@kya-os/mcp-i-core 1.1.0 → 1.1.1-canary.1

package/dist/delegation/bitstring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bitstring.d.ts","sourceRoot":"","sources":["../../src/delegation/bitstring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACjD;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACnD;AAED;;;;;GAKG;AACH,qBAAa,gBAAgB;IAMzB,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,YAAY;IANtB,OAAO,CAAC,IAAI,CAAa;IACzB,OAAO,CAAC,IAAI,CAAS;gBAGnB,IAAI,EAAE,MAAM,EACJ,UAAU,EAAE,mBAAmB,EAC/B,YAAY,EAAE,qBAAqB;IAQ7C;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAiB3C;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAW9B;;;;OAIG;IACH,UAAU,IAAI,MAAM,EAAE;IAUtB;;;;;;;;OAQG;IACG,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAQ/B;;;;;OAKG;WACU,MAAM,CACjB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,mBAAmB,EAC/B,YAAY,EAAE,qBAAqB,GAClC,OAAO,CAAC,gBAAgB,CAAC;IAc5B;;OAEG;IACH,UAAU,IAAI,UAAU;IAIxB;;OAEG;IACH,OAAO,IAAI,MAAM;IAIjB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAQvB;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,eAAe;IAa9B;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAOrB;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,aAAa;IAS5B;;;;;;;;OAQG;IACH,MAAM,CAAC,WAAW,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EAAE,EACjB,UAAU,EAAE,mBAAmB,EAC/B,YAAY,EAAE,qBAAqB,GAClC,gBAAgB;CAOpB;AAED;;;;;;;;;GASG;AACH,wBAAsB,UAAU,CAC9B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,qBAAqB,GAClC,OAAO,CAAC,OAAO,CAAC,CAalB"}

package/dist/delegation/bitstring.js

@@ -0,0 +1,213 @@
+"use strict";
+/**
+ * Bitstring Utilities for StatusList2021
+ *
+ * Implements GZIP compression + base64url encoding for efficient status lists.
+ * Per W3C StatusList2021 spec, each bit represents credential status:
+ * - 0: Not revoked/suspended
+ * - 1: Revoked/suspended
+ *
+ * Related Spec: W3C StatusList2021
+ * Python Reference: Delegation-Revocation.md
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BitstringManager = void 0;
+exports.isIndexSet = isIndexSet;
+/**
+ * Bitstring encoder/decoder
+ *
+ * Manages a bitstring for credential status tracking.
+ * Platform-agnostic - requires compression functions to be injected.
+ */
+class BitstringManager {
+    compressor;
+    decompressor;
+    bits;
+    size;
+    constructor(size, compressor, decompressor) {
+        this.compressor = compressor;
+        this.decompressor = decompressor;
+        this.size = size;
+        // Allocate bytes (8 bits per byte)
+        const byteCount = Math.ceil(size / 8);
+        this.bits = new Uint8Array(byteCount);
+    }
+    /**
+     * Set a bit at a specific index
+     *
+     * @param index - The bit index (0-based)
+     * @param value - true to set (revoked), false to clear (active)
+     */
+    setBit(index, value) {
+        if (index < 0 || index >= this.size) {
+            throw new Error(`Bit index ${index} out of range (0-${this.size - 1})`);
+        }
+        const byteIndex = Math.floor(index / 8);
+        const bitIndex = index % 8;
+        if (value) {
+            // Set bit to 1
+            this.bits[byteIndex] |= 1 << bitIndex;
+        }
+        else {
+            // Clear bit to 0
+            this.bits[byteIndex] &= ~(1 << bitIndex);
+        }
+    }
+    /**
+     * Get a bit at a specific index
+     *
+     * @param index - The bit index (0-based)
+     * @returns true if set (revoked), false if clear (active)
+     */
+    getBit(index) {
+        if (index < 0 || index >= this.size) {
+            throw new Error(`Bit index ${index} out of range (0-${this.size - 1})`);
+        }
+        const byteIndex = Math.floor(index / 8);
+        const bitIndex = index % 8;
+        return (this.bits[byteIndex] & (1 << bitIndex)) !== 0;
+    }
+    /**
+     * Get all set bit indices
+     *
