agent-passport-system 4.1.0 → 4.2.0

package/dist/src/v2/authority-delegation/compare.js

@@ -0,0 +1,67 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { scopeNarrows } from './scope.js';
+const REVERSIBILITY_RANK = {
+    tentative: 0,
+    compensable: 1,
+    irreversible: 2,
+};
+function fail(failures, code, facet, message) {
+    failures.push({ code, facet, message });
+}
+/** Compare a child against its immediate parent in the seven-facet partial order. */
+export function compareAuthority(parent, child) {
+    const failures = [];
+    if (child.scope.profile !== parent.scope.profile) {
+        fail(failures, 'UNSUPPORTED_PROFILE', 'scope', 'scope profile changes are incomparable');
+    }
+    else if (!scopeNarrows(parent.scope.grants, child.scope.grants)) {
+        fail(failures, 'SCOPE_WIDENING', 'scope', 'child scope is not covered by parent scope');
+    }
+    if (parent.spend.mode === 'bounded') {
+        if (child.spend.mode === 'unbounded') {
+            fail(failures, 'SPEND_WIDENING', 'spend', 'bounded parent cannot produce unbounded child');
+        }
+        else if (child.spend.unit !== parent.spend.unit) {
+            fail(failures, 'SPEND_UNIT_CHANGE', 'spend', 'bounded spend unit must remain exact');
+        }
+        else if (BigInt(child.spend.per_action) > BigInt(parent.spend.per_action) ||
+            BigInt(child.spend.cumulative) > BigInt(parent.spend.cumulative)) {
+            fail(failures, 'SPEND_WIDENING', 'spend', 'child spend limits exceed parent limits');
+        }
+    }
+    if (parent.depth.remaining === 0) {
+        fail(failures, 'DEPTH_EXHAUSTED', 'depth', 'parent has no remaining delegation hop');
+    }
+    else if (child.depth.remaining > parent.depth.remaining - 1) {
+        fail(failures, 'DEPTH_WIDENING', 'depth', 'child remaining depth must consume at least one hop');
+    }
+    if (Date.parse(child.time.not_before) < Date.parse(parent.time.not_before) ||
+        Date.parse(child.time.not_after) > Date.parse(parent.time.not_after)) {
+        fail(failures, 'TIME_WIDENING', 'time', 'child validity window is not contained in parent window');
+    }
+    if (child.reputation.profile !== parent.reputation.profile) {
+        fail(failures, 'UNSUPPORTED_PROFILE', 'reputation', 'reputation profile changes are incomparable');
+    }
+    else if (child.reputation.ceiling > parent.reputation.ceiling) {
+        fail(failures, 'REPUTATION_WIDENING', 'reputation', 'child reputation ceiling exceeds parent');
+    }
+    if (child.values.profile !== parent.values.profile) {
+        fail(failures, 'UNSUPPORTED_PROFILE', 'values', 'values profile changes are incomparable');
+    }
+    else {
+        const childRequired = new Set(child.values.required);
+        if (parent.values.required.some(identifier => !childRequired.has(identifier))) {
+            fail(failures, 'VALUES_WEAKENING', 'values', 'child removed an ancestor-required value identifier');
+        }
+    }
+    if (child.reversibility.profile !== parent.reversibility.profile) {
+        fail(failures, 'UNSUPPORTED_PROFILE', 'reversibility', 'reversibility profile changes are incomparable');
+    }
+    else if (REVERSIBILITY_RANK[child.reversibility.ceiling] >
+        REVERSIBILITY_RANK[parent.reversibility.ceiling]) {
+        fail(failures, 'REVERSIBILITY_WIDENING', 'reversibility', 'child reversibility ceiling exceeds parent');
+    }
+    return failures;
+}
+//# sourceMappingURL=compare.js.map

