tenzro-sdk 0.3.0 → 0.4.1

package/README.md

@@ -220,6 +220,16 @@ const result = await app.sponsorInference(user.address, 'gemma3-270m', 'Hello');
 | `skill` | `listSkills()`, `registerSkill()` |
 | `tool` | `listTools()`, `registerTool()` |
 | `svm-cross-vm` | Tenzro Cross-VM SVM-native program: `TENZRO_CROSS_VM_PROGRAM_ID_BASE58`, `encodeBridgeToEvm()`, `encodeBridgeFromEvm()`, `encodeRegisterTokenPointer()`, `encodeTransferCrossVm()`, `decodeCrossVmInstruction()` |
+| `capital` | Regulated capital-allocation intents: `openCapitalIntent()`, `quoteCapitalIntent()`, `assignCapitalIntent()`, `executeCapitalLeg()`, `verifyCapitalLeg()`, `compensateCapitalLeg()`, `settleCapitalIntent()`, `getCapitalIntent()`, `submitReserveAttestation()`, `getReserve()`, `attestedMint()` |
+| `workflow` | Multi-party saga workflows with AP2 / x402 / MPP / Stripe SPT / Visa TAP / Mastercard Agent Pay mandate binding: `openWorkflow()`, `executeStep()`, `verifyStep()`, `compensateStep()`, `finalizeWorkflow()`, `mirrorToCanton()`, `verifyDidEnvelope()`, `getWorkflow()`, `getWorkflowSaga()`, `getWorkflowLifecycle()`, `getWorkflowReceipt()`, `getWorkflowOperationalMetrics()`, `listWorkflowsByCreator()`, `listWorkflowsByParticipant()`, `listWorkflowsByStatus()`, `listWorkflowReceipts()` |
+| `eip7702` | Pectra Type-4 delegation registry: `install7702Delegation()`, `get7702Delegation()`, `revoke7702Delegation()` |
+| `erc7683` | Cross-chain intents origin opener + destination fill registry: `open7683Order()`, `get7683Order()`, `list7683Orders()`, `recordFill7683()`, `getFill7683()`, `listFills7683()` |
+| `permit2` | Permit2 `SignatureTransfer`: `domainSeparator()`, `digest()`, `verifyAndConsume()`, `nonceUsed()` (optional witness binding for ERC-7683 origin opens) |
+| `secureMint` | Per-token 1:1 reserve-attestation invariant for tokenized RWAs: `setPolicy()`, `getPolicy()`, `clearPolicy()`, `check()`, `apply()`, `recordBurn()` |
+| `hyperlane` | Hyperlane V3 messaging with sovereign Tenzro-validator-set ISM: `listChains()`, `quoteDispatch()`, `dispatch()`, `getMessage()` |
+| `axelar` | Axelar GMP — Cosmos / Move / Stellar / XRPL reach: `listChains()`, `callContract()`, `payGas()`, `getMessage()` |
+| `babylon` | Babylon Bitcoin staking finality-providers + EOTS delegations: `registerFinalityProvider()`, `submitFinalitySignature()`, `totalStakeForProvider()`, `listDelegations()` |
+| `caip` | Tenzro CAIP namespace identifiers per `ChainAgnostic/namespaces#184`: `caip2()`, `caip10()`, `caip19()` |
 
