agent-authority 0.1.0

package/dist/control-plane.js

@@ -0,0 +1,332 @@
+#!/usr/bin/env node
+import { createServer } from "node:http";
+import { fileURLToPath } from "node:url";
+import { realpathSync } from "node:fs";
+import { MemoryRevocationStore, MemoryAuditStore, MemoryRateStore, MemoryConsentStore, MemoryPolicyStore, } from "./store.js";
+export function createControlPlane(options = {}) {
+    const revocations = options.revocations ?? new MemoryRevocationStore();
+    const audit = options.audit ?? new MemoryAuditStore();
+    const rate = options.rate ?? new MemoryRateStore();
+    const consents = options.consents ?? new MemoryConsentStore();
+    const policies = options.policies ?? new MemoryPolicyStore();
+    let server;
+    const handler = (req, res) => {
+        void route(req, res).catch((e) => send(res, 500, { error: String(e) }));
+    };
+    async function route(req, res) {
+        // Resolve the caller. `token` is an admin credential (full, unscoped);
+        // `tenants` maps a bearer token to the issuer it is allowed to act for.
+        let isAdmin = false;
+        let callerIssuer;
+        if (options.token || options.tenants) {
+            const auth = req.headers["authorization"];
+            const bearer = typeof auth === "string" && auth.startsWith("Bearer ") ? auth.slice(7) : "";
+            if (options.token && bearer === options.token) {
+                isAdmin = true;
+            }
+            else if (options.tenants && Object.prototype.hasOwnProperty.call(options.tenants, bearer) && bearer) {
+                callerIssuer = options.tenants[bearer];
+            }
+            else {
+                return send(res, 401, { error: "unauthorized" });
+            }
+        }
+        const url = new URL(req.url ?? "/", "http://localhost");
+        const path = url.pathname;
+        const method = req.method ?? "GET";
+        // ---- Dashboard ----
+        if (method === "GET" && path === "/") {
+            // A tenant only ever sees its own audit; the shared revocation/consent
+            // views are withheld so the dashboard can't leak across tenants.
+            if (callerIssuer) {
+                const recent = (await audit.forIssuer(callerIssuer)).slice(-20).reverse();
+                return sendHtml(res, dashboard([], recent, []));
+            }
+            // Admin / single-trust-domain: full view (withheld under tenantScoped).
+            const recent = options.tenantScoped ? [] : (await audit.all()).slice(-20).reverse();
+            return sendHtml(res, dashboard(listRevoked(revocations), recent, await consents.list()));
+        }
+        // ---- Revocation ----
+        // Tenant revocations are namespaced under the tenant's issuer, so one
+        // tenant can never revoke (or unrevoke-by-collision) another tenant's
+        // mandate ids. Admin revocations are global and visible to all tenants.
+        const revKey = (id) => (callerIssuer ? `${callerIssuer} ${id}` : id);
+        if (method === "POST" && path === "/v1/revoke") {
+            const body = await readJson(req);
+            if (!body?.id)
+                return send(res, 400, { error: "id required" });
+            await revocations.revoke(revKey(String(body.id)));
+            return send(res, 200, { ok: true });
+        }
+        if (method === "GET" && path === "/v1/revoked") {
+            const all = listRevoked(revocations);
+            const ids = callerIssuer
+                ? all.filter((i) => i.startsWith(`${callerIssuer} `)).map((i) => i.slice(callerIssuer.length + 1))
+                : all;
+            return send(res, 200, { ids });
+        }
+        const revMatch = method === "GET" && /^\/v1\/revoked\/(.+)$/.exec(path);
+        if (revMatch) {
+            const id = decodeURIComponent(revMatch[1]);
+            // Tenants see their own namespaced revocations PLUS global (admin) ones.
+            const revoked = (await revocations.isRevoked(revKey(id))) ||
+                (callerIssuer ? await revocations.isRevoked(id) : false);
+            return send(res, 200, { revoked: Boolean(revoked) });
+        }
+        // ---- Audit retention ----
+        if (method === "POST" && path === "/v1/audit") {
+            const body = await readJson(req);
+            // Preferred path: the client sends raw fields and the control plane (the
+            // single writer) seals them onto the chain — race-free, O(1) per record.
+            if (body?.fields) {
+                const fields = body.fields;
+                if (callerIssuer && fields.issuer !== callerIssuer) {
+                    return send(res, 403, { error: "issuer does not match tenant token" });
+                }
+                const entry = await audit.record(fields);
+                return send(res, 200, { entry });
+            }
+            // Replication path: store an already-sealed entry verbatim.
+            if (body?.entry) {
+                if (callerIssuer && body.entry.issuer !== callerIssuer) {
+                    return send(res, 403, { error: "issuer does not match tenant token" });
+                }
+                await audit.append(body.entry);
+                return send(res, 200, { entry: body.entry });
+            }
+            return send(res, 400, { error: "fields or entry required" });
+        }
+        if (method === "GET" && path === "/v1/audit") {
+            // A tenant token is locked to its own issuer, ignoring any ?issuer.
