@moltzap/identity 2026.902.0

package/dist/agent-key.d.ts

@@ -0,0 +1,77 @@
+/** @file Exact Ed25519 public keys and opaque private signing authority. */
+import { Effect, Redacted, Schema } from "effect";
+import { type CryptoKey } from "jose";
+/**
+ * Checks the closed Ed25519 signature representation before cryptographic
+ * verification.
+ *
+ * The standards verifier supplies the strict verification equation. This
+ * boundary additionally rejects alternate point and scalar encodings that
+ * permissive platform verifiers may otherwise accept. The public-key Schema
+ * separately rejects small-order verification keys.
+ *
+ * @param signature Candidate 64-byte Ed25519 signature.
+ * @returns Whether its point and scalar use the single accepted encoding.
+ */
+export declare const hasCanonicalEd25519SignatureEncoding: (signature: Uint8Array) => boolean;
+/** Exact immutable Ed25519 public JWK. */
+export declare const Ed25519PublicKey: Schema.brand<Schema.transform<Schema.Struct<{
+    crv: Schema.Literal<["Ed25519"]>;
+    kty: Schema.Literal<["OKP"]>;
+    x: Schema.filter<typeof Schema.String>;
+}>, Schema.declare<Readonly<{
+    crv: "Ed25519";
+    kty: "OKP";
+    x: string;
+}>, Readonly<{
+    crv: "Ed25519";
+    kty: "OKP";
+    x: string;
+}>, readonly [], never>>, "Ed25519PublicKey">;
+/** Validated immutable Ed25519 public JWK. */
+export type Ed25519PublicKey = typeof Ed25519PublicKey.Type;
+declare const Ed25519PublicKeyOperationError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "Ed25519PublicKeyOperationError";
+} & Readonly<A>;
+/** Reports failure to derive the standard thumbprint URI for a validated key. */
+export declare class Ed25519PublicKeyOperationError extends Ed25519PublicKeyOperationError_base {
+}
+/**
+ * Derives the RFC JWK thumbprint URI for a validated Ed25519 public key.
+ *
+ * @param publicKey Validated public key.
+ * @returns The standard SHA-256 JWK thumbprint URI.
+ * @failure Ed25519PublicKeyOperationError when the JOSE implementation cannot
+ * derive the URI.
+ */
+export declare const ed25519PublicKeyThumbprintUri: (publicKey: Ed25519PublicKey) => Effect.Effect<string, Ed25519PublicKeyOperationError>;
+declare const agentSigningAuthorityBrand: unique symbol;
+/** Opaque authority over one imported Ed25519 private key. */
+export interface AgentSigningAuthority {
+    readonly [agentSigningAuthorityBrand]: "AgentSigningAuthority";
+}
+declare const InvalidAgentPrivateKeyError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "InvalidAgentPrivateKeyError";
+} & Readonly<A>;
+/** The supplied private-key material cannot act as an Ed25519 signer. */
+export declare class InvalidAgentPrivateKeyError extends InvalidAgentPrivateKeyError_base {
+}
+declare const fromPkcs8: (pkcs8: Redacted.Redacted) => Effect.Effect<AgentSigningAuthority, InvalidAgentPrivateKeyError>;
+declare const publicKey: (authority: AgentSigningAuthority) => Ed25519PublicKey;
+/**
+ * Returns the non-extractable key to identity-owned signed-artifact modules.
+ *
+ * @param authority Authority whose private key is needed.
+ * @returns The authority's non-extractable private key.
+ */
+export declare const agentSigningPrivateKey: (authority: AgentSigningAuthority) => CryptoKey;
+/**
+ * Loads and identifies one Ed25519 signing authority without exposing its
+ * private key or a generic signing operation.
+ */
+export declare const AgentSigningAuthority: Readonly<{
+    fromPkcs8: typeof fromPkcs8;
+    publicKey: typeof publicKey;
+}>;
+export {};
+//# sourceMappingURL=agent-key.d.ts.map

package/dist/agent-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-key.d.ts","sourceRoot":"","sources":["../src/agent-key.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAE5E,OAAO,EAAQ,MAAM,EAAoB,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC1E,OAAO,EAEL,KAAK,SAAS,EAGf,MAAM,MAAM,CAAC;AAgGd;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oCAAoC,cACpC,UAAU,KACpB,OAUF,CAAC;AA8EF,0CAA0C;AAE1C,eAAO,MAAM,gBAAgB;;;;;SA7EtB,SAAS;SACT,KAAK;OACP,MAAM;;;;;6CAsGV,CAAC;AAEF,8CAA8C;AAE9C,MAAM,MAAM,gBAAgB,GAAG,OAAO,gBAAgB,CAAC,IAAI,CAAC;;;;AAE5D,iFAAiF;AACjF,qBAAa,8BAA+B,SAAQ,mCAEnD;CAAG;AAEJ;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,cAC7B,gBAAgB,KAC1B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,8BAA8B,CAYnD,CAAC;AAEL,OAAO,CAAC,MAAM,0BAA0B,EAAE,OAAO,MAAM,CAAC;AAExD,8DAA8D;AAC9D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,CAAC,0BAA0B,CAAC,EAAE,uBAAuB,CAAC;CAChE;;;;AAED,yEAAyE;AACzE,qBAAa,2BAA4B,SAAQ,gCAEhD;CAAG;AAiBJ,QAAA,MAAM,SAAS,UACN,QAAQ,CAAC,QAAQ,KACvB,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,2BAA2B,CAyC/D,CAAC;AAEL,QAAA,MAAM,SAAS,cAAe,qBAAqB,KAAG,gBACd,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,cACtB,qBAAqB,KAC/B,SAAoD,CAAC;AAExD;;;GAGG;AAEH,eAAO,MAAM,qBAAqB;;;EAGhC,CAAC"}

package/dist/agent-key.js

@@ -0,0 +1,251 @@
+/** @file Exact Ed25519 public keys and opaque private signing authority. */
+import { Data, Effect, Either, Encoding, Redacted, Schema } from "effect";
+import { calculateJwkThumbprintUri, exportJWK, importPKCS8, } from "jose";