 ## Auth (OAuth 2.1 + DPoP Onboarding)
 

package/dist/a2a-extension.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Tenzro's A2A (Agent-to-Agent) protocol extension constants.
+ *
+ * Tenzro extends Google's A2A protocol with DID-bound message
+ * signing, allowing any A2A message to carry a `did:tenzro:`
+ * signature that downstream parties can verify. The extension is
+ * surfaced as JSON metadata keys (NOT URLs — per
+ * `feedback_a2a_extension_metadata_keys` the parent `/v1` should
+ * resolve but child keys like `/v1/did` are JSON keys, not URLs).
+ *
+ * These constants are exported so consumers don't hard-code the
+ * key strings — if the extension version bumps, callers re-import.
+ */
+/** Top-level extension namespace as it appears in A2A message metadata. */
+export declare const TENZRO_A2A_EXTENSION_NAMESPACE = "tenzro/v1";
+/** Metadata key carrying the sender's `did:tenzro:` DID. */
+export declare const TENZRO_A2A_DID_KEY = "tenzro/v1/did";
+/** Metadata key carrying the Ed25519 + ML-DSA-65 hybrid signature. */
+export declare const TENZRO_A2A_SIG_KEY = "tenzro/v1/sig";
+/** Metadata key carrying the signing pubkey (or KID for caching). */
+export declare const TENZRO_A2A_PUBKEY_KEY = "tenzro/v1/pubkey";
+/** Metadata key for a TDIP delegation scope reference, if scoped. */
+export declare const TENZRO_A2A_DELEGATION_KEY = "tenzro/v1/delegation";
+/** Metadata key for the optional mandate-ref payload (AP2 / x402 / etc.). */
+export declare const TENZRO_A2A_MANDATE_REF_KEY = "tenzro/v1/mandate-ref";
+/** Metadata key for the message's audit-trail link to a prior receipt. */
+export declare const TENZRO_A2A_RECEIPT_REF_KEY = "tenzro/v1/receipt-ref";
+/** Convenience type for the parsed Tenzro extension envelope. */
+export interface TenzroA2aExtension {
+    readonly did: string;
+    readonly sig: string;
+    readonly pubkey: string;
+    readonly delegation?: string;
+    readonly mandateRef?: string;
+    readonly receiptRef?: string;
+}
+/**
+ * Extract the Tenzro extension fields from an A2A message metadata
+ * object. Returns `null` when no Tenzro extension is present.
+ */
+export declare function extractTenzroA2aExtension(metadata: Readonly<Record<string, unknown>>): TenzroA2aExtension | null;
+//# sourceMappingURL=a2a-extension.d.ts.map

package/dist/a2a-extension.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"a2a-extension.d.ts","sourceRoot":"","sources":["../src/a2a-extension.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,2EAA2E;AAC3E,eAAO,MAAM,8BAA8B,cAAc,CAAC;AAE1D,4DAA4D;AAC5D,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAElD,sEAAsE;AACtE,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAElD,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD,qEAAqE;AACrE,eAAO,MAAM,yBAAyB,yBAAyB,CAAC;AAEhE,6EAA6E;AAC7E,eAAO,MAAM,0BAA0B,0BAA0B,CAAC;AAElE,0EAA0E;AAC1E,eAAO,MAAM,0BAA0B,0BAA0B,CAAC;AAElE,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAC1C,kBAAkB,GAAG,IAAI,CAkB3B"}