+     * @returns Array of indices where bits are set to 1
+     */
+    getSetBits() {
+        const setBits = [];
+        for (let i = 0; i < this.size; i++) {
+            if (this.getBit(i)) {
+                setBits.push(i);
+            }
+        }
+        return setBits;
+    }
+    /**
+     * Encode bitstring to base64url (GZIP compressed)
+     *
+     * Per StatusList2021 spec:
+     * 1. GZIP compress the bitstring
+     * 2. Base64url encode the compressed data
+     *
+     * @returns Base64url-encoded compressed bitstring
+     */
+    async encode() {
+        // Step 1: GZIP compress
+        const compressed = await this.compressor.compress(this.bits);
+        // Step 2: Base64url encode
+        return this.base64urlEncode(compressed);
+    }
+    /**
+     * Decode base64url bitstring (GZIP compressed)
+     *
+     * @param encodedList - Base64url-encoded compressed bitstring
+     * @returns BitstringManager instance
+     */
+    static async decode(encodedList, compressor, decompressor) {
+        // Step 1: Base64url decode
+        const compressed = BitstringManager.base64urlDecode(encodedList);
+        // Step 2: GZIP decompress
+        const decompressed = await decompressor.decompress(compressed);
+        // Step 3: Create manager with decoded bits
+        const size = decompressed.length * 8;
+        const manager = new BitstringManager(size, compressor, decompressor);
+        manager.bits = decompressed;
+        return manager;
+    }
+    /**
+     * Get the raw bitstring
+     */
+    getRawBits() {
+        return this.bits;
+    }
+    /**
+     * Get the size (number of bits)
+     */
+    getSize() {
+        return this.size;
+    }
+    /**
+     * Base64url encode (RFC 4648)
+     *
+     * Platform-agnostic implementation.
+     */
+    base64urlEncode(data) {
+        // Convert to base64
+        const base64 = this.bytesToBase64(data);
+        // Convert base64 to base64url
+        return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+    }
+    /**
+     * Base64url decode (RFC 4648)
+     */
+    static base64urlDecode(encoded) {
+        // Convert base64url to base64
+        let base64 = encoded.replace(/-/g, '+').replace(/_/g, '/');
+        // Add padding if needed
+        while (base64.length % 4 !== 0) {
+            base64 += '=';
+        }
+        // Convert base64 to bytes
+        return BitstringManager.base64ToBytes(base64);
+    }
+    /**
+     * Convert bytes to base64
+     *
+     * Platform-agnostic implementation (works in Node and browsers/Cloudflare)
+     */
+    bytesToBase64(bytes) {
+        const binary = Array.from(bytes)
+            .map((byte) => String.fromCharCode(byte))
+            .join('');
+        return btoa(binary);
+    }
+    /**
+     * Convert base64 to bytes
+     */
+    static base64ToBytes(base64) {
+        const binary = atob(base64);
+        const bytes = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++) {
+            bytes[i] = binary.charCodeAt(i);
+        }
+        return bytes;
+    }
+    /**
+     * Create a bitstring from a list of indices to set
+     *
+     * @param size - Total size of the bitstring
+     * @param setBits - Indices to set to 1
+     * @param compressor - Compression function
+     * @param decompressor - Decompression function
+     * @returns BitstringManager instance
+     */
+    static fromSetBits(size, setBits, compressor, decompressor) {
+        const manager = new BitstringManager(size, compressor, decompressor);
+        for (const index of setBits) {
+            manager.setBit(index, true);
+        }
+        return manager;
+    }
+}
+exports.BitstringManager = BitstringManager;
+/**
+ * Helper to check if an index is set in an encoded status list
+ *
+ * Convenience function for quick status checks without creating a full manager.
