(\n        'createCheckoutJwt: a string privateKey must be a PKCS#8 PEM beginning \"-----BEGIN PRIVATE KEY-----\"',\n      );\n    }\n    return importPKCS8(key, AP2_SIGNING_ALGORITHM);\n  }\n  if (typeof key !== 'object' || key === null) {\n    throw new TypeError('createCheckoutJwt: privateKey must be a private JWK or a PKCS#8 PEM');\n  }\n  if (key['d'] === undefined) {\n    throw new TypeError(\n      'createCheckoutJwt: privateKey is a public JWK (no \"d\"). Use the private half of the pair whose public key is configured under checkoutIssuers',\n    );\n  }\n  if (key['kty'] !== AP2_KEY_TYPE || key['crv'] !== AP2_JWK_CURVE) {\n    throw new TypeError(\n      `createCheckoutJwt: privateKey must be ${AP2_KEY_TYPE}/${AP2_JWK_CURVE}, the pair ${AP2_SIGNING_ALGORITHM} implies`,\n    );\n  }\n  return key as JWK;\n}\n\n/**\n * Returns the compact JWT to hand to the agent, which wraps it in the Checkout\n * Mandate the buyer signs\n */\nexport async function createCheckoutJwt(options: CreateCheckoutJwtOptions): Promise<string> {\n  const kid = requireText(options.kid, 'kid');\n  const issuer = requireText(options.issuer, 'issuer');\n  const audience = requireText(options.audience, 'audience');\n  const resourceId = requireText(options.resourceId, 'resourceId');\n  const currency = requireText(options.currency, 'currency');\n  const paymentMethod = requireText(options.paymentMethod, 'paymentMethod');\n\n  if (typeof options.amount === 'number') {\n    throw new TypeError(\n      'createCheckoutJwt: amount must be a decimal string, not a number. It is compared as a string, so 0.1 and \"0.10\" are different mandates',\n    );\n  }\n  const amount = requireText(options.amount, 'amount');\n\n  const key = await resolveKey(options.privateKey);\n  const issuedAt = Math.floor((options.now ?? new Date()).getTime() / 1000);\n  const expiresIn = options.expiresInSeconds ?? DEFAULT_EXPIRES_IN_SECONDS;\n  if (!Number.isInteger(expiresIn) || expiresIn <= 0) {\n    throw new TypeError('createCheckoutJwt: expiresInSeconds must be a positive whole number');\n  }\n\n  const agentCommerce: Record<string, string> = {\n    profile: AP2_CHECKOUT_PROFILE,\n    resource_id: resourceId,\n    input_hash: computeInputHash(options.input),\n    amount,\n    currency,\n    payment_method: paymentMethod,\n    ...(options.destination !== undefined ? { destination: options.destination } : {}),\n    ...(options.network !== undefined ? { network: options.network } : {}),\n    ...(options.asset !== undefined ? { asset: options.asset } : {}),\n  };\n\n  return new SignJWT({ agent_commerce: agentCommerce })\n    .setProtectedHeader({ alg: AP2_SIGNING_ALGORITHM, kid, typ: 'JWT' })\n    .setIssuer(issuer)\n    .setAudience(audience)\n    .setIssuedAt(issuedAt)\n    .setExpirationTime(issuedAt + expiresIn)\n    .setJti(options.jwtId ?? crypto.randomUUID())\n    .sign(key);\n}\n","/**\n * Adapter self-description.\n *\n * Imports nothing but core types and the pins, so `doctor` can report AP2\n * without pulling `jose` or `@sd-jwt/core` into the CLI bundle.\n */\nimport type { AdapterDescriptor } from '../../core';\nimport {\n  AP2_CHECKOUT_MANDATE_VCT,\n  AP2_CHECKOUT_PROFILE,\n  AP2_DIGEST_ALGORITHM,\n  AP2_SIGNING_ALGORITHM,\n  AP2_SPEC_VERSION,\n} from './constants';\n\n/** What this provider actually verifies */\nexport const AP2_CAPABILITIES: readonly string[] = [\n  'direct-mode',\n  'trusted-agent-provider',\n  AP2_CHECKOUT_MANDATE_VCT,\n  'sd-jwt-presentation',\n  AP2_SIGNING_ALGORITHM,\n  AP2_DIGEST_ALGORITHM,\n  'static-inline-trust',\n  'merchant-checkout-jwt-binding',\n  AP2_CHECKOUT_PROFILE,\n  'purchase-binding',\n  'replay-defence',\n];\n\n/**\n * Major AP2 features this provider does not support, published in its\n * descriptor and printed by `doctor`, so no client assumes full protocol\n * support\n */\nexport const AP2_UNSUPPORTED: readonly string[] = [\n  // Mandate kinds. Open mandates are refused: see AP2_CHECKOUT_MANDATE_VCT\n  'autonomous mode',\n  'open checkout mandates (mandate.checkout.open.1)',\n  'payment mandates (mandate.payment.1)',\n  'spending constraint evaluation',\n  'cnf-bound agent keys',\n  // Delegation models other than a trusted agent provider\n  'user credential delegation (OpenID4VP)',\n  'delegation chains and key-binding JWTs',\n  // Key handling. Every key is written into config by an operator\n  'JWKS and any key discovery by URL (jku, x5u)',\n  'issuer metadata fetching',\n  'key rotation without a config change',\n  // Algorithms\n  'signature algorithms other than ES256',\n  'digest algorithms other than sha-256',\n  // Roles this gateway does not play\n  'mandate issuance',\n  'checkout receipts',\n  'AP2 over the ACP checkout adapter',\n];\n\nexport function buildAp2Descriptor(implementationVersion: string): AdapterDescriptor {\n  return {\n    name: 'ap2',\n    kind: 'authorization',\n    implementationVersion,\n    supportedSpec: `ap2/v${AP2_SPEC_VERSION} mode=direct`,\n    capabilities: AP2_CAPABILITIES,\n    status: 'experimental',\n    unsupported: AP2_UNSUPPORTED,\n  };\n}\n","/**\n * Durable record of which mandates have been spent.\n *\n * Its own table in its own file: a payment replay key is needed only until its\n * authorization's `validBefore`, after which it cannot settle, while a consumed\n * mandate must stay consumed for as long as the merchant can be asked what they\n * delivered. Hence no retention sweep, unlike the ACP idempotency store:\n * deleting a `consumed` row makes that mandate spendable again. If the table\n * ever needs bounding, archive `released` rows and leave the rest.\n *\n * Settlement and a local commit are not one transaction. If the process dies\n * between them the row stays `reserved` and that mandate is refused from then\n * on: a refused retry costs a round trip, the other direction costs a second\n * payment.\n */\nimport type { Database } from 'better-sqlite3';\nimport { type Logger, NOOP_LOGGER } from '../../core';\nimport { openSqliteDatabase } from '../../storage/sqlite';\n\n/**\n * `released` is \"nothing happened\" and the only state a mandate can be\n * presented from again. `uncertain` is a settlement whose outcome we never\n * learned: not reusable, but findable by an operator reconciling by hand.\n */\nexport type Ap2AuthorizationState = 'reserved' | 'consumed' | 'released' | 'uncertain';\n\n/**\n * A digest and a few identifiers: everything replay defense needs, and nothing\n * a leaked database would hand an attacker\n */\nexport interface Ap2ReservationRequest {\n  /**\n   * Digest of the ISSUER-SIGNED TOKEN, not of the presentation. Selective\n   * disclosure gives one mandate many presentation strings, so keying on the\n   * presentation would let it be spent once per disclosed subset.\n   */\n  readonly reference: string;\n  /** `jti` of the merchant checkout JWT the mandate binds */\n  readonly checkoutJti: string;\n  readonly mandateIssuer: string;\n  readonly checkoutIssuer: string;\n  readonly resourceId: string;\n  readonly requestId: string;\n}\n\nexport type Ap2ReservationResult =\n  | { readonly kind: 'reserved' }\n  /** Already reserved, consumed, or of uncertain outcome. Never re-spendable */\n  | { readonly kind: 'replayed'; readonly state: Ap2AuthorizationState };\n\nexport interface Ap2ReplayStore {\n  /** Atomically claim a mandate, or report that something already holds it */\n  reserve(request: Ap2ReservationRequest): Ap2ReservationResult;\n  /** Settlement succeeded: spend it permanently */\n  consume(reference: string): void;\n  /** Nothing happened: hand it back so a corrected retry can use it */\n  release(reference: string): void;\n  /** Settlement outcome unknown. Not reusable, and flagged for a human */\n  markUncertain(reference: string): void;\n  /** Current state, for tests and diagnostics */\n  stateOf(reference: string): Ap2AuthorizationState | undefined;\n  close(): void;\n}\n\nexport interface Ap2ReplayStoreOptions {\n  /** File path, or ':memory:' for tests */\n  readonly path: string;\n  readonly logger?: Logger;\n  /** Injectable so tests need not move the wall clock */\n  readonly now?: () => number;\n}\n\ninterface StateRow {\n  state: string;\n}\n\nexport function createAp2ReplayStore(options: Ap2ReplayStoreOptions): Ap2ReplayStore {\n  const logger = options.logger ?? NOOP_LOGGER;\n  const now = options.now ?? (() => Date.now());\n\n  const db: Database = openSqliteDatabase({\n    path: options.path,\n    label: 'AP2 authorization database',\n    logger,\n  });\n  migrate(db);\n\n  const selectByReference = db.prepare<[string], StateRow>(\n    'SELECT state FROM ap2_authorizations WHERE reference = ?',\n  );\n  // Two mandates can bind one checkout document, giving two references, so\n  // the reference alone would not catch the second one\n  const selectLiveByJti = db.prepare<[string, string], StateRow>(\n    `SELECT state FROM ap2_authorizations\n      WHERE checkout_jti = ? AND reference != ? AND state != 'released'`,\n  );\n  const insert = db.prepare(\n    `INSERT INTO ap2_authorizations\n       (reference, checkout_jti, mandate_issuer, checkout_issuer, resource_id, request_id,\n        state, created_at, updated_at)\n     VALUES (@reference, @checkout_jti, @mandate_issuer, @checkout_issuer, @resource_id,\n             @request_id, 'reserved', @at, @at)`,\n  );\n  const reReserve = db.prepare(\n    `UPDATE ap2_authorizations\n        SET state = 'reserved', request_id = @request_id, updated_at = @at\n      WHERE reference = @reference AND state = 'released'`,\n  );\n  // Guarded on `reserved`: releasing a `consumed` row would hand back a\n  // mandate whose money has already moved\n  const transition = db.prepare(\n    `UPDATE ap2_authorizations SET state = @state, updated_at = @at\n      WHERE reference = @reference AND state = 'reserved'`,\n  );\n\n  const reserveTx = db.transaction((request: Ap2ReservationRequest): Ap2ReservationResult => {\n    const at = new Date(now()).toISOString();\n\n    const existing = selectByReference.get(request.reference);\n    if (existing !== undefined && existing.state !== 'released') {\n      return { kind: 'replayed', state: existing.state as Ap2AuthorizationState };\n    }\n\n    // Checked for a released reference too: another mandate may have reserved\n    // or spent the same checkout while this one was released\n    const sameCheckout = selectLiveByJti.get(request.checkoutJti, request.reference);\n    if (sameCheckout !== undefined) {\n      return { kind: 'replayed', state: sameCheckout.state as Ap2AuthorizationState };\n    }\n\n    if (existing !== undefined) {\n      reReserve.run({ reference: request.reference, request_id: request.requestId, at });\n      return { kind: 'reserved' };\n    }\n\n    insert.run({\n      reference: request.reference,\n      checkout_jti: request.checkoutJti,\n      mandate_issuer: request.mandateIssuer,\n      checkout_issuer: request.checkoutIssuer,\n      resource_id: request.resourceId,\n      request_id: request.requestId,\n      at,\n    });\n    return { kind: 'reserved' };\n  });\n\n  const move = (reference: string, state: Ap2AuthorizationState): void => {\n    transition.run({ reference, state, at: new Date(now()).toISOString() });\n  };\n\n  let closed = false;\n  return {\n    reserve(request) {\n      return reserveTx(request);\n    },\n    consume(reference) {\n      move(reference, 'consumed');\n    },\n    release(reference) {\n      move(reference, 'released');\n    },\n    markUncertain(reference) {\n      move(reference, 'uncertain');\n    },\n    stateOf(reference) {\n      return selectByReference.get(reference)?.state as Ap2AuthorizationState | undefined;\n    },\n    close() {\n      if (closed) return;\n      closed = true;\n      db.close();\n    },\n  };\n}\n\n// `PRAGMA user_version`, so reopening an existing file is a no-op check\nfunction migrate(db: Database): void {\n  const current = db.pragma('user_version', { simple: true }) as number;\n  if (current >= 1) return;\n  const apply = db.transaction(() => {\n    db.exec(`\n      CREATE TABLE IF NOT EXISTS ap2_authorizations (\n        reference        TEXT PRIMARY KEY,\n        checkout_jti     TEXT NOT NULL,\n        mandate_issuer   TEXT NOT NULL,\n        checkout_issuer  TEXT NOT NULL,\n        resource_id      TEXT NOT NULL,\n        request_id       TEXT NOT NULL,\n        state            TEXT NOT NULL\n                         CHECK (state IN ('reserved', 'consumed', 'released', 'uncertain')),\n        created_at       TEXT NOT NULL,\n        updated_at       TEXT NOT NULL\n      );\n      CREATE INDEX IF NOT EXISTS idx_ap2_authorizations_checkout_jti\n        ON ap2_authorizations(checkout_jti);\n    `);\n    db.pragma('user_version = 1');\n  });\n  apply();\n}\n","/**\n * Stage two: the merchant checkout JWT the mandate binds.\n *\n * Two things have to hold. The hash proves the buyer approved *this* document;\n * the signature proves the merchant issued it. Hash alone accepts a document\n * the buyer wrote themselves; signature alone accepts a genuine merchant\n * document this mandate never covered.\n */\nimport { decodeJwt, decodeProtectedHeader, type JWTVerifyOptions, jwtVerify } from 'jose';\nimport type { Clock } from '../../core';\nimport { AP2_SIGNING_ALGORITHM } from './constants';\nimport { type Ap2ErrorContext, ap2Rejected } from './errors';\nimport { sha256 } from './sha256';\nimport type { TrustStore } from './trust';\n\nexport interface VerifiedCheckoutJwt {\n  readonly issuer: string;\n  readonly jwtId: string;\n  readonly claims: Readonly<Record<string, unknown>>;\n}\n\n/**\n * `mandateClaims` must come from an already-verified mandate: `checkout_hash`\n * is worth nothing unless the issuer signed it\n */\nexport async function verifyCheckoutJwt(\n  mandateClaims: Readonly<Record<string, unknown>>,\n  deps: { readonly trust: TrustStore; readonly clock: Clock; readonly clockSkewSeconds: number },\n  context: Ap2ErrorContext,\n): Promise<VerifiedCheckoutJwt> {\n  const compact = mandateClaims['checkout_jwt'];\n  const expectedHash = mandateClaims['checkout_hash'];\n  if (typeof compact !== 'string' || compact.length === 0) {\n    throw ap2Rejected('invalid_claims', context);\n  }\n  if (typeof expectedHash !== 'string' || expectedHash.length === 0) {\n    throw ap2Rejected('invalid_claims', context);\n  }\n\n  requireMatchingHash(compact, expectedHash, context);\n\n  // Unverified, and read only to pick which configured key to try\n  let header: ReturnType<typeof decodeProtectedHeader>;\n  let unverifiedPayload: ReturnType<typeof decodeJwt>;\n  try {\n    header = decodeProtectedHeader(compact);\n    unverifiedPayload = decodeJwt(compact);\n  } catch (cause) {\n    throw ap2Rejected('checkout_binding_failed', { ...context, cause });\n  }\n\n  const { issuer, key } = await deps.trust.resolve(unverifiedPayload.iss, header.kid, context);\n\n  const options: JWTVerifyOptions = {\n    algorithms: [AP2_SIGNING_ALGORITHM],\n    issuer: issuer.issuer,\n    audience: issuer.audience,\n    clockTolerance: deps.clockSkewSeconds,\n    currentDate: deps.clock.now(),\n  };\n\n  let claims: Record<string, unknown>;\n  try {\n    const result = await jwtVerify(compact, key, options);\n    claims = result.payload as Record<string, unknown>;\n  } catch (cause) {\n    throw ap2Rejected('checkout_binding_failed', { ...context, cause });\n  }\n\n  const exp = claims['exp'];\n  const iat = claims['iat'];\n  const jti = claims['jti'];\n  // jose validates a time claim only when present, so requiring them is ours\n  if (typeof exp !== 'number' || typeof iat !== 'number') {\n    throw ap2Rejected('invalid_claims', context);\n  }\n  // `jti` is what replay defense and the receipt record, so it is required\n  if (typeof jti !== 'string' || jti.length === 0) {\n    throw ap2Rejected('invalid_claims', context);\n  }\n  const nowSeconds = Math.floor(deps.clock.now().getTime() / 1000);\n  if (iat > nowSeconds + deps.clockSkewSeconds) throw ap2Rejected('expired', context);\n\n  return { issuer: issuer.issuer, jwtId: jti, claims };\n}\n\n/**\n * Hashes the compact JWT as it arrived. Re-encoding the parsed claims would\n * hash a different document from the one being verified.\n */\nfunction requireMatchingHash(compact: string, expected: string, context: Ap2ErrorContext): void {\n  // sha-256 only: `_sd_alg` was already pinned to it upstream\n  const actual = sha256(compact).toString('base64url');\n  // Plain comparison: both sides are public to anyone holding the\n  // presentation, so there is no secret for timing to leak\n  if (actual !== expected) throw ap2Rejected('checkout_binding_failed', context);\n}\n","/**\n * Parse the presentation, verify the issuer's signature, resolve disclosures,\n * and read the mandate from `delegate_payload`.\n *\n * `@sd-jwt/core` handles disclosures, including malformed, duplicate, and\n * unreferenced disclosures. `jose` verifies the signature. This module applies\n * the configured key, algorithm, audience, and time policy.\n */\nimport { decodeSdJwt, getClaims, splitSdJwt } from '@sd-jwt/core';\nimport { type JWTVerifyOptions, jwtVerify } from 'jose';\nimport type { Clock } from '../../core';\nimport { isRecord } from '../../core/is-record';\nimport { AP2_CHECKOUT_MANDATE_VCT, AP2_DIGEST_ALGORITHM, AP2_SIGNING_ALGORITHM } from './constants';\nimport { type Ap2ErrorContext, ap2Rejected } from './errors';\nimport { sha256 } from './sha256';\nimport type { TrustStore } from './trust';\n\nexport interface VerifiedMandate {\n  readonly issuer: string;\n  /** The mandate element, with its nested disclosures resolved */\n  readonly claims: Readonly<Record<string, unknown>>;\n  /**\n   * The issuer-signed token on its own, without the disclosures.\n   *\n   * This, not the presentation string, is the stable identity of a mandate:\n   * disclosing or withholding an optional claim rewrites the presentation and\n   * leaves the signed token untouched. Replay defense keys on a digest of it.\n   */\n  readonly signedToken: string;\n}\n\n/**\n * `@sd-jwt/core` passes the algorithm it read from `_sd_alg`, so this is also\n * where a presentation declaring anything but sha-256 is refused\n */\nfunction hasher(data: string | ArrayBuffer, algorithm: string): Uint8Array {\n  if (algorithm.toLowerCase() !== AP2_DIGEST_ALGORITHM) {\n    throw ap2Rejected('malformed_presentation');\n  }\n  return sha256(typeof data === 'string' ? data : new Uint8Array(data));\n}\n\n/**\n * Order is the security boundary here: nothing is trusted until `jwtVerify`\n * returns. `kid` and `iss` are read before that only to pick which configured\n * key to try, and picking wrong just makes the signature fail.\n */\n// Both spellings of the renamed Delegate SD-JWT hop types\nconst KEY_BOUND_TYPES: ReadonlySet<string> = new Set([\n  'kb+sd-jwt',\n  'kb-sd-jwt',\n  'kb+sd-jwt+kb',\n  'kb-sd-jwt+kb',\n]);\n\nexport async function verifyMandate(\n  presentation: string,\n  deps: MandatePolicy,\n  context: Ap2ErrorContext,\n): Promise<VerifiedMandate> {\n  // Direct mode does not verify `~~`-joined delegation chains.\n  if (presentation.includes('~~')) {\n    throw ap2Rejected('unsupported_mandate_type', context);\n  }\n\n  let decoded: Awaited<ReturnType<typeof decodeSdJwt>>;\n  let encodedJws: string;\n  try {\n    // Covers a malformed base JWT, a disclosure that will not decode, a\n    // duplicate digest, and an `_sd_alg` other than sha-256\n    decoded = await decodeSdJwt(presentation, hasher);\n    encodedJws = splitSdJwt(presentation).jwt;\n  } catch (cause) {\n    throw ap2Rejected('malformed_presentation', { ...context, cause });\n  }\n\n  // Direct mode issues no key-bound mandates, so one arriving here belongs to\n  // a flow we do not verify. Ignoring it would mean silently not checking a\n  // proof that was sent.\n  if (decoded.kbJwt !== undefined) {\n    throw ap2Rejected('unsupported_mandate_type', context);\n  }\n\n  const rawPayload = decoded.jwt.payload;\n  const header = decoded.jwt.header;\n  if (!isRecord(rawPayload) || !isRecord(header)) {\n    throw ap2Rejected('malformed_presentation', context);\n  }\n\n  // Reject a delegation hop presented without its mandate. Its type or\n  // preceding-token hash identifies it.\n  if (\n    KEY_BOUND_TYPES.has(String(header['typ'])) ||\n    rawPayload['sd_hash'] !== undefined ||\n    rawPayload['issuer_jwt_hash'] !== undefined\n  ) {\n    throw ap2Rejected('unsupported_mandate_type', context);\n  }\n\n  const { issuer, key } = await deps.trust.resolve(rawPayload['iss'], header['kid'], context);\n\n  // AP2 permits an absent `aud`. If present, it must match the issuer's\n  // configured audience. The checkout JWT has a separate audience check.\n  const hasAudience = rawPayload['aud'] !== undefined;\n  if (!hasAudience && deps.requireAudience === true) {\n    throw ap2Rejected('invalid_claims', context);\n  }\n\n  const options: JWTVerifyOptions = {\n    // Redundant with one resolved EC key, which already refuses `alg: none` and\n    // a forged HMAC. It stops the header picking the algorithm if a key set is\n    // ever resolved instead.\n    algorithms: [AP2_SIGNING_ALGORITHM],\n    // Also redundant, since the key was resolved *from* `iss`, and kept as a\n    // backstop for a resolver that matches on something else\n    ...(rawPayload['iss'] !== undefined ? { issuer: issuer.issuer } : {}),\n    // Not redundant: `aud` is the presenter's claim, checked against the\n    // configured value\n    ...(hasAudience ? { audience: issuer.audience } : {}),\n    clockTolerance: deps.clockSkewSeconds,\n    // Injected clock, not jose's `Date.now()`, so expiry is testable\n    currentDate: deps.clock.now(),\n  };\n\n  let verifiedPayload: Record<string, unknown>;\n  try {\n    const result = await jwtVerify(encodedJws, key, options);\n    verifiedPayload = result.payload as Record<string, unknown>;\n  } catch (cause) {\n    throw ap2Rejected(classifyJoseFailure(cause), { ...context, cause });\n  }\n\n  let claims: Record<string, unknown>;\n  try {\n    // Against the VERIFIED payload: the decoded one would match disclosures\n    // against digests nobody signed\n    claims = (await getClaims(verifiedPayload, decoded.disclosures, hasher)) as Record<\n      string,\n      unknown\n    >;\n  } catch (cause) {\n    // Where an appended disclosure that no digest references is refused\n    throw ap2Rejected('malformed_presentation', { ...context, cause });\n  }\n\n  const mandate = delegatedMandate(claims, context);\n  // This verifier rejects KB-JWTs, so it cannot check a `cnf` holder-key\n  // binding. Reject the mandate rather than ignore the binding.\n  if (claims['cnf'] !== undefined || mandate['cnf'] !== undefined) {\n    throw ap2Rejected('unsupported_mandate_type', context);\n  }\n  requireClosedCheckoutMandate(mandate, context);\n  // Closed mandates cannot carry constraints this verifier does not evaluate\n  if (mandate['constraints'] !== undefined) {\n    throw ap2Rejected('unsupported_mandate_type', context);\n  }\n  requireFreshness([verifiedPayload, mandate], deps, context);\n\n  return { issuer: issuer.issuer, claims: mandate, signedToken: encodedJws };\n}\n\n/** What the verifier enforces beyond the signature */\nexport interface MandatePolicy {\n  readonly trust: TrustStore;\n  readonly clock: Clock;\n  readonly clockSkewSeconds: number;\n  /** Refuse a mandate with no `aud` */\n  readonly requireAudience?: boolean;\n  /** Refuse a mandate with no `exp`, at the top level or in the mandate content */\n  readonly requireExpiry?: boolean;\n}\n\n/**\n * Read the single object in `delegate_payload` after disclosure resolution.