agent-passport-system 7.0.0 → 7.2.0

package/dist/src/v2/activation/verify.js

@@ -0,0 +1,406 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+//
+// PROPOSED, OPT-IN. Deciding whether an activation condition is established at an instant.
+// See ./types.ts for the specification position and for the three parameters this module
+// refuses to default.
+import { parseRfc3339 } from '../../core/rfc3339.js';
+import { verify as verifyEd25519 } from '../../crypto/keys.js';
+import { mapAuthorityValidationToLifecycle } from '../lifecycle-state/map.js';
+import { lifecycleState } from '../lifecycle-state/state.js';
+import { activationAttestationSignatureInput } from './canonical.js';
+import { ACTIVATION_ATTESTATION_TYPE, ACTIVATION_CONDITION_TYPE, ACTIVATION_GAPS_BY_REASON, ACTIVATION_INSTANT_BASES, ActivationError, } from './types.js';
+/** How far through the checks a rejected attestation got. When no record was accepted, the
+ *  reported code is the reason of the record that got FURTHEST, so the verdict names the
+ *  closest thing to usable evidence that was presented. Ties break on `attestation_id`
+ *  ascending, which makes the answer independent of presentation order. */
+const REJECTION_RANK = Object.freeze({
+    ATTESTATION_RECORD_TYPE_NOT_ACCEPTED: 1,
+    ATTESTATION_SIGNATURE_UNVERIFIED: 2,
+    ATTESTATION_ATTESTOR_BINDING_MISMATCH: 3,
+    ATTESTATION_ATTESTOR_ROLE_UNKNOWN: 4,
+    ATTESTATION_ROLE_CLAIM_CONFLICT: 5,
+    ATTESTATION_ATTESTOR_ROLE_MISMATCH: 6,
+    ATTESTATION_CONDITION_MISMATCH: 7,
+    ATTESTATION_UNKNOWN_ASSERTION: 8,
+    ATTESTATION_INSTANT_MALFORMED: 9,
+    ATTESTATION_DOES_NOT_REACH_ACTION: 10,
+    // Verdict-level codes never rank: they are not rejections of a record.
+    ACTIVATION_ESTABLISHED: 0,
+    CONDITION_DATE_NOT_REACHED: 0,
+    CONDITION_ESTABLISHED_NOT_YET_OCCURRED: 0,
+    CONDITION_FIRST_OCCURRED_AFTER_ACTION: 0,
+    CONDITION_EVIDENCE_CONFLICT: 0,
+    ACTIVATION_THRESHOLD_NOT_MET: 0,
+    NO_ATTESTATION_PRESENTED: 0,
+    CONDITION_DELEGATION_MISMATCH: 0,
+});
+function assertInstant(value, label) {
+    const parsed = parseRfc3339(value);
+    if (!parsed.ok) {
+        throw new ActivationError('INSTANT_MALFORMED', `${label} is not an RFC 3339 instant with an offset (${parsed.reason})`);
+    }
+    return parsed.ms;
+}
+/** Shape rules, each with the reason it exists. A condition that breaks one is a programming
+ *  error at the caller, not a verdict about evidence, so this throws.
+ *
+ *  Exported so a caller can validate a condition it received before reaching a boundary. */
+export function validateActivationCondition(condition) {
+    if (condition === null || typeof condition !== 'object') {
+        throw new ActivationError('CONDITION_MALFORMED', 'condition is not an object');
+    }
+    if (condition.record_type !== ACTIVATION_CONDITION_TYPE) {
+        throw new ActivationError('CONDITION_RECORD_TYPE_UNKNOWN', `condition record_type must be ${ACTIVATION_CONDITION_TYPE}`);
+    }
+    for (const field of ['condition_id', 'delegation_id']) {
+        if (typeof condition[field] !== 'string' || condition[field].length === 0) {
+            throw new ActivationError('CONDITION_MALFORMED', `condition ${field} must be a non-empty string`);
+        }
+    }
+    if (condition.condition_type === 'date') {
+        assertInstant(condition.activation_date, 'condition activation_date');
+        return condition;
+    }
+    if (condition.condition_type === 'recorded_event') {
+        for (const field of ['event_type', 'event_id']) {
+            if (typeof condition[field] !== 'string' || condition[field].length === 0) {
+                throw new ActivationError('CONDITION_MALFORMED', `condition ${field} must be a non-empty string`);
+            }
+        }
+        const roles = condition.required_attestor_roles;
+        if (!Array.isArray(roles) || roles.length === 0) {
+            // A condition naming no accepted source has not stated what it accepts. Accepting
+            // anything would make the role check decorative, and refusing everything would be a
+            // fail-closed ruling the text does not state. Refuse the CONDITION instead.
+            throw new ActivationError('CONDITION_ROLES_REQUIRED', 'required_attestor_roles must name at least one role');
+        }
+        for (const role of roles) {
+            if (typeof role !== 'string' || role.length === 0) {
+                throw new ActivationError('CONDITION_ROLES_REQUIRED', 'required_attestor_roles must contain only non-empty strings');
+            }
+        }
+        if (!Number.isInteger(condition.threshold) || condition.threshold < 1) {
+            throw new ActivationError('CONDITION_THRESHOLD_INVALID', 'threshold must be an integer of at least 1, and this module declares no default');
+        }
+        if (!ACTIVATION_INSTANT_BASES.includes(condition.instant_basis)) {
+            throw new ActivationError('CONDITION_INSTANT_BASIS_REQUIRED', `instant_basis must be one of ${ACTIVATION_INSTANT_BASES.join(', ')}, and this module declares no default`);
+        }
+        return condition;
+    }
+    throw new ActivationError('CONDITION_TYPE_UNKNOWN', 'condition_type must be date or recorded_event');
+}
+function classify(attestation, condition, actionMs, input) {
+    const usesOwnPreimage = input.attestationPreimage === undefined;
+    const accepted = input.acceptedAttestationRecordTypes;
+    // 1. Record type. A record whose type the model has not declared it accepts for this
+    //    condition is not evidence, however well it verifies.
+    if (usesOwnPreimage) {
+        if (attestation.record_type !== ACTIVATION_ATTESTATION_TYPE) {
+            return { ok: false, reason: 'ATTESTATION_RECORD_TYPE_NOT_ACCEPTED' };
+        }
+    }
+    else if (!accepted.includes(attestation.record_type)) {
+        return { ok: false, reason: 'ATTESTATION_RECORD_TYPE_NOT_ACCEPTED' };
+    }
+    // 2. Signature, over the record's own bytes, under the key authorized at `attested_at`.
+    if (typeof attestation.attested_at !== 'string') {
+        return { ok: false, reason: 'ATTESTATION_INSTANT_MALFORMED' };
+    }
+    if (!parseRfc3339(attestation.attested_at).ok) {
+        return { ok: false, reason: 'ATTESTATION_INSTANT_MALFORMED' };
+    }
+    if (typeof attestation.verification_method !== 'string' ||
+        typeof attestation.signature !== 'string' ||
+        typeof attestation.attestor !== 'string') {
+        return { ok: false, reason: 'ATTESTATION_SIGNATURE_UNVERIFIED' };
+    }
+    const resolved = input.resolveVerificationKey(attestation.attestor, attestation.verification_method, attestation.attested_at);
+    // A resolver failure and a missing key are the same finding here: no accepted source
+    // produced a key, so the record is not usable evidence. The granular key-resolution
+    // outcomes belong to chain verification, which reports them on its own result.
+    if (typeof resolved !== 'string' || resolved.length === 0) {
+        return { ok: false, reason: 'ATTESTATION_SIGNATURE_UNVERIFIED' };
+    }
+    const preimage = usesOwnPreimage
+        ? activationAttestationSignatureInput(attestation)
