@mcsherrylabs/evolver-mcp 0.11.0 → 0.13.0

package/dist/group-ownership.js

@@ -0,0 +1,324 @@
+// Group OWNERSHIP transfer (issue #9) — a two-party prepare → consent → finalize → submit workflow.
+// NOT a credit transfer: `evolver_sign_transfer_many` moves credit; this hands a group to a new owner.
+//
+// The chain applies `TransferGroupOwnershipTxBody` only when the SignedTx carries an auth whose
+// `node_id` is the incoming owner (GroupLedgerOrchestrator.applyTransferOwnership), and admission
+// verifies EVERY auth against the named identity's REGISTERED (node_id, key_type, key_label) key
+// over the same auth-free digest (BlockPayloadValidator.admitFilter / resolveAuths). So:
+//
+//   1. PREPARE  (outgoing owner's session) — composes the intent with the SDK body composer and the
+//      SDK canonical digest. Signs NOTHING and records no bytes, so `evolver_submit` cannot find it.
+//   2. CONSENT  (incoming owner's session, its own host-held key) — recomputes the digest from the
+//      structured intent, refuses a mismatching txId, signs the digest with ITS signer and returns
+//      one public auth. It never holds a submittable envelope.
+//   3. FINALIZE (outgoing owner's session) — re-reads the chain, verifies the consent signature
+//      against the incoming owner's REGISTERED key, then signs as sender and assembles BOTH auths
+//      with the SDK `encodeSignedTx`. Recorded once, strictly, by id.
+//   4. `evolver_submit` — the ordinary path and its guards, unchanged.
+//
+// ⚠️ THE txId IS AUTH-FREE. SDK `txId` = node `signingMaterial` = SHA-256 over the tx-auth tag,
+// ledger, sender, ttl, body hash and maxToll — no auths (SignedTxOps.txId, signed_tx.proto). So the
+// prepared id, the consented id and the submitted id are one value; finalize re-derives and checks
+// it rather than assuming.
+//
+// ⚠️ ONLY Ed25519 CONSENT IS ACCEPTED BY THIS WORKFLOW. Verifying before assembly is the point;
+// a BLS consent remains refused locally, never assembled blind or verified by a hand-rolled
+// pairing check. Published SDK 0.22.0 `edVerify` uses strict RFC 8032 verification (`zip215:false`),
+// matching the node's strict Ed25519 mode rather than the former permissive ZIP215 behavior.
+// This dependency update does not broaden accepted consent algorithms or remove local guards.
+//
+// ⚠️ KEY MATERIAL NEVER ENTERS OR LEAVES. Arguments and results carry names, the digest-bound
+// intent, key type/label and the single consent signature; never a private key or signed envelope.
+//
+// ⚠️ THE CONSENT IS SAFE TO HAND OVER ONLY ON A NODE THAT REQUIRES THE SENDER'S OWN AUTH. Before
+// the #9 node fix, admission/validation/apply accepted ANY verified auth, so the incoming owner's
+// consent alone was a submittable transfer "from" the outgoing owner: a bearer artefact that seized
+// the group and charged a sender who never signed. Every step therefore refuses unless the
+// connected node's /status says `senderAuthorizationRequired: true` (SDK `nodeStatus`). That is
+// the connected node's assertion only: the whole chain must run compatible nodes (a deployment
+// prerequisite, not something this process can verify), and the canonical digest has no chain id,
+// so a consent remains replayable on another chain with the same names/keys until it expires.
+import { LEDGER, encodeSignedTx, txId as txDigest, transferGroupOwnershipBody, isValidGroupName, isValidNodeId, hexToBytes, edVerify, edSpkiToRaw, } from "@mcsherrylabs/evolver-client";
+import { recordAssembledOnce, recordPendingOwnership, pendingOwnershipById, dropPendingOwnership, pruneExpiredPendingOwnership, recordedById, namedInRefusal, MAX_PENDING_OWNERSHIP, } from "./write.js";
+/** Rounds of life for a two-party transfer. Longer than `DEFAULT_TTL_OFFSET` (50, sized for no
+ *  human wait) because a second party must act, but never beyond the node's default
+ *  `max-ttl-offset` (RoutingConfig.DefaultMaxTtlOffset = 100): a longer ttl is `ttl_too_far`, and
+ *  a long-lived co-signed envelope is a bearer artefact. The default stays 10 rounds inside that
+ *  bound so the two parties' nodes may disagree slightly about the tip. Expiry is final. */
+export const OWNERSHIP_TTL_MAX = 100;
+export const OWNERSHIP_TTL_DEFAULT = 90;
+/** The one key type whose consent can be verified with a published SDK primitive. */
+export const CONSENT_KEY_TYPE = "Ed25519";
+export const INTENT_KIND = "evolver.group_ownership_intent.v1";
+export const CONSENT_KIND = "evolver.group_ownership_consent.v1";
+const PURPOSE = "AUTHORIZE"; // TxAuth.purpose default; encodeSignedTx writes no other.
+const MAX_LABEL = 128;
+const refuse = (what, cause) => ({ kind: "partial", what, cause });
+const unreachable = (e) => ({ kind: "unreachable", chain: "", cause: e instanceof Error ? e.message : String(e) });
+const hex = (b) => Buffer.from(b).toString("hex");
+const str = (v) => (typeof v === "string" ? v.trim() : "");
+/** The canonical digest (== txId) for one transfer intent, from the SDK composer and SDK digest.