\n * The reference SDK discloses this element. If none or multiple are present,\n * there is no single mandate to check.\n */\nfunction delegatedMandate(\n  claims: Record<string, unknown>,\n  context: Ap2ErrorContext,\n): Record<string, unknown> {\n  const delegated = claims['delegate_payload'];\n  // One shape only: claims at the top level are refused, not read a second way\n  if (!Array.isArray(delegated)) throw ap2Rejected('unsupported_mandate_type', context);\n  const disclosed = delegated.filter(isRecord);\n  const [only] = disclosed;\n  if (disclosed.length !== 1 || only === undefined) throw ap2Rejected('invalid_claims', context);\n  return only;\n}\n\n/**\n * Matched on jose's stable error `code`, not its message. A client is owed\n * \"expired\" versus \"did not verify\"; anything finer describes our checks back\n * to whoever is probing them.\n */\nfunction classifyJoseFailure(\n  cause: unknown,\n): 'expired' | 'wrong_audience' | 'invalid_claims' | 'invalid_signature' {\n  const code = (cause as { code?: unknown })?.code;\n  if (code === 'ERR_JWT_EXPIRED') return 'expired';\n  if (code === 'ERR_JWT_CLAIM_VALIDATION_FAILED') {\n    const { claim, reason } = cause as { claim?: unknown; reason?: unknown };\n    if (claim === 'aud') return 'wrong_audience';\n    // `invalid` is jose's reason for a time claim that is not a number\n    if (claim === 'nbf' || claim === 'exp')\n      return reason === 'invalid' ? 'invalid_claims' : 'expired';\n  }\n  return 'invalid_signature';\n}\n\n/**\n * Check `exp`, `nbf` and `iat` on the signed token and the disclosed mandate.\n * `jose` checks only the token's time claims. AP2 requires none of them;\n * policy can require `exp` in either location.\n */\nfunction requireFreshness(\n  sources: readonly Record<string, unknown>[],\n  deps: MandatePolicy,\n  context: Ap2ErrorContext,\n): void {\n  const nowSeconds = Math.floor(deps.clock.now().getTime() / 1000);\n  let expires = false;\n  for (const claims of sources) {\n    const exp = claims['exp'];\n    const iat = claims['iat'];\n    if (exp !== undefined) {\n      if (typeof exp !== 'number') throw ap2Rejected('invalid_claims', context);\n      if (exp <= nowSeconds - deps.clockSkewSeconds) throw ap2Rejected('expired', context);\n      expires = true;\n    }\n    const nbf = claims['nbf'];\n    if (nbf !== undefined) {\n      if (typeof nbf !== 'number') throw ap2Rejected('invalid_claims', context);\n      if (nbf > nowSeconds + deps.clockSkewSeconds) throw ap2Rejected('expired', context);\n    }\n    if (iat !== undefined) {\n      if (typeof iat !== 'number') throw ap2Rejected('invalid_claims', context);\n      // A future `iat` is a broken signer, or a mandate minted to outlive its\n      // own expiry window\n      if (iat > nowSeconds + deps.clockSkewSeconds) throw ap2Rejected('expired', context);\n    }\n  }\n  if (!expires && deps.requireExpiry === true) throw ap2Rejected('invalid_claims', context);\n}\n\n// Exactly `mandate.checkout.1`; see AP2_CHECKOUT_MANDATE_VCT for why\nfunction requireClosedCheckoutMandate(\n  claims: Record<string, unknown>,\n  context: Ap2ErrorContext,\n): void {\n  if (claims['vct'] !== AP2_CHECKOUT_MANDATE_VCT) {\n    throw ap2Rejected('unsupported_mandate_type', context);\n  }\n}\n","/**\n * Static key resolution.\n *\n * Every key was written into `config.yaml` by an operator. No JWKS fetch, no\n * `jku`, no `x5u`. A mandate's `iss` and `kid`, or its `kid` alone when it\n * names no issuer, only choose *which* trusted key verifies it; anything\n * unrecognized is refused, so a mandate can never nominate its own signer.\n *\n * Not a \"try every key\" loop: that would make `kid` advisory and accept a\n * mandate that named a key it was not signed with.\n */\nimport { importJWK, type JWK } from 'jose';\nimport { AP2_SIGNING_ALGORITHM } from './constants';\nimport { type Ap2ErrorContext, ap2Rejected, ap2Unavailable } from './errors';\nimport type { Ap2TrustedIssuer } from './types';\n\n/** Named off `importJWK` because `CryptoKey` is a DOM type we do not load */\nexport type VerificationKey = Awaited<ReturnType<typeof importJWK>>;\n\nexport interface ResolvedKey {\n  readonly issuer: Ap2TrustedIssuer;\n  readonly key: VerificationKey;\n}\n\n/**\n * Resolves `(iss, kid)` against one configured issuer list. Caches the import\n * promise, not the key, so concurrent requests for a cold key share one import.\n */\nexport function createTrustStore(issuers: readonly Ap2TrustedIssuer[]) {\n  const byIssuer = new Map(issuers.map((entry) => [entry.issuer, entry]));\n  const imported = new Map<string, Promise<VerificationKey>>();\n\n  function issuerByName(iss: unknown, context: Ap2ErrorContext): Ap2TrustedIssuer {\n    if (typeof iss !== 'string' || iss.length === 0) {\n      throw ap2Rejected('invalid_claims', context);\n    }\n    const issuer = byIssuer.get(iss);\n    if (issuer === undefined) throw ap2Rejected('untrusted_issuer', context);\n    return issuer;\n  }\n\n  // AP2 mandates may omit `iss`; the reference SDK mints none. The `kid` then\n  // selects the issuer, and a `kid` that two issuers share selects neither.\n  function issuerByKid(kid: string, context: Ap2ErrorContext): Ap2TrustedIssuer {\n    const matches = issuers.filter((entry) => entry.keys.some((key) => key.kid === kid));\n    const [only] = matches;\n    if (matches.length !== 1 || only === undefined) throw ap2Rejected('unknown_key', context);\n    return only;\n  }\n\n  return {\n    /** Every trusted issuer id, for diagnostics. Never the keys themselves */\n    issuerIds(): readonly string[] {\n      return [...byIssuer.keys()];\n    },\n\n    async resolve(iss: unknown, kid: unknown, context: Ap2ErrorContext): Promise<ResolvedKey> {\n      // Not defaulted to the issuer's only key: mid-rotation there are two,\n      // and the gateway should not guess which one signed this\n      if (typeof kid !== 'string' || kid.length === 0) {\n        throw ap2Rejected('unknown_key', context);\n      }\n      const issuer = iss === undefined ? issuerByKid(kid, context) : issuerByName(iss, context);\n      const trusted = issuer.keys.find((candidate) => candidate.kid === kid);\n      if (trusted === undefined) throw ap2Rejected('unknown_key', context);\n\n      // JSON, not a joined string: both halves are operator-chosen and could\n      // contain whatever separator we picked\n      const cacheKey = JSON.stringify([iss, kid]);\n      let pending = imported.get(cacheKey);\n      if (pending === undefined) {\n        pending = importJWK(trusted.jwk as JWK, AP2_SIGNING_ALGORITHM);\n        imported.set(cacheKey, pending);\n      }\n\n      try {\n        return { issuer, key: await pending };\n      } catch (cause) {\n        // Config already checked this JWK member by member, so reaching here\n        // means our config is broken, not the mandate. Drop the cached\n        // rejection so the next request retries the import.\n        imported.delete(cacheKey);\n        throw ap2Unavailable('configured verification key could not be imported', {\n          ...context,\n          cause,\n        });\n      }\n    },\n  };\n}\n\nexport type TrustStore = ReturnType<typeof createTrustStore>;\n","/**\n * The Direct Checkout Mandate verifier: mandate signature first, then the\n * merchant checkout JWT it binds. Either stage failing is a refusal.\n *\n * Verification establishes that a trusted issuer signed the mandate, its\n * supplied time and audience claims pass policy, and it binds a checkout JWT\n * signed by a trusted merchant issuer. `bindMandateToPurchase` separately\n * checks the purchase before settlement.\n */\nimport type { Clock } from '../../core';\nimport { verifyCheckoutJwt } from './checkout-jwt';\nimport { type Ap2ErrorContext, ap2Rejected } from './errors';\nimport { verifyMandate } from './sd-jwt';\nimport { sha256 } from './sha256';\nimport { createTrustStore } from './trust';\nimport type { EnabledAp2Config, VerifiedCheckoutMandate } from './types';\n\nexport interface Ap2VerifierOptions {\n  readonly config: EnabledAp2Config;\n  readonly clock: Clock;\n}\n\nexport interface Ap2MandateVerifier {\n  verify(presentation: string, context?: Ap2ErrorContext): Promise<VerifiedCheckoutMandate>;\n  /** Trusted issuer ids, for the provider's health detail. Never keys */\n  trustedIssuers(): { readonly mandate: readonly string[]; readonly checkout: readonly string[] };\n}\n\n/**\n * Algorithm-prefixed so a future digest change is visible in stored references\n * rather than silently producing unequal values for one mandate\n */\nfunction mandateReference(signedToken: string): string {\n  return `sha256:${sha256(signedToken).toString('base64url')}`;\n}\n\nexport function createAp2MandateVerifier(options: Ap2VerifierOptions): Ap2MandateVerifier {\n  // Two stores, not one list: signing the merchant's checkout documents must\n  // not confer the power to issue mandates\n  const mandateTrust = createTrustStore(options.config.trust.mandateIssuers);\n  const checkoutTrust = createTrustStore(options.config.trust.checkoutIssuers);\n  const deps = { clock: options.clock, clockSkewSeconds: options.config.clockSkewSeconds };\n  const mandatePolicy = {\n    ...deps,\n    trust: mandateTrust,\n    requireAudience: options.config.requireMandateAudience === true,\n    requireExpiry: options.config.requireMandateExpiry === true,\n  };\n\n  return {\n    async verify(\n      presentation: string,\n      context: Ap2ErrorContext = {},\n    ): Promise<VerifiedCheckoutMandate> {\n      if (typeof presentation !== 'string' || presentation.length === 0) {\n        throw ap2Rejected('malformed_presentation', context);\n      }\n\n      const mandate = await verifyMandate(presentation, mandatePolicy, context);\n      const checkout = await verifyCheckoutJwt(\n        mandate.claims,\n        { ...deps, trust: checkoutTrust },\n        context,\n      );\n\n      return {\n        reference: mandateReference(mandate.signedToken),\n        mandateIssuer: mandate.issuer,\n        checkoutIssuer: checkout.issuer,\n        checkoutJwtId: checkout.jwtId,\n        checkoutClaims: checkout.claims,\n      };\n    },\n\n    trustedIssuers() {\n      return { mandate: mandateTrust.issuerIds(), checkout: checkoutTrust.issuerIds() };\n    },\n  };\n}\n","/**\n * The AP2 authorization provider: the seam between core's generic contract and\n * the mandate machinery.\n *\n * It owns its replay store, so whoever creates it must call `close()`:\n * `createGateway` does not close authorization providers.\n */\nimport type {\n  AdapterHealth,\n  AuthorizationFinalizeContext,\n  AuthorizationProvider,\n  AuthorizationRequirement,\n  AuthorizationVerification,\n  AuthorizationVerificationContext,\n  Clock,\n  Logger,\n} from '../../core';\nimport { NOOP_LOGGER, systemClock } from '../../core';\nimport { PACKAGE_VERSION } from '../../version';\nimport { AP2_CHECKOUT_PROFILE, AP2_SPEC_VERSION } from './constants';\nimport { buildAp2Descriptor } from './descriptor';\nimport { type Ap2ErrorContext, ap2Replayed, ap2Unavailable } from './errors';\nimport { bindMandateToPurchase } from './profile';\nimport { type Ap2ReplayStore, createAp2ReplayStore } from './replay-store';\nimport type { EnabledAp2Config } from './types';\nimport { createAp2MandateVerifier } from './verifier';\n\nexport interface Ap2AuthorizationProviderOptions {\n  readonly config: EnabledAp2Config;\n  readonly clock?: Clock;\n  readonly logger?: Logger;\n  /** Injectable so tests need not touch the filesystem */\n  readonly replayStore?: Ap2ReplayStore;\n}\n\nexport interface Ap2AuthorizationProvider extends AuthorizationProvider {\n  /** Closes the replay store */\n  close(): void;\n}\n\nexport function createAp2AuthorizationProvider(\n  options: Ap2AuthorizationProviderOptions,\n): Ap2AuthorizationProvider {\n  const clock = options.clock ?? systemClock;\n  const logger = options.logger ?? NOOP_LOGGER;\n\n  const verifier = createAp2MandateVerifier({ config: options.config, clock });\n  const replay =\n    options.replayStore ?? createAp2ReplayStore({ path: options.config.replay.path, logger });\n\n  const requirement: AuthorizationRequirement = {\n    method: 'ap2',\n    version: AP2_SPEC_VERSION,\n    profile: AP2_CHECKOUT_PROFILE,\n  };\n\n  async function verifyAndReserve(\n    context: AuthorizationVerificationContext,\n  ): Promise<AuthorizationVerification> {\n    const errorContext: Ap2ErrorContext = {\n      requestId: context.requestId,\n      resourceId: context.resourceId,\n    };\n\n    const mandate = await verifier.verify(context.submission.payload, errorContext);\n    // Before reserving, not after: a mandate that does not authorize this\n    // purchase must stay spendable on the purchase it does authorize\n    await bindMandateToPurchase(mandate, context, errorContext);\n\n    let reservation: ReturnType<Ap2ReplayStore['reserve']>;\n    try {\n      reservation = replay.reserve({\n        reference: mandate.reference,\n        checkoutJti: mandate.checkoutJwtId,\n        mandateIssuer: mandate.mandateIssuer,\n        checkoutIssuer: mandate.checkoutIssuer,\n        resourceId: context.resourceId,\n        requestId: context.requestId,\n      });\n    } catch (cause) {\n      throw ap2Unavailable('replay store could not be written', { ...errorContext, cause });\n    }\n\n    if (reservation.kind === 'replayed') {\n      throw ap2Replayed(reservation.state, errorContext);\n    }\n\n    return {\n      status: 'verified',\n      method: 'ap2',\n      reference: mandate.reference,\n      // The reservation handle is the reference itself, so the two can never\n      // name different mandates\n      reservationId: mandate.reference,\n      // Opaque identifiers an operator can reconcile with. Never a claim from\n      // the mandate: those carry the buyer's purchase and their personal data.\n      // `checkoutId`, not `checkoutJwtId` - the receipt store redacts any key\n      // that reads as secret-shaped, and \"jwt\" is on that list.\n      metadata: {\n        mandateIssuer: mandate.mandateIssuer,\n        checkoutIssuer: mandate.checkoutIssuer,\n        checkoutId: mandate.checkoutJwtId,\n      },\n    };\n  }\n\n  const finalize = (\n    action: 'consume' | 'release' | 'markUncertain',\n    reservationId: string,\n    context: AuthorizationFinalizeContext,\n  ): void => {\n    try {\n      replay[action](reservationId);\n    } catch (cause) {\n      throw ap2Unavailable(`replay store could not record ${action}`, { ...context, cause });\n    }\n  };\n\n  return {\n    name: 'ap2',\n    descriptor: buildAp2Descriptor(PACKAGE_VERSION),\n    requirement,\n    verifyAndReserve,\n\n    async consume(reservationId, context) {\n      finalize('consume', reservationId, context);\n    },\n    async release(reservationId, context) {\n      finalize('release', reservationId, context);\n    },\n    async markUncertain(reservationId, context) {\n      finalize('markUncertain', reservationId, context);\n    },\n\n    async health(): Promise<AdapterHealth> {\n      const startedAt = clock.monotonicMs();\n      const checkedAt = clock.nowIso();\n      let available = true;\n      try {\n        // A read against the real table, so a database that opened but cannot\n        // be queried is caught here rather than on the first purchase\n        replay.stateOf('health-probe');\n      } catch {\n        available = false;\n      }\n      const durationMs = Math.round(clock.monotonicMs() - startedAt);\n      if (!available) {\n        // A fixed token, never a sentence built from the caught error\n        return { status: 'fail', checkedAt, durationMs, detail: 'replay-store-unavailable' };\n      }\n      const trusted = verifier.trustedIssuers();\n      return {\n        status: 'pass',\n        checkedAt,\n        durationMs,\n        detail: `mandate-issuers=${trusted.mandate.length} checkout-issuers=${trusted.checkout.length}`,\n      };\n    },\n\n    close() {\n      replay.close();\n    },\n  };\n}\n"]}
+{"version":3,"sources":["../src/authorization/ap2/errors.ts","../src/authorization/ap2/sha256.ts","../src/authorization/ap2/profile.ts","../src/authorization/ap2/checkout-signer.ts","../src/authorization/ap2/descriptor.ts","../src/authorization/ap2/replay-store.ts","../src/authorization/ap2/checkout-jwt.ts","../src/authorization/ap2/sd-jwt.ts","../src/authorization/ap2/trust.ts","../src/authorization/ap2/verifier.ts","../src/authorization/ap2/provider.ts"],"names":["jwtVerify"],"mappings":";;;;;;;;;;AAqBO,IAAM,qBAAA,GAAwB;AAAA,EACnC,wBAAA;AAAA,EACA,kBAAA;AAAA,EACA,aAAA;AAAA,EACA,mBAAA;AAAA,EACA,gBAAA;AAAA,EACA,SAAA;AAAA,EACA,gBAAA;AAAA,EACA,0BAAA;AAAA,EACA,yBAAA;AAAA,EACA;AACF;AAIA,IAAM,QAAA,GAAyD;AAAA,EAC7D,sBAAA,EAAwB,6DAAA;AAAA,EACxB,gBAAA,EAAkB,iEAAA;AAAA,EAClB,WAAA,EAAa,+DAAA;AAAA,EACb,iBAAA,EAAmB,uCAAA;AAAA,EACnB,cAAA,EAAgB,+DAAA;AAAA,EAChB,OAAA,EAAS,0CAAA;AAAA,EACT,cAAA,EAAgB,mDAAA;AAAA,EAChB,wBAAA,EAA0B,sDAAA;AAAA,EAC1B,uBAAA,EAAyB,qEAAA;AAAA,EACzB,iBAAA,EAAmB;AACrB,CAAA;AASO,SAAS,WAAA,CACd,MAAA,EACA,OAAA,GAA2B,EAAC,EACb;AACf,EAAA,OAAO,IAAI,aAAA,CAAc,uBAAA,EAAyB,QAAA,CAAS,MAAM,CAAA,EAAG;AAAA,IAClE,OAAA,EAAS,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAA,EAAO;AAAA,IACjC,GAAI,QAAQ,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,EAAW,OAAA,CAAQ,SAAA,EAAU,GAAI,EAAC;AAAA,IAC1E,GAAI,QAAQ,UAAA,KAAe,MAAA,GAAY,EAAE,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAW,GAAI,EAAC;AAAA,IAC7E,GAAI,QAAQ,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAM,GAAI;AAAC,GAC/D,CAAA;AACH;AAMO,SAAS,WAAA,CAAY,KAAA,EAAe,OAAA,GAA2B,EAAC,EAAkB;AACvF,EAAA,OAAO,IAAI,aAAA;AAAA,IACT,wBAAA;AAAA,IACA,gFAAA;AAAA,IACA;AAAA,MACE,SAAS,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAA,EAAQ,YAAY,KAAA,EAAM;AAAA,MACpD,GAAI,QAAQ,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,EAAW,OAAA,CAAQ,SAAA,EAAU,GAAI,EAAC;AAAA,MAC1E,GAAI,QAAQ,UAAA,KAAe,MAAA,GAAY,EAAE,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAW,GAAI;AAAC;AAC/E,GACF;AACF;AAMO,SAAS,cAAA,CAAe,MAAA,EAAgB,OAAA,GAA2B,EAAC,EAAkB;AAC3F,EAAA,OAAO,IAAI,aAAA;AAAA,IACT,oCAAA;AAAA,IACA,yHAAA;AAAA,IACA;AAAA,MACE,SAAS,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAA,EAAQ,wBAAwB,MAAA,EAAO;AAAA,MACjE,GAAI,QAAQ,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,EAAW,OAAA,CAAQ,SAAA,EAAU,GAAI,EAAC;AAAA,MAC1E,GAAI,QAAQ,UAAA,KAAe,MAAA,GAAY,EAAE,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAW,GAAI,EAAC;AAAA,MAC7E,GAAI,QAAQ,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAM,GAAI;AAAC;AAChE,GACF;AACF;AChGO,SAAS,OAAO,IAAA,EAAmC;AACxD,EAAA,OAAO,WAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,IAAI,EAAE,MAAA,EAAO;AAClD;;;ACeA,IAAM,uBAAA,GAA0B;AAAA,EAC9B,SAAA;AAAA,EACA,aAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA;AAgBO,SAAS,iBAAiB,KAAA,EAAwB;AACvD,EAAA,MAAM,SAAA,GAAY,YAAA,CAAa,KAAA,IAAS,EAAE,CAAA;AAI1C,EAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,IAAA,MAAM,IAAI,aAAA,CAAc,gBAAA,EAAkB,4CAA4C,CAAA;AAAA,EACxF;AACA,EAAA,OAAO,MAAA,CAAO,SAAS,CAAA,CAAE,QAAA,CAAS,WAAW,CAAA;AAC/C;AAEA,IAAM,WAAA,GAAc,mBAAA;AAIpB,SAAS,cAAA,CAAe,UAAmB,QAAA,EAAuC;AAChF,EAAA,IAAI,OAAO,QAAA,KAAa,QAAA,IAAY,QAAA,KAAa,MAAA,EAAW;AAC1D,IAAA,IAAI,YAAY,IAAA,CAAK,QAAQ,KAAK,WAAA,CAAY,IAAA,CAAK,QAAQ,CAAA,EAAG;AAC5D,MAAA,OAAO,QAAA,CAAS,WAAA,EAAY,KAAM,QAAA,CAAS,WAAA,EAAY;AAAA,IACzD;AAAA,EACF;AACA,EAAA,OAAO,QAAA,KAAa,QAAA;AACtB;AAOA,eAAsB,qBAAA,CACpB,OAAA,EACA,OAAA,EACA,YAAA,EACe;AACf,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,cAAA,CAAe,gBAAgB,CAAA;AACvD,EAAA,IAAI,CAAC,QAAA,CAAS,OAAO,GAAG,MAAM,WAAA,CAAY,qBAAqB,YAAY,CAAA;AAE3E,EAAA,KAAA,MAAW,SAAS,uBAAA,EAAyB;AAC3C,IAAA,MAAM,KAAA,GAAQ,QAAQ,KAAK,CAAA;AAC3B,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,WAAW,CAAA,EAAG;AACnD,MAAA,MAAM,WAAA,CAAY,qBAAqB,YAAY,CAAA;AAAA,IACrD;AAAA,EACF;AAEA,EAAA,MAAM,cAAc,OAAA,CAAQ,WAAA;AAC5B,EAAA,MAAM,iBAAA,GAAoB,gBAAA,CAAiB,OAAA,CAAQ,KAAK,CAAA;AAExD,EAAA,MAAM,SAAA,GAAqD;AAAA,IACzD,CAAC,WAAW,oBAAoB,CAAA;AAAA,IAChC,CAAC,aAAA,EAAe,OAAA,CAAQ,UAAU,CAAA;AAAA,IAClC,CAAC,cAAc,iBAAiB,CAAA;AAAA;AAAA;AAAA,IAGhC,CAAC,QAAA,EAAU,WAAA,CAAY,MAAM,CAAA;AAAA,IAC7B,CAAC,UAAA,EAAY,WAAA,CAAY,QAAQ,CAAA;AAAA,IACjC,CAAC,gBAAA,EAAkB,WAAA,CAAY,QAAQ;AAAA,GACzC;AAEA,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,QAAQ,CAAA,IAAK,SAAA,EAAW;AACzC,IAAA,IAAI,QAAQ,KAAK,CAAA,KAAM,UAAU,MAAM,WAAA,CAAY,qBAAqB,YAAY,CAAA;AAAA,EACtF;AAKA,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,QAAQ,CAAA,IAAK;AAAA,IAC9B,CAAC,aAAA,EAAe,WAAA,CAAY,WAAW,CAAA;AAAA,IACvC,CAAC,SAAA,EAAW,WAAA,CAAY,OAAO,CAAA;AAAA,IAC/B,CAAC,OAAA,EAAS,WAAA,CAAY,KAAK;AAAA,GAC7B,EAAY;AACV,IAAA,MAAM,QAAA,GAAW,QAAQ,KAAK,CAAA;AAC9B,IAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,KAAa,MAAA,EAAW;AACtD,IAAA,IAAI,CAAC,eAAe,QAAA,EAAU,QAAQ,GAAG,MAAM,WAAA,CAAY,qBAAqB,YAAY,CAAA;AAAA,EAC9F;AACF;;;AC/CA,IAAM,0BAAA,GAA6B,GAAA;AAEnC,SAAS,WAAA,CAAY,OAAgB,KAAA,EAAuB;AAC1D,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,WAAW,CAAA,EAAG;AACnD,IAAA,MAAM,IAAI,SAAA;AAAA,MACR,CAAA,mBAAA,EAAsB,KAAK,CAAA,sCAAA,EAAyC,QAAA,CAAS,KAAK,CAAC,CAAA;AAAA,KACrF;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,SAAS,KAAA,EAAwB;AACxC,EAAA,OAAO,KAAA,KAAU,IAAA,GAAO,MAAA,GAAS,OAAO,KAAA;AAC1C;AAOA,eAAe,WACb,GAAA,EACwD;AACxD,EAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,IAAA,IAAI,CAAC,GAAA,CAAI,QAAA,CAAS,mBAAmB,CAAA,EAAG;AACtC,MAAA,MAAM,IAAI,SAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO,WAAA,CAAY,KAAK,qBAAqB,CAAA;AAAA,EAC/C;AACA,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,IAAA,EAAM;AAC3C,IAAA,MAAM,IAAI,UAAU,qEAAqE,CAAA;AAAA,EAC3F;AACA,EAAA,IAAI,GAAA,CAAI,GAAG,CAAA,KAAM,MAAA,EAAW;AAC1B,IAAA,MAAM,IAAI,SAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,IAAI,KAAK,CAAA,KAAM,gBAAgB,GAAA,CAAI,KAAK,MAAM,aAAA,EAAe;AAC/D,IAAA,MAAM,IAAI,SAAA;AAAA,MACR,CAAA,sCAAA,EAAyC,YAAY,CAAA,CAAA,EAAI,aAAa,cAAc,qBAAqB,CAAA,QAAA;AAAA,KAC3G;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAMA,eAAsB,kBAAkB,OAAA,EAAoD;AAC1F,EAAA,MAAM,GAAA,GAAM,WAAA,CAAY,OAAA,CAAQ,GAAA,EAAK,KAAK,CAAA;AAC1C,EAAA,MAAM,MAAA,GAAS,WAAA,CAAY,OAAA,CAAQ,MAAA,EAAQ,QAAQ,CAAA;AACnD,EAAA,MAAM,QAAA,GAAW,WAAA,CAAY,OAAA,CAAQ,QAAA,EAAU,UAAU,CAAA;AACzD,EAAA,MAAM,UAAA,GAAa,WAAA,CAAY,OAAA,CAAQ,UAAA,EAAY,YAAY,CAAA;AAC/D,EAAA,MAAM,QAAA,GAAW,WAAA,CAAY,OAAA,CAAQ,QAAA,EAAU,UAAU,CAAA;AACzD,EAAA,MAAM,aAAA,GAAgB,WAAA,CAAY,OAAA,CAAQ,aAAA,EAAe,eAAe,CAAA;AAExE,EAAA,IAAI,OAAO,OAAA,CAAQ,MAAA,KAAW,QAAA,EAAU;AACtC,IAAA,MAAM,IAAI,SAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAS,WAAA,CAAY,OAAA,CAAQ,MAAA,EAAQ,QAAQ,CAAA;AAEnD,EAAA,MAAM,GAAA,GAAM,MAAM,UAAA,CAAW,OAAA,CAAQ,UAAU,CAAA;AAC/C,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAA,CAAO,OAAA,CAAQ,GAAA,wBAAW,IAAA,EAAK,EAAG,OAAA,EAAQ,GAAI,GAAI,CAAA;AACxE,EAAA,MAAM,SAAA,GAAY,QAAQ,gBAAA,IAAoB,0BAAA;AAC9C,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,SAAS,CAAA,IAAK,aAAa,CAAA,EAAG;AAClD,IAAA,MAAM,IAAI,UAAU,qEAAqE,CAAA;AAAA,EAC3F;AAEA,EAAA,MAAM,aAAA,GAAwC;AAAA,IAC5C,OAAA,EAAS,oBAAA;AAAA,IACT,WAAA,EAAa,UAAA;AAAA,IACb,UAAA,EAAY,gBAAA,CAAiB,OAAA,CAAQ,KAAK,CAAA;AAAA,IAC1C,MAAA;AAAA,IACA,QAAA;AAAA,IACA,cAAA,EAAgB,aAAA;AAAA,IAChB,GAAI,QAAQ,WAAA,KAAgB,MAAA,GAAY,EAAE,WAAA,EAAa,OAAA,CAAQ,WAAA,EAAY,GAAI,EAAC;AAAA,IAChF,GAAI,QAAQ,OAAA,KAAY,MAAA,GAAY,EAAE,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAQ,GAAI,EAAC;AAAA,IACpE,GAAI,QAAQ,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAM,GAAI;AAAC,GAChE;AAEA,EAAA,OAAO,IAAI,OAAA,CAAQ,EAAE,cAAA,EAAgB,aAAA,EAAe,CAAA,CACjD,kBAAA,CAAmB,EAAE,GAAA,EAAK,uBAAuB,GAAA,EAAK,GAAA,EAAK,KAAA,EAAO,EAClE,SAAA,CAAU,MAAM,CAAA,CAChB,WAAA,CAAY,QAAQ,CAAA,CACpB,WAAA,CAAY,QAAQ,CAAA,CACpB,kBAAkB,QAAA,GAAW,SAAS,CAAA,CACtC,MAAA,CAAO,QAAQ,KAAA,IAAS,MAAA,CAAO,YAAY,CAAA,CAC3C,KAAK,GAAG,CAAA;AACb;;;ACnJO,IAAM,gBAAA,GAAsC;AAAA,EACjD,aAAA;AAAA,EACA,wBAAA;AAAA,EACA,wBAAA;AAAA,EACA,qBAAA;AAAA,EACA,qBAAA;AAAA,EACA,oBAAA;AAAA,EACA,qBAAA;AAAA,EACA,+BAAA;AAAA,EACA,oBAAA;AAAA,EACA,kBAAA;AAAA,EACA;AACF;AAOO,IAAM,eAAA,GAAqC;AAAA;AAAA,EAEhD,iBAAA;AAAA,EACA,kDAAA;AAAA,EACA,sCAAA;AAAA,EACA,gCAAA;AAAA,EACA,sBAAA;AAAA;AAAA,EAEA,wCAAA;AAAA,EACA,wCAAA;AAAA;AAAA,EAEA,8CAAA;AAAA,EACA,0BAAA;AAAA,EACA,sCAAA;AAAA;AAAA,EAEA,uCAAA;AAAA,EACA,sCAAA;AAAA;AAAA,EAEA,kBAAA;AAAA,EACA,mBAAA;AAAA,EACA;AACF;AAEO,SAAS,mBAAmB,qBAAA,EAAkD;AACnF,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,KAAA;AAAA,IACN,IAAA,EAAM,eAAA;AAAA,IACN,qBAAA;AAAA,IACA,aAAA,EAAe,QAAQ,gBAAgB,CAAA,YAAA,CAAA;AAAA,IACvC,YAAA,EAAc,gBAAA;AAAA,IACd,MAAA,EAAQ,cAAA;AAAA,IACR,WAAA,EAAa;AAAA,GACf;AACF;;;ACQO,SAAS,qBAAqB,OAAA,EAAgD;AACnF,EAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,IAAU,WAAA;AACjC,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,KAAQ,MAAM,KAAK,GAAA,EAAI,CAAA;AAE3C,EAAA,MAAM,KAAe,kBAAA,CAAmB;AAAA,IACtC,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,KAAA,EAAO,4BAAA;AAAA,IACP;AAAA,GACD,CAAA;AACD,EAAA,OAAA,CAAQ,EAAE,CAAA;AAEV,EAAA,MAAM,oBAAoB,EAAA,CAAG,OAAA;AAAA,IAC3B;AAAA,GACF;AAGA,EAAA,MAAM,kBAAkB,EAAA,CAAG,OAAA;AAAA,IACzB,CAAA;AAAA,uEAAA;AAAA,GAEF;AACA,EAAA,MAAM,SAAS,EAAA,CAAG,OAAA;AAAA,IAChB,CAAA;AAAA;AAAA;AAAA;AAAA,+CAAA;AAAA,GAKF;AACA,EAAA,MAAM,YAAY,EAAA,CAAG,OAAA;AAAA,IACnB,CAAA;AAAA;AAAA,yDAAA;AAAA,GAGF;AAGA,EAAA,MAAM,aAAa,EAAA,CAAG,OAAA;AAAA,IACpB,CAAA;AAAA,yDAAA;AAAA,GAEF;AAEA,EAAA,MAAM,SAAA,GAAY,EAAA,CAAG,WAAA,CAAY,CAAC,OAAA,KAAyD;AACzF,IAAA,MAAM,KAAK,IAAI,IAAA,CAAK,GAAA,EAAK,EAAE,WAAA,EAAY;AAEvC,IAAA,MAAM,QAAA,GAAW,iBAAA,CAAkB,GAAA,CAAI,OAAA,CAAQ,SAAS,CAAA;AACxD,IAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,CAAS,KAAA,KAAU,UAAA,EAAY;AAC3D,MAAA,OAAO,EAAE,IAAA,EAAM,UAAA,EAAY,KAAA,EAAO,SAAS,KAAA,EAA+B;AAAA,IAC5E;AAIA,IAAA,MAAM,eAAe,eAAA,CAAgB,GAAA,CAAI,OAAA,CAAQ,WAAA,EAAa,QAAQ,SAAS,CAAA;AAC/E,IAAA,IAAI,iBAAiB,MAAA,EAAW;AAC9B,MAAA,OAAO,EAAE,IAAA,EAAM,UAAA,EAAY,KAAA,EAAO,aAAa,KAAA,EAA+B;AAAA,IAChF;AAEA,IAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,MAAA,SAAA,CAAU,GAAA,CAAI,EAAE,SAAA,EAAW,OAAA,CAAQ,WAAW,UAAA,EAAY,OAAA,CAAQ,SAAA,EAAW,EAAA,EAAI,CAAA;AACjF,MAAA,OAAO,EAAE,MAAM,UAAA,EAAW;AAAA,IAC5B;AAEA,IAAA,MAAA,CAAO,GAAA,CAAI;AAAA,MACT,WAAW,OAAA,CAAQ,SAAA;AAAA,MACnB,cAAc,OAAA,CAAQ,WAAA;AAAA,MACtB,gBAAgB,OAAA,CAAQ,aAAA;AAAA,MACxB,iBAAiB,OAAA,CAAQ,cAAA;AAAA,MACzB,aAAa,OAAA,CAAQ,UAAA;AAAA,MACrB,YAAY,OAAA,CAAQ,SAAA;AAAA,MACpB;AAAA,KACD,CAAA;AACD,IAAA,OAAO,EAAE,MAAM,UAAA,EAAW;AAAA,EAC5B,CAAC,CAAA;AAED,EAAA,MAAM,IAAA,GAAO,CAAC,SAAA,EAAmB,KAAA,KAAuC;AACtE,IAAA,UAAA,CAAW,GAAA,CAAI,EAAE,SAAA,EAAW,KAAA,EAAO,EAAA,EAAI,IAAI,IAAA,CAAK,GAAA,EAAK,CAAA,CAAE,WAAA,EAAY,EAAG,CAAA;AAAA,EACxE,CAAA;AAEA,EAAA,IAAI,MAAA,GAAS,KAAA;AACb,EAAA,OAAO;AAAA,IACL,QAAQ,OAAA,EAAS;AACf,MAAA,OAAO,UAAU,OAAO,CAAA;AAAA,IAC1B,CAAA;AAAA,IACA,QAAQ,SAAA,EAAW;AACjB,MAAA,IAAA,CAAK,WAAW,UAAU,CAAA;AAAA,IAC5B,CAAA;AAAA,IACA,QAAQ,SAAA,EAAW;AACjB,MAAA,IAAA,CAAK,WAAW,UAAU,CAAA;AAAA,IAC5B,CAAA;AAAA,IACA,cAAc,SAAA,EAAW;AACvB,MAAA,IAAA,CAAK,WAAW,WAAW,CAAA;AAAA,IAC7B,CAAA;AAAA,IACA,QAAQ,SAAA,EAAW;AACjB,MAAA,OAAO,iBAAA,CAAkB,GAAA,CAAI,SAAS,CAAA,EAAG,KAAA;AAAA,IAC3C,CAAA;AAAA,IACA,KAAA,GAAQ;AACN,MAAA,IAAI,MAAA,EAAQ;AACZ,MAAA,MAAA,GAAS,IAAA;AACT,MAAA,EAAA,CAAG,KAAA,EAAM;AAAA,IACX;AAAA,GACF;AACF;AAGA,SAAS,QAAQ,EAAA,EAAoB;AACnC,EAAA,MAAM,UAAU,EAAA,CAAG,MAAA,CAAO,gBAAgB,EAAE,MAAA,EAAQ,MAAM,CAAA;AAC1D,EAAA,IAAI,WAAW,CAAA,EAAG;AAClB,EAAA,MAAM,KAAA,GAAQ,EAAA,CAAG,WAAA,CAAY,MAAM;AACjC,IAAA,EAAA,CAAG,IAAA,CAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAAA,CAeP,CAAA;AACD,IAAA,EAAA,CAAG,OAAO,kBAAkB,CAAA;AAAA,EAC9B,CAAC,CAAA;AACD,EAAA,KAAA,EAAM;AACR;AC/KA,eAAsB,iBAAA,CACpB,aAAA,EACA,IAAA,EACA,OAAA,EAC8B;AAC9B,EAAA,MAAM,OAAA,GAAU,cAAc,cAAc,CAAA;AAC5C,EAAA,MAAM,YAAA,GAAe,cAAc,eAAe,CAAA;AAClD,EAAA,IAAI,OAAO,OAAA,KAAY,QAAA,IAAY,OAAA,CAAQ,WAAW,CAAA,EAAG;AACvD,IAAA,MAAM,WAAA,CAAY,kBAAkB,OAAO,CAAA;AAAA,EAC7C;AACA,EAAA,IAAI,OAAO,YAAA,KAAiB,QAAA,IAAY,YAAA,CAAa,WAAW,CAAA,EAAG;AACjE,IAAA,MAAM,WAAA,CAAY,kBAAkB,OAAO,CAAA;AAAA,EAC7C;AAEA,EAAA,mBAAA,CAAoB,OAAA,EAAS,cAAc,OAAO,CAAA;AAGlD,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,iBAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,sBAAsB,OAAO,CAAA;AACtC,IAAA,iBAAA,GAAoB,UAAU,OAAO,CAAA;AAAA,EACvC,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,YAAY,yBAAA,EAA2B,EAAE,GAAG,OAAA,EAAS,OAAO,CAAA;AAAA,EACpE;AAEA,EAAA,MAAM,EAAE,MAAA,EAAQ,GAAA,EAAI,GAAI,MAAM,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,iBAAA,CAAkB,GAAA,EAAK,MAAA,CAAO,GAAA,EAAK,OAAO,CAAA;AAE3F,EAAA,MAAM,OAAA,GAA4B;AAAA,IAChC,UAAA,EAAY,CAAC,qBAAqB,CAAA;AAAA,IAClC,QAAQ,MAAA,CAAO,MAAA;AAAA,IACf,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,gBAAgB,IAAA,CAAK,gBAAA;AAAA,IACrB,WAAA,EAAa,IAAA,CAAK,KAAA,CAAM,GAAA;AAAI,GAC9B;AAEA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAM,SAAA,CAAU,OAAA,EAAS,KAAK,OAAO,CAAA;AACpD,IAAA,MAAA,GAAS,MAAA,CAAO,OAAA;AAAA,EAClB,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,YAAY,yBAAA,EAA2B,EAAE,GAAG,OAAA,EAAS,OAAO,CAAA;AAAA,EACpE;AAEA,EAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AACxB,EAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AACxB,EAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AAExB,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,OAAO,QAAQ,QAAA,EAAU;AACtD,IAAA,MAAM,WAAA,CAAY,kBAAkB,OAAO,CAAA;AAAA,EAC7C;AAEA,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,WAAW,CAAA,EAAG;AAC/C,IAAA,MAAM,WAAA,CAAY,kBAAkB,OAAO,CAAA;AAAA,EAC7C;AACA,EAAA,MAAM,UAAA,GAAa,KAAK,KAAA,CAAM,IAAA,CAAK,MAAM,GAAA,EAAI,CAAE,OAAA,EAAQ,GAAI,GAAI,CAAA;AAC/D,EAAA,IAAI,MAAM,UAAA,GAAa,IAAA,CAAK,kBAAkB,MAAM,WAAA,CAAY,WAAW,OAAO,CAAA;AAElF,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,CAAO,MAAA,EAAQ,KAAA,EAAO,KAAK,MAAA,EAAO;AACrD;AAMA,SAAS,mBAAA,CAAoB,OAAA,EAAiB,QAAA,EAAkB,OAAA,EAAgC;AAE9F,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,OAAO,CAAA,CAAE,SAAS,WAAW,CAAA;AAGnD,EAAA,IAAI,MAAA,KAAW,QAAA,EAAU,MAAM,WAAA,CAAY,2BAA2B,OAAO,CAAA;AAC/E;AC7DA,SAAS,MAAA,CAAO,MAA4B,SAAA,EAA+B;AACzE,EAAA,IAAI,SAAA,CAAU,WAAA,EAAY,KAAM,oBAAA,EAAsB;AACpD,IAAA,MAAM,YAAY,wBAAwB,CAAA;AAAA,EAC5C;AACA,EAAA,OAAO,MAAA,CAAO,OAAO,IAAA,KAAS,QAAA,GAAW,OAAO,IAAI,UAAA,CAAW,IAAI,CAAC,CAAA;AACtE;AAQA,IAAM,eAAA,uBAA2C,GAAA,CAAI;AAAA,EACnD,WAAA;AAAA,EACA,WAAA;AAAA,EACA,cAAA;AAAA,EACA;AACF,CAAC,CAAA;AAED,eAAsB,aAAA,CACpB,YAAA,EACA,IAAA,EACA,OAAA,EAC0B;AAE1B,EAAA,IAAI,YAAA,CAAa,QAAA,CAAS,IAAI,CAAA,EAAG;AAC/B,IAAA,MAAM,WAAA,CAAY,4BAA4B,OAAO,CAAA;AAAA,EACvD;AAEA,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,UAAA;AACJ,EAAA,IAAI;AAGF,IAAA,OAAA,GAAU,MAAM,WAAA,CAAY,YAAA,EAAc,MAAM,CAAA;AAChD,IAAA,UAAA,GAAa,UAAA,CAAW,YAAY,CAAA,CAAE,GAAA;AAAA,EACxC,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,YAAY,wBAAA,EAA0B,EAAE,GAAG,OAAA,EAAS,OAAO,CAAA;AAAA,EACnE;AAKA,EAAA,IAAI,OAAA,CAAQ,UAAU,MAAA,EAAW;AAC/B,IAAA,MAAM,WAAA,CAAY,4BAA4B,OAAO,CAAA;AAAA,EACvD;AAEA,EAAA,MAAM,UAAA,GAAa,QAAQ,GAAA,CAAI,OAAA;AAC/B,EAAA,MAAM,MAAA,GAAS,QAAQ,GAAA,CAAI,MAAA;AAC3B,EAAA,IAAI,CAAC,QAAA,CAAS,UAAU,KAAK,CAAC,QAAA,CAAS,MAAM,CAAA,EAAG;AAC9C,IAAA,MAAM,WAAA,CAAY,0BAA0B,OAAO,CAAA;AAAA,EACrD;AAIA,EAAA,IACE,eAAA,CAAgB,GAAA,CAAI,MAAA,CAAO,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA,IACzC,UAAA,CAAW,SAAS,CAAA,KAAM,MAAA,IAC1B,UAAA,CAAW,iBAAiB,MAAM,MAAA,EAClC;AACA,IAAA,MAAM,WAAA,CAAY,4BAA4B,OAAO,CAAA;AAAA,EACvD;AAEA,EAAA,MAAM,EAAE,MAAA,EAAQ,GAAA,EAAI,GAAI,MAAM,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,UAAA,CAAW,KAAK,CAAA,EAAG,MAAA,CAAO,KAAK,GAAG,OAAO,CAAA;AAI1F,EAAA,MAAM,WAAA,GAAc,UAAA,CAAW,KAAK,CAAA,KAAM,MAAA;AAC1C,EAAA,IAAI,CAAC,WAAA,IAAe,IAAA,CAAK,eAAA,KAAoB,IAAA,EAAM;AACjD,IAAA,MAAM,WAAA,CAAY,kBAAkB,OAAO,CAAA;AAAA,EAC7C;AAEA,EAAA,MAAM,OAAA,GAA4B;AAAA;AAAA;AAAA;AAAA,IAIhC,UAAA,EAAY,CAAC,qBAAqB,CAAA;AAAA;AAAA;AAAA,IAGlC,GAAI,UAAA,CAAW,KAAK,CAAA,KAAM,MAAA,GAAY,EAAE,MAAA,EAAQ,MAAA,CAAO,MAAA,EAAO,GAAI,EAAC;AAAA;AAAA;AAAA,IAGnE,GAAI,WAAA,GAAc,EAAE,UAAU,MAAA,CAAO,QAAA,KAAa,EAAC;AAAA,IACnD,gBAAgB,IAAA,CAAK,gBAAA;AAAA;AAAA,IAErB,WAAA,EAAa,IAAA,CAAK,KAAA,CAAM,GAAA;AAAI,GAC9B;AAEA,EAAA,IAAI,eAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAMA,SAAAA,CAAU,UAAA,EAAY,KAAK,OAAO,CAAA;AACvD,IAAA,eAAA,GAAkB,MAAA,CAAO,OAAA;AAAA,EAC3B,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,WAAA,CAAY,oBAAoB,KAAK,CAAA,EAAG,EAAE,GAAG,OAAA,EAAS,OAAO,CAAA;AAAA,EACrE;AAEA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AAGF,IAAA,MAAA,GAAU,MAAM,SAAA,CAAU,eAAA,EAAiB,OAAA,CAAQ,aAAa,MAAM,CAAA;AAAA,EAIxE,SAAS,KAAA,EAAO;AAEd,IAAA,MAAM,YAAY,wBAAA,EAA0B,EAAE,GAAG,OAAA,EAAS,OAAO,CAAA;AAAA,EACnE;AAEA,EAAA,MAAM,OAAA,GAAU,gBAAA,CAAiB,MAAA,EAAQ,OAAO,CAAA;AAGhD,EAAA,IAAI,OAAO,KAAK,CAAA,KAAM,UAAa,OAAA,CAAQ,KAAK,MAAM,MAAA,EAAW;AAC/D,IAAA,MAAM,WAAA,CAAY,4BAA4B,OAAO,CAAA;AAAA,EACvD;AACA,EAAA,4BAAA,CAA6B,SAAS,OAAO,CAAA;AAE7C,EAAA,IAAI,OAAA,CAAQ,aAAa,CAAA,KAAM,MAAA,EAAW;AACxC,IAAA,MAAM,WAAA,CAAY,4BAA4B,OAAO,CAAA;AAAA,EACvD;AACA,EAAA,gBAAA,CAAiB,CAAC,eAAA,EAAiB,OAAO,CAAA,EAAG,MAAM,OAAO,CAAA;AAE1D,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,CAAO,QAAQ,MAAA,EAAQ,OAAA,EAAS,aAAa,UAAA,EAAW;AAC3E;AAkBA,SAAS,gBAAA,CACP,QACA,OAAA,EACyB;AACzB,EAAA,MAAM,SAAA,GAAY,OAAO,kBAAkB,CAAA;AAE3C,EAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,SAAS,GAAG,MAAM,WAAA,CAAY,4BAA4B,OAAO,CAAA;AACpF,EAAA,MAAM,SAAA,GAAY,SAAA,CAAU,MAAA,CAAO,QAAQ,CAAA;AAC3C,EAAA,MAAM,CAAC,IAAI,CAAA,GAAI,SAAA;AACf,EAAA,IAAI,SAAA,CAAU,WAAW,CAAA,IAAK,IAAA,KAAS,QAAW,MAAM,WAAA,CAAY,kBAAkB,OAAO,CAAA;AAC7F,EAAA,OAAO,IAAA;AACT;AAOA,SAAS,oBACP,KAAA,EACuE;AACvE,EAAA,MAAM,OAAQ,KAAA,EAA8B,IAAA;AAC5C,EAAA,IAAI,IAAA,KAAS,mBAAmB,OAAO,SAAA;AACvC,EAAA,IAAI,SAAS,iCAAA,EAAmC;AAC9C,IAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAO,GAAI,KAAA;AAC1B,IAAA,IAAI,KAAA,KAAU,OAAO,OAAO,gBAAA;AAE5B,IAAA,IAAI,KAAA,KAAU,SAAS,KAAA,KAAU,KAAA;AAC/B,MAAA,OAAO,MAAA,KAAW,YAAY,gBAAA,GAAmB,SAAA;AAAA,EACrD;AACA,EAAA,OAAO,mBAAA;AACT;AAOA,SAAS,gBAAA,CACP,OAAA,EACA,IAAA,EACA,OAAA,EACM;AACN,EAAA,MAAM,UAAA,GAAa,KAAK,KAAA,CAAM,IAAA,CAAK,MAAM,GAAA,EAAI,CAAE,OAAA,EAAQ,GAAI,GAAI,CAAA;AAC/D,EAAA,IAAI,OAAA,GAAU,KAAA;AACd,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,IAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AACxB,IAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AACxB,IAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,MAAM,WAAA,CAAY,kBAAkB,OAAO,CAAA;AACxE,MAAA,IAAI,OAAO,UAAA,GAAa,IAAA,CAAK,kBAAkB,MAAM,WAAA,CAAY,WAAW,OAAO,CAAA;AACnF,MAAA,OAAA,GAAU,IAAA;AAAA,IACZ;AACA,IAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AACxB,IAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,MAAM,WAAA,CAAY,kBAAkB,OAAO,CAAA;AACxE,MAAA,IAAI,MAAM,UAAA,GAAa,IAAA,CAAK,kBAAkB,MAAM,WAAA,CAAY,WAAW,OAAO,CAAA;AAAA,IACpF;AACA,IAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,MAAM,WAAA,CAAY,kBAAkB,OAAO,CAAA;AAGxE,MAAA,IAAI,MAAM,UAAA,GAAa,IAAA,CAAK,kBAAkB,MAAM,WAAA,CAAY,WAAW,OAAO,CAAA;AAAA,IACpF;AAAA,EACF;AACA,EAAA,IAAI,CAAC,WAAW,IAAA,CAAK,aAAA,KAAkB,MAAM,MAAM,WAAA,CAAY,kBAAkB,OAAO,CAAA;AAC1F;AAGA,SAAS,4BAAA,CACP,QACA,OAAA,EACM;AACN,EAAA,IAAI,MAAA,CAAO,KAAK,CAAA,KAAM,wBAAA,EAA0B;AAC9C,IAAA,MAAM,WAAA,CAAY,4BAA4B,OAAO,CAAA;AAAA,EACvD;AACF;ACjOO,SAAS,iBAAiB,OAAA,EAAsC;AACrE,EAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,CAAC,KAAA,KAAU,CAAC,KAAA,CAAM,MAAA,EAAQ,KAAK,CAAC,CAAC,CAAA;AACtE,EAAA,MAAM,QAAA,uBAAe,GAAA,EAAsC;AAE3D,EAAA,SAAS,YAAA,CAAa,KAAc,OAAA,EAA4C;AAC9E,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,WAAW,CAAA,EAAG;AAC/C,MAAA,MAAM,WAAA,CAAY,kBAAkB,OAAO,CAAA;AAAA,IAC7C;AACA,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA;AAC/B,IAAA,IAAI,MAAA,KAAW,MAAA,EAAW,MAAM,WAAA,CAAY,oBAAoB,OAAO,CAAA;AACvE,IAAA,OAAO,MAAA;AAAA,EACT;AAIA,EAAA,SAAS,WAAA,CAAY,KAAa,OAAA,EAA4C;AAC5E,IAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,MAAA,CAAO,CAAC,KAAA,KAAU,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,CAAC,GAAA,KAAQ,GAAA,CAAI,GAAA,KAAQ,GAAG,CAAC,CAAA;AACnF,IAAA,MAAM,CAAC,IAAI,CAAA,GAAI,OAAA;AACf,IAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,IAAK,IAAA,KAAS,QAAW,MAAM,WAAA,CAAY,eAAe,OAAO,CAAA;AACxF,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,OAAO;AAAA;AAAA,IAEL,SAAA,GAA+B;AAC7B,MAAA,OAAO,CAAC,GAAG,QAAA,CAAS,IAAA,EAAM,CAAA;AAAA,IAC5B,CAAA;AAAA,IAEA,MAAM,OAAA,CAAQ,GAAA,EAAc,GAAA,EAAc,OAAA,EAAgD;AAGxF,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,WAAW,CAAA,EAAG;AAC/C,QAAA,MAAM,WAAA,CAAY,eAAe,OAAO,CAAA;AAAA,MAC1C;AACA,MAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,GAAY,WAAA,CAAY,KAAK,OAAO,CAAA,GAAI,YAAA,CAAa,GAAA,EAAK,OAAO,CAAA;AACxF,MAAA,MAAM,OAAA,GAAU,OAAO,IAAA,CAAK,IAAA,CAAK,CAAC,SAAA,KAAc,SAAA,CAAU,QAAQ,GAAG,CAAA;AACrE,MAAA,IAAI,OAAA,KAAY,MAAA,EAAW,MAAM,WAAA,CAAY,eAAe,OAAO,CAAA;AAInE,MAAA,MAAM,WAAW,IAAA,CAAK,SAAA,CAAU,CAAC,GAAA,EAAK,GAAG,CAAC,CAAA;AAC1C,MAAA,IAAI,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,QAAQ,CAAA;AACnC,MAAA,IAAI,YAAY,MAAA,EAAW;AACzB,QAAA,OAAA,GAAU,SAAA,CAAU,OAAA,CAAQ,GAAA,EAAY,qBAAqB,CAAA;AAC7D,QAAA,QAAA,CAAS,GAAA,CAAI,UAAU,OAAO,CAAA;AAAA,MAChC;AAEA,MAAA,IAAI;AACF,QAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,MAAM,OAAA,EAAQ;AAAA,MACtC,SAAS,KAAA,EAAO;AAId,QAAA,QAAA,CAAS,OAAO,QAAQ,CAAA;AACxB,QAAA,MAAM,eAAe,mDAAA,EAAqD;AAAA,UACxE,GAAG,OAAA;AAAA,UACH;AAAA,SACD,CAAA;AAAA,MACH;AAAA,IACF;AAAA,GACF;AACF;;;ACzDA,SAAS,iBAAiB,WAAA,EAA6B;AACrD,EAAA,OAAO,UAAU,MAAA,CAAO,WAAW,CAAA,CAAE,QAAA,CAAS,WAAW,CAAC,CAAA,CAAA;AAC5D;AAEO,SAAS,yBAAyB,OAAA,EAAiD;AAGxF,EAAA,MAAM,YAAA,GAAe,gBAAA,CAAiB,OAAA,CAAQ,MAAA,CAAO,MAAM,cAAc,CAAA;AACzE,EAAA,MAAM,aAAA,GAAgB,gBAAA,CAAiB,OAAA,CAAQ,MAAA,CAAO,MAAM,eAAe,CAAA;AAC3E,EAAA,MAAM,IAAA,GAAO,EAAE,KAAA,EAAO,OAAA,CAAQ,OAAO,gBAAA,EAAkB,OAAA,CAAQ,OAAO,gBAAA,EAAiB;AACvF,EAAA,MAAM,aAAA,GAAgB;AAAA,IACpB,GAAG,IAAA;AAAA,IACH,KAAA,EAAO,YAAA;AAAA,IACP,eAAA,EAAiB,OAAA,CAAQ,MAAA,CAAO,sBAAA,KAA2B,IAAA;AAAA,IAC3D,aAAA,EAAe,OAAA,CAAQ,MAAA,CAAO,oBAAA,KAAyB;AAAA,GACzD;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,MAAA,CACJ,YAAA,EACA,OAAA,GAA2B,EAAC,EACM;AAClC,MAAA,IAAI,OAAO,YAAA,KAAiB,QAAA,IAAY,YAAA,CAAa,WAAW,CAAA,EAAG;AACjE,QAAA,MAAM,WAAA,CAAY,0BAA0B,OAAO,CAAA;AAAA,MACrD;AAEA,MAAA,MAAM,OAAA,GAAU,MAAM,aAAA,CAAc,YAAA,EAAc,eAAe,OAAO,CAAA;AACxE,MAAA,MAAM,WAAW,MAAM,iBAAA;AAAA,QACrB,OAAA,CAAQ,MAAA;AAAA,QACR,EAAE,GAAG,IAAA,EAAM,KAAA,EAAO,aAAA,EAAc;AAAA,QAChC;AAAA,OACF;AAEA,MAAA,OAAO;AAAA,QACL,SAAA,EAAW,gBAAA,CAAiB,OAAA,CAAQ,WAAW,CAAA;AAAA,QAC/C,eAAe,OAAA,CAAQ,MAAA;AAAA,QACvB,gBAAgB,QAAA,CAAS,MAAA;AAAA,QACzB,eAAe,QAAA,CAAS,KAAA;AAAA,QACxB,gBAAgB,QAAA,CAAS;AAAA,OAC3B;AAAA,IACF,CAAA;AAAA,IAEA,cAAA,GAAiB;AACf,MAAA,OAAO,EAAE,SAAS,YAAA,CAAa,SAAA,IAAa,QAAA,EAAU,aAAA,CAAc,WAAU,EAAE;AAAA,IAClF;AAAA,GACF;AACF;;;ACtCO,SAAS,+BACd,OAAA,EAC0B;AAC1B,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,IAAS,WAAA;AAC/B,EAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,IAAU,WAAA;AAEjC,EAAA,MAAM,WAAW,wBAAA,CAAyB,EAAE,QAAQ,OAAA,CAAQ,MAAA,EAAQ,OAAO,CAAA;AAC3E,EAAA,MAAM,MAAA,GACJ,OAAA,CAAQ,WAAA,IAAe,oBAAA,CAAqB,EAAE,IAAA,EAAM,OAAA,CAAQ,MAAA,CAAO,MAAA,CAAO,IAAA,EAAM,MAAA,EAAQ,CAAA;AAE1F,EAAA,MAAM,WAAA,GAAwC;AAAA,IAC5C,MAAA,EAAQ,KAAA;AAAA,IACR,OAAA,EAAS,gBAAA;AAAA,IACT,OAAA,EAAS;AAAA,GACX;AAEA,EAAA,eAAe,iBACb,OAAA,EACoC;AACpC,IAAA,MAAM,YAAA,GAAgC;AAAA,MACpC,WAAW,OAAA,CAAQ,SAAA;AAAA,MACnB,YAAY,OAAA,CAAQ;AAAA,KACtB;AAEA,IAAA,MAAM,UAAU,MAAM,QAAA,CAAS,OAAO,OAAA,CAAQ,UAAA,CAAW,SAAS,YAAY,CAAA;AAG9E,IAAA,MAAM,qBAAA,CAAsB,OAAA,EAAS,OAAA,EAAS,YAAY,CAAA;AAE1D,IAAA,IAAI,WAAA;AACJ,IAAA,IAAI;AACF,MAAA,WAAA,GAAc,OAAO,OAAA,CAAQ;AAAA,QAC3B,WAAW,OAAA,CAAQ,SAAA;AAAA,QACnB,aAAa,OAAA,CAAQ,aAAA;AAAA,QACrB,eAAe,OAAA,CAAQ,aAAA;AAAA,QACvB,gBAAgB,OAAA,CAAQ,cAAA;AAAA,QACxB,YAAY,OAAA,CAAQ,UAAA;AAAA,QACpB,WAAW,OAAA,CAAQ;AAAA,OACpB,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,eAAe,mCAAA,EAAqC,EAAE,GAAG,YAAA,EAAc,OAAO,CAAA;AAAA,IACtF;AAEA,IAAA,IAAI,WAAA,CAAY,SAAS,UAAA,EAAY;AACnC,MAAA,MAAM,WAAA,CAAY,WAAA,CAAY,KAAA,EAAO,YAAY,CAAA;AAAA,IACnD;AAEA,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,UAAA;AAAA,MACR,MAAA,EAAQ,KAAA;AAAA,MACR,WAAW,OAAA,CAAQ,SAAA;AAAA;AAAA;AAAA,MAGnB,eAAe,OAAA,CAAQ,SAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAKvB,QAAA,EAAU;AAAA,QACR,eAAe,OAAA,CAAQ,aAAA;AAAA,QACvB,gBAAgB,OAAA,CAAQ,cAAA;AAAA,QACxB,YAAY,OAAA,CAAQ;AAAA;AACtB,KACF;AAAA,EACF;AAEA,EAAA,MAAM,QAAA,GAAW,CACf,MAAA,EACA,aAAA,EACA,OAAA,KACS;AACT,IAAA,IAAI;AACF,MAAA,MAAA,CAAO,MAAM,EAAE,aAAa,CAAA;AAAA,IAC9B,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,cAAA,CAAe,iCAAiC,MAAM,CAAA,CAAA,EAAI,EAAE,GAAG,OAAA,EAAS,OAAO,CAAA;AAAA,IACvF;AAAA,EACF,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,KAAA;AAAA,IACN,UAAA,EAAY,mBAAmB,eAAe,CAAA;AAAA,IAC9C,WAAA;AAAA,IACA,gBAAA;AAAA,IAEA,MAAM,OAAA,CAAQ,aAAA,EAAe,OAAA,EAAS;AACpC,MAAA,QAAA,CAAS,SAAA,EAAW,eAAe,OAAO,CAAA;AAAA,IAC5C,CAAA;AAAA,IACA,MAAM,OAAA,CAAQ,aAAA,EAAe,OAAA,EAAS;AACpC,MAAA,QAAA,CAAS,SAAA,EAAW,eAAe,OAAO,CAAA;AAAA,IAC5C,CAAA;AAAA,IACA,MAAM,aAAA,CAAc,aAAA,EAAe,OAAA,EAAS;AAC1C,MAAA,QAAA,CAAS,eAAA,EAAiB,eAAe,OAAO,CAAA;AAAA,IAClD,CAAA;AAAA,IAEA,MAAM,MAAA,GAAiC;AACrC,MAAA,MAAM,SAAA,GAAY,MAAM,WAAA,EAAY;AACpC,MAAA,MAAM,SAAA,GAAY,MAAM,MAAA,EAAO;AAC/B,MAAA,IAAI,SAAA,GAAY,IAAA;AAChB,MAAA,IAAI;AAGF,QAAA,MAAA,CAAO,QAAQ,cAAc,CAAA;AAAA,MAC/B,CAAA,CAAA,MAAQ;AACN,QAAA,SAAA,GAAY,KAAA;AAAA,MACd;AACA,MAAA,MAAM,aAAa,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,WAAA,KAAgB,SAAS,CAAA;AAC7D,MAAA,IAAI,CAAC,SAAA,EAAW;AAEd,QAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAA,EAAW,UAAA,EAAY,QAAQ,0BAAA,EAA2B;AAAA,MACrF;AACA,MAAA,MAAM,OAAA,GAAU,SAAS,cAAA,EAAe;AACxC,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,MAAA;AAAA,QACR,SAAA;AAAA,QACA,UAAA;AAAA,QACA,MAAA,EAAQ,mBAAmB,OAAA,CAAQ,OAAA,CAAQ,MAAM,CAAA,kBAAA,EAAqB,OAAA,CAAQ,SAAS,MAAM,CAAA;AAAA,OAC/F;AAAA,IACF,CAAA;AAAA,IAEA,KAAA,GAAQ;AACN,MAAA,MAAA,CAAO,KAAA,EAAM;AAAA,IACf;AAAA,GACF;AACF","file":"ap2.js","sourcesContent":["/**\n * Every failure the AP2 verifier can report.\n *\n * `CommerceError.message` reaches the client, and a mandate carries the\n * buyer's purchase and often personal data, so messages are fixed phrases from\n * the list below. The machine-readable code goes in `details.reason` and the\n * original exception on `cause`, which is never serialized.\n *\n * Three codes: AUTHORIZATION_INVALID when the buyer's mandate is bad,\n * AUTHORIZATION_REPLAYED when it is good but spent, and\n * AUTHORIZATION_PROVIDER_UNAVAILABLE when our verifier never reached a\n * verdict. Blaming the buyer for our outage refuses a good mandate.\n */\nimport { CommerceError } from '../../core';\n\n/**\n * Coarse on purpose: a client learns roughly where its mandate was refused,\n * not which check failed. Finer detail is an oracle for probing trust policy,\n * so a mandate signed with a disallowed algorithm reports `invalid_signature`\n * and one declaring a digest other than sha-256 `malformed_presentation`.\n */\nexport const AP2_REJECTION_REASONS = [\n  'malformed_presentation',\n  'untrusted_issuer',\n  'unknown_key',\n  'invalid_signature',\n  'invalid_claims',\n  'expired',\n  'wrong_audience',\n  'unsupported_mandate_type',\n  'checkout_binding_failed',\n  'purchase_mismatch',\n] as const;\n\nexport type Ap2RejectionReason = (typeof AP2_REJECTION_REASONS)[number];\n\nconst MESSAGES: Readonly<Record<Ap2RejectionReason, string>> = {\n  malformed_presentation: 'The authorization is not a well-formed SD-JWT presentation.',\n  untrusted_issuer: 'The mandate was issued by a party this merchant does not trust.',\n  unknown_key: 'The mandate names a signing key this merchant does not trust.',\n  invalid_signature: 'The mandate signature did not verify.',\n  invalid_claims: 'The mandate is missing required claims or they are malformed.',\n  expired: 'The mandate is expired or not yet valid.',\n  wrong_audience: 'The mandate is addressed to a different audience.',\n  unsupported_mandate_type: 'The mandate is not a closed Direct Checkout Mandate.',\n  checkout_binding_failed: 'The merchant checkout document bound to the mandate did not verify.',\n  purchase_mismatch: 'The mandate does not authorize this purchase.',\n};\n\nexport interface Ap2ErrorContext {\n  readonly requestId?: string;\n  readonly resourceId?: string;\n  readonly cause?: unknown;\n}\n\n/** The buyer's mandate is bad. Fail closed */\nexport function ap2Rejected(\n  reason: Ap2RejectionReason,\n  context: Ap2ErrorContext = {},\n): CommerceError {\n  return new CommerceError('AUTHORIZATION_INVALID', MESSAGES[reason], {\n    details: { method: 'ap2', reason },\n    ...(context.requestId !== undefined ? { requestId: context.requestId } : {}),\n    ...(context.resourceId !== undefined ? { resourceId: context.resourceId } : {}),\n    ...(context.cause !== undefined ? { cause: context.cause } : {}),\n  });\n}\n\n/**\n * The mandate verified but has already been presented. A separate code from\n * a bad mandate: nothing is wrong with this mandate except that it is spent.\n */\nexport function ap2Replayed(state: string, context: Ap2ErrorContext = {}): CommerceError {\n  return new CommerceError(\n    'AUTHORIZATION_REPLAYED',\n    'This mandate has already been presented and cannot authorize another purchase.',\n    {\n      details: { method: 'ap2', reason: 'replayed', state },\n      ...(context.requestId !== undefined ? { requestId: context.requestId } : {}),\n      ...(context.resourceId !== undefined ? { resourceId: context.resourceId } : {}),\n    },\n  );\n}\n\n/**\n * The check never ran (a configured key that will not import, say). Retryable,\n * and never recorded against the payer: the mandate may be perfectly good.\n */\nexport function ap2Unavailable(detail: string, context: Ap2ErrorContext = {}): CommerceError {\n  return new CommerceError(\n    'AUTHORIZATION_PROVIDER_UNAVAILABLE',\n    'Authorization could not be verified right now. This is a merchant-side fault, not a problem with the presented mandate.',\n    {\n      details: { method: 'ap2', reason: 'verifier_unavailable', detail },\n      ...(context.requestId !== undefined ? { requestId: context.requestId } : {}),\n      ...(context.resourceId !== undefined ? { resourceId: context.resourceId } : {}),\n      ...(context.cause !== undefined ? { cause: context.cause } : {}),\n    },\n  );\n}\n","import { createHash } from 'node:crypto';\n\n/** SHA-256, the only digest AP2 verification and signing use. A string is hashed as UTF-8 */\nexport function sha256(data: string | Uint8Array): Buffer {\n  return createHash('sha256').update(data).digest();\n}\n","/**\n * Binds a verified mandate to the purchase in front of us. Without this\n * comparison a mandate approved for a $0.01 report would settle a $500 one.\n *\n * Everything is compared against the ALREADY RESOLVED request. Nothing is\n * taken from the mandate to shape the purchase, which would invert the\n * control.\n */\nimport canonicalize from 'canonicalize';\nimport { type AuthorizationVerificationContext, CommerceError } from '../../core';\nimport { isRecord } from '../../core/is-record';\nimport { AP2_CHECKOUT_PROFILE } from './constants';\nimport { type Ap2ErrorContext, ap2Rejected } from './errors';\nimport { sha256 } from './sha256';\nimport type { VerifiedCheckoutMandate } from './types';\n\n/**\n * All required. Absent is a mismatch, never a skipped check: a mandate that\n * will not say which resource or how much authorizes nothing in particular.