agent-passport-system 4.1.0 → 4.2.0

package/dist/src/v2/authority-delegation/types.d.ts

@@ -0,0 +1,98 @@
+/** First complete APS authority-delegation wire profile. */
+export declare const AUTHORITY_DELEGATION_RECORD_TYPE: 'aps:authority-delegation:v1';
+export declare const AUTHORITY_DELEGATION_VERSION: '1.0';
+export declare const SCOPE_PROFILE_V1: 'aps-hierarchical-v1';
+export declare const REPUTATION_PROFILE_V1: 'aps-score-0-100-v1';
+export declare const VALUES_PROFILE_V1: 'aps-values-identifiers-v1';
+export declare const REVERSIBILITY_PROFILE_V1: 'aps-tci-v1';
+export interface ScopeFacetV1 {
+    profile: typeof SCOPE_PROFILE_V1;
+    grants: string[];
+}
+export type SpendFacetV1 = {
+    mode: 'unbounded';
+} | {
+    mode: 'bounded';
+    /** Opaque, exact-match accounting unit, for example iso4217:USD:minor. */
+    unit: string;
+    /** Canonical unsigned decimal integer. */
+    per_action: string;
+    /** Canonical unsigned decimal integer applying to the whole delegation subtree. */
+    cumulative: string;
+};
+export interface DepthFacetV1 {
+    /** Number of further delegation hops the subject may create. */
+    remaining: number;
+}
+export interface TimeFacetV1 {
+    not_before: string;
+    not_after: string;
+}
+export interface ReputationFacetV1 {
+    profile: typeof REPUTATION_PROFILE_V1;
+    ceiling: number;
+}
+export interface ValuesFacetV1 {
+    profile: typeof VALUES_PROFILE_V1;
+    required: string[];
+}
+export type ReversibilityClassV1 = 'tentative' | 'compensable' | 'irreversible';
+export interface ReversibilityFacetV1 {
+    profile: typeof REVERSIBILITY_PROFILE_V1;
+    ceiling: ReversibilityClassV1;
+}
+export interface AuthorityVectorV1 {
+    scope: ScopeFacetV1;
+    spend: SpendFacetV1;
+    depth: DepthFacetV1;
+    time: TimeFacetV1;
+    reputation: ReputationFacetV1;
+    values: ValuesFacetV1;
+    reversibility: ReversibilityFacetV1;
+}
+export interface AuthorityDelegationBodyV1 {
+    record_type: typeof AUTHORITY_DELEGATION_RECORD_TYPE;
+    version: typeof AUTHORITY_DELEGATION_VERSION;
+    /** Null only for a trust-policy-selected root. */
+    parent_delegation_id: string | null;
+    issuer: string;
+    subject: string;
+    verification_method: string;
+    issued_at: string;
+    /** 16 random bytes encoded as 32 lowercase hexadecimal characters. */
+    nonce: string;
+    authority: AuthorityVectorV1;
+}
+export interface AuthorityDelegationV1 extends AuthorityDelegationBodyV1 {
+    delegation_id: string;
+    /** Raw 64-byte Ed25519 signature encoded as 128 lowercase hexadecimal characters. */
+    signature: string;
+}
+export type AuthorityFailureCode = 'SCHEMA_INVALID' | 'UNSUPPORTED_VERSION' | 'UNSUPPORTED_PROFILE' | 'NONCANONICAL_VALUE' | 'ID_MISMATCH' | 'KEY_RESOLUTION_FAILED' | 'SIGNATURE_INVALID' | 'ROOT_UNTRUSTED' | 'CHAIN_DUPLICATE_ID' | 'PARENT_MISMATCH' | 'CHAIN_CONTINUITY' | 'ISSUED_AT_OUTSIDE_PARENT' | 'SCOPE_WIDENING' | 'SPEND_WIDENING' | 'SPEND_UNIT_CHANGE' | 'DEPTH_EXHAUSTED' | 'DEPTH_WIDENING' | 'TIME_WIDENING' | 'REPUTATION_WIDENING' | 'VALUES_WEAKENING' | 'REVERSIBILITY_WIDENING' | 'NOT_YET_VALID' | 'EXPIRED' | 'REVOKED' | 'REVOCATION_UNKNOWN';
+export interface AuthorityFailure {
+    code: AuthorityFailureCode;
+    message: string;
+    index?: number;
+    facet?: keyof AuthorityVectorV1;
+}
+export type AuthorityValidationState = 'valid' | 'invalid' | 'indeterminate' | 'unsupported';
+export interface AuthorityValidationResult {
+    state: AuthorityValidationState;
+    valid: boolean;
+    failures: AuthorityFailure[];
+}
+export type VerificationKeyResolver = (issuer: string, verificationMethod: string, issuedAt: string) => string | null;
+export type RevocationResolution = 'active' | 'revoked' | 'unknown';