package/dist/a2a-extension.js

@@ -0,0 +1,55 @@
+"use strict";
+/**
+ * Tenzro's A2A (Agent-to-Agent) protocol extension constants.
+ *
+ * Tenzro extends Google's A2A protocol with DID-bound message
+ * signing, allowing any A2A message to carry a `did:tenzro:`
+ * signature that downstream parties can verify. The extension is
+ * surfaced as JSON metadata keys (NOT URLs — per
+ * `feedback_a2a_extension_metadata_keys` the parent `/v1` should
+ * resolve but child keys like `/v1/did` are JSON keys, not URLs).
+ *
+ * These constants are exported so consumers don't hard-code the
+ * key strings — if the extension version bumps, callers re-import.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TENZRO_A2A_RECEIPT_REF_KEY = exports.TENZRO_A2A_MANDATE_REF_KEY = exports.TENZRO_A2A_DELEGATION_KEY = exports.TENZRO_A2A_PUBKEY_KEY = exports.TENZRO_A2A_SIG_KEY = exports.TENZRO_A2A_DID_KEY = exports.TENZRO_A2A_EXTENSION_NAMESPACE = void 0;
+exports.extractTenzroA2aExtension = extractTenzroA2aExtension;
+/** Top-level extension namespace as it appears in A2A message metadata. */
+exports.TENZRO_A2A_EXTENSION_NAMESPACE = 'tenzro/v1';
+/** Metadata key carrying the sender's `did:tenzro:` DID. */
+exports.TENZRO_A2A_DID_KEY = 'tenzro/v1/did';
+/** Metadata key carrying the Ed25519 + ML-DSA-65 hybrid signature. */
+exports.TENZRO_A2A_SIG_KEY = 'tenzro/v1/sig';
+/** Metadata key carrying the signing pubkey (or KID for caching). */
+exports.TENZRO_A2A_PUBKEY_KEY = 'tenzro/v1/pubkey';
+/** Metadata key for a TDIP delegation scope reference, if scoped. */
+exports.TENZRO_A2A_DELEGATION_KEY = 'tenzro/v1/delegation';
+/** Metadata key for the optional mandate-ref payload (AP2 / x402 / etc.). */
+exports.TENZRO_A2A_MANDATE_REF_KEY = 'tenzro/v1/mandate-ref';
+/** Metadata key for the message's audit-trail link to a prior receipt. */
+exports.TENZRO_A2A_RECEIPT_REF_KEY = 'tenzro/v1/receipt-ref';
+/**
+ * Extract the Tenzro extension fields from an A2A message metadata
+ * object. Returns `null` when no Tenzro extension is present.
+ */
+function extractTenzroA2aExtension(metadata) {
+    const did = metadata[exports.TENZRO_A2A_DID_KEY];
+    const sig = metadata[exports.TENZRO_A2A_SIG_KEY];
+    const pubkey = metadata[exports.TENZRO_A2A_PUBKEY_KEY];
+    if (typeof did !== 'string' || typeof sig !== 'string' || typeof pubkey !== 'string') {
+        return null;
+    }
+    const delegation = metadata[exports.TENZRO_A2A_DELEGATION_KEY];
+    const mandateRef = metadata[exports.TENZRO_A2A_MANDATE_REF_KEY];
+    const receiptRef = metadata[exports.TENZRO_A2A_RECEIPT_REF_KEY];
+    return {
+        did,
+        sig,
+        pubkey,
+        ...(typeof delegation === 'string' ? { delegation } : {}),
+        ...(typeof mandateRef === 'string' ? { mandateRef } : {}),
+        ...(typeof receiptRef === 'string' ? { receiptRef } : {}),
+    };
+}
+//# sourceMappingURL=a2a-extension.js.map

package/dist/a2a-extension.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"a2a-extension.js","sourceRoot":"","sources":["../src/a2a-extension.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAqCH,8DAoBC;AAvDD,2EAA2E;AAC9D,QAAA,8BAA8B,GAAG,WAAW,CAAC;AAE1D,4DAA4D;AAC/C,QAAA,kBAAkB,GAAG,eAAe,CAAC;AAElD,sEAAsE;AACzD,QAAA,kBAAkB,GAAG,eAAe,CAAC;AAElD,qEAAqE;AACxD,QAAA,qBAAqB,GAAG,kBAAkB,CAAC;AAExD,qEAAqE;AACxD,QAAA,yBAAyB,GAAG,sBAAsB,CAAC;AAEhE,6EAA6E;AAChE,QAAA,0BAA0B,GAAG,uBAAuB,CAAC;AAElE,0EAA0E;AAC7D,QAAA,0BAA0B,GAAG,uBAAuB,CAAC;AAYlE;;;GAGG;AACH,SAAgB,yBAAyB,CACvC,QAA2C;IAE3C,MAAM,GAAG,GAAG,QAAQ,CAAC,0BAAkB,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,0BAAkB,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,6BAAqB,CAAC,CAAC;IAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACrF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC,iCAAyB,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,QAAQ,CAAC,kCAA0B,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,QAAQ,CAAC,kCAA0B,CAAC,CAAC;IACxD,OAAO;QACL,GAAG;QACH,GAAG;QACH,MAAM;QACN,GAAG,CAAC,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;AACJ,CAAC"}