\n */\nconst REQUIRED_PROFILE_CLAIMS = [\n  'profile',\n  'resource_id',\n  'input_hash',\n  'amount',\n  'currency',\n  'payment_method',\n] as const;\n\n/**\n * RFC 8785 (JCS) digest of the validated resource input.\n *\n * Binds a mandate to the exact request, not just to a resource and a price:\n * without it, one mandate for `translate` would authorize any translation.\n *\n * The merchant's signer, possibly in another language, agrees with this digest\n * only if it follows RFC 8785's number formatting and UTF-16 key ordering too;\n * sorting keys is not enough.\n *\n * The caller passes what the backend will receive: validated, reserved fields\n * stripped, no request id or transport metadata (the buyer could not have\n * known those when they approved).\n */\nexport function computeInputHash(input: unknown): string {\n  const canonical = canonicalize(input ?? {});\n  // undefined means JSON cannot represent the value (a function, say). On the\n  // gateway path the input already passed schema validation, so this is not a\n  // buyer error.\n  if (canonical === undefined) {\n    throw new CommerceError('INTERNAL_ERROR', 'resource input is not canonicalizable JSON');\n  }\n  return sha256(canonical).toString('base64url');\n}\n\nconst EVM_ADDRESS = /^0x[0-9a-f]{40}$/i;\n\n// EIP-55 encodes an address checksum through letter casing, so lowercase and\n// checksummed forms identify the same account. Other values compare exactly.\nfunction sameCoordinate(declared: unknown, expected: string | undefined): boolean {\n  if (typeof declared === 'string' && expected !== undefined) {\n    if (EVM_ADDRESS.test(declared) && EVM_ADDRESS.test(expected)) {\n      return declared.toLowerCase() === expected.toLowerCase();\n    }\n  }\n  return declared === expected;\n}\n\n/**\n * Throws on the first mismatch with one coarse reason. Which field disagreed\n * is not reported: a caller able to ask about one field at a time can read a\n * mandate's contents out of the gateway by elimination.\n */\nexport async function bindMandateToPurchase(\n  mandate: VerifiedCheckoutMandate,\n  context: AuthorizationVerificationContext,\n  errorContext: Ap2ErrorContext,\n): Promise<void> {\n  const profile = mandate.checkoutClaims['agent_commerce'];\n  if (!isRecord(profile)) throw ap2Rejected('purchase_mismatch', errorContext);\n\n  for (const claim of REQUIRED_PROFILE_CLAIMS) {\n    const value = profile[claim];\n    if (typeof value !== 'string' || value.length === 0) {\n      throw ap2Rejected('purchase_mismatch', errorContext);\n    }\n  }\n\n  const requirement = context.requirement;\n  const expectedInputHash = computeInputHash(context.input);\n\n  const mustMatch: readonly (readonly [string, unknown])[] = [\n    ['profile', AP2_CHECKOUT_PROFILE],\n    ['resource_id', context.resourceId],\n    ['input_hash', expectedInputHash],\n    // Decimal strings on both sides. Comparing numerically would make \"0.10\"\n    // and \"0.1\" equal, and a mandate says what it says.\n    ['amount', requirement.amount],\n    ['currency', requirement.currency],\n    ['payment_method', requirement.provider],\n  ];\n\n  for (const [claim, expected] of mustMatch) {\n    if (profile[claim] !== expected) throw ap2Rejected('purchase_mismatch', errorContext);\n  }\n\n  // Checked whenever EITHER side names one, which is the fail-closed reading.\n  // A mandate silent about the chain must not unlock a mainnet settlement, and\n  // one naming a chain the requirement lacks was approved for another rail.\n  for (const [claim, expected] of [\n    ['destination', requirement.destination],\n    ['network', requirement.network],\n    ['asset', requirement.asset],\n  ] as const) {\n    const declared = profile[claim];\n    if (declared === undefined && expected === undefined) continue;\n    if (!sameCoordinate(declared, expected)) throw ap2Rejected('purchase_mismatch', errorContext);\n  }\n}\n","/**\n * Merchant-side helper: mints the checkout JWT a Checkout Mandate binds.\n *\n * A merchant runs it in their own process, with their own key, to produce the\n * document the buyer approves; the gateway never calls it. It mirrors\n * `createPaymentProof`, which a buyer runs to produce a payment proof.\n *\n * It exists mainly for `input_hash`, an RFC 8785 digest. A serializer that\n * only sorts keys, as many non-JavaScript JSON libraries do, can disagree with\n * it on floats and non-ASCII keys, and the mandate is then refused with a\n * reason that does not name the field.\n */\nimport { importPKCS8, type JWK, SignJWT } from 'jose';\nimport {\n  AP2_CHECKOUT_PROFILE,\n  AP2_JWK_CURVE,\n  AP2_KEY_TYPE,\n  AP2_SIGNING_ALGORITHM,\n} from './constants';\nimport { computeInputHash } from './profile';\n\n/**\n * A private ES256 key: either a private JWK (the pair of the public one in the\n * gateway's `checkoutIssuers`) or a PKCS#8 PEM, as `openssl` emits it\n */\nexport type Ap2SigningKey = Readonly<Record<string, unknown>> | string;\n\nexport interface CreateCheckoutJwtOptions {\n  readonly privateKey: Ap2SigningKey;\n  /** Must match a `kid` configured under the gateway's `checkoutIssuers` */\n  readonly kid: string;\n  /** Must match that issuer's configured `issuer` */\n  readonly issuer: string;\n  /** Must match that issuer's configured `audience` */\n  readonly audience: string;\n\n  readonly resourceId: string;\n  /**\n   * The resource input this purchase is for, exactly as the buyer will send\n   * it: no reserved fields, no request id, no transport metadata\n   */\n  readonly input: unknown;\n\n  /**\n   * Decimal string, never a number, and compared as a string: `0.10` and `0.1`\n   * are different mandates. Take it from your own catalog rather than from\n   * whatever the agent asked for.\n   */\n  readonly amount: string;\n  readonly currency: string;\n  /** The rail that will settle, e.g. `x402` */\n  readonly paymentMethod: string;\n\n  /**\n   * Settlement coordinates. Required whenever the gateway's requirement names\n   * them, which under x402 is always. A mandate silent about the chain will\n   * not unlock a settlement on one.\n   */\n  readonly destination?: string;\n  readonly network?: string;\n  readonly asset?: string;\n\n  /** Defaults to a random UUID. Recorded on the receipt and used for replay defense */\n  readonly jwtId?: string;\n  /** Defaults to 900: a human approval sits inside this window */\n  readonly expiresInSeconds?: number;\n  /** Injectable so a test need not move the wall clock */\n  readonly now?: Date;\n}\n\nconst DEFAULT_EXPIRES_IN_SECONDS = 900;\n\nfunction requireText(value: unknown, field: string): string {\n  if (typeof value !== 'string' || value.length === 0) {\n    throw new TypeError(\n      `createCheckoutJwt: ${field} must be a non-empty string, received ${describe(value)}`,\n    );\n  }\n  return value;\n}\n\nfunction describe(value: unknown): string {\n  return value === null ? 'null' : typeof value;\n}\n\n/**\n * Every rejection here is a mistake that would otherwise surface as an opaque\n * verification failure much later: the public half of the pair, the wrong key\n * type, or a PEM that is not PKCS#8\n */\nasync function resolveKey(\n  key: Ap2SigningKey,\n): Promise<JWK | Awaited<ReturnType<typeof importPKCS8>>> {\n  if (typeof key === 'string') {\n    if (!key.includes('BEGIN PRIVATE KEY')) {\n      throw new TypeError(\n        'createCheckoutJwt: a string privateKey must be a PKCS#8 PEM beginning \"-----BEGIN PRIVATE KEY-----\"',\n      );\n    }\n    return importPKCS8(key, AP2_SIGNING_ALGORITHM);\n  }\n  if (typeof key !== 'object' || key === null) {\n    throw new TypeError('createCheckoutJwt: privateKey must be a private JWK or a PKCS#8 PEM');\n  }\n  if (key['d'] === undefined) {\n    throw new TypeError(\n      'createCheckoutJwt: privateKey is a public JWK (no \"d\"). Use the private half of the pair whose public key is configured under checkoutIssuers',\n    );\n  }\n  if (key['kty'] !== AP2_KEY_TYPE || key['crv'] !== AP2_JWK_CURVE) {\n    throw new TypeError(\n      `createCheckoutJwt: privateKey must be ${AP2_KEY_TYPE}/${AP2_JWK_CURVE}, the pair ${AP2_SIGNING_ALGORITHM} implies`,\n    );\n  }\n  return key as JWK;\n}\n\n/**\n * Returns the compact JWT to hand to the agent, which wraps it in the Checkout\n * Mandate the buyer signs\n */\nexport async function createCheckoutJwt(options: CreateCheckoutJwtOptions): Promise<string> {\n  const kid = requireText(options.kid, 'kid');\n  const issuer = requireText(options.issuer, 'issuer');\n  const audience = requireText(options.audience, 'audience');\n  const resourceId = requireText(options.resourceId, 'resourceId');\n  const currency = requireText(options.currency, 'currency');\n  const paymentMethod = requireText(options.paymentMethod, 'paymentMethod');\n\n  if (typeof options.amount === 'number') {\n    throw new TypeError(\n      'createCheckoutJwt: amount must be a decimal string, not a number. It is compared as a string, so 0.1 and \"0.10\" are different mandates',\n    );\n  }\n  const amount = requireText(options.amount, 'amount');\n\n  const key = await resolveKey(options.privateKey);\n  const issuedAt = Math.floor((options.now ?? new Date()).getTime() / 1000);\n  const expiresIn = options.expiresInSeconds ?? DEFAULT_EXPIRES_IN_SECONDS;\n  if (!Number.isInteger(expiresIn) || expiresIn <= 0) {\n    throw new TypeError('createCheckoutJwt: expiresInSeconds must be a positive whole number');\n  }\n\n  const agentCommerce: Record<string, string> = {\n    profile: AP2_CHECKOUT_PROFILE,\n    resource_id: resourceId,\n    input_hash: computeInputHash(options.input),\n    amount,\n    currency,\n    payment_method: paymentMethod,\n    ...(options.destination !== undefined ? { destination: options.destination } : {}),\n    ...(options.network !== undefined ? { network: options.network } : {}),\n    ...(options.asset !== undefined ? { asset: options.asset } : {}),\n  };\n\n  return new SignJWT({ agent_commerce: agentCommerce })\n    .setProtectedHeader({ alg: AP2_SIGNING_ALGORITHM, kid, typ: 'JWT' })\n    .setIssuer(issuer)\n    .setAudience(audience)\n    .setIssuedAt(issuedAt)\n    .setExpirationTime(issuedAt + expiresIn)\n    .setJti(options.jwtId ?? crypto.randomUUID())\n    .sign(key);\n}\n","/**\n * Adapter self-description.\n *\n * Imports nothing but core types and the pins, so `doctor` can report AP2\n * without pulling `jose` or `@sd-jwt/core` into the CLI bundle.\n */\nimport type { AdapterDescriptor } from '../../core';\nimport {\n  AP2_CHECKOUT_MANDATE_VCT,\n  AP2_CHECKOUT_PROFILE,\n  AP2_DIGEST_ALGORITHM,\n  AP2_SIGNING_ALGORITHM,\n  AP2_SPEC_VERSION,\n} from './constants';\n\n/** What this provider actually verifies */\nexport const AP2_CAPABILITIES: readonly string[] = [\n  'direct-mode',\n  'trusted-agent-provider',\n  AP2_CHECKOUT_MANDATE_VCT,\n  'sd-jwt-presentation',\n  AP2_SIGNING_ALGORITHM,\n  AP2_DIGEST_ALGORITHM,\n  'static-inline-trust',\n  'merchant-checkout-jwt-binding',\n  AP2_CHECKOUT_PROFILE,\n  'purchase-binding',\n  'replay-defence',\n];\n\n/**\n * Major AP2 features this provider does not support, published in its\n * descriptor and printed by `doctor`, so no client assumes full protocol\n * support\n */\nexport const AP2_UNSUPPORTED: readonly string[] = [\n  // Mandate kinds. Open mandates are refused: see AP2_CHECKOUT_MANDATE_VCT\n  'autonomous mode',\n  'open checkout mandates (mandate.checkout.open.1)',\n  'payment mandates (mandate.payment.1)',\n  'spending constraint evaluation',\n  'cnf-bound agent keys',\n  // Delegation models other than a trusted agent provider\n  'user credential delegation (OpenID4VP)',\n  'delegation chains and key-binding JWTs',\n  // Key handling. Every key is written into config by an operator\n  'JWKS and any key discovery by URL (jku, x5u)',\n  'issuer metadata fetching',\n  'key rotation without a config change',\n  // Algorithms\n  'signature algorithms other than ES256',\n  'digest algorithms other than sha-256',\n  // Roles this gateway does not play\n  'mandate issuance',\n  'checkout receipts',\n  'AP2 over the ACP checkout adapter',\n];\n\nexport function buildAp2Descriptor(implementationVersion: string): AdapterDescriptor {\n  return {\n    name: 'ap2',\n    kind: 'authorization',\n    implementationVersion,\n    supportedSpec: `ap2/v${AP2_SPEC_VERSION} mode=direct`,\n    capabilities: AP2_CAPABILITIES,\n    status: 'experimental',\n    unsupported: AP2_UNSUPPORTED,\n  };\n}\n","/**\n * Durable record of which mandates have been spent.\n *\n * Its own table in its own file: a payment replay key is needed only until its\n * authorization's `validBefore`, after which it cannot settle, while a consumed\n * mandate must stay consumed for as long as the merchant can be asked what they\n * delivered. Hence no retention sweep, unlike the ACP idempotency store:\n * deleting a `consumed` row makes that mandate spendable again. If the table\n * ever needs bounding, archive `released` rows and leave the rest.\n *\n * Settlement and a local commit are not one transaction. If the process dies\n * between them the row stays `reserved` and that mandate is refused from then\n * on: a refused retry costs a round trip, the other direction costs a second\n * payment.\n */\nimport type { Database } from 'better-sqlite3';\nimport { type Logger, NOOP_LOGGER } from '../../core';\nimport { openSqliteDatabase } from '../../storage/sqlite';\n\n/**\n * `released` is \"nothing happened\" and the only state a mandate can be\n * presented from again. `uncertain` is a settlement whose outcome we never\n * learned: not reusable, but findable by an operator reconciling by hand.\n */\nexport type Ap2AuthorizationState = 'reserved' | 'consumed' | 'released' | 'uncertain';\n\n/**\n * A digest and a few identifiers: everything replay defense needs, and nothing\n * a leaked database would hand an attacker\n */\nexport interface Ap2ReservationRequest {\n  /**\n   * Digest of the ISSUER-SIGNED TOKEN, not of the presentation. Selective\n   * disclosure gives one mandate many presentation strings, so keying on the\n   * presentation would let it be spent once per disclosed subset.\n   */\n  readonly reference: string;\n  /** `jti` of the merchant checkout JWT the mandate binds */\n  readonly checkoutJti: string;\n  readonly mandateIssuer: string;\n  readonly checkoutIssuer: string;\n  readonly resourceId: string;\n  readonly requestId: string;\n}\n\nexport type Ap2ReservationResult =\n  | { readonly kind: 'reserved' }\n  /** Already reserved, consumed, or of uncertain outcome. Never re-spendable */\n  | { readonly kind: 'replayed'; readonly state: Ap2AuthorizationState };\n\nexport interface Ap2ReplayStore {\n  /** Atomically claim a mandate, or report that something already holds it */\n  reserve(request: Ap2ReservationRequest): Ap2ReservationResult;\n  /** Settlement succeeded: spend it permanently */\n  consume(reference: string): void;\n  /** Nothing happened: hand it back so a corrected retry can use it */\n  release(reference: string): void;\n  /** Settlement outcome unknown. Not reusable, and flagged for a human */\n  markUncertain(reference: string): void;\n  /** Current state, for tests and diagnostics */\n  stateOf(reference: string): Ap2AuthorizationState | undefined;\n  close(): void;\n}\n\nexport interface Ap2ReplayStoreOptions {\n  /** File path, or ':memory:' for tests */\n  readonly path: string;\n  readonly logger?: Logger;\n  /** Injectable so tests need not move the wall clock */\n  readonly now?: () => number;\n}\n\ninterface StateRow {\n  state: string;\n}\n\nexport function createAp2ReplayStore(options: Ap2ReplayStoreOptions): Ap2ReplayStore {\n  const logger = options.logger ?? NOOP_LOGGER;\n  const now = options.now ?? (() => Date.now());\n\n  const db: Database = openSqliteDatabase({\n    path: options.path,\n    label: 'AP2 authorization database',\n    logger,\n  });\n  migrate(db);\n\n  const selectByReference = db.prepare<[string], StateRow>(\n    'SELECT state FROM ap2_authorizations WHERE reference = ?',\n  );\n  // Two mandates can bind one checkout document, giving two references, so\n  // the reference alone would not catch the second one\n  const selectLiveByJti = db.prepare<[string, string], StateRow>(\n    `SELECT state FROM ap2_authorizations\n      WHERE checkout_jti = ? AND reference != ? AND state != 'released'`,\n  );\n  const insert = db.prepare(\n    `INSERT INTO ap2_authorizations\n       (reference, checkout_jti, mandate_issuer, checkout_issuer, resource_id, request_id,\n        state, created_at, updated_at)\n     VALUES (@reference, @checkout_jti, @mandate_issuer, @checkout_issuer, @resource_id,\n             @request_id, 'reserved', @at, @at)`,\n  );\n  const reReserve = db.prepare(\n    `UPDATE ap2_authorizations\n        SET state = 'reserved', request_id = @request_id, updated_at = @at\n      WHERE reference = @reference AND state = 'released'`,\n  );\n  // Guarded on `reserved`: releasing a `consumed` row would hand back a\n  // mandate whose money has already moved\n  const transition = db.prepare(\n    `UPDATE ap2_authorizations SET state = @state, updated_at = @at\n      WHERE reference = @reference AND state = 'reserved'`,\n  );\n\n  const reserveTx = db.transaction((request: Ap2ReservationRequest): Ap2ReservationResult => {\n    const at = new Date(now()).toISOString();\n\n    const existing = selectByReference.get(request.reference);\n    if (existing !== undefined && existing.state !== 'released') {\n      return { kind: 'replayed', state: existing.state as Ap2AuthorizationState };\n    }\n\n    // Checked for a released reference too: another mandate may have reserved\n    // or spent the same checkout while this one was released\n    const sameCheckout = selectLiveByJti.get(request.checkoutJti, request.reference);\n    if (sameCheckout !== undefined) {\n      return { kind: 'replayed', state: sameCheckout.state as Ap2AuthorizationState };\n    }\n\n    if (existing !== undefined) {\n      reReserve.run({ reference: request.reference, request_id: request.requestId, at });\n      return { kind: 'reserved' };\n    }\n\n    insert.run({\n      reference: request.reference,\n      checkout_jti: request.checkoutJti,\n      mandate_issuer: request.mandateIssuer,\n      checkout_issuer: request.checkoutIssuer,\n      resource_id: request.resourceId,\n      request_id: request.requestId,\n      at,\n    });\n    return { kind: 'reserved' };\n  });\n\n  const move = (reference: string, state: Ap2AuthorizationState): void => {\n    transition.run({ reference, state, at: new Date(now()).toISOString() });\n  };\n\n  let closed = false;\n  return {\n    reserve(request) {\n      return reserveTx(request);\n    },\n    consume(reference) {\n      move(reference, 'consumed');\n    },\n    release(reference) {\n      move(reference, 'released');\n    },\n    markUncertain(reference) {\n      move(reference, 'uncertain');\n    },\n    stateOf(reference) {\n      return selectByReference.get(reference)?.state as Ap2AuthorizationState | undefined;\n    },\n    close() {\n      if (closed) return;\n      closed = true;\n      db.close();\n    },\n  };\n}\n\n// `PRAGMA user_version`, so reopening an existing file is a no-op check\nfunction migrate(db: Database): void {\n  const current = db.pragma('user_version', { simple: true }) as number;\n  if (current >= 1) return;\n  const apply = db.transaction(() => {\n    db.exec(`\n      CREATE TABLE IF NOT EXISTS ap2_authorizations (\n        reference        TEXT PRIMARY KEY,\n        checkout_jti     TEXT NOT NULL,\n        mandate_issuer   TEXT NOT NULL,\n        checkout_issuer  TEXT NOT NULL,\n        resource_id      TEXT NOT NULL,\n        request_id       TEXT NOT NULL,\n        state            TEXT NOT NULL\n                         CHECK (state IN ('reserved', 'consumed', 'released', 'uncertain')),\n        created_at       TEXT NOT NULL,\n        updated_at       TEXT NOT NULL\n      );\n      CREATE INDEX IF NOT EXISTS idx_ap2_authorizations_checkout_jti\n        ON ap2_authorizations(checkout_jti);\n    `);\n    db.pragma('user_version = 1');\n  });\n  apply();\n}\n","/**\n * Stage two: the merchant checkout JWT the mandate binds.\n *\n * Two things have to hold. The hash proves the buyer approved *this* document;\n * the signature proves the merchant issued it. Hash alone accepts a document\n * the buyer wrote themselves; signature alone accepts a genuine merchant\n * document this mandate never covered.\n */\nimport { decodeJwt, decodeProtectedHeader, type JWTVerifyOptions, jwtVerify } from 'jose';\nimport type { Clock } from '../../core';\nimport { AP2_SIGNING_ALGORITHM } from './constants';\nimport { type Ap2ErrorContext, ap2Rejected } from './errors';\nimport { sha256 } from './sha256';\nimport type { TrustStore } from './trust';\n\nexport interface VerifiedCheckoutJwt {\n  readonly issuer: string;\n  readonly jwtId: string;\n  readonly claims: Readonly<Record<string, unknown>>;\n}\n\n/**\n * `mandateClaims` must come from an already-verified mandate: `checkout_hash`\n * is worth nothing unless the issuer signed it\n */\nexport async function verifyCheckoutJwt(\n  mandateClaims: Readonly<Record<string, unknown>>,\n  deps: { readonly trust: TrustStore; readonly clock: Clock; readonly clockSkewSeconds: number },\n  context: Ap2ErrorContext,\n): Promise<VerifiedCheckoutJwt> {\n  const compact = mandateClaims['checkout_jwt'];\n  const expectedHash = mandateClaims['checkout_hash'];\n  if (typeof compact !== 'string' || compact.length === 0) {\n    throw ap2Rejected('invalid_claims', context);\n  }\n  if (typeof expectedHash !== 'string' || expectedHash.length === 0) {\n    throw ap2Rejected('invalid_claims', context);\n  }\n\n  requireMatchingHash(compact, expectedHash, context);\n\n  // Unverified, and read only to pick which configured key to try\n  let header: ReturnType<typeof decodeProtectedHeader>;\n  let unverifiedPayload: ReturnType<typeof decodeJwt>;\n  try {\n    header = decodeProtectedHeader(compact);\n    unverifiedPayload = decodeJwt(compact);\n  } catch (cause) {\n    throw ap2Rejected('checkout_binding_failed', { ...context, cause });\n  }\n\n  const { issuer, key } = await deps.trust.resolve(unverifiedPayload.iss, header.kid, context);\n\n  const options: JWTVerifyOptions = {\n    algorithms: [AP2_SIGNING_ALGORITHM],\n    issuer: issuer.issuer,\n    audience: issuer.audience,\n    clockTolerance: deps.clockSkewSeconds,\n    currentDate: deps.clock.now(),\n  };\n\n  let claims: Record<string, unknown>;\n  try {\n    const result = await jwtVerify(compact, key, options);\n    claims = result.payload as Record<string, unknown>;\n  } catch (cause) {\n    throw ap2Rejected('checkout_binding_failed', { ...context, cause });\n  }\n\n  const exp = claims['exp'];\n  const iat = claims['iat'];\n  const jti = claims['jti'];\n  // jose validates a time claim only when present, so requiring them is ours\n  if (typeof exp !== 'number' || typeof iat !== 'number') {\n    throw ap2Rejected('invalid_claims', context);\n  }\n  // `jti` is what replay defense and the receipt record, so it is required\n  if (typeof jti !== 'string' || jti.length === 0) {\n    throw ap2Rejected('invalid_claims', context);\n  }\n  const nowSeconds = Math.floor(deps.clock.now().getTime() / 1000);\n  if (iat > nowSeconds + deps.clockSkewSeconds) throw ap2Rejected('expired', context);\n\n  return { issuer: issuer.issuer, jwtId: jti, claims };\n}\n\n/**\n * Hashes the compact JWT as it arrived. Re-encoding the parsed claims would\n * hash a different document from the one being verified.