+export interface AuthorityChainVerificationOptions {
+    now: string;
+    resolveVerificationKey: VerificationKeyResolver;
+    trustRoot: (root: AuthorityDelegationV1) => boolean;
+    resolveRevocation: (delegation: AuthorityDelegationV1) => RevocationResolution;
+}
+export type BudgetReservationState = 'reserved' | 'dispatched' | 'committed' | 'cancelled';
+export interface BudgetOperationResult {
+    ok: boolean;
+    code: 'RESERVED' | 'DISPATCHED' | 'COMMITTED' | 'CANCELLED' | 'IDEMPOTENT' | 'CONFLICT' | 'UNIT_MISMATCH' | 'PER_ACTION_EXCEEDED' | 'CUMULATIVE_EXCEEDED' | 'NOT_FOUND' | 'INVALID_STATE';
+    state?: BudgetReservationState;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/v2/authority-delegation/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/types.ts"],"names":[],"mappings":"AAGA,4DAA4D;AAC5D,eAAO,MAAM,gCAAgC,EAAG,6BAAsC,CAAA;AACtF,eAAO,MAAM,4BAA4B,EAAG,KAAc,CAAA;AAE1D,eAAO,MAAM,gBAAgB,EAAG,qBAA8B,CAAA;AAC9D,eAAO,MAAM,qBAAqB,EAAG,oBAA6B,CAAA;AAClE,eAAO,MAAM,iBAAiB,EAAG,2BAAoC,CAAA;AACrE,eAAO,MAAM,wBAAwB,EAAG,YAAqB,CAAA;AAE7D,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,gBAAgB,CAAA;IAChC,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IACE,IAAI,EAAE,SAAS,CAAA;IACf,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAA;IACZ,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,mFAAmF;IACnF,UAAU,EAAE,MAAM,CAAA;CACnB,CAAA;AAEL,MAAM,WAAW,YAAY;IAC3B,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,qBAAqB,CAAA;IACrC,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,iBAAiB,CAAA;IACjC,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG,aAAa,GAAG,cAAc,CAAA;AAE/E,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,wBAAwB,CAAA;IACxC,OAAO,EAAE,oBAAoB,CAAA;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,YAAY,CAAA;IACnB,KAAK,EAAE,YAAY,CAAA;IACnB,KAAK,EAAE,YAAY,CAAA;IACnB,IAAI,EAAE,WAAW,CAAA;IACjB,UAAU,EAAE,iBAAiB,CAAA;IAC7B,MAAM,EAAE,aAAa,CAAA;IACrB,aAAa,EAAE,oBAAoB,CAAA;CACpC;AAED,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,OAAO,gCAAgC,CAAA;IACpD,OAAO,EAAE,OAAO,4BAA4B,CAAA;IAC5C,kDAAkD;IAClD,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,mBAAmB,EAAE,MAAM,CAAA;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,iBAAiB,CAAA;CAC7B;AAED,MAAM,WAAW,qBAAsB,SAAQ,yBAAyB;IACtE,aAAa,EAAE,MAAM,CAAA;IACrB,qFAAqF;IACrF,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,oBAAoB,GAC5B,gBAAgB,GAChB,qBAAqB,GACrB,qBAAqB,GACrB,oBAAoB,GACpB,aAAa,GACb,uBAAuB,GACvB,mBAAmB,GACnB,gBAAgB,GAChB,oBAAoB,GACpB,iBAAiB,GACjB,kBAAkB,GAClB,0BAA0B,GAC1B,gBAAgB,GAChB,gBAAgB,GAChB,mBAAmB,GACnB,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,qBAAqB,GACrB,kBAAkB,GAClB,wBAAwB,GACxB,eAAe,GACf,SAAS,GACT,SAAS,GACT,oBAAoB,CAAA;AAExB,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,oBAAoB,CAAA;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,iBAAiB,CAAA;CAChC;AAED,MAAM,MAAM,wBAAwB,GAAG,OAAO,GAAG,SAAS,GAAG,eAAe,GAAG,aAAa,CAAA;AAE5F,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,wBAAwB,CAAA;IAC/B,KAAK,EAAE,OAAO,CAAA;IACd,QAAQ,EAAE,gBAAgB,EAAE,CAAA;CAC7B;AAED,MAAM,MAAM,uBAAuB,GAAG,CACpC,MAAM,EAAE,MAAM,EACd,kBAAkB,EAAE,MAAM,EAC1B,QAAQ,EAAE,MAAM,KACb,MAAM,GAAG,IAAI,CAAA;AAElB,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAA;AAEnE,MAAM,WAAW,iCAAiC;IAChD,GAAG,EAAE,MAAM,CAAA;IACX,sBAAsB,EAAE,uBAAuB,CAAA;IAC/C,SAAS,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,OAAO,CAAA;IACnD,iBAAiB,EAAE,CAAC,UAAU,EAAE,qBAAqB,KAAK,oBAAoB,CAAA;CAC/E;AAED,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,YAAY,GAAG,WAAW,GAAG,WAAW,CAAA;AAE1F,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAA;IACX,IAAI,EAAE,UAAU,GAAG,YAAY,GAAG,WAAW,GAAG,WAAW,GAAG,YAAY,GACxE,UAAU,GAAG,eAAe,GAAG,qBAAqB,GACpD,qBAAqB,GAAG,WAAW,GAAG,eAAe,CAAA;IACvD,KAAK,CAAC,EAAE,sBAAsB,CAAA;CAC/B"}

