@kya-os/mcp 1.16.2 → 1.17.0

package/dist/card/schema.d.ts

@@ -51,23 +51,25 @@ export declare const ProofPublicJwkSchema: z.ZodUnion<readonly [z.ZodObject<{
 }, z.core.$strict>]>;
 /**
  * Deliberately NON-strict: the JSON Schema marks `CapabilityAttestation` as
- * `additionalProperties: true`, so extra keys alongside `vc` are permitted here.
+ * `additionalProperties: true`, so extra keys alongside `vc` are permitted here — and PRESERVED.
+ * A plain `z.object` strips unknown keys, which would hand the capability verifier an attestation
+ * missing sidecar members it may need (a `credentialStatus`, say).
  */
 export declare const CapabilityAttestationSchema: z.ZodObject<{
     vc: z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>]>;
-}, z.core.$strip>;
+}, z.core.$loose>;
 export declare const Level2CapabilitySchema: z.ZodObject<{
     name: z.ZodString;
     attestations: z.ZodArray<z.ZodObject<{
         vc: z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>]>;
-    }, z.core.$strip>>;
+    }, z.core.$loose>>;
 }, z.core.$strict>;
 /** L1 bare-string name, or an L2 object carrying attestations. */
 export declare const CapabilitySchema: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
     name: z.ZodString;
     attestations: z.ZodArray<z.ZodObject<{
         vc: z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>]>;
-    }, z.core.$strip>>;
+    }, z.core.$loose>>;
 }, z.core.$strict>]>;
 export declare const AttestationSchema: z.ZodObject<{
     type: z.ZodEnum<{
@@ -136,7 +138,7 @@ export declare const EntityCardSchema: z.ZodObject<{
         name: z.ZodString;
         attestations: z.ZodArray<z.ZodObject<{
             vc: z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>]>;
-        }, z.core.$strip>>;
+        }, z.core.$loose>>;
     }, z.core.$strict>]>>>;
     conformanceLevel: z.ZodOptional<z.ZodEnum<{
         L1: "L1";
@@ -182,4 +184,3 @@ export type BitstringStatusListEntry = z.infer<typeof BitstringStatusListEntrySc
 export type EntityCard = z.infer<typeof EntityCardSchema>;
 /** Flatten capabilities (bare strings or attested objects) to their names. */
 export declare function capabilityNames(caps: Capability[]): string[];
-//# sourceMappingURL=schema.d.ts.map

package/dist/card/schema.js

@@ -34,11 +34,15 @@ export const ProofPublicJwkSchema = z.union([Ed25519PublicJwkSchema, P256PublicJ
 const VcValue = z.union([z.string(), z.record(z.string(), z.unknown())]);
 /**
  * Deliberately NON-strict: the JSON Schema marks `CapabilityAttestation` as
- * `additionalProperties: true`, so extra keys alongside `vc` are permitted here.
+ * `additionalProperties: true`, so extra keys alongside `vc` are permitted here — and PRESERVED.
+ * A plain `z.object` strips unknown keys, which would hand the capability verifier an attestation
+ * missing sidecar members it may need (a `credentialStatus`, say).
  */
-export const CapabilityAttestationSchema = z.object({
+export const CapabilityAttestationSchema = z
+    .object({
     vc: VcValue,
-});
+})
+    .passthrough();
 export const Level2CapabilitySchema = z
     .object({
     name: z.string().min(1),

package/dist/card/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/card/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AAEH,iHAAiH;AACjH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE,kCAAkC,CAAC,CAAC;AAE9F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAExF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACrB,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACzB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACpB,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACvB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,iGAAiG;AACjG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAE3F,gFAAgF;AAChF,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAEzE;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAErF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,sBAAsB,EAAE,uBAAuB,CAAC,CAAC;IAC/D,EAAE,EAAE,OAAO;IACX,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE;IACvB,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE;CACvB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;gGACgG;AAChG,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC;IACxC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IAC3B,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC;CACnC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,MAAM,CAAC;IACN,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,0DAA0D,CAAC;CAC1G,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,EAAE,EAAE,GAAG;IACP,UAAU,EAAE,gBAAgB;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,YAAY,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAClD,2EAA2E;IAC3E,gBAAgB,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IACnD,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,sFAAsF;IACtF,YAAY,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC3C,8EAA8E;IAC9E,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAClC,kFAAkF;IAClF,UAAU,EAAE,8BAA8B,CAAC,QAAQ,EAAE;CACtD,CAAC;IACF,mFAAmF;IACnF,mFAAmF;KAClF,MAAM,EAAE,CAAC;AAiBZ,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,IAAkB;IAChD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/card/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AAEH,iHAAiH;AACjH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE,kCAAkC,CAAC,CAAC;AAE9F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAExF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACrB,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACzB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACpB,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACvB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,iGAAiG;AACjG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAE3F,gFAAgF;AAChF,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC;IACN,EAAE,EAAE,OAAO;CACZ,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAErF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,sBAAsB,EAAE,uBAAuB,CAAC,CAAC;IAC/D,EAAE,EAAE,OAAO;IACX,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE;IACvB,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE;CACvB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;gGACgG;AAChG,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC;IACxC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IAC3B,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC;CACnC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,MAAM,CAAC;IACN,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,0DAA0D,CAAC;CAC1G,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,EAAE,EAAE,GAAG;IACP,UAAU,EAAE,gBAAgB;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,YAAY,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAClD,2EAA2E;IAC3E,gBAAgB,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IACnD,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,sFAAsF;IACtF,YAAY,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC3C,8EAA8E;IAC9E,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAClC,kFAAkF;IAClF,UAAU,EAAE,8BAA8B,CAAC,QAAQ,EAAE;CACtD,CAAC;IACF,mFAAmF;IACnF,mFAAmF;KAClF,MAAM,EAAE,CAAC;AAiBZ,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,IAAkB;IAChD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/dist/card/verify.d.ts

