@mcsherrylabs/evolver-mcp 0.12.0 → 0.13.0

package/dist/group-key-provider.d.ts

@@ -0,0 +1,30 @@
+import type { GroupKeyUnwrapper } from "@mcsherrylabs/evolver-client";
+export interface GroupKeyRecipient {
+    readonly identity: string;
+    readonly keyType: "Ed25519" | "X25519";
+    readonly keyLabel: string;
+}
+/** Host policy + SDK decryption capability. NEVER inject the private seed or a Signer here.
+ * unwrap returns a symmetric key only to host code, which immediately puts it in GroupKeyHandles.
+ * These are process-owned policies, not client-supplied authorization assertions. */
+export interface GroupKeyProvider extends GroupKeyUnwrapper {
+    readonly identity: string;
+    readonly keyType: "Ed25519" | "X25519";
+    readonly keyLabel: string;
+    readonly scopes: readonly string[];
+    readonly approvedRecipients: readonly GroupKeyRecipient[];
+    readonly allowPlaintext: boolean;
+}
+export declare const validScope: (v: unknown) => v is string;
+export declare const validKeyLabel: (v: unknown) => v is string;
+/** Dedicated host secret file: absolute, no symlink, owned regular file, mode 0600/0400 only,
+ * at most 128 bytes, containing a 32-byte hex Ed seed or native X25519 scalar. No persistence
+ * of AES keys. Host admins must protect ancestor directories, backups, env and process memory. */
+export declare function loadGroupKeyProviderFromEnv(env: NodeJS.ProcessEnv, identity: string): {
+    ok: true;
+    provider?: GroupKeyProvider;
+} | {
+    ok: false;
+    error: string;
+};
+//# sourceMappingURL=group-key-provider.d.ts.map

package/dist/group-key-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-key-provider.d.ts","sourceRoot":"","sources":["../src/group-key-provider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEtE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,GAAG,QAAQ,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;qFAEqF;AACrF,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,GAAG,QAAQ,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,kBAAkB,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC1D,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AAED,eAAO,MAAM,UAAU,GAAI,GAAG,OAAO,KAAG,CAAC,IAAI,MAC2B,CAAC;AACzE,eAAO,MAAM,aAAa,GAAI,GAAG,OAAO,KAAG,CAAC,IAAI,MAC8B,CAAC;AAE/E;;kGAEkG;AAClG,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,GACvC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAgD1E"}

package/dist/group-key-provider.js

@@ -0,0 +1,72 @@
+// Explicit encryption capability, independent of Signer. This module never reads signer env.
+import { constants, openSync, fstatSync, readFileSync, closeSync } from "node:fs";
+import { isAbsolute } from "node:path";
+import { edGroupKeyUnwrapper, x25519GroupKeyUnwrapper, isValidPrincipalName } from "@mcsherrylabs/evolver-client";
+export const validScope = (v) => typeof v === "string" && /^[a-zA-Z0-9][a-zA-Z0-9._/-]{0,127}$/.test(v);
+export const validKeyLabel = (v) => typeof v === "string" && v.length <= 128 && !/[\u0000-\u001f\u007f]/.test(v);
+/** Dedicated host secret file: absolute, no symlink, owned regular file, mode 0600/0400 only,
+ * at most 128 bytes, containing a 32-byte hex Ed seed or native X25519 scalar. No persistence
+ * of AES keys. Host admins must protect ancestor directories, backups, env and process memory. */
+export function loadGroupKeyProviderFromEnv(env, identity) {
+    const names = ["KEY_FILE", "KEY_TYPE", "KEY_LABEL", "SCOPES", "RECIPIENTS", "ALLOW_PLAINTEXT"];
+    if (!names.some(n => env[`EVOLVER_GROUP_CRYPTO_${n}`] !== undefined))
+        return { ok: true };
+    let fd;
+    let secret;
+    try {
+        const path = env.EVOLVER_GROUP_CRYPTO_KEY_FILE;
+        const keyType = env.EVOLVER_GROUP_CRYPTO_KEY_TYPE;
+        const keyLabel = env.EVOLVER_GROUP_CRYPTO_KEY_LABEL ?? "";
+        if (!path || !isAbsolute(path) || !["Ed25519", "X25519"].includes(keyType ?? "") ||
+            !validKeyLabel(keyLabel) || !isValidPrincipalName(identity))
+            throw new Error();
+        const scopes = JSON.parse(env.EVOLVER_GROUP_CRYPTO_SCOPES ?? "null");
+        const recipients = JSON.parse(env.EVOLVER_GROUP_CRYPTO_RECIPIENTS ?? "null");
+        if (!Array.isArray(scopes) || scopes.length < 1 || scopes.length > 32 || !scopes.every(validScope) ||
+            new Set(scopes).size !== scopes.length || !Array.isArray(recipients) || recipients.length > 64)
+            throw new Error();
+        for (const r of recipients) {
+            if (!r || typeof r !== "object" || Object.keys(r).sort().join(",") !== "identity,keyLabel,keyType" ||
+                !isValidPrincipalName(r.identity) || !["Ed25519", "X25519"].includes(r.keyType) || !validKeyLabel(r.keyLabel))
+                throw new Error();
+        }
+        const plaintext = env.EVOLVER_GROUP_CRYPTO_ALLOW_PLAINTEXT;
+        if (plaintext !== undefined && plaintext !== "0" && plaintext !== "1")
+            throw new Error();
+        fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        const st = fstatSync(fd);
+        if (!st.isFile() || st.size > 128 || st.uid !== process.getuid?.() || (st.mode & 0o777) & ~0o600 ||
+            !(st.mode & 0o400))
+            throw new Error();
+        secret = readFileSync(fd);
+        // Do not include file contents, paths, JSON parse errors or SDK exceptions in diagnostics.
+        const hex = secret.toString("utf8").trim();
+        if (!/^[a-fA-F0-9]{64}$/.test(hex))
+            throw new Error();
+        const seed = Buffer.from(hex, "hex");
+        let unwrapper;
+        try {
+            unwrapper = keyType === "Ed25519" ? edGroupKeyUnwrapper(seed) : x25519GroupKeyUnwrapper(new Uint8Array(seed));
+        }
+        finally {
+            seed.fill(0);
+        }
+        const provider = Object.freeze({
+            identity, keyType: keyType, keyLabel,
+            scopes: Object.freeze([...scopes]),
+            approvedRecipients: Object.freeze(recipients.map(r => Object.freeze({ ...r }))),
+            allowPlaintext: plaintext === "1",
+            unwrap: (w) => unwrapper.unwrap(w),
+        });
+        return { ok: true, provider };
+    }
+    catch {
+        return { ok: false, error: "invalid group encryption provider: require explicit Ed25519/X25519 KEY_TYPE, protected owned KEY_FILE, SCOPES and RECIPIENTS policy; BLS/signing keys cannot unwrap" };
+    }
+    finally {
+        secret?.fill(0);
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
+//# sourceMappingURL=group-key-provider.js.map

