agent-passport-system 7.1.0 → 7.2.0

package/dist/src/v2/bounds/record.d.ts

@@ -0,0 +1,78 @@
+import { type AuthorityBoundFulfilment, type AuthorityExhaustion, type BoundEvaluation } from './types.js';
+export interface IssueFulfilmentInput {
+    readonly bound_id: string;
+    readonly delegation_id: string;
+    readonly attestor: string;
+    readonly verification_method: string;
+    /** Canonical UTC-millisecond time, supplied by the caller. Issuance never reads a clock,
+     *  so the same inputs produce the same bytes on every run, which is what makes the
+     *  signature reproducible in a test and in a conformance vector. */
+    readonly attested_at: string;
+    readonly outcome: 'fulfilled' | 'not_fulfilled';
+    readonly reason_code: string;
+    /** Omitted from the record entirely when not supplied, never written as null. */
+    readonly detail?: string;
+}
+/**
+ * Mint a signed fulfilment attestation.
+ *
+ * What this function does NOT establish: that the holder of `privateKey` is in fact
+ * `attestor`, that `verification_method` is one of that party's keys, or that the attestor
+ * holds any fulfilment-attestor role. All three are a resolver's answer, not a local one.
+ * `assessFulfilment` makes those checks, and it asks about standing BEFORE it asks about the
+ * signature, because a record can be perfectly authentic and still come from somebody with
+ * no standing to make the statement.
+ *
+ * Proposed. Concept source: aeoess/agent-authority-lifecycle.
+ */
+export declare function issueAuthorityBoundFulfilment(input: IssueFulfilmentInput, privateKeyHex: string): AuthorityBoundFulfilment;
+export interface IssueExhaustionInput {
+    readonly boundary: string;
+    readonly verification_method: string;
+    /** Canonical UTC-millisecond time the finding was made. Never read from a clock. */
+    readonly found_at: string;
+    readonly detail?: string;
+}
+/**
+ * Mint the OPTIONAL signed exhaustion record for a `BoundEvaluation` that reached
+ * `exhausted`.
+ *
+ * REFUSES on any other state, and the refusal is the design. A record that says "I found
+ * this bound exhausted" when the evaluation said `not_established` would be a boundary
+ * asserting a finding it did not make, which is precisely what CAND-01 forbids. There is no
+ * flag to override it.
+ *
+ * `evidence` is derived from the evaluation's own accepted fulfilment records, and it is
+ * EMPTY for a `use_count` or `budget` bound. That emptiness is honest rather than
+ * incomplete: the basis for those two is the boundary's own ledger, which is the one thing
+ * an outside verifier cannot check, and a placeholder there would hide the gap. The same
+ * limit applies to the whole record, and ./types.ts states it: the record attests the
+ * boundary's finding, not the state of the world, on the model draft-03 section 5.3.3 uses
+ * for an action result.
+ *
+ * Proposed. Concept source: aeoess/agent-authority-lifecycle, invariant L10.
+ */
+export declare function issueAuthorityExhaustion(evaluation: BoundEvaluation, delegationId: string, input: IssueExhaustionInput, privateKeyHex: string): AuthorityExhaustion;
+export type AuthorityExhaustionFailureCode = 'SCHEMA_INVALID' | 'UNSUPPORTED_RECORD_TYPE' | 'ID_MISMATCH' | 'KEY_UNRESOLVED' | 'SIGNATURE_INVALID';
+export interface AuthorityExhaustionVerification {
+    /** `valid` or `invalid` only. This function answers a question about ONE record's bytes
+     *  and its signer, which is genuinely two sided, so it does not borrow the lifecycle
+     *  vocabulary. What the record means for a grant's state is `evaluateBound`'s question,
+     *  and a verified record is evidence toward it, never a substitute for it. */
+    readonly status: 'valid' | 'invalid';
+    readonly failures: readonly AuthorityExhaustionFailureCode[];
+}
+/**
+ * Verify an exhaustion record's bytes, identifier and signature.
+ *
+ * A `valid` answer here means: the record recomputes its own identifier, and the key
+ * resolved for its `boundary` at its `found_at` signed it. It does NOT mean the bound is
+ * exhausted. It means the named boundary said so, at that time, over those bytes. Treating
+ * the two as the same thing is the substitution draft-03's own security considerations warn
+ * about for receipts generally, verbatim: "Verifiers MUST treat receipts as evidence of what
+ * was attested, not as proof of what is true."
+ *
+ * Proposed.