\n */\nfunction requireMatchingHash(compact: string, expected: string, context: Ap2ErrorContext): void {\n  // sha-256 only: `_sd_alg` was already pinned to it upstream\n  const actual = sha256(compact).toString('base64url');\n  // Plain comparison: both sides are public to anyone holding the\n  // presentation, so there is no secret for timing to leak\n  if (actual !== expected) throw ap2Rejected('checkout_binding_failed', context);\n}\n","/**\n * Parse the presentation, verify the issuer's signature, resolve disclosures,\n * and read the mandate from `delegate_payload`.\n *\n * `@sd-jwt/core` handles disclosures, including malformed, duplicate, and\n * unreferenced disclosures. `jose` verifies the signature. This module applies\n * the configured key, algorithm, audience, and time policy.\n */\nimport { decodeSdJwt, getClaims, splitSdJwt } from '@sd-jwt/core';\nimport { type JWTVerifyOptions, jwtVerify } from 'jose';\nimport type { Clock } from '../../core';\nimport { isRecord } from '../../core/is-record';\nimport { AP2_CHECKOUT_MANDATE_VCT, AP2_DIGEST_ALGORITHM, AP2_SIGNING_ALGORITHM } from './constants';\nimport { type Ap2ErrorContext, ap2Rejected } from './errors';\nimport { sha256 } from './sha256';\nimport type { TrustStore } from './trust';\n\nexport interface VerifiedMandate {\n  readonly issuer: string;\n  /** The mandate element, with its nested disclosures resolved */\n  readonly claims: Readonly<Record<string, unknown>>;\n  /**\n   * The issuer-signed token on its own, without the disclosures.\n   *\n   * This, not the presentation string, is the stable identity of a mandate:\n   * disclosing or withholding an optional claim rewrites the presentation and\n   * leaves the signed token untouched. Replay defense keys on a digest of it.\n   */\n  readonly signedToken: string;\n}\n\n/**\n * `@sd-jwt/core` passes the algorithm it read from `_sd_alg`, so this is also\n * where a presentation declaring anything but sha-256 is refused\n */\nfunction hasher(data: string | ArrayBuffer, algorithm: string): Uint8Array {\n  if (algorithm.toLowerCase() !== AP2_DIGEST_ALGORITHM) {\n    throw ap2Rejected('malformed_presentation');\n  }\n  return sha256(typeof data === 'string' ? data : new Uint8Array(data));\n}\n\n/**\n * Order is the security boundary here: nothing is trusted until `jwtVerify`\n * returns. `kid` and `iss` are read before that only to pick which configured\n * key to try, and picking wrong just makes the signature fail.\n */\n// Both spellings of the renamed Delegate SD-JWT hop types\nconst KEY_BOUND_TYPES: ReadonlySet<string> = new Set([\n  'kb+sd-jwt',\n  'kb-sd-jwt',\n  'kb+sd-jwt+kb',\n  'kb-sd-jwt+kb',\n]);\n\nexport async function verifyMandate(\n  presentation: string,\n  deps: MandatePolicy,\n  context: Ap2ErrorContext,\n): Promise<VerifiedMandate> {\n  // Direct mode does not verify `~~`-joined delegation chains.\n  if (presentation.includes('~~')) {\n    throw ap2Rejected('unsupported_mandate_type', context);\n  }\n\n  let decoded: Awaited<ReturnType<typeof decodeSdJwt>>;\n  let encodedJws: string;\n  try {\n    // Covers a malformed base JWT, a disclosure that will not decode, a\n    // duplicate digest, and an `_sd_alg` other than sha-256\n    decoded = await decodeSdJwt(presentation, hasher);\n    encodedJws = splitSdJwt(presentation).jwt;\n  } catch (cause) {\n    throw ap2Rejected('malformed_presentation', { ...context, cause });\n  }\n\n  // Direct mode issues no key-bound mandates, so one arriving here belongs to\n  // a flow we do not verify. Ignoring it would mean silently not checking a\n  // proof that was sent.\n  if (decoded.kbJwt !== undefined) {\n    throw ap2Rejected('unsupported_mandate_type', context);\n  }\n\n  const rawPayload = decoded.jwt.payload;\n  const header = decoded.jwt.header;\n  if (!isRecord(rawPayload) || !isRecord(header)) {\n    throw ap2Rejected('malformed_presentation', context);\n  }\n\n  // Reject a delegation hop presented without its mandate. Its type or\n  // preceding-token hash identifies it.\n  if (\n    KEY_BOUND_TYPES.has(String(header['typ'])) ||\n    rawPayload['sd_hash'] !== undefined ||\n    rawPayload['issuer_jwt_hash'] !== undefined\n  ) {\n    throw ap2Rejected('unsupported_mandate_type', context);\n  }\n\n  const { issuer, key } = await deps.trust.resolve(rawPayload['iss'], header['kid'], context);\n\n  // AP2 permits an absent `aud`. If present, it must match the issuer's\n  // configured audience. The checkout JWT has a separate audience check.\n  const hasAudience = rawPayload['aud'] !== undefined;\n  if (!hasAudience && deps.requireAudience === true) {\n    throw ap2Rejected('invalid_claims', context);\n  }\n\n  const options: JWTVerifyOptions = {\n    // Redundant with one resolved EC key, which already refuses `alg: none` and\n    // a forged HMAC. It stops the header picking the algorithm if a key set is\n    // ever resolved instead.\n    algorithms: [AP2_SIGNING_ALGORITHM],\n    // Also redundant, since the key was resolved *from* `iss`, and kept as a\n    // backstop for a resolver that matches on something else\n    ...(rawPayload['iss'] !== undefined ? { issuer: issuer.issuer } : {}),\n    // Not redundant: `aud` is the presenter's claim, checked against the\n    // configured value\n    ...(hasAudience ? { audience: issuer.audience } : {}),\n    clockTolerance: deps.clockSkewSeconds,\n    // Injected clock, not jose's `Date.now()`, so expiry is testable\n    currentDate: deps.clock.now(),\n  };\n\n  let verifiedPayload: Record<string, unknown>;\n  try {\n    const result = await jwtVerify(encodedJws, key, options);\n    verifiedPayload = result.payload as Record<string, unknown>;\n  } catch (cause) {\n    throw ap2Rejected(classifyJoseFailure(cause), { ...context, cause });\n  }\n\n  let claims: Record<string, unknown>;\n  try {\n    // Against the VERIFIED payload: the decoded one would match disclosures\n    // against digests nobody signed\n    claims = (await getClaims(verifiedPayload, decoded.disclosures, hasher)) as Record<\n      string,\n      unknown\n    >;\n  } catch (cause) {\n    // Where an appended disclosure that no digest references is refused\n    throw ap2Rejected('malformed_presentation', { ...context, cause });\n  }\n\n  const mandate = delegatedMandate(claims, context);\n  // This verifier rejects KB-JWTs, so it cannot check a `cnf` holder-key\n  // binding. Reject the mandate rather than ignore the binding.\n  if (claims['cnf'] !== undefined || mandate['cnf'] !== undefined) {\n    throw ap2Rejected('unsupported_mandate_type', context);\n  }\n  requireClosedCheckoutMandate(mandate, context);\n  // Closed mandates cannot carry constraints this verifier does not evaluate\n  if (mandate['constraints'] !== undefined) {\n    throw ap2Rejected('unsupported_mandate_type', context);\n  }\n  requireFreshness([verifiedPayload, mandate], deps, context);\n\n  return { issuer: issuer.issuer, claims: mandate, signedToken: encodedJws };\n}\n\n/** What the verifier enforces beyond the signature */\nexport interface MandatePolicy {\n  readonly trust: TrustStore;\n  readonly clock: Clock;\n  readonly clockSkewSeconds: number;\n  /** Refuse a mandate with no `aud` */\n  readonly requireAudience?: boolean;\n  /** Refuse a mandate with no `exp`, at the top level or in the mandate content */\n  readonly requireExpiry?: boolean;\n}\n\n/**\n * Read the single object in `delegate_payload` after disclosure resolution.\n * The reference SDK discloses this element. If none or multiple are present,\n * there is no single mandate to check.\n */\nfunction delegatedMandate(\n  claims: Record<string, unknown>,\n  context: Ap2ErrorContext,\n): Record<string, unknown> {\n  const delegated = claims['delegate_payload'];\n  // One shape only: claims at the top level are refused, not read a second way\n  if (!Array.isArray(delegated)) throw ap2Rejected('unsupported_mandate_type', context);\n  const disclosed = delegated.filter(isRecord);\n  const [only] = disclosed;\n  if (disclosed.length !== 1 || only === undefined) throw ap2Rejected('invalid_claims', context);\n  return only;\n}\n\n/**\n * Matched on jose's stable error `code`, not its message. A client is owed\n * \"expired\" versus \"did not verify\"; anything finer describes our checks back\n * to whoever is probing them.\n */\nfunction classifyJoseFailure(\n  cause: unknown,\n): 'expired' | 'wrong_audience' | 'invalid_claims' | 'invalid_signature' {\n  const code = (cause as { code?: unknown })?.code;\n  if (code === 'ERR_JWT_EXPIRED') return 'expired';\n  if (code === 'ERR_JWT_CLAIM_VALIDATION_FAILED') {\n    const { claim, reason } = cause as { claim?: unknown; reason?: unknown };\n    if (claim === 'aud') return 'wrong_audience';\n    // `invalid` is jose's reason for a time claim that is not a number\n    if (claim === 'nbf' || claim === 'exp')\n      return reason === 'invalid' ? 'invalid_claims' : 'expired';\n  }\n  return 'invalid_signature';\n}\n\n/**\n * Check `exp`, `nbf` and `iat` on the signed token and the disclosed mandate.\n * `jose` checks only the token's time claims. AP2 requires none of them;\n * policy can require `exp` in either location.\n */\nfunction requireFreshness(\n  sources: readonly Record<string, unknown>[],\n  deps: MandatePolicy,\n  context: Ap2ErrorContext,\n): void {\n  const nowSeconds = Math.floor(deps.clock.now().getTime() / 1000);\n  let expires = false;\n  for (const claims of sources) {\n    const exp = claims['exp'];\n    const iat = claims['iat'];\n    if (exp !== undefined) {\n      if (typeof exp !== 'number') throw ap2Rejected('invalid_claims', context);\n      if (exp <= nowSeconds - deps.clockSkewSeconds) throw ap2Rejected('expired', context);\n      expires = true;\n    }\n    const nbf = claims['nbf'];\n    if (nbf !== undefined) {\n      if (typeof nbf !== 'number') throw ap2Rejected('invalid_claims', context);\n      if (nbf > nowSeconds + deps.clockSkewSeconds) throw ap2Rejected('expired', context);\n    }\n    if (iat !== undefined) {\n      if (typeof iat !== 'number') throw ap2Rejected('invalid_claims', context);\n      // A future `iat` is a broken signer, or a mandate minted to outlive its\n      // own expiry window\n      if (iat > nowSeconds + deps.clockSkewSeconds) throw ap2Rejected('expired', context);\n    }\n  }\n  if (!expires && deps.requireExpiry === true) throw ap2Rejected('invalid_claims', context);\n}\n\n// Exactly `mandate.checkout.1`; see AP2_CHECKOUT_MANDATE_VCT for why\nfunction requireClosedCheckoutMandate(\n  claims: Record<string, unknown>,\n  context: Ap2ErrorContext,\n): void {\n  if (claims['vct'] !== AP2_CHECKOUT_MANDATE_VCT) {\n    throw ap2Rejected('unsupported_mandate_type', context);\n  }\n}\n","/**\n * Static key resolution.\n *\n * Every key was written into `config.yaml` by an operator. No JWKS fetch, no\n * `jku`, no `x5u`. A mandate's `iss` and `kid`, or its `kid` alone when it\n * names no issuer, only choose *which* trusted key verifies it; anything\n * unrecognized is refused, so a mandate can never nominate its own signer.\n *\n * Not a \"try every key\" loop: that would make `kid` advisory and accept a\n * mandate that named a key it was not signed with.\n */\nimport { importJWK, type JWK } from 'jose';\nimport { AP2_SIGNING_ALGORITHM } from './constants';\nimport { type Ap2ErrorContext, ap2Rejected, ap2Unavailable } from './errors';\nimport type { Ap2TrustedIssuer } from './types';\n\n/** Named off `importJWK` because `CryptoKey` is a DOM type we do not load */\nexport type VerificationKey = Awaited<ReturnType<typeof importJWK>>;\n\nexport interface ResolvedKey {\n  readonly issuer: Ap2TrustedIssuer;\n  readonly key: VerificationKey;\n}\n\n/**\n * Resolves `(iss, kid)` against one configured issuer list. Caches the import\n * promise, not the key, so concurrent requests for a cold key share one import.\n */\nexport function createTrustStore(issuers: readonly Ap2TrustedIssuer[]) {\n  const byIssuer = new Map(issuers.map((entry) => [entry.issuer, entry]));\n  const imported = new Map<string, Promise<VerificationKey>>();\n\n  function issuerByName(iss: unknown, context: Ap2ErrorContext): Ap2TrustedIssuer {\n    if (typeof iss !== 'string' || iss.length === 0) {\n      throw ap2Rejected('invalid_claims', context);\n    }\n    const issuer = byIssuer.get(iss);\n    if (issuer === undefined) throw ap2Rejected('untrusted_issuer', context);\n    return issuer;\n  }\n\n  // AP2 mandates may omit `iss`; the reference SDK mints none. The `kid` then\n  // selects the issuer, and a `kid` that two issuers share selects neither.\n  function issuerByKid(kid: string, context: Ap2ErrorContext): Ap2TrustedIssuer {\n    const matches = issuers.filter((entry) => entry.keys.some((key) => key.kid === kid));\n    const [only] = matches;\n    if (matches.length !== 1 || only === undefined) throw ap2Rejected('unknown_key', context);\n    return only;\n  }\n\n  return {\n    /** Every trusted issuer id, for diagnostics. Never the keys themselves */\n    issuerIds(): readonly string[] {\n      return [...byIssuer.keys()];\n    },\n\n    async resolve(iss: unknown, kid: unknown, context: Ap2ErrorContext): Promise<ResolvedKey> {\n      // Not defaulted to the issuer's only key: mid-rotation there are two,\n      // and the gateway should not guess which one signed this\n      if (typeof kid !== 'string' || kid.length === 0) {\n        throw ap2Rejected('unknown_key', context);\n      }\n      const issuer = iss === undefined ? issuerByKid(kid, context) : issuerByName(iss, context);\n      const trusted = issuer.keys.find((candidate) => candidate.kid === kid);\n      if (trusted === undefined) throw ap2Rejected('unknown_key', context);\n\n      // JSON, not a joined string: both halves are operator-chosen and could\n      // contain whatever separator we picked\n      const cacheKey = JSON.stringify([iss, kid]);\n      let pending = imported.get(cacheKey);\n      if (pending === undefined) {\n        pending = importJWK(trusted.jwk as JWK, AP2_SIGNING_ALGORITHM);\n        imported.set(cacheKey, pending);\n      }\n\n      try {\n        return { issuer, key: await pending };\n      } catch (cause) {\n        // Config already checked this JWK member by member, so reaching here\n        // means our config is broken, not the mandate. Drop the cached\n        // rejection so the next request retries the import.\n        imported.delete(cacheKey);\n        throw ap2Unavailable('configured verification key could not be imported', {\n          ...context,\n          cause,\n        });\n      }\n    },\n  };\n}\n\nexport type TrustStore = ReturnType<typeof createTrustStore>;\n","/**\n * The Direct Checkout Mandate verifier: mandate signature first, then the\n * merchant checkout JWT it binds. Either stage failing is a refusal.\n *\n * Verification establishes that a trusted issuer signed the mandate, its\n * supplied time and audience claims pass policy, and it binds a checkout JWT\n * signed by a trusted merchant issuer. `bindMandateToPurchase` separately\n * checks the purchase before settlement.\n */\nimport type { Clock } from '../../core';\nimport { verifyCheckoutJwt } from './checkout-jwt';\nimport { type Ap2ErrorContext, ap2Rejected } from './errors';\nimport { verifyMandate } from './sd-jwt';\nimport { sha256 } from './sha256';\nimport { createTrustStore } from './trust';\nimport type { EnabledAp2Config, VerifiedCheckoutMandate } from './types';\n\nexport interface Ap2VerifierOptions {\n  readonly config: EnabledAp2Config;\n  readonly clock: Clock;\n}\n\nexport interface Ap2MandateVerifier {\n  verify(presentation: string, context?: Ap2ErrorContext): Promise<VerifiedCheckoutMandate>;\n  /** Trusted issuer ids, for the provider's health detail. Never keys */\n  trustedIssuers(): { readonly mandate: readonly string[]; readonly checkout: readonly string[] };\n}\n\n/**\n * Algorithm-prefixed so a future digest change is visible in stored references\n * rather than silently producing unequal values for one mandate\n */\nfunction mandateReference(signedToken: string): string {\n  return `sha256:${sha256(signedToken).toString('base64url')}`;\n}\n\nexport function createAp2MandateVerifier(options: Ap2VerifierOptions): Ap2MandateVerifier {\n  // Two stores, not one list: signing the merchant's checkout documents must\n  // not confer the power to issue mandates\n  const mandateTrust = createTrustStore(options.config.trust.mandateIssuers);\n  const checkoutTrust = createTrustStore(options.config.trust.checkoutIssuers);\n  const deps = { clock: options.clock, clockSkewSeconds: options.config.clockSkewSeconds };\n  const mandatePolicy = {\n    ...deps,\n    trust: mandateTrust,\n    requireAudience: options.config.requireMandateAudience === true,\n    requireExpiry: options.config.requireMandateExpiry === true,\n  };\n\n  return {\n    async verify(\n      presentation: string,\n      context: Ap2ErrorContext = {},\n    ): Promise<VerifiedCheckoutMandate> {\n      if (typeof presentation !== 'string' || presentation.length === 0) {\n        throw ap2Rejected('malformed_presentation', context);\n      }\n\n      const mandate = await verifyMandate(presentation, mandatePolicy, context);\n      const checkout = await verifyCheckoutJwt(\n        mandate.claims,\n        { ...deps, trust: checkoutTrust },\n        context,\n      );\n\n      return {\n        reference: mandateReference(mandate.signedToken),\n        mandateIssuer: mandate.issuer,\n        checkoutIssuer: checkout.issuer,\n        checkoutJwtId: checkout.jwtId,\n        checkoutClaims: checkout.claims,\n      };\n    },\n\n    trustedIssuers() {\n      return { mandate: mandateTrust.issuerIds(), checkout: checkoutTrust.issuerIds() };\n    },\n  };\n}\n","/**\n * The AP2 authorization provider: the seam between core's generic contract and\n * the mandate machinery.\n *\n * It owns its replay store, so whoever creates it must call `close()`:\n * `createGateway` does not close authorization providers.\n */\nimport type {\n  AdapterHealth,\n  AuthorizationFinalizeContext,\n  AuthorizationProvider,\n  AuthorizationRequirement,\n  AuthorizationVerification,\n  AuthorizationVerificationContext,\n  Clock,\n  Logger,\n} from '../../core';\nimport { NOOP_LOGGER, systemClock } from '../../core';\nimport { PACKAGE_VERSION } from '../../version';\nimport { AP2_CHECKOUT_PROFILE, AP2_SPEC_VERSION } from './constants';\nimport { buildAp2Descriptor } from './descriptor';\nimport { type Ap2ErrorContext, ap2Replayed, ap2Unavailable } from './errors';\nimport { bindMandateToPurchase } from './profile';\nimport { type Ap2ReplayStore, createAp2ReplayStore } from './replay-store';\nimport type { EnabledAp2Config } from './types';\nimport { createAp2MandateVerifier } from './verifier';\n\nexport interface Ap2AuthorizationProviderOptions {\n  readonly config: EnabledAp2Config;\n  readonly clock?: Clock;\n  readonly logger?: Logger;\n  /** Injectable so tests need not touch the filesystem */\n  readonly replayStore?: Ap2ReplayStore;\n}\n\nexport interface Ap2AuthorizationProvider extends AuthorizationProvider {\n  /** Closes the replay store */\n  close(): void;\n}\n\nexport function createAp2AuthorizationProvider(\n  options: Ap2AuthorizationProviderOptions,\n): Ap2AuthorizationProvider {\n  const clock = options.clock ?? systemClock;\n  const logger = options.logger ?? NOOP_LOGGER;\n\n  const verifier = createAp2MandateVerifier({ config: options.config, clock });\n  const replay =\n    options.replayStore ?? createAp2ReplayStore({ path: options.config.replay.path, logger });\n\n  const requirement: AuthorizationRequirement = {\n    method: 'ap2',\n    version: AP2_SPEC_VERSION,\n    profile: AP2_CHECKOUT_PROFILE,\n  };\n\n  async function verifyAndReserve(\n    context: AuthorizationVerificationContext,\n  ): Promise<AuthorizationVerification> {\n    const errorContext: Ap2ErrorContext = {\n      requestId: context.requestId,\n      resourceId: context.resourceId,\n    };\n\n    const mandate = await verifier.verify(context.submission.payload, errorContext);\n    // Before reserving, not after: a mandate that does not authorize this\n    // purchase must stay spendable on the purchase it does authorize\n    await bindMandateToPurchase(mandate, context, errorContext);\n\n    let reservation: ReturnType<Ap2ReplayStore['reserve']>;\n    try {\n      reservation = replay.reserve({\n        reference: mandate.reference,\n        checkoutJti: mandate.checkoutJwtId,\n        mandateIssuer: mandate.mandateIssuer,\n        checkoutIssuer: mandate.checkoutIssuer,\n        resourceId: context.resourceId,\n        requestId: context.requestId,\n      });\n    } catch (cause) {\n      throw ap2Unavailable('replay store could not be written', { ...errorContext, cause });\n    }\n\n    if (reservation.kind === 'replayed') {\n      throw ap2Replayed(reservation.state, errorContext);\n    }\n\n    return {\n      status: 'verified',\n      method: 'ap2',\n      reference: mandate.reference,\n      // The reservation handle is the reference itself, so the two can never\n      // name different mandates\n      reservationId: mandate.reference,\n      // Opaque identifiers an operator can reconcile with. Never a claim from\n      // the mandate: those carry the buyer's purchase and their personal data.\n      // `checkoutId`, not `checkoutJwtId` - the receipt store redacts any key\n      // that reads as secret-shaped, and \"jwt\" is on that list.\n      metadata: {\n        mandateIssuer: mandate.mandateIssuer,\n        checkoutIssuer: mandate.checkoutIssuer,\n        checkoutId: mandate.checkoutJwtId,\n      },\n    };\n  }\n\n  const finalize = (\n    action: 'consume' | 'release' | 'markUncertain',\n    reservationId: string,\n    context: AuthorizationFinalizeContext,\n  ): void => {\n    try {\n      replay[action](reservationId);\n    } catch (cause) {\n      throw ap2Unavailable(`replay store could not record ${action}`, { ...context, cause });\n    }\n  };\n\n  return {\n    name: 'ap2',\n    descriptor: buildAp2Descriptor(PACKAGE_VERSION),\n    requirement,\n    verifyAndReserve,\n\n    async consume(reservationId, context) {\n      finalize('consume', reservationId, context);\n    },\n    async release(reservationId, context) {\n      finalize('release', reservationId, context);\n    },\n    async markUncertain(reservationId, context) {\n      finalize('markUncertain', reservationId, context);\n    },\n\n    async health(): Promise<AdapterHealth> {\n      const startedAt = clock.monotonicMs();\n      const checkedAt = clock.nowIso();\n      let available = true;\n      try {\n        // A read against the real table, so a database that opened but cannot\n        // be queried is caught here rather than on the first purchase\n        replay.stateOf('health-probe');\n      } catch {\n        available = false;\n      }\n      const durationMs = Math.round(clock.monotonicMs() - startedAt);\n      if (!available) {\n        // A fixed token, never a sentence built from the caught error\n        return { status: 'fail', checkedAt, durationMs, detail: 'replay-store-unavailable' };\n      }\n      const trusted = verifier.trustedIssuers();\n      return {\n        status: 'pass',\n        checkedAt,\n        durationMs,\n        detail: `mandate-issuers=${trusted.mandate.length} checkout-issuers=${trusted.checkout.length}`,\n      };\n    },\n\n    close() {\n      replay.close();\n    },\n  };\n}\n"]}