package/dist/src/v2/authority-delegation/types.js

@@ -0,0 +1,10 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+/** First complete APS authority-delegation wire profile. */
+export const AUTHORITY_DELEGATION_RECORD_TYPE = 'aps:authority-delegation:v1';
+export const AUTHORITY_DELEGATION_VERSION = '1.0';
+export const SCOPE_PROFILE_V1 = 'aps-hierarchical-v1';
+export const REPUTATION_PROFILE_V1 = 'aps-score-0-100-v1';
+export const VALUES_PROFILE_V1 = 'aps-values-identifiers-v1';
+export const REVERSIBILITY_PROFILE_V1 = 'aps-tci-v1';
+//# sourceMappingURL=types.js.map

package/dist/src/v2/authority-delegation/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/types.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,4DAA4D;AAC5D,MAAM,CAAC,MAAM,gCAAgC,GAAG,6BAAsC,CAAA;AACtF,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAc,CAAA;AAE1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAA8B,CAAA;AAC9D,MAAM,CAAC,MAAM,qBAAqB,GAAG,oBAA6B,CAAA;AAClE,MAAM,CAAC,MAAM,iBAAiB,GAAG,2BAAoC,CAAA;AACrE,MAAM,CAAC,MAAM,wBAAwB,GAAG,YAAqB,CAAA"}

package/dist/src/v2/authority-delegation/verify.d.ts

@@ -0,0 +1,5 @@
+import type { AuthorityChainVerificationOptions, AuthorityValidationResult } from './types.js';
+/** Full root-to-leaf structural, cryptographic, temporal, and revocation validation. */
+export declare function verifyAuthorityDelegationChain(rawChain: readonly unknown[], options: AuthorityChainVerificationOptions): AuthorityValidationResult;
+export declare function verifyAuthorityDelegation(delegation: unknown, options: AuthorityChainVerificationOptions): AuthorityValidationResult;
+//# sourceMappingURL=verify.d.ts.map

package/dist/src/v2/authority-delegation/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/verify.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,iCAAiC,EAGjC,yBAAyB,EAE1B,MAAM,YAAY,CAAA;AAUnB,wFAAwF;AACxF,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,SAAS,OAAO,EAAE,EAC5B,OAAO,EAAE,iCAAiC,GACzC,yBAAyB,CA8G3B;AAED,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,OAAO,EACnB,OAAO,EAAE,iCAAiC,GACzC,yBAAyB,CAE3B"}

package/dist/src/v2/authority-delegation/verify.js

@@ -0,0 +1,124 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { authorityDelegationBody, computeAuthorityDelegationId, verifyAuthorityDelegationSignature, } from './canonical.js';
+import { compareAuthority } from './compare.js';
+import { isCanonicalTimestamp, validateAuthorityDelegationShape } from './schema.js';
+function result(state, failures) {
+    return { state, valid: state === 'valid', failures };
+}
+function indexed(failure, index) {
+    return { ...failure, index };
+}
+/** Full root-to-leaf structural, cryptographic, temporal, and revocation validation. */
+export function verifyAuthorityDelegationChain(rawChain, options) {
+    if (!Array.isArray(rawChain) || rawChain.length === 0 || rawChain.length > 256) {
+        return result('invalid', [{ code: 'SCHEMA_INVALID', message: 'chain must contain 1 through 256 records' }]);
+    }
+    if (!options || !isCanonicalTimestamp(options.now)) {
+        return result('invalid', [{ code: 'NONCANONICAL_VALUE', message: 'verification clock must be canonical UTC milliseconds' }]);
+    }
+    const now = Date.parse(options.now);
+    const chain = [];
+    for (let i = 0; i < rawChain.length; i++) {
+        const failures = validateAuthorityDelegationShape(rawChain[i]).map(item => indexed(item, i));
+        if (failures.length > 0) {
+            const unsupported = failures.every(item => item.code === 'UNSUPPORTED_VERSION' || item.code === 'UNSUPPORTED_PROFILE');
+            return result(unsupported ? 'unsupported' : 'invalid', failures);
+        }
+        chain.push(rawChain[i]);
+    }
+    const seen = new Set();
+    for (let i = 0; i < chain.length; i++) {
+        const delegation = chain[i];
+        if (seen.has(delegation.delegation_id)) {
+            return result('invalid', [{ code: 'CHAIN_DUPLICATE_ID', index: i, message: 'delegation ID repeats in chain' }]);
+        }
+        seen.add(delegation.delegation_id);
+        const expectedId = computeAuthorityDelegationId(authorityDelegationBody(delegation));
+        if (expectedId !== delegation.delegation_id) {
+            return result('invalid', [{ code: 'ID_MISMATCH', index: i, message: 'delegation content address does not match body' }]);
+        }
+        let publicKey = null;
+        try {
+            publicKey = options.resolveVerificationKey(delegation.issuer, delegation.verification_method, delegation.issued_at);
+        }
+        catch {
+            publicKey = null;
+        }
+        if (publicKey === null) {
+            return result('indeterminate', [{ code: 'KEY_RESOLUTION_FAILED', index: i, message: 'issuer verification key could not be resolved' }]);
+        }
+        if (!verifyAuthorityDelegationSignature(delegation, publicKey)) {
+            return result('invalid', [{ code: 'SIGNATURE_INVALID', index: i, message: 'Ed25519 signature is invalid' }]);
+        }
+    }
+    const root = chain[0];
+    if (root.parent_delegation_id !== null) {
+        return result('invalid', [{ code: 'PARENT_MISMATCH', index: 0, message: 'full chain root must carry null parent_delegation_id' }]);
+    }
+    if (typeof options.trustRoot !== 'function') {
+        return result('indeterminate', [{ code: 'ROOT_UNTRUSTED', index: 0, message: 'root trust policy is unavailable' }]);
+    }
+    let trustDecision;
+    try {
+        trustDecision = options.trustRoot(root);
+    }
+    catch {
+        return result('indeterminate', [{ code: 'ROOT_UNTRUSTED', index: 0, message: 'root trust policy could not decide' }]);
+    }
+    if (typeof trustDecision !== 'boolean') {
+        return result('indeterminate', [{ code: 'ROOT_UNTRUSTED', index: 0, message: 'root trust policy returned no boolean decision' }]);
+    }
+    if (!trustDecision) {
+        return result('invalid', [{ code: 'ROOT_UNTRUSTED', index: 0, message: 'root is not accepted by verifier trust policy' }]);
+    }
+    for (let i = 1; i < chain.length; i++) {
+        const parent = chain[i - 1];
+        const child = chain[i];
+        if (child.parent_delegation_id !== parent.delegation_id) {
+            return result('invalid', [{ code: 'PARENT_MISMATCH', index: i, message: 'child does not name immediate parent content address' }]);
+        }
+        if (child.issuer !== parent.subject) {
+            return result('invalid', [{ code: 'CHAIN_CONTINUITY', index: i, message: 'child issuer is not parent subject' }]);
+        }
+        const issued = Date.parse(child.issued_at);
+        if (issued < Date.parse(parent.authority.time.not_before) ||
+            issued >= Date.parse(parent.authority.time.not_after)) {
+            return result('invalid', [{ code: 'ISSUED_AT_OUTSIDE_PARENT', index: i, message: 'child was issued outside parent validity window' }]);
+        }
+        const attenuationFailures = compareAuthority(parent.authority, child.authority);
+        if (attenuationFailures.length > 0) {
+            const indexedFailures = attenuationFailures.map(item => indexed(item, i));
+            const unsupported = indexedFailures.every(item => item.code === 'UNSUPPORTED_PROFILE');
+            return result(unsupported ? 'unsupported' : 'invalid', indexedFailures);
+        }
+    }
+    for (let i = 0; i < chain.length; i++) {
+        const delegation = chain[i];
+        if (now < Date.parse(delegation.authority.time.not_before)) {
+            return result('invalid', [{ code: 'NOT_YET_VALID', index: i, message: 'delegation is not yet valid' }]);
+        }
+        if (now >= Date.parse(delegation.authority.time.not_after)) {
+            return result('invalid', [{ code: 'EXPIRED', index: i, message: 'delegation has expired' }]);
+        }
+        let revocation = 'unknown';
+        try {
+            const resolved = options.resolveRevocation(delegation);
+            revocation = resolved === 'active' || resolved === 'revoked' ? resolved : 'unknown';
+        }
+        catch {
+            revocation = 'unknown';
+        }
+        if (revocation === 'revoked') {
+            return result('invalid', [{ code: 'REVOKED', index: i, message: 'delegation is revoked' }]);
+        }
+        if (revocation === 'unknown') {
+            return result('indeterminate', [{ code: 'REVOCATION_UNKNOWN', index: i, message: 'revocation status is unknown' }]);
+        }
+    }
+    return result('valid', []);
+}
+export function verifyAuthorityDelegation(delegation, options) {
+    return verifyAuthorityDelegationChain([delegation], options);
+}
+//# sourceMappingURL=verify.js.map