+ *  maxToll is 0: the groups ledger charges no toll and this workflow consents to none. */
+function digestFor(outgoing, groupName, incoming, ttl) {
+    const body = transferGroupOwnershipBody({ groupName, newOwnerNodeId: incoming });
+    return { body, digest: txDigest(LEDGER.groups, outgoing, ttl, body, 0n) };
+}
+/** Refusals shared by every step, before any read: names and the outgoing/incoming distinction. */
+function validNames(groupName, outgoing, incoming) {
+    if (!isValidGroupName(groupName))
+        return refuse("groupName", "not a valid group name");
+    if (!isValidNodeId(outgoing))
+        return refuse("outgoingOwner", "not a valid identity id");
+    if (!isValidNodeId(incoming))
+        return refuse("incomingOwner", "not a valid identity id");
+    if (outgoing === incoming)
+        return refuse("incomingOwner", "the incoming owner equals the outgoing owner — the chain fines that rather than refusing it");
+    return null;
+}
+/** Chain facts the chain will itself enforce at apply (a mismatch is a FINE, too late to refuse):
+ *  the group's committed owner, and that the incoming owner is an existing identity, not a group. */
+async function checkChainFacts(reads, groupName, outgoing, incoming) {
+    try {
+        const listed = (await reads.listGroups()).find((g) => g.ledgerId === groupName);
+        if (listed === undefined)
+            return { kind: "not_found", what: `group "${groupName}"` };
+        if (listed.owner !== outgoing)
+            return refuse("outgoingOwner", `group "${groupName}" is owned by "${listed.owner}" at the node's applied state, not "${outgoing}"`);
+        if ((await reads.getGroup(incoming)) !== null)
+            return refuse("incomingOwner", `"${incoming}" is a group; only an identity can own a group`);
+        if ((await reads.getIdentity(incoming)) === null)
+            return { kind: "not_found", what: `identity "${incoming}" (incoming owner)` };
+    }
+    catch (e) {
+        return unreachable(e);
+    }
+    return null;
+}
+/** Freshness under the chain's own admit rule: `tip < ttl <= tip + max-ttl-offset`. */
+function checkFresh(tip, expiresAtRound) {
+    if (expiresAtRound <= tip)
+        return refuse("expiresAtRound", `expired: round ${expiresAtRound} is not after the current round ${tip}. Expiry is final; prepare a NEW transfer (a new txId) rather than reusing this one`);
+    if (expiresAtRound - tip > OWNERSHIP_TTL_MAX)
+        return refuse("expiresAtRound", `round ${expiresAtRound} is more than ${OWNERSHIP_TTL_MAX} rounds after the current round ${tip}; refused as over-long`);
+    return null;
+}
+/** The incoming owner's REGISTERED key for (identity, Ed25519, label), raw 32 bytes. Knowing a
+ *  public key is not authority; only the chain's registration of it for this identity is. */
+async function registeredEdKey(reads, who, keyLabel) {
+    let rows;
+    try {
+        rows = await reads.getIdentityKeys(who);
+    }
+    catch (e) {
+        return unreachable(e);
+    }
+    if (rows === null)
+        return { kind: "not_found", what: `identity "${who}"` };
+    const match = rows.filter((r) => r.keyType === CONSENT_KEY_TYPE && r.label === keyLabel);
+    if (match.length !== 1)
+        return refuse("consent.auth", `"${who}" has no single registered ${CONSENT_KEY_TYPE} key labelled "${keyLabel}" at the node's applied state (unknown_key on chain)`);
+    try {
+        return edSpkiToRaw(hexToBytes(match[0].publicKeyHex));
+    }
+    catch {
+        return refuse("consent.auth", `the registered ${CONSENT_KEY_TYPE} key for "${who}" is not a recognisable Ed25519 public key`);
+    }
+}
+/** Fail closed unless the CONNECTED node states it requires the sender's own AUTHORIZE auth.
+ *  Absent/null/false/non-boolean is unsupported (`partial`); a failed read is `unreachable`. */
+async function requireSenderAuthorizationNode(reads) {
+    let flag;
+    try {
+        flag = (await reads.nodeStatus()).senderAuthorizationRequired;
+    }
+    catch (e) {
+        return unreachable(e);
+    }
+    if (flag === true)
+        return null;
+    return refuse("node", "the connected node does not advertise senderAuthorizationRequired: true. On such a node the " +
+        "incoming owner's consent alone could be submitted as a transfer the outgoing owner never signed, " +
+        "so nothing is prepared, signed or returned. Use a node (and a chain) running the sender-authorization fix.");
+}
+async function tip(reads) {
+    try {
+        return await reads.currentRound();
+    }
+    catch (e) {
+        return unreachable(e);
+    }
+}
+/**
+ * PREPARE (outgoing owner). Signs nothing; returns the public intent for the incoming owner.
+ */
+export async function prepareOwnershipTransfer(deps, params) {
+    const groupName = str(params.groupName), incoming = str(params.incomingOwner), outgoing = deps.identity;
+    const bad = validNames(groupName, outgoing, incoming);
+    if (bad)
+        return bad;
+    const ttlRounds = params.ttlRounds === undefined ? OWNERSHIP_TTL_DEFAULT : params.ttlRounds;
+    if (typeof ttlRounds !== "number" || !Number.isSafeInteger(ttlRounds) || ttlRounds < 1 || ttlRounds > OWNERSHIP_TTL_MAX)
+        return refuse("ttlRounds", `must be an integer 1..${OWNERSHIP_TTL_MAX} (the node's default max-ttl-offset)`);
+    const policy = await requireSenderAuthorizationNode(deps.reads);
+    if (policy)
+        return policy;
+    const facts = await checkChainFacts(deps.reads, groupName, outgoing, incoming);
+    if (facts)
+        return facts;
+    const now = await tip(deps.reads);
+    if (typeof now !== "number")
+        return now;
+    const expiresAtRound = now + ttlRounds;
+    const id = hex(digestFor(outgoing, groupName, incoming, expiresAtRound).digest);
+    const fields = { ledgerId: LEDGER.groups, groupName, outgoingOwner: outgoing, incomingOwner: incoming, maxToll: "0" };
+    const pending = {
+        txId: id, expiresAtRound, preparedAtRound: now, verb: "group_ownership_transfer_pending", fields,
+        summary: { sender: outgoing, ...fields },
+        status: "awaiting incoming-owner consent: NOT signed by this session and NOT submittable",
+    };
+    if (recordedById(id) !== undefined || pendingOwnershipById(id) !== undefined)
+        return refuse("txId", `transfer ${id} is already prepared or finalized in this session`);
+    pruneExpiredPendingOwnership(now);
+    if (!recordPendingOwnership(pending))
+        return refuse("pending", `at most ${MAX_PENDING_OWNERSHIP} prepared transfers may await consent per session`);
+    return {
+        kind: "ok",
+        value: {
+            kind: INTENT_KIND, txId: id, ...fields, maxToll: "0", expiresAtRound, preparedAtRound: now,
+            next: `Send these public fields to "${incoming}". Their own MCP session calls evolver_group_ownership_consent ` +
+                `with them; then call evolver_group_ownership_finalize here with the returned consent before round ${expiresAtRound}.`,
+        },
+    };
+}
+/**
+ * CONSENT (incoming owner). Recomputes the intent's txId and signs it with THIS session's key.
+ */
+export async function consentOwnershipTransfer(deps, params) {
+    const groupName = str(params.groupName), outgoing = str(params.outgoingOwner), incoming = str(params.incomingOwner);
+    const claimedId = str(params.txId).toLowerCase();
+    const expiresAtRound = params.expiresAtRound;
+    if (incoming !== deps.identity)
+        return refuse("incomingOwner", `this session signs as "${deps.identity}", not "${incoming || "(empty)"}"; only the incoming owner's own session can consent`);
+    const bad = validNames(groupName, outgoing, incoming);
+    if (bad)
+        return bad;
+    if (typeof expiresAtRound !== "number" || !Number.isSafeInteger(expiresAtRound) || expiresAtRound < 1)
+        return refuse("expiresAtRound", "must be a positive integer round");
+    if (!/^[0-9a-f]{64}$/.test(claimedId))
+        return refuse("txId", "must be the 64-character hex txId from the intent");
+    if (deps.signer.keyType !== CONSENT_KEY_TYPE)
+        return refuse("signer", `this session's key is ${deps.signer.keyType}; the outgoing owner can verify only ${CONSENT_KEY_TYPE} consent ` +
+            `(SDK 0.21.0 exports no BLS verify). Use a session configured with this identity's registered Ed25519 key (EVOLVER_KEY_TYPE=ed25519). Nothing was signed.`);
+    const { digest } = digestFor(outgoing, groupName, incoming, expiresAtRound);
+    if (hex(digest) !== claimedId)
+        return refuse("txId", `the intent's txId ${namedInRefusal(claimedId)} does not match the transfer these fields describe; nothing was signed`);
+    // Before signing: an old node would let this consent stand alone as the sender's transfer.