package/dist/{authorization-BpbWGGrf.d.ts → authorization-CMkIuAkO.d.ts}

@@ -1,4 +1,4 @@
-import { f as AuthorizationMethodName, A as AdapterDescriptor, m as PaymentRequirement, c as AdapterHealth } from './runtime-CiYbgGpi.js';
+import { g as AuthorizationMethodName, A as AdapterDescriptor, n as PaymentRequirement, c as AdapterHealth } from './runtime-7vLNYvmU.js';
 
 /**
  * Canonical authorization model. FROZEN CONTRACT.

package/dist/chunk-2CJNA7MS.js

@@ -0,0 +1,8 @@
+// src/core/is-record.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+export { isRecord };
+//# sourceMappingURL=chunk-2CJNA7MS.js.map
+//# sourceMappingURL=chunk-2CJNA7MS.js.map

package/dist/chunk-2CJNA7MS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/is-record.ts"],"names":[],"mappings":";AACO,SAAS,SAAS,KAAA,EAAkD;AACzE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E","file":"chunk-2CJNA7MS.js","sourcesContent":["/** A non-null, non-array object. The prototype is not checked */\nexport function isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n"]}

package/dist/{chunk-CKJRITWY.js → chunk-5ZYXBCDX.js}

@@ -1,4 +1,4 @@
-import { isRecord } from './chunk-53WXXIPR.js';
+import { isRecord } from './chunk-2CJNA7MS.js';
 import { createHash } from 'crypto';
 
 // src/payments/mpp/problems.ts
@@ -109,5 +109,5 @@ function receiptObject(serialized) {
 }
 
 export { CONTENT_DIGEST_METADATA_KEY, MPP_MCP_CREDENTIAL_META_KEY, MPP_MCP_PAYMENT_REQUIRED_META_KEY, MPP_MCP_RECEIPT_META_KEY, contentDigest, mcpPaymentRequired, mppProblem, mppProblemDetail, receiptObject };
-//# sourceMappingURL=chunk-CKJRITWY.js.map
-//# sourceMappingURL=chunk-CKJRITWY.js.map
+//# sourceMappingURL=chunk-5ZYXBCDX.js.map
+//# sourceMappingURL=chunk-5ZYXBCDX.js.map