package/dist/src/v2/authority-delegation/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../../src/v2/authority-delegation/verify.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,kCAAkC,GACnC,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,EAAE,oBAAoB,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAA;AASpF,SAAS,MAAM,CAAC,KAA+B,EAAE,QAA4B;IAC3E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,EAAE,QAAQ,EAAE,CAAA;AACtD,CAAC;AAED,SAAS,OAAO,CAAC,OAAyB,EAAE,KAAa;IACvD,OAAO,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAA;AAC9B,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,8BAA8B,CAC5C,QAA4B,EAC5B,OAA0C;IAE1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC/E,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC,CAAC,CAAA;IAC7G,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,uDAAuD,EAAE,CAAC,CAAC,CAAA;IAC9H,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAEnC,MAAM,KAAK,GAA4B,EAAE,CAAA;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,gCAAgC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC5F,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,qBAAqB,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAA;YACtH,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;QAClE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAA0B,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACvC,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAC,CAAA;QACjH,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAAA;QAClC,MAAM,UAAU,GAAG,4BAA4B,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC,CAAA;QACpF,IAAI,UAAU,KAAK,UAAU,CAAC,aAAa,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC,CAAC,CAAA;QAC1H,CAAC;QACD,IAAI,SAAS,GAAkB,IAAI,CAAA;QACnC,IAAI,CAAC;YACH,SAAS,GAAG,OAAO,CAAC,sBAAsB,CACxC,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,mBAAmB,EAC9B,UAAU,CAAC,SAAS,CACrB,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,IAAI,CAAA;QAClB,CAAC;QACD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC,CAAC,CAAA;QACzI,CAAC;QACD,IAAI,CAAC,kCAAkC,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC;YAC/D,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC,CAAA;QAC9G,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACrB,IAAI,IAAI,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC,CAAC,CAAA;IACpI,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAC,CAAA;IACrH,CAAC;IACD,IAAI,aAAsB,CAAA;IAC1B,IAAI,CAAC;QAAC,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QACrD,OAAO,MAAM,CAAC,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC,CAAA;IACvH,CAAC;IACD,IAAI,OAAO,aAAa,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC,CAAC,CAAA;IACnI,CAAC;IACD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC,CAAC,CAAA;IAC5H,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACtB,IAAI,KAAK,CAAC,oBAAoB,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;YACxD,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC,CAAC,CAAA;QACpI,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC,CAAA;QACnH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAC1C,IAAI,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;YACrD,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1D,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC,CAAC,CAAA;QACxI,CAAC;QACD,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAA;QAC/E,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,eAAe,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YACzE,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAA;YACtF,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;QACzE,CAAC;IACH,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QAC3B,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3D,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAA;QACzG,CAAC;QACD,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAA;QAC9F,CAAC;QACD,IAAI,UAAU,GAAqC,SAAS,CAAA;QAC5D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;YACtD,UAAU,GAAG,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;QACrF,CAAC;QAAC,MAAM,CAAC;YAAC,UAAU,GAAG,SAAS,CAAA;QAAC,CAAC;QAClC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAA;QAC7F,CAAC;QACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC,CAAA;QACrH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;AAC5B,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,UAAmB,EACnB,OAA0C;IAE1C,OAAO,8BAA8B,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAA;AAC9D,CAAC"}