+            let entries;
+            if (callerIssuer) {
+                entries = await audit.forIssuer(callerIssuer);
+            }
+            else {
+                const issuer = url.searchParams.get("issuer");
+                if (issuer)
+                    entries = await audit.forIssuer(issuer);
+                else if (options.tenantScoped) {
+                    return send(res, 403, { error: "issuer query required (tenant-scoped)" });
+                }
+                else
+                    entries = await audit.all();
+            }
+            // Pagination so the response stays bounded as the log grows.
+            const total = entries.length;
+            const offset = Math.max(0, Number(url.searchParams.get("offset") ?? 0) || 0);
+            const limitRaw = Number(url.searchParams.get("limit") ?? 0);
+            const limit = Number.isFinite(limitRaw) && limitRaw > 0 ? limitRaw : undefined;
+            if (offset > 0 || limit !== undefined) {
+                entries = entries.slice(offset, limit !== undefined ? offset + limit : undefined);
+            }
+            return send(res, 200, { entries, total });
+        }
+        const auditMatch = method === "GET" && /^\/v1\/audit\/(.+)$/.exec(path);
+        if (auditMatch) {
+            const id = decodeURIComponent(auditMatch[1]);
+            let entries = await audit.forMandate(id);
+            if (callerIssuer)
+                entries = entries.filter((e) => e.issuer === callerIssuer);
+            return send(res, 200, { entries });
+        }
+        // ---- Shared rate limiting ----
+        if (method === "POST" && path === "/v1/rate") {
+            const body = await readJson(req);
+            if (!body?.key)
+                return send(res, 400, { error: "key required" });
+            const windowMs = Number(body.windowMs);
+            const limit = Number(body.limit);
+            if (!Number.isFinite(windowMs) || windowMs <= 0 || !Number.isFinite(limit) || limit < 0) {
+                return send(res, 400, { error: "windowMs must be > 0 and limit must be >= 0" });
+            }
+            // The control plane is the time authority — the client's clock is ignored
+            // so it can't slide the window to evade the shared cap. Tenant rate keys
+            // are namespaced so tenants can't consume (or observe) each other's caps.
+            const rateKey = callerIssuer ? `${callerIssuer} ${String(body.key)}` : String(body.key);
+            const allowed = await rate.hit(rateKey, windowMs, limit, Date.now());
+            return send(res, 200, { allowed });
+        }
+        // ---- Consent ----
+        // Pending requests past their TTL become "expired" — a terminal deny.
+        const sweep = async (r) => {
+            if (r.status === "pending" &&
+                options.consentTtlMs !== undefined &&
+                Date.now() - r.createdAt > options.consentTtlMs) {
+                r.status = "expired";
+                r.decidedAt = Date.now();
+                await consents.put(r);
+            }
+            return r;
+        };
+        // A tenant token only sees/decides its own consent records.
+        const visible = (r) => !callerIssuer || r.issuer === callerIssuer;
+        if (method === "POST" && path === "/v1/consent") {
+            const body = await readJson(req);
+            if (!body?.agent || !body?.capability) {
+                return send(res, 400, { error: "agent and capability required" });
+            }
+            const id = randomId();
+            const record = {
+                id,
+                agent: String(body.agent),
+                capability: String(body.capability),
+                context: body.context,
+                ...(callerIssuer ? { issuer: callerIssuer } : {}),
+                status: "pending",
+                createdAt: Date.now(),
+            };
+            await consents.put(record);
+            return send(res, 201, record);
+        }
+        if (method === "GET" && path === "/v1/consent") {
+            const all = await Promise.all((await consents.list()).map(sweep));
+            return send(res, 200, { consents: all.filter(visible) });
+        }
+        const consentDecide = method === "POST" && /^\/v1\/consent\/([^/]+)\/decision$/.exec(path);
+        if (consentDecide) {
+            const record = await consents.get(consentDecide[1]);
+            if (!record || !visible(record))
+                return send(res, 404, { error: "not found" });
+            await sweep(record);
+            if (record.status === "expired")
+                return send(res, 200, record);
+            const body = await readJson(req);
+            record.status = body?.approve ? "approved" : "denied";
+            record.decidedAt = Date.now();
+            await consents.put(record);
+            return send(res, 200, record);
+        }
+        const consentGet = method === "GET" && /^\/v1\/consent\/([^/]+)$/.exec(path);
+        if (consentGet) {
+            const record = await consents.get(consentGet[1]);
+            if (!record || !visible(record))
+                return send(res, 404, { error: "not found" });
+            return send(res, 200, await sweep(record));
+        }
+        // ---- Policy ----
+        const policyMatch = /^\/v1\/policy\/([^/]+)$/.exec(path);
+        if (policyMatch) {
+            const name = policyMatch[1];
+            // Tenants get a private namespace so policy names can't clash or leak.