+const PUBLIC_KEY_BYTE_LENGTH = 32;
+const SIGNATURE_BYTE_LENGTH = 64;
+const FIELD_MODULUS = Uint8Array.from([
+    0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0x7f,
+]);
+const SCALAR_ORDER = Uint8Array.from([
+    0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, 0xd6, 0x9c, 0xf7, 0xa2, 0xde,
+    0xf9, 0xde, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x10,
+]);
+const bytesFromHex = (value) => Uint8Array.from(Buffer.from(value, "hex"));
+const SMALL_ORDER_POINTS = Object.freeze([
+    bytesFromHex("00".repeat(32)),
+    bytesFromHex(`01${"00".repeat(31)}`),
+    bytesFromHex("26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05"),
+    bytesFromHex("c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a"),
+    bytesFromHex(`ec${"ff".repeat(30)}7f`),
+    bytesFromHex(`ed${"ff".repeat(30)}7f`),
+    bytesFromHex(`ee${"ff".repeat(30)}7f`),
+]);
+const isLessThanLittleEndian = (value, upperBound) => {
+    if (value.byteLength !== upperBound.byteLength) {
+        return false;
+    }
+    for (let index = value.byteLength - 1; index >= 0; index -= 1) {
+        const valueByte = value[index];
+        const boundByte = upperBound[index];
+        if (valueByte === undefined || boundByte === undefined) {
+            return false;
+        }
+        if (valueByte !== boundByte) {
+            return valueByte < boundByte;
+        }
+    }
+    return false;
+};
+const hasCanonicalPointEncoding = (value) => {
+    if (value.byteLength !== PUBLIC_KEY_BYTE_LENGTH) {
+        return false;
+    }
+    const coordinate = Uint8Array.from(value);
+    const finalByte = coordinate[PUBLIC_KEY_BYTE_LENGTH - 1];
+    if (finalByte === undefined) {
+        return false;
+    }
+    coordinate[PUBLIC_KEY_BYTE_LENGTH - 1] = finalByte & 0x7f;
+    return isLessThanLittleEndian(coordinate, FIELD_MODULUS);
+};
+const encodesSmallOrderPoint = (value) => SMALL_ORDER_POINTS.some((point) => {
+    for (let index = 0; index < PUBLIC_KEY_BYTE_LENGTH; index += 1) {
+        const valueByte = value[index];
+        const pointByte = point[index];
+        if (valueByte === undefined || pointByte === undefined) {
+            return false;
+        }
+        const mask = index === PUBLIC_KEY_BYTE_LENGTH - 1 ? 0x7f : 0xff;
+        if ((valueByte & mask) !== pointByte) {
+            return false;
+        }
+    }
+    return true;
+});
+const hasAcceptedPublicKeyEncoding = (value) => hasCanonicalPointEncoding(value) && !encodesSmallOrderPoint(value);
+const decodeAcceptedPublicKey = (value) => Either.match(Encoding.decodeBase64Url(value), {
+    onLeft: () => undefined,
+    onRight: (bytes) => Encoding.encodeBase64Url(bytes) === value &&
+        hasAcceptedPublicKeyEncoding(bytes)
+        ? bytes
+        : undefined,
+});
+/**
+ * Checks the closed Ed25519 signature representation before cryptographic
+ * verification.
+ *
+ * The standards verifier supplies the strict verification equation. This
+ * boundary additionally rejects alternate point and scalar encodings that
+ * permissive platform verifiers may otherwise accept. The public-key Schema
+ * separately rejects small-order verification keys.
+ *
+ * @param signature Candidate 64-byte Ed25519 signature.
+ * @returns Whether its point and scalar use the single accepted encoding.
+ */
+export const hasCanonicalEd25519SignatureEncoding = (signature) => {
+    if (signature.byteLength !== SIGNATURE_BYTE_LENGTH) {
+        return false;
+    }
+    const encodedPoint = signature.subarray(0, PUBLIC_KEY_BYTE_LENGTH);
+    const scalar = signature.subarray(PUBLIC_KEY_BYTE_LENGTH);
+    return (hasCanonicalPointEncoding(encodedPoint) &&
+        isLessThanLittleEndian(scalar, SCALAR_ORDER));
+};
+const missingMember = Symbol("missingMember");
+const hasExactPublicKeyNames = (value) => {
+    const keys = Reflect.ownKeys(value);
+    const names = new Set(keys);
+    return (keys.length === 3 && names.has("crv") && names.has("kty") && names.has("x"));
+};
+const readPublicKeyMember = (value, name) => {
+    const descriptor = Object.getOwnPropertyDescriptor(value, name);
+    if (descriptor === undefined ||
+        descriptor.enumerable !== true ||
+        !("value" in descriptor)) {
+        return missingMember;
+    }
+    return descriptor.value;
+};
+const hasPublicKeyMembers = (value) => {
+    if (!hasExactPublicKeyNames(value)) {
+        return false;
+    }
+    const crv = readPublicKeyMember(value, "crv");
+    const kty = readPublicKeyMember(value, "kty");
+    const x = readPublicKeyMember(value, "x");
+    return crv === "Ed25519" && kty === "OKP" && typeof x === "string";
+};
+const isFrozenPublicKey = (value) => {
+    try {
+        return (typeof value === "object" &&
+            value !== null &&
+            Object.isFrozen(value) &&
+            hasPublicKeyMembers(value));
+        // eslint-disable-next-line agent-code-guard/bare-catch -- A Schema predicate converts hostile reflection into ordinary validation failure. #ignore-sloppy-code-next-line[bare-catch]: The predicate returns false.