package/dist/src/v2/authority-delegation/compare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compare.js","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/compare.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAGzC,MAAM,kBAAkB,GAAyC;IAC/D,SAAS,EAAE,CAAC;IACZ,WAAW,EAAE,CAAC;IACd,YAAY,EAAE,CAAC;CAChB,CAAA;AAED,SAAS,IAAI,CACX,QAA4B,EAC5B,IAA8B,EAC9B,KAA8B,EAC9B,OAAe;IAEf,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;AACzC,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,gBAAgB,CAC9B,MAAyB,EACzB,KAAwB;IAExB,MAAM,QAAQ,GAAuB,EAAE,CAAA;IAEvC,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACjD,IAAI,CAAC,QAAQ,EAAE,qBAAqB,EAAE,OAAO,EAAE,wCAAwC,CAAC,CAAA;IAC1F,CAAC;SAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,4CAA4C,CAAC,CAAA;IACzF,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACrC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,+CAA+C,CAAC,CAAA;QAC5F,CAAC;aAAM,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAClD,IAAI,CAAC,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,sCAAsC,CAAC,CAAA;QACtF,CAAC;aAAM,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;YAChE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5E,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,yCAAyC,CAAC,CAAA;QACtF,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,wCAAwC,CAAC,CAAA;IACtF,CAAC;SAAM,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,qDAAqD,CAAC,CAAA;IAClG,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACtE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,yDAAyD,CAAC,CAAA;IACpG,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAC3D,IAAI,CAAC,QAAQ,EAAE,qBAAqB,EAAE,YAAY,EAAE,6CAA6C,CAAC,CAAA;IACpG,CAAC;SAAM,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAChE,IAAI,CAAC,QAAQ,EAAE,qBAAqB,EAAE,YAAY,EAAE,yCAAyC,CAAC,CAAA;IAChG,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,qBAAqB,EAAE,QAAQ,EAAE,yCAAyC,CAAC,CAAA;IAC5F,CAAC;SAAM,CAAC;QACN,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QACpD,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAC9E,IAAI,CAAC,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,EAAE,qDAAqD,CAAC,CAAA;QACrG,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,aAAa,CAAC,OAAO,KAAK,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QACjE,IAAI,CAAC,QAAQ,EAAE,qBAAqB,EAAE,eAAe,EAAE,gDAAgD,CAAC,CAAA;IAC1G,CAAC;SAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC;QAC/C,kBAAkB,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,QAAQ,EAAE,wBAAwB,EAAE,eAAe,EAAE,4CAA4C,CAAC,CAAA;IACzG,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/src/v2/authority-delegation/index.d.ts

@@ -0,0 +1,10 @@
+export * from './types.js';
+export * from './schema.js';
+export * from './scope.js';
+export * from './canonical.js';
+export * from './compare.js';
+export * from './issue.js';
+export * from './parse.js';
+export * from './verify.js';
+export * from './budget.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/v2/authority-delegation/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/index.ts"],"names":[],"mappings":"AAGA,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA"}

package/dist/src/v2/authority-delegation/index.js

@@ -0,0 +1,12 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+export * from './types.js';
+export * from './schema.js';
+export * from './scope.js';
+export * from './canonical.js';
+export * from './compare.js';
+export * from './issue.js';
+export * from './parse.js';
+export * from './verify.js';
+export * from './budget.js';
+//# sourceMappingURL=index.js.map

package/dist/src/v2/authority-delegation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/index.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA"}

package/dist/src/v2/authority-delegation/issue.d.ts

@@ -0,0 +1,10 @@
+import type { AuthorityDelegationBodyV1, AuthorityDelegationV1 } from './types.js';
+/** Create a deterministic v1 record from explicit body fields and an Ed25519 key. */
+export declare function issueAuthorityDelegation(body: AuthorityDelegationBodyV1, privateKey: string): AuthorityDelegationV1;
+/**
+ * Issue a child after immediate-parent attenuation checks. The caller must first
+ * validate the complete parent chain and revocation state; this pure primitive
+ * cannot establish live ancestor status by itself.
+ */
+export declare function issueSubAuthorityDelegation(parent: AuthorityDelegationV1, body: AuthorityDelegationBodyV1, privateKey: string): AuthorityDelegationV1;
+//# sourceMappingURL=issue.d.ts.map

package/dist/src/v2/authority-delegation/issue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/issue.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAclF,qFAAqF;AACrF,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,yBAAyB,EAC/B,UAAU,EAAE,MAAM,GACjB,qBAAqB,CAKvB;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,yBAAyB,EAC/B,UAAU,EAAE,MAAM,GACjB,qBAAqB,CAsBvB"}

package/dist/src/v2/authority-delegation/issue.js

@@ -0,0 +1,52 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { computeAuthorityDelegationId, signAuthorityDelegation, } from './canonical.js';
+import { compareAuthority } from './compare.js';
+import { validateAuthorityDelegationShape } from './schema.js';
+function assertBody(body) {
+    const probe = {
+        ...body,
+        delegation_id: `sha256:${'0'.repeat(64)}`,
+        signature: '0'.repeat(128),
+    };
+    const failures = validateAuthorityDelegationShape(probe);
+    if (failures.length > 0) {
+        throw new Error(`authority delegation body invalid: ${failures.map(item => `${item.code}: ${item.message}`).join('; ')}`);
+    }
+}
+/** Create a deterministic v1 record from explicit body fields and an Ed25519 key. */
+export function issueAuthorityDelegation(body, privateKey) {
+    assertBody(body);
+    const delegation_id = computeAuthorityDelegationId(body);
+    const unsigned = { ...body, delegation_id };
+    return { ...unsigned, signature: signAuthorityDelegation(unsigned, privateKey) };
+}
+/**
+ * Issue a child after immediate-parent attenuation checks. The caller must first
+ * validate the complete parent chain and revocation state; this pure primitive
+ * cannot establish live ancestor status by itself.
+ */
+export function issueSubAuthorityDelegation(parent, body, privateKey) {
+    const parentFailures = validateAuthorityDelegationShape(parent);
+    if (parentFailures.length > 0) {
+        throw new Error(`authority delegation parent invalid: ${parentFailures.map(item => item.code).join(', ')}`);
+    }
+    assertBody(body);
+    if (body.parent_delegation_id !== parent.delegation_id) {
+        throw new Error('authority delegation parent mismatch');
+    }
+    if (body.issuer !== parent.subject) {
+        throw new Error('authority delegation chain continuity failure');
+    }
+    const issued = Date.parse(body.issued_at);
+    if (issued < Date.parse(parent.authority.time.not_before) ||
+        issued >= Date.parse(parent.authority.time.not_after)) {
+        throw new Error('authority delegation issued_at is outside parent validity');
+    }
+    const failures = compareAuthority(parent.authority, body.authority);
+    if (failures.length > 0) {
+        throw new Error(`authority delegation does not narrow: ${failures.map(item => item.code).join(', ')}`);
+    }
+    return issueAuthorityDelegation(body, privateKey);
+}
+//# sourceMappingURL=issue.js.map