package/dist/group-key-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-key-provider.js","sourceRoot":"","sources":["../src/group-key-provider.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAqBlH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAU,EAAe,EAAE,CACpD,OAAO,CAAC,KAAK,QAAQ,IAAI,qCAAqC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACzE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAU,EAAe,EAAE,CACvD,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAE/E;;kGAEkG;AAClG,MAAM,UAAU,2BAA2B,CACzC,GAAsB,EAAE,QAAgB;IAExC,MAAM,KAAK,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC;IAC/F,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,CAAC,KAAK,SAAS,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC1F,IAAI,EAAsB,CAAC;IAC3B,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,6BAA6B,CAAC;QAC/C,MAAM,OAAO,GAAG,GAAG,CAAC,6BAA6B,CAAC;QAClD,MAAM,QAAQ,GAAG,GAAG,CAAC,8BAA8B,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;YAC5E,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACnF,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,2BAA2B,IAAI,MAAM,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,+BAA+B,IAAI,MAAM,CAAC,CAAC;QACtF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;YAC9F,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACtH,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,2BAA2B;gBAC9F,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACvI,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,oCAAoC,CAAC;QAC3D,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACzF,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACtF,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK;YAC5F,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAC1C,MAAM,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAC1B,2FAA2F;QAC3F,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,SAA4B,CAAC;QACjC,IAAI,CAAC;YACH,SAAS,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAChH,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAC3B,MAAM,QAAQ,GAAqB,MAAM,CAAC,MAAM,CAAC;YAC/C,QAAQ,EAAE,OAAO,EAAE,OAAsC,EAAE,QAAQ;YACnE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;YAClC,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/E,cAAc,EAAE,SAAS,KAAK,GAAG;YACjC,MAAM,EAAE,CAAC,CAA6C,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;SAC/E,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qKAAqK,EAAE,CAAC;IACrM,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;AACH,CAAC"}

package/dist/group-keys.d.ts

@@ -0,0 +1,34 @@
+export declare const GROUP_KEY_TTL_SECONDS = 900;
+export declare const GROUP_KEY_MAX_TTL_SECONDS = 3600;
+export declare const GROUP_KEY_MAX_HANDLES = 128;
+export interface GroupKeyHandle {
+    readonly handle: string;
+    readonly scope: string;
+    readonly expiresAt: number;
+}
+/** Host-only stream/output authorization. Never return this object or the callback key to tools.
+ * commit() is called synchronously at the output boundary after its final authorization check.
+ * A completed commit stays a truthful success even if disposal happens while returning metadata. */
+export interface GroupKeyLease {
+    readonly signal: AbortSignal;
+    check(): void;
+    commit(): void;
+}
+export declare class GroupKeyHandles {
+    #private;
+    readonly owner: string;
+    private readonly now;
+    constructor(owner: string, now?: () => number);
+    insert(scope: string, key: Uint8Array, ttlSeconds?: number): GroupKeyHandle;
+    /** Never expose this callback or key to tools. It MUST NOT return key material. A temporary
+     * copy keeps asynchronous SDK calls safe from zeroization; disposal/expiry invalidates their
+     * result. All copies are wiped even on rejection. Owner is fixed by the injected store instance. */
+    withKey<T>(scope: string, handle: string, operation: (key: Uint8Array) => Promise<T>): Promise<T>;
+    /** Unlike withKey's inline-result check, a stream lease spans ACTUAL consumption and output
+     * completion. Disposal/expiry aborts pending IO; check() also observes an injected clock.
+     * Call commit ONLY after an output's final authorization check, never before async staging. */
+    withLease<T>(scope: string, handle: string, operation: (key: Uint8Array, lease: GroupKeyLease) => Promise<T>): Promise<T>;
+    dispose(scope: string, handle: string): void;
+    close(): void;
+}
+//# sourceMappingURL=group-keys.d.ts.map

package/dist/group-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-keys.d.ts","sourceRoot":"","sources":["../src/group-keys.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,qBAAqB,MAAM,CAAC;AACzC,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAC9C,eAAO,MAAM,qBAAqB,MAAM,CAAC;AACzC,MAAM,WAAW,cAAc;IAAG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE;AAC/G;;oGAEoG;AACpG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,KAAK,IAAI,IAAI,CAAC;IACd,MAAM,IAAI,IAAI,CAAC;CAChB;AAGD,qBAAa,eAAe;;IAGd,QAAQ,CAAC,KAAK,EAAE,MAAM;IAAE,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAnC,KAAK,EAAE,MAAM,EAAmB,GAAG,GAAE,MAAM,MAAiB;IAEjF,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,SAAwB,GAAG,cAAc;IAa1F;;wGAEoG;IAC9F,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAUvG;;mGAE+F;IACzF,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAc/H,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAC5C,KAAK,IAAI,IAAI;CAYd"}

package/dist/group-keys.js

@@ -0,0 +1,88 @@
+// Process-local, owner/scope-bound opaque AES-key handles. Host-only API for inline/stream crypto.
+import { randomUUID } from "node:crypto";
+import { validScope } from "./group-key-provider.js";
+export const GROUP_KEY_TTL_SECONDS = 900;
+export const GROUP_KEY_MAX_TTL_SECONDS = 3600;
+export const GROUP_KEY_MAX_HANDLES = 128;
+export class GroupKeyHandles {
+    owner;
+    now;
+    #entries = new Map();
+    #closed = false;
+    constructor(owner, now = Date.now) {
+        this.owner = owner;
+        this.now = now;
+    }
+    insert(scope, key, ttlSeconds = GROUP_KEY_TTL_SECONDS) {
+        this.#sweep();
+        if (this.#closed || !validScope(scope) || key.length !== 32 || !Number.isSafeInteger(ttlSeconds) ||
+            ttlSeconds < 1 || ttlSeconds > GROUP_KEY_MAX_TTL_SECONDS || this.#entries.size >= GROUP_KEY_MAX_HANDLES)
+            throw new Error("group key store unavailable, invalid key/TTL/scope, or handle capacity reached");
+        const handle = `gk_${randomUUID()}`;
+        const expiresAt = this.now() + ttlSeconds * 1000;
+        const timer = setTimeout(() => this.#remove(handle), ttlSeconds * 1000);
+        timer.unref();
+        this.#entries.set(handle, { key: new Uint8Array(key), scope, expiresAt, timer, lifetime: new AbortController() });
+        return { handle, scope, expiresAt };
+    }
+    /** Never expose this callback or key to tools. It MUST NOT return key material. A temporary
+     * copy keeps asynchronous SDK calls safe from zeroization; disposal/expiry invalidates their
+     * result. All copies are wiped even on rejection. Owner is fixed by the injected store instance. */
+    async withKey(scope, handle, operation) {
+        const entry = this.#get(scope, handle);
+        const copy = new Uint8Array(entry.key);
+        try {
+            const result = await operation(copy);
+            if (this.#get(scope, handle) !== entry)
+                throw new Error("group key handle no longer valid");
+            return result;
+        }
+        finally {
+            copy.fill(0);
+        }
+    }
+    /** Unlike withKey's inline-result check, a stream lease spans ACTUAL consumption and output
+     * completion. Disposal/expiry aborts pending IO; check() also observes an injected clock.
+     * Call commit ONLY after an output's final authorization check, never before async staging. */
+    async withLease(scope, handle, operation) {
+        const entry = this.#get(scope, handle);
+        const copy = new Uint8Array(entry.key);
+        let committed = false;
+        const check = () => { if (this.#get(scope, handle) !== entry)
+            throw new Error("group key handle no longer valid"); };
+        const lease = Object.freeze({ signal: entry.lifetime.signal, check,
+            commit: () => { check(); committed = true; } });
+        try {
+            const result = await operation(copy, lease);
+            if (!committed)
+                check();
+            return result;
+        }
+        finally {
+            copy.fill(0);
+        }
+    }
+    dispose(scope, handle) { this.#get(scope, handle); this.#remove(handle); }
+    close() { this.#closed = true; for (const h of this.#entries.keys())
+        this.#remove(h); }
+    #get(scope, handle) {
+        this.#sweep();
+        const entry = this.#entries.get(handle);
+        if (this.#closed || !entry || entry.scope !== scope)
+            throw new Error("invalid, expired, disposed or foreign-scope group key handle");
+        return entry;
+    }
+    #sweep() { for (const [h, e] of this.#entries)
+        if (e.expiresAt <= this.now())
+            this.#remove(h); }
+    #remove(handle) {
+        const entry = this.#entries.get(handle);
+        if (entry) {
+            clearTimeout(entry.timer);
+            entry.key.fill(0);
+            this.#entries.delete(handle);
+            entry.lifetime.abort();
+        }
+    }
+}
+//# sourceMappingURL=group-keys.js.map