+    }
+    catch {
+        return false;
+    }
+};
+const publicKeyValueSchema = Schema.declare(isFrozenPublicKey, {
+    identifier: "Ed25519PublicKeyValue",
+});
+const publicKeyRepresentation = Schema.Struct({
+    crv: Schema.Literal("Ed25519"),
+    kty: Schema.Literal("OKP"),
+    x: Schema.String.pipe(Schema.filter((value) => decodeAcceptedPublicKey(value) !== undefined, {
+        identifier: "Ed25519PublicKeyCoordinate",
+        description: "Canonical non-small-order Ed25519 public-key coordinate",
+    })),
+}).annotations({
+    identifier: "Ed25519PublicKeyRepresentation",
+    parseOptions: {
+        exact: true,
+        onExcessProperty: "error",
+    },
+});
+/** Exact immutable Ed25519 public JWK. */
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Effect Schemas use the public model's type name so callers import one vocabulary term.
+export const Ed25519PublicKey = Schema.transform(publicKeyRepresentation, publicKeyValueSchema, {
+    strict: true,
+    decode: (value) => Object.freeze({
+        crv: value.crv,
+        kty: value.kty,
+        x: value.x,
+    }),
+    encode: (value) => ({
+        crv: value.crv,
+        kty: value.kty,
+        x: value.x,
+    }),
+}).pipe(Schema.brand("Ed25519PublicKey"), Schema.annotations({
+    identifier: "Ed25519PublicKey",
+    description: "Exact immutable Ed25519 public JWK",
+    parseOptions: {
+        exact: true,
+        onExcessProperty: "error",
+    },
+}));
+/** Reports failure to derive the standard thumbprint URI for a validated key. */
+export class Ed25519PublicKeyOperationError extends Data.TaggedError("Ed25519PublicKeyOperationError") {
+}
+/**
+ * Derives the RFC JWK thumbprint URI for a validated Ed25519 public key.
+ *
+ * @param publicKey Validated public key.
+ * @returns The standard SHA-256 JWK thumbprint URI.
+ * @failure Ed25519PublicKeyOperationError when the JOSE implementation cannot
+ * derive the URI.
+ */
+export const ed25519PublicKeyThumbprintUri = (publicKey) => Effect.tryPromise({
+    try: () => calculateJwkThumbprintUri({
+        crv: publicKey.crv,
+        kty: publicKey.kty,
+        x: publicKey.x,
+    }, "sha256"),
+    catch: () => new Ed25519PublicKeyOperationError(),
+});
+/** The supplied private-key material cannot act as an Ed25519 signer. */
+export class InvalidAgentPrivateKeyError extends Data.TaggedError("InvalidAgentPrivateKeyError") {
+}
+const authorityState = new WeakMap();
+const getAuthorityState = (authority) => {
+    const state = authorityState.get(authority);
+    // eslint-disable-next-line agent-code-guard/require-assertion-rationale -- The construction invariant inserts state before this opaque value escapes.
+    return state;
+};
+const fromPkcs8 = (pkcs8) => Effect.gen(function* () {
+    // JOSE needs an extractable import to derive the public JWK, while the
+    // authority retains a separate non-extractable import.
+    const extractableKey = yield* Effect.tryPromise({
+        try: () => importPKCS8(Redacted.value(pkcs8), "Ed25519", {
+            extractable: true,
+        }),
+        catch: () => new InvalidAgentPrivateKeyError(),
+    });
+    const exportedKey = yield* Effect.tryPromise({
+        try: () => exportJWK(extractableKey),
+        catch: () => new InvalidAgentPrivateKeyError(),
+    });
+    const publicKey = yield* Schema.decodeUnknown(Ed25519PublicKey)({
+        crv: exportedKey.crv,
+        kty: exportedKey.kty,
+        x: exportedKey.x,
+    }, {
+        exact: true,
+        onExcessProperty: "error",
+    }).pipe(
+    // eslint-disable-next-line agent-code-guard/no-effect-error-coalescing -- The public contract intentionally represents every unusable private key with one empty error.
+    Effect.mapError(() => new InvalidAgentPrivateKeyError()));
+    const privateKey = yield* Effect.tryPromise({
+        try: () => importPKCS8(Redacted.value(pkcs8), "Ed25519", {
+            extractable: false,
+        }),
+        catch: () => new InvalidAgentPrivateKeyError(),
+    });
+    // eslint-disable-next-line agent-code-guard/require-assertion-rationale -- This assertion is safe because this module alone constructs values after inserting their WeakMap state.
+    const authority = Object.freeze({});
+    authorityState.set(authority, { privateKey, publicKey });
+    return authority;
+});
+const publicKey = (authority) => getAuthorityState(authority).publicKey;
+/**
+ * Returns the non-extractable key to identity-owned signed-artifact modules.
+ *
+ * @param authority Authority whose private key is needed.
+ * @returns The authority's non-extractable private key.
+ */
+export const agentSigningPrivateKey = (authority) => getAuthorityState(authority).privateKey;
+/**
+ * Loads and identifies one Ed25519 signing authority without exposing its
+ * private key or a generic signing operation.
+ */
+// eslint-disable-next-line @typescript-eslint/naming-convention, @typescript-eslint/no-redeclare -- The approved Effect-style API uses one name for its opaque type and capability value.