+ */
+export declare function verifyAuthorityExhaustion(record: AuthorityExhaustion, resolveVerificationKey: (boundary: string, verificationMethod: string, foundAt: string) => string | null): AuthorityExhaustionVerification;
+//# sourceMappingURL=record.d.ts.map

package/dist/src/v2/bounds/record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"record.d.ts","sourceRoot":"","sources":["../../../../src/v2/bounds/record.ts"],"names":[],"mappings":"AAgBA,OAAO,EAIL,KAAK,wBAAwB,EAE7B,KAAK,mBAAmB,EAExB,KAAK,eAAe,EAErB,MAAM,YAAY,CAAA;AAEnB,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC;;wEAEoE;IACpE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,eAAe,CAAA;IAC/C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,iFAAiF;IACjF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,oBAAoB,EAC3B,aAAa,EAAE,MAAM,GACpB,wBAAwB,CAsC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,eAAe,EAC3B,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,oBAAoB,EAC3B,aAAa,EAAE,MAAM,GACpB,mBAAmB,CAiDrB;AAED,MAAM,MAAM,8BAA8B,GACtC,gBAAgB,GAChB,yBAAyB,GACzB,aAAa,GACb,gBAAgB,GAChB,mBAAmB,CAAA;AAEvB,MAAM,WAAW,+BAA+B;IAC9C;;;kFAG8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,CAAA;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,8BAA8B,EAAE,CAAA;CAC7D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,mBAAmB,EAC3B,sBAAsB,EAAE,CACtB,QAAQ,EAAE,MAAM,EAChB,kBAAkB,EAAE,MAAM,EAC1B,OAAO,EAAE,MAAM,KACZ,MAAM,GAAG,IAAI,GACjB,+BAA+B,CAqDjC"}

package/dist/src/v2/bounds/record.js

@@ -0,0 +1,170 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+//
+// PROPOSED, OPT-IN. Issuing and verifying the two records this module declares.
+//
+// Neither record is required by draft-pidlisnyi-aps-03 and neither is an `aps:` record type.
+// See ./types.ts for what each one attests and, more importantly, what it does not.
+import { computeAuthorityExhaustionIdForWrite, computeAuthorityExhaustionId, signAuthorityBoundFulfilment, signAuthorityExhaustion, verifyAuthorityExhaustionSignature, } from './canonical.js';
+import { AuthorityBoundError } from './evaluate.js';
+import { AUTHORITY_BOUND_FULFILMENT_TYPE, AUTHORITY_EXHAUSTION_TYPE, BOUND_KINDS, } from './types.js';
+/**
+ * Mint a signed fulfilment attestation.
+ *
+ * What this function does NOT establish: that the holder of `privateKey` is in fact
+ * `attestor`, that `verification_method` is one of that party's keys, or that the attestor
+ * holds any fulfilment-attestor role. All three are a resolver's answer, not a local one.
+ * `assessFulfilment` makes those checks, and it asks about standing BEFORE it asks about the
+ * signature, because a record can be perfectly authentic and still come from somebody with
+ * no standing to make the statement.
+ *
+ * Proposed. Concept source: aeoess/agent-authority-lifecycle.
+ */
+export function issueAuthorityBoundFulfilment(input, privateKeyHex) {
+    for (const field of [
+        'bound_id',
+        'delegation_id',
+        'attestor',
+        'verification_method',
+        'attested_at',
+        'reason_code',
+    ]) {
+        const value = input[field];
+        if (typeof value !== 'string' || value.length === 0) {
+            throw new AuthorityBoundError('FULFILMENT_ISSUE_MALFORMED', `${field} must be a non-empty string`);
+        }
+    }
+    if (input.outcome !== 'fulfilled' && input.outcome !== 'not_fulfilled') {
+        throw new AuthorityBoundError('FULFILMENT_ISSUE_MALFORMED', 'outcome must be fulfilled or not_fulfilled');
+    }
+    const body = Object.freeze({
+        record_type: AUTHORITY_BOUND_FULFILMENT_TYPE,
+        bound_id: input.bound_id,
+        delegation_id: input.delegation_id,
+        attestor: input.attestor,
+        verification_method: input.verification_method,
+        attested_at: input.attested_at,
+        outcome: input.outcome,
+        reason_code: input.reason_code,
+        ...(input.detail !== undefined ? { detail: input.detail } : {}),
+    });
+    return Object.freeze({
+        ...body,
+        signature: signAuthorityBoundFulfilment(body, privateKeyHex),
+    });
+}
+/**
+ * Mint the OPTIONAL signed exhaustion record for a `BoundEvaluation` that reached
+ * `exhausted`.
+ *
+ * REFUSES on any other state, and the refusal is the design. A record that says "I found
+ * this bound exhausted" when the evaluation said `not_established` would be a boundary
+ * asserting a finding it did not make, which is precisely what CAND-01 forbids. There is no
+ * flag to override it.
+ *
+ * `evidence` is derived from the evaluation's own accepted fulfilment records, and it is
+ * EMPTY for a `use_count` or `budget` bound. That emptiness is honest rather than
+ * incomplete: the basis for those two is the boundary's own ledger, which is the one thing
+ * an outside verifier cannot check, and a placeholder there would hide the gap. The same
+ * limit applies to the whole record, and ./types.ts states it: the record attests the
+ * boundary's finding, not the state of the world, on the model draft-03 section 5.3.3 uses
+ * for an action result.
+ *
+ * Proposed. Concept source: aeoess/agent-authority-lifecycle, invariant L10.