+ *
+ * @param encodedList - Base64url-encoded compressed bitstring
+ * @param index - The bit index to check
+ * @param decompressor - Decompression function
+ * @returns true if bit is set (revoked), false otherwise
+ */
+async function isIndexSet(encodedList, index, decompressor) {
+    // Decode without needing compressor (we're only reading)
+    const compressed = BitstringManager['base64urlDecode'](encodedList);
+    const decompressed = await decompressor.decompress(compressed);
+    const byteIndex = Math.floor(index / 8);
+    const bitIndex = index % 8;
+    if (byteIndex >= decompressed.length) {
+        return false; // Out of range = not set
+    }
+    return (decompressed[byteIndex] & (1 << bitIndex)) !== 0;
+}
+//# sourceMappingURL=bitstring.js.map

package/dist/delegation/bitstring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bitstring.js","sourceRoot":"","sources":["../../src/delegation/bitstring.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AA0PH,gCAiBC;AA1OD;;;;;GAKG;AACH,MAAa,gBAAgB;IAMjB;IACA;IANF,IAAI,CAAa;IACjB,IAAI,CAAS;IAErB,YACE,IAAY,EACJ,UAA+B,EAC/B,YAAmC;QADnC,eAAU,GAAV,UAAU,CAAqB;QAC/B,iBAAY,GAAZ,YAAY,CAAuB;QAE3C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,mCAAmC;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAa,EAAE,KAAc;QAClC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,oBAAoB,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,KAAK,GAAG,CAAC,CAAC;QAE3B,IAAI,KAAK,EAAE,CAAC;YACV,eAAe;YACf,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,iBAAiB;YACjB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAa;QAClB,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,oBAAoB,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,KAAK,GAAG,CAAC,CAAC;QAE3B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC;IAED;;;;OAIG;IACH,UAAU;QACR,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM;QACV,wBAAwB;QACxB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE7D,2BAA2B;QAC3B,OAAO,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,WAAmB,EACnB,UAA+B,EAC/B,YAAmC;QAEnC,2BAA2B;QAC3B,MAAM,UAAU,GAAG,gBAAgB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAEjE,0BAA0B;QAC1B,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAE/D,2CAA2C;QAC3C,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC;QAC5B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACK,eAAe,CAAC,IAAgB;QACtC,oBAAoB;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAExC,8BAA8B;QAC9B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,eAAe,CAAC,OAAe;QAC5C,8BAA8B;QAC9B,IAAI,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAE3D,wBAAwB;QACxB,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,CAAC;QAChB,CAAC;QAED,0BAA0B;QAC1B,OAAO,gBAAgB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAED;;;;OAIG;IACK,aAAa,CAAC,KAAiB;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;aAC7B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;aACxC,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,aAAa,CAAC,MAAc;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,WAAW,CAChB,IAAY,EACZ,OAAiB,EACjB,UAA+B,EAC/B,YAAmC;QAEnC,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;QACrE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAvMD,4CAuMC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,UAAU,CAC9B,WAAmB,EACnB,KAAa,EACb,YAAmC;IAEnC,yDAAyD;IACzD,MAAM,UAAU,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,CAAC,WAAW,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAE/D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,KAAK,GAAG,CAAC,CAAC;IAE3B,IAAI,SAAS,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,CAAC,yBAAyB;IACzC,CAAC;IAED,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC"}

package/dist/delegation/cascading-revocation.d.ts

@@ -0,0 +1,162 @@
+/**
+ * Cascading Revocation Manager
+ *
+ * Implements cascading revocation per Python POC design.
+ * When a parent delegation is revoked, all children are automatically revoked.