+    const policy = await requireSenderAuthorizationNode(deps.reads);
+    if (policy)
+        return policy;
+    const now = await tip(deps.reads);
+    if (typeof now !== "number")
+        return now;
+    const stale = checkFresh(now, expiresAtRound);
+    if (stale)
+        return stale;
+    const facts = await checkChainFacts(deps.reads, groupName, outgoing, incoming);
+    if (facts)
+        return facts;
+    // The configured key must be the one the chain will verify against: sign, then check our own
+    // signature against the registered key, so a wrong key file fails here rather than at admit.
+    const pub = await registeredEdKey(deps.reads, incoming, deps.signer.keyLabel);
+    if (!(pub instanceof Uint8Array))
+        return pub;
+    const signature = deps.signer.sign(digest);
+    if (!edVerify(digest, signature, pub))
+        return refuse("signer", `this session's Ed25519 key is not the key registered for "${incoming}"; the consent was discarded`);
+    return {
+        kind: "ok",
+        value: {
+            kind: CONSENT_KIND, txId: claimedId, ledgerId: LEDGER.groups, groupName, outgoingOwner: outgoing,
+            incomingOwner: incoming, expiresAtRound, maxToll: "0",
+            auth: { nodeId: incoming, keyType: deps.signer.keyType, keyLabel: deps.signer.keyLabel, purpose: PURPOSE, signatureHex: hex(signature) },
+            next: `Return this consent to "${outgoing}". It authorizes ONLY txId ${claimedId}, which expires at round ` +
+                `${expiresAtRound}; it does not submit anything and cannot be used for any other operation.`,
+        },
+    };
+}
+/**
+ * FINALIZE (outgoing owner). Verifies the consent, signs as sender, assembles both auths, records.
+ */
+export async function finalizeOwnershipTransfer(deps, params) {
+    const id = str(params.txId).toLowerCase();
+    if (recordedById(id) !== undefined)
+        return refuse("txId", `transfer ${namedInRefusal(id)} is already finalized in this session; submit or reconcile that id, never finalize again`);
+    const pending = pendingOwnershipById(id);
+    if (pending === undefined)
+        return refuse("txId", `no transfer ${namedInRefusal(id)} was prepared by this session; only a transfer prepared here can be finalized`);
+    const f = pending.fields;
+    if (f.outgoingOwner !== deps.identity)
+        return refuse("txId", "prepared for a different sender");
+    // The consent must describe exactly the prepared intent — every field, not just the id.
+    const c = (typeof params.consent === "object" && params.consent !== null ? params.consent : {});
+    const a = (typeof c["auth"] === "object" && c["auth"] !== null ? c["auth"] : {});
+    if (c["kind"] !== CONSENT_KIND)
+        return refuse("consent.kind", `must be "${CONSENT_KIND}"`);
+    // Hex case carries no meaning; compare the canonical lowercase form (the id is already lowercase).
+    const consentId = typeof c["txId"] === "string" ? c["txId"].trim().toLowerCase() : c["txId"];
+    const mismatch = [
+        ["txId", consentId, id], ["ledgerId", c["ledgerId"], f.ledgerId], ["groupName", c["groupName"], f.groupName],
+        ["outgoingOwner", c["outgoingOwner"], f.outgoingOwner], ["incomingOwner", c["incomingOwner"], f.incomingOwner],
+        ["expiresAtRound", c["expiresAtRound"], pending.expiresAtRound], ["maxToll", c["maxToll"], f.maxToll],
+        ["auth.nodeId", a["nodeId"], f.incomingOwner], ["auth.purpose", a["purpose"], PURPOSE],
+    ].find(([, got, want]) => got !== want);
+    if (mismatch)
+        return refuse(`consent.${mismatch[0]}`, "does not match the prepared transfer (wrong intent, principal or purpose); nothing was signed");
+    const keyType = a["keyType"], keyLabel = a["keyLabel"], sigHex = a["signatureHex"];
+    if (keyType !== CONSENT_KEY_TYPE)
+        return refuse("consent.auth.keyType", `only ${CONSENT_KEY_TYPE} consent can be verified (SDK 0.21.0 exports no BLS verify); nothing was signed`);
+    if (typeof keyLabel !== "string" || keyLabel.length > MAX_LABEL)
+        return refuse("consent.auth.keyLabel", "must be a string of at most 128 characters");
+    if (typeof sigHex !== "string" || !/^[0-9a-f]{128}$/.test(sigHex))
+        return refuse("consent.auth.signatureHex", "must be a 64-byte Ed25519 signature as lowercase hex");
+    // Re-derive the digest from the prepared fields with the SDK: the id must still be the intent.
+    const { body, digest } = digestFor(f.outgoingOwner, f.groupName, f.incomingOwner, pending.expiresAtRound);
+    if (hex(digest) !== id)
+        return refuse("txId", "the prepared fields no longer derive this txId; refused");
+    // Rechecked at finalization: the session may now be pointed at (or answered by) an older node.
+    const policy = await requireSenderAuthorizationNode(deps.reads);
+    if (policy)
+        return policy;
+    const now = await tip(deps.reads);
+    if (typeof now !== "number")
+        return now;
+    const stale = checkFresh(now, pending.expiresAtRound);
+    if (stale)
+        return stale;
+    const facts = await checkChainFacts(deps.reads, f.groupName, f.outgoingOwner, f.incomingOwner);
+    if (facts)
+        return facts;
+    const pub = await registeredEdKey(deps.reads, f.incomingOwner, keyLabel);
+    if (!(pub instanceof Uint8Array))
+        return pub;
+    if (!edVerify(digest, hexToBytes(sigHex), pub))
+        return refuse("consent.auth.signatureHex", `does not verify for txId ${id} under "${f.incomingOwner}"'s registered ${CONSENT_KEY_TYPE} key; nothing was signed`);
+    // Verified. Sign as sender (empty node_id ⇒ the sender) and assemble with the SDK encoder.