package/dist/src/v2/identity-binding/did-aps.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Legacy APS self-certifying identifier support. New PassportV2 issuance uses
+ * did:key by default; this parser exists so previously emitted did:aps values
+ * remain verifiable without implying that their identifier survives rotation.
+ */
+export declare function legacyDidApsFromPublicKey(publicKeyHex: string): string;
+export declare function publicKeyFromLegacyDidAps(did: string): string;
+export declare function publicKeyFromDidKey(did: string): string;
+export declare function didKeyFromPublicKey(publicKeyHex: string): string;
+export declare function selfCertifyingPublicKey(did: string): string | null;
+export declare function defaultVerificationMethod(agentId: string): string;
+//# sourceMappingURL=did-aps.d.ts.map

package/dist/src/v2/identity-binding/did-aps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"did-aps.d.ts","sourceRoot":"","sources":["../../../../src/v2/identity-binding/did-aps.ts"],"names":[],"mappings":"AAKA;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAGtE;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAU7D;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMvD;AAED,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAGhE;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIlE;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGjE"}

package/dist/src/v2/identity-binding/did-aps.js

@@ -0,0 +1,53 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { hexToMultibase, multibaseToHex } from '../../core/did.js';
+/**
+ * Legacy APS self-certifying identifier support. New PassportV2 issuance uses
+ * did:key by default; this parser exists so previously emitted did:aps values
+ * remain verifiable without implying that their identifier survives rotation.
+ */
+export function legacyDidApsFromPublicKey(publicKeyHex) {
+    assertEd25519PublicKey(publicKeyHex);
+    return `did:aps:${hexToMultibase(publicKeyHex)}`;
+}
+export function publicKeyFromLegacyDidAps(did) {
+    if (!/^did:aps:z[1-9A-HJ-NP-Za-km-z]+$/.test(did)) {
+        throw new Error('Invalid did:aps identifier');
+    }
+    const publicKey = multibaseToHex(did.slice('did:aps:'.length));
+    assertEd25519PublicKey(publicKey);
+    if (legacyDidApsFromPublicKey(publicKey) !== did) {
+        throw new Error('Non-canonical did:aps identifier');
+    }
+    return publicKey;
+}
+export function publicKeyFromDidKey(did) {
+    if (!/^did:key:z[1-9A-HJ-NP-Za-km-z]+$/.test(did))
+        throw new Error('Invalid did:key identifier');
+    const publicKey = multibaseToHex(did.slice('did:key:'.length));
+    assertEd25519PublicKey(publicKey);
+    if (didKeyFromPublicKey(publicKey) !== did)
+        throw new Error('Non-canonical did:key identifier');
+    return publicKey;
+}
+export function didKeyFromPublicKey(publicKeyHex) {
+    assertEd25519PublicKey(publicKeyHex);
+    return `did:key:${hexToMultibase(publicKeyHex)}`;
+}
+export function selfCertifyingPublicKey(did) {
+    if (did.startsWith('did:key:'))
+        return publicKeyFromDidKey(did);
+    if (did.startsWith('did:aps:'))
+        return publicKeyFromLegacyDidAps(did);
+    return null;
+}
+export function defaultVerificationMethod(agentId) {
+    if (agentId.startsWith('did:key:'))
+        return `${agentId}#${agentId.slice('did:key:'.length)}`;
+    return `${agentId}#key-1`;
+}
+function assertEd25519PublicKey(value) {
+    if (!/^[0-9a-f]{64}$/.test(value))
+        throw new Error('Invalid Ed25519 public key');
+}
+//# sourceMappingURL=did-aps.js.map

package/dist/src/v2/identity-binding/did-aps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"did-aps.js","sourceRoot":"","sources":["../../../../src/v2/identity-binding/did-aps.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAElE;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,YAAoB;IAC5D,sBAAsB,CAAC,YAAY,CAAC,CAAA;IACpC,OAAO,WAAW,cAAc,CAAC,YAAY,CAAC,EAAE,CAAA;AAClD,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;IAC9D,sBAAsB,CAAC,SAAS,CAAC,CAAA;IACjC,IAAI,yBAAyB,CAAC,SAAS,CAAC,KAAK,GAAG,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IACrD,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAChG,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;IAC9D,sBAAsB,CAAC,SAAS,CAAC,CAAA;IACjC,IAAI,mBAAmB,CAAC,SAAS,CAAC,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IAC/F,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,YAAoB;IACtD,sBAAsB,CAAC,YAAY,CAAC,CAAA;IACpC,OAAO,WAAW,cAAc,CAAC,YAAY,CAAC,EAAE,CAAA;AAClD,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAA;IAC/D,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,yBAAyB,CAAC,GAAG,CAAC,CAAA;IACrE,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,GAAG,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAA;IAC3F,OAAO,GAAG,OAAO,QAAQ,CAAA;AAC3B,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;AAClF,CAAC"}