+ */
+export function issueAuthorityExhaustion(evaluation, delegationId, input, privateKeyHex) {
+    if (evaluation === null || typeof evaluation !== 'object') {
+        throw new AuthorityBoundError('EXHAUSTION_ISSUE_MALFORMED', 'evaluation is not an object');
+    }
+    if (evaluation.bound_state !== 'exhausted') {
+        throw new AuthorityBoundError('EXHAUSTION_STATE_NOT_EXHAUSTED', `an exhaustion record can only be minted for bound_state exhausted, not ${String(evaluation.bound_state)}`);
+    }
+    for (const field of ['boundary', 'verification_method', 'found_at']) {
+        const value = input[field];
+        if (typeof value !== 'string' || value.length === 0) {
+            throw new AuthorityBoundError('EXHAUSTION_ISSUE_MALFORMED', `${field} must be a non-empty string`);
+        }
+    }
+    if (!BOUND_KINDS.includes(evaluation.kind)) {
+        throw new AuthorityBoundError('EXHAUSTION_ISSUE_MALFORMED', `kind must be one of ${BOUND_KINDS.join(', ')}`);
+    }
+    const body = Object.freeze({
+        record_type: AUTHORITY_EXHAUSTION_TYPE,
+        bound_id: evaluation.bound_id,
+        delegation_id: delegationId,
+        kind: evaluation.kind,
+        boundary: input.boundary,
+        verification_method: input.verification_method,
+        found_at: input.found_at,
+        reason_code: evaluation.reason_code,
+        evidence: Object.freeze(evaluation.fulfilments
+            .filter(a => a.accepted)
+            .map(a => Object.freeze({ attestor: a.attestor, attested_at: a.attested_at }))),
+        ...(input.detail !== undefined ? { detail: input.detail } : {}),
+    });
+    const exhaustionId = computeAuthorityExhaustionIdForWrite(body);
+    const unsigned = Object.freeze({ ...body, exhaustion_id: exhaustionId });
+    return Object.freeze({
+        ...unsigned,
+        signature: signAuthorityExhaustion(unsigned, privateKeyHex),
+    });
+}
+/**
+ * Verify an exhaustion record's bytes, identifier and signature.
+ *
+ * A `valid` answer here means: the record recomputes its own identifier, and the key
+ * resolved for its `boundary` at its `found_at` signed it. It does NOT mean the bound is
+ * exhausted. It means the named boundary said so, at that time, over those bytes. Treating
+ * the two as the same thing is the substitution draft-03's own security considerations warn
+ * about for receipts generally, verbatim: "Verifiers MUST treat receipts as evidence of what
+ * was attested, not as proof of what is true."
+ *
+ * Proposed.
+ */
+export function verifyAuthorityExhaustion(record, resolveVerificationKey) {
+    const failures = [];
+    const invalid = () => Object.freeze({ status: 'invalid', failures: Object.freeze([...failures]) });
+    if (record === null || typeof record !== 'object') {
+        failures.push('SCHEMA_INVALID');
+        return invalid();
+    }
+    if (record.record_type !== AUTHORITY_EXHAUSTION_TYPE) {
+        failures.push('UNSUPPORTED_RECORD_TYPE');
+        return invalid();
+    }
+    for (const field of [
+        'bound_id',
+        'delegation_id',
+        'boundary',
+        'verification_method',
+        'found_at',
+        'reason_code',
+        'exhaustion_id',
+        'signature',
+    ]) {
+        if (typeof record[field] !== 'string' || record[field].length === 0) {
+            failures.push('SCHEMA_INVALID');
+            return invalid();
+        }
+    }
+    if (!Array.isArray(record.evidence) || !BOUND_KINDS.includes(record.kind)) {
+        failures.push('SCHEMA_INVALID');
+        return invalid();
+    }
+    const { exhaustion_id: claimedId, signature: _signature, ...body } = record;
+    if (computeAuthorityExhaustionId(body) !== claimedId) {
+        failures.push('ID_MISMATCH');
+        return invalid();
+    }
+    const publicKey = resolveVerificationKey(record.boundary, record.verification_method, record.found_at);
+    if (typeof publicKey !== 'string' || publicKey.length === 0) {
+        failures.push('KEY_UNRESOLVED');
+        return invalid();
+    }
+    if (!verifyAuthorityExhaustionSignature(record, publicKey)) {
+        failures.push('SIGNATURE_INVALID');
+        return invalid();
+    }
+    return Object.freeze({ status: 'valid', failures: Object.freeze([]) });
+}
+//# sourceMappingURL=record.js.map