+    const auths = [
+        { keyType: deps.signer.keyType, keyLabel: deps.signer.keyLabel, nodeId: "", signature: deps.signer.sign(digest) },
+        { keyType: CONSENT_KEY_TYPE, keyLabel, nodeId: f.incomingOwner, signature: hexToBytes(sigHex) },
+    ];
+    const bytes = encodeSignedTx({ ledgerId: LEDGER.groups, senderNodeId: f.outgoingOwner, body, ttlRound: pending.expiresAtRound, auths, maxToll: 0n });
+    const fields = {
+        groupName: f.groupName, outgoingOwner: f.outgoingOwner, incomingOwner: f.incomingOwner, maxToll: "0",
+        outgoingAuth: `${f.outgoingOwner} ${deps.signer.keyType} label="${deps.signer.keyLabel}"`,
+        incomingAuth: `${f.incomingOwner} ${CONSENT_KEY_TYPE} label="${keyLabel}" (verified against registered key at round ${now})`,
+    };
+    const signed = {
+        txId: id, expiresAtRound: pending.expiresAtRound, signedAtRound: now, verb: "group_ownership_transfer",
+        fields, summary: { sender: f.outgoingOwner, ...fields },
+    };
+    if (!recordAssembledOnce(signed, bytes))
+        return refuse("txId", `transfer ${id} is already recorded in this session; nothing was replaced`);
+    dropPendingOwnership(id);
+    return { kind: "ok", value: signed };
+}
+//# sourceMappingURL=group-ownership.js.map

package/dist/group-ownership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-ownership.js","sourceRoot":"","sources":["../src/group-ownership.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,uGAAuG;AACvG,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,iGAAiG;AACjG,yFAAyF;AACzF,EAAE;AACF,oGAAoG;AACpG,qGAAqG;AACrG,mGAAmG;AACnG,mGAAmG;AACnG,+DAA+D;AAC/D,gGAAgG;AAChG,kGAAkG;AAClG,sEAAsE;AACtE,uEAAuE;AACvE,EAAE;AACF,gGAAgG;AAChG,oGAAoG;AACpG,mGAAmG;AACnG,2BAA2B;AAC3B,EAAE;AACF,gGAAgG;AAChG,4FAA4F;AAC5F,qGAAqG;AACrG,6FAA6F;AAC7F,8FAA8F;AAC9F,EAAE;AACF,8FAA8F;AAC9F,mGAAmG;AACnG,EAAE;AACF,iGAAiG;AACjG,kGAAkG;AAClG,oGAAoG;AACpG,2FAA2F;AAC3F,gGAAgG;AAChG,+FAA+F;AAC/F,kGAAkG;AAClG,8FAA8F;AAE9F,OAAO,EACL,MAAM,EACN,cAAc,EACd,IAAI,IAAI,QAAQ,EAChB,0BAA0B,EAC1B,gBAAgB,EAChB,aAAa,EACb,UAAU,EACV,QAAQ,EACR,WAAW,GACZ,MAAM,8BAA8B,CAAC;AAItC,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,4BAA4B,EAC5B,YAAY,EACZ,cAAc,EACd,qBAAqB,GACtB,MAAM,YAAY,CAAC;AASpB;;;;4FAI4F;AAC5F,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AACrC,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAExC,qFAAqF;AACrF,MAAM,CAAC,MAAM,gBAAgB,GAAG,SAAS,CAAC;AAC1C,MAAM,CAAC,MAAM,WAAW,GAAG,mCAAmC,CAAC;AAC/D,MAAM,CAAC,MAAM,YAAY,GAAG,oCAAoC,CAAC;AACjE,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,0DAA0D;AACvF,MAAM,SAAS,GAAG,GAAG,CAAC;AA+BtB,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,KAAa,EAAqB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACtG,MAAM,WAAW,GAAG,CAAC,CAAU,EAAqB,EAAE,CACpD,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC1F,MAAM,GAAG,GAAG,CAAC,CAAa,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACtE,MAAM,GAAG,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAE5E;0FAC0F;AAC1F,SAAS,SAAS,CAAC,QAAgB,EAAE,SAAiB,EAAE,QAAgB,EAAE,GAAW;IACnF,MAAM,IAAI,GAAG,0BAA0B,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,mGAAmG;AACnG,SAAS,UAAU,CAAC,SAAiB,EAAE,QAAgB,EAAE,QAAgB;IACvE,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC;IACvF,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IACxF,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IACxF,IAAI,QAAQ,KAAK,QAAQ;QACvB,OAAO,MAAM,CAAC,eAAe,EAAE,6FAA6F,CAAC,CAAC;IAChI,OAAO,IAAI,CAAC;AACd,CAAC;AAED;qGACqG;AACrG,KAAK,UAAU,eAAe,CAAC,KAAiB,EAAE,SAAiB,EAAE,QAAgB,EAAE,QAAgB;IACrG,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;QAChF,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,SAAS,GAAG,EAAE,CAAC;QACrF,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ;YAC3B,OAAO,MAAM,CAAC,eAAe,EAAE,UAAU,SAAS,kBAAkB,MAAM,CAAC,KAAK,uCAAuC,QAAQ,GAAG,CAAC,CAAC;QACtI,IAAI,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI;YAC3C,OAAO,MAAM,CAAC,eAAe,EAAE,IAAI,QAAQ,gDAAgD,CAAC,CAAC;QAC/F,IAAI,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI;YAC9C,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,QAAQ,oBAAoB,EAAE,CAAC;IAClF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uFAAuF;AACvF,SAAS,UAAU,CAAC,GAAW,EAAE,cAAsB;IACrD,IAAI,cAAc,IAAI,GAAG;QACvB,OAAO,MAAM,CAAC,gBAAgB,EAAE,kBAAkB,cAAc,mCAAmC,GAAG,qFAAqF,CAAC,CAAC;IAC/L,IAAI,cAAc,GAAG,GAAG,GAAG,iBAAiB;QAC1C,OAAO,MAAM,CAAC,gBAAgB,EAAE,SAAS,cAAc,iBAAiB,iBAAiB,mCAAmC,GAAG,wBAAwB,CAAC,CAAC;IAC3J,OAAO,IAAI,CAAC;AACd,CAAC;AAED;6FAC6F;AAC7F,KAAK,UAAU,eAAe,CAAC,KAAiB,EAAE,GAAW,EAAE,QAAgB;IAC7E,IAAI,IAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,GAAG,GAAG,EAAE,CAAC;IAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,gBAAgB,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC;IACzF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QACpB,OAAO,MAAM,CAAC,cAAc,EAAE,IAAI,GAAG,8BAA8B,gBAAgB,kBAAkB,QAAQ,sDAAsD,CAAC,CAAC;IACvK,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,cAAc,EAAE,kBAAkB,gBAAgB,aAAa,GAAG,4CAA4C,CAAC,CAAC;IAChI,CAAC;AACH,CAAC;AAED;gGACgG;AAChG,KAAK,UAAU,8BAA8B,CAAC,KAAiB;IAC7D,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,2BAA2B,CAAC;IAChE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,MAAM,CAAC,MAAM,EAClB,8FAA8F;QAC9F,mGAAmG;QACnG,4GAA4G,CAAC,CAAC;AAClH,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,KAAiB;IAClC,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAmB,EACnB,MAA2E;IAE3E,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IACxG,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACtD,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IAC5F,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,iBAAiB;QACrH,OAAO,MAAM,CAAC,WAAW,EAAE,yBAAyB,iBAAiB,sCAAsC,CAAC,CAAC;IAE/G,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/E,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAExC,MAAM,cAAc,GAAG,GAAG,GAAG,SAAS,CAAC;IACvC,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;IAChF,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IACtH,MAAM,OAAO,GAA6B;QACxC,IAAI,EAAE,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,EAAE,kCAAkC,EAAE,MAAM;QAChG,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE;QACxC,MAAM,EAAE,iFAAiF;KAC1F,CAAC;IACF,IAAI,YAAY,CAAC,EAAE,CAAC,KAAK,SAAS,IAAI,oBAAoB,CAAC,EAAE,CAAC,KAAK,SAAS;QAC1E,OAAO,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,mDAAmD,CAAC,CAAC;IAC3F,4BAA4B,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC;QAClC,OAAO,MAAM,CAAC,SAAS,EAAE,WAAW,qBAAqB,mDAAmD,CAAC,CAAC;IAChH,OAAO;QACL,IAAI,EAAE,IAAI;QACV,KAAK,EAAE;YACL,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG;YAC1F,IAAI,EAAE,gCAAgC,QAAQ,iEAAiE;gBAC7G,qGAAqG,cAAc,GAAG;SACzH;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAmB,EACnB,MAAsH;IAEtH,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACpH,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;IAC7C,IAAI,QAAQ,KAAK,IAAI,CAAC,QAAQ;QAC5B,OAAO,MAAM,CAAC,eAAe,EAAE,0BAA0B,IAAI,CAAC,QAAQ,WAAW,QAAQ,IAAI,SAAS,sDAAsD,CAAC,CAAC;IAChK,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACtD,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC;QACnG,OAAO,MAAM,CAAC,gBAAgB,EAAE,kCAAkC,CAAC,CAAC;IACtE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,mDAAmD,CAAC,CAAC;IAClH,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,gBAAgB;QAC1C,OAAO,MAAM,CAAC,QAAQ,EAAE,yBAAyB,IAAI,CAAC,MAAM,CAAC,OAAO,wCAAwC,gBAAgB,WAAW;YACrI,0JAA0J,CAAC,CAAC;IAEhK,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC5E,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS;QAC3B,OAAO,MAAM,CAAC,MAAM,EAAE,qBAAqB,cAAc,CAAC,SAAS,CAAC,wEAAwE,CAAC,CAAC;IAEhJ,2FAA2F;IAC3F,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC9C,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/E,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,6FAA6F;IAC7F,6FAA6F;IAC7F,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9E,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC;QAAE,OAAO,GAAG,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC;QACnC,OAAO,MAAM,CAAC,QAAQ,EAAE,6DAA6D,QAAQ,8BAA8B,CAAC,CAAC;IAE/H,OAAO;QACL,IAAI,EAAE,IAAI;QACV,KAAK,EAAE;YACL,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ;YAChG,aAAa,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG;YACrD,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE;YACxI,IAAI,EAAE,2BAA2B,QAAQ,8BAA8B,SAAS,2BAA2B;gBACzG,GAAG,cAAc,2EAA2E;SAC/F;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAAmB,EACnB,MAA2C;IAE3C,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,YAAY,CAAC,EAAE,CAAC,KAAK,SAAS;QAChC,OAAO,MAAM,CAAC,MAAM,EAAE,YAAY,cAAc,CAAC,EAAE,CAAC,0FAA0F,CAAC,CAAC;IAClJ,MAAM,OAAO,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,SAAS;QACvB,OAAO,MAAM,CAAC,MAAM,EAAE,eAAe,cAAc,CAAC,EAAE,CAAC,+EAA+E,CAAC,CAAC;IAC1I,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC;IAEhG,wFAAwF;IACxF,MAAM,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;IAC3H,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;IAC5G,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,YAAY;QAAE,OAAO,MAAM,CAAC,cAAc,EAAE,YAAY,YAAY,GAAG,CAAC,CAAC;IAC3F,mGAAmG;IACnG,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7F,MAAM,QAAQ,GAAI;QAChB,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;QAC5G,CAAC,eAAe,EAAE,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC;QAC9G,CAAC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;QACrG,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;KAC7E,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IAClD,IAAI,QAAQ;QACV,OAAO,MAAM,CAAC,WAAW,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,+FAA+F,CAAC,CAAC;IAC3I,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC;IACnF,IAAI,OAAO,KAAK,gBAAgB;QAC9B,OAAO,MAAM,CAAC,sBAAsB,EAAE,QAAQ,gBAAgB,iFAAiF,CAAC,CAAC;IACnJ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,SAAS;QAAE,OAAO,MAAM,CAAC,uBAAuB,EAAE,4CAA4C,CAAC,CAAC;IACtJ,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,2BAA2B,EAAE,sDAAsD,CAAC,CAAC;IAEtK,+FAA+F;IAC/F,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAC1G,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,yDAAyD,CAAC,CAAC;IAEzG,+FAA+F;IAC/F,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACtD,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC;IAC/F,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IACzE,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC;QAAE,OAAO,GAAG,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC;QAC5C,OAAO,MAAM,CAAC,2BAA2B,EAAE,4BAA4B,EAAE,WAAW,CAAC,CAAC,aAAa,kBAAkB,gBAAgB,0BAA0B,CAAC,CAAC;IAEnK,2FAA2F;IAC3F,MAAM,KAAK,GAAW;QACpB,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;QACjH,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,aAAa,EAAE,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE;KAChG,CAAC;IACF,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IACrJ,MAAM,MAAM,GAAG;QACb,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,GAAG;QACpG,YAAY,EAAE,GAAG,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG;QACzF,YAAY,EAAE,GAAG,CAAC,CAAC,aAAa,IAAI,gBAAgB,WAAW,QAAQ,+CAA+C,GAAG,GAAG;KAC7H,CAAC;IACF,MAAM,MAAM,GAAgB;QAC1B,IAAI,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,EAAE,0BAA0B;QACtG,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,aAAa,EAAE,GAAG,MAAM,EAAE;KACxD,CAAC;IACF,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC;QACrC,OAAO,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,4DAA4D,CAAC,CAAC;IACpG,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACzB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC"}

package/dist/group.d.ts

@@ -46,8 +46,8 @@ export declare function signRemoveMember(deps: GroupOpsDeps, params: {
 /**
  * Multi-recipient credit transfer (SIGN-02): move credit from the signing identity to 1..20
  * recipients. This is the plain `transferBody` on `LEDGER.identity` — NOT a group-membership encoder
- * and NOT an ownership transfer (group ownership transfer is deferred to v2; it always fines
- * "missing co-signer auth"). "One verb = one tx"; the multi-entry array is the ONE thing that
+ * and NOT an ownership transfer (that needs the incoming owner's co-signature and lives in
+ * `src/group-ownership.ts`). "One verb = one tx"; the multi-entry array is the ONE thing that
  * distinguishes it from the singleton `evolver_sign_transfer`. Order is significant — it decides
  * which transfer survives a short-balance apply.
  */

package/dist/group.js

@@ -155,8 +155,8 @@ export async function signRemoveMember(deps, params) {
 /**
  * Multi-recipient credit transfer (SIGN-02): move credit from the signing identity to 1..20
  * recipients. This is the plain `transferBody` on `LEDGER.identity` — NOT a group-membership encoder
- * and NOT an ownership transfer (group ownership transfer is deferred to v2; it always fines
- * "missing co-signer auth"). "One verb = one tx"; the multi-entry array is the ONE thing that
+ * and NOT an ownership transfer (that needs the incoming owner's co-signature and lives in
+ * `src/group-ownership.ts`). "One verb = one tx"; the multi-entry array is the ONE thing that
  * distinguishes it from the singleton `evolver_sign_transfer`. Order is significant — it decides
  * which transfer survives a short-balance apply.