package/dist/api-key.d.ts

@@ -0,0 +1,128 @@
+import type { RpcClient } from "./rpc";
+/**
+ * Key class — controls who can revoke the key.
+ *
+ * - `subject`: default. Subject can self-revoke via `revokeMine`; admin
+ *   can revoke via `revoke`.
+ * - `operator_internal`: operator-only ops key. Admin can revoke; subject
+ *   path does not apply.
+ * - `operator_protected`: operator-only locked-down key. Not revokable
+ *   via RPC by anyone (including admin). Rotate by updating the operator
+ *   secret + restarting the node.
+ */
+export type KeyClass = "subject" | "operator_internal" | "operator_protected";
+/** Parameters for {@link ApiKeyClient.create}. */
+export interface CreateApiKeyParams {
+    /** Free-form label shown in `list`. */
+    label: string;
+    /**
+     * Optional subject identifier — typically a Tenzro DID. Required if
+     * the operator wants the holder to self-revoke later.
+     */
+    subject?: string;
+    /** Scopes to grant. Defaults to `["canton"]` server-side when empty. */
+    scopes?: string[];
+    /** Revocability class. Defaults to `subject` when omitted. */
+    class?: KeyClass;
+}
+/**
+ * Response from {@link ApiKeyClient.create}. The `key` field is the
+ * plaintext `tnz_...` token and is shown exactly once — persist it
+ * immediately.
+ */
+export interface CreatedApiKey {
+    key: string;
+    key_id: string;
+    label: string;
+    subject?: string | null;
+    scopes: string[];
+    class?: string | null;
+    created_at: number;
+    note?: string | null;
+}
+/** One row of the keyring as returned by `list` / `listMine`. */
+export interface ApiKeyRecord {
+    key_id: string;
+    subject?: string | null;
+    label: string;
+    scopes: string[];
+    class?: string | null;
+    created_at: number;
+    revoked_at?: number | null;
+    active: boolean;
+}
+/** Response from {@link ApiKeyClient.list}. */
+export interface ApiKeyList {
+    keys: ApiKeyRecord[];
+}
+/** Response from {@link ApiKeyClient.listMine}. */
+export interface MyApiKeyList {
+    keys: ApiKeyRecord[];
+    subject: string;
+}
+/** Response from {@link ApiKeyClient.revoke} / {@link ApiKeyClient.revokeMine}. */
+export interface RevokeApiKeyResult {
+    key_id: string;
+    revoked: boolean;
+}
+/**
+ * API-key management client.
+ *
+ * Two control planes:
+ *
+ * 1. **Operator** (`X-Tenzro-Admin-Token`): {@link create} / {@link list}
+ *    / {@link revoke} any key on the operator's own node. Sourced from
+ *    the `TENZRO_ADMIN_TOKEN` env var by the underlying `RpcClient`.
+ * 2. **Subject** (`X-Tenzro-Api-Key`): {@link listMine} / {@link revokeMine}
+ *    keys belonging to the caller's own subject. Sourced from `TENZRO_API_KEY`.
+ *
+ * Every Tenzro node operator holds their own admin token for *their
+ * own* node. There is no global "Tenzro Labs token," and admin
+ * capabilities do not extend to network-wide state (validator set,
+ * treasury, fee schedule, system contracts — those flow through
+ * on-chain governance via `tenzro-token`). See `docs/api-keys.md`.
+ */
+export declare class ApiKeyClient {
+    private readonly rpc;
+    constructor(rpc: RpcClient);
+    /**
+     * Mint a new API key on this node. Requires `TENZRO_ADMIN_TOKEN` in
+     * the environment.
+     *
+     * `class` controls revocability:
+     * - `subject` (default): subject can self-revoke, admin can revoke.
+     * - `operator_internal`: admin-only revoke.
+     * - `operator_protected`: not revokable via RPC — rotate by updating
+     *   the operator secret and restarting the node. The SDK injects the
+     *   `confirm_operator_protected` interlock automatically.
+     */
+    create(params: CreateApiKeyParams): Promise<CreatedApiKey>;
+    /**
+     * List every API key the node has issued — active and revoked.
+     * Admin-token-gated.
+     */
+    list(): Promise<ApiKeyList>;
+    /**
+     * Revoke an API key by its non-secret `key_id`. Admin-token-gated.
+     *
+     * Fails with `-32004` if the target is an `operator_protected` key
+     * (those cannot be revoked via RPC, by anyone, including an admin).
+     * Rotate that class by updating the operator secret + restart.
+     */
+    revoke(keyId: string): Promise<RevokeApiKeyResult>;
+    /**
+     * List every API key belonging to the caller's own subject.
+     * Requires `TENZRO_API_KEY` in the environment.
+     */
+    listMine(): Promise<MyApiKeyList>;
+    /**
+     * Revoke an API key belonging to the caller's own subject.
+     * Requires `TENZRO_API_KEY` in the environment.
+     *
+     * Only `subject`-class keys are eligible. The error for "no such key"
+     * and "not your key" is intentionally the same so ownership cannot be
+     * probed.
+     */
+    revokeMine(keyId: string): Promise<RevokeApiKeyResult>;
+}
+//# sourceMappingURL=api-key.d.ts.map