package/dist/group-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-keys.js","sourceRoot":"","sources":["../src/group-keys.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AACzC,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAYzC,MAAM,OAAO,eAAe;IAGL;IAAgC;IAF5C,QAAQ,GAAG,IAAI,GAAG,EAAiB,CAAC;IAC7C,OAAO,GAAG,KAAK,CAAC;IAChB,YAAqB,KAAa,EAAmB,MAAoB,IAAI,CAAC,GAAG;QAA5D,UAAK,GAAL,KAAK,CAAQ;QAAmB,QAAG,GAAH,GAAG,CAAyB;IAAG,CAAC;IAErF,MAAM,CAAC,KAAa,EAAE,GAAe,EAAE,UAAU,GAAG,qBAAqB;QACvE,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC;YAC5F,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,yBAAyB,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,qBAAqB;YACzG,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACpG,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC;QACjD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC,CAAC;QACxE,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,eAAe,EAAE,EAAE,CAAC,CAAC;QAClH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACtC,CAAC;IAED;;wGAEoG;IACpG,KAAK,CAAC,OAAO,CAAI,KAAa,EAAE,MAAc,EAAE,SAA0C;QACxF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAC5F,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IAC7B,CAAC;IAED;;mGAE+F;IAC/F,KAAK,CAAC,SAAS,CAAI,KAAa,EAAE,MAAc,EAAE,SAAgE;QAChH,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,MAAM,KAAK,GAAG,GAAS,EAAE,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3H,MAAM,KAAK,GAAkB,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK;YAC/E,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC5C,IAAI,CAAC,SAAS;gBAAE,KAAK,EAAE,CAAC;YACxB,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IAC7B,CAAC;IAED,OAAO,CAAC,KAAa,EAAE,MAAc,IAAU,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChG,KAAK,KAAW,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;QAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,IAAI,CAAC,KAAa,EAAE,MAAc;QAChC,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QACrI,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAW,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ;QAAE,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtG,OAAO,CAAC,MAAc;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;IACpH,CAAC;CACF"}

package/dist/group-ownership.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"group-ownership.d.ts","sourceRoot":"","sources":["../src/group-ownership.ts"],"names":[],"mappings":"AAqDA,OAAO,KAAK,EAAQ,MAAM,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAW9C,OAAO,KAAK,EAA4B,WAAW,EAAE,MAAM,YAAY,CAAC;AAExE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED;;;;4FAI4F;AAC5F,eAAO,MAAM,iBAAiB,MAAM,CAAC;AACrC,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC,qFAAqF;AACrF,eAAO,MAAM,gBAAgB,YAAY,CAAC;AAC1C,eAAO,MAAM,WAAW,sCAAsC,CAAC;AAC/D,eAAO,MAAM,YAAY,uCAAuC,CAAC;AACjE,QAAA,MAAM,OAAO,cAAc,CAAC;AAG5B,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,OAAO,WAAW,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,OAAO,YAAY,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC7E,QAAQ,CAAC,OAAO,EAAE,OAAO,OAAO,CAAC;QAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;KACjE,CAAC;IACF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAgGD;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GAC1E,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAoCtC;AAED;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAE,GACrH,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAgDvC;AAED;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAC1C,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAoElC"}
+{"version":3,"file":"group-ownership.d.ts","sourceRoot":"","sources":["../src/group-ownership.ts"],"names":[],"mappings":"AAoDA,OAAO,KAAK,EAAQ,MAAM,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAW9C,OAAO,KAAK,EAA4B,WAAW,EAAE,MAAM,YAAY,CAAC;AAExE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED;;;;4FAI4F;AAC5F,eAAO,MAAM,iBAAiB,MAAM,CAAC;AACrC,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC,qFAAqF;AACrF,eAAO,MAAM,gBAAgB,YAAY,CAAC;AAC1C,eAAO,MAAM,WAAW,sCAAsC,CAAC;AAC/D,eAAO,MAAM,YAAY,uCAAuC,CAAC;AACjE,QAAA,MAAM,OAAO,cAAc,CAAC;AAG5B,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,OAAO,WAAW,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,OAAO,YAAY,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC7E,QAAQ,CAAC,OAAO,EAAE,OAAO,OAAO,CAAC;QAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;KACjE,CAAC;IACF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAgGD;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GAC1E,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAoCtC;AAED;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAE,GACrH,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAgDvC;AAED;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAC1C,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAoElC"}

package/dist/group-ownership.js

@@ -21,12 +21,11 @@
 // prepared id, the consented id and the submitted id are one value; finalize re-derives and checks
 // it rather than assuming.
 //
-// ⚠️ ONLY Ed25519 CONSENT CAN BE VERIFIED HERE. SDK 0.21.0 exports `edVerify` but no BLS verify, and
-// verifying before assembly is the point. A BLS consent is refused locally — never assembled blind,
-// never verified by a hand-rolled pairing check. ACCEPTED DISCREPANCY: SDK `edVerify` is noble's
-// ZIP215 (permissive) rule while the node's JCA verifier is strict RFC 8032, so a deliberately
-// non-canonical signature could pass here and be refused by the node as `invalid_signature` —
-// uncharged, but the submit consumes this session's once-only id and needs a NEW prepare.
+// ⚠️ ONLY Ed25519 CONSENT IS ACCEPTED BY THIS WORKFLOW. Verifying before assembly is the point;
+// a BLS consent remains refused locally, never assembled blind or verified by a hand-rolled
+// pairing check. Published SDK 0.22.0 `edVerify` uses strict RFC 8032 verification (`zip215:false`),
+// matching the node's strict Ed25519 mode rather than the former permissive ZIP215 behavior.
+// This dependency update does not broaden accepted consent algorithms or remove local guards.
 //
 // ⚠️ KEY MATERIAL NEVER ENTERS OR LEAVES. Arguments and results carry names, the digest-bound
 // intent, key type/label and the single consent signature; never a private key or signed envelope.