+        : input.attestationPreimage(attestation);
+    let signatureOk = false;
+    try {
+        signatureOk = verifyEd25519(preimage, attestation.signature, resolved);
+    }
+    catch {
+        signatureOk = false;
+    }
+    if (!signatureOk)
+        return { ok: false, reason: 'ATTESTATION_SIGNATURE_UNVERIFIED' };
+    // 3. The verification method has to belong to the attestor the body names, or a valid
+    //    signature says nothing about who attested.
+    if (!attestation.verification_method.startsWith(`${attestation.attestor}#`)) {
+        return { ok: false, reason: 'ATTESTATION_ATTESTOR_BINDING_MISMATCH' };
+    }
+    // 4. The attestor's own role claim, checked AGAINST the resolver. Never believed.
+    if (typeof attestation.attestor_role === 'string' && attestation.attestor_role.length > 0) {
+        const claimed = input.resolveAttestorRole(attestation.attestor, attestation.attestor_role, attestation.attested_at);
+        if (claimed === 'unknown')
+            return { ok: false, reason: 'ATTESTATION_ATTESTOR_ROLE_UNKNOWN' };
+        if (claimed !== 'holds')
+            return { ok: false, reason: 'ATTESTATION_ROLE_CLAIM_CONFLICT' };
+    }
+    // 5. Does the attestor hold a role the condition requires? A source the model does not
+    //    accept for THIS condition is not evidence in either direction: it cannot establish the
+    //    condition and it cannot establish that the condition was unmet.
+    let holdsRequired = false;
+    let anyUnknown = false;
+    for (const role of condition.required_attestor_roles) {
+        const standing = input.resolveAttestorRole(attestation.attestor, role, attestation.attested_at);
+        if (standing === 'holds') {
+            holdsRequired = true;
+            break;
+        }
+        if (standing === 'unknown')
+            anyUnknown = true;
+    }
+    if (!holdsRequired) {
+        return {
+            ok: false,
+            reason: anyUnknown
+                ? 'ATTESTATION_ATTESTOR_ROLE_UNKNOWN'
+                : 'ATTESTATION_ATTESTOR_ROLE_MISMATCH',
+        };
+    }
+    // 6. Condition binding.
+    if (attestation.condition_id !== condition.condition_id ||
+        attestation.event_type !== condition.event_type ||
+        attestation.event_id !== condition.event_id) {
+        return { ok: false, reason: 'ATTESTATION_CONDITION_MISMATCH' };
+    }
+    // 7. What it establishes, measured on the instant the CONDITION declares governs.
+    if (attestation.assertion === 'condition_occurred') {
+        const raw = condition.instant_basis === 'attestation_written'
+            ? attestation.attested_at
+            : attestation.occurred_at;
+        if (typeof raw !== 'string')
+            return { ok: false, reason: 'ATTESTATION_UNKNOWN_ASSERTION' };
+        const parsed = parseRfc3339(raw);
+        if (!parsed.ok)
+            return { ok: false, reason: 'ATTESTATION_INSTANT_MALFORMED' };
+        return {
+            ok: true,
+            finding: parsed.ms <= actionMs ? 'occurred_by_action' : 'occurred_after_action',
+        };
+    }
+    if (attestation.assertion === 'condition_not_occurred_through') {
+        const raw = attestation.not_occurred_through;
+        if (typeof raw !== 'string')
+            return { ok: false, reason: 'ATTESTATION_UNKNOWN_ASSERTION' };
+        const parsed = parseRfc3339(raw);
+        if (!parsed.ok)
+            return { ok: false, reason: 'ATTESTATION_INSTANT_MALFORMED' };
+        // A negative that stops short of the action instant says nothing about the interval
+        // between where it stops and the action. That is the coverage limb, not a source problem.
+        if (parsed.ms < actionMs)
+            return { ok: false, reason: 'ATTESTATION_DOES_NOT_REACH_ACTION' };
+        return { ok: true, finding: 'not_occurred_through_action' };
+    }
+    return { ok: false, reason: 'ATTESTATION_UNKNOWN_ASSERTION' };
+}
+function notEstablishedFor(code) {
+    return lifecycleState({
+        verdict: 'not_established',
+        reason_code: code,
+        missing: ACTIVATION_GAPS_BY_REASON[code] ?? ['source'],
+    });
+}
+/**
+ * Decide whether an activation condition is established for one action at one instant.
+ *
+ * Three verdicts are reachable and `invalid` is not one of them:
+ *
+ * | situation                                                    | verdict             |
+ * |--------------------------------------------------------------|---------------------|
+ * | condition established at or before the action instant         | `valid`             |
+ * | established as not met at that instant, or first met after it | `not_yet_effective` |
+ * | the verifier cannot tell                                      | `not_established`   |
+ *
+ * NOT ESTABLISHED IS NOT THE NEGATION OF THE CLAIM. It says the verifier could not reach a
+ * conclusion and names which establishment limb was missing. `not_yet_effective` says the
+ * verifier DID reach a conclusion and it was negative; its remedy is to wait, where
+ * `not_established`'s remedy is a better source. Collapsing the two throws away a decidable
+ * answer the verifier already had.
+ *
+ * NO RETROACTIVE ACTIVATION, KEYED ON THE CONDITION'S OWN INSTANT. A record putting the
+ * condition's first occurrence after the action instant leaves that action
+ * `not_yet_effective`, and the SAME record establishes the condition for any later action.
+ * What the rule keys on is the condition's instant, not the instant someone wrote the record:
+ * learning on Thursday that a condition was met on Monday is the normal case for any model
+ * built around an after-the-fact determination, and under
+ * `instant_basis: 'condition_occurrence'` such a record establishes the condition. A model
+ * that reads it the other way says so with `instant_basis: 'attestation_written'`.
+ *
+ * ORDER OF RESOLUTION, and why contradiction sits above acceptance:
+ *
+ *   1. two accepted records that disagree      `not_established`, `CONDITION_EVIDENCE_CONFLICT`
+ *   2. `threshold` records say occurred by it  `valid`
+ *   3. `threshold` records say not occurred    `not_yet_effective`
+ *   4. `threshold` records say occurred after  `not_yet_effective`
+ *   5. some accepted, fewer than `threshold`   `not_established`, `ACTIVATION_THRESHOLD_NOT_MET`
+ *   6. none accepted                           `not_established`, furthest rejection reason
+ *
+ * Contradiction is evaluated on PRESENCE, not on counts. Two acceptable records that disagree
+ * leave the verifier unable to tell which holds, and neither is discarded in favour of the
+ * other: preferring the later record, or the negative one, or a majority, would each be a
+ * precedence rule the concept text does not state.
+ *
+ * This function reads no clock and makes no network call. `actionInstant` is a parameter.
+ *
+ * Proposed. Concept source: aeoess/agent-authority-lifecycle, invariant candidates CAND-04
+ * and CAND-13 (activation half) and BROAD-L7. Not required by draft-pidlisnyi-aps-03.
+ */
+export function verifyActivation(input) {
+    if (input === null || typeof input !== 'object') {
