attenu-guard 0.1.0 → 0.2.0

package/dist/esm/wire.js

@@ -1,5 +1,5 @@
 /**
- * wire.ts — the signing and verification backends.
+ * wire.ts — the Delegation Token: signing backends + offline chain verification.
  *
  * Anchors and delegation tokens are signed over canonical JSON bytes. Two
  * backends ship, matching the Python library's `attenu_guard.wire`:
@@ -8,11 +8,29 @@
  *   `Ed25519Signer`    the production signer the Internet-Draft requires, with
  *                      `Ed25519Verifier` for anyone holding only the public half.
  *
+ * The second half of the module is `load()`: the Offline Verification Algorithm
+ * of draft-asor-wimse-agent-delegation-chain-00, ported from `wire.py`'s
+ * `load()`. A Delegation Token is a compact, JWT-shaped, JWS-signed object
+ * carrying one hop's `Authority` plus enough chain-linkage state (`del_depth`,
+ * `del_max_depth`, `par_hash`) that an Enforcement Point can verify an entire
+ * Delegation Chain with no call to an authorization server. The 17 interop
+ * vectors under `test/fixtures/vectors/` are the check on that port: they are
+ * generated by the Python reference implementation and each declares the exact
+ * reason it must be accepted or rejected for.
+ *
+ * This module MINTS nothing. Serialization (`serialize`/`serialize_chain` in
+ * Python) is the issuing side and lives with whoever holds the signing key;
+ * what a TypeScript enforcement point needs is the verifying side.
+ *
  * Everything here is built on Node's own `node:crypto`, so the package keeps
  * zero runtime dependencies. Ed25519 keys are wrapped in the fixed DER prefixes
  * below rather than pulled from a library.
  */
-import { createHmac, createPrivateKey, createPublicKey, generateKeyPairSync, sign as cryptoSign, timingSafeEqual, verify as cryptoVerify, } from "node:crypto";
+import { createHash, createHmac, createPrivateKey, createPublicKey, generateKeyPairSync, sign as cryptoSign, timingSafeEqual, verify as cryptoVerify, } from "node:crypto";
+import { TextDecoder } from "node:util";
+import { Authority } from "./authority.js";
+import { CanonicalizationError, DuplicateMemberError, NonFiniteNumberError, RawNumber, canonicalJson, parseJson, toPlain, } from "./canonical.js";
+import { ReasonCode } from "./reasons.js";
 /**
  * stdlib HMAC-SHA256 signer — the default for tests, examples and local dev,
  * because it needs no key management at all.
@@ -156,4 +174,384 @@ export class Ed25519Verifier {
         return rawPublicBytes(this.publicKey);
     }
 }
+// ===========================================================================
+// base64url (RFC 7515 §2: standard base64, `+`/`/` -> `-`/`_`, no `=` padding)
+// ===========================================================================
+/** Encode `data` as unpadded base64url — the encoding every token part uses. */
+export function b64urlEncode(data) {
+    return data.toString("base64url");
+}
+const B64URL = /^[A-Za-z0-9_-]*$/;
+/**
+ * Decode unpadded base64url. Node re-pads internally, so a token part never has
+ * to carry `=`.
+ *
+ * The alphabet and length are checked first, and a bad string throws. Node's own
+ * decoder is lenient — it silently drops characters outside the alphabet — which
+ * would turn a garbage `par_hash` into a *hash* mismatch instead of the
+ * malformed input it actually is. Python's `b64url_decode` raises there and
+ * `load()` reports `malformed`; this check is what keeps the two reporting the
+ * same reason for the same bytes. A length of 1 mod 4 encodes no whole byte and
+ * is rejected for the same reason.
+ */
+export function b64urlDecode(s) {
+    if (!B64URL.test(s) || s.length % 4 === 1) {
+        throw new Error(`not valid base64url: ${JSON.stringify(s)}`);
+    }
+    return Buffer.from(s, "base64url");
+}
+// ===========================================================================
+// Errors / reason codes
+// ===========================================================================
+/**
+ * Wire-verification-specific reason codes, string constants (same pattern as
+ * `ReasonCode` — see reasons.ts). `EXPIRED` is not reinvented: it aliases
+ * `ReasonCode.EXPIRED` verbatim (identical string, identical meaning: a
+ * time-bound invariant failed), covering both "now is past exp" and "exp is not
+ * monotonic along the chain" — the draft treats both as the same class of check
+ * (verification step 5).