package/dist/group-ownership.js.map

@@ -1 +1 @@
-{"version":3,"file":"group-ownership.js","sourceRoot":"","sources":["../src/group-ownership.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,uGAAuG;AACvG,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,iGAAiG;AACjG,yFAAyF;AACzF,EAAE;AACF,oGAAoG;AACpG,qGAAqG;AACrG,mGAAmG;AACnG,mGAAmG;AACnG,+DAA+D;AAC/D,gGAAgG;AAChG,kGAAkG;AAClG,sEAAsE;AACtE,uEAAuE;AACvE,EAAE;AACF,gGAAgG;AAChG,oGAAoG;AACpG,mGAAmG;AACnG,2BAA2B;AAC3B,EAAE;AACF,qGAAqG;AACrG,oGAAoG;AACpG,iGAAiG;AACjG,+FAA+F;AAC/F,8FAA8F;AAC9F,0FAA0F;AAC1F,EAAE;AACF,8FAA8F;AAC9F,mGAAmG;AACnG,EAAE;AACF,iGAAiG;AACjG,kGAAkG;AAClG,oGAAoG;AACpG,2FAA2F;AAC3F,gGAAgG;AAChG,+FAA+F;AAC/F,kGAAkG;AAClG,8FAA8F;AAE9F,OAAO,EACL,MAAM,EACN,cAAc,EACd,IAAI,IAAI,QAAQ,EAChB,0BAA0B,EAC1B,gBAAgB,EAChB,aAAa,EACb,UAAU,EACV,QAAQ,EACR,WAAW,GACZ,MAAM,8BAA8B,CAAC;AAItC,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,4BAA4B,EAC5B,YAAY,EACZ,cAAc,EACd,qBAAqB,GACtB,MAAM,YAAY,CAAC;AASpB;;;;4FAI4F;AAC5F,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AACrC,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAExC,qFAAqF;AACrF,MAAM,CAAC,MAAM,gBAAgB,GAAG,SAAS,CAAC;AAC1C,MAAM,CAAC,MAAM,WAAW,GAAG,mCAAmC,CAAC;AAC/D,MAAM,CAAC,MAAM,YAAY,GAAG,oCAAoC,CAAC;AACjE,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,0DAA0D;AACvF,MAAM,SAAS,GAAG,GAAG,CAAC;AA+BtB,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,KAAa,EAAqB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACtG,MAAM,WAAW,GAAG,CAAC,CAAU,EAAqB,EAAE,CACpD,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC1F,MAAM,GAAG,GAAG,CAAC,CAAa,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACtE,MAAM,GAAG,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAE5E;0FAC0F;AAC1F,SAAS,SAAS,CAAC,QAAgB,EAAE,SAAiB,EAAE,QAAgB,EAAE,GAAW;IACnF,MAAM,IAAI,GAAG,0BAA0B,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,mGAAmG;AACnG,SAAS,UAAU,CAAC,SAAiB,EAAE,QAAgB,EAAE,QAAgB;IACvE,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC;IACvF,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IACxF,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IACxF,IAAI,QAAQ,KAAK,QAAQ;QACvB,OAAO,MAAM,CAAC,eAAe,EAAE,6FAA6F,CAAC,CAAC;IAChI,OAAO,IAAI,CAAC;AACd,CAAC;AAED;qGACqG;AACrG,KAAK,UAAU,eAAe,CAAC,KAAiB,EAAE,SAAiB,EAAE,QAAgB,EAAE,QAAgB;IACrG,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;QAChF,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,SAAS,GAAG,EAAE,CAAC;QACrF,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ;YAC3B,OAAO,MAAM,CAAC,eAAe,EAAE,UAAU,SAAS,kBAAkB,MAAM,CAAC,KAAK,uCAAuC,QAAQ,GAAG,CAAC,CAAC;QACtI,IAAI,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI;YAC3C,OAAO,MAAM,CAAC,eAAe,EAAE,IAAI,QAAQ,gDAAgD,CAAC,CAAC;QAC/F,IAAI,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI;YAC9C,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,QAAQ,oBAAoB,EAAE,CAAC;IAClF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uFAAuF;AACvF,SAAS,UAAU,CAAC,GAAW,EAAE,cAAsB;IACrD,IAAI,cAAc,IAAI,GAAG;QACvB,OAAO,MAAM,CAAC,gBAAgB,EAAE,kBAAkB,cAAc,mCAAmC,GAAG,qFAAqF,CAAC,CAAC;IAC/L,IAAI,cAAc,GAAG,GAAG,GAAG,iBAAiB;QAC1C,OAAO,MAAM,CAAC,gBAAgB,EAAE,SAAS,cAAc,iBAAiB,iBAAiB,mCAAmC,GAAG,wBAAwB,CAAC,CAAC;IAC3J,OAAO,IAAI,CAAC;AACd,CAAC;AAED;6FAC6F;AAC7F,KAAK,UAAU,eAAe,CAAC,KAAiB,EAAE,GAAW,EAAE,QAAgB;IAC7E,IAAI,IAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,GAAG,GAAG,EAAE,CAAC;IAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,gBAAgB,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC;IACzF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QACpB,OAAO,MAAM,CAAC,cAAc,EAAE,IAAI,GAAG,8BAA8B,gBAAgB,kBAAkB,QAAQ,sDAAsD,CAAC,CAAC;IACvK,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,cAAc,EAAE,kBAAkB,gBAAgB,aAAa,GAAG,4CAA4C,CAAC,CAAC;IAChI,CAAC;AACH,CAAC;AAED;gGACgG;AAChG,KAAK,UAAU,8BAA8B,CAAC,KAAiB;IAC7D,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,2BAA2B,CAAC;IAChE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,MAAM,CAAC,MAAM,EAClB,8FAA8F;QAC9F,mGAAmG;QACnG,4GAA4G,CAAC,CAAC;AAClH,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,KAAiB;IAClC,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAmB,EACnB,MAA2E;IAE3E,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IACxG,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACtD,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IAC5F,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,iBAAiB;QACrH,OAAO,MAAM,CAAC,WAAW,EAAE,yBAAyB,iBAAiB,sCAAsC,CAAC,CAAC;IAE/G,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/E,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAExC,MAAM,cAAc,GAAG,GAAG,GAAG,SAAS,CAAC;IACvC,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;IAChF,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IACtH,MAAM,OAAO,GAA6B;QACxC,IAAI,EAAE,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,EAAE,kCAAkC,EAAE,MAAM;QAChG,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE;QACxC,MAAM,EAAE,iFAAiF;KAC1F,CAAC;IACF,IAAI,YAAY,CAAC,EAAE,CAAC,KAAK,SAAS,IAAI,oBAAoB,CAAC,EAAE,CAAC,KAAK,SAAS;QAC1E,OAAO,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,mDAAmD,CAAC,CAAC;IAC3F,4BAA4B,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC;QAClC,OAAO,MAAM,CAAC,SAAS,EAAE,WAAW,qBAAqB,mDAAmD,CAAC,CAAC;IAChH,OAAO;QACL,IAAI,EAAE,IAAI;QACV,KAAK,EAAE;YACL,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG;YAC1F,IAAI,EAAE,gCAAgC,QAAQ,iEAAiE;gBAC7G,qGAAqG,cAAc,GAAG;SACzH;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAmB,EACnB,MAAsH;IAEtH,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACpH,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;IAC7C,IAAI,QAAQ,KAAK,IAAI,CAAC,QAAQ;QAC5B,OAAO,MAAM,CAAC,eAAe,EAAE,0BAA0B,IAAI,CAAC,QAAQ,WAAW,QAAQ,IAAI,SAAS,sDAAsD,CAAC,CAAC;IAChK,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACtD,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC;QACnG,OAAO,MAAM,CAAC,gBAAgB,EAAE,kCAAkC,CAAC,CAAC;IACtE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,mDAAmD,CAAC,CAAC;IAClH,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,gBAAgB;QAC1C,OAAO,MAAM,CAAC,QAAQ,EAAE,yBAAyB,IAAI,CAAC,MAAM,CAAC,OAAO,wCAAwC,gBAAgB,WAAW;YACrI,0JAA0J,CAAC,CAAC;IAEhK,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC5E,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS;QAC3B,OAAO,MAAM,CAAC,MAAM,EAAE,qBAAqB,cAAc,CAAC,SAAS,CAAC,wEAAwE,CAAC,CAAC;IAEhJ,2FAA2F;IAC3F,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC9C,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/E,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,6FAA6F;IAC7F,6FAA6F;IAC7F,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9E,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC;QAAE,OAAO,GAAG,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC;QACnC,OAAO,MAAM,CAAC,QAAQ,EAAE,6DAA6D,QAAQ,8BAA8B,CAAC,CAAC;IAE/H,OAAO;QACL,IAAI,EAAE,IAAI;QACV,KAAK,EAAE;YACL,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ;YAChG,aAAa,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG;YACrD,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE;YACxI,IAAI,EAAE,2BAA2B,QAAQ,8BAA8B,SAAS,2BAA2B;gBACzG,GAAG,cAAc,2EAA2E;SAC/F;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAAmB,EACnB,MAA2C;IAE3C,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,YAAY,CAAC,EAAE,CAAC,KAAK,SAAS;QAChC,OAAO,MAAM,CAAC,MAAM,EAAE,YAAY,cAAc,CAAC,EAAE,CAAC,0FAA0F,CAAC,CAAC;IAClJ,MAAM,OAAO,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,SAAS;QACvB,OAAO,MAAM,CAAC,MAAM,EAAE,eAAe,cAAc,CAAC,EAAE,CAAC,+EAA+E,CAAC,CAAC;IAC1I,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC;IAEhG,wFAAwF;IACxF,MAAM,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;IAC3H,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;IAC5G,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,YAAY;QAAE,OAAO,MAAM,CAAC,cAAc,EAAE,YAAY,YAAY,GAAG,CAAC,CAAC;IAC3F,mGAAmG;IACnG,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7F,MAAM,QAAQ,GAAI;QAChB,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;QAC5G,CAAC,eAAe,EAAE,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC;QAC9G,CAAC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;QACrG,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;KAC7E,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IAClD,IAAI,QAAQ;QACV,OAAO,MAAM,CAAC,WAAW,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,+FAA+F,CAAC,CAAC;IAC3I,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC;IACnF,IAAI,OAAO,KAAK,gBAAgB;QAC9B,OAAO,MAAM,CAAC,sBAAsB,EAAE,QAAQ,gBAAgB,iFAAiF,CAAC,CAAC;IACnJ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,SAAS;QAAE,OAAO,MAAM,CAAC,uBAAuB,EAAE,4CAA4C,CAAC,CAAC;IACtJ,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,2BAA2B,EAAE,sDAAsD,CAAC,CAAC;IAEtK,+FAA+F;IAC/F,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAC1G,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,yDAAyD,CAAC,CAAC;IAEzG,+FAA+F;IAC/F,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACtD,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC;IAC/F,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IACzE,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC;QAAE,OAAO,GAAG,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC;QAC5C,OAAO,MAAM,CAAC,2BAA2B,EAAE,4BAA4B,EAAE,WAAW,CAAC,CAAC,aAAa,kBAAkB,gBAAgB,0BAA0B,CAAC,CAAC;IAEnK,2FAA2F;IAC3F,MAAM,KAAK,GAAW;QACpB,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;QACjH,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,aAAa,EAAE,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE;KAChG,CAAC;IACF,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IACrJ,MAAM,MAAM,GAAG;QACb,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,GAAG;QACpG,YAAY,EAAE,GAAG,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG;QACzF,YAAY,EAAE,GAAG,CAAC,CAAC,aAAa,IAAI,gBAAgB,WAAW,QAAQ,+CAA+C,GAAG,GAAG;KAC7H,CAAC;IACF,MAAM,MAAM,GAAgB;QAC1B,IAAI,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,EAAE,0BAA0B;QACtG,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,aAAa,EAAE,GAAG,MAAM,EAAE;KACxD,CAAC;IACF,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC;QACrC,OAAO,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,4DAA4D,CAAC,CAAC;IACpG,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACzB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC"}