@@ -141,4 +141,3 @@ export declare function verifyCard(card: EntityCard, deps: VerifyCardDeps): Prom
  * `true` so 2-arg calls still compile; a `false` (unreachable/stale list) demotes L3 → L2.
  */
 export declare function deriveConformanceLevel(check: CapabilityCheckResult, proofOk: boolean, revocationFresh?: boolean): ConformanceLevel;
-//# sourceMappingURL=verify.d.ts.map

package/dist/delegation/audience-validator.d.ts

@@ -6,4 +6,3 @@
  */
 import type { DelegationRecord } from '../types/protocol.js';
 export declare function verifyDelegationAudience(delegation: DelegationRecord, serverDid: string): boolean;
-//# sourceMappingURL=audience-validator.d.ts.map

package/dist/delegation/bitstring.d.ts

@@ -42,4 +42,3 @@ export declare class BitstringManager {
  * reading as "not set".
  */
 export declare function isIndexSet(encodedList: string, index: number, decompressor: DecompressionFunction): Promise<boolean>;
-//# sourceMappingURL=bitstring.d.ts.map

package/dist/delegation/cascading-revocation.d.ts

@@ -34,12 +34,11 @@ export declare class CascadingRevocationManager {
         reason?: string;
         revokedAncestor?: string;
     }>;
+    private isStatusBitSet;
     getRevokedInSubtree(rootId: string): Promise<string[]>;
-    private parseCredentialStatus;
     validateDelegation(delegationId: string): Promise<{
         valid: boolean;
         reason?: string;
     }>;
 }
 export declare function createCascadingRevocationManager(graph: DelegationGraphManager, statusList: StatusList2021Manager): CascadingRevocationManager;
-//# sourceMappingURL=cascading-revocation.d.ts.map

package/dist/delegation/cascading-revocation.js

@@ -6,6 +6,7 @@
  *
  * Related Spec: KYA-OS §4.4, Delegation Chains
  */
+import { nodeStatusEntry } from './delegation-status-entry.js';
 export class CascadingRevocationManager {
     graph;
     statusList;
@@ -50,11 +51,21 @@ export class CascadingRevocationManager {
         if (dryRun) {
             return event;
         }
-        if (node.credentialStatusId) {
-            const credentialStatus = this.parseCredentialStatus(node.credentialStatusId);
-            if (credentialStatus) {
-                await this.statusList.updateStatus(credentialStatus, true);
-            }
+        // Mark the graph first (SPEC.md §6.5 step 1): it holds even when the node
+        // has no status list entry to flip (no status id, or one such as
+        // urn:uuid:… that names no list and index), or when publishing the bit
+        // below fails.
+        const marked = await this.graph.setRevoked(node.id, true);
+        const credentialStatus = nodeStatusEntry(node);
+        // With no bit to flip, the mark is the only record. If the storage
+        // provider dropped it, reporting success would leave the delegation live.
+        if (!marked && !credentialStatus) {
+            throw new Error(`Revocation of delegation ${node.id} was not recorded: it has no status list entry, and the ` +
+                `graph storage provider did not persist DelegationNode.revoked. A DelegationGraphStorageProvider ` +
+                `must store the revoked field to revoke delegations without a status list entry.`);
+        }
+        if (credentialStatus) {
+            await this.statusList.updateStatus(credentialStatus, true);
         }
         return event;
     }
@@ -69,35 +80,36 @@ export class CascadingRevocationManager {
             timestamp: Date.now(),
             reason: 'Restored',
         };
-        if (node.credentialStatusId) {
-            const credentialStatus = this.parseCredentialStatus(node.credentialStatusId);
-            if (credentialStatus) {
-                await this.statusList.updateStatus(credentialStatus, false);
-            }
+        // Clear the graph mark last: if clearing the status bit fails, the
+        // delegation still reads as revoked.
+        const credentialStatus = nodeStatusEntry(node);
+        if (credentialStatus) {
+            await this.statusList.updateStatus(credentialStatus, false);
         }
+        await this.graph.setRevoked(node.id, false);
         return event;
     }
     async isRevoked(delegationId) {
         // Walk root → target so ancestor revocation is detected before the
         // target's own (cascade-set) bit. getChain() already returns root-first order.
+        // A node counts as revoked when the graph marks it or its status bit is
+        // set; a node with no status list entry is read from the mark alone.
         const chain = await this.graph.getChain(delegationId);
         for (const node of chain) {
-            if (node.credentialStatusId) {
-                const credentialStatus = this.parseCredentialStatus(node.credentialStatusId);
-                if (credentialStatus) {
-                    const isRevoked = await this.statusList.checkStatus(credentialStatus);
-                    if (isRevoked) {
-                        return {
-                            revoked: true,
-                            reason: node.id === delegationId ? 'Directly revoked' : 'Ancestor revoked',
-                            revokedAncestor: node.id === delegationId ? undefined : node.id,
-                        };
-                    }
-                }
+            if (node.revoked || (await this.isStatusBitSet(node))) {
+                return {
+                    revoked: true,
+                    reason: node.id === delegationId ? 'Directly revoked' : 'Ancestor revoked',
+                    revokedAncestor: node.id === delegationId ? undefined : node.id,
+                };
             }
         }
         return { revoked: false };
     }
+    async isStatusBitSet(node) {
+        const credentialStatus = nodeStatusEntry(node);
+        return credentialStatus ? this.statusList.checkStatus(credentialStatus) : false;
+    }
     async getRevokedInSubtree(rootId) {
         const descendants = await this.graph.getDescendants(rootId);
         const revoked = [];
@@ -113,20 +125,6 @@ export class CascadingRevocationManager {
         }
         return revoked;
     }
-    parseCredentialStatus(credentialStatusId) {
-        const match = credentialStatusId.match(/^(.+)#(\d+)$/);
-        if (!match)
-            return null;
-        const [, statusListCredential, indexStr] = match;
-        const index = parseInt(indexStr, 10);
-        return {
-            id: credentialStatusId,
-            type: 'StatusList2021Entry',
-            statusPurpose: 'revocation',
-            statusListIndex: index.toString(),
-            statusListCredential: statusListCredential,
-        };
-    }
     async validateDelegation(delegationId) {
         const revokedCheck = await this.isRevoked(delegationId);
         if (revokedCheck.revoked) {