+ *
+ * SOLID Principles:
+ * - Single Responsibility: Only handles cascading revocation logic
+ * - Open/Closed: Extensible via hooks/callbacks
+ * - Liskov Substitution: Works with any graph/statuslist implementations
+ * - Interface Segregation: Minimal interface
+ * - Dependency Inversion: Depends on abstractions (graph, statuslist)
+ *
+ * Related Spec: MCP-I §4.4, Delegation Chains
+ * Python Reference: Delegation-Revocation.md:45-67
+ */
+import { DelegationGraphManager } from './delegation-graph';
+import { StatusList2021Manager } from './statuslist-manager';
+/**
+ * Revocation event for auditing/logging
+ */
+export interface RevocationEvent {
+    /** Delegation ID that was revoked */
+    delegationId: string;
+    /** Whether this was the root of the cascade or a child */
+    isRoot: boolean;
+    /** Parent delegation ID (if cascaded) */
+    parentId?: string;
+    /** Timestamp */
+    timestamp: number;
+    /** Reason for revocation */
+    reason?: string;
+}
+/**
+ * Revocation hook function
+ *
+ * Called for each delegation during cascading revocation.
+ * Useful for auditing, logging, or custom logic.
+ */
+export type RevocationHook = (event: RevocationEvent) => Promise<void> | void;
+/**
+ * Options for cascading revocation
+ */
+export interface CascadingRevocationOptions {
+    /** Reason for revocation (for audit trail) */
+    reason?: string;
+    /** Optional hook called for each revocation */
+    onRevoke?: RevocationHook;
+    /** Maximum depth to cascade (prevents infinite loops) */
+    maxDepth?: number;
+    /** Dry run - don't actually revoke, just return what would be revoked */
+    dryRun?: boolean;
+}
+/**
+ * Cascading Revocation Manager
+ *
+ * Coordinates revocation across the delegation graph.
+ * Per Delegation-Revocation.md:45-67:
+ * - When parent revoked → all descendants revoked
+ * - Uses StatusList2021 for efficient updates
+ * - Maintains audit trail
+ */
+export declare class CascadingRevocationManager {
+    private graph;
+    private statusList;
+    constructor(graph: DelegationGraphManager, statusList: StatusList2021Manager);
+    /**
+     * Revoke a delegation and all its descendants
+     *
+     * Per Delegation-Revocation.md:56-67:
+     * 1. Revoke the target delegation
+     * 2. Find all descendants
+     * 3. Revoke each descendant
+     * 4. Trigger hooks for auditing
+     *
+     * @param delegationId - The delegation ID to revoke
+     * @param options - Revocation options
+     * @returns Array of revoked delegation IDs
+     */
+    revokeDelegation(delegationId: string, options?: CascadingRevocationOptions): Promise<RevocationEvent[]>;
+    /**
+     * Revoke a single node
+     *
+     * @param node - The delegation node
+     * @param isRoot - Whether this is the root of the cascade
+     * @param reason - Reason for revocation
+     * @param dryRun - If true, don't actually revoke
+     * @param parentId - Parent ID if cascaded
+     * @returns Revocation event
+     */
+    private revokeNode;
+    /**
+     * Restore (un-revoke) a delegation
+     *
+     * Note: This does NOT cascade to children.
+     * Only the specific delegation is restored.
+     *
+     * @param delegationId - The delegation ID to restore
+     * @returns Revocation event
+     */
+    restoreDelegation(delegationId: string): Promise<RevocationEvent>;
+    /**
+     * Check if a delegation is revoked
+     *
+     * Checks both:
+     * 1. The delegation itself
+     * 2. Any of its ancestors (cascading check)
+     *
+     * Per Delegation-Revocation.md:56: If any ancestor is revoked, this is revoked.