+        throw new ActivationError('INPUT_MALFORMED', 'input is not an object');
+    }
+    if (typeof input.resolveAttestorRole !== 'function') {
+        throw new ActivationError('ROLE_RESOLVER_REQUIRED', 'resolveAttestorRole is required: role standing is resolved outside the record, always');
+    }
+    if (typeof input.resolveVerificationKey !== 'function') {
+        throw new ActivationError('KEY_RESOLVER_REQUIRED', 'resolveVerificationKey is required');
+    }
+    if (input.attestationPreimage !== undefined) {
+        const accepted = input.acceptedAttestationRecordTypes;
+        if (!Array.isArray(accepted) || accepted.length === 0) {
+            throw new ActivationError('ACCEPTED_RECORD_TYPES_REQUIRED', 'acceptedAttestationRecordTypes must name at least one type when attestationPreimage is supplied');
+        }
+    }
+    if (typeof input.delegationId !== 'string' || input.delegationId.length === 0) {
+        throw new ActivationError('DELEGATION_ID_REQUIRED', 'delegationId must be a non-empty string');
+    }
+    const condition = validateActivationCondition(input.condition);
+    const actionMs = assertInstant(input.actionInstant, 'actionInstant');
+    const presented = input.attestations ?? [];
+    if (condition.delegation_id !== input.delegationId) {
+        return Object.freeze({
+            state: notEstablishedFor('CONDITION_DELEGATION_MISMATCH'),
+            condition_id: condition.condition_id,
+            condition_type: condition.condition_type,
+            findings: Object.freeze([]),
+            rejections: Object.freeze([]),
+        });
+    }
+    // A date condition needs no evidence at all. The verifier reads the date off the condition
+    // and compares it with the action instant, so an unreached date is a KNOWN negative and
+    // never an unknown one. Presented attestations are not consulted.
+    if (condition.condition_type === 'date') {
+        const reached = assertInstant(condition.activation_date, 'condition activation_date') <= actionMs;
+        return Object.freeze({
+            state: reached
+                ? lifecycleState({ verdict: 'valid', reason_code: 'ACTIVATION_ESTABLISHED' })
+                : lifecycleState({
+                    verdict: 'not_yet_effective',
+                    reason_code: 'CONDITION_DATE_NOT_REACHED',
+                }),
+            condition_id: condition.condition_id,
+            condition_type: condition.condition_type,
+            findings: Object.freeze([]),
+            rejections: Object.freeze([]),
+        });
+    }
+    const findings = [];
+    const rejections = [];
+    const counts = {
+        occurred_by_action: 0,
+        occurred_after_action: 0,
+        not_occurred_through_action: 0,
+    };
+    for (const attestation of presented) {
+        if (attestation === null || typeof attestation !== 'object') {
+            throw new ActivationError('ATTESTATION_MALFORMED', 'an attestation is not an object');
+        }
+        const id = typeof attestation.attestation_id === 'string' ? attestation.attestation_id : '';
+        const attestor = typeof attestation.attestor === 'string' ? attestation.attestor : '';
+        const outcome = classify(attestation, condition, actionMs, input);
+        if (outcome.ok) {
+            counts[outcome.finding] += 1;
+            findings.push(Object.freeze({ attestation_id: id, attestor, finding: outcome.finding }));
+        }
+        else {
+            rejections.push(Object.freeze({ attestation_id: id, attestor, reason_code: outcome.reason }));
+        }
+    }
+    const frozen = {
+        condition_id: condition.condition_id,
+        condition_type: condition.condition_type,
+        findings: Object.freeze([...findings]),
+        rejections: Object.freeze([...rejections]),
+    };
+    if (counts.occurred_by_action > 0 && counts.not_occurred_through_action > 0) {
+        return Object.freeze({ ...frozen, state: notEstablishedFor('CONDITION_EVIDENCE_CONFLICT') });
+    }
+    if (counts.occurred_by_action >= condition.threshold) {
+        return Object.freeze({
+            ...frozen,
+            state: lifecycleState({ verdict: 'valid', reason_code: 'ACTIVATION_ESTABLISHED' }),
+        });
+    }
+    if (counts.not_occurred_through_action >= condition.threshold) {
+        return Object.freeze({
+            ...frozen,
+            state: lifecycleState({
+                verdict: 'not_yet_effective',
+                reason_code: 'CONDITION_ESTABLISHED_NOT_YET_OCCURRED',
+            }),
+        });
+    }
+    if (counts.occurred_after_action >= condition.threshold) {
+        return Object.freeze({
+            ...frozen,
+            state: lifecycleState({
+                verdict: 'not_yet_effective',
+                reason_code: 'CONDITION_FIRST_OCCURRED_AFTER_ACTION',
+            }),
+        });
+    }
+    if (findings.length > 0) {
+        return Object.freeze({ ...frozen, state: notEstablishedFor('ACTIVATION_THRESHOLD_NOT_MET') });
+    }
+    if (rejections.length === 0) {
+        return Object.freeze({ ...frozen, state: notEstablishedFor('NO_ATTESTATION_PRESENTED') });
+    }
+    const furthest = [...rejections].sort((a, b) => {
+        const rank = REJECTION_RANK[b.reason_code] - REJECTION_RANK[a.reason_code];
+        return rank !== 0 ? rank : a.attestation_id.localeCompare(b.attestation_id);
+    })[0];
+    return Object.freeze({ ...frozen, state: notEstablishedFor(furthest.reason_code) });
+}
+/**
+ * Report an activation result ALONGSIDE a chain result, never merged into it.
+ *
+ * Two stages, in order, and the order is the point:
+ *
+ *   1. Chain verification decides whether the grant is valid at the action instant. Its
+ *      four-value result is returned untouched in `chain`.
+ *   2. Activation is asked ONLY when the chain is valid. A grant that does not verify is not a
+ *      grant that is waiting on a condition, and reporting `not_yet_effective` for a revoked
+ *      or unparented grant would say the remedy is to wait when it is not.
+ *
+ * This is also where CAND-13's activation half lands. A pre-committed replacement grant is an
+ * ordinary grant with an ordinary condition, so it needs no separate machinery here, and the
+ * ordering is what keeps L1 intact: if the pre-committing instrument is revoked, the
+ * replacement's chain is invalid and no activation evidence can make it exercisable. Nothing
+ * in this module can turn an invalid chain into a `valid` lifecycle verdict.
+ *
+ * `activation` may be `null`, which is how a caller says no activation module ran. The
+ * composite then carries only the chain's own reading.
+ *
+ * Proposed. Concept source: aeoess/agent-authority-lifecycle, invariant L1 and invariant
+ * candidates CAND-04 and CAND-13.
+ */
+export function composeActivation(chain, activation, options = {}) {
+    const mapped = mapAuthorityValidationToLifecycle(chain, options.mapping ?? {});
+    if (chain.state !== 'valid' || activation === null) {
+        return Object.freeze({ chain, lifecycle: mapped });
+    }
+    return Object.freeze({ chain, lifecycle: activation.state });
+}
+//# sourceMappingURL=verify.js.map