  */
@@ -193,7 +193,7 @@ export async function signGroupTransfer(deps, params) {
         fields[`amount.${i}`] = formatAmount(parsed[i].amount);
     }
     return composeAndSign(deps, {
-        ledgerId: LEDGER.identity, // NOT groups — credit lives on identities (ownership transfer is deferred to v2)
+        ledgerId: LEDGER.identity, // NOT groups — credit lives on identities (ownership: src/group-ownership.ts)
         body: transferBody(parsed.map((e) => ({ recipient: e.recipient, amount: e.amount }))),
         ttlRound: expiresAtRound,
         signedAtRound: tip,

package/dist/group.js.map

@@ -1 +1 @@
-{"version":3,"file":"group.js","sourceRoot":"","sources":["../src/group.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,iGAAiG;AACjG,qGAAqG;AACrG,EAAE;AACF,oGAAoG;AACpG,iGAAiG;AACjG,+FAA+F;AAC/F,qGAAqG;AACrG,mGAAmG;AACnG,kBAAkB;AAClB,EAAE;AACF,oGAAoG;AACpG,qFAAqF;AAErF,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACvI,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAExD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAgBhE;cACc;AACd,KAAK,UAAU,gBAAgB,CAAC,IAAkB;IAChD,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;IACzC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,CAAC;AACH,CAAC;AAED,wGAAwG;AACxG,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAkB,EAClB,MAAwB;IAExB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,IAAI,IAAI,8GAA8G;SAC9H,CAAC;IAEJ,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,MAAM,cAAc,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;IAEpE,OAAO,cAAc,CAAC,IAAI,EAAE;QAC1B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,mCAAmC;QAC5D,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;QAC3B,QAAQ,EAAE,cAAc;QACxB,aAAa,EAAE,GAAG;QAClB,IAAI,EAAE,cAAc;QACpB,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;KAC5B,CAAoB,CAAC;AACxB,CAAC;AAED;6EAC6E;AAC7E,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,IAAI,IAAI,8GAA8G;SAC9H,CAAC;IACJ,OAAO,IAAI,CAAC;AACd,CAAC;AAED;+FAC+F;AAC/F,SAAS,aAAa,CAAC,YAAoB,EAAE,QAAgB;IAC3D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAChF,IAAI,YAAY,KAAK,QAAQ;QAC3B,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,uBAAuB,QAAQ,mGAAmG;SAC1I,CAAC;IACJ,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC;QAC9B,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,IAAI,YAAY,yGAAyG;SACjI,CAAC;IACJ,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAkB,EAClB,MAAwB;IAExB,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACnE,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEpD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,MAAM,cAAc,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;IAEpE,OAAO,cAAc,CAAC,IAAI,EAAE;QAC1B,QAAQ,EAAE,MAAM,CAAC,MAAM;QACvB,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC;QAChC,QAAQ,EAAE,cAAc;QACxB,aAAa,EAAE,GAAG;QAClB,IAAI,EAAE,cAAc;QACpB,MAAM,EAAE,EAAE,SAAS,EAAE;KACtB,CAAoB,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAkB,EAClB,MAAmD;IAEnD,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxE,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtF,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAE9C,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,MAAM,cAAc,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;IAEpE,OAAO,cAAc,CAAC,IAAI,EAAE;QAC1B,QAAQ,EAAE,MAAM,CAAC,MAAM;QACvB,IAAI,EAAE,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC;QACtC,QAAQ,EAAE,cAAc;QACxB,aAAa,EAAE,GAAG;QAClB,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE;KAC5C,CAAoB,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAkB,EAClB,MAAmD;IAEnD,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxE,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtF,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAE9C,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,MAAM,cAAc,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;IAEpE,OAAO,cAAc,CAAC,IAAI,EAAE;QAC1B,QAAQ,EAAE,MAAM,CAAC,MAAM;QACvB,IAAI,EAAE,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC;QACzC,QAAQ,EAAE,cAAc;QACxB,aAAa,EAAE,GAAG;QAClB,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE;KAC5C,CAAoB,CAAC;AACxB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAkB,EAClB,MAAiE;IAEjE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;IAChG,IAAI,OAAO,CAAC,MAAM,GAAG,oBAAoB;QACvC,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,WAAW,oBAAoB,qDAAqD,OAAO,CAAC,MAAM,EAAE;SAC5G,CAAC;IAEJ,iGAAiG;IACjG,6EAA6E;IAC7E,MAAM,MAAM,GAAiD,EAAE,CAAC;IAChE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YACxB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,CAAC,YAAY,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QAC1F,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,EAAE;YACZ,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC/E,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,MAAM,cAAc,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;IAEpE,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/C,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,cAAc,CAAC,IAAI,EAAE;QAC1B,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,iFAAiF;QAC5G,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACrF,QAAQ,EAAE,cAAc;QACxB,aAAa,EAAE,GAAG;QAClB,IAAI,EAAE,gBAAgB;QACtB,MAAM;KACP,CAAoB,CAAC;AACxB,CAAC"}
+{"version":3,"file":"group.js","sourceRoot":"","sources":["../src/group.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,iGAAiG;AACjG,qGAAqG;AACrG,EAAE;AACF,oGAAoG;AACpG,iGAAiG;AACjG,+FAA+F;AAC/F,qGAAqG;AACrG,mGAAmG;AACnG,kBAAkB;AAClB,EAAE;AACF,oGAAoG;AACpG,qFAAqF;AAErF,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACvI,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAExD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAgBhE;cACc;AACd,KAAK,UAAU,gBAAgB,CAAC,IAAkB;IAChD,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;IACzC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,CAAC;AACH,CAAC;AAED,wGAAwG;AACxG,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAkB,EAClB,MAAwB;IAExB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,IAAI,IAAI,8GAA8G;SAC9H,CAAC;IAEJ,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,MAAM,cAAc,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;IAEpE,OAAO,cAAc,CAAC,IAAI,EAAE;QAC1B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,mCAAmC;QAC5D,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;QAC3B,QAAQ,EAAE,cAAc;QACxB,aAAa,EAAE,GAAG;QAClB,IAAI,EAAE,cAAc;QACpB,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;KAC5B,CAAoB,CAAC;AACxB,CAAC;AAED;6EAC6E;AAC7E,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,IAAI,IAAI,8GAA8G;SAC9H,CAAC;IACJ,OAAO,IAAI,CAAC;AACd,CAAC;AAED;+FAC+F;AAC/F,SAAS,aAAa,CAAC,YAAoB,EAAE,QAAgB;IAC3D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAChF,IAAI,YAAY,KAAK,QAAQ;QAC3B,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,uBAAuB,QAAQ,mGAAmG;SAC1I,CAAC;IACJ,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC;QAC9B,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,IAAI,YAAY,yGAAyG;SACjI,CAAC;IACJ,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAkB,EAClB,MAAwB;IAExB,