+ */
+export const WireReasonCode = {
+    SIGNATURE_INVALID: "signature_invalid",
+    PAR_HASH_MISMATCH: "par_hash_mismatch",
+    DEPTH_INVALID: "depth_invalid",
+    NOT_NARROWER: "not_narrower",
+    MALFORMED: "malformed",
+    NON_FINITE: "non_finite",
+    DUPLICATE_MEMBER: "duplicate_member",
+    CANONICALIZATION_REQUIRED: "canonicalization_required",
+    NON_CANONICAL: "non_canonical",
+    EXPIRED: ReasonCode.EXPIRED, // "expired" — reuse, don't reinvent
+};
+/**
+ * Thrown by `load()` on the FIRST verification failure (the draft: "denying on
+ * the first failure") — offline chain verification is fail-fast and fail-closed,
+ * not an aggregation of every problem found.
+ *
+ * The constructor takes `(reason, message)`, mirroring Python's `WireError` so
+ * the two `load()`s read the same line for line. That is the opposite order to
+ * `AuthorityError(message, reason)`; here the reason code is the contract and
+ * the message is the human gloss.
+ */
+export class WireError extends Error {
+    reason;
+    constructor(reason, message = "") {
+        super(message);
+        this.name = "WireError";
+        this.reason = reason;
+    }
+}
+function isJsonObject(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function parseToken(token) {
+    const parts = token.split(".");
+    if (parts.length !== 3) {
+        throw new WireError(WireReasonCode.MALFORMED, `expected 3 dot-separated parts, got ${parts.length}`);
+    }
+    const [headerB64, payloadB64, sigB64] = parts;
+    let headerBytes;
+    let payloadBytes;
+    let sig;
+    try {
+        headerBytes = b64urlDecode(headerB64);
+        payloadBytes = b64urlDecode(payloadB64);
+        sig = b64urlDecode(sigB64);
+    }
+    catch (e) {
+        throw new WireError(WireReasonCode.MALFORMED, `could not decode token: ${String(e)}`);
+    }
+    let headerRaw;
+    let payloadRaw;
+    try {
+        const decoder = new TextDecoder("utf-8", { fatal: true });
+        headerRaw = parseJson(decoder.decode(headerBytes));
+        payloadRaw = parseJson(decoder.decode(payloadBytes));
+    }
+    catch (e) {
+        if (e instanceof DuplicateMemberError) {
+            throw new WireError(WireReasonCode.DUPLICATE_MEMBER, e.message);
+        }
+        if (e instanceof NonFiniteNumberError) {
+            throw new WireError(WireReasonCode.NON_FINITE, e.message);
+        }
+        if (e instanceof CanonicalizationError) {
+            throw new WireError(WireReasonCode.NON_CANONICAL, e.message);
+        }
+        throw new WireError(WireReasonCode.MALFORMED, `could not parse token JSON: ${String(e)}`);
+    }
+    const header = toPlain(headerRaw);
+    const payload = toPlain(payloadRaw);
+    if (!isJsonObject(header) || !isJsonObject(payload)) {
+        throw new WireError(WireReasonCode.MALFORMED, "header/payload must be JSON objects");
+    }
+    if (header["c14n"] !== "JCS") {
+        throw new WireError(WireReasonCode.CANONICALIZATION_REQUIRED, "token header must declare c14n='JCS'");
+    }
+    let canonicalHeader;
+    let canonicalPayload;
+    try {
+        canonicalHeader = canonicalJson(headerRaw);
+        canonicalPayload = canonicalJson(payloadRaw);
+    }
+    catch (e) {
+        if (e instanceof NonFiniteNumberError) {
+            throw new WireError(WireReasonCode.NON_FINITE, e.message);
+        }
+        if (e instanceof CanonicalizationError) {
+            throw new WireError(WireReasonCode.NON_CANONICAL, e.message);
+        }
+        throw e;
+    }
+    if (!headerBytes.equals(Buffer.from(canonicalHeader, "utf8")) ||
+        !payloadBytes.equals(Buffer.from(canonicalPayload, "utf8"))) {
+        throw new WireError(WireReasonCode.NON_CANONICAL, "token header and payload must be RFC 8785 JCS bytes");
+    }
+    return {
+        header,
+        payload,
+        payloadRaw: payloadRaw,
+        sig,
+        // ASCII, not utf8: the signing input is by definition the two base64url
+        // parts and a dot, so any byte outside ASCII could not have decoded.
+        signingInput: Buffer.from(`${headerB64}.${payloadB64}`, "ascii"),
+    };
+}
+/**
+ * Rebuild the FULL `Authority` a token carries, including `ttl` (recovered as
+ * `exp - iat`), so `load()` can hand the very same `Authority.isNarrowerThan`
+ * the library uses for in-process attenuation. The draft's subsumption relation
+ * and the library relation must be the same relation, so this reconstitutes an
+ * `Authority` rather than comparing claim shapes by hand.