package/dist/delegation/cascading-revocation.js.map

@@ -1 +1 @@
-{"version":3,"file":"cascading-revocation.js","sourceRoot":"","sources":["../../src/delegation/cascading-revocation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAuBH,MAAM,OAAO,0BAA0B;IAE3B;IACA;IAFV,YACU,KAA6B,EAC7B,UAAiC;QADjC,UAAK,GAAL,KAAK,CAAwB;QAC7B,eAAU,GAAV,UAAU,CAAuB;IACxC,CAAC;IAEJ,KAAK,CAAC,gBAAgB,CACpB,YAAoB,EACpB,UAAsC,EAAE;QAExC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC;QACzC,MAAM,MAAM,GAAsB,EAAE,CAAC;QAErC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,oBAAoB,QAAQ,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CACrC,UAAU,EACV,IAAI,EACJ,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,MAAM,CACf,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEvB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QAElE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CACjC,UAAU,EACV,KAAK,EACL,iBAAiB,YAAY,EAAE,EAC/B,OAAO,CAAC,MAAM,EACd,YAAY,CACb,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAEnB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,IAAoB,EACpB,MAAe,EACf,MAAe,EACf,MAAgB,EAChB,QAAiB;QAEjB,MAAM,KAAK,GAAoB;YAC7B,YAAY,EAAE,IAAI,CAAC,EAAE;YACrB,MAAM;YACN,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,MAAM;SACP,CAAC;QAEF,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,MAAM,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC7E,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,YAAoB;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,KAAK,GAAoB;YAC7B,YAAY,EAAE,IAAI,CAAC,EAAE;YACrB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,UAAU;SACnB,CAAC;QAEF,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,MAAM,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC7E,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,YAAoB;QAKlC,mEAAmE;QACnE,+EAA+E;QAC/E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAEtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC5B,MAAM,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBAC7E,IAAI,gBAAgB,EAAE,CAAC;oBACrB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;oBACtE,IAAI,SAAS,EAAE,CAAC;wBACd,OAAO;4BACL,OAAO,EAAE,IAAI;4BACb,MAAM,EAAE,IAAI,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB;4BAC1E,eAAe,EAAE,IAAI,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;yBAChE,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAc;QACtC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChD,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,qBAAqB,CAAC,kBAA0B;QACtD,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,MAAM,CAAC,EAAE,oBAAoB,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC;QACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAS,EAAE,EAAE,CAAC,CAAC;QAEtC,OAAO;YACL,EAAE,EAAE,kBAAkB;YACtB,IAAI,EAAE,qBAAqB;YAC3B,aAAa,EAAE,YAAY;YAC3B,eAAe,EAAE,KAAK,CAAC,QAAQ,EAAE;YACjC,oBAAoB,EAAE,oBAAqB;SAC5C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,YAAoB;QAC3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,YAAY,CAAC,eAAe;oBAClC,CAAC,CAAC,YAAY,YAAY,CAAC,eAAe,aAAa;oBACvD,CAAC,CAAC,uBAAuB;aAC5B,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACrE,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;CACF;AAED,MAAM,UAAU,gCAAgC,CAC9C,KAA6B,EAC7B,UAAiC;IAEjC,OAAO,IAAI,0BAA0B,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;AAC3D,CAAC"}
+{"version":3,"file":"cascading-revocation.js","sourceRoot":"","sources":["../../src/delegation/cascading-revocation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAoB/D,MAAM,OAAO,0BAA0B;IAE3B;IACA;IAFV,YACU,KAA6B,EAC7B,UAAiC;QADjC,UAAK,GAAL,KAAK,CAAwB;QAC7B,eAAU,GAAV,UAAU,CAAuB;IACxC,CAAC;IAEJ,KAAK,CAAC,gBAAgB,CACpB,YAAoB,EACpB,UAAsC,EAAE;QAExC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC;QACzC,MAAM,MAAM,GAAsB,EAAE,CAAC;QAErC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,oBAAoB,QAAQ,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CACrC,UAAU,EACV,IAAI,EACJ,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,MAAM,CACf,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEvB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QAElE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CACjC,UAAU,EACV,KAAK,EACL,iBAAiB,YAAY,EAAE,EAC/B,OAAO,CAAC,MAAM,EACd,YAAY,CACb,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAEnB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,IAAoB,EACpB,MAAe,EACf,MAAe,EACf,MAAgB,EAChB,QAAiB;QAEjB,MAAM,KAAK,GAAoB;YAC7B,YAAY,EAAE,IAAI,CAAC,EAAE;YACrB,MAAM;YACN,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,MAAM;SACP,CAAC;QAEF,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACf,CAAC;QAED,0EAA0E;QAC1E,iEAAiE;QACjE,uEAAuE;QACvE,eAAe;QACf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAE1D,MAAM,gBAAgB,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAC/C,mEAAmE;QACnE,0EAA0E;QAC1E,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,4BAA4B,IAAI,CAAC,EAAE,0DAA0D;gBAC3F,kGAAkG;gBAClG,iFAAiF,CACpF,CAAC;QACJ,CAAC;QACD,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,YAAoB;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,KAAK,GAAoB;YAC7B,YAAY,EAAE,IAAI,CAAC,EAAE;YACrB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,UAAU;SACnB,CAAC;QAEF,mEAAmE;QACnE,qCAAqC;QACrC,MAAM,gBAAgB,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAE5C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,YAAoB;QAKlC,mEAAmE;QACnE,+EAA+E;QAC/E,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAEtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACtD,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,IAAI,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB;oBAC1E,eAAe,EAAE,IAAI,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;iBAChE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,IAAoB;QAC/C,MAAM,gBAAgB,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAc;QACtC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChD,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,YAAoB;QAC3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,YAAY,CAAC,eAAe;oBAClC,CAAC,CAAC,YAAY,YAAY,CAAC,eAAe,aAAa;oBACvD,CAAC,CAAC,uBAAuB;aAC5B,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACrE,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;CACF;AAED,MAAM,UAAU,gCAAgC,CAC9C,KAA6B,EAC7B,UAAiC;IAEjC,OAAO,IAAI,0BAA0B,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;AAC3D,CAAC"}