+{"version":3,"file":"group-ownership.js","sourceRoot":"","sources":["../src/group-ownership.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,uGAAuG;AACvG,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,iGAAiG;AACjG,yFAAyF;AACzF,EAAE;AACF,oGAAoG;AACpG,qGAAqG;AACrG,mGAAmG;AACnG,mGAAmG;AACnG,+DAA+D;AAC/D,gGAAgG;AAChG,kGAAkG;AAClG,sEAAsE;AACtE,uEAAuE;AACvE,EAAE;AACF,gGAAgG;AAChG,oGAAoG;AACpG,mGAAmG;AACnG,2BAA2B;AAC3B,EAAE;AACF,gGAAgG;AAChG,4FAA4F;AAC5F,qGAAqG;AACrG,6FAA6F;AAC7F,8FAA8F;AAC9F,EAAE;AACF,8FAA8F;AAC9F,mGAAmG;AACnG,EAAE;AACF,iGAAiG;AACjG,kGAAkG;AAClG,oGAAoG;AACpG,2FAA2F;AAC3F,gGAAgG;AAChG,+FAA+F;AAC/F,kGAAkG;AAClG,8FAA8F;AAE9F,OAAO,EACL,MAAM,EACN,cAAc,EACd,IAAI,IAAI,QAAQ,EAChB,0BAA0B,EAC1B,gBAAgB,EAChB,aAAa,EACb,UAAU,EACV,QAAQ,EACR,WAAW,GACZ,MAAM,8BAA8B,CAAC;AAItC,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,4BAA4B,EAC5B,YAAY,EACZ,cAAc,EACd,qBAAqB,GACtB,MAAM,YAAY,CAAC;AASpB;;;;4FAI4F;AAC5F,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AACrC,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAExC,qFAAqF;AACrF,MAAM,CAAC,MAAM,gBAAgB,GAAG,SAAS,CAAC;AAC1C,MAAM,CAAC,MAAM,WAAW,GAAG,mCAAmC,CAAC;AAC/D,MAAM,CAAC,MAAM,YAAY,GAAG,oCAAoC,CAAC;AACjE,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,0DAA0D;AACvF,MAAM,SAAS,GAAG,GAAG,CAAC;AA+BtB,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,KAAa,EAAqB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACtG,MAAM,WAAW,GAAG,CAAC,CAAU,EAAqB,EAAE,CACpD,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC1F,MAAM,GAAG,GAAG,CAAC,CAAa,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACtE,MAAM,GAAG,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAE5E;0FAC0F;AAC1F,SAAS,SAAS,CAAC,QAAgB,EAAE,SAAiB,EAAE,QAAgB,EAAE,GAAW;IACnF,MAAM,IAAI,GAAG,0BAA0B,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,mGAAmG;AACnG,SAAS,UAAU,CAAC,SAAiB,EAAE,QAAgB,EAAE,QAAgB;IACvE,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC;IACvF,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IACxF,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IACxF,IAAI,QAAQ,KAAK,QAAQ;QACvB,OAAO,MAAM,CAAC,eAAe,EAAE,6FAA6F,CAAC,CAAC;IAChI,OAAO,IAAI,CAAC;AACd,CAAC;AAED;qGACqG;AACrG,KAAK,UAAU,eAAe,CAAC,KAAiB,EAAE,SAAiB,EAAE,QAAgB,EAAE,QAAgB;IACrG,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;QAChF,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,SAAS,GAAG,EAAE,CAAC;QACrF,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ;YAC3B,OAAO,MAAM,CAAC,eAAe,EAAE,UAAU,SAAS,kBAAkB,MAAM,CAAC,KAAK,uCAAuC,QAAQ,GAAG,CAAC,CAAC;QACtI,IAAI,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI;YAC3C,OAAO,MAAM,CAAC,eAAe,EAAE,IAAI,QAAQ,gDAAgD,CAAC,CAAC;QAC/F,IAAI,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI;YAC9C,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,QAAQ,oBAAoB,EAAE,CAAC;IAClF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uFAAuF;AACvF,SAAS,UAAU,CAAC,GAAW,EAAE,cAAsB;IACrD,IAAI,cAAc,IAAI,GAAG;QACvB,OAAO,MAAM,CAAC,gBAAgB,EAAE,kBAAkB,cAAc,mCAAmC,GAAG,qFAAqF,CAAC,CAAC;IAC/L,IAAI,cAAc,GAAG,GAAG,GAAG,iBAAiB;QAC1C,OAAO,MAAM,CAAC,gBAAgB,EAAE,SAAS,cAAc,iBAAiB,iBAAiB,mCAAmC,GAAG,wBAAwB,CAAC,CAAC;IAC3J,OAAO,IAAI,CAAC;AACd,CAAC;AAED;6FAC6F;AAC7F,KAAK,UAAU,eAAe,CAAC,KAAiB,EAAE,GAAW,EAAE,QAAgB;IAC7E,IAAI,IAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,GAAG,GAAG,EAAE,CAAC;IAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,gBAAgB,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC;IACzF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QACpB,OAAO,MAAM,CAAC,cAAc,EAAE,IAAI,GAAG,8BAA8B,gBAAgB,kBAAkB,QAAQ,sDAAsD,CAAC,CAAC;IACvK,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,cAAc,EAAE,kBAAkB,gBAAgB,aAAa,GAAG,4CAA4C,CAAC,CAAC;IAChI,CAAC;AACH,CAAC;AAED;gGACgG;AAChG,KAAK,UAAU,8BAA8B,CAAC,KAAiB;IAC7D,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,2BAA2B,CAAC;IAChE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,MAAM,CAAC,MAAM,EAClB,8FAA8F;QAC9F,mGAAmG;QACnG,4GAA4G,CAAC,CAAC;AAClH,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,KAAiB;IAClC,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAmB,EACnB,MAA2E;IAE3E,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IACxG,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACtD,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IAC5F,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,iBAAiB;QACrH,OAAO,MAAM,CAAC,WAAW,EAAE,yBAAyB,iBAAiB,sCAAsC,CAAC,CAAC;IAE/G,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/E,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAExC,MAAM,cAAc,GAAG,GAAG,GAAG,SAAS,CAAC;IACvC,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;IAChF,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IACtH,MAAM,OAAO,GAA6B;QACxC,IAAI,EAAE,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,EAAE,kCAAkC,EAAE,MAAM;QAChG,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE;QACxC,MAAM,EAAE,iFAAiF;KAC1F,CAAC;IACF,IAAI,YAAY,CAAC,EAAE,CAAC,KAAK,SAAS,IAAI,oBAAoB,CAAC,EAAE,CAAC,KAAK,SAAS;QAC1E,OAAO,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,mDAAmD,CAAC,CAAC;IAC3F,4BAA4B,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC;QAClC,OAAO,MAAM,CAAC,SAAS,EAAE,WAAW,qBAAqB,mDAAmD,CAAC,CAAC;IAChH,OAAO;QACL,IAAI,EAAE,IAAI;QACV,KAAK,EAAE;YACL,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG;YAC1F,IAAI,EAAE,gCAAgC,QAAQ,iEAAiE;gBAC7G,qGAAqG,cAAc,GAAG;SACzH;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAmB,EACnB,MAAsH;IAEtH,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACpH,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;IAC7C,IAAI,QAAQ,KAAK,IAAI,CAAC,QAAQ;QAC5B,OAAO,MAAM,CAAC,eAAe,EAAE,0BAA0B,IAAI,CAAC,QAAQ,WAAW,QAAQ,IAAI,SAAS,sDAAsD,CAAC,CAAC;IAChK,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACtD,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC;QACnG,OAAO,MAAM,CAAC,gBAAgB,EAAE,kCAAkC,CAAC,CAAC;IACtE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,mDAAmD,CAAC,CAAC;IAClH,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,gBAAgB;QAC1C,OAAO,MAAM,CAAC,QAAQ,EAAE,yBAAyB,IAAI,CAAC,MAAM,CAAC,OAAO,wCAAwC,gBAAgB,WAAW;YACrI,0JAA0J,CAAC,CAAC;IAEhK,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC5E,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS;QAC3B,OAAO,MAAM,CAAC,MAAM,EAAE,qBAAqB,cAAc,CAAC,SAAS,CAAC,wEAAwE,CAAC,CAAC;IAEhJ,2FAA2F;IAC3F,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC9C,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/E,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,6FAA6F;IAC7F,6FAA6F;IAC7F,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9E,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC;QAAE,OAAO,GAAG,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC;QACnC,OAAO,MAAM,CAAC,QAAQ,EAAE,6DAA6D,QAAQ,8BAA8B,CAAC,CAAC;IAE/H,OAAO;QACL,IAAI,EAAE,IAAI;QACV,KAAK,EAAE;YACL,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ;YAChG,aAAa,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG;YACrD,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE;YACxI,IAAI,EAAE,2BAA2B,QAAQ,8BAA8B,SAAS,2BAA2B;gBACzG,GAAG,cAAc,2EAA2E;SAC/F;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAAmB,EACnB,MAA2C;IAE3C,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,YAAY,CAAC,EAAE,CAAC,KAAK,SAAS;QAChC,OAAO,MAAM,CAAC,MAAM,EAAE,YAAY,cAAc,CAAC,EAAE,CAAC,0FAA0F,CAAC,CAAC;IAClJ,MAAM,OAAO,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,SAAS;QACvB,OAAO,MAAM,CAAC,MAAM,EAAE,eAAe,cAAc,CAAC,EAAE,CAAC,+EAA+E,CAAC,CAAC;IAC1I,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC;IAEhG,wFAAwF;IACxF,MAAM,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;IAC3H,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;IAC5G,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,YAAY;QAAE,OAAO,MAAM,CAAC,cAAc,EAAE,YAAY,YAAY,GAAG,CAAC,CAAC;IAC3F,mGAAmG;IACnG,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7F,MAAM,QAAQ,GAAI;QAChB,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;QAC5G,CAAC,eAAe,EAAE,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC;QAC9G,CAAC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;QACrG,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;KAC7E,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IAClD,IAAI,QAAQ;QACV,OAAO,MAAM,CAAC,WAAW,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,+FAA+F,CAAC,CAAC;IAC3I,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC;IACnF,IAAI,OAAO,KAAK,gBAAgB;QAC9B,OAAO,MAAM,CAAC,sBAAsB,EAAE,QAAQ,gBAAgB,iFAAiF,CAAC,CAAC;IACnJ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,SAAS;QAAE,OAAO,MAAM,CAAC,uBAAuB,EAAE,4CAA4C,CAAC,CAAC;IACtJ,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,2BAA2B,EAAE,sDAAsD,CAAC,CAAC;IAEtK,+FAA+F;IAC/F,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAC1G,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,yDAAyD,CAAC,CAAC;IAEzG,+FAA+F;IAC/F,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACtD,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC;IAC/F,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IACzE,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC;QAAE,OAAO,GAAG,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC;QAC5C,OAAO,MAAM,CAAC,2BAA2B,EAAE,4BAA4B,EAAE,WAAW,CAAC,CAAC,aAAa,kBAAkB,gBAAgB,0BAA0B,CAAC,CAAC;IAEnK,2FAA2F;IAC3F,MAAM,KAAK,GAAW;QACpB,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;QACjH,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,aAAa,EAAE,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE;KAChG,CAAC;IACF,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IACrJ,MAAM,MAAM,GAAG;QACb,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,GAAG;QACpG,YAAY,EAAE,GAAG,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG;QACzF,YAAY,EAAE,GAAG,CAAC,CAAC,aAAa,IAAI,gBAAgB,WAAW,QAAQ,+CAA+C,GAAG,GAAG;KAC7H,CAAC;IACF,MAAM,MAAM,GAAgB;QAC1B,IAAI,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,EAAE,0BAA0B;QACtG,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,aAAa,EAAE,GAAG,MAAM,EAAE;KACxD,CAAC;IACF,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC;QACrC,OAAO,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,4DAA4D,CAAC,CAAC;IACpG,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACzB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC"}