package/dist/src/v2/authority-delegation/issue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue.js","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/issue.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAA;AAG9D,SAAS,UAAU,CAAC,IAA+B;IACjD,MAAM,KAAK,GAA0B;QACnC,GAAG,IAAI;QACP,aAAa,EAAE,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;QACzC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;KAC3B,CAAA;IACD,MAAM,QAAQ,GAAG,gCAAgC,CAAC,KAAK,CAAC,CAAA;IACxD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC3H,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,wBAAwB,CACtC,IAA+B,EAC/B,UAAkB;IAElB,UAAU,CAAC,IAAI,CAAC,CAAA;IAChB,MAAM,aAAa,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAA;IACxD,MAAM,QAAQ,GAA6C,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,CAAA;IACrF,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,uBAAuB,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAA;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAA6B,EAC7B,IAA+B,EAC/B,UAAkB;IAElB,MAAM,cAAc,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAA;IAC/D,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,wCAAwC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC7G,CAAC;IACD,UAAU,CAAC,IAAI,CAAC,CAAA;IAChB,IAAI,IAAI,CAAC,oBAAoB,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;IACzD,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACzC,IAAI,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;QACrD,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IACnE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACxG,CAAC;IACD,OAAO,wBAAwB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;AACnD,CAAC"}

package/dist/src/v2/authority-delegation/parse.d.ts

@@ -0,0 +1,4 @@
+import type { AuthorityDelegationV1 } from './types.js';
+/** Strict untrusted-wire entry point: valid JSON, I-JSON names, and closed v1 schema. */
+export declare function parseAuthorityDelegationJson(source: string): AuthorityDelegationV1;
+//# sourceMappingURL=parse.d.ts.map

package/dist/src/v2/authority-delegation/parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/parse.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAsEvD,yFAAyF;AACzF,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,GAAG,qBAAqB,CAWlF"}

package/dist/src/v2/authority-delegation/parse.js

@@ -0,0 +1,96 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { validateAuthorityDelegationShape } from './schema.js';
+const MAX_WIRE_BYTES = 1_048_576;
+/**
+ * JSON.parse silently keeps the last occurrence of a duplicate member. RFC
+ * 8785 operates on I-JSON, so scan the already-syntax-checked source and reject
+ * repeated names at every object depth before accepting a signed record.
+ */
+function rejectDuplicateMembers(source) {
+    let cursor = 0;
+    const skipWhitespace = () => {
+        while (cursor < source.length && /[\u0009\u000a\u000d\u0020]/.test(source[cursor]))
+            cursor++;
+    };
+    const readString = () => {
+        const start = cursor;
+        cursor++; // opening quote; whole-document JSON.parse already proved syntax
+        while (cursor < source.length) {
+            if (source[cursor] === '\\') {
+                cursor += 2;
+            }
+            else if (source[cursor++] === '"') {
+                return JSON.parse(source.slice(start, cursor));
+            }
+        }
+        throw new SyntaxError('unterminated JSON string');
+    };
+    const value = () => {
+        skipWhitespace();
+        const first = source[cursor];
+        if (first === '{') {
+            cursor++;
+            skipWhitespace();
+            const names = new Set();
+            if (source[cursor] === '}') {
+                cursor++;
+                return;
+            }
+            while (cursor < source.length) {
+                const name = readString();
+                if (names.has(name))
+                    throw new SyntaxError('duplicate JSON object member');
+                names.add(name);
+                skipWhitespace();
+                cursor++; // colon
+                value();
+                skipWhitespace();
+                if (source[cursor++] === '}')
+                    return;
+                skipWhitespace(); // comma was consumed
+            }
+        }
+        else if (first === '[') {
+            cursor++;
+            skipWhitespace();
+            if (source[cursor] === ']') {
+                cursor++;
+                return;
+            }
+            while (cursor < source.length) {
+                value();
+                skipWhitespace();
+                if (source[cursor++] === ']')
+                    return;
+            }
+        }
+        else if (first === '"') {
+            readString();
+        }
+        else {
+            const start = cursor;
+            while (cursor < source.length && !/[\u0009\u000a\u000d\u0020,}\]]/.test(source[cursor]))
+                cursor++;
+            const token = source.slice(start, cursor);
+            if (/^[-0-9]/.test(token) && !/^-?(0|[1-9][0-9]*)$/.test(token)) {
+                throw new SyntaxError('non-integer JSON numbers are not permitted');
+            }
+        }
+    };
+    value();
+}
+/** Strict untrusted-wire entry point: valid JSON, I-JSON names, and closed v1 schema. */
+export function parseAuthorityDelegationJson(source) {
+    if (typeof source !== 'string' || Buffer.byteLength(source, 'utf8') > MAX_WIRE_BYTES) {
+        throw new TypeError('authority delegation JSON must be a string no larger than 1 MiB');
+    }
+    const decoded = JSON.parse(source);
+    rejectDuplicateMembers(source);
+    const failures = validateAuthorityDelegationShape(decoded);
+    if (failures.length > 0) {
+        throw new TypeError(`authority delegation wire invalid: ${failures.map(item => item.code).join(', ')}`);
+    }
+    return decoded;
+}
+//# sourceMappingURL=parse.js.map