package/dist/src/v2/activation/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../../src/v2/activation/verify.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,EAAE;AACF,2FAA2F;AAC3F,yFAAyF;AACzF,sBAAsB;AAEtB,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAM9D,OAAO,EAAE,iCAAiC,EAAE,MAAM,2BAA2B,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAK5D,OAAO,EAAE,mCAAmC,EAAE,MAAM,gBAAgB,CAAA;AACpE,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,EACxB,eAAe,GAUhB,MAAM,YAAY,CAAA;AAEnB;;;2EAG2E;AAC3E,MAAM,cAAc,GAAmD,MAAM,CAAC,MAAM,CAAC;IACnF,oCAAoC,EAAE,CAAC;IACvC,gCAAgC,EAAE,CAAC;IACnC,qCAAqC,EAAE,CAAC;IACxC,iCAAiC,EAAE,CAAC;IACpC,+BAA+B,EAAE,CAAC;IAClC,kCAAkC,EAAE,CAAC;IACrC,8BAA8B,EAAE,CAAC;IACjC,6BAA6B,EAAE,CAAC;IAChC,6BAA6B,EAAE,CAAC;IAChC,iCAAiC,EAAE,EAAE;IACrC,uEAAuE;IACvE,sBAAsB,EAAE,CAAC;IACzB,0BAA0B,EAAE,CAAC;IAC7B,sCAAsC,EAAE,CAAC;IACzC,qCAAqC,EAAE,CAAC;IACxC,2BAA2B,EAAE,CAAC;IAC9B,4BAA4B,EAAE,CAAC;IAC/B,wBAAwB,EAAE,CAAC;IAC3B,6BAA6B,EAAE,CAAC;CACjC,CAAC,CAAA;AAyCF,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa;IACjD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;IAClC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CACvB,mBAAmB,EACnB,GAAG,KAAK,+CAA+C,MAAM,CAAC,MAAM,GAAG,CACxE,CAAA;IACH,CAAC;IACD,OAAO,MAAM,CAAC,EAAE,CAAA;AAClB,CAAC;AAED;;;4FAG4F;AAC5F,MAAM,UAAU,2BAA2B,CACzC,SAAgC;IAEhC,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QACxD,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,4BAA4B,CAAC,CAAA;IAChF,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,KAAK,yBAAyB,EAAE,CAAC;QACxD,MAAM,IAAI,eAAe,CACvB,+BAA+B,EAC/B,iCAAiC,yBAAyB,EAAE,CAC7D,CAAA;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,eAAe,CAAU,EAAE,CAAC;QAC/D,IAAI,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,eAAe,CACvB,qBAAqB,EACrB,aAAa,KAAK,6BAA6B,CAChD,CAAA;QACH,CAAC;IACH,CAAC;IAED,IAAI,SAAS,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC;QACxC,aAAa,CAAC,SAAS,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAA;QACrE,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAI,SAAS,CAAC,cAAc,KAAK,gBAAgB,EAAE,CAAC;QAClD,KAAK,MAAM,KAAK,IAAI,CAAC,YAAY,EAAE,UAAU,CAAU,EAAE,CAAC;YACxD,IAAI,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1E,MAAM,IAAI,eAAe,CACvB,qBAAqB,EACrB,aAAa,KAAK,6BAA6B,CAChD,CAAA;YACH,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,CAAC,uBAAuB,CAAA;QAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,kFAAkF;YAClF,oFAAoF;YACpF,4EAA4E;YAC5E,MAAM,IAAI,eAAe,CACvB,0BAA0B,EAC1B,qDAAqD,CACtD,CAAA;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClD,MAAM,IAAI,eAAe,CACvB,0BAA0B,EAC1B,6DAA6D,CAC9D,CAAA;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,eAAe,CACvB,6BAA6B,EAC7B,iFAAiF,CAClF,CAAA;QACH,CAAC;QACD,IAAI,CAAE,wBAA8C,CAAC,QAAQ,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,eAAe,CACvB,kCAAkC,EAClC,gCAAgC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,uCAAuC,CAC3G,CAAA;QACH,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,IAAI,eAAe,CACvB,wBAAwB,EACxB,+CAA+C,CAChD,CAAA;AACH,CAAC;AAMD,SAAS,QAAQ,CACf,WAAoC,EACpC,SAA6C,EAC7C,QAAgB,EAChB,KAAkC;IAElC,MAAM,eAAe,GAAG,KAAK,CAAC,mBAAmB,KAAK,SAAS,CAAA;IAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,8BAA8B,CAAA;IAErD,qFAAqF;IACrF,0DAA0D;IAC1D,IAAI,eAAe,EAAE,CAAC;QACpB,IAAI,WAAW,CAAC,WAAW,KAAK,2BAA2B,EAAE,CAAC;YAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAA;QACtE,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,QAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAA;IACtE,CAAC;IAED,wFAAwF;IACxF,IAAI,OAAO,WAAW,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAA;IAC/D,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAA;IAC/D,CAAC;IACD,IACE,OAAO,WAAW,CAAC,mBAAmB,KAAK,QAAQ;QACnD,OAAO,WAAW,CAAC,SAAS,KAAK,QAAQ;QACzC,OAAO,WAAW,CAAC,QAAQ,KAAK,QAAQ,EACxC,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAA;IAClE,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,sBAAsB,CAC3C,WAAW,CAAC,QAAQ,EACpB,WAAW,CAAC,mBAAmB,EAC/B,WAAW,CAAC,WAAW,CACxB,CAAA;IACD,qFAAqF;IACrF,oFAAoF;IACpF,+EAA+E;IAC/E,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAA;IAClE,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe;QAC9B,CAAC,CAAC,mCAAmC,CAAC,WAAW,CAAC;QAClD,CAAC,CAAC,KAAK,CAAC,mBAAoB,CAAC,WAAW,CAAC,CAAA;IAC3C,IAAI,WAAW,GAAG,KAAK,CAAA;IACvB,IAAI,CAAC;QACH,WAAW,GAAG,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,GAAG,KAAK,CAAA;IACrB,CAAC;IACD,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAA;IAElF,sFAAsF;IACtF,gDAAgD;IAChD,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QAC5E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAA;IACvE,CAAC;IAED,kFAAkF;IAClF,IAAI,OAAO,WAAW,CAAC,aAAa,KAAK,QAAQ,IAAI,WAAW,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1F,MAAM,OAAO,GAAG,KAAK,CAAC,mBAAmB,CACvC,WAAW,CAAC,QAAQ,EACpB,WAAW,CAAC,aAAa,EACzB,WAAW,CAAC,WAAW,CACxB,CAAA;QACD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAA;QAC5F,IAAI,OAAO,KAAK,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAA;IAC1F,CAAC;IAED,uFAAuF;IACvF,4FAA4F;IAC5F,qEAAqE;IACrE,IAAI,aAAa,GAAG,KAAK,CAAA;IACzB,IAAI,UAAU,GAAG,KAAK,CAAA;IACtB,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,uBAAuB,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,mBAAmB,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,WAAW,CAAC,CAAA;QAC/F,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,aAAa,GAAG,IAAI,CAAA;YACpB,MAAK;QACP,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS;YAAE,UAAU,GAAG,IAAI,CAAA;IAC/C,CAAC;IACD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,UAAU;gBAChB,CAAC,CAAC,mCAAmC;gBACrC,CAAC,CAAC,oCAAoC;SACzC,CAAA;IACH,CAAC;IAED,wBAAwB;IACxB,IACE,WAAW,CAAC,YAAY,KAAK,SAAS,CAAC,YAAY;QACnD,WAAW,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU;QAC/C,WAAW,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,EAC3C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAA;IAChE,CAAC;IAED,kFAAkF;IAClF,IAAI,WAAW,CAAC,SAAS,KAAK,oBAAoB,EAAE,CAAC;QACnD,MAAM,GAAG,GACP,SAAS,CAAC,aAAa,KAAK,qBAAqB;YAC/C,CAAC,CAAC,WAAW,CAAC,WAAW;YACzB,CAAC,CAAC,WAAW,CAAC,WAAW,CAAA;QAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAA;QAC1F,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAA;QAC7E,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,uBAAuB;SAChF,CAAA;IACH,CAAC;IAED,IAAI,WAAW,CAAC,SAAS,KAAK,gCAAgC,EAAE,CAAC;QAC/D,MAAM,GAAG,GAAG,WAAW,CAAC,oBAAoB,CAAA;QAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAA;QAC1F,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAA;QAC7E,oFAAoF;QACpF,0FAA0F;QAC1F,IAAI,MAAM,CAAC,EAAE,GAAG,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAA;QAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAA;IAC7D,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAA;AAC/D,CAAC;AAED,SAAS,iBAAiB,CAAC,IAA0B;IACnD,OAAO,cAAc,CAAC;QACpB,OAAO,EAAE,iBAAiB;QAC1B,WAAW,EAAE,IAAI;QACjB,OAAO,EAAE,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;KACvD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAkC;IACjE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,eAAe,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,mBAAmB,KAAK,UAAU,EAAE,CAAC;QACpD,MAAM,IAAI,eAAe,CACvB,wBAAwB,EACxB,uFAAuF,CACxF,CAAA;IACH,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,sBAAsB,KAAK,UAAU,EAAE,CAAC;QACvD,MAAM,IAAI,eAAe,CAAC,uBAAuB,EAAE,oCAAoC,CAAC,CAAA;IAC1F,CAAC;IACD,IAAI,KAAK,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,8BAA8B,CAAA;QACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,eAAe,CACvB,gCAAgC,EAChC,iGAAiG,CAClG,CAAA;QACH,CAAC;IACH,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,eAAe,CAAC,wBAAwB,EAAE,yCAAyC,CAAC,CAAA;IAChG,CAAC;IAED,MAAM,SAAS,GAAG,2BAA2B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAC9D,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC,CAAA;IACpE,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAA;IAE1C,IAAI,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;QACnD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,KAAK,EAAE,iBAAiB,CAAC,+BAA+B,CAAC;YACzD,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,cAAc,EAAE,SAAS,CAAC,cAAc;YACxC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAA;IACJ,CAAC;IAED,2FAA2F;IAC3F,wFAAwF;IACxF,kEAAkE;IAClE,IAAI,SAAS,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,eAAe,EAAE,2BAA2B,CAAC,IAAI,QAAQ,CAAA;QACjG,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,KAAK,EAAE,OAAO;gBACZ,CAAC,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;gBAC7E,CAAC,CAAC,cAAc,CAAC;oBACb,OAAO,EAAE,mBAAmB;oBAC5B,WAAW,EAAE,4BAA4B;iBAC1C,CAAC;YACN,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,cAAc,EAAE,SAAS,CAAC,cAAc;YACxC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,QAAQ,GAAwB,EAAE,CAAA;IACxC,MAAM,UAAU,GAA0B,EAAE,CAAA;IAC5C,MAAM,MAAM,GAA0C;QACpD,kBAAkB,EAAE,CAAC;QACrB,qBAAqB,EAAE,CAAC;QACxB,2BAA2B,EAAE,CAAC;KAC/B,CAAA;IAED,KAAK,MAAM,WAAW,IAAI,SAAS,EAAE,CAAC;QACpC,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YAC5D,MAAM,IAAI,eAAe,CAAC,uBAAuB,EAAE,iCAAiC,CAAC,CAAA;QACvF,CAAC;QACD,MAAM,EAAE,GAAG,OAAO,WAAW,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAA;QAC3F,MAAM,QAAQ,GAAG,OAAO,WAAW,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAA;QACrF,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;QACjE,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAC5B,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;QAC1F,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;QAC/F,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG;QACb,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,cAAc,EAAE,SAAS,CAAC,cAAc;QACxC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC;QACtC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC;KAC3C,CAAA;IAED,IAAI,MAAM,CAAC,kBAAkB,GAAG,CAAC,IAAI,MAAM,CAAC,2BAA2B,GAAG,CAAC,EAAE,CAAC;QAC5E,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,iBAAiB,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAA;IAC9F,CAAC;IACD,IAAI,MAAM,CAAC,kBAAkB,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,GAAG,MAAM;YACT,KAAK,EAAE,cAAc,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;SACnF,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,2BAA2B,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;QAC9D,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,GAAG,MAAM;YACT,KAAK,EAAE,cAAc,CAAC;gBACpB,OAAO,EAAE,mBAAmB;gBAC5B,WAAW,EAAE,wCAAwC;aACtD,CAAC;SACH,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,qBAAqB,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;QACxD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,GAAG,MAAM;YACT,KAAK,EAAE,cAAc,CAAC;gBACpB,OAAO,EAAE,mBAAmB;gBAC5B,WAAW,EAAE,uCAAuC;aACrD,CAAC;SACH,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,iBAAiB,CAAC,8BAA8B,CAAC,EAAE,CAAC,CAAA;IAC/F,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,iBAAiB,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAA;IAC3F,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC7C,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;QAC1E,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACL,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;AACrF,CAAC;AAiBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAgC,EAChC,UAAmC,EACnC,OAAO,GAAiC,EAAE;IAE1C,MAAM,MAAM,GAAG,iCAAiC,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAA;IAC9E,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACnD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;IACpD,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAA;AAC9D,CAAC"}