package/dist/http-profiles.d.ts

@@ -0,0 +1,47 @@
+import type { SignedRequestParams } from "@mcsherrylabs/evolver-client";
+export declare const HTTP_METHODS: readonly ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"];
+export interface HttpProfile {
+    readonly name: string;
+    readonly principal: string;
+    readonly keyLabel: string;
+    readonly audience: string;
+    readonly origin: string;
+    readonly targets: readonly {
+        path: string;
+        methods: readonly string[];
+    }[];
+    readonly maxTtlSeconds: number;
+    readonly challengeUrl?: string;
+    /** Exact trusted local addresses, validated/resolved/pinned by the published SDK transport.
+     * No MCP DNS/IP classification or generic allowLocal flag. Never permit metadata/link-local. */
+    readonly localAddresses?: readonly string[];
+    /** Additional exact host IP refusals; SDK checks these before any local opt-in. */
+    readonly denyAddresses?: readonly string[];
+    /** Independent public relying-service CA trust; never inherit node insecure TLS. */
+    readonly caPem?: string;
+}
+export type HttpProfilesResult = {
+    ok: true;
+    profiles: readonly HttpProfile[];
+} | {
+    ok: false;
+    error: string;
+};
+export interface HttpHeader {
+    readonly name: string;
+    readonly value: string;
+}
+export declare const HTTP_MAX_TEMPLATE_BYTES = 4096;
+export declare const HTTP_MAX_HEADER_BYTES = 8192;
+/** Canonical EXACT endpoints only. Reject all percent encoding rather than guessing how a remote
+ * router, proxy or framework normalizes it. No query, fragment, placeholder, userinfo or backslash. */
+export declare function httpEndpoint(raw: unknown): URL;
+export declare function resolveHttpProfiles(raw: unknown): HttpProfilesResult;
+export declare function loadHttpProfilesFromEnv(env: NodeJS.ProcessEnv): HttpProfilesResult;
+export declare function validateHttpRequest(raw: unknown, profile: HttpProfile): {
+    ok: true;
+    request: SignedRequestParams["request"];
+} | {
+    ok: false;
+};
+//# sourceMappingURL=http-profiles.d.ts.map