+export const AgentSigningAuthority = Object.freeze({
+    fromPkcs8,
+    publicKey,
+});
+//# sourceMappingURL=agent-key.js.map

package/dist/agent-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-key.js","sourceRoot":"","sources":["../src/agent-key.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAE5E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC1E,OAAO,EACL,yBAAyB,EAEzB,SAAS,EACT,WAAW,GACZ,MAAM,MAAM,CAAC;AAEd,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC;IACpC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CACnC,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC;IACnC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CACnC,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,KAAa,EAAc,EAAE,CACjD,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAE7C,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC;IACvC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7B,YAAY,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IACpC,YAAY,CACV,kEAAkE,CACnE;IACD,YAAY,CACV,kEAAkE,CACnE;IACD,YAAY,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC;IACtC,YAAY,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC;IACtC,YAAY,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC;CACvC,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,CAC7B,KAAiB,EACjB,UAAsB,EACb,EAAE;IACX,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU,CAAC,UAAU,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,KAAK,CAAC,UAAU,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACvD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,SAAS,GAAG,SAAS,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,yBAAyB,GAAG,CAAC,KAAiB,EAAW,EAAE;IAC/D,IAAI,KAAK,CAAC,UAAU,KAAK,sBAAsB,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,UAAU,CAAC,sBAAsB,GAAG,CAAC,CAAC,CAAC;IACzD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,UAAU,CAAC,sBAAsB,GAAG,CAAC,CAAC,GAAG,SAAS,GAAG,IAAI,CAAC;IAC1D,OAAO,sBAAsB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAC3D,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAAC,KAAiB,EAAW,EAAE,CAC5D,kBAAkB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;IAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,sBAAsB,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACvD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,KAAK,sBAAsB,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC,CAAC;AAEL,MAAM,4BAA4B,GAAG,CAAC,KAAiB,EAAW,EAAE,CAClE,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;AAErE,MAAM,uBAAuB,GAAG,CAAC,KAAa,EAA0B,EAAE,CACxE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE;IAC5C,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS;IACvB,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,KAAK;QACzC,4BAA4B,CAAC,KAAK,CAAC;QACjC,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS;CAChB,CAAC,CAAC;AAEL;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAClD,SAAqB,EACZ,EAAE;IACX,IAAI,SAAS,CAAC,UAAU,KAAK,qBAAqB,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAC1D,OAAO,CACL,yBAAyB,CAAC,YAAY,CAAC;QACvC,sBAAsB,CAAC,MAAM,EAAE,YAAY,CAAC,CAC7C,CAAC;AACJ,CAAC,CAAC;AAQF,MAAM,aAAa,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;AAE9C,MAAM,sBAAsB,GAAG,CAAC,KAAa,EAAW,EAAE;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,CACL,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAC5E,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAC1B,KAAa,EACb,IAAyB,EAChB,EAAE;IACX,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAChE,IACE,UAAU,KAAK,SAAS;QACxB,UAAU,CAAC,UAAU,KAAK,IAAI;QAC9B,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,EACxB,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,CAAC;AAC1B,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAAC,KAAa,EAA2B,EAAE;IACrE,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,MAAM,CAAC,GAAG,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1C,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,KAAK,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC;AACrE,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAA2B,EAAE;IACpE,IAAI,CAAC;QACH,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACd,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YACtB,mBAAmB,CAAC,KAAK,CAAC,CAC3B,CAAC;QACF,mNAAmN;IACrN,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE;IAC7D,UAAU,EAAE,uBAAuB;CACpC,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;IAC9B,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;IAC1B,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CACnB,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE;QACrE,UAAU,EAAE,4BAA4B;QACxC,WAAW,EAAE,yDAAyD;KACvE,CAAC,CACH;CACF,CAAC,CAAC,WAAW,CAAC;IACb,UAAU,EAAE,gCAAgC;IAC5C,YAAY,EAAE;QACZ,KAAK,EAAE,IAAI;QACX,gBAAgB,EAAE,OAAO;KAC1B;CACF,CAAC,CAAC;AAEH,0CAA0C;AAC1C,0JAA0J;AAC1J,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,SAAS,CAC9C,uBAAuB,EACvB,oBAAoB,EACpB;IACE,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAChB,MAAM,CAAC,MAAM,CAAC;QACZ,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,CAAC,EAAE,KAAK,CAAC,CAAC;KACX,CAAC;IACJ,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,CAAC,EAAE,KAAK,CAAC,CAAC;KACX,CAAC;CACH,CACF,CAAC,IAAI,CACJ,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAChC,MAAM,CAAC,WAAW,CAAC;IACjB,UAAU,EAAE,kBAAkB;IAC9B,WAAW,EAAE,oCAAoC;IACjD,YAAY,EAAE;QACZ,KAAK,EAAE,IAAI;QACX,gBAAgB,EAAE,OAAO;KAC1B;CACF,CAAC,CACH,CAAC;AAMF,iFAAiF;AACjF,MAAM,OAAO,8BAA+B,SAAQ,IAAI,CAAC,WAAW,CAClE,gCAAgC,CACjC;CAAG;AAEJ;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC3C,SAA2B,EAC4B,EAAE,CACzD,MAAM,CAAC,UAAU,CAAC;IAChB,GAAG,EAAE,GAAG,EAAE,CACR,yBAAyB,CACvB;QACE,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,CAAC,EAAE,SAAS,CAAC,CAAC;KACf,EACD,QAAQ,CACT;IACH,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,8BAA8B,EAAE;CAClD,CAAC,CAAC;AASL,yEAAyE;AACzE,MAAM,OAAO,