package/dist/delegation/chain-enforcement.d.ts

@@ -15,9 +15,15 @@ import { type DelegationCredential } from "../types/protocol.js";
 /** Union of a credential's delegation scopes and its constraint scopes. */
 export declare function getDelegationScopes(credential: DelegationCredential): string[];
 /**
- * A child re-delegation may only narrow (attenuate) its parent's authority.
- * Enforces flat-scope subset AND crisp-matcher subset (by matcher+resource),
- * failing closed on any widening. Pure; never throws.
+ * A child re-delegation may only narrow (attenuate) its parent's authority
+ * (SPEC.md §6.4). Scope authority comes in two representations (SPEC.md §6.3):
+ * flat scopes, matched exactly, and CRISP scope matchers. Both credentials are
+ * read as one typed authority ({@link scopeAuthority}), and every flat scope and
+ * matcher the child grants must be proven inside the parent's authority
+ * ({@link authorityContains}), whichever representation either side uses;
+ * anything unprovable, including a malformed entry, fails closed. A credential
+ * with no scopes of either kind is not scope-restricted: such a parent accepts
+ * any child, and such a child never attenuates a restricted parent. Pure.
  */
 export declare function validateScopeAttenuation(parentCredential: DelegationCredential, childCredential: DelegationCredential): {
     valid: boolean;
@@ -67,10 +73,20 @@ export interface ChainEnforcementDeps {
     statusListConfigured: boolean;
     /** Optional graph-backed ancestor-revocation check (see {@link RevocationChecker}). */
     revocationChecker?: RevocationChecker;
+    /**
+     * DIDs allowed to sign the chain's root credential (its Responsible Party).
+     * When set, a root signed by any other DID is rejected. Omit to accept any
+     * root issuer.
+     */
+    trustedRootIssuers?: readonly string[];
 }
 export interface ChainValidationResult {
     valid: boolean;
     reason?: string;
+    /** Earliest verified credential/constraint expiry across the chain (ms epoch). */
+    expiresAt?: number;
+    /** Non-fatal inconsistencies worth logging, such as a root whose issuerDid is not its signer. */
+    warnings?: string[];
 }
 /**
  * Validate a delegation credential and (if re-delegated) its full chain:
@@ -78,9 +94,14 @@ export interface ChainValidationResult {
  * the §11.6 re-delegation audience-constraint requirement, parent↔child linkage
  * (parentId + issuerDid==parent.subjectDid), cycle detection, scope attenuation,
  * and — when a {@link RevocationChecker} is supplied — graph-backed ancestor
- * revocation. Never throws on a malformed input; returns `{ valid, reason }`.
+ * revocation. `skipSignature` applies only to the presented leaf whose JWT
+ * envelope the caller has verified; ancestors always require verification.
+ * Each child must also be signed by its parent's subject: the claimed
+ * `issuerDid` alone is not signed evidence of who issued it. When
+ * `trustedRootIssuers` is set, the root must be signed by one of them.
+ * Success includes the earliest applicable expiry for downstream grant storage.
+ * Never throws on a malformed input; returns `{ valid, reason }`.
  */
 export declare function validateDelegationChain(leafCredential: DelegationCredential, deps: ChainEnforcementDeps, options?: {
     skipSignature?: boolean;
 }): Promise<ChainValidationResult>;
-//# sourceMappingURL=chain-enforcement.d.ts.map