package/dist/http-profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-profiles.d.ts","sourceRoot":"","sources":["../src/http-profiles.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAGxE,eAAO,MAAM,YAAY,uEAAwE,CAAC;AAClG,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IAC1E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;oGACgG;IAChG,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,mFAAmF;IACnF,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,oFAAoF;IACpF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AACD,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAC/G,MAAM,WAAW,UAAU;IAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAC7E,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAC5C,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAkB1C;uGACuG;AACvG,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,CAM9C;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,CAmCpE;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,kBAAkB,CASlF;AAcD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAyB7I"}

package/dist/http-profiles.js

@@ -0,0 +1,161 @@
+import { readFileSync, statSync } from "node:fs";
+import { isValidPrincipalName } from "@mcsherrylabs/evolver-client";
+// Exact request methods admitted by the reviewed SDK approved-request transport (0d724deb).
+export const HTTP_METHODS = ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"];
+export const HTTP_MAX_TEMPLATE_BYTES = 4096;
+export const HTTP_MAX_HEADER_BYTES = 8192;
+const object = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+const only = (v, allowed) => Object.keys(v).every(k => allowed.includes(k));
+function addressPolicy(raw) {
+    if (raw === undefined)
+        return undefined;
+    if (!Array.isArray(raw) || raw.length < 1 || raw.length > 8)
+        throw new Error();
+    const addresses = raw.map(ip => {
+        if (typeof ip !== "string" || !ip || ip.length > 64 || /[^\x21-\x7e]/.test(ip))
+            throw new Error();
+        return ip;
+    });
+    if (new Set(addresses).size !== addresses.length)
+        throw new Error();
+    return addresses; // Exact IP syntax/classification belongs only to the public SDK factory.
+}
+function pathAllowed(path) {
+    return path.startsWith("/") && path.length <= 1024 && !path.includes("//") &&
+        path.split("/").every((s, i, a) => (s === "" ? i === 0 || i === a.length - 1 : /^[A-Za-z0-9_.~-]+$/.test(s) && s !== "." && s !== ".."));
+}
+/** Canonical EXACT endpoints only. Reject all percent encoding rather than guessing how a remote
+ * router, proxy or framework normalizes it. No query, fragment, placeholder, userinfo or backslash. */
+export function httpEndpoint(raw) {
+    if (typeof raw !== "string" || raw.length > 2048 || /[^\x21-\x7e]|[%{}\\]/.test(raw))
+        throw new Error();
+    const url = new URL(raw);
+    if (!["https:", "http:"].includes(url.protocol) || url.username || url.password || url.search || url.hash ||
+        url.toString() !== raw || !pathAllowed(url.pathname))
+        throw new Error();
+    return url;
+}
+export function resolveHttpProfiles(raw) {
+    try {
+        if (!object(raw) || !only(raw, ["profiles"]) || !Array.isArray(raw.profiles) || raw.profiles.length > 16)
+            throw new Error();
+        const names = new Set();
+        const profiles = raw.profiles.map((v) => {
+            if (!object(v) || !only(v, ["name", "principal", "keyLabel", "audience", "origin", "targets", "maxTtlSeconds", "challengeUrl", "localAddresses", "denyAddresses", "caPem"]))
+                throw new Error();
+            if (typeof v.name !== "string" || !/^[a-z][a-z0-9-]{0,63}$/.test(v.name) || names.has(v.name))
+                throw new Error();
+            names.add(v.name);
+            if (typeof v.principal !== "string" || !isValidPrincipalName(v.principal) || typeof v.keyLabel !== "string" || v.keyLabel.length > 128 || /[^\x20-\x7e]/.test(v.keyLabel))
+                throw new Error();
+            if (typeof v.origin !== "string")
+                throw new Error();
+            const origin = httpEndpoint(v.origin + "/");
+            if (origin.origin !== v.origin || origin.pathname !== "/")
+                throw new Error();
+            if (typeof v.audience !== "string" || v.audience.length > 256 || ![origin.hostname, origin.origin].includes(v.audience))
+                throw new Error();
+            const local = addressPolicy(v.localAddresses), denied = addressPolicy(v.denyAddresses);
+            if (origin.protocol === "http:" && local === undefined)
+                throw new Error();
+            const caPem = v.caPem;
+            if (caPem !== undefined && (origin.protocol !== "https:" || typeof caPem !== "string" || Buffer.byteLength(caPem) > 16384 || !caPem.includes("-----BEGIN CERTIFICATE-----") || caPem.includes("PRIVATE KEY")))
+                throw new Error();
+            if (!Array.isArray(v.targets) || v.targets.length < 1 || v.targets.length > 16)
+                throw new Error();
+            const paths = new Set();
+            const targets = v.targets.map(t => {
+                if (!object(t) || !only(t, ["path", "methods"]) || typeof t.path !== "string" || !pathAllowed(t.path) || paths.has(t.path) ||
+                    !Array.isArray(t.methods) || t.methods.length < 1 || t.methods.length > HTTP_METHODS.length ||
+                    t.methods.some(m => !HTTP_METHODS.includes(m)) || new Set(t.methods).size !== t.methods.length)
+                    throw new Error();
+                paths.add(t.path);
+                return { path: t.path, methods: [...t.methods] };
+            });
+            if (typeof v.maxTtlSeconds !== "number" || !Number.isSafeInteger(v.maxTtlSeconds) || v.maxTtlSeconds < 1 || v.maxTtlSeconds > 300)
+                throw new Error();
+            const challenge = v.challengeUrl === undefined ? undefined : httpEndpoint(v.challengeUrl);
+            if (challenge && challenge.origin !== origin.origin)
+                throw new Error();
+            return { name: v.name, principal: v.principal, keyLabel: v.keyLabel, audience: v.audience, origin: origin.origin,
+                targets, maxTtlSeconds: v.maxTtlSeconds, ...(challenge ? { challengeUrl: challenge.toString() } : {}),
+                ...(local ? { localAddresses: [...local] } : {}), ...(denied ? { denyAddresses: [...denied] } : {}), ...(caPem ? { caPem } : {}) };
+        });
+        return { ok: true, profiles };
+    }
+    catch {
+        return { ok: false, error: "Invalid host HTTP profiles: require fixed canonical origin, matching audience/identity/Ed25519 label, exact endpoint/method targets and TTL 1..300. Plain HTTP requires an exact SDK-validated localAddresses policy; no generic local/private access is granted." };
+    }
+}
+export function loadHttpProfilesFromEnv(env) {
+    const path = env.EVOLVER_HTTP_PROFILES_PATH;
+    if (!path)
+        return { ok: true, profiles: [] };
+    try {
+        if (!statSync(path).isFile() || statSync(path).size > 65536)
+            throw new Error();
+        const text = readFileSync(path, "utf8");
+        if (Buffer.byteLength(text) > 65536)
+            throw new Error();
+        return resolveHttpProfiles(JSON.parse(text));
+    }
+    catch {
+        return { ok: false, error: "Cannot read bounded operator HTTP profiles from EVOLVER_HTTP_PROFILES_PATH; configure host policy and reload MCP." };
+    }
+}
+// Node20+ intrinsic: reject the same lone-surrogate loss that content.ts refuses, without
+// introducing a second UTF-8 encoder or changing the file owner's content module.
+const wellFormed = (s) => s.isWellFormed();
+function boundedJson(v, depth = 0, nodes = { count: 0 }) {
+    if (++nodes.count > 1024 || depth > 16)
+        return false;
+    if (typeof v === "string")
+        return wellFormed(v);
+    if (v === null || typeof v === "boolean")
+        return true;
+    if (typeof v === "number")
+        return Number.isFinite(v);
+    if (Array.isArray(v))
+        return v.every(x => boundedJson(x, depth + 1, nodes));
+    if (!object(v) || (Object.getPrototypeOf(v) !== Object.prototype && Object.getPrototypeOf(v) !== null))
+        return false;
+    return Object.entries(v).every(([k, x]) => wellFormed(k) && boundedJson(x, depth + 1, nodes));
+}
+export function validateHttpRequest(raw, profile) {
+    try {
+        if (!object(raw) || !only(raw, ["method", "url", "headers", "body"]) || typeof raw.method !== "string" || !HTTP_METHODS.includes(raw.method) ||
+            ((raw.method === "GET" || raw.method === "HEAD") && raw.body !== undefined))
+            throw new Error();
+        const url = httpEndpoint(raw.url);
+        if (url.origin !== profile.origin || !profile.targets.some(t => t.path === url.pathname && t.methods.includes(raw.method)))
+            throw new Error();
+        const hs = raw.headers ?? [];
+        if (!Array.isArray(hs) || hs.length > 16)
+            throw new Error();
+        const seen = new Set(), pairs = [];
+        let headerBytes = 0;
+        for (const h of hs) {
+            if (!object(h) || !only(h, ["name", "value"]) || typeof h.name !== "string" || typeof h.value !== "string" ||
+                !/^[!#$%&'*+.^_`|~0-9A-Za-z-]{1,128}$/.test(h.name) || !/^[\x20-\x7e]{0,1024}$/.test(h.value))
+                throw new Error();
+            const name = h.name.toLowerCase();
+            // Match ALL transport control/proxy refusals before approval/signing, plus host-only
+            // credential/referrer restrictions. DNS-only preflight cannot validate RequestInit.
+            if (seen.has(name) || ["__proto__", "host", "content-length", "transfer-encoding", "connection", "keep-alive", "te", "trailer", "upgrade", "expect", "http2-settings", "forwarded", "via", "accept-encoding", "cookie", "set-cookie", "origin", "referer"].includes(name) || name.startsWith("proxy-") || name.startsWith("x-forwarded-") ||
+                (name === "authorization" && !h.value.includes("{answer")))
+                throw new Error();
+            seen.add(name);
+            headerBytes += Buffer.byteLength(h.name + h.value) + 4;
+            pairs.push([h.name, h.value]);
+        }
+        if (headerBytes > HTTP_MAX_HEADER_BYTES)
+            throw new Error();
+        if (raw.body !== undefined && (!boundedJson(raw.body) || Buffer.byteLength(JSON.stringify(raw.body)) > HTTP_MAX_TEMPLATE_BYTES))
+            throw new Error();
+        return { ok: true, request: structuredClone({ method: raw.method, url: url.toString(), ...(pairs.length ? { headers: Object.fromEntries(pairs) } : {}), ...(raw.body === undefined ? {} : { body: raw.body }) }) };
+    }
+    catch {
+        return { ok: false };
+    }
+}
+//# sourceMappingURL=http-profiles.js.map