+     *
+     * @param delegationId - The delegation ID
+     * @returns true if revoked (directly or via cascade)
+     */
+    isRevoked(delegationId: string): Promise<{
+        revoked: boolean;
+        reason?: string;
+        revokedAncestor?: string;
+    }>;
+    /**
+     * Get all revoked delegations in a subtree
+     *
+     * @param rootId - The root delegation ID
+     * @returns Array of revoked delegation IDs
+     */
+    getRevokedInSubtree(rootId: string): Promise<string[]>;
+    /**
+     * Parse credential status from stored ID
+     *
+     * The credentialStatusId is stored as a composite:
+     * "statusListUrl#index"
+     *
+     * @param credentialStatusId - The stored credential status ID
+     * @returns Parsed CredentialStatus, or null if invalid
+     */
+    private parseCredentialStatus;
+    /**
+     * Validate that a delegation can be used
+     *
+     * Checks:
+     * 1. The delegation itself is not revoked
+     * 2. No ancestors are revoked
+     * 3. The chain is valid
+     *
+     * @param delegationId - The delegation ID
+     * @returns Validation result
+     */
+    validateDelegation(delegationId: string): Promise<{
+        valid: boolean;
+        reason?: string;
+    }>;
+}
+/**
+ * Create a cascading revocation manager
+ *
+ * Convenience factory function.
+ *
+ * @param graph - Delegation graph manager
+ * @param statusList - StatusList2021 manager
+ * @returns CascadingRevocationManager instance
+ */
+export declare function createCascadingRevocationManager(graph: DelegationGraphManager, statusList: StatusList2021Manager): CascadingRevocationManager;
+//# sourceMappingURL=cascading-revocation.d.ts.map

package/dist/delegation/cascading-revocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cascading-revocation.d.ts","sourceRoot":"","sources":["../../src/delegation/cascading-revocation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,sBAAsB,EAAkB,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,qCAAqC;IACrC,YAAY,EAAE,MAAM,CAAC;IAErB,0DAA0D;IAC1D,MAAM,EAAE,OAAO,CAAC;IAEhB,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,gBAAgB;IAChB,SAAS,EAAE,MAAM,CAAC;IAElB,4BAA4B;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAE9E;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,8CAA8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,cAAc,CAAC;IAE1B,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,yEAAyE;IACzE,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA0B;IAEnC,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,UAAU;gBADV,KAAK,EAAE,sBAAsB,EAC7B,UAAU,EAAE,qBAAqB;IAG3C;;;;;;;;;;;;OAYG;IACG,gBAAgB,CACpB,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,eAAe,EAAE,CAAC;IAqD7B;;;;;;;;;OASG;YACW,UAAU;IA8BxB;;;;;;;;OAQG;IACG,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAuBvE;;;;;;;;;;;OAWG;IACG,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAC7C,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IA2BF;;;;;OAKG;IACG,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAqB5D;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAkB7B;;;;;;;;;;OAUG;IACG,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QACtD,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;CAoBH;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,sBAAsB,EAC7B,UAAU,EAAE,qBAAqB,GAChC,0BAA0B,CAE5B"}

package/dist/delegation/cascading-revocation.js

@@ -0,0 +1,263 @@
+"use strict";
+/**
+ * Cascading Revocation Manager
+ *
+ * Implements cascading revocation per Python POC design.
+ * When a parent delegation is revoked, all children are automatically revoked.
+ *
+ * SOLID Principles:
+ * - Single Responsibility: Only handles cascading revocation logic
+ * - Open/Closed: Extensible via hooks/callbacks
+ * - Liskov Substitution: Works with any graph/statuslist implementations
+ * - Interface Segregation: Minimal interface
+ * - Dependency Inversion: Depends on abstractions (graph, statuslist)
+ *
+ * Related Spec: MCP-I §4.4, Delegation Chains
+ * Python Reference: Delegation-Revocation.md:45-67
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CascadingRevocationManager = void 0;
+exports.createCascadingRevocationManager = createCascadingRevocationManager;
+/**
+ * Cascading Revocation Manager
+ *
+ * Coordinates revocation across the delegation graph.