package/dist/{chunk-CKJRITWY.js.map → chunk-5ZYXBCDX.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/payments/mpp/problems.ts","../src/payments/mpp/transport.ts"],"names":[],"mappings":";;;;AAMO,IAAM,oBAAA,GAAuB,mCAAA;AAUpC,IAAM,MAAA,GAAmD;AAAA,EACvD,kBAAA,EAAoB,kBAAA;AAAA,EACpB,sBAAA,EAAwB,sBAAA;AAAA,EACxB,mBAAA,EAAqB,mBAAA;AAAA,EACrB,iBAAA,EAAmB,iBAAA;AAAA,EACnB,qBAAA,EAAuB,qBAAA;AAAA,EACvB,wBAAA,EAA0B;AAC5B,CAAA;AAIA,IAAM,YAAA,uBAAwD,GAAA,CAAI;AAAA,EAChE,CAAC,wBAAwB,sBAAsB,CAAA;AAAA,EAC/C,CAAC,mBAAmB,sBAAsB,CAAA;AAAA,EAC1C,CAAC,qBAAqB,mBAAmB,CAAA;AAAA,EACzC,CAAC,wBAAwB,mBAAmB,CAAA;AAAA,EAC5C,CAAC,eAAe,mBAAmB,CAAA;AAAA,EACnC,CAAC,kBAAkB,mBAAmB,CAAA;AAAA,EACtC,CAAC,0BAA0B,mBAAmB,CAAA;AAAA,EAC9C,CAAC,qBAAqB,iBAAiB,CAAA;AAAA,EACvC,CAAC,yBAAyB,iBAAiB;AAC7C,CAAC,CAAA;AAGM,SAAS,UAAA,CACd,IAAA,EACA,UAAA,EACA,MAAA,EACmD;AACnD,EAAA,MAAM,OAAA,GAAU,WAAA,CAAY,IAAA,EAAM,UAAA,EAAY,MAAM,CAAA;AACpD,EAAA,OAAO,EAAE,IAAA,EAAM,CAAA,EAAG,oBAAoB,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,KAAA,EAAO,MAAA,CAAO,OAAO,CAAA,EAAE;AAC7E;AAGA,IAAM,cAAA,uBAAkD,GAAA,CAAI;AAAA,EAC1D,CAAC,kBAAkB,sDAAsD,CAAA;AAAA,EACzE,CAAC,qBAAqB,6CAA6C,CAAA;AAAA,EACnE,CAAC,wBAAwB,sCAAsC,CAAA;AAAA,EAC/D,CAAC,mBAAmB,4DAA4D,CAAA;AAAA,EAChF,CAAC,qBAAqB,mDAAmD,CAAA;AAAA,EACzE,CAAC,wBAAwB,6DAA6D,CAAA;AAAA,EACtF,CAAC,0BAA0B,oDAAoD,CAAA;AAAA,EAC/E,CAAC,qBAAqB,4BAA4B,CAAA;AAAA,EAClD,CAAC,eAAe,6CAA6C,CAAA;AAAA,EAC7D,CAAC,kBAAkB,gDAAgD,CAAA;AAAA,EACnE;AAAA,IACE,oBAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,CAAC,0BAA0B,yDAAyD,CAAA;AAAA,EACpF,CAAC,wBAAwB,qEAAqE,CAAA;AAAA,EAC9F,CAAC,gBAAgB,kDAAkD,CAAA;AAAA,EACnE,CAAC,mBAAmB,qDAAqD,CAAA;AAAA,EACzE,CAAC,iBAAiB,0DAA0D,CAAA;AAAA,EAC5E,CAAC,eAAe,wDAAwD,CAAA;AAAA,EACxE,CAAC,eAAe,+CAA+C,CAAA;AAAA,EAC/D,CAAC,eAAe,4DAA4D,CAAA;AAAA,EAC5E,CAAC,qBAAqB,uDAAuD,CAAA;AAAA,EAC7E,CAAC,mBAAmB,yEAAyE,CAAA;AAAA,EAC7F,CAAC,+BAA+B,qCAAqC,CAAA;AAAA,EACrE,CAAC,yBAAyB,gCAAgC,CAAA;AAAA,EAC1D,CAAC,yBAAyB,wCAAwC,CAAA;AAAA,EAClE,CAAC,uBAAuB,4CAA4C,CAAA;AAAA,EACpE,CAAC,uBAAuB,qDAAqD,CAAA;AAAA,EAC7E,CAAC,0CAA0C,gDAAgD,CAAA;AAAA,EAC3F;AAAA,IACE,iDAAA;AAAA,IACA;AAAA;AAEJ,CAAC,CAAA;AAGM,SAAS,gBAAA,CAAiB,QAA4B,QAAA,EAA0B;AACrF,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,QAAA;AACjC,EAAA,OAAO,cAAA,CAAe,GAAA,CAAI,MAAM,CAAA,IAAK,4BAA4B,MAAM,CAAA,CAAA,CAAA;AACzE;AAEA,SAAS,WAAA,CAAY,IAAA,EAAc,UAAA,EAAoB,MAAA,EAAiC;AACtF,EAAA,IAAI,IAAA,KAAS,oBAAoB,OAAO,kBAAA;AACxC,EAAA,IAAI,UAAA,IAAc,KAAK,OAAO,wBAAA;AAG9B,EAAA,IAAI,IAAA,KAAS,oBAAoB,OAAO,mBAAA;AACxC,EAAA,OAAA,CAAQ,WAAW,MAAA,GAAY,YAAA,CAAa,GAAA,CAAI,MAAM,IAAI,MAAA,KAAc,qBAAA;AAC1E;;;ACtFO,IAAM,2BAAA,GAA8B;AAGpC,SAAS,cAAc,IAAA,EAA0B;AACtD,EAAA,OAAO,CAAA,SAAA,EAAY,WAAW,QAAQ,CAAA,CAAE,OAAO,IAAI,CAAA,CAAE,MAAA,CAAO,QAAQ,CAAC,CAAA,CAAA,CAAA;AACvE;AAGO,IAAM,2BAAA,GAA8B;AAGpC,IAAM,iCAAA,GAAoC;AAG1C,IAAM,wBAAA,GAA2B;AASjC,SAAS,kBAAA,CACd,UACA,OAAA,EACqC;AACrC,EAAA,MAAM,aAAa,QAAA,CAAS,QAAQ,CAAA,GAAI,QAAA,CAAS,YAAY,CAAA,GAAI,MAAA;AACjE,EAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,UAAU,KAAK,UAAA,CAAW,MAAA,KAAW,GAAG,OAAO,MAAA;AAClE,EAAA,MAAM,SAAS,OAAO,OAAA,EAAS,MAAA,KAAW,QAAA,GAAW,QAAQ,MAAA,GAAS,MAAA;AACtE,EAAA,OAAO;AAAA,IACL,UAAA,EAAY,GAAA;AAAA,IACZ,UAAA;AAAA,IACA,GAAI,YAAY,MAAA,GACZ;AAAA,MACE,OAAA,EAAS;AAAA,QACP,GAAG,UAAA,CAAW,OAAA,CAAQ,IAAA,EAAM,KAAK,MAAM,CAAA;AAAA,QACvC,MAAA,EAAQ,GAAA;AAAA,QACR,MAAA,EAAQ,gBAAA,CAAiB,MAAA,EAAQ,OAAA,CAAQ,MAAM,CAAA;AAAA,QAC/C,GAAI,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,KAAW;AAAC;AAC3C,QAEF;AAAC,GACP;AACF;AAGO,SAAS,cAAc,UAAA,EAA0D;AACtF,EAAA,IAAI,OAAO,UAAA,KAAe,QAAA,EAAU,OAAO,MAAA;AAC3C,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAmB,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAA,CAAK,YAAY,WAAW,CAAA,CAAE,QAAA,CAAS,MAAM,CAAC,CAAA;AACzF,IAAA,OAAO,QAAA,CAAS,OAAO,CAAA,GAAI,OAAA,GAAU,KAAA,CAAA;AAAA,EACvC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF","file":"chunk-CKJRITWY.js","sourcesContent":["/**\n * Map MPP payment errors to the Problem Details types in\n * `draft-httpauth-payment-01`. This module has no optional peer imports, so\n * the main HTTP route can use it.\n */\n\nexport const MPP_PROBLEM_BASE_URI = 'https://paymentauth.org/problems/';\n\nexport type MppProblemType =\n  | 'payment-required'\n  | 'malformed-credential'\n  | 'invalid-challenge'\n  | 'payment-expired'\n  | 'verification-failed'\n  | 'internal-payment-error';\n\nconst TITLES: Readonly<Record<MppProblemType, string>> = {\n  'payment-required': 'Payment Required',\n  'malformed-credential': 'Malformed Credential',\n  'invalid-challenge': 'Invalid Challenge',\n  'payment-expired': 'Payment Expired',\n  'verification-failed': 'Verification Failed',\n  'internal-payment-error': 'Internal Payment Error',\n};\n\n// Map known MPP refusal reasons to problem types; other reasons use\n// `verification-failed`. A Map keeps facilitator text out of Object.prototype\nconst REASON_TYPES: ReadonlyMap<string, MppProblemType> = new Map([\n  ['malformed_credential', 'malformed-credential'],\n  ['invalid_payload', 'malformed-credential'],\n  ['invalid_challenge', 'invalid-challenge'],\n  ['challenge_not_issued', 'invalid-challenge'],\n  ['wrong_realm', 'invalid-challenge'],\n  ['wrong_resource', 'invalid-challenge'],\n  ['challenge_already_used', 'invalid-challenge'],\n  ['challenge_expired', 'payment-expired'],\n  ['authorization_expired', 'payment-expired'],\n]);\n\n/** The Problem Details `type` URI and `title` for an MPP payment error */\nexport function mppProblem(\n  code: string,\n  httpStatus: number,\n  reason?: string,\n): { readonly type: string; readonly title: string } {\n  const problem = problemType(code, httpStatus, reason);\n  return { type: `${MPP_PROBLEM_BASE_URI}${problem}`, title: TITLES[problem] };\n}\n\n// Descriptions for MPP reasons and two x402 facilitator refusals\nconst REASON_DETAILS: ReadonlyMap<string, string> = new Map([\n  ['wrong_provider', 'The challenge was issued for another payment method.'],\n  ['missing_challenge', 'No challenge is available for this request.'],\n  ['malformed_credential', 'The credential could not be decoded.'],\n  ['invalid_payload', 'The credential payload does not match the expected format.'],\n  ['invalid_challenge', 'The credential does not answer a valid challenge.'],\n  ['challenge_not_issued', 'The challenge was not issued by this server or was altered.'],\n  ['challenge_already_used', 'The challenge has already been used for a payment.'],\n  ['challenge_expired', 'The challenge has expired.'],\n  ['wrong_realm', 'The challenge was issued for another realm.'],\n  ['wrong_resource', 'The challenge was issued for another resource.'],\n  [\n    'unsupported_method',\n    'The challenge names a payment method or intent this server does not accept.',\n  ],\n  ['unsupported_credential', 'The credential type is not accepted for this challenge.'],\n  ['body_digest_mismatch', 'The request body differs from the one the challenge was issued for.'],\n  ['wrong_amount', 'The payment amount does not match the challenge.'],\n  ['wrong_recipient', 'The payment recipient does not match the challenge.'],\n  ['wrong_network', 'The payment uses a different network from the challenge.'],\n  ['wrong_asset', 'The payment uses a different asset from the challenge.'],\n  ['wrong_terms', 'The payment terms do not match the challenge.'],\n  ['wrong_nonce', 'The authorization nonce is not derived from the challenge.'],\n  ['invalid_signature', 'The authorization signature does not match the payer.'],\n  ['source_mismatch', 'The credential source is not the account that signed the authorization.'],\n  ['authorization_not_yet_valid', 'The authorization is not valid yet.'],\n  ['authorization_expired', 'The authorization has expired.'],\n  ['authorization_invalid', 'The authorization failed verification.'],\n  ['settlement_rejected', 'The payment was refused before settlement.'],\n  ['settlement_mismatch', 'The payment could not be matched to its settlement.'],\n  ['invalid_exact_evm_insufficient_balance', 'The payer balance is too low for this payment.'],\n  [\n    'invalid_exact_evm_transaction_simulation_failed',\n    'The transfer failed in simulation, so it was not submitted.',\n  ],\n]);\n\n/** Return a sentence for a known reason, or quote an unknown reason */\nexport function mppProblemDetail(reason: string | undefined, fallback: string): string {\n  if (reason === undefined) return fallback;\n  return REASON_DETAILS.get(reason) ?? `The payment was refused: ${reason}.`;\n}\n\nfunction problemType(code: string, httpStatus: number, reason?: string): MppProblemType {\n  if (code === 'PAYMENT_REQUIRED') return 'payment-required';\n  if (httpStatus >= 500) return 'internal-payment-error';\n  // A replayed credential reuses its challenge because the replay key\n  // includes the challenge-derived nonce\n  if (code === 'PAYMENT_REPLAYED') return 'invalid-challenge';\n  return (reason !== undefined ? REASON_TYPES.get(reason) : undefined) ?? 'verification-failed';\n}\n","/**\n * Build MPP MCP metadata accepted by the `mppx` client. This module has no\n * optional peer imports, so the `./mcp` subpath can use it.\n */\n\nimport { createHash } from 'node:crypto';\nimport { isRecord } from '../../core/is-record';\nimport { mppProblem, mppProblemDetail } from './problems';\n\n/**\n * `CanonicalRequest.metadata` key for the digest of an HTTP request body. The\n * MPP provider binds it into the challenge when present, so a credential\n * cannot pay for a different body.\n */\nexport const CONTENT_DIGEST_METADATA_KEY = 'contentDigest';\n\n/** RFC 9530 `sha-256` digest of a request body, the form of the MPP `digest` parameter */\nexport function contentDigest(body: Uint8Array): string {\n  return `sha-256=:${createHash('sha256').update(body).digest('base64')}:`;\n}\n\n/** MCP `_meta` key of a tool call's credential object */\nexport const MPP_MCP_CREDENTIAL_META_KEY = 'org.paymentauth/credential';\n\n/** MCP `_meta` key of a tool result's challenges */\nexport const MPP_MCP_PAYMENT_REQUIRED_META_KEY = 'org.paymentauth/payment-required';\n\n/** MCP `_meta` key of a paid tool result's receipt object */\nexport const MPP_MCP_RECEIPT_META_KEY = 'org.paymentauth/receipt';\n\n/**\n * Build payment-required metadata from the provider's challenge objects.\n * Return undefined if the envelope has none. The draft uses JSON-RPC error\n * -32042; this gateway puts the data in a tool result's `_meta`, which\n * `mppx` also reads. A refusal adds its Problem Details, with the provider's\n * reason token in the `reason` member.\n */\nexport function mcpPaymentRequired(\n  envelope: unknown,\n  refusal?: { readonly code: string; readonly reason?: unknown; readonly detail: string },\n): Record<string, unknown> | undefined {\n  const challenges = isRecord(envelope) ? envelope['challenges'] : undefined;\n  if (!Array.isArray(challenges) || challenges.length === 0) return undefined;\n  const reason = typeof refusal?.reason === 'string' ? refusal.reason : undefined;\n  return {\n    httpStatus: 402,\n    challenges,\n    ...(refusal !== undefined\n      ? {\n          problem: {\n            ...mppProblem(refusal.code, 402, reason),\n            status: 402,\n            detail: mppProblemDetail(reason, refusal.detail),\n            ...(reason !== undefined ? { reason } : {}),\n          },\n        }\n      : {}),\n  };\n}\n\n/** The receipt object from a serialized `Payment-Receipt` value, base64url JSON */\nexport function receiptObject(serialized: unknown): Record<string, unknown> | undefined {\n  if (typeof serialized !== 'string') return undefined;\n  try {\n    const decoded: unknown = JSON.parse(Buffer.from(serialized, 'base64url').toString('utf8'));\n    return isRecord(decoded) ? decoded : undefined;\n  } catch {\n    return undefined;\n  }\n}\n"]}
+{"version":3,"sources":["../src/payments/mpp/problems.ts","../src/payments/mpp/transport.ts"],"names":[],"mappings":";;;;AAMO,IAAM,oBAAA,GAAuB,mCAAA;AAUpC,IAAM,MAAA,GAAmD;AAAA,EACvD,kBAAA,EAAoB,kBAAA;AAAA,EACpB,sBAAA,EAAwB,sBAAA;AAAA,EACxB,mBAAA,EAAqB,mBAAA;AAAA,EACrB,iBAAA,EAAmB,iBAAA;AAAA,EACnB,qBAAA,EAAuB,qBAAA;AAAA,EACvB,wBAAA,EAA0B;AAC5B,CAAA;AAIA,IAAM,YAAA,uBAAwD,GAAA,CAAI;AAAA,EAChE,CAAC,wBAAwB,sBAAsB,CAAA;AAAA,EAC/C,CAAC,mBAAmB,sBAAsB,CAAA;AAAA,EAC1C,CAAC,qBAAqB,mBAAmB,CAAA;AAAA,EACzC,CAAC,wBAAwB,mBAAmB,CAAA;AAAA,EAC5C,CAAC,eAAe,mBAAmB,CAAA;AAAA,EACnC,CAAC,kBAAkB,mBAAmB,CAAA;AAAA,EACtC,CAAC,0BAA0B,mBAAmB,CAAA;AAAA,EAC9C,CAAC,qBAAqB,iBAAiB,CAAA;AAAA,EACvC,CAAC,yBAAyB,iBAAiB;AAC7C,CAAC,CAAA;AAGM,SAAS,UAAA,CACd,IAAA,EACA,UAAA,EACA,MAAA,EACmD;AACnD,EAAA,MAAM,OAAA,GAAU,WAAA,CAAY,IAAA,EAAM,UAAA,EAAY,MAAM,CAAA;AACpD,EAAA,OAAO,EAAE,IAAA,EAAM,CAAA,EAAG,oBAAoB,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,KAAA,EAAO,MAAA,CAAO,OAAO,CAAA,EAAE;AAC7E;AAGA,IAAM,cAAA,uBAAkD,GAAA,CAAI;AAAA,EAC1D,CAAC,kBAAkB,sDAAsD,CAAA;AAAA,EACzE,CAAC,qBAAqB,6CAA6C,CAAA;AAAA,EACnE,CAAC,wBAAwB,sCAAsC,CAAA;AAAA,EAC/D,CAAC,mBAAmB,4DAA4D,CAAA;AAAA,EAChF,CAAC,qBAAqB,mDAAmD,CAAA;AAAA,EACzE,CAAC,wBAAwB,6DAA6D,CAAA;AAAA,EACtF,CAAC,0BAA0B,oDAAoD,CAAA;AAAA,EAC/E,CAAC,qBAAqB,4BAA4B,CAAA;AAAA,EAClD,CAAC,eAAe,6CAA6C,CAAA;AAAA,EAC7D,CAAC,kBAAkB,gDAAgD,CAAA;AAAA,EACnE;AAAA,IACE,oBAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,CAAC,0BAA0B,yDAAyD,CAAA;AAAA,EACpF,CAAC,wBAAwB,qEAAqE,CAAA;AAAA,EAC9F,CAAC,gBAAgB,kDAAkD,CAAA;AAAA,EACnE,CAAC,mBAAmB,qDAAqD,CAAA;AAAA,EACzE,CAAC,iBAAiB,0DAA0D,CAAA;AAAA,EAC5E,CAAC,eAAe,wDAAwD,CAAA;AAAA,EACxE,CAAC,eAAe,+CAA+C,CAAA;AAAA,EAC/D,CAAC,eAAe,4DAA4D,CAAA;AAAA,EAC5E,CAAC,qBAAqB,uDAAuD,CAAA;AAAA,EAC7E,CAAC,mBAAmB,yEAAyE,CAAA;AAAA,EAC7F,CAAC,+BAA+B,qCAAqC,CAAA;AAAA,EACrE,CAAC,yBAAyB,gCAAgC,CAAA;AAAA,EAC1D,CAAC,yBAAyB,wCAAwC,CAAA;AAAA,EAClE,CAAC,uBAAuB,4CAA4C,CAAA;AAAA,EACpE,CAAC,uBAAuB,qDAAqD,CAAA;AAAA,EAC7E,CAAC,0CAA0C,gDAAgD,CAAA;AAAA,EAC3F;AAAA,IACE,iDAAA;AAAA,IACA;AAAA;AAEJ,CAAC,CAAA;AAGM,SAAS,gBAAA,CAAiB,QAA4B,QAAA,EAA0B;AACrF,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,QAAA;AACjC,EAAA,OAAO,cAAA,CAAe,GAAA,CAAI,MAAM,CAAA,IAAK,4BAA4B,MAAM,CAAA,CAAA,CAAA;AACzE;AAEA,SAAS,WAAA,CAAY,IAAA,EAAc,UAAA,EAAoB,MAAA,EAAiC;AACtF,EAAA,IAAI,IAAA,KAAS,oBAAoB,OAAO,kBAAA;AACxC,EAAA,IAAI,UAAA,IAAc,KAAK,OAAO,wBAAA;AAG9B,EAAA,IAAI,IAAA,KAAS,oBAAoB,OAAO,mBAAA;AACxC,EAAA,OAAA,CAAQ,WAAW,MAAA,GAAY,YAAA,CAAa,GAAA,CAAI,MAAM,IAAI,MAAA,KAAc,qBAAA;AAC1E;;;ACtFO,IAAM,2BAAA,GAA8B;AAGpC,SAAS,cAAc,IAAA,EAA0B;AACtD,EAAA,OAAO,CAAA,SAAA,EAAY,WAAW,QAAQ,CAAA,CAAE,OAAO,IAAI,CAAA,CAAE,MAAA,CAAO,QAAQ,CAAC,CAAA,CAAA,CAAA;AACvE;AAGO,IAAM,2BAAA,GAA8B;AAGpC,IAAM,iCAAA,GAAoC;AAG1C,IAAM,wBAAA,GAA2B;AASjC,SAAS,kBAAA,CACd,UACA,OAAA,EACqC;AACrC,EAAA,MAAM,aAAa,QAAA,CAAS,QAAQ,CAAA,GAAI,QAAA,CAAS,YAAY,CAAA,GAAI,MAAA;AACjE,EAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,UAAU,KAAK,UAAA,CAAW,MAAA,KAAW,GAAG,OAAO,MAAA;AAClE,EAAA,MAAM,SAAS,OAAO,OAAA,EAAS,MAAA,KAAW,QAAA,GAAW,QAAQ,MAAA,GAAS,MAAA;AACtE,EAAA,OAAO;AAAA,IACL,UAAA,EAAY,GAAA;AAAA,IACZ,UAAA;AAAA,IACA,GAAI,YAAY,MAAA,GACZ;AAAA,MACE,OAAA,EAAS;AAAA,QACP,GAAG,UAAA,CAAW,OAAA,CAAQ,IAAA,EAAM,KAAK,MAAM,CAAA;AAAA,QACvC,MAAA,EAAQ,GAAA;AAAA,QACR,MAAA,EAAQ,gBAAA,CAAiB,MAAA,EAAQ,OAAA,CAAQ,MAAM,CAAA;AAAA,QAC/C,GAAI,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,KAAW;AAAC;AAC3C,QAEF;AAAC,GACP;AACF;AAGO,SAAS,cAAc,UAAA,EAA0D;AACtF,EAAA,IAAI,OAAO,UAAA,KAAe,QAAA,EAAU,OAAO,MAAA;AAC3C,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAmB,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAA,CAAK,YAAY,WAAW,CAAA,CAAE,QAAA,CAAS,MAAM,CAAC,CAAA;AACzF,IAAA,OAAO,QAAA,CAAS,OAAO,CAAA,GAAI,OAAA,GAAU,KAAA,CAAA;AAAA,EACvC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF","file":"chunk-5ZYXBCDX.js","sourcesContent":["/**\n * Map MPP payment errors to the Problem Details types in\n * `draft-httpauth-payment-01`. This module has no optional peer imports, so\n * the main HTTP route can use it.\n */\n\nexport const MPP_PROBLEM_BASE_URI = 'https://paymentauth.org/problems/';\n\nexport type MppProblemType =\n  | 'payment-required'\n  | 'malformed-credential'\n  | 'invalid-challenge'\n  | 'payment-expired'\n  | 'verification-failed'\n  | 'internal-payment-error';\n\nconst TITLES: Readonly<Record<MppProblemType, string>> = {\n  'payment-required': 'Payment Required',\n  'malformed-credential': 'Malformed Credential',\n  'invalid-challenge': 'Invalid Challenge',\n  'payment-expired': 'Payment Expired',\n  'verification-failed': 'Verification Failed',\n  'internal-payment-error': 'Internal Payment Error',\n};\n\n// Map known MPP refusal reasons to problem types; other reasons use\n// `verification-failed`. A Map keeps facilitator text out of Object.prototype\nconst REASON_TYPES: ReadonlyMap<string, MppProblemType> = new Map([\n  ['malformed_credential', 'malformed-credential'],\n  ['invalid_payload', 'malformed-credential'],\n  ['invalid_challenge', 'invalid-challenge'],\n  ['challenge_not_issued', 'invalid-challenge'],\n  ['wrong_realm', 'invalid-challenge'],\n  ['wrong_resource', 'invalid-challenge'],\n  ['challenge_already_used', 'invalid-challenge'],\n  ['challenge_expired', 'payment-expired'],\n  ['authorization_expired', 'payment-expired'],\n]);\n\n/** The Problem Details `type` URI and `title` for an MPP payment error */\nexport function mppProblem(\n  code: string,\n  httpStatus: number,\n  reason?: string,\n): { readonly type: string; readonly title: string } {\n  const problem = problemType(code, httpStatus, reason);\n  return { type: `${MPP_PROBLEM_BASE_URI}${problem}`, title: TITLES[problem] };\n}\n\n// Descriptions for MPP reasons and two x402 facilitator refusals\nconst REASON_DETAILS: ReadonlyMap<string, string> = new Map([\n  ['wrong_provider', 'The challenge was issued for another payment method.'],\n  ['missing_challenge', 'No challenge is available for this request.'],\n  ['malformed_credential', 'The credential could not be decoded.'],\n  ['invalid_payload', 'The credential payload does not match the expected format.'],\n  ['invalid_challenge', 'The credential does not answer a valid challenge.'],\n  ['challenge_not_issued', 'The challenge was not issued by this server or was altered.'],\n  ['challenge_already_used', 'The challenge has already been used for a payment.'],\n  ['challenge_expired', 'The challenge has expired.'],\n  ['wrong_realm', 'The challenge was issued for another realm.'],\n  ['wrong_resource', 'The challenge was issued for another resource.'],\n  [\n    'unsupported_method',\n    'The challenge names a payment method or intent this server does not accept.',\n  ],\n  ['unsupported_credential', 'The credential type is not accepted for this challenge.'],\n  ['body_digest_mismatch', 'The request body differs from the one the challenge was issued for.'],\n  ['wrong_amount', 'The payment amount does not match the challenge.'],\n  ['wrong_recipient', 'The payment recipient does not match the challenge.'],\n  ['wrong_network', 'The payment uses a different network from the challenge.'],\n  ['wrong_asset', 'The payment uses a different asset from the challenge.'],\n  ['wrong_terms', 'The payment terms do not match the challenge.'],\n  ['wrong_nonce', 'The authorization nonce is not derived from the challenge.'],\n  ['invalid_signature', 'The authorization signature does not match the payer.'],\n  ['source_mismatch', 'The credential source is not the account that signed the authorization.'],\n  ['authorization_not_yet_valid', 'The authorization is not valid yet.'],\n  ['authorization_expired', 'The authorization has expired.'],\n  ['authorization_invalid', 'The authorization failed verification.'],\n  ['settlement_rejected', 'The payment was refused before settlement.'],\n  ['settlement_mismatch', 'The payment could not be matched to its settlement.'],\n  ['invalid_exact_evm_insufficient_balance', 'The payer balance is too low for this payment.'],\n  [\n    'invalid_exact_evm_transaction_simulation_failed',\n    'The transfer failed in simulation, so it was not submitted.',\n  ],\n]);\n\n/** Return a sentence for a known reason, or quote an unknown reason */\nexport function mppProblemDetail(reason: string | undefined, fallback: string): string {\n  if (reason === undefined) return fallback;\n  return REASON_DETAILS.get(reason) ?? `The payment was refused: ${reason}.`;\n}\n\nfunction problemType(code: string, httpStatus: number, reason?: string): MppProblemType {\n  if (code === 'PAYMENT_REQUIRED') return 'payment-required';\n  if (httpStatus >= 500) return 'internal-payment-error';\n  // A replayed credential reuses its challenge because the replay key\n  // includes the challenge-derived nonce\n  if (code === 'PAYMENT_REPLAYED') return 'invalid-challenge';\n  return (reason !== undefined ? REASON_TYPES.get(reason) : undefined) ?? 'verification-failed';\n}\n","/**\n * Build MPP MCP metadata accepted by the `mppx` client. This module has no\n * optional peer imports, so the `./mcp` subpath can use it.\n */\n\nimport { createHash } from 'node:crypto';\nimport { isRecord } from '../../core/is-record';\nimport { mppProblem, mppProblemDetail } from './problems';\n\n/**\n * `CanonicalRequest.metadata` key for the digest of an HTTP request body. The\n * MPP provider binds it into the challenge when present, so a credential\n * cannot pay for a different body.\n */\nexport const CONTENT_DIGEST_METADATA_KEY = 'contentDigest';\n\n/** RFC 9530 `sha-256` digest of a request body, the form of the MPP `digest` parameter */\nexport function contentDigest(body: Uint8Array): string {\n  return `sha-256=:${createHash('sha256').update(body).digest('base64')}:`;\n}\n\n/** MCP `_meta` key of a tool call's credential object */\nexport const MPP_MCP_CREDENTIAL_META_KEY = 'org.paymentauth/credential';\n\n/** MCP `_meta` key of a tool result's challenges */\nexport const MPP_MCP_PAYMENT_REQUIRED_META_KEY = 'org.paymentauth/payment-required';\n\n/** MCP `_meta` key of a paid tool result's receipt object */\nexport const MPP_MCP_RECEIPT_META_KEY = 'org.paymentauth/receipt';\n\n/**\n * Build payment-required metadata from the provider's challenge objects.\n * Return undefined if the envelope has none. The draft uses JSON-RPC error\n * -32042; this gateway puts the data in a tool result's `_meta`, which\n * `mppx` also reads. A refusal adds its Problem Details, with the provider's\n * reason token in the `reason` member.\n */\nexport function mcpPaymentRequired(\n  envelope: unknown,\n  refusal?: { readonly code: string; readonly reason?: unknown; readonly detail: string },\n): Record<string, unknown> | undefined {\n  const challenges = isRecord(envelope) ? envelope['challenges'] : undefined;\n  if (!Array.isArray(challenges) || challenges.length === 0) return undefined;\n  const reason = typeof refusal?.reason === 'string' ? refusal.reason : undefined;\n  return {\n    httpStatus: 402,\n    challenges,\n    ...(refusal !== undefined\n      ? {\n          problem: {\n            ...mppProblem(refusal.code, 402, reason),\n            status: 402,\n            detail: mppProblemDetail(reason, refusal.detail),\n            ...(reason !== undefined ? { reason } : {}),\n          },\n        }\n      : {}),\n  };\n}\n\n/** The receipt object from a serialized `Payment-Receipt` value, base64url JSON */\nexport function receiptObject(serialized: unknown): Record<string, unknown> | undefined {\n  if (typeof serialized !== 'string') return undefined;\n  try {\n    const decoded: unknown = JSON.parse(Buffer.from(serialized, 'base64url').toString('utf8'));\n    return isRecord(decoded) ? decoded : undefined;\n  } catch {\n    return undefined;\n  }\n}\n"]}

package/dist/{chunk-3LUJHVKX.js → chunk-6Z2H53CG.js}

@@ -15,13 +15,14 @@ var MPP_PROFILE = {
   assetSymbol: "USDC",
   assetDecimals: 6
 };
-var MPP_NETWORKS = ["eip155:84532", "eip155:8453"];
+var MPP_NETWORKS = ["eip155:31337", "eip155:84532", "eip155:8453"];
 var MPP_DEFAULT_NETWORK = "eip155:84532";
+var MPP_DEFAULT_PAYMENT_FLOW = "upfront";
 function isMppNetwork(value) {
   return MPP_NETWORKS.includes(value);
 }
 var MPP_SUPPORTED_SPEC = `mpp/${MPP_SPEC_DRAFTS.core} intent=${MPP_PROFILE.intent} method=${MPP_PROFILE.method}`;
 