package/dist/src/v2/bounds/record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record.js","sourceRoot":"","sources":["../../../../src/v2/bounds/record.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,EAAE;AACF,gFAAgF;AAChF,EAAE;AACF,6FAA6F;AAC7F,oFAAoF;AAEpF,OAAO,EACL,oCAAoC,EACpC,4BAA4B,EAC5B,4BAA4B,EAC5B,uBAAuB,EACvB,kCAAkC,GACnC,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,WAAW,GAOZ,MAAM,YAAY,CAAA;AAiBnB;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,6BAA6B,CAC3C,KAA2B,EAC3B,aAAqB;IAErB,KAAK,MAAM,KAAK,IAAI;QAClB,UAAU;QACV,eAAe;QACf,UAAU;QACV,qBAAqB;QACrB,aAAa;QACb,aAAa;KACL,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,mBAAmB,CAC3B,4BAA4B,EAC5B,GAAG,KAAK,6BAA6B,CACtC,CAAA;QACH,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,WAAW,IAAI,KAAK,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;QACvE,MAAM,IAAI,mBAAmB,CAC3B,4BAA4B,EAC5B,4CAA4C,CAC7C,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAAiC,MAAM,CAAC,MAAM,CAAC;QACvD,WAAW,EAAE,+BAA+B;QAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,IAAI;QACP,SAAS,EAAE,4BAA4B,CAAC,IAAI,EAAE,aAAa,CAAC;KAC7D,CAAC,CAAA;AACJ,CAAC;AAUD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAA2B,EAC3B,YAAoB,EACpB,KAA2B,EAC3B,aAAqB;IAErB,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,EAAE,6BAA6B,CAAC,CAAA;IAC5F,CAAC;IACD,IAAI,UAAU,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QAC3C,MAAM,IAAI,mBAAmB,CAC3B,gCAAgC,EAChC,0EAA0E,MAAM,CAC9E,UAAU,CAAC,WAAW,CACvB,EAAE,CACJ,CAAA;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,EAAE,qBAAqB,EAAE,UAAU,CAAU,EAAE,CAAC;QAC7E,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,mBAAmB,CAC3B,4BAA4B,EAC5B,GAAG,KAAK,6BAA6B,CACtC,CAAA;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAE,WAAiC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,mBAAmB,CAC3B,4BAA4B,EAC5B,uBAAuB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChD,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAA4B,MAAM,CAAC,MAAM,CAAC;QAClD,WAAW,EAAE,yBAAyB;QACtC,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,aAAa,EAAE,YAAY;QAC3B,IAAI,EAAE,UAAU,CAAC,IAAiB;QAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,QAAQ,EAAE,MAAM,CAAC,MAAM,CACrB,UAAU,CAAC,WAAW;aACnB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;aACvB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CACjF;QACD,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC,CAAA;IACF,MAAM,YAAY,GAAG,oCAAoC,CAAC,IAAI,CAAC,CAAA;IAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAA;IACxE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,QAAQ;QACX,SAAS,EAAE,uBAAuB,CAAC,QAAQ,EAAE,aAAa,CAAC;KAC5D,CAAC,CAAA;AACJ,CAAC;AAkBD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAA2B,EAC3B,sBAIkB;IAElB,MAAM,QAAQ,GAAqC,EAAE,CAAA;IACrD,MAAM,OAAO,GAAG,GAAoC,EAAE,CACpD,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAkB,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAA;IAEvF,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC/B,OAAO,OAAO,EAAE,CAAA;IAClB,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,KAAK,yBAAyB,EAAE,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAA;QACxC,OAAO,OAAO,EAAE,CAAA;IAClB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI;QAClB,UAAU;QACV,eAAe;QACf,UAAU;QACV,qBAAqB;QACrB,UAAU;QACV,aAAa;QACb,eAAe;QACf,WAAW;KACH,EAAE,CAAC;QACX,IAAI,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpE,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;YAC/B,OAAO,OAAO,EAAE,CAAA;QAClB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAE,WAAiC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACjG,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC/B,OAAO,OAAO,EAAE,CAAA;IAClB,CAAC;IAED,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAA;IAC3E,IAAI,4BAA4B,CAAC,IAA+B,CAAC,KAAK,SAAS,EAAE,CAAC;QAChF,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QAC5B,OAAO,OAAO,EAAE,CAAA;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,sBAAsB,CACtC,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,mBAAmB,EAC1B,MAAM,CAAC,QAAQ,CAChB,CAAA;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC/B,OAAO,OAAO,EAAE,CAAA;IAClB,CAAC;IACD,IAAI,CAAC,kCAAkC,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;QAC3D,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;QAClC,OAAO,OAAO,EAAE,CAAA;IAClB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAgB,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;AACjF,CAAC"}

package/dist/src/v2/bounds/types.d.ts

@@ -0,0 +1,275 @@
+import type { EstablishmentGap, LifecycleStateResult } from '../lifecycle-state/types.js';
+/** Record type of the bound declaration. The `proposed:` prefix is load-bearing: this is
+ *  not an `aps:` record type, because no published specification defines it. */
+export declare const AUTHORITY_BOUND_TYPE: 'proposed:aps:authority-bound:v0';
+/** Record type of a fulfilment attestation against a bound. */
+export declare const AUTHORITY_BOUND_FULFILMENT_TYPE: 'proposed:aps:authority-bound-fulfilment:v0';
+/** Record type of the optional exhaustion record. See ./record.ts for what it does and
+ *  does not attest. */
+export declare const AUTHORITY_EXHAUSTION_TYPE: 'proposed:aps:authority-exhaustion:v0';
+/** The three bound kinds the case corpus produces.
+ *
+ *  - `purpose`    the grant states a reason. It is reached when a fulfilment record from a
+ *                 party with standing establishes the reason was met. Exercising the grant
+ *                 does NOT by itself reach it.
+ *  - `use_count`  the grant allows a fixed number of admissions. The admission itself
+ *                 reaches it. No fulfilment record is involved.