+ * Per Delegation-Revocation.md:45-67:
+ * - When parent revoked → all descendants revoked
+ * - Uses StatusList2021 for efficient updates
+ * - Maintains audit trail
+ */
+class CascadingRevocationManager {
+    graph;
+    statusList;
+    constructor(graph, statusList) {
+        this.graph = graph;
+        this.statusList = statusList;
+    }
+    /**
+     * Revoke a delegation and all its descendants
+     *
+     * Per Delegation-Revocation.md:56-67:
+     * 1. Revoke the target delegation
+     * 2. Find all descendants
+     * 3. Revoke each descendant
+     * 4. Trigger hooks for auditing
+     *
+     * @param delegationId - The delegation ID to revoke
+     * @param options - Revocation options
+     * @returns Array of revoked delegation IDs
+     */
+    async revokeDelegation(delegationId, options = {}) {
+        const maxDepth = options.maxDepth || 100; // Safety limit
+        const events = [];
+        // Get the target delegation
+        const targetNode = await this.graph.getNode(delegationId);
+        if (!targetNode) {
+            throw new Error(`Delegation not found: ${delegationId}`);
+        }
+        // Check depth to prevent infinite loops
+        const depth = await this.graph.getDepth(delegationId);
+        if (depth > maxDepth) {
+            throw new Error(`Delegation depth ${depth} exceeds maximum ${maxDepth}`);
+        }
+        // Revoke the target delegation
+        const rootEvent = await this.revokeNode(targetNode, true, options.reason, options.dryRun);
+        events.push(rootEvent);
+        if (options.onRevoke) {
+            await options.onRevoke(rootEvent);
+        }
+        // Get all descendants
+        const descendants = await this.graph.getDescendants(delegationId);
+        // Revoke each descendant
+        for (const descendant of descendants) {
+            const event = await this.revokeNode(descendant, false, `Cascaded from ${delegationId}`, options.dryRun, delegationId);
+            events.push(event);
+            if (options.onRevoke) {
+                await options.onRevoke(event);
+            }
+        }
+        return events;
+    }
+    /**
+     * Revoke a single node
+     *
+     * @param node - The delegation node
+     * @param isRoot - Whether this is the root of the cascade
+     * @param reason - Reason for revocation
+     * @param dryRun - If true, don't actually revoke
+     * @param parentId - Parent ID if cascaded
+     * @returns Revocation event
+     */
+    async revokeNode(node, isRoot, reason, dryRun, parentId) {
+        const event = {
+            delegationId: node.id,
+            isRoot,
+            parentId,
+            timestamp: Date.now(),
+            reason,
+        };
+        if (dryRun) {
+            return event;
+        }
+        // Parse the credential status from the node
+        if (node.credentialStatusId) {
+            const credentialStatus = this.parseCredentialStatus(node.credentialStatusId);
+            if (credentialStatus) {
+                await this.statusList.updateStatus(credentialStatus, true);
+            }
+        }
+        return event;
+    }
+    /**
+     * Restore (un-revoke) a delegation
+     *
+     * Note: This does NOT cascade to children.
+     * Only the specific delegation is restored.
+     *
+     * @param delegationId - The delegation ID to restore
+     * @returns Revocation event
+     */
+    async restoreDelegation(delegationId) {
+        const node = await this.graph.getNode(delegationId);
+        if (!node) {
+            throw new Error(`Delegation not found: ${delegationId}`);
+        }
+        const event = {
+            delegationId: node.id,
+            isRoot: true,
+            timestamp: Date.now(),
+            reason: 'Restored',
+        };
+        if (node.credentialStatusId) {
+            const credentialStatus = this.parseCredentialStatus(node.credentialStatusId);
+            if (credentialStatus) {
+                await this.statusList.updateStatus(credentialStatus, false);
+            }
+        }
+        return event;
+    }
+    /**
+     * Check if a delegation is revoked
+     *
+     * Checks both:
+     * 1. The delegation itself
+     * 2. Any of its ancestors (cascading check)
+     *
+     * Per Delegation-Revocation.md:56: If any ancestor is revoked, this is revoked.