package/dist/delegation/chain-enforcement.js

@@ -13,6 +13,8 @@
  */
 import { extractDelegationFromVC, } from "../types/protocol.js";
 import { verifyDelegationAudience } from "./audience-validator.js";
+import { authorityContains, crispScopes, scopeAuthority } from "./scope-matcher.js";
+import { credentialIssuerDid } from "./vc-jwt-verify.js";
 /** Union of a credential's delegation scopes and its constraint scopes. */
 export function getDelegationScopes(credential) {
     const scopes = new Set();
@@ -25,44 +27,46 @@ export function getDelegationScopes(credential) {
     return Array.from(scopes);
 }
 /**
- * A child re-delegation may only narrow (attenuate) its parent's authority.
- * Enforces flat-scope subset AND crisp-matcher subset (by matcher+resource),
- * failing closed on any widening. Pure; never throws.
+ * A child re-delegation may only narrow (attenuate) its parent's authority
+ * (SPEC.md §6.4). Scope authority comes in two representations (SPEC.md §6.3):
+ * flat scopes, matched exactly, and CRISP scope matchers. Both credentials are
+ * read as one typed authority ({@link scopeAuthority}), and every flat scope and
+ * matcher the child grants must be proven inside the parent's authority
+ * ({@link authorityContains}), whichever representation either side uses;
+ * anything unprovable, including a malformed entry, fails closed. A credential
+ * with no scopes of either kind is not scope-restricted: such a parent accepts
+ * any child, and such a child never attenuates a restricted parent. Pure.
  */
 export function validateScopeAttenuation(parentCredential, childCredential) {
-    const parentScopes = getDelegationScopes(parentCredential);
+    const parentId = parentCredential.credentialSubject.delegation.id;
+    const childId = childCredential.credentialSubject.delegation.id;
+    const parentAuthority = scopeAuthority(parentCredential);
+    if (parentAuthority.length === 0) {
+        return { valid: true };
+    }
     const childScopes = getDelegationScopes(childCredential);
-    const childDelegation = childCredential.credentialSubject.delegation;
-    // CRISP matcher attenuation: getDelegationScopes does NOT see constraints.crisp.scopes,
-    // so a re-delegation could otherwise widen authority by introducing a broad
-    // prefix/regex matcher (e.g. resource:"" matches every scope). Require the child's
-    // crisp matchers to be a subset of the parent's (by matcher+resource). Fail closed.
-    const crispKey = (s) => `${s.matcher}\u0000${s.resource}`;
-    const parentCrisp = new Set((parentCredential.credentialSubject.delegation.constraints.crisp?.scopes ?? []).map(crispKey));
-    const widenedCrisp = (childDelegation.constraints.crisp?.scopes ?? []).filter((s) => !parentCrisp.has(crispKey(s)));
-    if (widenedCrisp.length > 0) {
+    const childMatchers = crispScopes(childCredential);
+    if (childScopes.length === 0 && childMatchers.length === 0) {
         return {
             valid: false,
-            reason: `Delegation ${childDelegation.id} introduces crisp scope matcher(s) absent from parent ${parentCredential.credentialSubject.delegation.id}: ${widenedCrisp
-                .map((s) => `${s.matcher}:${s.resource}`)
-                .join(", ")}`,
+            reason: `Delegation ${childId} omits scopes required to prove attenuation from parent ${parentId}`,
         };
     }
-    if (parentScopes.length === 0) {
-        return { valid: true };
-    }
-    if (childScopes.length === 0) {
+    const withinParent = authorityContains(parentAuthority);
+    const widenedMatchers = childMatchers.filter((scope) => !withinParent(scope));
+    if (widenedMatchers.length > 0) {
         return {
             valid: false,
-            reason: `Delegation ${childDelegation.id} omits scopes required to prove attenuation from parent ${parentCredential.credentialSubject.delegation.id}`,
+            reason: `Delegation ${childId} introduces crisp scope matcher(s) outside parent ${parentId}: ${widenedMatchers
+                .map((s) => `${s?.matcher}:${s?.resource}`)
+                .join(", ")}`,
         };
     }
-    const parentScopeSet = new Set(parentScopes);
-    const widenedScopes = childScopes.filter((scope) => !parentScopeSet.has(scope));
+    const widenedScopes = childScopes.filter((scope) => !withinParent({ resource: scope, matcher: "exact" }));
     if (widenedScopes.length > 0) {
         return {
             valid: false,
-            reason: `Delegation ${childDelegation.id} widens scopes beyond parent ${parentCredential.credentialSubject.delegation.id}: ${widenedScopes.join(", ")}`,
+            reason: `Delegation ${childId} widens scopes beyond parent ${parentId}: ${widenedScopes.join(", ")}`,
         };
     }
     return { valid: true };
@@ -73,7 +77,13 @@ export function validateScopeAttenuation(parentCredential, childCredential) {
  * the §11.6 re-delegation audience-constraint requirement, parent↔child linkage
  * (parentId + issuerDid==parent.subjectDid), cycle detection, scope attenuation,
  * and — when a {@link RevocationChecker} is supplied — graph-backed ancestor
- * revocation. Never throws on a malformed input; returns `{ valid, reason }`.
+ * revocation. `skipSignature` applies only to the presented leaf whose JWT
+ * envelope the caller has verified; ancestors always require verification.
+ * Each child must also be signed by its parent's subject: the claimed
+ * `issuerDid` alone is not signed evidence of who issued it. When
+ * `trustedRootIssuers` is set, the root must be signed by one of them.
+ * Success includes the earliest applicable expiry for downstream grant storage.
+ * Never throws on a malformed input; returns `{ valid, reason }`.
  */
 export async function validateDelegationChain(leafCredential, deps, options) {
     // Shape guard (validate* never-throw contract): a structurally malformed leaf
@@ -122,8 +132,15 @@ export async function validateDelegationChain(leafCredential, deps, options) {
                 reason: `Resolved delegation chain for ${leafDelegation.id} must end with the leaf credential`,
             };
         }
-        chain = leafIndex === -1 ? [...resolvedChain, leafCredential] : resolvedChain;
+        // Always validate the presented leaf. A resolver may return a copy, but it
+        // must not replace the credential whose JWT envelope was authenticated.
+        chain = [
+            ...(leafIndex === -1 ? resolvedChain : resolvedChain.slice(0, -1)),
+            leafCredential,
+        ];
     }
+    let expiresAt;
+    const warnings = [];
     const seenIds = new Set();
     let previousDelegation;
