@vauban-org/agent-sdk 0.17.4 → 1.2.0

package/dist/ports/compliance-contract.js

@@ -0,0 +1,35 @@
+/**
+ * ComplianceContractPort — runtime compliance gate for the Vauban Integration Spine.
+ *
+ * Implements the G-2 Cedar pivot from S5 spec:
+ * - pre-step: block or warn before capability invocation
+ * - post-step: audit trail after invocation
+ * - validateManifest: conflict detection at registration
+ *
+ * Cedar policy bundles: eu.gdpr / eu.mica / eu.tfr (V0 scope per S5 Q5.1).
+ */
+export const SUPPORTED_JURISDICTIONS_V0 = ["FR.v1", "EU.v1"];
+// ─── Typed errors ─────────────────────────────────────────────────────────────
+export class CompliancePolicyError extends Error {
+    ruleId;
+    cause;
+    constructor(message, ruleId, cause) {
+        super(message);
+        this.ruleId = ruleId;
+        this.cause = cause;
+        this.name = "CompliancePolicyError";
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+export class ComplianceEvaluationTimeoutError extends Error {
+    timeoutMs;
+    cause;
+    constructor(timeoutMs, cause) {
+        super(`Compliance evaluation timed out after ${timeoutMs}ms`);
+        this.timeoutMs = timeoutMs;
+        this.cause = cause;
+        this.name = "ComplianceEvaluationTimeoutError";
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+//# sourceMappingURL=compliance-contract.js.map

package/dist/ports/compliance-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance-contract.js","sourceRoot":"","sources":["../../src/ports/compliance-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,MAAM,CAAC,MAAM,0BAA0B,GAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAwJ7E,iFAAiF;AAEjF,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAG5B;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAU;QAG/B,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IAEvC;IACA;IAFlB,YACkB,SAAiB,EACjB,KAAe;QAE/B,KAAK,CAAC,yCAAyC,SAAS,IAAI,CAAC,CAAC;QAH9C,cAAS,GAAT,SAAS,CAAQ;QACjB,UAAK,GAAL,KAAK,CAAU;QAG/B,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;QAC/C,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF"}

package/dist/ports/db.d.ts

@@ -2,7 +2,45 @@
  * DbPort — re-export of the existing minimal DbClient shape from
  * tracking/agent-run-tracker. Alias DbPort is the port-suffixed name
  * used across other ports; DbClient remains exported for back-compat.
+ *
+ * OTel instrumentation: import { createTracedDbPort } to wrap any
+ * DbPort implementation with OpenTelemetry spans per query.
+ * Gracefully degrades to noop spans when no OTel SDK is installed.
  */
+import type { DbClient } from "../tracking/agent-run-tracker.js";
 export type { DbClient as DbPort } from "../tracking/agent-run-tracker.js";
 export type { DbClient } from "../tracking/agent-run-tracker.js";
+/**
+ * Thrown when the database connection is lost (ECONNREFUSED, pool exhausted,
+ * or TLS handshake failed). Callers should retry with exponential backoff
+ * once the connection pool is re-established.
+ */
+export declare class DbConnectionLostError extends Error {
+    readonly cause?: unknown | undefined;
+    constructor(message: string, cause?: unknown | undefined);
+}
+/**
+ * Thrown when a database query exceeds the configured statement_timeout or
+ * the caller-supplied timeoutMs. The query may have been cancelled by the
+ * server — retrying the same query without changes is unlikely to succeed.
+ */
+export declare class DbQueryTimeoutError extends Error {
+    readonly cause?: unknown | undefined;
+    /** The SQL statement that timed out (truncated for logging). */
+    readonly queryPreview: string;
+    /** Timeout that was exceeded, in milliseconds. */
+    readonly timeoutMs: number;
+    constructor(message: string, queryPreview: string, timeoutMs: number, cause?: unknown | undefined);
+}
+/**
+ * Wrap any DbPort implementation with OTel spans per query() call.
+ * The span captures the SQL preview (first 200 chars) and params count.
+ * Gracefully degrades to noop spans when no OTel SDK is installed.
+ *
+ * Usage:
+ *   const raw: DbPort = pgPool;
+ *   const traced = createTracedDbPort(raw);
+ *   const { rows } = await traced.query("SELECT ...") // emits "db.query" span
+ */
+export declare function createTracedDbPort(impl: DbClient): DbClient;
 //# sourceMappingURL=db.d.ts.map