package/dist/src/v2/authority-delegation/parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.js","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/parse.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAA;AAG9D,MAAM,cAAc,GAAG,SAAS,CAAA;AAEhC;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,MAAc;IAC5C,IAAI,MAAM,GAAG,CAAC,CAAA;IAEd,MAAM,cAAc,GAAG,GAAS,EAAE;QAChC,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAAE,MAAM,EAAE,CAAA;IAC9F,CAAC,CAAA;IACD,MAAM,UAAU,GAAG,GAAW,EAAE;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAA;QACpB,MAAM,EAAE,CAAA,CAAC,iEAAiE;QAC1E,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,CAAA;YACb,CAAC;iBAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC;gBACpC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAW,CAAA;YAC1D,CAAC;QACH,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,0BAA0B,CAAC,CAAA;IACnD,CAAC,CAAA;IACD,MAAM,KAAK,GAAG,GAAS,EAAE;QACvB,cAAc,EAAE,CAAA;QAChB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;QAC5B,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAClB,MAAM,EAAE,CAAA;YACR,cAAc,EAAE,CAAA;YAChB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;YAC/B,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,MAAM,EAAE,CAAC;gBAAC,OAAM;YAAC,CAAC;YAChD,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,UAAU,EAAE,CAAA;gBACzB,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,WAAW,CAAC,8BAA8B,CAAC,CAAA;gBAC1E,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;gBACf,cAAc,EAAE,CAAA;gBAChB,MAAM,EAAE,CAAA,CAAC,QAAQ;gBACjB,KAAK,EAAE,CAAA;gBACP,cAAc,EAAE,CAAA;gBAChB,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,GAAG;oBAAE,OAAM;gBACpC,cAAc,EAAE,CAAA,CAAC,qBAAqB;YACxC,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACzB,MAAM,EAAE,CAAA;YACR,cAAc,EAAE,CAAA;YAChB,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,MAAM,EAAE,CAAC;gBAAC,OAAM;YAAC,CAAC;YAChD,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC9B,KAAK,EAAE,CAAA;gBACP,cAAc,EAAE,CAAA;gBAChB,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,GAAG;oBAAE,OAAM;YACtC,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACzB,UAAU,EAAE,CAAA;QACd,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,MAAM,CAAA;YACpB,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAAE,MAAM,EAAE,CAAA;YACjG,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;YACzC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChE,MAAM,IAAI,WAAW,CAAC,4CAA4C,CAAC,CAAA;YACrE,CAAC;QACH,CAAC;IACH,CAAC,CAAA;IAED,KAAK,EAAE,CAAA;AACT,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,4BAA4B,CAAC,MAAc;IACzD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,cAAc,EAAE,CAAC;QACrF,MAAM,IAAI,SAAS,CAAC,iEAAiE,CAAC,CAAA;IACxF,CAAC;IACD,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC3C,sBAAsB,CAAC,MAAM,CAAC,CAAA;IAC9B,MAAM,QAAQ,GAAG,gCAAgC,CAAC,OAAO,CAAC,CAAA;IAC1D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,SAAS,CAAC,sCAAsC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACzG,CAAC;IACD,OAAO,OAAgC,CAAA;AACzC,CAAC"}

package/dist/src/v2/authority-delegation/schema.d.ts

@@ -0,0 +1,7 @@
+import type { AuthorityDelegationV1, AuthorityFailure } from './types.js';
+export declare function isCanonicalTimestamp(value: unknown): value is string;
+export declare function isCanonicalQuantity(value: unknown): value is string;
+/** Closed-schema and canonical-value validation for an in-memory decoded record. */
+export declare function validateAuthorityDelegationShape(value: unknown): AuthorityFailure[];
+export declare function isAuthorityDelegationV1(value: unknown): value is AuthorityDelegationV1;
+//# sourceMappingURL=schema.d.ts.map