2BAA4B,SAAQ,IAAI,CAAC,WAAW,CAC/D,6BAA6B,CAC9B;CAAG;AAOJ,MAAM,cAAc,GAAG,IAAI,OAAO,EAAyC,CAAC;AAE5E,MAAM,iBAAiB,GAAG,CACxB,SAAgC,EAChB,EAAE;IAClB,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC5C,sJAAsJ;IACtJ,OAAO,KAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAChB,KAAwB,EAC2C,EAAE,CACrE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,uEAAuE;IACvE,uDAAuD;IACvD,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;QAC9C,GAAG,EAAE,GAAG,EAAE,CACR,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE;YAC5C,WAAW,EAAE,IAAI;SAClB,CAAC;QACJ,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,2BAA2B,EAAE;KAC/C,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;QAC3C,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,cAAc,CAAC;QACpC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,2BAA2B,EAAE;KAC/C,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAC7D;QACE,GAAG,EAAE,WAAW,CAAC,GAAG;QACpB,GAAG,EAAE,WAAW,CAAC,GAAG;QACpB,CAAC,EAAE,WAAW,CAAC,CAAC;KACjB,EACD;QACE,KAAK,EAAE,IAAI;QACX,gBAAgB,EAAE,OAAO;KAC1B,CACF,CAAC,IAAI;IACJ,wKAAwK;IACxK,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,2BAA2B,EAAE,CAAC,CACzD,CAAC;IAEF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;QAC1C,GAAG,EAAE,GAAG,EAAE,CACR,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE;YAC5C,WAAW,EAAE,KAAK;SACnB,CAAC;QACJ,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,2BAA2B,EAAE;KAC/C,CAAC,CAAC;IACH,mLAAmL;IACnL,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAA0B,CAAC;IAC7D,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC,CAAC;AAEL,MAAM,SAAS,GAAG,CAAC,SAAgC,EAAoB,EAAE,CACvE,iBAAiB,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,SAAgC,EACrB,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC;AAExD;;;GAGG;AACH,0LAA0L;AAC1L,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CAAC;IACjD,SAAS;IACT,SAAS;CACV,CAAC,CAAC"}

package/dist/authenticated-http.d.ts

@@ -0,0 +1,44 @@
+/** @file Registered-agent HTTP signing, resolution, replay defense, and verification. */
+import type { HttpClientRequest, HttpServerRequest } from "@effect/platform";
+import { Brand, Context, Effect, Layer } from "effect";
+import type { VerifiedAgentCard } from "./agent-card.js";
+import type { AgentSigningAuthority } from "./agent-key.js";
+import { AuthenticationFailedError, MalformedRequestError, OverloadedError, UnavailableError, VersionMismatchError } from "./http-errors.js";
+import { AgentSigningError } from "./http-signature.js";
+import { type AgentId as AgentIdValue } from "./identifiers.js";
+import { Registry } from "./registry.js";
+/** Request body and caller identity established by AuthenticatedHttp. */
+export type VerifiedAgentRequest = Readonly<{
+    readonly callerAgentId: AgentIdValue;
+    readonly agentCard: VerifiedAgentCard;
+    readonly request: unknown;
+}> & Brand.Brand<"VerifiedAgentRequest">;
+type AuthenticationError = MalformedRequestError | AuthenticationFailedError | VersionMismatchError | OverloadedError | UnavailableError;
+interface AuthenticatedHttpService {
+    readonly verifyAgentRequest: (input: {
+        readonly httpRequest: HttpServerRequest.HttpServerRequest;
+        readonly bodyBytes: Uint8Array;
+    }) => Effect.Effect<VerifiedAgentRequest, AuthenticationError>;
+}
+declare const AuthenticatedHttp_base: Context.TagClass<AuthenticatedHttp, "@moltzap/identity/AuthenticatedHttp", AuthenticatedHttpService>;
+/** Registered-agent request signing and verification. */
+export declare class AuthenticatedHttp extends AuthenticatedHttp_base {
+    static readonly signAgentRequest: typeof signAgentRequest;
+    static readonly verifyAgentRequest: (input: {
+        readonly httpRequest: HttpServerRequest.HttpServerRequest;
+        readonly bodyBytes: Uint8Array;
+    }) => Effect.Effect<VerifiedAgentRequest, AuthenticationError, AuthenticatedHttp>;
+    static readonly layer: (input: {
+        readonly liveNonceCapacity: number;
+        readonly agentCardCacheCapacity: number;
+        readonly registryLookupConcurrencyLimit: number;
+    }) => Layer.Layer<AuthenticatedHttp, never, Registry>;
+}
+declare function signAgentRequest(input: {
+    readonly httpRequest: HttpClientRequest.HttpClientRequest;
+    readonly callerAgentId: AgentIdValue;
+    readonly encodedRequest: unknown;
+    readonly signingAuthority: AgentSigningAuthority;
+}): Effect.Effect<HttpClientRequest.HttpClientRequest, AgentSigningError>;
+export {};
+//# sourceMappingURL=authenticated-http.d.ts.map

package/dist/authenticated-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticated-http.d.ts","sourceRoot":"","sources":["../src/authenticated-http.ts"],"names":[],"mappings":"AAAA,yFAAyF;AAEzF,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EACL,KAAK,EACL,OAAO,EAEP,MAAM,EACN,KAAK,EAIN,MAAM,QAAQ,CAAC;AAChB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAG5D,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,iBAAiB,EAGlB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAW,KAAK,OAAO,IAAI,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGzC,yEAAyE;AACzE,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAC1C,QAAQ,CAAC,aAAa,EAAE,YAAY,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B,CAAC,GACA,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;AAEtC,KAAK,mBAAmB,GACpB,qBAAqB,GACrB,yBAAyB,GACzB,oBAAoB,GACpB,eAAe,GACf,gBAAgB,CAAC;AAErB,UAAU,wBAAwB;IAChC,QAAQ,CAAC,kBAAkB,EAAE,CAAC,KAAK,EAAE;QACnC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC,iBAAiB,CAAC;QAC1D,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;KAChC,KAAK,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;CAChE;;AAED,yDAAyD;AACzD,qBAAa,iBAAkB,SAAQ,sBAES;IAC9C,MAAM,CAAC,QAAQ,CAAC,gBAAgB,0BAAoB;IAEpD,MAAM,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC,KAAK,EAAE;QAC1C,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC,iBAAiB,CAAC;QAC1D,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;KAChC,KAAK,MAAM,CAAC,MAAM,CACjB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,CAClB,CAGC;IAEF,MAAM,CAAC,QAAQ,CAAC,KAAK,UAAW;QAC9B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;QACxC,QAAQ,CAAC,8BAA8B,EAAE,MAAM,CAAC;KACjD,KAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,EAAE,QAAQ,CAAC,CACU;CAC9D;AA2CD,iBAAS,gBAAgB,CAAC,KAAK,EAAE;IAC/B,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC,iBAAiB,CAAC;IAC1D,QAAQ,CAAC,aAAa,EAAE,YAAY,CAAC;IACrC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,gBAAgB,EAAE,qBAAqB,CAAC;CAClD,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAiBxE"}