+ *
+ * `ttl` is deliberately absent from `authorization_details` on the wire: token
+ * lifetime is carried once, at the top level, in the standard `iat`/`exp`
+ * claims, where it cannot drift out of sync with itself.
+ */
+function authorityFromPayload(payload) {
+    const details = payload["authorization_details"];
+    if (!Array.isArray(details) || details.length === 0) {
+        throw new WireError(WireReasonCode.MALFORMED, "authorization_details missing or empty");
+    }
+    const d0 = details[0];
+    if (!isJsonObject(d0) || d0["type"] !== "agent_delegation") {
+        throw new WireError(WireReasonCode.MALFORMED, "authorization_details[0].type must be 'agent_delegation'");
+    }
+    const iat = payload["iat"];
+    const exp = payload["exp"];
+    if (typeof iat !== "number" || typeof exp !== "number") {
+        throw new WireError(WireReasonCode.MALFORMED, "iat/exp missing or not numeric");
+    }
+    const wire = {
+        scopes: d0["scopes"] ?? [],
+        constraints: d0["constraints"] ?? [],
+        ttl: exp - iat,
+    };
+    try {
+        return Authority.fromWire(wire);
+    }
+    catch (e) {
+        // A malformed constraint shape, and anything else the ceiling registry
+        // refuses to build: the token is unusable, so fail closed.
+        throw new WireError(WireReasonCode.MALFORMED, `invalid authorization_details: ${String(e)}`);
+    }
+}
+// ===========================================================================
+// load() — the Offline Verification Algorithm
+// ===========================================================================
+/**
+ * A chain that passed every check in `load()`. It carries only what an
+ * Enforcement Point needs afterwards: the LEAF authority — the only authority
+ * ever checked against an attempted action — plus enough raw material to log
+ * and debug with.
+ */
+export class VerifiedChain {
+    tokens;
+    payloads;
+    leafAuthority;
+    depth;
+    delMaxDepth;
+    constructor(tokens, payloads, leafAuthority, depth, delMaxDepth) {
+        this.tokens = tokens;
+        this.payloads = payloads;
+        this.leafAuthority = leafAuthority;
+        this.depth = depth;
+        this.delMaxDepth = delMaxDepth;
+    }
+    /**
+     * Authorize `scope` (with request context `ctx`) against the LEAF authority.
+     * Delegates entirely to `Authority.permits`; no policy logic is reimplemented
+     * here, so a decision taken from a verified chain and a decision taken
+     * in-process are the same decision.
+     */
+    permits(scope, ctx = null) {
+        return this.leafAuthority.permits(scope, ctx);
+    }
+}
+/**
+ * Run the Offline Verification Algorithm over `tokens` (`[DT_0, ..., DT_n]`,
+ * root-first) and, on success, return a `VerifiedChain`. Denies on the FIRST
+ * failure by throwing a `WireError` whose `.reason` is one of the
+ * `WireReasonCode` constants.
+ *
+ * `signer` verifies every token in the chain — this implementation's
+ * simplifying trust model, matching Python's, is ONE signer/key material per
+ * whole chain. A production multi-issuer deployment would generalize `signer`
+ * into a `kid`-keyed resolver, which is a straightforward extension left out
+ * here.
+ *
+ * Steps performed, in the draft's own order:
+ *   1. JWS signature of every DT_i (+ the alg-confusion guard: the header's
+ *      declared `alg` must equal `signer.alg` — never trust a token's own claim
+ *      about which algorithm verifies it), plus the optional `rootKeyIds`
+ *      restriction on DT_0.
+ *   2. The `par_hash` byte-commitment for every i > 0, compared in constant
+ *      time; DT_0 MUST NOT carry one.
+ *   3. `del_depth`/`del_max_depth` bounds.
+ *   4. Subsumption: DT_i's authority `isNarrowerThan` DT_{i-1}'s for every
+ *      i > 0 — REUSES the core's own relation (authority.ts); not
+ *      reimplemented here.
+ *   5. Time: `now <= exp` (and `now >= nbf` where present) for every DT_i, and
+ *      `exp` non-increasing along the chain.
+ *
+ * OUT OF SCOPE, as in the Python reference implementation — documented here
+ * rather than silently skipped: step 6 (`cnf`/DPoP holder-binding proof) and
+ * step 7 (Token Status List revocation). Neither is checked.