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACnE,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEpD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,MAAM,cAAc,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;IAEpE,OAAO,cAAc,CAAC,IAAI,EAAE;QAC1B,QAAQ,EAAE,MAAM,CAAC,MAAM;QACvB,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC;QAChC,QAAQ,EAAE,cAAc;QACxB,aAAa,EAAE,GAAG;QAClB,IAAI,EAAE,cAAc;QACpB,MAAM,EAAE,EAAE,SAAS,EAAE;KACtB,CAAoB,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAkB,EAClB,MAAmD;IAEnD,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxE,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtF,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAE9C,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,MAAM,cAAc,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;IAEpE,OAAO,cAAc,CAAC,IAAI,EAAE;QAC1B,QAAQ,EAAE,MAAM,CAAC,MAAM;QACvB,IAAI,EAAE,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC;QACtC,QAAQ,EAAE,cAAc;QACxB,aAAa,EAAE,GAAG;QAClB,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE;KAC5C,CAAoB,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAkB,EAClB,MAAmD;IAEnD,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxE,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtF,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAE9C,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,MAAM,cAAc,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;IAEpE,OAAO,cAAc,CAAC,IAAI,EAAE;QAC1B,QAAQ,EAAE,MAAM,CAAC,MAAM;QACvB,IAAI,EAAE,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC;QACzC,QAAQ,EAAE,cAAc;QACxB,aAAa,EAAE,GAAG;QAClB,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE;KAC5C,CAAoB,CAAC;AACxB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAkB,EAClB,MAAiE;IAEjE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;IAChG,IAAI,OAAO,CAAC,MAAM,GAAG,oBAAoB;QACvC,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,WAAW,oBAAoB,qDAAqD,OAAO,CAAC,MAAM,EAAE;SAC5G,CAAC;IAEJ,iGAAiG;IACjG,6EAA6E;IAC7E,MAAM,MAAM,GAAiD,EAAE,CAAC;IAChE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YACxB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,CAAC,YAAY,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QAC1F,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,EAAE;YACZ,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC/E,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,MAAM,cAAc,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;IAEpE,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/C,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,cAAc,CAAC,IAAI,EAAE;QAC1B,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,8EAA8E;QACzG,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACrF,QAAQ,EAAE,cAAc;QACxB,aAAa,EAAE,GAAG;QAClB,IAAI,EAAE,gBAAgB;QACtB,MAAM;KACP,CAAoB,CAAC;AACxB,CAAC"}

package/dist/http-profiles.d.ts

@@ -0,0 +1,47 @@
+import type { SignedRequestParams } from "@mcsherrylabs/evolver-client";
+export declare const HTTP_METHODS: readonly ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"];
+export interface HttpProfile {
+    readonly name: string;
+    readonly principal: string;
+    readonly keyLabel: string;
+    readonly audience: string;
+    readonly origin: string;
+    readonly targets: readonly {
+        path: string;
+        methods: readonly string[];
+    }[];
+    readonly maxTtlSeconds: number;
+    readonly challengeUrl?: string;
+    /** Exact trusted local addresses, validated/resolved/pinned by the published SDK transport.
+     * No MCP DNS/IP classification or generic allowLocal flag. Never permit metadata/link-local. */
+    readonly localAddresses?: readonly string[];
+    /** Additional exact host IP refusals; SDK checks these before any local opt-in. */
+    readonly denyAddresses?: readonly string[];
+    /** Independent public relying-service CA trust; never inherit node insecure TLS. */
+    readonly caPem?: string;
+}
+export type HttpProfilesResult = {
+    ok: true;
+    profiles: readonly HttpProfile[];
+} | {
+    ok: false;
+    error: string;
+};
+export interface HttpHeader {
+    readonly name: string;
+    readonly value: string;
+}
+export declare const HTTP_MAX_TEMPLATE_BYTES = 4096;
+export declare const HTTP_MAX_HEADER_BYTES = 8192;
+/** Canonical EXACT endpoints only. Reject all percent encoding rather than guessing how a remote
+ * router, proxy or framework normalizes it. No query, fragment, placeholder, userinfo or backslash. */
+export declare function httpEndpoint(raw: unknown): URL;
+export declare function resolveHttpProfiles(raw: unknown): HttpProfilesResult;
+export declare function loadHttpProfilesFromEnv(env: NodeJS.ProcessEnv): HttpProfilesResult;
+export declare function validateHttpRequest(raw: unknown, profile: HttpProfile): {
+    ok: true;
+    request: SignedRequestParams["request"];
+} | {
+    ok: false;
+};
+//# sourceMappingURL=http-profiles.d.ts.map

package/dist/http-profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-profiles.d.ts","sourceRoot":"","sources":["../src/http-profiles.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAGxE,eAAO,MAAM,YAAY,uEAAwE,CAAC;AAClG,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IAC1E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;oGACgG;IAChG,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,mFAAmF;IACnF,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,oFAAoF;IACpF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AACD,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAC/G,MAAM,WAAW,UAAU;IAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAC7E,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAC5C,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAkB1C;uGACuG;AACvG,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,CAM9C;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,CAmCpE;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,kBAAkB,CASlF;AAcD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAyB7I"}

package/dist/http-profiles.js

@@ -0,0 +1,161 @@
+import { readFileSync, statSync } from "node:fs";
+import { isValidPrincipalName } from "@mcsherrylabs/evolver-client";
+// Exact request methods admitted by the reviewed SDK approved-request transport (0d724deb).
+export const HTTP_METHODS = ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"];
+export const HTTP_MAX_TEMPLATE_BYTES = 4096;
+export const HTTP_MAX_HEADER_BYTES = 8192;
+const object = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+const only = (v, allowed) => Object.keys(v).every(k => allowed.includes(k));
+function addressPolicy(raw) {
+    if (raw === undefined)
+        return undefined;
+    if (!Array.isArray(raw) || raw.length < 1 || raw.length > 8)
+        throw new Error();
+    const addresses = raw.map(ip => {
+        if (typeof ip !== "string" || !ip || ip.length > 64 || /[^\x21-\x7e]/.test(ip))
+            throw new Error();
+        return ip;
+    });
+    if (new Set(addresses).size !== addresses.length)
+        throw new Error();
+    return addresses; // Exact IP syntax/classification belongs only to the public SDK factory.