-export { MPPX_VERSION, MPP_DEFAULT_NETWORK, MPP_MIN_CHALLENGE_SECRET_LENGTH, MPP_NETWORKS, MPP_PROFILE, MPP_SPEC_COMMIT, MPP_SPEC_DRAFTS, MPP_SPEC_REPOSITORY, MPP_SUPPORTED_SPEC, isMppNetwork };
-//# sourceMappingURL=chunk-3LUJHVKX.js.map
-//# sourceMappingURL=chunk-3LUJHVKX.js.map
+export { MPPX_VERSION, MPP_DEFAULT_NETWORK, MPP_DEFAULT_PAYMENT_FLOW, MPP_MIN_CHALLENGE_SECRET_LENGTH, MPP_NETWORKS, MPP_PROFILE, MPP_SPEC_COMMIT, MPP_SPEC_DRAFTS, MPP_SPEC_REPOSITORY, MPP_SUPPORTED_SPEC, isMppNetwork };
+//# sourceMappingURL=chunk-6Z2H53CG.js.map
+//# sourceMappingURL=chunk-6Z2H53CG.js.map

package/dist/chunk-6Z2H53CG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/payments/mpp/constants.ts"],"names":[],"mappings":";AAYO,IAAM,mBAAA,GAAsB;AAQ5B,IAAM,eAAA,GAAkB;AAGxB,IAAM,eAAA,GAAkB;AAAA,EAC7B,IAAA,EAAM,2BAAA;AAAA,EACN,MAAA,EAAQ,gCAAA;AAAA,EACR,MAAA,EAAQ;AACV;AAMO,IAAM,+BAAA,GAAkC;AAGxC,IAAM,YAAA,GAAe;AAUrB,IAAM,WAAA,GAAc;AAAA,EACzB,MAAA,EAAQ,QAAA;AAAA,EACR,MAAA,EAAQ,KAAA;AAAA,EACR,cAAA,EAAgB,eAAA;AAAA,EAChB,WAAA,EAAa,MAAA;AAAA,EACb,aAAA,EAAe;AACjB;AAGO,IAAM,YAAA,GAAe,CAAC,cAAA,EAAgB,cAAA,EAAgB,aAAa;AAKnE,IAAM,mBAAA,GAAkC;AAOxC,IAAM,wBAAA,GAA4C;AAElD,SAAS,aAAa,KAAA,EAAoC;AAC/D,EAAA,OAAQ,YAAA,CAAmC,SAAS,KAAK,CAAA;AAC3D;AAGO,IAAM,kBAAA,GAAqB,OAAO,eAAA,CAAgB,IAAI,WAAW,WAAA,CAAY,MAAM,CAAA,QAAA,EAAW,WAAA,CAAY,MAAM,CAAA","file":"chunk-6Z2H53CG.js","sourcesContent":["/**\n * The one MPP profile this rail targets.\n *\n * MPP combines a core HTTP authentication layer, an intent, a method and\n * optional extensions. These constants identify the selected combination and\n * the exact specification revision.\n *\n * Importing this metadata does not load `mppx`.\n */\nimport type { X402PaymentFlow } from '../x402/payment-flow';\n\n/** Upstream specification repository the pinned drafts were read from */\nexport const MPP_SPEC_REPOSITORY = 'https://github.com/tempoxyz/mpp-specs';\n\n/**\n * Upstream commit the pinned drafts were read at.\n *\n * A draft's content can change without its `-00` name changing, so the name\n * alone does not identify a document; the commit does.\n */\nexport const MPP_SPEC_COMMIT = '806fdb8b8c92cda5c84b8660558921b6bbeef7e0';\n\n/** The core HTTP authentication draft, the `charge` intent, and its EVM method */\nexport const MPP_SPEC_DRAFTS = {\n  core: 'draft-httpauth-payment-01',\n  intent: 'draft-payment-intent-charge-00',\n  method: 'draft-evm-charge-00',\n} as const;\n\n/**\n * Minimum accepted `challengeSecret.length`. This is a configuration floor,\n * not an entropy check.\n */\nexport const MPP_MIN_CHALLENGE_SECRET_LENGTH = 32;\n\n/** Exact `mppx` release the rail is pinned to */\nexport const MPPX_VERSION = '0.13.1';\n\n/**\n * The pinned profile.\n *\n * `intent`, `method` and `credentialType` copy MPP wire identifiers from\n * `mppx` so this module has no peer import; tests detect drift. `assetSymbol`\n * is the pricing currency an MPP resource must use. EVM charge requests carry a\n * numeric `chainId` and token address instead.\n */\nexport const MPP_PROFILE = {\n  intent: 'charge',\n  method: 'evm',\n  credentialType: 'authorization',\n  assetSymbol: 'USDC',\n  assetDecimals: 6,\n} as const;\n\n/** Supported CAIP-2 networks; gateway config applies the x402 mainnet guardrails */\nexport const MPP_NETWORKS = ['eip155:31337', 'eip155:84532', 'eip155:8453'] as const;\n\nexport type MppNetwork = (typeof MPP_NETWORKS)[number];\n\n/** Default network: Base Sepolia. The local Anvil chain is `eip155:31337` */\nexport const MPP_DEFAULT_NETWORK: MppNetwork = 'eip155:84532';\n\n/**\n * Default payment flow: `upfront` settles before the backend runs. The\n * `charge` intent counts a backend call made before verification completes as\n * partial access, and EVM charge verification includes the transfer itself.\n */\nexport const MPP_DEFAULT_PAYMENT_FLOW: X402PaymentFlow = 'upfront';\n\nexport function isMppNetwork(value: string): value is MppNetwork {\n  return (MPP_NETWORKS as readonly string[]).includes(value);\n}\n\n/** Compact descriptor value naming the core draft, intent and method */\nexport const MPP_SUPPORTED_SPEC = `mpp/${MPP_SPEC_DRAFTS.core} intent=${MPP_PROFILE.intent} method=${MPP_PROFILE.method}`;\n"]}

package/dist/{chunk-HOZA3IWP.js → chunk-ES3V6ECS.js}

@@ -1,4 +1,4 @@
-import { isRecord } from './chunk-53WXXIPR.js';
+import { isRecord } from './chunk-2CJNA7MS.js';
 import { timingSafeEqual, createHash } from 'crypto';
 
 // src/protocols/mcp/constants.ts
@@ -48,10 +48,20 @@ function x402McpPaymentSubmission(value) {
   return Buffer.from(JSON.stringify(value), "utf8").toString("base64");
 }
 var X402_MCP_PAYMENT_RESPONSE_META_KEY = "x402/payment-response";
-function x402ErrorCode(code, reason) {
-  if (code === "PAYMENT_REPLAYED") return "invalid_exact_evm_nonce_already_used";
+var REPLAY_CODES = {
+  near: "invalid_exact_near_payload_delegate_action_nonce_already_used",
+  solana: "duplicate_settlement"
+};
+function x402ErrorCode(code, reason, network) {
+  if (code === "PAYMENT_REPLAYED") {
+    const namespace = typeof network === "string" ? network.split(":")[0] : void 0;
+    return (namespace !== void 0 ? REPLAY_CODES[namespace] : void 0) ?? "invalid_exact_evm_nonce_already_used";
+  }
   return typeof reason === "string" ? reason : "unexpected_verify_error";
 }
+function x402RefusalStatus(code, httpStatus, reason) {
+  return code === "PAYMENT_INVALID" && reason === "permit2_allowance_required" ? 412 : httpStatus;
+}
 function settlementDocument(payment) {
   return {
     success: payment.status === "settled",
@@ -110,6 +120,6 @@ function settlementFailure(details) {
   };
 }
 
-export { MCP_MODERN_PROTOCOL_REVISION, MCP_TOOL_NAME_PATTERN, X402_MCP_ERROR_META_KEY, X402_MCP_PAYMENT_META_KEY, X402_MCP_PAYMENT_RESPONSE_META_KEY, createBearerCheck, joinUrl, readCappedBody, settlementFailure, settlementResponse, settlementResponseFromDetails, x402ErrorCode, x402McpPaymentSubmission };
-//# sourceMappingURL=chunk-HOZA3IWP.js.map
-//# sourceMappingURL=chunk-HOZA3IWP.js.map
+export { MCP_MODERN_PROTOCOL_REVISION, MCP_TOOL_NAME_PATTERN, X402_MCP_ERROR_META_KEY, X402_MCP_PAYMENT_META_KEY, X402_MCP_PAYMENT_RESPONSE_META_KEY, createBearerCheck, joinUrl, readCappedBody, settlementFailure, settlementResponse, settlementResponseFromDetails, x402ErrorCode, x402McpPaymentSubmission, x402RefusalStatus };
+//# sourceMappingURL=chunk-ES3V6ECS.js.map
+//# sourceMappingURL=chunk-ES3V6ECS.js.map

package/dist/chunk-ES3V6ECS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/protocols/mcp/constants.ts","../src/protocols/http.ts","../src/payments/x402/transport.ts"],"names":[],"mappings":";;;;AAUO,IAAM,mBAAA,GAAsB,cAAA;AAG5B,IAAM,wBAAA,GAA2B,GAAA;AAQjC,IAAM,wBAAwB,IAAI,MAAA;AAAA,EACvC,CAAA,EAAA,EAAK,mBAAmB,CAAA,IAAA,EAAO,wBAAwB,CAAA,EAAA;AACzD;AAMO,IAAM,4BAAA,GAA+B;ACzB5C,IAAM,aAAA,GAAgB,YAAA;AAQf,SAAS,kBAAkB,aAAA,EAAgE;AAChG,EAAA,MAAM,QAAA,GAAW,OAAO,aAAa,CAAA;AACrC,EAAA,OAAO,CAAC,MAAA,KAAW;AACjB,IAAA,IAAI,WAAW,MAAA,IAAa,CAAC,cAAc,IAAA,CAAK,MAAM,GAAG,OAAO,KAAA;AAChE,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,OAAA,CAAQ,aAAA,EAAe,EAAE,CAAA;AAClD,IAAA,OAAO,UAAU,MAAA,GAAS,CAAA,IAAK,gBAAgB,MAAA,CAAO,SAAS,GAAG,QAAQ,CAAA;AAAA,EAC5E,CAAA;AACF;AAEA,SAAS,OAAO,KAAA,EAAuB;AACrC,EAAA,OAAO,WAAW,QAAQ,CAAA,CAAE,OAAO,KAAA,EAAO,MAAM,EAAE,MAAA,EAAO;AAC3D;AAYA,eAAsB,cAAA,CAAe,KAAsB,QAAA,EAAqC;AAC9F,EAAA,MAAM,SAAmB,EAAC;AAC1B,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,IAAI;AACF,IAAA,WAAA,MAAiB,SAAS,GAAA,EAAK;AAC7B,MAAA,MAAM,MAAA,GAAS,KAAA;AACf,MAAA,KAAA,IAAS,MAAA,CAAO,MAAA;AAChB,MAAA,IAAI,KAAA,GAAQ,QAAA,EAAU,OAAO,EAAE,MAAM,WAAA,EAAY;AACjD,MAAA,MAAA,CAAO,KAAK,MAAM,CAAA;AAAA,IACpB;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,MAAM,YAAA,EAAa;AAAA,EAC9B;AACA,EAAA,OAAO,EAAE,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,MAAA,CAAO,OAAO,MAAM,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA,EAAE;AACpE;AAOO,SAAS,OAAA,CAAQ,SAAiB,SAAA,EAA2B;AAClE,EAAA,OAAO,CAAA,EAAG,OAAA,CAAQ,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAC,CAAA,CAAA,EAAI,SAAA,CAAU,OAAA,CAAQ,YAAA,EAAc,EAAE,CAAC,CAAA,CAAA;AAC9E;;;ACjDO,IAAM,yBAAA,GAA4B;AAGlC,IAAM,uBAAA,GAA0B;AAOhC,SAAS,yBAAyB,KAAA,EAAoC;AAC3E,EAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,EAAM,OAAO,MAAA;AAClD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,KAAA;AACtC,EAAA,OAAO,MAAA,CAAO,KAAK,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,EAAG,MAAM,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AACrE;AAGO,IAAM,kCAAA,GAAqC;AAKlD,IAAM,YAAA,GAAiD;AAAA,EACrD,IAAA,EAAM,+DAAA;AAAA,EACN,MAAA,EAAQ;AACV,CAAA;AAMO,SAAS,aAAA,CAAc,IAAA,EAAc,MAAA,EAAiB,OAAA,EAA2B;AACtF,EAAA,IAAI,SAAS,kBAAA,EAAoB;AAC/B,IAAA,MAAM,SAAA,GAAY,OAAO,OAAA,KAAY,QAAA,GAAW,QAAQ,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,GAAI,MAAA;AACxE,IAAA,OAAA,CACG,SAAA,KAAc,MAAA,GAAY,YAAA,CAAa,SAAS,IAAI,MAAA,KACrD,sCAAA;AAAA,EAEJ;AACA,EAAA,OAAO,OAAO,MAAA,KAAW,QAAA,GAAW,MAAA,GAAS,yBAAA;AAC/C;AAMO,SAAS,iBAAA,CAAkB,IAAA,EAAc,UAAA,EAAoB,MAAA,EAAyB;AAC3F,EAAA,OAAO,IAAA,KAAS,iBAAA,IAAqB,MAAA,KAAW,4BAAA,GAA+B,GAAA,GAAM,UAAA;AACvF;AAeA,SAAS,mBAAmB,OAAA,EAAkD;AAC5E,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,QAAQ,MAAA,KAAW,SAAA;AAAA,IAC5B,WAAA,EAAa,QAAQ,iBAAA,IAAqB,EAAA;AAAA,IAC1C,OAAA,EAAS,QAAQ,OAAA,IAAW,EAAA;AAAA,IAC5B,GAAI,QAAQ,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAM,GAAI,EAAC;AAAA,IAC9D,GAAI,QAAQ,eAAA,KAAoB,MAAA,GAAY,EAAE,MAAA,EAAQ,OAAA,CAAQ,eAAA,EAAgB,GAAI,EAAC;AAAA,IACnF,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,GAAI,QAAQ,iBAAA,KAAsB,MAAA,GAC9B,EAAE,iBAAA,EAAmB,OAAA,CAAQ,iBAAA,EAAkB,GAC/C;AAAC,GACP;AACF;AAGO,SAAS,mBAAmB,OAAA,EAAiD;AAClF,EAAA,MAAM,eAAA,GAAkB,OAAA,CAAQ,QAAA,GAAW,iBAAiB,CAAA;AAC5D,EAAA,OAAO,kBAAA,CAAmB;AAAA,IACxB,GAAG,OAAA;AAAA,IACH,GAAI,OAAO,eAAA,KAAoB,WAAW,EAAE,eAAA,KAAoB;AAAC,GAClE,CAAA;AACH;AAMO,SAAS,8BACd,OAAA,EACqC;AACrC,EAAA,MAAM,OAAA,GAAU,UAAU,SAAS,CAAA;AACnC,EAAA,IAAI,CAAC,QAAA,CAAS,OAAO,CAAA,EAAG,OAAO,MAAA;AAC/B,EAAA,MAAM,IAAA,GAAO,CAAC,GAAA,KACZ,OAAO,OAAA,CAAQ,GAAG,CAAA,KAAM,QAAA,GAAW,OAAA,CAAQ,GAAG,CAAA,GAAI,MAAA;AACpD,EAAA,MAAM,MAAA,GAAS,KAAK,QAAQ,CAAA;AAC5B,EAAA,MAAM,QAAA,GAAW,KAAK,UAAU,CAAA;AAChC,EAAA,MAAM,QAAA,GAAW,KAAK,UAAU,CAAA;AAChC,EAAA,IAAI,WAAW,MAAA,IAAa,QAAA,KAAa,MAAA,IAAa,QAAA,KAAa,QAAW,OAAO,MAAA;AACrF,EAAA,OAAO,kBAAA,CAAmB;AAAA,IACxB,MAAA;AAAA,IACA,QAAA;AAAA,IACA,QAAA;AAAA,IACA,OAAA,EAAS,KAAK,SAAS,CAAA;AAAA,IACvB,iBAAA,EAAmB,KAAK,mBAAmB,CAAA;AAAA,IAC3C,KAAA,EAAO,KAAK,OAAO,CAAA;AAAA,IACnB,eAAA,EAAiB,KAAK,iBAAiB;AAAA,GACxC,CAAA;AACH;AAMO,SAAS,kBACd,OAAA,EACyB;AACzB,EAAA,MAAM,IAAA,GAAO,CAAC,GAAA,KAAoC;AAChD,IAAA,MAAM,KAAA,GAAQ,UAAU,GAAG,CAAA;AAC3B,IAAA,OAAO,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,MAAA;AAAA,EAC7C,CAAA;AACA,EAAA,MAAM,WAAA,GAAc,KAAK,iBAAiB,CAAA;AAC1C,EAAA,MAAM,KAAA,GAAQ,KAAK,OAAO,CAAA;AAC1B,EAAA,IAAI,WAAA,GAAc,IAAA,CAAK,QAAQ,CAAA,IAAK,yBAAA;AACpC,EAAA,IAAI,OAAA,GAAU,qBAAqB,CAAA,KAAM,IAAA,EAAM;AAC7C,IAAA,WAAA,GAAc,WAAA,KAAgB,SAAY,oBAAA,GAAuB,yBAAA;AAAA,EACnE;AACA,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,KAAA;AAAA,IACT,WAAA;AAAA,IACA,aAAa,WAAA,IAAe,EAAA;AAAA,IAC5B,OAAA,EAAS,IAAA,CAAK,SAAS,CAAA,IAAK,EAAA;AAAA,IAC5B,GAAI,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,KAAU;AAAC,GACzC;AACF","file":"chunk-ES3V6ECS.js","sourcesContent":["/**\n * MCP protocol constants shared by the config layer, the adapter and the\n * OpenAPI importer.\n *\n * Kept dependency-free: `src/config` validates tool names at load time, so\n * anything imported here would become a config-load dependency too, and the\n * MCP SDK is an optional peer the main entry and CLI must never load.\n */\n\n/** Characters SEP-986 allows in an MCP tool name, as a regex character class body */\nexport const MCP_TOOL_NAME_CHARS = 'A-Za-z0-9._-';\n\n/** Longest MCP tool name SEP-986 allows */\nexport const MCP_TOOL_NAME_MAX_LENGTH = 128;\n\n/**\n * MCP tool names per SEP-986: 1-128 chars of [A-Za-z0-9._-], the SDK's own\n * `TOOL_NAME_REGEX`, which it does not export. Config refuses an mcp-exposed\n * resource whose id fails it; the low-level `Server` checks no names, so the\n * adapter also skips such an id with a warning.\n */\nexport const MCP_TOOL_NAME_PATTERN = new RegExp(\n  `^[${MCP_TOOL_NAME_CHARS}]{1,${MCP_TOOL_NAME_MAX_LENGTH}}$`,\n);\n\n/**\n * The modern revision served by the SDK. A v2 client negotiates this value\n * in the conformance test.\n */\nexport const MCP_MODERN_PROTOCOL_REVISION = '2026-07-28';\n","// HTTP helpers shared by the A2A and ACP adapters and the gateway's admin-token gate\nimport { createHash, timingSafeEqual } from 'node:crypto';\nimport type { IncomingMessage } from 'node:http';\n\nconst BEARER_PREFIX = /^Bearer +/i;\n\n/**\n * Builds a check of an `Authorization: Bearer <token>` header against a fixed\n * token. The scheme is case-insensitive (RFC 9110). Both sides are compared as\n * SHA-256 digests, because `timingSafeEqual` throws on a length mismatch and\n * would reveal the token's length; the expected digest is computed once here.\n */\nexport function createBearerCheck(expectedToken: string): (header: string | undefined) => boolean {\n  const expected = sha256(expectedToken);\n  return (header) => {\n    if (header === undefined || !BEARER_PREFIX.test(header)) return false;\n    const presented = header.replace(BEARER_PREFIX, '');\n    return presented.length > 0 && timingSafeEqual(sha256(presented), expected);\n  };\n}\n\nfunction sha256(value: string): Buffer {\n  return createHash('sha256').update(value, 'utf8').digest();\n}\n\n/** A tagged result, so no body text can be mistaken for a failure */\nexport type BodyRead =\n  | { readonly kind: 'ok'; readonly text: string }\n  | { readonly kind: 'too-large' }\n  | { readonly kind: 'unreadable' };\n\n/**\n * Reads the unconsumed request stream the gateway hands an adapter, stopping\n * at the cap rather than buffering whatever arrives\n */\nexport async function readCappedBody(req: IncomingMessage, maxBytes: number): Promise<BodyRead> {\n  const chunks: Buffer[] = [];\n  let total = 0;\n  try {\n    for await (const chunk of req) {\n      const buffer = chunk as Buffer;\n      total += buffer.length;\n      if (total > maxBytes) return { kind: 'too-large' };\n      chunks.push(buffer);\n    }\n  } catch {\n    return { kind: 'unreadable' };\n  }\n  return { kind: 'ok', text: Buffer.concat(chunks).toString('utf8') };\n}\n\n/**\n * Joins a base URL and a mount path with exactly one slash between them and\n * none at the end. Plain concatenation can yield `https://host//a2a`, which a\n * router may treat as a different path.\n */\nexport function joinUrl(baseUrl: string, mountPath: string): string {\n  return `${baseUrl.replace(/\\/+$/, '')}/${mountPath.replace(/^\\/+|\\/+$/g, '')}`;\n}\n","/**\n * Build x402 v2 responses for the HTTP route and MCP adapter. This module\n * has no optional peer imports, so both entries can use it.\n */\n\nimport type { PaymentResult } from '../../core';\nimport { isRecord } from '../../core/is-record';\n\n/** MCP `_meta` key of a tool call's `PaymentPayload` (x402 MCP transport) */\nexport const X402_MCP_PAYMENT_META_KEY = 'x402/payment';\n\n/** Challenge key read by the `cloudflare/agents` x402 MCP client */\nexport const X402_MCP_ERROR_META_KEY = 'x402/error';\n\n/**\n * Accept an object or base64 string from `x402/payment` and return the string\n * the provider decodes. An absent value returns undefined; other JSON\n * values are encoded for provider validation.\n */\nexport function x402McpPaymentSubmission(value: unknown): string | undefined {\n  if (value === undefined || value === null) return undefined;\n  if (typeof value === 'string') return value;\n  return Buffer.from(JSON.stringify(value), 'utf8').toString('base64');\n}\n\n/** MCP `_meta` key of a tool result's settlement response (x402 MCP transport) */\nexport const X402_MCP_PAYMENT_RESPONSE_META_KEY = 'x402/payment-response';\n\n// The code an SDK facilitator gives a spent authorization, by CAIP-2 namespace.\n// The Solana scheme has none; its specification refuses a payload being\n// settled again as `duplicate_settlement`.\nconst REPLAY_CODES: Readonly<Record<string, string>> = {\n  near: 'invalid_exact_near_payload_delegate_action_nonce_already_used',\n  solana: 'duplicate_settlement',\n};\n\n/**\n * Returns the provider's refusal reason, or the paid network family's replay\n * code. Unknown networks use EVM's replay code.\n */\nexport function x402ErrorCode(code: string, reason: unknown, network?: unknown): string {\n  if (code === 'PAYMENT_REPLAYED') {\n    const namespace = typeof network === 'string' ? network.split(':')[0] : undefined;\n    return (\n      (namespace !== undefined ? REPLAY_CODES[namespace] : undefined) ??\n      'invalid_exact_evm_nonce_already_used'\n    );\n  }\n  return typeof reason === 'string' ? reason : 'unexpected_verify_error';\n}\n\n/**\n * Returns 412 Precondition Failed for a missing Permit2 allowance: the buyer\n * must approve Permit2 before retrying. Other refusals keep their status.\n */\nexport function x402RefusalStatus(code: string, httpStatus: number, reason: unknown): number {\n  return code === 'PAYMENT_INVALID' && reason === 'permit2_allowance_required' ? 412 : httpStatus;\n}\n\ninterface SettledPayment {\n  readonly status: string;\n  readonly provider: string;\n  readonly currency: string;\n  readonly network?: string | undefined;\n  readonly externalReference?: string | undefined;\n  readonly payer?: string | undefined;\n  readonly amountBaseUnits?: string | undefined;\n}\n\n// The `SettleResponse` shape. When present, `amount` uses base units.\n// `status`, `provider`, `currency`, and `externalReference` are gateway\n// extensions; an x402 v2 client ignores fields it does not know.\nfunction settlementDocument(payment: SettledPayment): Record<string, unknown> {\n  return {\n    success: payment.status === 'settled',\n    transaction: payment.externalReference ?? '',\n    network: payment.network ?? '',\n    ...(payment.payer !== undefined ? { payer: payment.payer } : {}),\n    ...(payment.amountBaseUnits !== undefined ? { amount: payment.amountBaseUnits } : {}),\n    status: payment.status,\n    provider: payment.provider,\n    currency: payment.currency,\n    ...(payment.externalReference !== undefined\n      ? { externalReference: payment.externalReference }\n      : {}),\n  };\n}\n\n/** A delivered payment's settlement response */\nexport function settlementResponse(payment: PaymentResult): Record<string, unknown> {\n  const amountBaseUnits = payment.metadata?.['amountBaseUnits'];\n  return settlementDocument({\n    ...payment,\n    ...(typeof amountBaseUnits === 'string' ? { amountBaseUnits } : {}),\n  });\n}\n\n/**\n * The settlement response for a backend failure after settlement, from the\n * error's `details.payment`; undefined when the error carries none\n */\nexport function settlementResponseFromDetails(\n  details: Readonly<Record<string, unknown>> | undefined,\n): Record<string, unknown> | undefined {\n  const payment = details?.['payment'];\n  if (!isRecord(payment)) return undefined;\n  const text = (key: string): string | undefined =>\n    typeof payment[key] === 'string' ? payment[key] : undefined;\n  const status = text('status');\n  const provider = text('provider');\n  const currency = text('currency');\n  if (status === undefined || provider === undefined || currency === undefined) return undefined;\n  return settlementDocument({\n    status,\n    provider,\n    currency,\n    network: text('network'),\n    externalReference: text('externalReference'),\n    payer: text('payer'),\n    amountBaseUnits: text('amountBaseUnits'),\n  });\n}\n\n/**\n * A refused or unconfirmed settlement as a failed `SettleResponse`. An\n * unconfirmed transfer with a hash uses x402's `settlement_pending` reason.\n */\nexport function settlementFailure(\n  details: Readonly<Record<string, unknown>> | undefined,\n): Record<string, unknown> {\n  const text = (key: string): string | undefined => {\n    const value = details?.[key];\n    return typeof value === 'string' ? value : undefined;\n  };\n  const transaction = text('transactionHash');\n  const payer = text('payer');\n  let errorReason = text('reason') ?? 'unexpected_settle_error';\n  if (details?.['settlementUncertain'] === true) {\n    errorReason = transaction !== undefined ? 'settlement_pending' : 'unexpected_settle_error';\n  }\n  return {\n    success: false,\n    errorReason,\n    transaction: transaction ?? '',\n    network: text('network') ?? '',\n    ...(payer !== undefined ? { payer } : {}),\n  };\n}\n"]}