package/dist/src/v2/authority-delegation/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/schema.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAmCzE,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAIpE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAGnE;AAMD,oFAAoF;AACpF,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,EAAE,CA4GnF;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAEtF"}

package/dist/src/v2/authority-delegation/schema.js

@@ -0,0 +1,177 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { grantsAreCanonical } from './scope.js';
+import { AUTHORITY_DELEGATION_RECORD_TYPE, AUTHORITY_DELEGATION_VERSION, REPUTATION_PROFILE_V1, REVERSIBILITY_PROFILE_V1, SCOPE_PROFILE_V1, VALUES_PROFILE_V1, } from './types.js';
+const ID = /^sha256:[0-9a-f]{64}$/;
+const HEX_32 = /^[0-9a-f]{32}$/;
+const HEX_128 = /^[0-9a-f]{128}$/;
+const DECIMAL = /^(0|[1-9][0-9]*)$/;
+const IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+const MAX_QUANTITY = 9223372036854775807n;
+const MILLIS_UTC = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function exactKeys(value, expected) {
+    const actual = Object.keys(value).sort();
+    const wanted = [...expected].sort();
+    return actual.length === wanted.length && actual.every((key, i) => key === wanted[i]);
+}
+function wellFormedUnicode(value) {
+    for (let i = 0; i < value.length; i++) {
+        const unit = value.charCodeAt(i);
+        if (unit >= 0xd800 && unit <= 0xdbff) {
+            const next = value.charCodeAt(++i);
+            if (!(next >= 0xdc00 && next <= 0xdfff))
+                return false;
+        }
+        else if (unit >= 0xdc00 && unit <= 0xdfff) {
+            return false;
+        }
+    }
+    return true;
+}
+export function isCanonicalTimestamp(value) {
+    if (typeof value !== 'string' || !MILLIS_UTC.test(value) || value.startsWith('0000-'))
+        return false;
+    const parsed = new Date(value);
+    return Number.isFinite(parsed.getTime()) && parsed.toISOString() === value;
+}
+export function isCanonicalQuantity(value) {
+    if (typeof value !== 'string' || !DECIMAL.test(value))
+        return false;
+    try {
+        return BigInt(value) <= MAX_QUANTITY;
+    }
+    catch {
+        return false;
+    }
+}
+function failure(code, message) {
+    return { code, message };
+}
+/** Closed-schema and canonical-value validation for an in-memory decoded record. */
+export function validateAuthorityDelegationShape(value) {
+    const failures = [];
+    const top = record(value);
+    if (!top || !exactKeys(top, [
+        'record_type', 'version', 'delegation_id', 'parent_delegation_id', 'issuer',
+        'subject', 'verification_method', 'issued_at', 'nonce', 'authority', 'signature',
+    ]))
+        return [failure('SCHEMA_INVALID', 'delegation must be an exact closed v1 object')];
+    if (top.record_type !== AUTHORITY_DELEGATION_RECORD_TYPE || top.version !== AUTHORITY_DELEGATION_VERSION) {
+        failures.push(failure('UNSUPPORTED_VERSION', 'unsupported authority-delegation record_type or version'));
+    }
+    if (typeof top.delegation_id !== 'string' || !ID.test(top.delegation_id)) {
+        failures.push(failure('SCHEMA_INVALID', 'delegation_id must be sha256:<64 lowercase hex>'));
+    }
+    if (top.parent_delegation_id !== null &&
+        (typeof top.parent_delegation_id !== 'string' || !ID.test(top.parent_delegation_id))) {
+        failures.push(failure('SCHEMA_INVALID', 'parent_delegation_id must be null or a delegation digest'));
+    }
+    for (const key of ['issuer', 'subject', 'verification_method']) {
+        const item = top[key];
+        if (typeof item !== 'string' || item.length === 0 || Buffer.byteLength(item, 'utf8') > 1024 || !wellFormedUnicode(item)) {
+            failures.push(failure('SCHEMA_INVALID', `${key} must be a non-empty well-formed Unicode string`));
+        }
+    }
+    if (!isCanonicalTimestamp(top.issued_at))
+        failures.push(failure('NONCANONICAL_VALUE', 'issued_at must be canonical UTC milliseconds'));
+    if (typeof top.nonce !== 'string' || !HEX_32.test(top.nonce))
+        failures.push(failure('NONCANONICAL_VALUE', 'nonce must be 32 lowercase hex characters'));
+    if (typeof top.signature !== 'string' || !HEX_128.test(top.signature))
+        failures.push(failure('SCHEMA_INVALID', 'signature must be 128 lowercase hex characters'));
+    const authority = record(top.authority);
+    if (!authority || !exactKeys(authority, ['scope', 'spend', 'depth', 'time', 'reputation', 'values', 'reversibility'])) {
+        failures.push(failure('SCHEMA_INVALID', 'authority must carry exactly all seven facets'));
+        return failures;
+    }
+    const scope = record(authority.scope);
+    if (!scope || !exactKeys(scope, ['profile', 'grants']) || typeof scope.profile !== 'string' ||