+ *  - `budget`     a cumulative spend ceiling. Listed for completeness and delegated to,
+ *                 never reimplemented: `InMemoryAuthorityBudgetLedger` already answers it,
+ *                 and draft-03 section 3.4 already states the rule, verbatim: "Signatures
+ *                 establish static limits; they do not establish the current cumulative
+ *                 total."
+ *
+ *  Three bases for one state, kept apart on purpose. Proposed. */
+export declare const BOUND_KINDS: readonly ['purpose', 'use_count', 'budget'];
+export type BoundKind = (typeof BOUND_KINDS)[number];
+/** The state of one grant's declared bound, as a verifier can establish it at an instant.
+ *
+ *  - `not_reached`      established: the bound has not been reached.
+ *  - `exhausted`        established: it has. Neither revocation nor expiry. L10.
+ *  - `not_established`  the verifier cannot say. A fulfilment claim arrived that could not
+ *                       be authenticated, or could not be attributed to a party with
+ *                       standing. That establishes neither that the bound was reached nor
+ *                       that it was not, and it is never the negation of either. CAND-01.
+ *
+ *  Proposed. */
+export declare const BOUND_STATES: readonly ['not_reached', 'exhausted', 'not_established'];
+export type BoundState = (typeof BOUND_STATES)[number];
+/** Which ending a bound evaluation reports, in L10's vocabulary.
+ *
+ *  `exhaustion` and nothing else. This module never reports `expiry` and never reports
+ *  `revocation`: both of those are chain-verification answers, they arrive as
+ *  `EXPIRED` and `REVOKED` failure codes on an `AuthorityValidationResult`, and a bound
+ *  evaluation has no standing to restate them. A grant can be expired AND exhausted at the
+ *  same instant, which is why the two are reported side by side and neither overwrites the
+ *  other.
+ *
+ *  Concept source: invariant L10. Proposed. */
+export type BoundEnding = 'exhaustion' | null;
+/** A bound declared on one delegation.
+ *
+ *  This module does NOT authenticate the bound declaration itself. A bound is an input the
+ *  caller has already established, by whatever means its authority model provides: a
+ *  principal signature over this body, an entry in a registry the verifier accepts, or a
+ *  term of a contract outside the wire format. Saying so plainly matters, because
+ *  draft-03's closed facet set means there is no way to put the bound inside the signed
+ *  delegation, and a module that silently treated an unauthenticated bound as established
+ *  would be inventing the very thing CAND-01 forbids inventing.
+ *
+ *  What this module DOES authenticate is the fulfilment record, which is the external event
+ *  CAND-01 is about. */
+export interface AuthorityBound {
+    readonly record_type: typeof AUTHORITY_BOUND_TYPE;
+    /** Caller-chosen stable identifier for this bound. Non-empty. */
+    readonly bound_id: string;
+    /** Content address of the bounded delegation: `sha256:<64 lowercase hex>`. */
+    readonly delegation_id: string;
+    readonly kind: BoundKind;
+    /** kind `purpose`: a hierarchical colon-separated purpose, the same grammar
+     *  `isPurposePermitted` reads for a scope grant.
+     *  kind `use_count`: a canonical unsigned decimal integer, no leading zero unless the
+     *  value is exactly "0".
+     *  kind `budget`: a canonical unsigned decimal integer in the unit's minor units. */
+    readonly value: string;
+    /** Who may attest that this bound was reached. ROLES, not principals, for the reason a
+     *  role registry exists at all: the party with standing to say a compressor was installed
+     *  is whoever currently holds the maintenance-attestor role, not whoever held it when the
+     *  grant was signed. An empty array means nobody but the delegation's issuer, and a
+     *  resolver is still what decides whether a given attestor holds the role.
+     *
+     *  Ignored for kind `use_count` and kind `budget`, where no attestation is involved. */
+    readonly fulfilment_attestor_roles: readonly string[];
+}
+/** The signed content of a fulfilment attestation: the record with `signature` absent.