package/dist/authenticated-http.js

@@ -0,0 +1,226 @@
+/** @file Registered-agent HTTP signing, resolution, replay defense, and verification. */
+import { Brand, Context, Deferred, Effect, Layer, Option, Ref, Schema, } from "effect";
+import { decodeCanonicalJson, encodeCanonicalJson } from "./canonical-json.js";
+import { AuthenticationFailedError, MalformedRequestError, OverloadedError, UnavailableError, VersionMismatchError, } from "./http-errors.js";
+import { AgentSigningError, signHttpRequest, verifyHttpRequestSignature, } from "./http-signature.js";
+import { AgentId } from "./identifiers.js";
+import { Registry } from "./registry.js";
+import { MOLTZAP_VERSION } from "./version.js";
+/** Registered-agent request signing and verification. */
+export class AuthenticatedHttp extends Context.Tag("@moltzap/identity/AuthenticatedHttp")() {
+    static signAgentRequest = signAgentRequest;
+    static verifyAgentRequest = Effect.serviceFunctionEffect(AuthenticatedHttp, (service) => service.verifyAgentRequest);
+    static layer = (input) => Layer.effect(AuthenticatedHttp, makeService({ ...input }));
+}
+const brandVerifiedAgentRequest = Brand.nominal();
+const exactStruct = (fields) => Schema.Struct(fields).annotations({
+    parseOptions: {
+        exact: true,
+        onExcessProperty: "error",
+    },
+});
+const registeredAgentBody = exactStruct({
+    callerAgentId: AgentId,
+    request: Schema.Unknown,
+});
+function makeService(input) {
+    return Effect.gen(function* () {
+        const registry = yield* Registry;
+        const nonces = yield* Ref.make(new Map());
+        const resolveCard = yield* makeCardResolver({
+            cacheCapacity: input.agentCardCacheCapacity,
+            lookupConcurrencyLimit: input.registryLookupConcurrencyLimit,
+        }, (request) => registry.lookup(request));
+        return {
+            verifyAgentRequest: (request) => verifyRequest(request, {
+                liveNonceCapacity: input.liveNonceCapacity,
+                nonces,
+                resolveCard,
+            }),
+        };
+    });
+}
+function signAgentRequest(input) {
+    return encodeCanonicalJson({
+        callerAgentId: input.callerAgentId,
+        request: input.encodedRequest,
+    }).pipe(Effect.catchTag("CanonicalJsonError", () => Effect.fail(new AgentSigningError())), Effect.flatMap((bodyBytes) => signHttpRequest({
+        httpRequest: input.httpRequest,
+        bodyBytes,
+        signingAuthority: input.signingAuthority,
+        profile: "normal",
+    })));
+}
+function verifyRequest(input, dependencies) {
+    return Effect.gen(function* () {
+        const body = yield* decodeCanonicalJson(registeredAgentBody, Uint8Array.from(input.bodyBytes)).pipe(Effect.catchTag("CanonicalJsonError", () => Effect.fail(new MalformedRequestError())));
+        const agentCard = yield* dependencies.resolveCard(body.callerAgentId);
+        const signature = yield* verifyHttpRequestSignature({
+            httpRequest: input.httpRequest,
+            bodyBytes: input.bodyBytes,
+            publicKey: agentCard.publicKey,
+            profile: "normal",
+        });
+        const claim = yield* claimNonce(dependencies.nonces, {
+            capacity: dependencies.liveNonceCapacity,
+            nonce: signature.nonce,
+            expires: signature.expires,
+            now: signature.verifiedAt,
+        });
+        if (claim === "replayed") {
+            return yield* new AuthenticationFailedError();
+        }
+        if (claim === "full") {
+            return yield* new OverloadedError();
+        }
+        if (input.httpRequest.headers["moltzap-version"] !== MOLTZAP_VERSION) {
+            return yield* new VersionMismatchError();
+        }
+        return makeVerifiedAgentRequest({
+            callerAgentId: body.callerAgentId,
+            agentCard,
+            request: body.request,
+        });
+    });
+}
+function makeCardResolver(settings, lookup) {
+    return Effect.gen(function* () {
+        const cache = yield* Ref.make({
+            cards: new Map(),
+            recency: Object.freeze([]),
+            pending: new Map(),
+        });
+        const lookupPermits = yield* Effect.makeSemaphore(settings.lookupConcurrencyLimit);
+        const dependencies = {
+            cache,
+            cacheCapacity: settings.cacheCapacity,
+            lookup,
+            lookupPermits,
+        };
+        return (agentId) => Effect.uninterruptibleMask((restoreInterruptibility) => resolveCard(dependencies, agentId, restoreInterruptibility));
+    });
+}
+function resolveCard(dependencies, agentId, restoreInterruptibility) {
+    return Effect.gen(function* () {
+        const candidate = yield* Deferred.make();
+        const access = yield* beginCardResolution(dependencies.cache, agentId, candidate);
+        return yield* resolveCacheAccess(dependencies, agentId, access, restoreInterruptibility);
+    });
+}
+function resolveCacheAccess(dependencies, agentId, access, restoreInterruptibility) {
+    // CacheAccess is a closed discriminated union.