+        !IDENTIFIER.test(scope.profile) || !Array.isArray(scope.grants) ||
+        !scope.grants.every(item => typeof item === 'string')) {
+        failures.push(failure('SCHEMA_INVALID', 'scope must contain profile and grants'));
+    }
+    else {
+        if (scope.profile !== SCOPE_PROFILE_V1)
+            failures.push(failure('UNSUPPORTED_PROFILE', 'unsupported scope profile'));
+        if (!grantsAreCanonical(scope.grants))
+            failures.push(failure('NONCANONICAL_VALUE', 'scope grants must be valid, sorted, unique, and irredundant'));
+    }
+    const spend = record(authority.spend);
+    if (!spend || typeof spend.mode !== 'string') {
+        failures.push(failure('SCHEMA_INVALID', 'spend must be a tagged object'));
+    }
+    else if (spend.mode === 'unbounded') {
+        if (!exactKeys(spend, ['mode']))
+            failures.push(failure('SCHEMA_INVALID', 'unbounded spend has no other fields'));
+    }
+    else if (spend.mode === 'bounded') {
+        if (!exactKeys(spend, ['mode', 'unit', 'per_action', 'cumulative']) ||
+            typeof spend.unit !== 'string' || !IDENTIFIER.test(spend.unit) ||
+            !isCanonicalQuantity(spend.per_action) || !isCanonicalQuantity(spend.cumulative)) {
+            failures.push(failure('NONCANONICAL_VALUE', 'bounded spend fields are malformed'));
+        }
+        else if (BigInt(spend.per_action) > BigInt(spend.cumulative)) {
+            failures.push(failure('SCHEMA_INVALID', 'spend per_action cannot exceed cumulative'));
+        }
+    }
+    else
+        failures.push(failure('SCHEMA_INVALID', 'unknown spend mode'));
+    const depth = record(authority.depth);
+    if (!depth || !exactKeys(depth, ['remaining']) || !Number.isInteger(depth.remaining) ||
+        depth.remaining < 0 || depth.remaining > 255) {
+        failures.push(failure('SCHEMA_INVALID', 'depth.remaining must be an integer from 0 through 255'));
+    }
+    const time = record(authority.time);
+    if (!time || !exactKeys(time, ['not_before', 'not_after']) ||
+        !isCanonicalTimestamp(time.not_before) || !isCanonicalTimestamp(time.not_after)) {
+        failures.push(failure('NONCANONICAL_VALUE', 'time bounds must be canonical UTC milliseconds'));
+    }
+    else if (Date.parse(time.not_before) >= Date.parse(time.not_after)) {
+        failures.push(failure('SCHEMA_INVALID', 'time window must be non-empty'));
+    }
+    else if (isCanonicalTimestamp(top.issued_at) && Date.parse(time.not_before) < Date.parse(top.issued_at)) {
+        failures.push(failure('SCHEMA_INVALID', 'time.not_before cannot predate issued_at'));
+    }
+    const reputation = record(authority.reputation);
+    if (!reputation || !exactKeys(reputation, ['profile', 'ceiling']) ||
+        typeof reputation.profile !== 'string' || !IDENTIFIER.test(reputation.profile) ||
+        !Number.isInteger(reputation.ceiling) || reputation.ceiling < 0 ||
+        reputation.ceiling > 100) {
+        failures.push(failure('SCHEMA_INVALID', 'reputation ceiling must be an integer from 0 through 100'));
+    }
+    else if (reputation.profile !== REPUTATION_PROFILE_V1) {
+        failures.push(failure('UNSUPPORTED_PROFILE', 'unsupported reputation profile'));
+    }
+    const values = record(authority.values);
+    if (!values || !exactKeys(values, ['profile', 'required']) || typeof values.profile !== 'string' ||
+        !IDENTIFIER.test(values.profile) || !Array.isArray(values.required) ||
+        !values.required.every(item => typeof item === 'string' && IDENTIFIER.test(item))) {
+        failures.push(failure('SCHEMA_INVALID', 'values.required must contain valid identifiers'));
+    }
+    else {
+        if (values.profile !== VALUES_PROFILE_V1)
+            failures.push(failure('UNSUPPORTED_PROFILE', 'unsupported values profile'));
+        const required = values.required;
+        if (required.some((item, i) => i > 0 && required[i - 1] >= item)) {
+            failures.push(failure('NONCANONICAL_VALUE', 'values.required must be sorted and unique'));
+        }
+    }
+    const reversibility = record(authority.reversibility);
+    if (!reversibility || !exactKeys(reversibility, ['profile', 'ceiling']) ||
+        typeof reversibility.profile !== 'string' || !IDENTIFIER.test(reversibility.profile) ||
+        !['tentative', 'compensable', 'irreversible'].includes(String(reversibility.ceiling))) {
+        failures.push(failure('SCHEMA_INVALID', 'reversibility facet is malformed'));
+    }
+    else if (reversibility.profile !== REVERSIBILITY_PROFILE_V1) {
+        failures.push(failure('UNSUPPORTED_PROFILE', 'unsupported reversibility profile'));
+    }
+    return failures;
+}
+export function isAuthorityDelegationV1(value) {
+    return validateAuthorityDelegationShape(value).length === 0;
+}
+//# sourceMappingURL=schema.js.map