+            const key = callerIssuer ? `${callerIssuer}${name}` : name;
+            if (method === "GET") {
+                return (await policies.has(key))
+                    ? send(res, 200, { name, policy: await policies.get(key) })
+                    : send(res, 404, { error: "not found" });
+            }
+            if (method === "PUT") {
+                const body = await readJson(req);
+                await policies.set(key, body?.policy ?? body);
+                return send(res, 200, { name, policy: await policies.get(key) });
+            }
+        }
+        return send(res, 404, { error: `no route for ${method} ${path}` });
+    }
+    return {
+        handler,
+        listen(port = 0) {
+            server = createServer(handler);
+            return new Promise((resolve) => {
+                server.listen(port, () => {
+                    const addr = server.address();
+                    resolve(typeof addr === "object" && addr ? addr.port : port);
+                });
+            });
+        },
+        close() {
+            return new Promise((resolve) => (server ? server.close(() => resolve()) : resolve()));
+        },
+    };
+}
+// ---- helpers ----
+function readJson(req) {
+    return new Promise((resolve) => {
+        let data = "";
+        req.on("data", (c) => (data += c));
+        req.on("end", () => {
+            if (!data)
+                return resolve(null);
+            try {
+                resolve(JSON.parse(data));
+            }
+            catch {
+                resolve(null);
+            }
+        });
+        req.on("error", () => resolve(null));
+    });
+}
+function send(res, status, body) {
+    res.statusCode = status;
+    res.setHeader("content-type", "application/json");
+    res.end(JSON.stringify(body));
+}
+function sendHtml(res, html) {
+    res.statusCode = 200;
+    res.setHeader("content-type", "text/html; charset=utf-8");
+    res.end(html);
+}
+function randomId() {
+    return Math.random().toString(36).slice(2) + Date.now().toString(36);
+}
+function listRevoked(store) {
+    // MemoryRevocationStore keeps a private Set; expose what we can generically.
+    return store.revoked
+        ? [...store.revoked]
+        : [];
+}
+function esc(s) {
+    return String(s).replace(/[&<>"]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" })[c]);
+}
+function dashboard(revoked, recent, consents) {
+    const pending = consents.filter((c) => c.status === "pending");
+    return `<!doctype html><html><head><meta charset="utf-8"><title>Behalf Control Plane</title>
+<style>body{font:14px system-ui,sans-serif;margin:2rem;max-width:60rem}h1{font-size:1.4rem}
+table{border-collapse:collapse;width:100%;margin:.5rem 0 2rem}td,th{border:1px solid #ddd;padding:.3rem .5rem;text-align:left}
+.deny{color:#b00}.allow{color:#070}code{background:#f4f4f4;padding:.1rem .3rem;border-radius:3px}</style></head><body>
+<h1>Behalf Control Plane</h1>
+<h2>Revoked mandates (${revoked.length})</h2>
+<table><tr><th>id</th></tr>${revoked.map((id) => `<tr><td><code>${esc(id)}</code></td></tr>`).join("") || "<tr><td>none</td></tr>"}</table>
+<h2>Pending consent (${pending.length})</h2>
+<table><tr><th>id</th><th>agent</th><th>capability</th></tr>${pending.map((c) => `<tr><td><code>${esc(c.id)}</code></td><td>${esc(c.agent)}</td><td><code>${esc(c.capability)}</code></td></tr>`).join("") ||
+        "<tr><td colspan=3>none</td></tr>"}</table>
+<h2>Recent audit (${recent.length})</h2>
+<table><tr><th>time</th><th>decision</th><th>action</th><th>reason</th></tr>${recent
+        .map((e) => `<tr><td>${new Date(e.ts).toISOString()}</td><td class="${e.decision}">${esc(e.decision)}</td><td><code>${esc(e.action)}</code></td><td>${esc(e.reason ?? "")}</td></tr>`)
+        .join("") || "<tr><td colspan=4>none</td></tr>"}</table>
+</body></html>`;
+}
+// Allow `node dist/control-plane.js` (and the `behalf-control-plane` bin) to run
+// a durable, file-backed control plane. PORT and BEHALF_HOME are read from env.