package/dist/http-profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-profiles.js","sourceRoot":"","sources":["../src/http-profiles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAGpE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAoBlG,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAC5C,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAC1C,MAAM,MAAM,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC/G,MAAM,IAAI,GAAG,CAAC,CAA0B,EAAE,OAA0B,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACxH,SAAS,aAAa,CAAC,GAAY;IACjC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,EAAE,CAAC;IAC/E,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;QAC7B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,GAAG,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAClG,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,EAAE,CAAC;IACpE,OAAO,SAAS,CAAC,CAAC,yEAAyE;AAC7F,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACxE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;AAC7I,CAAC;AACD;uGACuG;AACvG,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,EAAE,CAAC;IACxG,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;QACrG,GAAG,CAAC,QAAQ,EAAE,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,EAAE,CAAC;IAC5E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAC5H,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAe,EAAE;YACnD,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YAC/L,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YACjH,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAClB,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YAC7L,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;YAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YAC7E,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YAC3I,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;YACvF,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YAC1E,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;YACtB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YACjO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YAClG,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;YAChC,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;gBAChC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;oBACtH,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM;oBAC3F,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM;oBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;gBACtH,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAClB,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAa,EAAE,CAAC;YAC/D,CAAC,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,aAAa,GAAG,CAAC,IAAI,CAAC,CAAC,aAAa,GAAG,GAAG;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YACrJ,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YAC1F,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YACvE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM;gBAC9G,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACvI,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mQAAmQ,EAAE,CAAC;IAAC,CAAC;AAC/S,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAsB;IAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,0BAA0B,CAAC;IAC5C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC7C,IAAI,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAC/E,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACvD,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mHAAmH,EAAE,CAAC;IAAC,CAAC;AAC/J,CAAC;AAED,0FAA0F;AAC1F,kFAAkF;AAClF,MAAM,UAAU,GAAG,CAAC,CAAS,EAAW,EAAE,CAAE,CAA0C,CAAC,YAAY,EAAE,CAAC;AACtG,SAAS,WAAW,CAAC,CAAU,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE;IAC9D,IAAI,EAAE,KAAK,CAAC,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrH,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AAChG,CAAC;AACD,MAAM,UAAU,mBAAmB,CAAC,GAAY,EAAE,OAAoB;IACpE,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAqC,CAAC;YACvK,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACnG,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAgB,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACxJ,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,EAAE,KAAK,GAAuB,EAAE,CAAC;QAC/D,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;gBACtG,CAAC,qCAAqC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YACrH,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAClC,qFAAqF;YACrF,oFAAoF;YACpF,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;gBACrU,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YAClF,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAAC,WAAW,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACvE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,WAAW,GAAG,qBAAqB;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAC3D,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,uBAAuB,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACnJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IACrN,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IAAC,CAAC;AACnC,CAAC"}

package/dist/human-approval.d.ts

@@ -0,0 +1,14 @@
+import type { Approval } from "@mcsherrylabs/evolver-client";
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare class ApprovalUnavailable extends Error {
+    constructor();
+}
+export type HumanApproval = (approval: Approval, signal?: AbortSignal) => Promise<boolean>;
+export type TextHumanApproval = (text: string, signal?: AbortSignal) => Promise<boolean>;
+/** A generic action prompt: transaction approval must NOT impersonate an SDK HTTP request.
+ * The operator must trust this client's human UI to render the WHOLE message, not auto-answer.
+ * Neither a tool parameter nor ordinary assistant text is an approval source. */
+export declare function createTextHumanApproval(server: McpServer, env: NodeJS.ProcessEnv): TextHumanApproval;
+/** Keep the published SDK's HTTP Approval contract at its own boundary. */
+export declare function createHumanApproval(server: McpServer, env: NodeJS.ProcessEnv): HumanApproval;
+//# sourceMappingURL=human-approval.d.ts.map

package/dist/human-approval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"human-approval.d.ts","sourceRoot":"","sources":["../src/human-approval.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,qBAAa,mBAAoB,SAAQ,KAAK;;CAE7C;AAED,MAAM,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAC3F,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEzF;;iFAEiF;AACjF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,iBAAiB,CAiBpG;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,aAAa,CAG5F"}