+     *
+     * @param delegationId - The delegation ID
+     * @returns true if revoked (directly or via cascade)
+     */
+    async isRevoked(delegationId) {
+        // Get the chain from root to this delegation
+        const chain = await this.graph.getChain(delegationId);
+        // Check each node in the chain (bottom-up, most specific first)
+        for (const node of chain.reverse()) {
+            if (node.credentialStatusId) {
+                const credentialStatus = this.parseCredentialStatus(node.credentialStatusId);
+                if (credentialStatus) {
+                    const isRevoked = await this.statusList.checkStatus(credentialStatus);
+                    if (isRevoked) {
+                        return {
+                            revoked: true,
+                            reason: node.id === delegationId
+                                ? 'Directly revoked'
+                                : 'Ancestor revoked',
+                            revokedAncestor: node.id === delegationId ? undefined : node.id,
+                        };
+                    }
+                }
+            }
+        }
+        return { revoked: false };
+    }
+    /**
+     * Get all revoked delegations in a subtree
+     *
+     * @param rootId - The root delegation ID
+     * @returns Array of revoked delegation IDs
+     */
+    async getRevokedInSubtree(rootId) {
+        const descendants = await this.graph.getDescendants(rootId);
+        const revoked = [];
+        // Check root
+        const rootRevoked = await this.isRevoked(rootId);
+        if (rootRevoked.revoked) {
+            revoked.push(rootId);
+        }
+        // Check each descendant
+        for (const node of descendants) {
+            const isRevoked = await this.isRevoked(node.id);
+            if (isRevoked.revoked) {
+                revoked.push(node.id);
+            }
+        }
+        return revoked;
+    }
+    /**
+     * Parse credential status from stored ID
+     *
+     * The credentialStatusId is stored as a composite:
+     * "statusListUrl#index"
+     *
+     * @param credentialStatusId - The stored credential status ID
+     * @returns Parsed CredentialStatus, or null if invalid
+     */
+    parseCredentialStatus(credentialStatusId) {
+        const match = credentialStatusId.match(/^(.+)#(\d+)$/);
+        if (!match)
+            return null;
+        const [, statusListCredential, indexStr] = match;
+        const index = parseInt(indexStr, 10);
+        return {
+            id: credentialStatusId,
+            type: 'StatusList2021Entry',
+            statusPurpose: 'revocation', // Assume revocation (could be enhanced)
+            statusListIndex: index.toString(),
+            statusListCredential,
+        };
+    }
+    /**
+     * Validate that a delegation can be used
+     *
+     * Checks:
+     * 1. The delegation itself is not revoked
+     * 2. No ancestors are revoked
+     * 3. The chain is valid
+     *
+     * @param delegationId - The delegation ID
+     * @returns Validation result
+     */
+    async validateDelegation(delegationId) {
+        // Check if revoked
+        const revokedCheck = await this.isRevoked(delegationId);
+        if (revokedCheck.revoked) {
+            return {
+                valid: false,
+                reason: revokedCheck.revokedAncestor
+                    ? `Ancestor ${revokedCheck.revokedAncestor} is revoked`
+                    : 'Delegation is revoked',
+            };
+        }
+        // Validate chain structure
+        const chainValidation = await this.graph.validateChain(delegationId);
+        if (!chainValidation.valid) {
+            return chainValidation;
+        }
+        return { valid: true };
+    }
+}
+exports.CascadingRevocationManager = CascadingRevocationManager;
+/**
+ * Create a cascading revocation manager
+ *
+ * Convenience factory function.