+function runningAsMain() {
+    const entry = process.argv[1];
+    if (!entry)
+        return false;
+    try {
+        return realpathSync(entry) === realpathSync(fileURLToPath(import.meta.url));
+    }
+    catch {
+        return false;
+    }
+}
+if (runningAsMain()) {
+    void (async () => {
+        const { join } = await import("node:path");
+        const { homedir } = await import("node:os");
+        const { FileRevocationStore, FileAuditStore, FileConsentStore, FilePolicyStore, FileRateStore } = await import("./persist.js");
+        const home = process.env.BEHALF_HOME ?? join(homedir(), ".behalf");
+        const port = Number(process.env.PORT ?? 8787);
+        const cp = createControlPlane({
+            revocations: new FileRevocationStore(join(home, "revocations.json")),
+            audit: new FileAuditStore(join(home, "audit.jsonl")),
+            consents: new FileConsentStore(join(home, "consents.json")),
+            policies: new FilePolicyStore(join(home, "policies.json")),
+            rate: new FileRateStore(join(home, "rate.json")),
+            token: process.env.BEHALF_TOKEN,
+        });
+        const bound = await cp.listen(port);
+        console.error(`behalf control plane listening on http://127.0.0.1:${bound}  (dashboard at /)`);
+    })();
+}
+//# sourceMappingURL=control-plane.js.map

package/dist/control-plane.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-plane.js","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,iBAAiB,GAMlB,MAAM,YAAY,CAAC;AA2DpB,MAAM,UAAU,kBAAkB,CAAC,UAA+B,EAAE;IAClE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,qBAAqB,EAAE,CAAC;IACvE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,gBAAgB,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,eAAe,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,kBAAkB,EAAE,CAAC;IAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,iBAAiB,EAAE,CAAC;IAC7D,IAAI,MAA0B,CAAC;IAE/B,MAAM,OAAO,GAAG,CAAC,GAAoB,EAAE,GAAmB,EAAQ,EAAE;QAClE,KAAK,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC,CAAC;IAEF,KAAK,UAAU,KAAK,CAAC,GAAoB,EAAE,GAAmB;QAC5D,uEAAuE;QACvE,wEAAwE;QACxE,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,YAAgC,CAAC;QACrC,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,IAAI,OAAO,CAAC,KAAK,IAAI,MAAM,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;gBAC9C,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;iBAAM,IAAI,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACtG,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;QAEnC,sBAAsB;QACtB,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACrC,uEAAuE;YACvE,iEAAiE;YACjE,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC1E,OAAO,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;YAClD,CAAC;YACD,wEAAwE;YACxE,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACpF,OAAO,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3F,CAAC;QAED,uBAAuB;QACvB,sEAAsE;QACtE,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7E,IAAI,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,IAAI,EAAE,EAAE;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC/D,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAClD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC/C,MAAM,GAAG,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YACrC,MAAM,GAAG,GAAG,YAAY;gBACtB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAClG,CAAC,CAAC,GAAG,CAAC;YACR,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,KAAK,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,EAAE,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,yEAAyE;YACzE,MAAM,OAAO,GACX,CAAC,MAAM,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;gBACzC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvD,CAAC;QAED,4BAA4B;QAC5B,IAAI,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjC,yEAAyE;YACzE,yEAAyE;YACzE,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAqB,CAAC;gBAC1C,IAAI,YAAY,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;oBACnD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;gBACzE,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACzC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACnC,CAAC;YACD,4DAA4D;YAC5D,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;gBAChB,IAAI,YAAY,IAAK,IAAI,CAAC,KAAoB,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;oBACvE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;gBACzE,CAAC;gBACD,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAC;gBAC7C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAC/C,CAAC;YACD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YAC7C,oEAAoE;YACpE,IAAI,OAAqB,CAAC;YAC1B,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YAChD,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC9C,IAAI,MAAM;oBAAE,OAAO,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;qBAC/C,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;oBAC9B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;gBAC5E,CAAC;;oBAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;YACrC,CAAC;YACD,6DAA6D;YAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7E,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/E,IAAI,MAAM,GAAG,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACtC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,KAAK,KAAK,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxE,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,EAAE,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7C,IAAI,OAAO,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACzC,IAAI,YAAY;gBAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC;YAC7E,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,iCAAiC;QACjC,IAAI,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,IAAI,EAAE,GAAG;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACxF,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,0EAA0E;YAC1E,yEAAyE;YACzE,0EAA0E;YAC1E,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACrE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,oBAAoB;QACpB,sEAAsE;QACtE,MAAM,KAAK,GAAG,KAAK,EAAE,CAAgB,EAA0B,EAAE;YAC/D,IACE,CAAC,CAAC,MAAM,KAAK,SAAS;gBACtB,OAAO,CAAC,YAAY,KAAK,SAAS;gBAClC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,GAAG,OAAO,CAAC,YAAY,EAC/C,CAAC;gBACD,CAAC,CAAC,MAAM,GAAG,SAAS,CAAC;gBACrB,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACzB,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxB,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC,CAAC;QACF,4DAA4D;QAC5D,MAAM,OAAO,GAAG,CAAC,CAAgB,EAAE,EAAE,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,MAAM,KAAK,YAAY,CAAC;QACjF,IAAI,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC;gBACtC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;YACtB,MAAM,MAAM,GAAkB;gBAC5B,EAAE;gBACF,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;gBACzB,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;gBACnC,OAAO,EAAE,IAAI,CAAC,OAA8C;gBAC5D,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC;YACF,MAAM,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC3B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC/C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YAClE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,KAAK,MAAM,IAAI,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3F,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC/E,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;YACpB,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC/D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;YACtD,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC9B,MAAM,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC3B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,KAAK,KAAK,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7E,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC/E,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7C,CAAC;QAED,mBAAmB;QACnB,MAAM,WAAW,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAC5B,uEAAuE;YACvE,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5D,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBACrB,OAAO,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC9B,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC3D,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC7C,CAAC;YACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACjC,MAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC;gBAC9C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,MAAM,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,OAAO;QACL,OAAO;QACP,MAAM,CAAC,IAAI,GAAG,CAAC;YACb,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YAC/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;gBAC7B,MAAO,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;oBACxB,MAAM,IAAI,GAAG,MAAO,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC/D,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK;YACH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oBAAoB;AAEpB,SAAS,QAAQ,CAAC,GAAoB;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC,IAAI;gBAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAC9D,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;IACxB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,IAAY;IACjD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;IACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;IAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,WAAW,CAAC,KAAsB;IACzC,6EAA6E;IAC7E,OAAQ,KAA8C,CAAC,OAAO;QAC5D,CAAC,CAAC,CAAC,GAAI,KAA6C,CAAC,OAAO,CAAC;QAC7D,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;AAC9G,CAAC;AAED,SAAS,SAAS,CAChB,OAAiB,EACjB,MAAoB,EACpB,QAAyB;IAEzB,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IAE/D,OAAO;;;;;wBAKe,OAAO,CAAC,MAAM;6BACT,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,wBAAwB;uBAC3G,OAAO,CAAC,MAAM;8DAEjC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5I,kCACF;oBACkB,MAAM,CAAC,MAAM;8EAE7B,MAAM;SACH,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,YAAY,CAC5K;SACA,IAAI,CAAC,EAAE,CAAC,IAAI,kCACjB;eACa,CAAC;AAChB,CAAC;AAED,iFAAiF;AACjF,gFAAgF;AAChF,SAAS,aAAa;IACpB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AACD,IAAI,aAAa,EAAE,EAAE,CAAC;IACpB,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,EAAE,mBAAmB,EAAE,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,GAC7F,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;QAC9C,MAAM,EAAE,GAAG,kBAAkB,CAAC;YAC5B,WAAW,EAAE,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;YACpE,KAAK,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;YACpD,QAAQ,EAAE,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YAC3D,QAAQ,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YAC1D,IAAI,EAAE,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAChD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY;SAChC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpC,OAAO,CAAC,KAAK,CAAC,sDAAsD,KAAK,oBAAoB,CAAC,CAAC;IACjG,CAAC,CAAC,EAAE,CAAC;AACP,CAAC"}

package/dist/crypto.d.ts

@@ -0,0 +1,68 @@
+import { type KeyObject } from "node:crypto";
+import type { Block } from "./types.js";
+/**
+ * Asymmetric attenuable tokens (biscuit-style Ed25519 signature chain).
+ *
+ * The token is an ordered list of blocks. Block 0 (the root grant) is signed by
+ * the issuer's private key. Every block also publishes a fresh public key
+ * (`nextPub`); the *next* block is signed by the matching private key. So:
+ *
+ *   sig[0]  = sign(rootPriv,        canonical(block[0]))   verify with rootPub
+ *   sig[i]  = sign(block[i-1].next, canonical(block[i]))   verify with block[i-1].nextPub
+ *
+ * Consequences:
+ *  - Verification needs only PUBLIC keys — any relying party can check a mandate
+ *    and its whole chain offline, without the issuer's secret.
+ *  - A holder attenuates by appending a block signed with the private key it was
+ *    handed; it never needs the issuer key.
+ *  - A block cannot be edited (its signature) or removed from the middle (the
+ *    next block's signer key was published inside it). Trailing-block TRUNCATION
+ *    is prevented separately, at authorize time, by a proof of possession: the
+ *    presenter must sign a fresh challenge with the private key matching the
+ *    LAST block's `nextPub`. Each delegation hands a fresh such key downstream,
+ *    so a holder cannot produce the proof for any shorter prefix of its chain.
+ *  - Widening is impossible because every block's caveats are intersected at
+ *    authorize time.
+ */
+export interface KeyPair {
+    publicKey: KeyObject;
+    privateKey: KeyObject;
+}
+export declare function newKeyPair(): KeyPair;
+/**
+ * Deterministic canonical JSON: object keys sorted recursively, no insignificant
+ * whitespace. Produces byte-identical output to Python's
+ * `json.dumps(obj, sort_keys=True, separators=(",", ":"), ensure_ascii=False)`,
+ * so the two reference ports — and any third-party verifier following this rule —
+ * compute the same signed bytes regardless of object construction order.