+}
+function pathAllowed(path) {
+    return path.startsWith("/") && path.length <= 1024 && !path.includes("//") &&
+        path.split("/").every((s, i, a) => (s === "" ? i === 0 || i === a.length - 1 : /^[A-Za-z0-9_.~-]+$/.test(s) && s !== "." && s !== ".."));
+}
+/** Canonical EXACT endpoints only. Reject all percent encoding rather than guessing how a remote
+ * router, proxy or framework normalizes it. No query, fragment, placeholder, userinfo or backslash. */
+export function httpEndpoint(raw) {
+    if (typeof raw !== "string" || raw.length > 2048 || /[^\x21-\x7e]|[%{}\\]/.test(raw))
+        throw new Error();
+    const url = new URL(raw);
+    if (!["https:", "http:"].includes(url.protocol) || url.username || url.password || url.search || url.hash ||
+        url.toString() !== raw || !pathAllowed(url.pathname))
+        throw new Error();
+    return url;
+}
+export function resolveHttpProfiles(raw) {
+    try {
+        if (!object(raw) || !only(raw, ["profiles"]) || !Array.isArray(raw.profiles) || raw.profiles.length > 16)
+            throw new Error();
+        const names = new Set();
+        const profiles = raw.profiles.map((v) => {
+            if (!object(v) || !only(v, ["name", "principal", "keyLabel", "audience", "origin", "targets", "maxTtlSeconds", "challengeUrl", "localAddresses", "denyAddresses", "caPem"]))
+                throw new Error();
+            if (typeof v.name !== "string" || !/^[a-z][a-z0-9-]{0,63}$/.test(v.name) || names.has(v.name))
+                throw new Error();
+            names.add(v.name);
+            if (typeof v.principal !== "string" || !isValidPrincipalName(v.principal) || typeof v.keyLabel !== "string" || v.keyLabel.length > 128 || /[^\x20-\x7e]/.test(v.keyLabel))
+                throw new Error();
+            if (typeof v.origin !== "string")
+                throw new Error();
+            const origin = httpEndpoint(v.origin + "/");
+            if (origin.origin !== v.origin || origin.pathname !== "/")
+                throw new Error();
+            if (typeof v.audience !== "string" || v.audience.length > 256 || ![origin.hostname, origin.origin].includes(v.audience))
+                throw new Error();
+            const local = addressPolicy(v.localAddresses), denied = addressPolicy(v.denyAddresses);
+            if (origin.protocol === "http:" && local === undefined)
+                throw new Error();
+            const caPem = v.caPem;
+            if (caPem !== undefined && (origin.protocol !== "https:" || typeof caPem !== "string" || Buffer.byteLength(caPem) > 16384 || !caPem.includes("-----BEGIN CERTIFICATE-----") || caPem.includes("PRIVATE KEY")))
+                throw new Error();
+            if (!Array.isArray(v.targets) || v.targets.length < 1 || v.targets.length > 16)
+                throw new Error();
+            const paths = new Set();
+            const targets = v.targets.map(t => {
+                if (!object(t) || !only(t, ["path", "methods"]) || typeof t.path !== "string" || !pathAllowed(t.path) || paths.has(t.path) ||
+                    !Array.isArray(t.methods) || t.methods.length < 1 || t.methods.length > HTTP_METHODS.length ||
+                    t.methods.some(m => !HTTP_METHODS.includes(m)) || new Set(t.methods).size !== t.methods.length)
+                    throw new Error();
+                paths.add(t.path);
+                return { path: t.path, methods: [...t.methods] };
+            });
+            if (typeof v.maxTtlSeconds !== "number" || !Number.isSafeInteger(v.maxTtlSeconds) || v.maxTtlSeconds < 1 || v.maxTtlSeconds > 300)
+                throw new Error();
+            const challenge = v.challengeUrl === undefined ? undefined : httpEndpoint(v.challengeUrl);
+            if (challenge && challenge.origin !== origin.origin)
+                throw new Error();
+            return { name: v.name, principal: v.principal, keyLabel: v.keyLabel, audience: v.audience, origin: origin.origin,
+                targets, maxTtlSeconds: v.maxTtlSeconds, ...(challenge ? { challengeUrl: challenge.toString() } : {}),
+                ...(local ? { localAddresses: [...local] } : {}), ...(denied ? { denyAddresses: [...denied] } : {}), ...(caPem ? { caPem } : {}) };
+        });
+        return { ok: true, profiles };
+    }
+    catch {
+        return { ok: false, error: "Invalid host HTTP profiles: require fixed canonical origin, matching audience/identity/Ed25519 label, exact endpoint/method targets and TTL 1..300. Plain HTTP requires an exact SDK-validated localAddresses policy; no generic local/private access is granted." };
+    }
+}
+export function loadHttpProfilesFromEnv(env) {
+    const path = env.EVOLVER_HTTP_PROFILES_PATH;
+    if (!path)
+        return { ok: true, profiles: [] };
+    try {
+        if (!statSync(path).isFile() || statSync(path).size > 65536)
+            throw new Error();
+        const text = readFileSync(path, "utf8");
+        if (Buffer.byteLength(text) > 65536)
+            throw new Error();
+        return resolveHttpProfiles(JSON.parse(text));
+    }
+    catch {
+        return { ok: false, error: "Cannot read bounded operator HTTP profiles from EVOLVER_HTTP_PROFILES_PATH; configure host policy and reload MCP." };
+    }
+}
+// Node20+ intrinsic: reject the same lone-surrogate loss that content.ts refuses, without
+// introducing a second UTF-8 encoder or changing the file owner's content module.
+const wellFormed = (s) => s.isWellFormed();
+function boundedJson(v, depth = 0, nodes = { count: 0 }) {
+    if (++nodes.count > 1024 || depth > 16)
+        return false;
+    if (typeof v === "string")
+        return wellFormed(v);
+    if (v === null || typeof v === "boolean")
+        return true;
+    if (typeof v === "number")
+        return Number.isFinite(v);
+    if (Array.isArray(v))
+        return v.every(x => boundedJson(x, depth + 1, nodes));
+    if (!object(v) || (Object.getPrototypeOf(v) !== Object.prototype && Object.getPrototypeOf(v) !== null))
+        return false;
+    return Object.entries(v).every(([k, x]) => wellFormed(k) && boundedJson(x, depth + 1, nodes));
+}
+export function validateHttpRequest(raw, profile) {
+    try {
+        if (!object(raw) || !only(raw, ["method", "url", "headers", "body"]) || typeof raw.method !== "string" || !HTTP_METHODS.includes(raw.method) ||
+            ((raw.method === "GET" || raw.method === "HEAD") && raw.body !== undefined))
+            throw new Error();
+        const url = httpEndpoint(raw.url);
+        if (url.origin !== profile.origin || !profile.targets.some(t => t.path === url.pathname && t.methods.includes(raw.method)))
+            throw new Error();
+        const hs = raw.headers ?? [];
+        if (!Array.isArray(hs) || hs.length > 16)
+            throw new Error();
+        const seen = new Set(), pairs = [];
+        let headerBytes = 0;
+        for (const h of hs) {
+            if (!object(h) || !only(h, ["name", "value"]) || typeof h.name !== "string" || typeof h.value !== "string" ||
+                !/^[!#$%&'*+.^_`|~0-9A-Za-z-]{1,128}$/.test(h.name) || !/^[\x20-\x7e]{0,1024}$/.test(h.value))
+                throw new Error();
+            const name = h.name.toLowerCase();
+            // Match ALL transport control/proxy refusals before approval/signing, plus host-only
+            // credential/referrer restrictions. DNS-only preflight cannot validate RequestInit.
+            if (seen.has(name) || ["__proto__", "host", "content-length", "transfer-encoding", "connection", "keep-alive", "te", "trailer", "upgrade", "expect", "http2-settings", "forwarded", "via", "accept-encoding", "cookie", "set-cookie", "origin", "referer"].includes(name) || name.startsWith("proxy-") || name.startsWith("x-forwarded-") ||
+                (name === "authorization" && !h.value.includes("{answer")))
+                throw new Error();
+            seen.add(name);
+            headerBytes += Buffer.byteLength(h.name + h.value) + 4;
+            pairs.push([h.name, h.value]);
+        }
+        if (headerBytes > HTTP_MAX_HEADER_BYTES)
+            throw new Error();
+        if (raw.body !== undefined && (!boundedJson(raw.body) || Buffer.byteLength(JSON.stringify(raw.body)) > HTTP_MAX_TEMPLATE_BYTES))
+            throw new Error();
+        return { ok: true, request: structuredClone({ method: raw.method, url: url.toString(), ...(pairs.length ? { headers: Object.fromEntries(pairs) } : {}), ...(raw.body === undefined ? {} : { body: raw.body }) }) };
+    }
+    catch {
+        return { ok: false };
+    }
+}
+//# sourceMappingURL=http-profiles.js.map