+ *
+ *  Modelled on what draft-03 section 3.5.1 requires of a revocation record, which is the
+ *  nearest published shape for "a party with standing recorded that an authority artifact's
+ *  state changed", verbatim: "A revocation MUST produce a signed revocation record
+ *  carrying, at minimum: the revoked delegation's identity; the revocation time, inside the
+ *  signed content; a reference to the revoking authority; and a machine-readable reason
+ *  code, with optional free-text detail." Each of those four has a member below. Nothing in
+ *  draft-03 requires this record to exist. */
+export interface AuthorityBoundFulfilmentBody {
+    readonly record_type: typeof AUTHORITY_BOUND_FULFILMENT_TYPE;
+    /** The bound this attestation is about. Compared to `AuthorityBound.bound_id`. */
+    readonly bound_id: string;
+    /** The bounded delegation's identity. Compared to `AuthorityBound.delegation_id`. */
+    readonly delegation_id: string;
+    /** The attesting party. A valid signature establishes WHO signed. It does not establish
+     *  that the signer was allowed to make this statement, which is what the role resolver
+     *  is for. */
+    readonly attestor: string;
+    /** Which key signed. No local rule relates it to `attestor`: an identifier-to-key
+     *  binding is a resolver's answer. */
+    readonly verification_method: string;
+    /** Canonical UTC-millisecond time, inside the signed content, supplied by the caller and
+     *  never read from a clock. */
+    readonly attested_at: string;
+    /** Machine-readable outcome. `fulfilled` is the only value that can reach a bound. A
+     *  record that says `not_fulfilled` is a statement about the world, and it is why "a
+     *  fulfilment record exists" and "it says the purpose was met" stay two facts. */
+    readonly outcome: 'fulfilled' | 'not_fulfilled';
+    /** Machine-readable reason code. Non-empty, and no grammar is fixed. */
+    readonly reason_code: string;
+    /** OPTIONAL free-text detail. An absent detail is absent, never serialized as null: JCS
+     *  has no canonical form for undefined. */
+    readonly detail?: string;
+}
+export interface AuthorityBoundFulfilment extends AuthorityBoundFulfilmentBody {
+    /** Raw 64-byte Ed25519 signature as 128 lowercase hexadecimal characters. */
+    readonly signature: string;
+}
+/** What a resolver says about one attestor's standing at one instant.
+ *
+ *  Three values, and the third is the point. `unknown` is not `other`: a resolver that
+ *  cannot answer has not told the verifier that the attestor lacks the role, and collapsing
+ *  the two would turn an unanswered question into a finding. Mirrors the three-value shape
+ *  the activation-condition surface uses for the same reason. */
+export declare const ATTESTOR_ROLE_ANSWERS: readonly ['holds_role', 'does_not_hold_role', 'unknown'];
+export type AttestorRoleAnswer = (typeof ATTESTOR_ROLE_ANSWERS)[number];
+/** Resolve whether `attestor` held any of `roles` at `atInstant`.
+ *
+ *  Roles, not principals: see `AuthorityBound.fulfilment_attestor_roles`. The resolver is
+ *  the caller's, because who holds a role is not a local fact. */
+export type AttestorRoleResolver = (attestor: string, roles: readonly string[], atInstant: string) => AttestorRoleAnswer;
+/** Resolve the verification key for one attestor's method as of one instant. `null` means
+ *  no key was resolved, which is a `source` gap and never a signature failure. The
+ *  instant-taking shape matches the historical key resolution invariant L9 describes: a
+ *  verifier selects the key version authorized at the record's own timestamp. */
+export type BoundVerificationKeyResolver = (attestor: string, verificationMethod: string, attestedAt: string) => string | null;
+/** The reason codes this module emits. Stable, module-local, SCREAMING_SNAKE_CASE. */
+export declare const BOUND_REASON_CODES: readonly [
+/** not_reached: the bound is declared and no accepted evidence reaches it. */
+'BOUND_NOT_REACHED', 
+/** exhausted: an accepted fulfilment record established the purpose was met. */
+'PURPOSE_EXHAUSTED', 
+/** exhausted: admissions counted against the bound reached its limit. */
+'USE_COUNT_EXHAUSTED', 
+/** exhausted: committed plus reserved spend reached the cumulative ceiling. */
+'BUDGET_EXHAUSTED', 
+/** not_established: at least one fulfilment claim could not be established, and none
+ *  was accepted. The per-record code says which limb failed on which record. */
+'BOUND_STATE_NOT_ESTABLISHED'];
+export type BoundReasonCode = (typeof BOUND_REASON_CODES)[number];
+/** Per-record codes an assessment carries. A rejected record always says which of the
+ *  three failure classes it fell into, because "we did not accept it" is not an answer. */
+export declare const FULFILMENT_REASON_CODES: readonly [
+/** Accepted: structurally sound, signature verified, attestor holds a named role. */
+'FULFILMENT_ACCEPTED', 
+/** The record does not have the shape this module reads. */
+'FULFILMENT_SCHEMA_INVALID', 
+/** The record names a different bound or a different delegation. */
+'FULFILMENT_NOT_BOUND_TO_BOUND', 
+/** The record says the bound was not met. Established, and negative. */
+'FULFILMENT_OUTCOME_NOT_FULFILLED', 
+/** `attested_at` is later than the instant being evaluated. A verifier asked about
+ *  Tuesday does not get to read Wednesday's records. */
+'FULFILMENT_NOT_YET_ATTESTED', 
+/** No key resolved for the attestor's method. A source gap, not a signature failure. */
+'FULFILMENT_KEY_UNRESOLVED', 
+/** A key resolved and the signature did not verify over the canonical preimage. */
+'FULFILMENT_SIGNATURE_INVALID', 
+/** The signature verified and the resolver says the attestor does not hold a named role.