     let previousCredential;
@@ -143,7 +160,9 @@ export async function validateDelegationChain(leafCredential, deps, options) {
             };
         }
         const credentialVerification = await deps.verifier.verifyDelegationCredential(credential, {
-            ...(options?.skipSignature ? { skipSignature: true } : {}),
+            ...(options?.skipSignature && credential === leafCredential
+                ? { skipSignature: true }
+                : {}),
         });
         if (!credentialVerification.valid) {
             return {
@@ -151,6 +170,19 @@ export async function validateDelegationChain(leafCredential, deps, options) {
                 reason: `Delegation ${delegation.id} invalid: ${credentialVerification.reason}`,
             };
         }
+        // Use the already-verified walk so grant lifetime cannot outlive a shorter
+        // ancestor or constraint. Expiry/status are still rechecked on every call.
+        const deadlines = [
+            credential.expirationDate ? Date.parse(credential.expirationDate) : undefined,
+            delegation.constraints.notAfter !== undefined
+                ? delegation.constraints.notAfter * 1000
+                : undefined,
+        ];
+        for (const deadline of deadlines) {
+            if (deadline !== undefined && Number.isFinite(deadline)) {
+                expiresAt = Math.min(expiresAt ?? deadline, deadline);
+            }
+        }
         if (!verifyDelegationAudience(delegation, deps.serverDid)) {
             return {
                 valid: false,
@@ -167,6 +199,10 @@ export async function validateDelegationChain(leafCredential, deps, options) {
                 reason: `Delegation ${delegation.id} is a re-delegation (parentId: ${delegation.parentId}) but has no audience constraint. Re-delegations MUST include an audience constraint (KYA-OS §11.6)`,
             };
         }
+        // The DID whose key the verifier checked this credential against. Unlike
+        // `delegation.issuerDid`, which is only a claim inside the signed body,
+        // this is who actually issued it.
+        const signerDid = credentialIssuerDid(credential);
         if (!previousDelegation || !previousCredential) {
             if (delegation.parentId) {
                 return {
@@ -174,6 +210,16 @@ export async function validateDelegationChain(leafCredential, deps, options) {
                     reason: `Resolved delegation chain is incomplete: root delegation ${delegation.id} still references parent ${delegation.parentId}`,
                 };
             }
+            if (deps.trustedRootIssuers &&
+                (signerDid === undefined || !deps.trustedRootIssuers.includes(signerDid))) {
+                return {
+                    valid: false,
+                    reason: `Root delegation ${delegation.id} is issued by ${signerDid ?? "an unidentified issuer"}, which is not a trusted root issuer`,
+                };
+            }
+            if (signerDid !== delegation.issuerDid) {
+                warnings.push(`Root delegation ${delegation.id} names issuerDid ${delegation.issuerDid} but is signed by ${signerDid ?? "an unidentified issuer"}`);
+            }
             previousDelegation = delegation;
             previousCredential = credential;
             continue;
@@ -190,6 +236,14 @@ export async function validateDelegationChain(leafCredential, deps, options) {
                 reason: `Delegation ${delegation.id} issued by ${delegation.issuerDid} but parent subject is ${previousDelegation.subjectDid}`,
             };
         }
+        // Only the parent's delegate may re-delegate. Without this, anyone could
+        // sign a child that merely claims the parent's subject as its issuer.
+        if (signerDid !== previousDelegation.subjectDid) {
+            return {
+                valid: false,
+                reason: `Delegation ${delegation.id} is signed by ${signerDid ?? "an unidentified issuer"} but parent subject is ${previousDelegation.subjectDid}`,
+            };
+        }
         const scopeValidation = validateScopeAttenuation(previousCredential, credential);
         if (!scopeValidation.valid) {
             return scopeValidation;
@@ -206,19 +260,41 @@ export async function validateDelegationChain(leafCredential, deps, options) {
     }
     // E3.1: graph-backed ancestor revocation. Independent of how the chain above
     // was resolved — catches a cascade-revoked ANCESTOR even when the leaf's own
-    // credentialStatus bit was never flipped. Opt-in: only runs when a checker is
-    // wired, so existing callers are unaffected.
+    // credentialStatus bit was never flipped. Every credential in the verified
+    // chain is asked about, root first: a leaf minted after its ancestor was
+    // revoked was never registered, so the graph cannot reach the ancestor
+    // from the leaf's id alone. Opt-in: only runs when a checker is wired, so
+    // existing callers are unaffected.
     if (deps.revocationChecker) {
-        const revocation = await deps.revocationChecker.isRevoked(leafDelegation.id);
-        if (revocation.revoked) {
+        for (const credential of chain) {
+            const delegationId = credential.credentialSubject.delegation.id;
+            let revocation;
+            try {
+                revocation = await deps.revocationChecker.isRevoked(delegationId);
+            }
+            catch (error) {
+                return {
+                    valid: false,
+                    reason: `Revocation check failed for delegation ${delegationId}: ${error instanceof Error ? error.message : "Unknown error"}`,
+                };
+            }
+            if (!revocation.revoked) {
+                continue;
+            }
+            const revokedAncestor = revocation.revokedAncestor ??
+                (delegationId === leafDelegation.id ? undefined : delegationId);
             return {
                 valid: false,
-                reason: revocation.revokedAncestor
-                    ? `Delegation ${leafDelegation.id} is revoked via ancestor ${revocation.revokedAncestor}`
+                reason: revokedAncestor
+                    ? `Delegation ${leafDelegation.id} is revoked via ancestor ${revokedAncestor}`
                     : `Delegation ${leafDelegation.id} is revoked${revocation.reason ? `: ${revocation.reason}` : ""}`,
             };
         }
     }
-    return { valid: true };
+    return {
+        valid: true,
+        ...(expiresAt !== undefined ? { expiresAt } : {}),
+        ...(warnings.length > 0 ? { warnings } : {}),
+    };
 }
 //# sourceMappingURL=chain-enforcement.js.map