+ */
+export function load(tokens, signer, options = {}) {
+    const { rootKeyIds = null, now = 0 } = options;
+    if (tokens.length === 0) {
+        throw new WireError(WireReasonCode.MALFORMED, "empty token chain");
+    }
+    const parsed = tokens.map((t) => parseToken(t));
+    // ---- step 1: signatures -------------------------------------------------
+    const trustedRoots = rootKeyIds === null ? null : new Set(rootKeyIds);
+    for (let i = 0; i < parsed.length; i++) {
+        const { header, sig, signingInput } = parsed[i];
+        const alg = header["alg"];
+        if (alg !== signer.alg) {
+            throw new WireError(WireReasonCode.SIGNATURE_INVALID, `token[${i}] header alg ${JSON.stringify(alg)} != signer alg ${JSON.stringify(signer.alg)}`);
+        }
+        const kid = typeof header["kid"] === "string" ? header["kid"] : null;
+        if (i === 0 && trustedRoots !== null && !trustedRoots.has(kid)) {
+            throw new WireError(WireReasonCode.SIGNATURE_INVALID, `root token kid ${JSON.stringify(kid)} not in trusted rootKeyIds`);
+        }
+        if (!signer.verify(signingInput, sig, kid)) {
+            throw new WireError(WireReasonCode.SIGNATURE_INVALID, `token[${i}] signature does not verify`);
+        }
+    }
+    // ---- step 2: par_hash byte-commitment (constant-time, over hex) ---------
+    // The commitment is over the PARENT's signing input — its exact serialized
+    // bytes — which is what makes a spliced chain detectable even when the
+    // substituted parent is broad enough that subsumption alone would pass it.
+    if ("par_hash" in parsed[0].payload) {
+        throw new WireError(WireReasonCode.MALFORMED, "DT_0 (del_depth 0) MUST NOT carry par_hash");
+    }
+    for (let i = 1; i < parsed.length; i++) {
+        const expectedHex = createHash("sha256").update(parsed[i - 1].signingInput).digest("hex");
+        const gotB64 = parsed[i].payload["par_hash"];
+        if (typeof gotB64 !== "string") {
+            throw new WireError(WireReasonCode.PAR_HASH_MISMATCH, `token[${i}] missing par_hash`);
+        }
+        let gotHex;
+        try {
+            gotHex = b64urlDecode(gotB64).toString("hex");
+        }
+        catch (e) {
+            throw new WireError(WireReasonCode.MALFORMED, `token[${i}] par_hash is not valid base64url: ${String(e)}`);
+        }
+        if (!constantTimeEqualAscii(expectedHex, gotHex)) {
+            throw new WireError(WireReasonCode.PAR_HASH_MISMATCH, `token[${i}] par_hash does not match parent token[${i - 1}]'s signing input ` +
+                "(splice, wrong parent, or tampered parent)");
+        }
+    }
+    // ---- step 3: del_depth / del_max_depth ----------------------------------
+    const rootPayload = parsed[0].payload;
+    if (rootPayload["del_depth"] !== 0) {
+        throw new WireError(WireReasonCode.DEPTH_INVALID, "DT_0.del_depth must be 0");
+    }
+    const delMaxDepth = rootPayload["del_max_depth"];
+    if (typeof delMaxDepth !== "number" ||
+        !isIntegerLiteral(parsed[0].payloadRaw["del_max_depth"]) ||
+        delMaxDepth <= 0) {
+        throw new WireError(WireReasonCode.DEPTH_INVALID, "DT_0.del_max_depth must be a positive integer");
+    }
+    // `del_max_depth` is the maximum chain LENGTH (a token count) while
+    // `del_depth` is a 0-based index, so the leaf's index must be strictly below
+    // it — a 3-token chain has a leaf at del_depth 2 and needs del_max_depth >= 3.