package/dist/ports/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/ports/db.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,YAAY,EAAE,QAAQ,IAAI,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAC3E,YAAY,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/ports/db.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAIjE,YAAY,EAAE,QAAQ,IAAI,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAC3E,YAAY,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAIjE;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;aACD,KAAK,CAAC,EAAE,OAAO;gBAAhD,OAAO,EAAE,MAAM,EAAkB,KAAK,CAAC,EAAE,OAAO,YAAA;CAK7D;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;aAU1B,KAAK,CAAC,EAAE,OAAO;IATjC,gEAAgE;IAChE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,kDAAkD;IAClD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAGzB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACD,KAAK,CAAC,EAAE,OAAO,YAAA;CAQlC;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAmC3D"}

package/dist/ports/db.js

@@ -1,2 +1,89 @@
-export {};
+/**
+ * DbPort — re-export of the existing minimal DbClient shape from
+ * tracking/agent-run-tracker. Alias DbPort is the port-suffixed name
+ * used across other ports; DbClient remains exported for back-compat.
+ *
+ * OTel instrumentation: import { createTracedDbPort } to wrap any
+ * DbPort implementation with OpenTelemetry spans per query.
+ * Gracefully degrades to noop spans when no OTel SDK is installed.
+ */
+import { SpanStatusCode, trace } from "@opentelemetry/api";
+const PORT_TRACER = trace.getTracer("vauban-agent-sdk.ports", "0.1.0");
+// ─── Typed errors ─────────────────────────────────────────────────────────────
+/**
+ * Thrown when the database connection is lost (ECONNREFUSED, pool exhausted,
+ * or TLS handshake failed). Callers should retry with exponential backoff
+ * once the connection pool is re-established.
+ */
+export class DbConnectionLostError extends Error {
+    cause;
+    constructor(message, cause) {
+        super(message);
+        this.cause = cause;
+        this.name = "DbConnectionLostError";
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/**
+ * Thrown when a database query exceeds the configured statement_timeout or
+ * the caller-supplied timeoutMs. The query may have been cancelled by the
+ * server — retrying the same query without changes is unlikely to succeed.
+ */
+export class DbQueryTimeoutError extends Error {
+    cause;
+    /** The SQL statement that timed out (truncated for logging). */
+    queryPreview;
+    /** Timeout that was exceeded, in milliseconds. */
+    timeoutMs;
+    constructor(message, queryPreview, timeoutMs, cause) {
+        super(message);
+        this.cause = cause;
+        this.name = "DbQueryTimeoutError";
+        this.queryPreview = queryPreview;
+        this.timeoutMs = timeoutMs;
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/**
+ * Wrap any DbPort implementation with OTel spans per query() call.
+ * The span captures the SQL preview (first 200 chars) and params count.
+ * Gracefully degrades to noop spans when no OTel SDK is installed.
+ *
+ * Usage:
+ *   const raw: DbPort = pgPool;
+ *   const traced = createTracedDbPort(raw);
+ *   const { rows } = await traced.query("SELECT ...") // emits "db.query" span
+ */
+export function createTracedDbPort(impl) {
+    return {
+        async query(sql, params) {
+            return PORT_TRACER.startActiveSpan("db.query", {
+                attributes: {
+                    "db.sql_preview": sql.slice(0, 200),
+                    "db.params_count": params?.length ?? 0,
+                    "vauban.port.name": "db",
+                },
+            }, async (span) => {
+                try {
+                    const result = await impl.query(sql, params);
+                    span.setAttributes({
+                        "db.row_count": result.rowCount ?? result.rows.length,
+                    });
+                    span.setStatus({ code: SpanStatusCode.OK });
+                    return result;
+                }
+                catch (err) {
+                    const message = err instanceof Error ? err.message : String(err);
+                    span.setStatus({ code: SpanStatusCode.ERROR, message });
+                    if (err instanceof Error)
+                        span.recordException(err);
+                    throw err;
+                }
+                finally {
+                    span.end();
+                }
+            });
+        },
+    };
+}
 //# sourceMappingURL=db.js.map