+ *  Authenticated, and by someone without standing. A different failure from the one
+ *  above, and this module will not collapse them. */
+'FULFILMENT_ATTESTOR_WITHOUT_STANDING', 
+/** The resolver could not say whether the attestor holds a role. Not the same as
+ *  `WITHOUT_STANDING`: nobody has told the verifier anything. */
+'FULFILMENT_ATTESTOR_ROLE_UNKNOWN', 
+/** The bound's kind takes no fulfilment record. A `use_count` bound is reached by the
+ *  admission and a `budget` bound by the ledger. */
+'FULFILMENT_NOT_APPLICABLE_TO_KIND'];
+export type FulfilmentReasonCode = (typeof FULFILMENT_REASON_CODES)[number];
+/** What this module concluded about ONE fulfilment record. */
+export interface FulfilmentAssessment {
+    /** `bound_id` plus `attested_at` plus `attestor`, as supplied. Never computed from the
+     *  record's own claims about itself. */
+    readonly attestor: string;
+    readonly attested_at: string;
+    readonly accepted: boolean;
+    readonly reason_code: FulfilmentReasonCode;
+    /** The resolver's answer, when one was asked for. */
+    readonly role_answer?: AttestorRoleAnswer;
+    /** Which establishment limb this rejection leaves missing, when the rejection is an
+     *  evidential one rather than an established negative. Absent on an accepted record and
+     *  on `FULFILMENT_OUTCOME_NOT_FULFILLED`, which is a conclusion, not a gap. */
+    readonly missing?: readonly EstablishmentGap[];
+}
+/** What `evaluateBound` concludes. */
+export interface BoundEvaluation {
+    readonly bound_id: string;
+    readonly kind: BoundKind;
+    readonly bound_state: BoundState;
+    readonly reason_code: BoundReasonCode;
+    /** L10's ending vocabulary. `exhaustion` exactly when `bound_state` is `exhausted`, and
+     *  `null` otherwise. Never `expiry` and never `revocation`: see `BoundEnding`. */
+    readonly ending: BoundEnding;
+    /** The same conclusion in the `../lifecycle-state/` vocabulary, for reporting alongside
+     *  a chain result. `not_reached` is `valid`, `exhausted` is `invalid` (the vocabulary
+     *  has no seventh verdict and exhaustion is one of the findings that lands there,
+     *  separated by reason code), `not_established` is `not_established` with its limbs. */
+    readonly lifecycle: LifecycleStateResult;
+    /** Every fulfilment record that was looked at, in the order supplied, with what happened
+     *  to it. Never a count and never a boolean. */
+    readonly fulfilments: readonly FulfilmentAssessment[];
+    /** kind `use_count` only: admissions still allowed, as a canonical decimal string.
+     *  "0" when exhausted. Absent for the other kinds. */
+    readonly remaining?: string;
+}
+/** The signed content of the OPTIONAL exhaustion record: the record with `exhaustion_id`
+ *  and `signature` absent.
+ *
+ *  WHAT THIS RECORD ATTESTS, stated once and stated plainly. It attests that the
+ *  enforcement boundary named in `boundary` found, from the evidence it names, that the
+ *  bound had been reached. It does NOT attest that the purpose was met in the world. That
+ *  distinction is not an invention of this module: draft-03 section 5.3.3 draws the same
+ *  one for an action result, verbatim: "An action-result record attests to what the
+ *  enforcement boundary observed after dispatch.  External occurrence or settlement
+ *  requires separately resolved evidence." A verifier with no access to the boundary's
+ *  ledgers cannot reach an exhaustion verdict from signed records alone, and this record
+ *  does not pretend otherwise.
+ *
+ *  WHY IT EXISTS ANYWAY. draft-03 section 3.5.1 gives revocation a signed record, verbatim:
+ *  "A revocation MUST produce a signed revocation record carrying, at minimum: the revoked
+ *  delegation's identity; the revocation time, inside the signed content; a reference to the
+ *  revoking authority; and a machine-readable reason code, with optional free-text detail."
+ *  Exhaustion has no published counterpart. Invariant L10 says the difference between the
+ *  two endings "matters for evidence and for whether a replacement is expected", and an
+ *  ending with no record at all cannot carry that difference anywhere. This record is shaped
+ *  deliberately like the section 3.5.1 one so the two endings are comparable evidence and
+ *  still never the same record type.