package/dist/src/v2/authority-revocation/canonical.d.ts

@@ -0,0 +1,46 @@
+import type { AuthorityRevocationBodyV1, AuthorityRevocationV1 } from './types.js';
+/** Domain tags for the three preimages this record uses. Each is a distinct APS tag
+ *  followed by one zero byte, the same discipline AuthorityDelegationV1 and
+ *  PrincipalBindingRevocationV1 follow, so bytes minted for one construction can never
+ *  be read as bytes minted for another. */
+export declare const AUTHORITY_REVOCATION_ID_DOMAIN = "APS-AUTHORITY-REVOCATION-ID-V1\0";
+export declare const AUTHORITY_REVOCATION_SIGNATURE_DOMAIN = "APS-AUTHORITY-REVOCATION-SIGNATURE-V1\0";
+export declare const AUTHORITY_REVOCATION_CASCADE_TRANSACTION_DOMAIN = "APS-AUTHORITY-REVOCATION-CASCADE-TRANSACTION-ID-V1\0";
+/** The origin content a cascade transaction identity is derived from: the revocation body
+ *  with `cascade_transaction_id` absent, alongside `revocation_id` and `signature`.
+ *
+ *  Section 3.5.1 says a cascade carries a transaction identity shared by every record it
+ *  produces, and says nothing about how it is constructed. A content-bound derivation is
+ *  chosen over a random value so that issuance stays byte-deterministic for fixed inputs
+ *  and so a verifier can recompute the field instead of accepting whatever the issuer
+ *  wrote there. Independent cascades do not collide because the origin's 16-byte `nonce`
+ *  is inside this preimage. */
+export type AuthorityRevocationCascadeOriginV1 = Omit<AuthorityRevocationBodyV1, 'cascade_transaction_id'>;
+/** Exact RFC 8785 input used to derive cascade_transaction_id. */
+export declare function authorityRevocationCascadeTransactionInput(origin: AuthorityRevocationCascadeOriginV1): string;
+export declare function computeAuthorityRevocationCascadeTransactionId(origin: AuthorityRevocationCascadeOriginV1): string;
+/** Write-boundary twin of computeAuthorityRevocationCascadeTransactionId(). */
+export declare function computeAuthorityRevocationCascadeTransactionIdForWrite(origin: AuthorityRevocationCascadeOriginV1): string;
+/** Exact RFC 8785 input used to derive revocation_id. */
+export declare function authorityRevocationIdInput(body: AuthorityRevocationBodyV1): string;
+export declare function computeAuthorityRevocationId(body: AuthorityRevocationBodyV1): string;
+/** Write-boundary twin of computeAuthorityRevocationId().
+ *
+ *  Emits the same bytes as computeAuthorityRevocationId() for every value it accepts; it
+ *  only refuses an integer-valued number outside the interoperable IEEE 754 range rather
+ *  than serializing it. Use when ISSUING. verify.ts keeps calling the unrestricted form,
+ *  so a record minted before this rule still re-derives its identifier. */
+export declare function computeAuthorityRevocationIdForWrite(body: AuthorityRevocationBodyV1): string;
+/** Exact Ed25519 input: the signature domain tag plus JCS of the record with `signature`
+ *  absent. `revocation_id` IS inside this preimage, so the identifier is signed rather
+ *  than being an unauthenticated label beside the signature. */
+export declare function authorityRevocationSignatureInput(revocation: Omit<AuthorityRevocationV1, 'signature'>): string;
+export declare function signAuthorityRevocation(revocation: Omit<AuthorityRevocationV1, 'signature'>, privateKey: string): string;
+export declare function verifyAuthorityRevocationSignature(revocation: AuthorityRevocationV1, publicKey: string): boolean;
+/** The body a revocation_id is computed over: the record with `revocation_id` and
+ *  `signature` removed. */
+export declare function authorityRevocationBody(revocation: AuthorityRevocationV1): AuthorityRevocationBodyV1;
+/** The cascade origin a cascade_transaction_id is computed over: the body with
+ *  `cascade_transaction_id` removed. */
+export declare function authorityRevocationCascadeOrigin(body: AuthorityRevocationBodyV1): AuthorityRevocationCascadeOriginV1;
+//# sourceMappingURL=canonical.d.ts.map