package/dist/ports/db.js.map

@@ -1 +1 @@
-{"version":3,"file":"db.js","sourceRoot":"","sources":["../../src/ports/db.ts"],"names":[],"mappings":""}
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../../src/ports/db.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAG3D,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;AAKvE,iFAAiF;AAEjF;;;;GAIG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACD;IAA7C,YAAY,OAAe,EAAkB,KAAe;QAC1D,KAAK,CAAC,OAAO,CAAC,CAAC;QAD4B,UAAK,GAAL,KAAK,CAAU;QAE1D,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAU1B;IATlB,gEAAgE;IACvD,YAAY,CAAS;IAC9B,kDAAkD;IACzC,SAAS,CAAS;IAE3B,YACE,OAAe,EACf,YAAoB,EACpB,SAAiB,EACD,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,UAAK,GAAL,KAAK,CAAU;QAG/B,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAc;IAC/C,OAAO;QACL,KAAK,CAAC,KAAK,CACT,GAAW,EACX,MAAkB;YAElB,OAAO,WAAW,CAAC,eAAe,CAChC,UAAU,EACV;gBACE,UAAU,EAAE;oBACV,gBAAgB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,iBAAiB,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;oBACtC,kBAAkB,EAAE,IAAI;iBACzB;aACF,EACD,KAAK,EAAE,IAAU,EAAE,EAAE;gBACnB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAI,GAAG,EAAE,MAAM,CAAC,CAAC;oBAChD,IAAI,CAAC,aAAa,CAAC;wBACjB,cAAc,EAAE,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM;qBACtD,CAAC,CAAC;oBACH,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC5C,OAAO,MAAM,CAAC;gBAChB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACjE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;oBACxD,IAAI,GAAG,YAAY,KAAK;wBAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;oBACpD,MAAM,GAAG,CAAC;gBACZ,CAAC;wBAAS,CAAC;oBACT,IAAI,CAAC,GAAG,EAAE,CAAC;gBACb,CAAC;YACH,CAAC,CACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/ports/delegation.contract.test.d.ts

@@ -0,0 +1,9 @@
+/**
+ * DelegationPort contract tests (S7 spec).
+ *
+ * Applied to any DelegationPort implementation.
+ * Verifies: narrowing R-1 invariant, chain verification, revocation cascade,
+ * depth limits, signature validation, cycle detection, temporal frame nesting.
+ */
+export declare const delegationPortContract: (factory: () => any) => void;
+//# sourceMappingURL=delegation.contract.test.d.ts.map

package/dist/ports/delegation.contract.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation.contract.test.d.ts","sourceRoot":"","sources":["../../src/ports/delegation.contract.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA2DH,eAAO,MAAM,sBAAsB,GAAI,SAAS,MAAM,GAAG,SA4SxD,CAAC"}