package/dist/src/v2/identity-binding/index.d.ts

@@ -0,0 +1,6 @@
+export * from './types.js';
+export * from './did-aps.js';
+export * from './passport.js';
+export * from './principal-binding.js';
+export * from './revocation.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/v2/identity-binding/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/v2/identity-binding/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,iBAAiB,CAAA"}

package/dist/src/v2/identity-binding/index.js

@@ -0,0 +1,6 @@
+export * from './types.js';
+export * from './did-aps.js';
+export * from './passport.js';
+export * from './principal-binding.js';
+export * from './revocation.js';
+//# sourceMappingURL=index.js.map

package/dist/src/v2/identity-binding/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/v2/identity-binding/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,iBAAiB,CAAA"}

package/dist/src/v2/identity-binding/passport.d.ts

@@ -0,0 +1,18 @@
+import type { HistoricalKeyResolver, IdentityVerificationResult, PassportV2 } from './types.js';
+export interface IssuePassportV2Input {
+    public_key_hex: string;
+    private_key_hex: string;
+    agent_id?: string;
+    verification_method?: string;
+    issued_at: string;
+    expires_at: string;
+    nonce: string;
+    display_name?: string;
+    capabilities?: readonly string[];
+}
+export declare function issuePassportV2(input: IssuePassportV2Input): PassportV2;
+export declare function verifyPassportV2(candidate: unknown, options?: {
+    now?: string;
+    resolve_key?: HistoricalKeyResolver;
+}): Promise<IdentityVerificationResult>;
+//# sourceMappingURL=passport.d.ts.map

package/dist/src/v2/identity-binding/passport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passport.d.ts","sourceRoot":"","sources":["../../../../src/v2/identity-binding/passport.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACV,qBAAqB,EACrB,0BAA0B,EAC1B,UAAU,EACX,MAAM,YAAY,CAAA;AAcnB,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACjC;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,UAAU,CAsBvE;AAED,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,OAAO,EAClB,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,qBAAqB,CAAA;CAAO,GAClE,OAAO,CAAC,0BAA0B,CAAC,CAgErC"}