+    const n = parsed.length - 1;
+    if (!(n < delMaxDepth)) {
+        throw new WireError(WireReasonCode.DEPTH_INVALID, `chain length ${n + 1} exceeds del_max_depth ${delMaxDepth} ` +
+            `(need leaf del_depth ${n} < del_max_depth)`);
+    }
+    for (let i = 0; i < parsed.length; i++) {
+        if (parsed[i].payload["del_depth"] !== i) {
+            throw new WireError(WireReasonCode.DEPTH_INVALID, `token[${i}].del_depth = ${JSON.stringify(parsed[i].payload["del_depth"])}, expected ${i}`);
+        }
+    }
+    // ---- step 4: subsumption (reuse Authority.isNarrowerThan) ---------------
+    const authorities = parsed.map((p) => authorityFromPayload(p.payload));
+    for (let i = 1; i < authorities.length; i++) {
+        if (!authorities[i].isNarrowerThan(authorities[i - 1])) {
+            throw new WireError(WireReasonCode.NOT_NARROWER, `token[${i}] authority is not narrower than token[${i - 1}]'s ` +
+                "(widened scope, loosened/dropped ceiling, or looser ttl)");
+        }
+    }
+    // ---- step 5: time -------------------------------------------------------
+    let prevExp = null;
+    for (let i = 0; i < parsed.length; i++) {
+        const payload = parsed[i].payload;
+        const exp = payload["exp"];
+        if (typeof exp !== "number") {
+            throw new WireError(WireReasonCode.MALFORMED, `token[${i}] missing numeric exp`);
+        }
+        // `nbf` is optional; absent or null means "no lower bound". Anything else
+        // that is not a number is refused rather than ignored — Python compares it
+        // to `now` directly and raises a TypeError that escapes `load()`, so a
+        // caller catching only `WireError` would see the chain neither accepted nor
+        // cleanly rejected. Failing closed here is the safe reading of both.
+        const nbf = payload["nbf"];
+        if (nbf !== undefined && nbf !== null) {
+            if (typeof nbf !== "number") {
+                throw new WireError(WireReasonCode.MALFORMED, `token[${i}] nbf is not numeric`);
+            }
+            if (now < nbf) {
+                throw new WireError(WireReasonCode.EXPIRED, `token[${i}] not yet valid: now=${now} < nbf=${nbf}`);
+            }
+        }
+        if (now > exp) {
+            throw new WireError(WireReasonCode.EXPIRED, `token[${i}] expired: now=${now} > exp=${exp}`);
+        }
+        if (prevExp !== null && exp > prevExp) {
+            throw new WireError(WireReasonCode.EXPIRED, `token[${i}] exp=${exp} exceeds parent token[${i - 1}] exp=${prevExp} ` +
+                "(exp must be monotonic non-increasing along the chain)");
+        }
+        prevExp = exp;
+    }
+    // ---- steps 6-7: OUT OF SCOPE (see the doc comment) ----------------------
+    //   step 6: cnf/DPoP holder-binding proof — not checked.
+    //   step 7: Token Status List revocation — not checked.
+    return new VerifiedChain([...tokens], parsed.map((p) => p.payload), authorities[authorities.length - 1], parsed[parsed.length - 1].payload["del_depth"], delMaxDepth);
+}
+/**
+ * Did the issuer write an integer, as opposed to a value that merely equals one?
+ * `parseJson` keeps every number's original literal precisely so this question
+ * can still be asked after parsing.
+ */
+function isIntegerLiteral(value) {
+    if (value instanceof RawNumber)
+        return /^-?\d+$/.test(value.raw);
+    return typeof value === "number" && Number.isInteger(value);
+}
+/**
+ * Compare two ASCII strings without an early exit, so a near-miss and a wild
+ * miss take the same time. `timingSafeEqual` throws on unequal lengths, so the
+ * length is checked first — that leak is only the digest length, which is fixed
+ * and public anyway.
+ */
+function constantTimeEqualAscii(a, b) {
+    const ab = Buffer.from(a, "ascii");
+    const bb = Buffer.from(b, "ascii");
+    return ab.length === bb.length && timingSafeEqual(ab, bb);
+}
 //# sourceMappingURL=wire.js.map

package/dist/esm/wire.js.map

@@ -1 +1 @@