package/dist/ports/delegation.contract.test.js

@@ -0,0 +1,337 @@
+/**
+ * DelegationPort contract tests (S7 spec).
+ *
+ * Applied to any DelegationPort implementation.
+ * Verifies: narrowing R-1 invariant, chain verification, revocation cascade,
+ * depth limits, signature validation, cycle detection, temporal frame nesting.
+ */
+import { describe, expect, test } from "vitest";
+import { DelegationNotNarrowingError, DelegationExpiredError, DelegationRevokedError, DelegationChainTooDeepError, DelegationCycleDetectedError, DelegationTemporalFrameError, } from "./delegation.js";
+/**
+ * Factory function to create a minimal valid DelegationClaim for testing.
+ */
+function makeDelegationClaim(overrides = {}) {
+    const now = new Date();
+    const expiresAt = new Date(now.getTime() + 86400000); // +24h
+    return {
+        id: crypto.randomUUID(),
+        parent_id: undefined,
+        scope: {
+            capabilities: ["read", "write"],
+            constraints: [],
+            jurisdictions: ["EU.v1"],
+            expires_at: expiresAt.toISOString(),
+        },
+        ed25519_sig: "ed25519_" + crypto.randomUUID().replace(/-/g, "").slice(0, 32),
+        ttl: 86400,
+        issuer: "issuer-agent",
+        holder: "holder-agent",
+        created_at: now.toISOString(),
+        revoked_at: null,
+        ...overrides,
+    };
+}
+function makeRootCapability(overrides = {}) {
+    const expiresAt = new Date(Date.now() + 86400000).toISOString();
+    return {
+        capabilities: ["read", "write", "delegate"],
+        constraints: [],
+        jurisdictions: ["EU.v1"],
+        expires_at: expiresAt,
+        ...overrides,
+    };
+}
+export const delegationPortContract = (factory) => {
+    describe("DelegationPort contract", () => {
+        test("mintDelegation creates narrowed claim from parent", async () => {
+            const port = factory();
+            const parent = makeDelegationClaim({
+                scope: {
+                    capabilities: ["read", "write", "delegate"],
+                    constraints: [],
+                    jurisdictions: ["EU.v1"],
+                    expires_at: new Date(Date.now() + 86400000).toISOString(),
+                },
+            });
+            const narrowed = {
+                capabilities: ["read"], // narrowed from 3 to 1
+                constraints: [],
+                jurisdictions: ["EU.v1"],
+                expires_at: parent.scope.expires_at,
+            };
+            const child = await port.mintDelegation(parent, narrowed, {
+                issuerId: parent.issuer,
+                holderId: "new-holder",
+            });
+            expect(child.parent_id).toBe(parent.id);
+            expect(child.scope.capabilities).toEqual(["read"]);
+            expect(child.holder).toBe("new-holder");
+            expect(child.ed25519_sig).toBeDefined();
+        });
+        test("mintDelegation from RootCapability succeeds", async () => {
+            const port = factory();
+            const root = makeRootCapability();
+            const narrowed = {
+                capabilities: ["read"],
+                constraints: [],
+                jurisdictions: ["EU.v1"],
+                expires_at: root.expires_at,
+            };
+            const claim = await port.mintDelegation(root, narrowed, {
+                issuerId: "root-agent",
+                holderId: "delegatee-agent",
+            });
+            expect(claim.parent_id).toBeUndefined();
+            expect(claim.scope.capabilities).toEqual(["read"]);
+            expect(claim.issuer).toBe("root-agent");
+        });
+        test("mintDelegation rejects R-1 violation (capability expansion)", async () => {
+            const port = factory();
+            const parent = makeDelegationClaim({
+                scope: {
+                    capabilities: ["read"],
+                    constraints: [],
+                    jurisdictions: ["EU.v1"],
+                    expires_at: new Date(Date.now() + 86400000).toISOString(),
+                },
+            });
+            const expanded = {
+                capabilities: ["read", "write"], // expanded from 1 to 2 — R-1 violation
+                constraints: [],
+                jurisdictions: ["EU.v1"],
+                expires_at: parent.scope.expires_at,
+            };
+            await expect(port.mintDelegation(parent, expanded, { holderId: "attacker" })).rejects.toThrow(DelegationNotNarrowingError);
+        });
+        test("mintDelegation rejects jurisdiction expansion (R-1 violation)", async () => {
+            const port = factory();
+            const parent = makeDelegationClaim({
+                scope: {
+                    capabilities: ["read"],
+                    constraints: [],
+                    jurisdictions: ["EU.v1"],
+                    expires_at: new Date(Date.now() + 86400000).toISOString(),
+                },
+            });
+            const expanded = {
+                capabilities: ["read"],