package/dist/delegation/chain-enforcement.js.map

@@ -1 +1 @@
-{"version":3,"file":"chain-enforcement.js","sourceRoot":"","sources":["../../src/delegation/chain-enforcement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,uBAAuB,GAGxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAEnE,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,UAAgC;IAClE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACzE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;QACtF,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,gBAAsC,EACtC,eAAqC;IAErC,MAAM,YAAY,GAAG,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;IACzD,MAAM,eAAe,GAAG,eAAe,CAAC,iBAAiB,CAAC,UAAU,CAAC;IAErE,wFAAwF;IACxF,4EAA4E;IAC5E,mFAAmF;IACnF,oFAAoF;IACpF,MAAM,QAAQ,GAAG,CAAC,CAAwC,EAAU,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC;IACzG,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC9F,CAAC;IACF,MAAM,YAAY,GAAG,CAAC,eAAe,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAC3E,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CACrC,CAAC;IACF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,cAAc,eAAe,CAAC,EAAE,yDAAyD,gBAAgB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,YAAY;iBAC/J,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;iBACxC,IAAI,CAAC,IAAI,CAAC,EAAE;SAChB,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,cAAc,eAAe,CAAC,EAAE,2DAA2D,gBAAgB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,EAAE;SACtJ,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAChF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,cAAc,eAAe,CAAC,EAAE,gCAAgC,gBAAgB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACxJ,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAuDD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,cAAoC,EACpC,IAA0B,EAC1B,OAAqC;IAErC,8EAA8E;IAC9E,iFAAiF;IACjF,qDAAqD;IACrD,gFAAgF;IAChF,MAAM,iBAAiB,GACrB,cAAc,EAAE,iBAGjB,EAAE,UAAU,CAAC;IACd,IACE,CAAC,iBAAiB;QAClB,OAAO,iBAAiB,KAAK,QAAQ;QACrC,CAAC,iBAAiB,CAAC,WAAW;QAC9B,OAAO,iBAAiB,CAAC,WAAW,KAAK,QAAQ,EACjD,CAAC;QACD,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EACJ,0FAA0F;SAC7F,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,uBAAuB,CAAC,cAAc,CAAC,CAAC;IAC/D,IAAI,KAAK,GAA2B,CAAC,cAAc,CAAC,CAAC;IAErD,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACjC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,cAAc,CAAC,EAAE,sBAAsB,cAAc,CAAC,QAAQ,sDAAsD;aAC3I,CAAC;QACJ,CAAC;QAED,IAAI,aAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,uCAAuC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;aAC1G,CAAC;QACJ,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,cAAc,CAAC,EAAE,sBAAsB,cAAc,CAAC,QAAQ,kCAAkC;aACvH,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CACvC,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,cAAc,CAAC,EAAE,CACnE,CAAC;QACF,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,SAAS,KAAK,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,iCAAiC,cAAc,CAAC,EAAE,oCAAoC;aAC/F,CAAC;QACJ,CAAC;QAED,KAAK,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;IAChF,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,kBAAgD,CAAC;IACrD,IAAI,kBAAoD,CAAC;IAEzD,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;QAEvD,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,qDAAqD,UAAU,CAAC,EAAE,EAAE;aAC7E,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE3B,IAAI,UAAU,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC9D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,+DAA+D;aACnG,CAAC;QACJ,CAAC;QAED,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAC3E,UAAU,EACV;YACE,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CACF,CAAC;QACF,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,CAAC;YAClC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,aAAa,sBAAsB,CAAC,MAAM,EAAE;aAChF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,wBAAwB,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,yCAAyC,IAAI,CAAC,SAAS,EAAE;aAC7F,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,4EAA4E;QAC5E,uEAAuE;QACvE,6CAA6C;QAC7C,IAAI,UAAU,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;YAC5D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,kCAAkC,UAAU,CAAC,QAAQ,qGAAqG;aAC9L,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,kBAAkB,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC/C,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,4DAA4D,UAAU,CAAC,EAAE,4BAA4B,UAAU,CAAC,QAAQ,EAAE;iBACnI,CAAC;YACJ,CAAC;YAED,kBAAkB,GAAG,UAAU,CAAC;YAChC,kBAAkB,GAAG,UAAU,CAAC;YAChC,SAAS;QACX,CAAC;QAED,IAAI,UAAU,CAAC,QAAQ,KAAK,kBAAkB,CAAC,EAAE,EAAE,CAAC;YAClD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,sBAAsB,UAAU,CAAC,QAAQ,iBAAiB,kBAAkB,CAAC,EAAE,EAAE;aACrH,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,CAAC,SAAS,KAAK,kBAAkB,CAAC,UAAU,EAAE,CAAC;YAC3D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,cAAc,UAAU,CAAC,SAAS,0BAA0B,kBAAkB,CAAC,UAAU,EAAE;aAC/H,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,wBAAwB,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;QACjF,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,kBAAkB,GAAG,UAAU,CAAC;QAChC,kBAAkB,GAAG,UAAU,CAAC;IAClC,CAAC;IAED,MAAM,eAAe,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,CAAC;IAC1E,IAAI,eAAe,CAAC,EAAE,KAAK,cAAc,CAAC,EAAE,EAAE,CAAC;QAC7C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,sCAAsC,eAAe,CAAC,EAAE,oBAAoB,cAAc,CAAC,EAAE,EAAE;SACxG,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,8EAA8E;IAC9E,6CAA6C;IAC7C,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QAC7E,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,UAAU,CAAC,eAAe;oBAChC,CAAC,CAAC,cAAc,cAAc,CAAC,EAAE,4BAA4B,UAAU,CAAC,eAAe,EAAE;oBACzF,CAAC,CAAC,cAAc,cAAc,CAAC,EAAE,cAAc,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACrG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC"}