+    // eslint-disable-next-line default-case -- the switch is exhaustive
+    switch (access.kind) {
+        case "cached":
+            return Effect.succeed(access.card);
+        case "join":
+            return restoreInterruptibility(Deferred.await(access.deferred));
+        case "lead":
+            return Effect.forkDaemon(runLeadingResolution(dependencies, agentId, access.deferred).pipe(Effect.interruptible)).pipe(Effect.zipRight(restoreInterruptibility(Deferred.await(access.deferred))));
+    }
+}
+function runLeadingResolution(dependencies, agentId, deferred) {
+    return lookupCard(dependencies, agentId).pipe(Effect.tap((card) => retainResolvedCard(dependencies.cache, {
+        capacity: dependencies.cacheCapacity,
+        agentId,
+        card,
+    })), Effect.onExit((exit) => removePendingResolution(dependencies.cache, agentId).pipe(Effect.zipRight(Deferred.done(deferred, exit)))));
+}
+function lookupCard(dependencies, agentId) {
+    return dependencies.lookupPermits
+        .withPermitsIfAvailable(1)(dependencies.lookup({ agentId }).pipe(
+    // Registry failures have one recovery at this boundary: the caller
+    // identity cannot currently be resolved.
+    // eslint-disable-next-line agent-code-guard/no-effect-error-coalescing -- collapse the Registry client surface into the approved boundary error
+    Effect.mapError(() => new UnavailableError())))
+        .pipe(Effect.flatMap(resolveLookupAttempt));
+}
+function resolveLookupAttempt(attempted) {
+    if (Option.isNone(attempted)) {
+        return Effect.fail(new OverloadedError());
+    }
+    return attempted.value.kind === "found"
+        ? Effect.succeed(attempted.value.agentCard)
+        : Effect.fail(new AuthenticationFailedError());
+}
+function beginCardResolution(cache, agentId, candidate) {
+    return Ref.modify(cache, (current) => {
+        const card = current.cards.get(agentId);
+        if (card !== undefined) {
+            return [
+                { kind: "cached", card },
+                {
+                    ...current,
+                    recency: Object.freeze([
+                        ...current.recency.filter((value) => value !== agentId),
+                        agentId,
+                    ]),
+                },
+            ];
+        }
+        const pending = current.pending.get(agentId);
+        if (pending !== undefined) {
+            return [{ kind: "join", deferred: pending }, current];
+        }
+        return [
+            { kind: "lead", deferred: candidate },
+            {
+                ...current,
+                pending: new Map(current.pending).set(agentId, candidate),
+            },
+        ];
+    });
+}
+function removePendingResolution(cache, agentId) {
+    return Ref.update(cache, (current) => {
+        const pending = new Map(current.pending);
+        pending.delete(agentId);
+        return { ...current, pending };
+    });
+}
+function retainResolvedCard(cache, input) {
+    return Ref.update(cache, (current) => {
+        const pending = new Map(current.pending);
+        pending.delete(input.agentId);
+        const cards = new Map(current.cards);
+        const recency = [
+            ...current.recency.filter((value) => value !== input.agentId),
+            input.agentId,
+        ];
+        cards.set(input.agentId, input.card);
+        while (recency.length > input.capacity) {
+            const evicted = recency.shift();
+            if (evicted !== undefined) {
+                cards.delete(evicted);
+            }
+        }
+        return {
+            cards,
+            recency: Object.freeze(recency),
+            pending,
+        };
+    });
+}
+function claimNonce(nonces, input) {
+    return Ref.modify(nonces, (current) => updateNonces(current, input));
+}
+function updateNonces(current, input) {
+    const live = new Map();
+    for (const [retainedNonce, retainedExpiry] of current) {
+        if (retainedExpiry >= input.now) {
+            live.set(retainedNonce, retainedExpiry);
+        }
+    }
+    if (live.has(input.nonce)) {
+        return ["replayed", live];
+    }
+    if (live.size >= input.capacity) {
+        return ["full", live];
+    }
+    live.set(input.nonce, input.expires);
+    return ["claimed", live];
+}
+function makeVerifiedAgentRequest(input) {
+    return brandVerifiedAgentRequest(Object.freeze({ ...input }));
+}
+//# sourceMappingURL=authenticated-http.js.map

package/dist/authenticated-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticated-http.js","sourceRoot":"","sources":["../src/authenticated-http.ts"],"names":[],"mappings":"AAAA,yFAAyF;AAGzF,OAAO,EACL,KAAK,EACL,OAAO,EACP,QAAQ,EACR,MAAM,EACN,KAAK,EACL,MAAM,EACN,GAAG,EACH,MAAM,GACP,MAAM,QAAQ,CAAC;AAIhB,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAgC,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAwB/C,yDAAyD;AACzD,MAAM,OAAO,iBAAkB,SAAQ,OAAO,CAAC,GAAG,CAChD,qCAAqC,CACtC,EAA+C;IAC9C,MAAM,CAAU,gBAAgB,GAAG,gBAAgB,CAAC;IAEpD,MAAM,CAAU,kBAAkB,GAO9B,MAAM,CAAC,qBAAqB,CAC9B,iBAAiB,EACjB,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,kBAAkB,CACxC,CAAC;IAEF,MAAM,CAAU,KAAK,GAAG,CAAC,KAIxB,EAAmD,EAAE,CACpD,KAAK,CAAC,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC;CAC9D;AAED,MAAM,yBAAyB,GAAG,KAAK,CAAC,OAAO,EAAwB,CAAC;AAExE,MAAM,WAAW,GAAG,CAAsC,MAAc,EAAE,EAAE,CAC1E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC;IAChC,YAAY,EAAE;QACZ,KAAK,EAAE,IAAI;QACX,gBAAgB,EAAE,OAAO;KAC1B;CACF,CAAC,CAAC;AAEL,MAAM,mBAAmB,GAAG,WAAW,CAAC;IACtC,aAAa,EAAE,OAAO;IACtB,OAAO,EAAE,MAAM,CAAC,OAAO;CACxB,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,KAIpB;IACC,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC;QACjC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAA8B,IAAI,GAAG,EAAE,CAAC,CAAC;QACvE,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,gBAAgB,CACzC;YACE,aAAa,EAAE,KAAK,CAAC,sBAAsB;YAC3C,sBAAsB,EAAE,KAAK,CAAC,8BAA8B;SAC7D,EACD,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CACtC,CAAC;QACF,OAAO;YACL,kBAAkB,EAAE,CAAC,OAAO,EAAE,EAAE,CAC9B,aAAa,CAAC,OAAO,EAAE;gBACrB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,MAAM;gBACN,WAAW;aACZ,CAAC;SACL,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,KAKzB;IACC,OAAO,mBAAmB,CAAC;QACzB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,OAAO,EAAE,KAAK,CAAC,cAAc;KAC9B,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE,CACzC,MAAM,CAAC,IAAI,CAAC,IAAI,iBAAiB,EAAE,CAAC,CACrC,EACD,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAC3B,eAAe,CAAC;QACd,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS;QACT,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE,QAAQ;KAClB,CAAC,CACH,CACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,KAGC,EACD,YAIC;IAED,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,mBAAmB,CACrC,mBAAmB,EACnB,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CACjC,CAAC,IAAI,CACJ,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE,CACzC,MAAM,CAAC,IAAI,CAAC,IAAI,qBAAqB,EAAE,CAAC,CACzC,CACF,CAAC;QACF,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,0BAA0B,CAAC;YAClD,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,MAAM,EAAE;YACnD,QAAQ,EAAE,YAAY,CAAC,iBAAiB;YACxC,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,GAAG,EAAE,SAAS,CAAC,UAAU;SAC1B,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC,CAAC,IAAI,yBAAyB,EAAE,CAAC;QAChD,CAAC;QACD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC;QACtC,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,eAAe,EAAE,CAAC;YACrE,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,EAAE,CAAC;QAC3C,CAAC;QACD,OAAO,wBAAwB,CAAC;YAC9B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS;YACT,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAqDD,SAAS,gBAAgB,CACvB,QAAgC,EAChC,MAAsB;IAMtB,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAY;YACvC,KAAK,EAAE,IAAI,GAAG,EAAE;YAChB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,IAAI,GAAG,EAAE;SACnB,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAC/C,QAAQ,CAAC,sBAAsB,CAChC,CAAC;QACF,MAAM,YAAY,GAA6B;YAC7C,KAAK;YACL,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,MAAM;YACN,aAAa;SACd,CAAC;QACF,OAAO,CACL,OAAqB,EACkC,EAAE,CACzD,MAAM,CAAC,mBAAmB,CAAC,CAAC,uBAAuB,EAAE,EAAE,CACrD,WAAW,CAAC,YAAY,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAC5D,CAAC;IACN,CAAC,CAAC,CAAC;AACL,CAAC;AAID,SAAS,WAAW,CAClB,YAAsC,EACtC,OAAqB,EACrB,uBAAgD;IAEhD,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,EAGnC,CAAC;QACJ,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,mBAAmB,CACvC,YAAY,CAAC,KAAK,EAClB,OAAO,EACP,SAAS,CACV,CAAC;QACF,OAAO,KAAK,CAAC,CAAC,kBAAkB,CAC9B,YAAY,EACZ,OAAO,EACP,MAAM,EACN,uBAAuB,CACxB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CACzB,YAAsC,EACtC,OAAqB,EACrB,MAAmB,EACnB,uBAAgD;IAEhD,+CAA+C;IAC/C,oEAAoE;IACpE,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrC,KAAK,MAAM;YACT,OAAO,uBAAuB,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,KAAK,MAAM;YACT,OAAO,MAAM,CAAC,UAAU,CACtB,oBAAoB,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC/D,MAAM,CAAC,aAAa,CACrB,CACF,CAAC,IAAI,CACJ,MAAM,CAAC,QAAQ,CACb,uBAAuB,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CACzD,CACF,CAAC;IACN,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,YAAsC,EACtC,OAAqB,EACrB,QAAmE;IAEnE,OAAO,UAAU,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,CAC3C,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAClB,kBAAkB,CAAC,YAAY,CAAC,KAAK,EAAE;QACrC,QAAQ,EAAE,YAAY,CAAC,aAAa;QACpC,OAAO;QACP,IAAI;KACL,CAAC,CACH,EACD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACrB,uBAAuB,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CACvD,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAC/C,CACF,CACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,YAAsC,EACtC,OAAqB;IAErB,OAAO,YAAY,CAAC,aAAa;SAC9B,sBAAsB,CAAC,CAAC,CAAC,CACxB,YAAY,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI;IACnC,mEAAmE;IACnE,yCAAyC;IACzC,gJAAgJ;IAChJ,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAC9C,CACF;SACA,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,oBAAoB,CAC3B,SAA8C;IAK9C,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO;QACrC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,yBAAyB,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAyB,EACzB,OAAqB,EACrB,SAAoE;IAEpE,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,EAAqC,EAAE;QACtE,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO;gBACL,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACxB;oBACE,GAAG,OAAO;oBACV,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;wBACrB,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC;wBACvD,OAAO;qBACR,CAAC;iBACH;aACO,CAAC;QACb,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,CAAU,CAAC;QACjE,CAAC;QACD,OAAO;YACL,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE;YACrC;gBACE,GAAG,OAAO;gBACV,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC;aAC1D;SACO,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAAyB,EACzB,OAAqB;IAErB,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACxB,OAAO,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAyB,EACzB,KAIC;IAED,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG;YACd,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO,CAAC;YAC7D,KAAK,CAAC,OAAO;SACd,CAAC;QACF,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACrC,OAAO,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;YAChC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QACD,OAAO;YACL,KAAK;YACL,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;YAC/B,OAAO;SACR,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAWD,SAAS,UAAU,CACjB,MAA4C,EAC5C,KAAsB;IAEtB,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,YAAY,CACnB,OAAoC,EACpC,KAAsB;IAEtB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,CAAC,aAAa,EAAE,cAAc,CAAC,IAAI,OAAO,EAAE,CAAC;QACtD,IAAI,cAAc,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAChC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,wBAAwB,CAAC,KAIjC;IACC,OAAO,yBAAyB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC;AAChE,CAAC"}