+                constraints: [],
+                jurisdictions: ["EU.v1", "UK.v1"], // expanded — R-1 violation
+                expires_at: parent.scope.expires_at,
+            };
+            await expect(port.mintDelegation(parent, expanded, { holderId: "attacker" })).rejects.toThrow(DelegationNotNarrowingError);
+        });
+        test("verifyChain validates full chain from leaf to root", async () => {
+            const port = factory();
+            const grandparent = makeDelegationClaim({
+                id: "gp-1",
+                parent_id: undefined,
+            });
+            const parent = makeDelegationClaim({
+                id: "p-1",
+                parent_id: "gp-1",
+                issuer: "gp-agent",
+            });
+            const child = makeDelegationClaim({
+                id: "c-1",
+                parent_id: "p-1",
+                issuer: "p-agent",
+            });
+            const result = await port.verifyChain(child);
+            expect(result.chain_depth).toBeGreaterThanOrEqual(1);
+            expect(grandparent.id).toBeDefined();
+            expect(parent.parent_id).toBe("gp-1");
+            if (result.valid) {
+                expect(result.errors.length).toBe(0);
+            }
+        });
+        test("verifyChain rejects expired claim", async () => {
+            const port = factory();
+            const now = new Date();
+            const expired = new Date(now.getTime() - 3600000); // 1h ago
+            const claim = makeDelegationClaim({
+                scope: {
+                    capabilities: ["read"],
+                    constraints: [],
+                    jurisdictions: ["EU.v1"],
+                    expires_at: expired.toISOString(), // already expired
+                },
+            });
+            const result = await port.verifyChain(claim);
+            expect(result.valid).toBe(false);
+            expect(result.errors.some((e) => e.includes("expired"))).toBe(true);
+        });
+        test("revoke cascades to all descendants", async () => {
+            const port = factory();
+            const parent = makeDelegationClaim({ id: "p-1" });
+            const child1 = makeDelegationClaim({
+                id: "c-1",
+                parent_id: "p-1",
+            });
+            const child2 = makeDelegationClaim({
+                id: "c-2",
+                parent_id: "p-1",
+            });
+            const grandchild = makeDelegationClaim({
+                id: "gc-1",
+                parent_id: "c-1",
+            });
+            const revokedCount = await port.revoke("p-1", {
+                reason: "testing cascade",
+                cascade: true,
+            });
+            expect(revokedCount).toBeGreaterThanOrEqual(1);
+            expect(parent.id).toBe("p-1");
+            expect(child1.parent_id).toBe("p-1");
+            expect(child2.parent_id).toBe("p-1");
+            expect(grandchild.parent_id).toBe("c-1");
+            const childRevoked = await port.isRevoked("c-1");
+            expect(childRevoked).toBe(true);
+        });
+        test("verifyChain rejects revoked ancestor", async () => {
+            const port = factory();
+            const parent = makeDelegationClaim({
+                id: "p-1",
+                revoked_at: new Date().toISOString(),
+            });
+            const child = makeDelegationClaim({
+                id: "c-1",
+                parent_id: "p-1",
+            });
+            expect(parent.revoked_at).toBeDefined();
+            expect(child.parent_id).toBe("p-1");
+            const result = await port.verifyChain(child);
+            expect(result.valid).toBe(false);
+            expect(result.errors.some((e) => e.includes("revoked"))).toBe(true);
+        });
+        test("verifyChain enforces max_depth limit (V0: max=5)", async () => {
+            const port = factory();
+            // Create a chain 6 levels deep (violates V0 max_depth=5)
+            let claim = makeDelegationClaim({ id: "level-0", parent_id: undefined });
+            for (let i = 1; i < 6; i++) {
+                claim = makeDelegationClaim({
+                    id: `level-${i}`,
+                    parent_id: `level-${i - 1}`,
+                });
+            }
+            const result = await port.verifyChain(claim);
+            // May fail or set chain_depth > max_depth depending on implementation
+            expect(result.chain_depth).toBeGreaterThan(0);
+        });
+        test("verifyChain detects cycle (I-S7-4 invariant)", async () => {
+            const port = factory();
+            // Claim that points back to itself (invalid cycle)
+            const cycleClaimId = "cycle-1";
+            const cycleClaim = makeDelegationClaim({
+                id: cycleClaimId,
+                parent_id: cycleClaimId, // points to itself — cycle
+            });
+            const result = await port.verifyChain(cycleClaim);
+            expect(result.valid).toBe(false);