package/dist/src/v2/identity-binding/passport.js

@@ -0,0 +1,144 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { createHash } from 'node:crypto';
+import { canonicalizeJCS } from '../../core/canonical-jcs.js';
+import { sign, verify } from '../../crypto/keys.js';
+import { hexToMultibase, multibaseToHex } from '../../core/did.js';
+import { defaultVerificationMethod, didKeyFromPublicKey, selfCertifyingPublicKey, } from './did-aps.js';
+import { assertExactKeys, assertHex, assertIJson, assertPlainRecord, assertSortedUnique, assertUtcMilliseconds, sortedUnique, } from './validation.js';
+const ID_DOMAIN = 'APS-PASSPORT-ID-V2\0';
+const SIGNATURE_DOMAIN = 'APS-PASSPORT-SIG-V2\0';
+export function issuePassportV2(input) {
+    assertHex(input.public_key_hex, 64, 'public_key_hex');
+    const agentId = input.agent_id ?? didKeyFromPublicKey(input.public_key_hex);
+    const draft = {
+        record_type: 'aps.agent-passport',
+        version: '2.0',
+        agent_id: agentId,
+        verification_method: input.verification_method ?? defaultVerificationMethod(agentId),
+        public_key_multibase: hexToMultibase(input.public_key_hex),
+        issued_at: input.issued_at,
+        expires_at: input.expires_at,
+        nonce: input.nonce,
+        self_asserted: {
+            ...(input.display_name === undefined ? {} : { display_name: input.display_name }),
+            capabilities: sortedUnique(input.capabilities ?? [], 'self_asserted.capabilities'),
+        },
+    };
+    validatePassportDraft(draft);
+    const passportId = digest(ID_DOMAIN + canonicalizeJCS(draft));
+    const withId = { ...draft, passport_id: passportId };
+    const signature = sign(SIGNATURE_DOMAIN + canonicalizeJCS(withId), input.private_key_hex);
+    return { ...withId, signature };
+}
+export async function verifyPassportV2(candidate, options = {}) {
+    let passport;
+    try {
+        passport = validatePassport(candidate);
+    }
+    catch {
+        return invalid('PASSPORT_MALFORMED');
+    }
+    const idForm = omit(passport, ['passport_id', 'signature']);
+    if (digest(ID_DOMAIN + canonicalizeJCS(idForm)) !== passport.passport_id) {
+        return invalid('PASSPORT_ID_MISMATCH');
+    }
+    const publicKey = multibaseToHex(passport.public_key_multibase);
+    const signatureForm = omit(passport, ['signature']);
+    if (!verify(SIGNATURE_DOMAIN + canonicalizeJCS(signatureForm), passport.signature, publicKey)) {
+        return invalid('PASSPORT_SIGNATURE_INVALID');
+    }
+    const now = options.now ?? new Date().toISOString();
+    if (now < passport.issued_at || now >= passport.expires_at) {
+        return { ...invalid('PASSPORT_NOT_CURRENT'), proof_of_possession: true };
+    }
+    const derived = selfCertifyingPublicKey(passport.agent_id);
+    if (derived !== null) {
+        if (derived !== publicKey) {
+            return {
+                ...invalid('PASSPORT_KEY_AUTHORITY_REJECTED'),
+                proof_of_possession: true,
+                key_authority: 'rejected',
+            };
+        }
+        return { state: 'valid', code: 'OK', proof_of_possession: true, key_authority: 'verified' };
+    }
+    if (!options.resolve_key) {
+        return {
+            state: 'indeterminate',
+            code: 'PASSPORT_KEY_AUTHORITY_UNRESOLVED',
+            proof_of_possession: true,
+            key_authority: 'unresolved',
+        };
+    }
+    const resolution = await options.resolve_key({
+        controller: passport.agent_id,
+        verification_method: passport.verification_method,
+        at: passport.issued_at,
+    });
+    if (resolution.state !== 'resolved' || !resolution.public_key_hex) {
+        return {
+            state: resolution.state === 'unreachable' ? 'indeterminate' : 'invalid',
+            code: `PASSPORT_KEY_${resolution.state.toUpperCase()}`,
+            proof_of_possession: true,
+            key_authority: resolution.state === 'unreachable' ? 'unresolved' : 'rejected',
+        };
+    }
+    if (resolution.public_key_hex !== publicKey) {
+        return {
+            ...invalid('PASSPORT_KEY_AUTHORITY_REJECTED'),
+            proof_of_possession: true,
+            key_authority: 'rejected',
+        };
+    }
+    return { state: 'valid', code: 'OK', proof_of_possession: true, key_authority: 'verified' };
+}
+function validatePassport(value) {
+    assertPlainRecord(value, 'passport');
+    assertExactKeys(value, [
+        'record_type', 'version', 'passport_id', 'agent_id', 'verification_method',
+        'public_key_multibase', 'issued_at', 'expires_at', 'nonce', 'self_asserted', 'signature',
+    ], [], 'passport');
+    validatePassportDraft(value);
+    assertHex(String(value.passport_id), 64, 'passport_id');
+    assertHex(String(value.signature), 128, 'signature');
+    return value;
+}
+function validatePassportDraft(value) {
+    assertIJson(value);
+    if (value.record_type !== 'aps.agent-passport' || value.version !== '2.0')
+        throw new Error('passport profile');
+    if (!/^did:[a-z0-9]+:.+$/.test(value.agent_id))
+        throw new Error('agent_id');
+    if (!value.verification_method.startsWith(`${value.agent_id}#`))
+        throw new Error('verification_method');
+    const key = multibaseToHex(value.public_key_multibase);
+    assertHex(key, 64, 'public_key_multibase');
+    assertUtcMilliseconds(value.issued_at, 'issued_at');
+    assertUtcMilliseconds(value.expires_at, 'expires_at');
+    if (value.issued_at >= value.expires_at)
+        throw new Error('passport time window');
+    assertHex(value.nonce, 32, 'nonce');
+    assertPlainRecord(value.self_asserted, 'self_asserted');
+    assertExactKeys(value.self_asserted, ['capabilities'], ['display_name'], 'self_asserted');
+    if (!Array.isArray(value.self_asserted.capabilities))
+        throw new Error('capabilities');
+    assertSortedUnique(value.self_asserted.capabilities, 'capabilities');
+    if (value.self_asserted.display_name !== undefined && typeof value.self_asserted.display_name !== 'string') {
+        throw new Error('display_name');
+    }
+}
+function digest(value) {
+    return createHash('sha256').update(value, 'utf8').digest('hex');
+}
+function omit(value, keys) {
+    const result = {};
+    for (const [key, entry] of Object.entries(value))
+        if (!keys.includes(key))
+            result[key] = entry;
+    return result;
+}
+function invalid(code) {
+    return { state: 'invalid', code, proof_of_possession: false, key_authority: 'rejected' };
+}
+//# sourceMappingURL=passport.js.map