+ *
+ * @param graph - Delegation graph manager
+ * @param statusList - StatusList2021 manager
+ * @returns CascadingRevocationManager instance
+ */
+function createCascadingRevocationManager(graph, statusList) {
+    return new CascadingRevocationManager(graph, statusList);
+}
+//# sourceMappingURL=cascading-revocation.js.map

package/dist/delegation/cascading-revocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cascading-revocation.js","sourceRoot":"","sources":["../../src/delegation/cascading-revocation.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AA6VH,4EAKC;AA/SD;;;;;;;;GAQG;AACH,MAAa,0BAA0B;IAE3B;IACA;IAFV,YACU,KAA6B,EAC7B,UAAiC;QADjC,UAAK,GAAL,KAAK,CAAwB;QAC7B,eAAU,GAAV,UAAU,CAAuB;IACxC,CAAC;IAEJ;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,gBAAgB,CACpB,YAAoB,EACpB,UAAsC,EAAE;QAExC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC,eAAe;QACzD,MAAM,MAAM,GAAsB,EAAE,CAAC;QAErC,4BAA4B;QAC5B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,wCAAwC;QACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,oBAAoB,KAAK,oBAAoB,QAAQ,EAAE,CACxD,CAAC;QACJ,CAAC;QAED,+BAA+B;QAC/B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CACrC,UAAU,EACV,IAAI,EACJ,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,MAAM,CACf,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEvB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QAED,sBAAsB;QACtB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QAElE,yBAAyB;QACzB,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CACjC,UAAU,EACV,KAAK,EACL,iBAAiB,YAAY,EAAE,EAC/B,OAAO,CAAC,MAAM,EACd,YAAY,CACb,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAEnB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,UAAU,CACtB,IAAoB,EACpB,MAAe,EACf,MAAe,EACf,MAAgB,EAChB,QAAiB;QAEjB,MAAM,KAAK,GAAoB;YAC7B,YAAY,EAAE,IAAI,CAAC,EAAE;YACrB,MAAM;YACN,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,MAAM;SACP,CAAC;QAEF,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACf,CAAC;QAED,4CAA4C;QAC5C,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,MAAM,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC7E,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,iBAAiB,CAAC,YAAoB;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,KAAK,GAAoB;YAC7B,YAAY,EAAE,IAAI,CAAC,EAAE;YACrB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,UAAU;SACnB,CAAC;QAEF,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,MAAM,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC7E,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,SAAS,CAAC,YAAoB;QAKlC,6CAA6C;QAC7C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAEtD,gEAAgE;QAChE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC5B,MAAM,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBAC7E,IAAI,gBAAgB,EAAE,CAAC;oBACrB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;oBACtE,IAAI,SAAS,EAAE,CAAC;wBACd,OAAO;4BACL,OAAO,EAAE,IAAI;4BACb,MAAM,EACJ,IAAI,CAAC,EAAE,KAAK,YAAY;gCACtB,CAAC,CAAC,kBAAkB;gCACpB,CAAC,CAAC,kBAAkB;4BACxB,eAAe,EAAE,IAAI,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;yBAChE,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,mBAAmB,CAAC,MAAc;QACtC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,aAAa;QACb,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;QAED,wBAAwB;QACxB,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChD,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;OAQG;IACK,qBAAqB,CAC3B,kBAA0B;QAE1B,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,MAAM,CAAC,EAAE,oBAAoB,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC;QACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAErC,OAAO;YACL,EAAE,EAAE,kBAAkB;YACtB,IAAI,EAAE,qBAAqB;YAC3B,aAAa,EAAE,YAAY,EAAE,wCAAwC;YACrE,eAAe,EAAE,KAAK,CAAC,QAAQ,EAAE;YACjC,oBAAoB;SACrB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,kBAAkB,CAAC,YAAoB;QAI3C,mBAAmB;QACnB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,YAAY,CAAC,eAAe;oBAClC,CAAC,CAAC,YAAY,YAAY,CAAC,eAAe,aAAa;oBACvD,CAAC,CAAC,uBAAuB;aAC5B,CAAC;QACJ,CAAC;QAED,2BAA2B;QAC3B,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACrE,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;CACF;AAtRD,gEAsRC;AAED;;;;;;;;GAQG;AACH,SAAgB,gCAAgC,CAC9C,KAA6B,EAC7B,UAAiC;IAEjC,OAAO,IAAI,0BAA0B,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;AAC3D,CAAC"}