+ */
+export declare function canonicalJson(value: unknown): string;
+/** Canonical bytes for a block (what gets signed/verified) — see canonicalJson. */
+export declare function canonicalBlock(block: Block): string;
+export declare function signBlock(privateKey: KeyObject, block: Block): string;
+export declare function verifyBlock(publicKey: KeyObject, block: Block, sig: string): boolean;
+export declare function exportPublicKey(key: KeyObject): string;
+export declare function importPublicKey(b64: string): KeyObject;
+export declare function exportPrivateKey(key: KeyObject): string;
+export declare function importPrivateKey(d: string, x: string): KeyObject;
+/**
+ * Proof of possession (PoP) of the chain's terminal key — closes trailing-block
+ * truncation and makes a serialized token NOT a usable bearer credential.
+ *
+ * The message binds the proof to the EXACT presented chain (id + every block
+ * signature), the timestamp, AND the action, so it cannot be replayed for a
+ * different/truncated token or reused for a different action, and only within a
+ * short freshness window for the same (token, action). Producing it requires the
+ * private key matching `blocks[last].nextPub`, which only the legitimate tail
+ * holder has. (Over the wire, run under TLS; for single-use guarantees within
+ * the window, layer a verifier-issued nonce.)
+ */
+export declare function proofMessage(id: string, sigs: string[], ts: number, action: string, nonce?: string): string;
+export declare function signProof(delegationKey: KeyObject, id: string, sigs: string[], ts: number, action: string, nonce?: string): string;
+export declare function verifyProof(terminalPub: KeyObject, id: string, sigs: string[], ts: number, action: string, sig: string, nonce?: string): boolean;
+/** Sign / verify an arbitrary canonical message (used for audit checkpoints). */
+export declare function signMessage(privateKey: KeyObject, message: string): string;
+export declare function verifyMessage(publicKey: KeyObject, message: string, sig: string): boolean;
+export declare function sha256Hex(data: string): string;
+export declare function newId(): string;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,SAAS,CAAC;IACrB,UAAU,EAAE,SAAS,CAAC;CACvB;AAED,wBAAgB,UAAU,IAAI,OAAO,CAEpC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAYpD;AAED,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAEnD;AAED,wBAAgB,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,GAAG,MAAM,CAIrE;AAED,wBAAgB,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAWpF;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAMtD;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAEtD;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAKvD;AAED,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAEhE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAC1B,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EAAE,EACd,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,KAAK,SAAK,GACT,MAAM,CAER;AAED,wBAAgB,SAAS,CACvB,aAAa,EAAE,SAAS,EACxB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EAAE,EACd,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,KAAK,SAAK,GACT,MAAM,CAMR;AAED,wBAAgB,WAAW,CACzB,WAAW,EAAE,SAAS,EACtB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EAAE,EACd,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,KAAK,SAAK,GACT,OAAO,CAWT;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAMzF;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,wBAAgB,KAAK,IAAI,MAAM,CAE9B"}

package/dist/crypto.js

@@ -0,0 +1,105 @@
+import { generateKeyPairSync, sign as edSign, verify as edVerify, createHash, createPublicKey, createPrivateKey, randomUUID, } from "node:crypto";
+export function newKeyPair() {
+    return generateKeyPairSync("ed25519");
+}
+/**
+ * Deterministic canonical JSON: object keys sorted recursively, no insignificant
+ * whitespace. Produces byte-identical output to Python's
+ * `json.dumps(obj, sort_keys=True, separators=(",", ":"), ensure_ascii=False)`,
+ * so the two reference ports — and any third-party verifier following this rule —
+ * compute the same signed bytes regardless of object construction order.
+ */
+export function canonicalJson(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return "[" + value.map(canonicalJson).join(",") + "]";
+    const obj = value;
+    return ("{" +
+        Object.keys(obj)
+            .sort()
+            .map((k) => JSON.stringify(k) + ":" + canonicalJson(obj[k]))
+            .join(",") +
+        "}");
+}
+/** Canonical bytes for a block (what gets signed/verified) — see canonicalJson. */
+export function canonicalBlock(block) {
+    return canonicalJson({ caveats: block.caveats, nextPub: block.nextPub });
+}
+export function signBlock(privateKey, block) {
+    return edSign(null, Buffer.from(canonicalBlock(block), "utf8"), privateKey).toString("base64url");
+}
+export function verifyBlock(publicKey, block, sig) {
+    try {
+        return edVerify(null, Buffer.from(canonicalBlock(block), "utf8"), publicKey, Buffer.from(sig, "base64url"));
+    }
+    catch {
+        return false;
+    }
+}
+export function exportPublicKey(key) {
+    // Raw 32-byte Ed25519 public key (JWK `x`), base64url — matches the Python
+    // port's encoding so tokens verify across both reference implementations.