package/dist/src/v2/authority-delegation/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/schema.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EACL,gCAAgC,EAChC,4BAA4B,EAC5B,qBAAqB,EACrB,wBAAwB,EACxB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,YAAY,CAAA;AAGnB,MAAM,EAAE,GAAG,uBAAuB,CAAA;AAClC,MAAM,MAAM,GAAG,gBAAgB,CAAA;AAC/B,MAAM,OAAO,GAAG,iBAAiB,CAAA;AACjC,MAAM,OAAO,GAAG,mBAAmB,CAAA;AACnC,MAAM,UAAU,GAAG,qCAAqC,CAAA;AACxD,MAAM,YAAY,GAAG,oBAAoB,CAAA;AACzC,MAAM,UAAU,GAAG,+CAA+C,CAAA;AAElE,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAC,KAAgC;QAClC,CAAC,CAAC,IAAI,CAAA;AACV,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,QAA2B;IAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;IACxC,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAA;IACnC,OAAO,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;AACvF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QAChC,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;YAClC,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAA;QACvD,CAAC;aAAM,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAA;IACnG,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK,CAAA;AAC5E,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACnE,IAAI,CAAC;QAAC,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,YAAY,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;AACrE,CAAC;AAED,SAAS,OAAO,CAAC,IAA8B,EAAE,OAAe;IAC9D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAC1B,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,gCAAgC,CAAC,KAAc;IAC7D,MAAM,QAAQ,GAAuB,EAAE,CAAA;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IACzB,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;QAC1B,aAAa,EAAE,SAAS,EAAE,eAAe,EAAE,sBAAsB,EAAE,QAAQ;QAC3E,SAAS,EAAE,qBAAqB,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW;KACjF,CAAC;QAAE,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,8CAA8C,CAAC,CAAC,CAAA;IAEtF,IAAI,GAAG,CAAC,WAAW,KAAK,gCAAgC,IAAI,GAAG,CAAC,OAAO,KAAK,4BAA4B,EAAE,CAAC;QACzG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,yDAAyD,CAAC,CAAC,CAAA;IAC1G,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QACzE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,iDAAiD,CAAC,CAAC,CAAA;IAC7F,CAAC;IACD,IAAI,GAAG,CAAC,oBAAoB,KAAK,IAAI;QACjC,CAAC,OAAO,GAAG,CAAC,oBAAoB,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC;QACzF,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,0DAA0D,CAAC,CAAC,CAAA;IACtG,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,qBAAqB,CAAU,EAAE,CAAC;QACxE,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;QACrB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YACxH,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,GAAG,iDAAiD,CAAC,CAAC,CAAA;QACnG,CAAC;IACH,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,8CAA8C,CAAC,CAAC,CAAA;IACtI,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,2CAA2C,CAAC,CAAC,CAAA;IACvJ,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,gDAAgD,CAAC,CAAC,CAAA;IAEjK,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACvC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;QACtH,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,+CAA+C,CAAC,CAAC,CAAA;QACzF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACrC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACvF,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAC/D,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC1D,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,uCAAuC,CAAC,CAAC,CAAA;IACnF,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,CAAC,OAAO,KAAK,gBAAgB;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,2BAA2B,CAAC,CAAC,CAAA;QAClH,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,MAAkB,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,6DAA6D,CAAC,CAAC,CAAA;IAChK,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACrC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7C,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC,CAAA;IAC3E,CAAC;SAAM,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACtC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,qCAAqC,CAAC,CAAC,CAAA;IAClH,CAAC;SAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;YAC/D,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAC9D,CAAC,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACrF,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,oCAAoC,CAAC,CAAC,CAAA;QACpF,CAAC;aAAM,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/D,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,2CAA2C,CAAC,CAAC,CAAA;QACvF,CAAC;IACH,CAAC;;QAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,CAAC,CAAA;IAErE,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACrC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC;QAC/E,KAAK,CAAC,SAAoB,GAAG,CAAC,IAAK,KAAK,CAAC,SAAoB,GAAG,GAAG,EAAE,CAAC;QACzE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,uDAAuD,CAAC,CAAC,CAAA;IACnG,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACnC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACtD,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACpF,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,gDAAgD,CAAC,CAAC,CAAA;IAChG,CAAC;SAAM,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACrE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC,CAAA;IAC3E,CAAC;SAAM,IAAI,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1G,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,0CAA0C,CAAC,CAAC,CAAA;IACtF,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;IAC/C,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC7D,OAAO,UAAU,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAC9E,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,IAAK,UAAU,CAAC,OAAkB,GAAG,CAAC;QAC1E,UAAU,CAAC,OAAkB,GAAG,GAAG,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,0DAA0D,CAAC,CAAC,CAAA;IACtG,CAAC;SAAM,IAAI,UAAU,CAAC,OAAO,KAAK,qBAAqB,EAAE,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,gCAAgC,CAAC,CAAC,CAAA;IACjF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IACvC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;QAC5F,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;QACnE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACtF,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,gDAAgD,CAAC,CAAC,CAAA;IAC5F,CAAC;SAAM,CAAC;QACN,IAAI,MAAM,CAAC,OAAO,KAAK,iBAAiB;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,4BAA4B,CAAC,CAAC,CAAA;QACrH,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAoB,CAAA;QAC5C,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;YACjE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,2CAA2C,CAAC,CAAC,CAAA;QAC3F,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;IACrD,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACnE,OAAO,aAAa,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QACpF,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC1F,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,kCAAkC,CAAC,CAAC,CAAA;IAC9E,CAAC;SAAM,IAAI,aAAa,CAAC,OAAO,KAAK,wBAAwB,EAAE,CAAC;QAC9D,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,mCAAmC,CAAC,CAAC,CAAA;IACpF,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,OAAO,gCAAgC,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAA;AAC7D,CAAC"}