package/dist/src/v2/authority-revocation/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-revocation/canonical.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAElF;;;2CAG2C;AAC3C,eAAO,MAAM,8BAA8B,qCAAqC,CAAA;AAChF,eAAO,MAAM,qCAAqC,4CAA4C,CAAA;AAC9F,eAAO,MAAM,+CAA+C,yDACJ,CAAA;AAMxD;;;;;;;;+BAQ+B;AAC/B,MAAM,MAAM,kCAAkC,GAAG,IAAI,CACnD,yBAAyB,EACzB,wBAAwB,CACzB,CAAA;AAED,kEAAkE;AAClE,wBAAgB,0CAA0C,CACxD,MAAM,EAAE,kCAAkC,GACzC,MAAM,CAER;AAED,wBAAgB,8CAA8C,CAC5D,MAAM,EAAE,kCAAkC,GACzC,MAAM,CAER;AAED,+EAA+E;AAC/E,wBAAgB,sDAAsD,CACpE,MAAM,EAAE,kCAAkC,GACzC,MAAM,CAIR;AAED,yDAAyD;AACzD,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,yBAAyB,GAAG,MAAM,CAElF;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,yBAAyB,GAAG,MAAM,CAEpF;AAED;;;;;2EAK2E;AAC3E,wBAAgB,oCAAoC,CAAC,IAAI,EAAE,yBAAyB,GAAG,MAAM,CAE5F;AAED;;gEAEgE;AAChE,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,IAAI,CAAC,qBAAqB,EAAE,WAAW,CAAC,GACnD,MAAM,CAER;AAED,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,IAAI,CAAC,qBAAqB,EAAE,WAAW,CAAC,EACpD,UAAU,EAAE,MAAM,GACjB,MAAM,CAKR;AAED,wBAAgB,kCAAkC,CAChD,UAAU,EAAE,qBAAqB,EACjC,SAAS,EAAE,MAAM,GAChB,OAAO,CAGT;AAED;2BAC2B;AAC3B,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,qBAAqB,GAChC,yBAAyB,CAG3B;AAED;wCACwC;AACxC,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,yBAAyB,GAC9B,kCAAkC,CAGpC"}

package/dist/src/v2/authority-revocation/canonical.js

@@ -0,0 +1,68 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { createHash } from 'node:crypto';
+import { canonicalizeJCS, canonicalizeJCSForWrite } from '../../core/canonical-jcs.js';
+import { sign, verify } from '../../crypto/keys.js';
+/** Domain tags for the three preimages this record uses. Each is a distinct APS tag
+ *  followed by one zero byte, the same discipline AuthorityDelegationV1 and
+ *  PrincipalBindingRevocationV1 follow, so bytes minted for one construction can never
+ *  be read as bytes minted for another. */
+export const AUTHORITY_REVOCATION_ID_DOMAIN = 'APS-AUTHORITY-REVOCATION-ID-V1\0';
+export const AUTHORITY_REVOCATION_SIGNATURE_DOMAIN = 'APS-AUTHORITY-REVOCATION-SIGNATURE-V1\0';
+export const AUTHORITY_REVOCATION_CASCADE_TRANSACTION_DOMAIN = 'APS-AUTHORITY-REVOCATION-CASCADE-TRANSACTION-ID-V1\0';
+function sha256Hex(value) {
+    return createHash('sha256').update(value, 'utf8').digest('hex');
+}
+/** Exact RFC 8785 input used to derive cascade_transaction_id. */
+export function authorityRevocationCascadeTransactionInput(origin) {
+    return AUTHORITY_REVOCATION_CASCADE_TRANSACTION_DOMAIN + canonicalizeJCS(origin);
+}
+export function computeAuthorityRevocationCascadeTransactionId(origin) {
+    return `sha256:${sha256Hex(authorityRevocationCascadeTransactionInput(origin))}`;
+}
+/** Write-boundary twin of computeAuthorityRevocationCascadeTransactionId(). */
+export function computeAuthorityRevocationCascadeTransactionIdForWrite(origin) {
+    return `sha256:${sha256Hex(AUTHORITY_REVOCATION_CASCADE_TRANSACTION_DOMAIN + canonicalizeJCSForWrite(origin))}`;
+}
+/** Exact RFC 8785 input used to derive revocation_id. */
+export function authorityRevocationIdInput(body) {
+    return AUTHORITY_REVOCATION_ID_DOMAIN + canonicalizeJCS(body);
+}
+export function computeAuthorityRevocationId(body) {
+    return `sha256:${sha256Hex(authorityRevocationIdInput(body))}`;
+}
+/** Write-boundary twin of computeAuthorityRevocationId().
+ *
+ *  Emits the same bytes as computeAuthorityRevocationId() for every value it accepts; it
+ *  only refuses an integer-valued number outside the interoperable IEEE 754 range rather
+ *  than serializing it. Use when ISSUING. verify.ts keeps calling the unrestricted form,
+ *  so a record minted before this rule still re-derives its identifier. */
+export function computeAuthorityRevocationIdForWrite(body) {
+    return `sha256:${sha256Hex(AUTHORITY_REVOCATION_ID_DOMAIN + canonicalizeJCSForWrite(body))}`;
+}
+/** Exact Ed25519 input: the signature domain tag plus JCS of the record with `signature`
+ *  absent. `revocation_id` IS inside this preimage, so the identifier is signed rather
+ *  than being an unauthenticated label beside the signature. */
+export function authorityRevocationSignatureInput(revocation) {
+    return AUTHORITY_REVOCATION_SIGNATURE_DOMAIN + canonicalizeJCS(revocation);
+}
+export function signAuthorityRevocation(revocation, privateKey) {
+    return sign(AUTHORITY_REVOCATION_SIGNATURE_DOMAIN + canonicalizeJCSForWrite(revocation), privateKey);
+}
+export function verifyAuthorityRevocationSignature(revocation, publicKey) {
+    const { signature, ...unsigned } = revocation;
+    return verify(authorityRevocationSignatureInput(unsigned), signature, publicKey);
+}
+/** The body a revocation_id is computed over: the record with `revocation_id` and
+ *  `signature` removed. */
+export function authorityRevocationBody(revocation) {
+    const { revocation_id: _revocationId, signature: _signature, ...body } = revocation;
+    return body;
+}
+/** The cascade origin a cascade_transaction_id is computed over: the body with
+ *  `cascade_transaction_id` removed. */
+export function authorityRevocationCascadeOrigin(body) {
+    const { cascade_transaction_id: _cascadeTransactionId, ...origin } = body;
+    return origin;
+}
+//# sourceMappingURL=canonical.js.map