package/dist/src/v2/identity-binding/passport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passport.js","sourceRoot":"","sources":["../../../../src/v2/identity-binding/passport.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,cAAc,CAAA;AAMrB,OAAO,EACL,eAAe,EACf,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,YAAY,GACb,MAAM,iBAAiB,CAAA;AAExB,MAAM,SAAS,GAAG,sBAAsB,CAAA;AACxC,MAAM,gBAAgB,GAAG,uBAAuB,CAAA;AAchD,MAAM,UAAU,eAAe,CAAC,KAA2B;IACzD,SAAS,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,EAAE,gBAAgB,CAAC,CAAA;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,IAAI,mBAAmB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;IAC3E,MAAM,KAAK,GAAkD;QAC3D,WAAW,EAAE,oBAAoB;QACjC,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,OAAO;QACjB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,IAAI,yBAAyB,CAAC,OAAO,CAAC;QACpF,oBAAoB,EAAE,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC;QAC1D,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,aAAa,EAAE;YACb,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;YACjF,YAAY,EAAE,YAAY,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,EAAE,4BAA4B,CAAC;SACnF;KACF,CAAA;IACD,qBAAqB,CAAC,KAAK,CAAC,CAAA;IAC5B,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAA;IAC7D,MAAM,MAAM,GAAkC,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,CAAA;IACnF,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,CAAA;IACzF,OAAO,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,CAAA;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAkB,EAClB,OAAO,GAA0D,EAAE;IAEnE,IAAI,QAAoB,CAAA;IACxB,IAAI,CAAC;QACH,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAA;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAA;IACtC,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;IAC3D,IAAI,MAAM,CAAC,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzE,OAAO,OAAO,CAAC,sBAAsB,CAAC,CAAA;IACxC,CAAC;IACD,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAA;IAC/D,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;IACnD,IAAI,CAAC,MAAM,CAAC,gBAAgB,GAAG,eAAe,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QAC9F,OAAO,OAAO,CAAC,4BAA4B,CAAC,CAAA;IAC9C,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACnD,IAAI,GAAG,GAAG,QAAQ,CAAC,SAAS,IAAI,GAAG,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC3D,OAAO,EAAE,GAAG,OAAO,CAAC,sBAAsB,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAA;IAC1E,CAAC;IAED,MAAM,OAAO,GAAG,uBAAuB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC1D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO;gBACL,GAAG,OAAO,CAAC,iCAAiC,CAAC;gBAC7C,mBAAmB,EAAE,IAAI;gBACzB,aAAa,EAAE,UAAU;aAC1B,CAAA;QACH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,CAAA;IAC7F,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,OAAO;YACL,KAAK,EAAE,eAAe;YACtB,IAAI,EAAE,mCAAmC;YACzC,mBAAmB,EAAE,IAAI;YACzB,aAAa,EAAE,YAAY;SAC5B,CAAA;IACH,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC;QAC3C,UAAU,EAAE,QAAQ,CAAC,QAAQ;QAC7B,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;QACjD,EAAE,EAAE,QAAQ,CAAC,SAAS;KACvB,CAAC,CAAA;IACF,IAAI,UAAU,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;QAClE,OAAO;YACL,KAAK,EAAE,UAAU,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;YACvE,IAAI,EAAE,gBAAgB,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE;YACtD,mBAAmB,EAAE,IAAI;YACzB,aAAa,EAAE,UAAU,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU;SAC9E,CAAA;IACH,CAAC;IACD,IAAI,UAAU,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC5C,OAAO;YACL,GAAG,OAAO,CAAC,iCAAiC,CAAC;YAC7C,mBAAmB,EAAE,IAAI;YACzB,aAAa,EAAE,UAAU;SAC1B,CAAA;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,CAAA;AAC7F,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,iBAAiB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IACpC,eAAe,CAAC,KAAK,EAAE;QACrB,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,qBAAqB;QAC1E,sBAAsB,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW;KACzF,EAAE,EAAE,EAAE,UAAU,CAAC,CAAA;IAClB,qBAAqB,CAAC,KAAiE,CAAC,CAAA;IACxF,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,aAAa,CAAC,CAAA;IACvD,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;IACpD,OAAO,KAA8B,CAAA;AACvC,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAoD;IACjF,WAAW,CAAC,KAAK,CAAC,CAAA;IAClB,IAAI,KAAK,CAAC,WAAW,KAAK,oBAAoB,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;IAC9G,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAA;IAC3E,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,QAAQ,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;IACvG,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAA;IACtD,SAAS,CAAC,GAAG,EAAE,EAAE,EAAE,sBAAsB,CAAC,CAAA;IAC1C,qBAAqB,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IACnD,qBAAqB,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;IACrD,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;IAChF,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;IACnC,iBAAiB,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC,CAAA;IACvD,eAAe,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,eAAe,CAAC,CAAA;IACzF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAA;IACrF,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAAA;IACpE,IAAI,KAAK,CAAC,aAAa,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,aAAa,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC3G,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAA;IACjC,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjE,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,IAAuB;IAClD,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAC9F,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,CAAA;AAC1F,CAAC"}

package/dist/src/v2/identity-binding/principal-binding.d.ts

@@ -0,0 +1,20 @@
+import type { HistoricalKeyResolver, IdentityVerificationResult, PrincipalBindingV1 } from './types.js';
+export interface IssuePrincipalBindingV1Input {
+    agent_id: string;
+    principal_id: string;
+    verification_method: string;
+    audiences: readonly string[];
+    authority_profiles: readonly string[];
+    status_uri: string;
+    issued_at: string;
+    expires_at: string;
+    nonce: string;
+    principal_private_key_hex: string;
+}
+export declare function issuePrincipalBindingV1(input: IssuePrincipalBindingV1Input): PrincipalBindingV1;
+export declare function verifyPrincipalBindingV1(candidate: unknown, options: {
+    now?: string;
+    resolve_key: HistoricalKeyResolver;
+    principal_is_externally_verified?: (principalId: string, at: string) => boolean | Promise<boolean>;
+}): Promise<IdentityVerificationResult>;
+//# sourceMappingURL=principal-binding.d.ts.map

package/dist/src/v2/identity-binding/principal-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-binding.d.ts","sourceRoot":"","sources":["../../../../src/v2/identity-binding/principal-binding.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,qBAAqB,EACrB,0BAA0B,EAC1B,kBAAkB,EAEnB,MAAM,YAAY,CAAA;AAcnB,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IAC5B,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,yBAAyB,EAAE,MAAM,CAAA;CAClC;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,4BAA4B,GAAG,kBAAkB,CAqB/F;AAED,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE,OAAO,EAClB,OAAO,EAAE;IACP,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,qBAAqB,CAAA;IAClC,gCAAgC,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACnG,GACA,OAAO,CAAC,0BAA0B,CAAC,CAiDrC"}