+ *
+ *  Concept source: invariant L10 and invariant candidate CAND-01. Proposed. */
+export interface AuthorityExhaustionBody {
+    readonly record_type: typeof AUTHORITY_EXHAUSTION_TYPE;
+    /** The bound that was reached. */
+    readonly bound_id: string;
+    /** The bounded delegation's identity. */
+    readonly delegation_id: string;
+    readonly kind: BoundKind;
+    /** The enforcement boundary making the finding. Its own identity, not the principal's:
+     *  this is the boundary's statement about what it observed. */
+    readonly boundary: string;
+    readonly verification_method: string;
+    /** Canonical UTC-millisecond time the finding was made, inside the signed content. */
+    readonly found_at: string;
+    /** One of `BOUND_REASON_CODES`, and the reason the module reached `exhausted`. */
+    readonly reason_code: string;
+    /** The evidence the finding rests on. For a purpose bound, the `attestor` and
+     *  `attested_at` of every accepted fulfilment record. For a use-count or budget bound,
+     *  an empty array: the basis is the boundary's own ledger, which is exactly the thing an
+     *  outside verifier cannot check, and writing a placeholder here would hide that. */
+    readonly evidence: readonly {
+        readonly attestor: string;
+        readonly attested_at: string;
+    }[];
+    /** OPTIONAL free-text detail. Absent means absent, never null. */
+    readonly detail?: string;
+}
+export interface AuthorityExhaustion extends AuthorityExhaustionBody {
+    /** `sha256:<64 lowercase hex>` over the ID domain tag and JCS of the body. */
+    readonly exhaustion_id: string;
+    /** Raw 64-byte Ed25519 signature as 128 lowercase hexadecimal characters. */
+    readonly signature: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/v2/bounds/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/v2/bounds/types.ts"],"names":[],"mappings":"AAwCA,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAEzF;gFACgF;AAChF,eAAO,MAAM,oBAAoB,EAAG,iCAA0C,CAAA;AAE9E,+DAA+D;AAC/D,eAAO,MAAM,+BAA+B,EAC1C,4CAAqD,CAAA;AAEvD;uBACuB;AACvB,eAAO,MAAM,yBAAyB,EAAG,sCAA+C,CAAA;AAExF;;;;;;;;;;;;;kEAakE;AAClE,eAAO,MAAM,WAAW,YAAI,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAU,CAAA;AAEtE,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAA;AAEpD;;;;;;;;;gBASgB;AAChB,eAAO,MAAM,YAAY,YAAI,aAAa,EAAE,WAAW,EAAE,iBAAiB,CAAU,CAAA;AAEpF,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAA;AAEtD;;;;;;;;;+CAS+C;AAC/C,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,IAAI,CAAA;AAE7C;;;;;;;;;;;wBAWwB;AACxB,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,WAAW,EAAE,OAAO,oBAAoB,CAAA;IACjD,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB;;;;yFAIqF;IACrF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB;;;;;;4FAMwF;IACxF,QAAQ,CAAC,yBAAyB,EAAE,SAAS,MAAM,EAAE,CAAA;CACtD;AAED;;;;;;;;8CAQ8C;AAC9C,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,WAAW,EAAE,OAAO,+BAA+B,CAAA;IAC5D,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,qFAAqF;IACrF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B;;kBAEc;IACd,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB;0CACsC;IACtC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC;mCAC+B;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;sFAEkF;IAClF,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,eAAe,CAAA;IAC/C,wEAAwE;IACxE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;+CAC2C;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,wBAAyB,SAAQ,4BAA4B;IAC5E,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;iEAKiE;AACjE,eAAO,MAAM,qBAAqB,YAAI,YAAY,EAAE,oBAAoB,EAAE,SAAS,CAAU,CAAA;AAE7F,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEvE;;;kEAGkE;AAClE,MAAM,MAAM,oBAAoB,GAAG,CACjC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,SAAS,EAAE,MAAM,KACd,kBAAkB,CAAA;AAEvB;;;iFAGiF;AACjF,MAAM,MAAM,4BAA4B,GAAG,CACzC,QAAQ,EAAE,MAAM,EAChB,kBAAkB,EAAE,MAAM,EAC1B,UAAU,EAAE,MAAM,KACf,MAAM,GAAG,IAAI,CAAA;AAElB,sFAAsF;AACtF,eAAO,MAAM,kBAAkB;AAC7B,8EAA8E;AAC9E,mBAAmB;AACnB,gFAAgF;AAChF,mBAAmB;AACnB,yEAAyE;AACzE,qBAAqB;AACrB,+EAA+E;AAC/E,kBAAkB;AAClB;gFACgF;AAChF,6BAA6B,CACrB,CAAA;AAEV,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEjE;2FAC2F;AAC3F,eAAO,MAAM,uBAAuB;AAClC,qFAAqF;AACrF,qBAAqB;AACrB,4DAA4D;AAC5D,2BAA2B;AAC3B,oEAAoE;AACpE,+BAA+B;AAC/B,wEAAwE;AACxE,kCAAkC;AAClC;wDACwD;AACxD,6BAA6B;AAC7B,wFAAwF;AACxF,2BAA2B;AAC3B,mFAAmF;AACnF,8BAA8B;AAC9B;;qDAEqD;AACrD,sCAAsC;AACtC;iEACiE;AACjE,kCAAkC;AAClC;oDACoD;AACpD,mCAAmC,CAC3B,CAAA;AAEV,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE3E,8DAA8D;AAC9D,MAAM,WAAW,oBAAoB;IACnC;4CACwC;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAA;IAC1C,qDAAqD;IACrD,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAA;IACzC;;mFAE+E;IAC/E,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAA;CAC/C;AAED,sCAAsC;AACtC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAA;IAChC,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAA;IACrC;sFACkF;IAClF,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5B;;;4FAGwF;IACxF,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAA;IACxC;oDACgD;IAChD,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACrD;0DACsD;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;+EAuB+E;AAC/E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,WAAW,EAAE,OAAO,yBAAyB,CAAA;IACtD,kCAAkC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,yCAAyC;IACzC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB;mEAC+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,kFAAkF;IAClF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;yFAGqF;IACrF,QAAQ,CAAC,QAAQ,EAAE,SAAS;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACzF,kEAAkE;IAClE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,mBAAoB,SAAQ,uBAAuB;IAClE,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B"}