package/dist/src/v2/authority-revocation/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../../../src/v2/authority-revocation/canonical.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAA;AACtF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAGnD;;;2CAG2C;AAC3C,MAAM,CAAC,MAAM,8BAA8B,GAAG,kCAAkC,CAAA;AAChF,MAAM,CAAC,MAAM,qCAAqC,GAAG,yCAAyC,CAAA;AAC9F,MAAM,CAAC,MAAM,+CAA+C,GAC1D,sDAAsD,CAAA;AAExD,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjE,CAAC;AAgBD,kEAAkE;AAClE,MAAM,UAAU,0CAA0C,CACxD,MAA0C;IAE1C,OAAO,+CAA+C,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;AAClF,CAAC;AAED,MAAM,UAAU,8CAA8C,CAC5D,MAA0C;IAE1C,OAAO,UAAU,SAAS,CAAC,0CAA0C,CAAC,MAAM,CAAC,CAAC,EAAE,CAAA;AAClF,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,sDAAsD,CACpE,MAA0C;IAE1C,OAAO,UAAU,SAAS,CACxB,+CAA+C,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAClF,EAAE,CAAA;AACL,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,0BAA0B,CAAC,IAA+B;IACxE,OAAO,8BAA8B,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;AAC/D,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,IAA+B;IAC1E,OAAO,UAAU,SAAS,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,EAAE,CAAA;AAChE,CAAC;AAED;;;;;2EAK2E;AAC3E,MAAM,UAAU,oCAAoC,CAAC,IAA+B;IAClF,OAAO,UAAU,SAAS,CAAC,8BAA8B,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAA;AAC9F,CAAC;AAED;;gEAEgE;AAChE,MAAM,UAAU,iCAAiC,CAC/C,UAAoD;IAEpD,OAAO,qCAAqC,GAAG,eAAe,CAAC,UAAU,CAAC,CAAA;AAC5E,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,UAAoD,EACpD,UAAkB;IAElB,OAAO,IAAI,CACT,qCAAqC,GAAG,uBAAuB,CAAC,UAAU,CAAC,EAC3E,UAAU,CACX,CAAA;AACH,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,UAAiC,EACjC,SAAiB;IAEjB,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,UAAU,CAAA;IAC7C,OAAO,MAAM,CAAC,iCAAiC,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;AAClF,CAAC;AAED;2BAC2B;AAC3B,MAAM,UAAU,uBAAuB,CACrC,UAAiC;IAEjC,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,CAAA;IACnF,OAAO,IAAI,CAAA;AACb,CAAC;AAED;wCACwC;AACxC,MAAM,UAAU,gCAAgC,CAC9C,IAA+B;IAE/B,MAAM,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAAA;IACzE,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/src/v2/authority-revocation/index.d.ts

@@ -0,0 +1,9 @@
+export * from './types.js';
+export * from './schema.js';
+export * from './canonical.js';
+export * from './issue.js';
+export * from './verify.js';
+export * from './store.js';
+export * from './record.js';
+export * from './resolver.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/v2/authority-revocation/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-revocation/index.ts"],"names":[],"mappings":"AAGA,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA"}

package/dist/src/v2/authority-revocation/index.js

@@ -0,0 +1,11 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+export * from './types.js';
+export * from './schema.js';
+export * from './canonical.js';
+export * from './issue.js';
+export * from './verify.js';
+export * from './store.js';
+export * from './record.js';
+export * from './resolver.js';
+//# sourceMappingURL=index.js.map

package/dist/src/v2/authority-revocation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/v2/authority-revocation/index.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA"}

package/dist/src/v2/authority-revocation/issue.d.ts

@@ -0,0 +1,54 @@
+import type { AuthorityDelegationV1 } from '../authority-delegation/types.js';
+import type { AuthorityRevocationV1 } from './types.js';
+/** Everything issuance takes besides the target delegation and the signing key. */
+export interface AuthorityRevocationIssueInput {
+    /** Canonical UTC-millisecond revocation time, supplied by the caller.
+     *
+     *  Issuance never reads a clock. The value lands in the record's signed `revoked_at`,
+     *  so the same inputs produce the same bytes on every run, which is what makes the
+     *  identifier and the signature reproducible in a test and in a conformance vector.
+     *  Named `now` to match SubAuthorityIssueOptions. */
+    now: string;
+    /** The revoking authority. Checked against the target delegation's `issuer`. */
+    revoker: string;
+    /** Which key signs. A non-empty string; no local shape rule relates it to `revoker`.
+     *  Whether it belongs to the issuer is decided only by key resolution against
+     *  `target.issuer` at `revoked_at`, which verifyAuthorityRevocation() performs. */
+    verification_method: string;
+    /** Machine-readable reason. A non-empty string; the draft fixes no grammar. */
+    reason_code: string;
+    /** OPTIONAL. Omitted from the record entirely when not supplied; never written as null. */
+    detail?: string;
+    nonce: string;
+}
+/**
+ * Mint a draft-03 section 3.5.1 direct revocation for one AuthorityDelegationV1.
+ *
+ * Section 3.5 line 634 states the only authorization rule this function applies: "Any
+ * delegation MAY be revoked by its issuer." The exact comparison is
+ * `input.revoker === delegation.issuer`, where `delegation` is the target record passed
+ * in by the caller and `issuer` is its own member. The record being minted is never
+ * consulted for its own authorization: a field a would-be revoker writes inside its own
+ * record cannot make that revoker the issuer of somebody else's delegation.
+ *
+ * The target's `delegation_id` is recomputed from its body before that comparison. A
+ * `delegation_id` sits outside the delegation's own identifier preimage, so a record
+ * whose claimed identifier does not match its body has an unauthenticated `issuer` too,
+ * and refusing there is what keeps the revoker check meaningful.
+ *
+ * What this function does NOT establish: that the holder of `privateKey` is in fact
+ * `input.revoker`, or that `input.verification_method` is one of that party's keys. An
+ * identifier-to-key binding is a resolver's answer, not a local one, and no string shape
+ * imposed on `verification_method` here could stand in for it. verifyAuthorityRevocation()
+ * makes that check, resolving the method under the TARGET delegation's `issuer` at
+ * `revoked_at`. Issuance can only refuse to mint a record that is already unverifiable; it
+ * cannot promise the record will verify.
+ *
+ * Nothing about a cascade over descendants is emitted here. This function produces one
+ * record about one delegation. Enforcement against descendants comes from chain
+ * verification, which rejects any chain containing a revoked ancestor.
+ *
+ * Throws on refusal; each message names its code in parentheses.
+ */
+export declare function issueAuthorityRevocation(delegation: AuthorityDelegationV1, input: AuthorityRevocationIssueInput, privateKey: string): AuthorityRevocationV1;
+//# sourceMappingURL=issue.d.ts.map