-{"version":3,"file":"wire.js","sourceRoot":"","sources":["../../src/wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,IAAI,IAAI,UAAU,EAClB,eAAe,EACf,MAAM,IAAI,YAAY,GAEvB,MAAM,aAAa,CAAC;AAarB;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,eAAe;IAKP;IAJV,GAAG,GAAG,OAAO,CAAC;IACd,GAAG,CAAS;IAErB,YACmB,MAAc,EAC/B,GAAG,GAAG,MAAM;QADK,WAAM,GAAN,MAAM,CAAQ;QAG/B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,IAAI,CAAC,YAAoB;QACvB,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;IACzE,CAAC;IAED,MAAM,CAAC,YAAoB,EAAE,GAAW,EAAE,MAAsB;QAC9D,yEAAyE;QACzE,yEAAyE;QACzE,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzC,OAAO,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC1E,CAAC;CACF;AAED,+EAA+E;AAC/E,+EAA+E;AAC/E,+DAA+D;AAC/D,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;AAC3E,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;AAEpF,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,eAAe,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;QAC9C,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,2CAA2C,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,gBAAgB,CAAC;QACtB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QAC/C,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,GAAc;IACpC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,eAAe,CAAC,GAAc;IACrC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,aAAa;IACf,GAAG,GAAG,OAAO,CAAC;IACd,GAAG,CAAS;IACJ,UAAU,CAAY;IACtB,SAAS,CAAY;IAEtC,YAAY,UAAsB,EAAE,GAAG,GAAG,WAAW;QACnD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YAClC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;YAC7B,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,qDAAqD;IACrD,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG,WAAW;QAC/B,OAAO,IAAI,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,yEAAyE;IACzE,MAAM,CAAC,gBAAgB,CAAC,GAAW,EAAE,GAAG,GAAG,WAAW;QACpD,OAAO,IAAI,aAAa,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,YAAoB;QACvB,OAAO,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,CAAC,YAAoB,EAAE,GAAW,EAAE,MAAsB;QAC9D,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,cAAc;QACZ,OAAO,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAED,0EAA0E;IAC1E,eAAe;QACb,OAAO,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,eAAe;IACjB,GAAG,GAAG,OAAO,CAAC;IACd,GAAG,CAAS;IACJ,SAAS,CAAY;IAEtC,YAAY,cAAsB,EAAE,GAAG,GAAG,WAAW;QACnD,IAAI,CAAC,SAAS,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,IAAI,CAAC,aAAqB;QACxB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,CAAC,YAAoB,EAAE,GAAW,EAAE,MAAsB;QAC9D,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,cAAc;QACZ,OAAO,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;CACF"}
+{"version":3,"file":"wire.js","sourceRoot":"","sources":["../../src/wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EACL,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,IAAI,IAAI,UAAU,EAClB,eAAe,EACf,MAAM,IAAI,YAAY,GAEvB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,SAAS,EACT,aAAa,EACb,SAAS,EACT,OAAO,GAGR,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,UAAU,EAAiB,MAAM,cAAc,CAAC;AAazD;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,eAAe;IAKP;IAJV,GAAG,GAAG,OAAO,CAAC;IACd,GAAG,CAAS;IAErB,YACmB,MAAc,EAC/B,GAAG,GAAG,MAAM;QADK,WAAM,GAAN,MAAM,CAAQ;QAG/B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,IAAI,CAAC,YAAoB;QACvB,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;IACzE,CAAC;IAED,MAAM,CAAC,YAAoB,EAAE,GAAW,EAAE,MAAsB;QAC9D,yEAAyE;QACzE,yEAAyE;QACzE,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzC,OAAO,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC1E,CAAC;CACF;AAED,+EAA+E;AAC/E,+EAA+E;AAC/E,+DAA+D;AAC/D,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;AAC3E,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;AAEpF,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,eAAe,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;QAC9C,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,2CAA2C,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,gBAAgB,CAAC;QACtB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QAC/C,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,GAAc;IACpC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,eAAe,CAAC,GAAc;IACrC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,aAAa;IACf,GAAG,GAAG,OAAO,CAAC;IACd,GAAG,CAAS;IACJ,UAAU,CAAY;IACtB,SAAS,CAAY;IAEtC,YAAY,UAAsB,EAAE,GAAG,GAAG,WAAW;QACnD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YAClC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;YAC7B,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,qDAAqD;IACrD,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG,WAAW;QAC/B,OAAO,IAAI,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,yEAAyE;IACzE,MAAM,CAAC,gBAAgB,CAAC,GAAW,EAAE,GAAG,GAAG,WAAW;QACpD,OAAO,IAAI,aAAa,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,YAAoB;QACvB,OAAO,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,CAAC,YAAoB,EAAE,GAAW,EAAE,MAAsB;QAC9D,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,cAAc;QACZ,OAAO,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAED,0EAA0E;IAC1E,eAAe;QACb,OAAO,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,eAAe;IACjB,GAAG,GAAG,OAAO,CAAC;IACd,GAAG,CAAS;IACJ,SAAS,CAAY;IAEtC,YAAY,cAAsB,EAAE,GAAG,GAAG,WAAW;QACnD,IAAI,CAAC,SAAS,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,IAAI,CAAC,aAAqB;QACxB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,CAAC,YAAoB,EAAE,GAAW,EAAE,MAAsB;QAC9D,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,cAAc;QACZ,OAAO,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;CACF;AAED,8EAA8E;AAC9E,+EAA+E;AAC/E,8EAA8E;AAE9E,gFAAgF;AAChF,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,MAAM,GAAG,kBAAkB,CAAC;AAElC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;AACrC,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,iBAAiB,EAAE,mBAAmB;IACtC,iBAAiB,EAAE,mBAAmB;IACtC,aAAa,EAAE,eAAe;IAC9B,YAAY,EAAE,cAAc;IAC5B,SAAS,EAAE,WAAW;IACtB,UAAU,EAAE,YAAY;IACxB,gBAAgB,EAAE,kBAAkB;IACpC,yBAAyB,EAAE,2BAA2B;IACtD,aAAa,EAAE,eAAe;IAC9B,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,oCAAoC;CACzD,CAAC;AAIX;;;;;;;;;GASG;AACH,MAAM,OAAO,SAAU,SAAQ,KAAK;IACzB,MAAM,CAAS;IAExB,YAAY,MAAc,EAAE,OAAO,GAAG,EAAE;QACtC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAqBD,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,SAAS,CACjB,cAAc,CAAC,SAAS,EACxB,uCAAuC,KAAK,CAAC,MAAM,EAAE,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,KAAiC,CAAC;IAC1E,IAAI,WAAmB,CAAC;IACxB,IAAI,YAAoB,CAAC;IACzB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,WAAW,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACtC,YAAY,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACxC,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,SAAS,CAAC,cAAc,CAAC,SAAS,EAAE,2BAA2B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,IAAI,SAAgB,CAAC;IACrB,IAAI,UAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;QACnD,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,oBAAoB,EAAE,CAAC;YACtC,MAAM,IAAI,SAAS,CAAC,cAAc,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,YAAY,oBAAoB,EAAE,CAAC;YACtC,MAAM,IAAI,SAAS,CAAC,cAAc,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,YAAY,qBAAqB,EAAE,CAAC;YACvC,MAAM,IAAI,SAAS,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,cAAc,CAAC,SAAS,EAAE,+BAA+B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAO,SAAS,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,OAAO,CAAO,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,SAAS,CAAC,cAAc,CAAC,SAAS,EAAE,qCAAqC,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,EAAE,CAAC;QAC7B,MAAM,IAAI,SAAS,CACjB,cAAc,CAAC,yBAAyB,EACxC,sCAAsC,CACvC,CAAC;IACJ,CAAC;IACD,IAAI,eAAuB,CAAC;IAC5B,IAAI,gBAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,eAAe,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QAC3C,gBAAgB,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,oBAAoB,EAAE,CAAC;YACtC,MAAM,IAAI,SAAS,CAAC,cAAc,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,YAAY,qBAAqB,EAAE,CAAC;YACvC,MAAM,IAAI,SAAS,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;IACD,IACE,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QACzD,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,EAC3D,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,cAAc,CAAC,aAAa,EAC5B,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM;QACN,OAAO;QACP,UAAU,EAAE,UAAmC;QAC/C,GAAG;QACH,wEAAwE;QACxE,qEAAqE;QACrE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,EAAE,OAAO,CAAC;KACjE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,oBAAoB,CAAC,OAA6B;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,SAAS,CAAC,cAAc,CAAC,SAAS,EAAE,wCAAwC,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,KAAK,kBAAkB,EAAE,CAAC;QAC3D,MAAM,IAAI,SAAS,CACjB,cAAc,CAAC,SAAS,EACxB,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACvD,MAAM,IAAI,SAAS,CAAC,cAAc,CAAC,SAAS,EAAE,gCAAgC,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,IAAI,GAAG;QACX,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE;QAC1B,WAAW,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE;QACpC,GAAG,EAAE,GAAG,GAAG,GAAG;KACf,CAAC;IACF,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,QAAQ,CAAC,IAAa,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,uEAAuE;QACvE,2DAA2D;QAC3D,MAAM,IAAI,SAAS,CAAC,cAAc,CAAC,SAAS,EAAE,kCAAkC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,OAAO,aAAa;IAEb;IACA;IACA;IACA;IACA;IALX,YACW,MAAyB,EACzB,QAAyC,EACzC,aAAwB,EACxB,KAAa,EACb,WAAmB;QAJnB,WAAM,GAAN,MAAM,CAAmB;QACzB,aAAQ,GAAR,QAAQ,CAAiC;QACzC,kBAAa,GAAb,aAAa,CAAW;QACxB,UAAK,GAAL,KAAK,CAAQ;QACb,gBAAW,GAAX,WAAW,CAAQ;IAC3B,CAAC;IAEJ;;;;;OAKG;IACH,OAAO,CAAC,KAAa,EAAE,MAAsB,IAAI;QAC/C,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;CACF;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,IAAI,CAClB,MAAyB,EACzB,MAAc,EACd,UAAuB,EAAE;IAEzB,MAAM,EAAE,UAAU,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC;IAC/C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,SAAS,CAAC,cAAc,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhD,4EAA4E;IAC5E,MAAM,YAAY,GAAG,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACtE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QACjD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,GAAG,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CACjB,cAAc,CAAC,iBAAiB,EAChC,SAAS,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC5F,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrE,IAAI,CAAC,KAAK,CAAC,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,SAAS,CACjB,cAAc,CAAC,iBAAiB,EAChC,kBAAkB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,4BAA4B,CAClE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,SAAS,CACjB,cAAc,CAAC,iBAAiB,EAChC,SAAS,CAAC,6BAA6B,CACxC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,IAAI,UAAU,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,IAAI,SAAS,CAAC,cAAc,CAAC,SAAS,EAAE,4CAA4C,CAAC,CAAC;IAC9F,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,SAAS,CAAC,cAAc,CAAC,iBAAiB,EAAE,SAAS,CAAC,oBAAoB,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,SAAS,CACjB,cAAc,CAAC,SAAS,EACxB,SAAS,CAAC,sCAAsC,MAAM,CAAC,CAAC,CAAC,EAAE,CAC5D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,sBAAsB,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,SAAS,CACjB,cAAc,CAAC,iBAAiB,EAChC,SAAS,CAAC,0CAA0C,CAAC,GAAG,CAAC,oBAAoB;gBAC3E,4CAA4C,CAC/C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC;IACvC,IAAI,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,SAAS,CAAC,cAAc,CAAC,aAAa,EAAE,0BAA0B,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,WAAW,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC;IACjD,IACE,OAAO,WAAW,KAAK,QAAQ;QAC/B,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;QACzD,WAAW,IAAI,CAAC,EAChB,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,cAAc,CAAC,aAAa,EAC5B,+CAA+C,CAChD,CAAC;IACJ,CAAC;IACD,oEAAoE;IACpE,6EAA6E;IAC7E,+EAA+E;IAC/E,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,SAAS,CACjB,cAAc,CAAC,aAAa,EAC5B,gBAAgB,CAAC,GAAG,CAAC,0BAA0B,WAAW,GAAG;YAC3D,wBAAwB,CAAC,mBAAmB,CAC/C,CAAC;IACJ,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,SAAS,CACjB,cAAc,CAAC,aAAa,EAC5B,SAAS,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,cAAc,CAAC,EAAE,CAC5F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,IAAI,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,SAAS,CACjB,cAAc,CAAC,YAAY,EAC3B,SAAS,CAAC,0CAA0C,CAAC,GAAG,CAAC,MAAM;gBAC7D,0DAA0D,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC;QACnC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,SAAS,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,uBAAuB,CAAC,CAAC;QACnF,CAAC;QACD,0EAA0E;QAC1E,2EAA2E;QAC3E,uEAAuE;QACvE,4EAA4E;QAC5E,qEAAqE;QACrE,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACtC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,IAAI,SAAS,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,sBAAsB,CAAC,CAAC;YAClF,CAAC;YACD,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;gBACd,MAAM,IAAI,SAAS,CACjB,cAAc,CAAC,OAAO,EACtB,SAAS,CAAC,wBAAwB,GAAG,UAAU,GAAG,EAAE,CACrD,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,SAAS,CAAC,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,kBAAkB,GAAG,UAAU,GAAG,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,IAAI,GAAG,GAAG,OAAO,EAAE,CAAC;YACtC,MAAM,IAAI,SAAS,CACjB,cAAc,CAAC,OAAO,EACtB,SAAS,CAAC,SAAS,GAAG,yBAAyB,CAAC,GAAG,CAAC,SAAS,OAAO,GAAG;gBACrE,wDAAwD,CAC3D,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,GAAG,CAAC;IAChB,CAAC;IAED,4EAA4E;IAC5E,yDAAyD;IACzD,wDAAwD;IAExD,OAAO,IAAI,aAAa,CACtB,CAAC,GAAG,MAAM,CAAC,EACX,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAC5B,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAE,EACpC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,OAAO,CAAC,WAAW,CAAW,EACzD,WAAW,CACZ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,KAAwB;IAChD,IAAI,KAAK,YAAY,SAAS;QAAE,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACnC,OAAO,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,IAAI,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "attenu-guard",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Attenu Guard for TypeScript: enforces per-agent permissions on every tool call and sub-agent handoff — a sub-agent never holds more than its parent — and writes a hash-chained audit log you verify offline. Same bundle format as the Python library.",
   "license": "Apache-2.0",
   "author": "Attenu",