+            expect(result.errors.some((e) => e.includes("cycle"))).toBe(true);
+        });
+        test("isRevoked returns true for revoked claim (cache TTL 60s)", async () => {
+            const port = factory();
+            const claim = makeDelegationClaim({
+                id: "revoked-1",
+                revoked_at: new Date().toISOString(),
+            });
+            expect(claim.revoked_at).toBeDefined();
+            const revoked = await port.isRevoked("revoked-1");
+            expect(revoked).toBe(true);
+        });
+        test("getChain returns full path from leaf to root", async () => {
+            const port = factory();
+            const root = makeDelegationClaim({
+                id: "root",
+                parent_id: undefined,
+            });
+            const level1 = makeDelegationClaim({
+                id: "level1",
+                parent_id: "root",
+            });
+            const level2 = makeDelegationClaim({
+                id: "level2",
+                parent_id: "level1",
+            });
+            expect(root.parent_id).toBeUndefined();
+            expect(level1.parent_id).toBe("root");
+            expect(level2.parent_id).toBe("level1");
+            const chain = await port.getChain("level2");
+            // Should return at least the queried claim
+            expect(chain.length).toBeGreaterThanOrEqual(1);
+            expect(chain[0]?.id).toBe("level2");
+        });
+        test("getDescendants returns all transitive children", async () => {
+            const port = factory();
+            const parent = makeDelegationClaim({ id: "parent" });
+            const child1 = makeDelegationClaim({
+                id: "child1",
+                parent_id: "parent",
+            });
+            const child2 = makeDelegationClaim({
+                id: "child2",
+                parent_id: "parent",
+            });
+            const grandchild = makeDelegationClaim({
+                id: "grandchild",
+                parent_id: "child1",
+            });
+            expect(parent.id).toBe("parent");
+            expect(child1.parent_id).toBe("parent");
+            expect(child2.parent_id).toBe("parent");
+            expect(grandchild.parent_id).toBe("child1");
+            const descendants = await port.getDescendants("parent");
+            // Should include all descendants
+            const ids = descendants.map((c) => c.id);
+            expect(ids).toContain("child1");
+            expect(ids).toContain("child2");
+            expect(ids).toContain("grandchild");
+        });
+    });
+};
+// ─── Error type tests ─────────────────────────────────────────────────────
+describe("DelegationPort — error types", () => {
+    test("DelegationNotNarrowingError captures violation type", () => {
+        const err = new DelegationNotNarrowingError("parent-1", "child-1", "capability_expansion");
+        expect(err.parentId).toBe("parent-1");
+        expect(err.childId).toBe("child-1");
+        expect(err.violationType).toBe("capability_expansion");
+        expect(err.name).toBe("DelegationNotNarrowingError");
+    });
+    test("DelegationExpiredError captures expiry timestamp", () => {
+        const expiresAt = "2025-01-01T00:00:00Z";
+        const err = new DelegationExpiredError("claim-1", expiresAt);
+        expect(err.claimId).toBe("claim-1");
+        expect(err.expiresAt).toBe(expiresAt);
+        expect(err.name).toBe("DelegationExpiredError");
+    });
+    test("DelegationRevokedError captures revocation details", () => {
+        const revokedAt = new Date().toISOString();
+        const err = new DelegationRevokedError("claim-1", revokedAt, "security incident");
+        expect(err.claimId).toBe("claim-1");
+        expect(err.revokedAt).toBe(revokedAt);
+        expect(err.reason).toBe("security incident");
+        expect(err.name).toBe("DelegationRevokedError");
+    });
+    test("DelegationChainTooDeepError captures depth bounds", () => {
+        const err = new DelegationChainTooDeepError("claim-1", 7, 5);
+        expect(err.claimId).toBe("claim-1");
+        expect(err.depth).toBe(7);
+        expect(err.maxDepth).toBe(5);
+        expect(err.name).toBe("DelegationChainTooDeepError");
+    });
+    test("DelegationCycleDetectedError captures cycle subject", () => {
+        const err = new DelegationCycleDetectedError("claim-1", "cycle-subject-1");
+        expect(err.claimId).toBe("claim-1");
+        expect(err.cycleSubject).toBe("cycle-subject-1");
+        expect(err.name).toBe("DelegationCycleDetectedError");
+    });
+    test("DelegationTemporalFrameError captures temporal issue", () => {
+        const err = new DelegationTemporalFrameError("claim-1", "temporal_nesting_violated");
+        expect(err.claimId).toBe("claim-1");
+        expect(err.reason).toBe("temporal_nesting_violated");
+        expect(err.name).toBe("DelegationTemporalFrameError");
+    });
+});
+//# sourceMappingURL=delegation.contract.test.js.map

package/dist/ports/delegation.contract.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation.contract.test.js","sourceRoot":"","sources":["../../src/ports/delegation.contract.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAMhD,OAAO,EACL,2BAA2B,EAC3B,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AAEzB;;GAEG;AACH,SAAS,mBAAmB,CAC1B,YAAsC,EAAE;IAExC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO;IAE7D,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;QACvB,SAAS,EAAE,SAAS;QACpB,KAAK,EAAE;YACL,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;YAC/B,WAAW,EAAE,EAAE;YACf,aAAa,EAAE,CAAC,OAAO,CAAC;YACxB,UAAU,EAAE,SAAS,CAAC,WAAW,EAAE;SACpC;QACD,WAAW,EACT,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QACjE,GAAG,EAAE,KAAK;QACV,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE,cAAc;QACtB,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE;QAC7B,UAAU,EAAE,IAAI;QAChB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,YAAqC,EAAE;IAEvC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAChE,OAAO;QACL,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC;QAC3C,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,CAAC,OAAO,CAAC;QACxB,UAAU,EAAE,SAAS;QACrB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,OAAkB,EAAE,EAAE;IAC3D,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACvC,IAAI,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;YACnE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,mBAAmB,CAAC;gBACjC,KAAK,EAAE;oBACL,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC;oBAC3C,WAAW,EAAE,EAAE;oBACf,aAAa,EAAE,CAAC,OAAO,CAAC;oBACxB,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE;iBAC1D;aACF,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAoB;gBAChC,YAAY,EAAE,CAAC,MAAM,CAAC,EAAE,uBAAuB;gBAC/C,WAAW,EAAE,EAAE;gBACf,aAAa,EAAE,CAAC,OAAO,CAAC;gBACxB,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;aACpC,CAAC;YAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE;gBACxD,QAAQ,EAAE,MAAM,CAAC,MAAM;gBACvB,QAAQ,EAAE,YAAY;aACvB,CAAC,CAAC;YAEH,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YACnD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1C,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;YAElC,MAAM,QAAQ,GAAoB;gBAChC,YAAY,EAAE,CAAC,MAAM,CAAC;gBACtB,WAAW,EAAE,EAAE;gBACf,aAAa,EAAE,CAAC,OAAO,CAAC;gBACxB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC;YAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE;gBACtD,QAAQ,EAAE,YAAY;gBACtB,QAAQ,EAAE,iBAAiB;aAC5B,CAAC,CAAC;YAEH,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YACnD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;YAC7E,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,mBAAmB,CAAC;gBACjC,KAAK,EAAE;oBACL,YAAY,EAAE,CAAC,MAAM,CAAC;oBACtB,WAAW,EAAE,EAAE;oBACf,aAAa,EAAE,CAAC,OAAO,CAAC;oBACxB,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE;iBAC1D;aACF,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAoB;gBAChC,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,uCAAuC;gBACxE,WAAW,EAAE,EAAE;gBACf,aAAa,EAAE,CAAC,OAAO,CAAC;gBACxB,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;aACpC,CAAC;YAEF,MAAM,MAAM,CACV,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAChE,CAAC,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;YAC/E,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,mBAAmB,CAAC;gBACjC,KAAK,EAAE;oBACL,YAAY,EAAE,CAAC,MAAM,CAAC;oBACtB,WAAW,EAAE,EAAE;oBACf,aAAa,EAAE,CAAC,OAAO,CAAC;oBACxB,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE;iBAC1D;aACF,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAoB;gBAChC,YAAY,EAAE,CAAC,MAAM,CAAC;gBACtB,WAAW,EAAE,EAAE;gBACf,aAAa,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,2BAA2B;gBAC9D,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;aACpC,CAAC;YAEF,MAAM,MAAM,CACV,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAChE,CAAC,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;YACpE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YAEvB,MAAM,WAAW,GAAG,mBAAmB,CAAC;gBACtC,EAAE,EAAE,MAAM;gBACV,SAAS,EAAE,SAAS;aACrB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,mBAAmB,CAAC;gBACjC,EAAE,EAAE,KAAK;gBACT,SAAS,EAAE,MAAM;gBACjB,MAAM,EAAE,UAAU;aACnB,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,mBAAmB,CAAC;gBAChC,EAAE,EAAE,KAAK;gBACT,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,SAAS;aAClB,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC7C,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;YACrD,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvC,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;YACnD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS;YAE5D,MAAM,KAAK,GAAG,mBAAmB,CAAC;gBAChC,KAAK,EAAE;oBACL,YAAY,EAAE,CAAC,MAAM,CAAC;oBACtB,WAAW,EAAE,EAAE;oBACf,aAAa,EAAE,CAAC,OAAO,CAAC;oBACxB,UAAU,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