package/dist/src/v2/authority-delegation/scope.d.ts

@@ -0,0 +1,6 @@
+export declare function isValidScopeGrant(grant: string): boolean;
+/** Exact grants cover only themselves. A terminal :* grant covers its prefix and descendants. */
+export declare function scopeGrantCovers(parent: string, child: string): boolean;
+export declare function grantsAreCanonical(grants: readonly string[]): boolean;
+export declare function scopeNarrows(parent: readonly string[], child: readonly string[]): boolean;
+//# sourceMappingURL=scope.d.ts.map

package/dist/src/v2/authority-delegation/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/scope.ts"],"names":[],"mappings":"AAKA,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CASxD;AAED,iGAAiG;AACjG,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAQvE;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAYrE;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAEzF"}

package/dist/src/v2/authority-delegation/scope.js

@@ -0,0 +1,50 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+const SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+export function isValidScopeGrant(grant) {
+    if (grant === '*')
+        return true;
+    if (typeof grant !== 'string' || grant.length === 0 || grant.length > 255)
+        return false;
+    const parts = grant.split(':');
+    if (parts.length > 16)
+        return false;
+    const wildcard = parts.at(-1) === '*';
+    if (wildcard)
+        parts.pop();
+    if (parts.length === 0 || parts.some(part => !SEGMENT.test(part)))
+        return false;
+    return !parts.includes('*');
+}
+/** Exact grants cover only themselves. A terminal :* grant covers its prefix and descendants. */
+export function scopeGrantCovers(parent, child) {
+    if (parent === '*')
+        return true;
+    if (parent.endsWith(':*')) {
+        const prefix = parent.slice(0, -2);
+        const childPrefix = child.endsWith(':*') ? child.slice(0, -2) : child;
+        return childPrefix === prefix || childPrefix.startsWith(prefix + ':');
+    }
+    return parent === child;
+}
+export function grantsAreCanonical(grants) {
+    if (!Array.isArray(grants))
+        return false;
+    for (let i = 0; i < grants.length; i++) {
+        const grant = grants[i];
+        if (!isValidScopeGrant(grant))
+            return false;
+        if (i > 0 && grants[i - 1] >= grant)
+            return false;
+        // A canonical set is an antichain: no entry is redundant under another entry.
+        for (let j = 0; j < grants.length; j++) {
+            if (i !== j && scopeGrantCovers(grants[j], grant))
+                return false;
+        }
+    }
+    return true;
+}
+export function scopeNarrows(parent, child) {
+    return child.every(grant => parent.some(parentGrant => scopeGrantCovers(parentGrant, grant)));
+}
+//# sourceMappingURL=scope.js.map

package/dist/src/v2/authority-delegation/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/scope.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,MAAM,OAAO,GAAG,mCAAmC,CAAA;AAEnD,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,KAAK,CAAA;IACvF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAA;IACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAA;IACrC,IAAI,QAAQ;QAAE,KAAK,CAAC,GAAG,EAAE,CAAA;IACzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAC/E,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AAC7B,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,KAAa;IAC5D,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAC/B,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAClC,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACrE,OAAO,WAAW,KAAK,MAAM,IAAI,WAAW,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAA;IACvE,CAAC;IACD,OAAO,MAAM,KAAK,KAAK,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAyB;IAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;QACvB,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QAC3C,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAA;QACjD,8EAA8E;QAC9E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,IAAI,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAA;QACjE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAyB,EAAE,KAAwB;IAC9E,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAA;AAC/F,CAAC"}