+    const jwk = key.export({ format: "jwk" });
+    if (!jwk.x)
+        throw new Error("not an Ed25519 public key");
+    return jwk.x;
+}
+export function importPublicKey(b64) {
+    return createPublicKey({ key: { kty: "OKP", crv: "Ed25519", x: b64 }, format: "jwk" });
+}
+export function exportPrivateKey(key) {
+    // Raw 32-byte seed (JWK `d`), base64url.
+    const jwk = key.export({ format: "jwk" });
+    if (!jwk.d)
+        throw new Error("not an Ed25519 private key");
+    return jwk.d;
+}
+export function importPrivateKey(d, x) {
+    return createPrivateKey({ key: { kty: "OKP", crv: "Ed25519", x, d }, format: "jwk" });
+}
+/**
+ * Proof of possession (PoP) of the chain's terminal key — closes trailing-block
+ * truncation and makes a serialized token NOT a usable bearer credential.
+ *
+ * The message binds the proof to the EXACT presented chain (id + every block
+ * signature), the timestamp, AND the action, so it cannot be replayed for a
+ * different/truncated token or reused for a different action, and only within a
+ * short freshness window for the same (token, action). Producing it requires the
+ * private key matching `blocks[last].nextPub`, which only the legitimate tail
+ * holder has. (Over the wire, run under TLS; for single-use guarantees within
+ * the window, layer a verifier-issued nonce.)
+ */
+export function proofMessage(id, sigs, ts, action, nonce = "") {
+    return `behalf-pop\n${id}\n${sigs.join(",")}\n${ts}\n${action}\n${nonce}`;
+}
+export function signProof(delegationKey, id, sigs, ts, action, nonce = "") {
+    return edSign(null, Buffer.from(proofMessage(id, sigs, ts, action, nonce), "utf8"), delegationKey).toString("base64url");
+}
+export function verifyProof(terminalPub, id, sigs, ts, action, sig, nonce = "") {
+    try {
+        return edVerify(null, Buffer.from(proofMessage(id, sigs, ts, action, nonce), "utf8"), terminalPub, Buffer.from(sig, "base64url"));
+    }
+    catch {
+        return false;
+    }
+}
+/** Sign / verify an arbitrary canonical message (used for audit checkpoints). */
+export function signMessage(privateKey, message) {
+    return edSign(null, Buffer.from(message, "utf8"), privateKey).toString("base64url");
+}
+export function verifyMessage(publicKey, message, sig) {
+    try {
+        return edVerify(null, Buffer.from(message, "utf8"), publicKey, Buffer.from(sig, "base64url"));
+    }
+    catch {
+        return false;
+    }
+}
+export function sha256Hex(data) {
+    return createHash("sha256").update(data, "utf8").digest("hex");
+}
+export function newId() {
+    return randomUUID();
+}
+//# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,IAAI,IAAI,MAAM,EACd,MAAM,IAAI,QAAQ,EAClB,UAAU,EACV,eAAe,EACf,gBAAgB,EAChB,UAAU,GAEX,MAAM,aAAa,CAAC;AAiCrB,MAAM,UAAU,UAAU;IACxB,OAAO,mBAAmB,CAAC,SAAS,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAChF,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,CACL,GAAG;QACH,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;aACb,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;aAC3D,IAAI,CAAC,GAAG,CAAC;QACZ,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,cAAc,CAAC,KAAY;IACzC,OAAO,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,UAAqB,EAAE,KAAY;IAC3D,OAAO,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC,QAAQ,CAClF,WAAW,CACZ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAoB,EAAE,KAAY,EAAE,GAAW;IACzE,IAAI,CAAC;QACH,OAAO,QAAQ,CACb,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,EAC1C,SAAS,EACT,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAC9B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAc;IAC5C,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAmB,CAAC;IAC5D,IAAI,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACzD,OAAO,GAAG,CAAC,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAc;IAC7C,yCAAyC;IACzC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAmB,CAAC;IAC5D,IAAI,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC1D,OAAO,GAAG,CAAC,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,CAAS,EAAE,CAAS;IACnD,OAAO,gBAAgB,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAC1B,EAAU,EACV,IAAc,EACd,EAAU,EACV,MAAc,EACd,KAAK,GAAG,EAAE;IAEV,OAAO,eAAe,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,MAAM,KAAK,KAAK,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,aAAwB,EACxB,EAAU,EACV,IAAc,EACd,EAAU,EACV,MAAc,EACd,KAAK,GAAG,EAAE;IAEV,OAAO,MAAM,CACX,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,EAC9D,aAAa,CACd,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,WAAsB,EACtB,EAAU,EACV,IAAc,EACd,EAAU,EACV,MAAc,EACd,GAAW,EACX,KAAK,GAAG,EAAE;IAEV,IAAI,CAAC;QACH,OAAO,QAAQ,CACb,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,EAC9D,WAAW,EACX,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAC9B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,WAAW,CAAC,UAAqB,EAAE,OAAe;IAChE,OAAO,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAAoB,EAAE,OAAe,EAAE,GAAW;IAC9E,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;IAChG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,KAAK;IACnB,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,25 @@
+/** Base class for all Behalf errors, so callers can `catch (e instanceof BehalfError)`. */
+export declare class BehalfError extends Error {
+    constructor(message: string);
+}
+/** Thrown by `authorize()` when the requested action is not permitted. */
+export declare class AuthorizationError extends BehalfError {
+    readonly action: string;
+    readonly reason: string;
+    constructor(action: string, reason: string);
+}
+/** Thrown by `attenuate()` when a requested capability would widen authority. */
+export declare class WideningError extends BehalfError {
+    readonly capability: string;
+    constructor(capability: string);
+}
+/** Thrown when a token's signature chain does not verify. */
+export declare class IntegrityError extends BehalfError {
+    constructor(message?: string);
+}
+/** Thrown when a capability string cannot be parsed. */
+export declare class CapabilityParseError extends BehalfError {
+    readonly capability: string;
+    constructor(capability: string, detail: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,qBAAa,WAAY,SAAQ,KAAK;gBACxB,OAAO,EAAE,MAAM;CAI5B;AAED,0EAA0E;AAC1E,qBAAa,kBAAmB,SAAQ,WAAW;aAE/B,MAAM,EAAE,MAAM;aACd,MAAM,EAAE,MAAM;gBADd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM;CAIjC;AAED,iFAAiF;AACjF,qBAAa,aAAc,SAAQ,WAAW;aAChB,UAAU,EAAE,MAAM;gBAAlB,UAAU,EAAE,MAAM;CAK/C;AAED,6DAA6D;AAC7D,qBAAa,cAAe,SAAQ,WAAW;gBACjC,OAAO,SAAiC;CAGrD;AAED,wDAAwD;AACxD,qBAAa,oBAAqB,SAAQ,WAAW;aACvB,UAAU,EAAE,MAAM;gBAAlB,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAG/D"}

package/dist/errors.js

@@ -0,0 +1,40 @@
+/** Base class for all Behalf errors, so callers can `catch (e instanceof BehalfError)`. */
+export class BehalfError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = new.target.name;
+    }
+}
+/** Thrown by `authorize()` when the requested action is not permitted. */
+export class AuthorizationError extends BehalfError {
+    action;
+    reason;
+    constructor(action, reason) {
+        super(`authorization denied for "${action}": ${reason}`);
+        this.action = action;
+        this.reason = reason;
+    }
+}
+/** Thrown by `attenuate()` when a requested capability would widen authority. */
+export class WideningError extends BehalfError {
+    capability;
+    constructor(capability) {
+        super(`attenuation would widen authority: "${capability}" is not covered by the parent mandate`);
+        this.capability = capability;
+    }
+}
+/** Thrown when a token's signature chain does not verify. */
+export class IntegrityError extends BehalfError {
+    constructor(message = "mandate signature is invalid") {
+        super(message);
+    }
+}
+/** Thrown when a capability string cannot be parsed. */
+export class CapabilityParseError extends BehalfError {
+    capability;
+    constructor(capability, detail) {
+        super(`invalid capability "${capability}": ${detail}`);
+        this.capability = capability;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF;AAED,0EAA0E;AAC1E,MAAM,OAAO,kBAAmB,SAAQ,WAAW;IAE/B;IACA;IAFlB,YACkB,MAAc,EACd,MAAc;QAE9B,KAAK,CAAC,6BAA6B,MAAM,MAAM,MAAM,EAAE,CAAC,CAAC;QAHzC,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAQ;IAGhC,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,OAAO,aAAc,SAAQ,WAAW;IAChB;IAA5B,YAA4B,UAAkB;QAC5C,KAAK,CACH,uCAAuC,UAAU,wCAAwC,CAC1F,CAAC;QAHwB,eAAU,GAAV,UAAU,CAAQ;IAI9C,CAAC;CACF;AAED,6DAA6D;AAC7D,MAAM,OAAO,cAAe,SAAQ,WAAW;IAC7C,YAAY,OAAO,GAAG,8BAA8B;QAClD,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAED,wDAAwD;AACxD,MAAM,OAAO,oBAAqB,SAAQ,WAAW;IACvB;IAA5B,YAA4B,UAAkB,EAAE,MAAc;QAC5D,KAAK,CAAC,uBAAuB,UAAU,MAAM,MAAM,EAAE,CAAC,CAAC;QAD7B,eAAU,GAAV,UAAU,CAAQ;IAE9C,CAAC;CACF"}