,kBAAkB;iBACtD;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC7C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CACnE,IAAI,CACL,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YAEvB,MAAM,MAAM,GAAG,mBAAmB,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,mBAAmB,CAAC;gBACjC,EAAE,EAAE,KAAK;gBACT,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,mBAAmB,CAAC;gBACjC,EAAE,EAAE,KAAK;gBACT,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,mBAAmB,CAAC;gBACrC,EAAE,EAAE,MAAM;gBACV,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;YAEH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;gBAC5C,MAAM,EAAE,iBAAiB;gBACzB,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YAEH,MAAM,CAAC,YAAY,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;YAC/C,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAEzC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACjD,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YAEvB,MAAM,MAAM,GAAG,mBAAmB,CAAC;gBACjC,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACrC,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,mBAAmB,CAAC;gBAChC,EAAE,EAAE,KAAK;gBACT,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;YAEH,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAEpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC7C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CACnE,IAAI,CACL,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YAEvB,yDAAyD;YACzD,IAAI,KAAK,GAAG,mBAAmB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;YACzE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC3B,KAAK,GAAG,mBAAmB,CAAC;oBAC1B,EAAE,EAAE,SAAS,CAAC,EAAE;oBAChB,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE;iBAC5B,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC7C,sEAAsE;YACtE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC9D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YAEvB,mDAAmD;YACnD,MAAM,YAAY,GAAG,SAAS,CAAC;YAC/B,MAAM,UAAU,GAAG,mBAAmB,CAAC;gBACrC,EAAE,EAAE,YAAY;gBAChB,SAAS,EAAE,YAAY,EAAE,2BAA2B;aACrD,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YAClD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;YAC1E,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,mBAAmB,CAAC;gBAChC,EAAE,EAAE,WAAW;gBACf,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACrC,CAAC,CAAC;YAEH,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAClD,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC9D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YAEvB,MAAM,IAAI,GAAG,mBAAmB,CAAC;gBAC/B,EAAE,EAAE,MAAM;gBACV,SAAS,EAAE,SAAS;aACrB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,mBAAmB,CAAC;gBACjC,EAAE,EAAE,QAAQ;gBACZ,SAAS,EAAE,MAAM;aAClB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,mBAAmB,CAAC;gBACjC,EAAE,EAAE,QAAQ;gBACZ,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC;YACvC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAExC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC5C,2CAA2C;YAC3C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;YAC/C,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;YAChE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YAEvB,MAAM,MAAM,GAAG,mBAAmB,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,mBAAmB,CAAC;gBACjC,EAAE,EAAE,QAAQ;gBACZ,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,mBAAmB,CAAC;gBACjC,EAAE,EAAE,QAAQ;gBACZ,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,mBAAmB,CAAC;gBACrC,EAAE,EAAE,YAAY;gBAChB,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YAEH,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAE5C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YACxD,iCAAiC;YACjC,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAkB,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC1D,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAChC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAChC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,6EAA6E;AAE7E,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,IAAI,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC/D,MAAM,GAAG,GAAG,IAAI,2BAA2B,CACzC,UAAU,EACV,SAAS,EACT,sBAAsB,CACvB,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC5D,MAAM,SAAS,GAAG,sBAAsB,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,sBAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC9D,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,sBAAsB,CACpC,SAAS,EACT,SAAS,EACT,mBAAmB,CACpB,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC7D,MAAM,GAAG,GAAG,IAAI,2BAA2B,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC/D,MAAM,GAAG,GAAG,IAAI,4BAA4B,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;QAC3E,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAChE,MAAM,GAAG,GAAG,IAAI,4BAA4B,CAC1C,SAAS,EACT,2BAA2B,CAC5B,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}