+{"version":3,"file":"chain-enforcement.js","sourceRoot":"","sources":["../../src/delegation/chain-enforcement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,uBAAuB,GAGxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,UAAgC;IAClE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACzE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;QACtF,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CACtC,gBAAsC,EACtC,eAAqC;IAErC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,eAAe,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;IAChE,MAAM,eAAe,GAAG,cAAc,CAAC,gBAAgB,CAAC,CAAC;IACzD,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,MAAM,WAAW,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,cAAc,OAAO,2DAA2D,QAAQ,EAAE;SACnG,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;IACxD,MAAM,eAAe,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9E,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,cAAc,OAAO,qDAAqD,QAAQ,KAAK,eAAe;iBAC3G,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC;iBAC1C,IAAI,CAAC,IAAI,CAAC,EAAE;SAChB,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC1G,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,cAAc,OAAO,gCAAgC,QAAQ,KAAK,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACrG,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAiED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,cAAoC,EACpC,IAA0B,EAC1B,OAAqC;IAErC,8EAA8E;IAC9E,iFAAiF;IACjF,qDAAqD;IACrD,gFAAgF;IAChF,MAAM,iBAAiB,GACrB,cAAc,EAAE,iBAGjB,EAAE,UAAU,CAAC;IACd,IACE,CAAC,iBAAiB;QAClB,OAAO,iBAAiB,KAAK,QAAQ;QACrC,CAAC,iBAAiB,CAAC,WAAW;QAC9B,OAAO,iBAAiB,CAAC,WAAW,KAAK,QAAQ,EACjD,CAAC;QACD,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EACJ,0FAA0F;SAC7F,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,uBAAuB,CAAC,cAAc,CAAC,CAAC;IAC/D,IAAI,KAAK,GAA2B,CAAC,cAAc,CAAC,CAAC;IAErD,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACjC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,cAAc,CAAC,EAAE,sBAAsB,cAAc,CAAC,QAAQ,sDAAsD;aAC3I,CAAC;QACJ,CAAC;QAED,IAAI,aAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,uCAAuC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;aAC1G,CAAC;QACJ,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,cAAc,CAAC,EAAE,sBAAsB,cAAc,CAAC,QAAQ,kCAAkC;aACvH,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CACvC,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,cAAc,CAAC,EAAE,CACnE,CAAC;QACF,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,SAAS,KAAK,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,iCAAiC,cAAc,CAAC,EAAE,oCAAoC;aAC/F,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,wEAAwE;QACxE,KAAK,GAAG;YACN,GAAG,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAClE,cAAc;SACf,CAAC;IACJ,CAAC;IAED,IAAI,SAA6B,CAAC;IAClC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,kBAAgD,CAAC;IACrD,IAAI,kBAAoD,CAAC;IAEzD,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;QAEvD,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,qDAAqD,UAAU,CAAC,EAAE,EAAE;aAC7E,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE3B,IAAI,UAAU,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC9D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,+DAA+D;aACnG,CAAC;QACJ,CAAC;QAED,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAC3E,UAAU,EACV;YACE,GAAG,CAAC,OAAO,EAAE,aAAa,IAAI,UAAU,KAAK,cAAc;gBACzD,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE;gBACzB,CAAC,CAAC,EAAE,CAAC;SACR,CACF,CAAC;QACF,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,CAAC;YAClC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,aAAa,sBAAsB,CAAC,MAAM,EAAE;aAChF,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,2EAA2E;QAC3E,MAAM,SAAS,GAAG;YAChB,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS;YAC7E,UAAU,CAAC,WAAW,CAAC,QAAQ,KAAK,SAAS;gBAC3C,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,GAAG,IAAI;gBACxC,CAAC,CAAC,SAAS;SACd,CAAC;QACF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxD,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,IAAI,CAAC,wBAAwB,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,yCAAyC,IAAI,CAAC,SAAS,EAAE;aAC7F,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,4EAA4E;QAC5E,uEAAuE;QACvE,6CAA6C;QAC7C,IAAI,UAAU,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;YAC5D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,kCAAkC,UAAU,CAAC,QAAQ,qGAAqG;aAC9L,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,wEAAwE;QACxE,kCAAkC;QAClC,MAAM,SAAS,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAElD,IAAI,CAAC,kBAAkB,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC/C,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,4DAA4D,UAAU,CAAC,EAAE,4BAA4B,UAAU,CAAC,QAAQ,EAAE;iBACnI,CAAC;YACJ,CAAC;YAED,IACE,IAAI,CAAC,kBAAkB;gBACvB,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EACzE,CAAC;gBACD,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,mBAAmB,UAAU,CAAC,EAAE,iBAAiB,SAAS,IAAI,wBAAwB,sCAAsC;iBACrI,CAAC;YACJ,CAAC;YAED,IAAI,SAAS,KAAK,UAAU,CAAC,SAAS,EAAE,CAAC;gBACvC,QAAQ,CAAC,IAAI,CACX,mBAAmB,UAAU,CAAC,EAAE,oBAAoB,UAAU,CAAC,SAAS,qBAAqB,SAAS,IAAI,wBAAwB,EAAE,CACrI,CAAC;YACJ,CAAC;YAED,kBAAkB,GAAG,UAAU,CAAC;YAChC,kBAAkB,GAAG,UAAU,CAAC;YAChC,SAAS;QACX,CAAC;QAED,IAAI,UAAU,CAAC,QAAQ,KAAK,kBAAkB,CAAC,EAAE,EAAE,CAAC;YAClD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,sBAAsB,UAAU,CAAC,QAAQ,iBAAiB,kBAAkB,CAAC,EAAE,EAAE;aACrH,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,CAAC,SAAS,KAAK,kBAAkB,CAAC,UAAU,EAAE,CAAC;YAC3D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,cAAc,UAAU,CAAC,SAAS,0BAA0B,kBAAkB,CAAC,UAAU,EAAE;aAC/H,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,sEAAsE;QACtE,IAAI,SAAS,KAAK,kBAAkB,CAAC,UAAU,EAAE,CAAC;YAChD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,iBAAiB,SAAS,IAAI,wBAAwB,0BAA0B,kBAAkB,CAAC,UAAU,EAAE;aACnJ,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,wBAAwB,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;QACjF,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,kBAAkB,GAAG,UAAU,CAAC;QAChC,kBAAkB,GAAG,UAAU,CAAC;IAClC,CAAC;IAED,MAAM,eAAe,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,CAAC;IAC1E,IAAI,eAAe,CAAC,EAAE,KAAK,cAAc,CAAC,EAAE,EAAE,CAAC;QAC7C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,sCAAsC,eAAe,CAAC,EAAE,oBAAoB,cAAc,CAAC,EAAE,EAAE;SACxG,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,0EAA0E;IAC1E,mCAAmC;IACnC,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;YAC/B,MAAM,YAAY,GAAG,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;YAChE,IAAI,UAA+D,CAAC;YACpE,IAAI,CAAC;gBACH,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,0CAA0C,YAAY,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;iBAC9H,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,SAAS;YACX,CAAC;YACD,MAAM,eAAe,GACnB,UAAU,CAAC,eAAe;gBAC1B,CAAC,YAAY,KAAK,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YAClE,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,eAAe;oBACrB,CAAC,CAAC,cAAc,cAAc,CAAC,EAAE,4BAA4B,eAAe,EAAE;oBAC9E,CAAC,CAAC,cAAc,cAAc,CAAC,EAAE,cAAc,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACrG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACJ,CAAC"}