package/dist/api-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.d.ts","sourceRoot":"","sources":["../src/api-key.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAEvC;;;;;;;;;;GAUG;AACH,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,mBAAmB,GAAG,oBAAoB,CAAC;AAE9E,kDAAkD;AAClD,MAAM,WAAW,kBAAkB;IACjC,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,QAAQ,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,iEAAiE;AACjE,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,+CAA+C;AAC/C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AAED,mDAAmD;AACnD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,YAAY,EAAE,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,mFAAmF;AACnF,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,YAAY;IACX,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,SAAS;IAI3C;;;;;;;;;;OAUG;IACG,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,aAAa,CAAC;IAehE;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC;IAIjC;;;;;;OAMG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAQxD;;;OAGG;IACG,QAAQ,IAAI,OAAO,CAAC,YAAY,CAAC;IAIvC;;;;;;;OAOG;IACG,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;CAK7D"}

package/dist/api-key.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiKeyClient = void 0;
+/**
+ * API-key management client.
+ *
+ * Two control planes:
+ *
+ * 1. **Operator** (`X-Tenzro-Admin-Token`): {@link create} / {@link list}
+ *    / {@link revoke} any key on the operator's own node. Sourced from
+ *    the `TENZRO_ADMIN_TOKEN` env var by the underlying `RpcClient`.
+ * 2. **Subject** (`X-Tenzro-Api-Key`): {@link listMine} / {@link revokeMine}
+ *    keys belonging to the caller's own subject. Sourced from `TENZRO_API_KEY`.
+ *
+ * Every Tenzro node operator holds their own admin token for *their
+ * own* node. There is no global "Tenzro Labs token," and admin
+ * capabilities do not extend to network-wide state (validator set,
+ * treasury, fee schedule, system contracts — those flow through
+ * on-chain governance via `tenzro-token`). See `docs/api-keys.md`.
+ */
+class ApiKeyClient {
+    rpc;
+    constructor(rpc) {
+        this.rpc = rpc;
+    }
+    // ── Operator surface (admin-token-gated) ─────────────────────────
+    /**
+     * Mint a new API key on this node. Requires `TENZRO_ADMIN_TOKEN` in
+     * the environment.
+     *
+     * `class` controls revocability:
+     * - `subject` (default): subject can self-revoke, admin can revoke.
+     * - `operator_internal`: admin-only revoke.
+     * - `operator_protected`: not revokable via RPC — rotate by updating
+     *   the operator secret and restarting the node. The SDK injects the
+     *   `confirm_operator_protected` interlock automatically.
+     */
+    async create(params) {
+        const body = {
+            label: params.label,
+            scopes: params.scopes ?? [],
+            class: params.class ?? "subject",
+        };
+        if (params.subject !== undefined) {
+            body.subject = params.subject;
+        }
+        if ((params.class ?? "subject") === "operator_protected") {
+            body.confirm_operator_protected = true;
+        }
+        return this.rpc.call("tenzro_createApiKey", body);
+    }
+    /**
+     * List every API key the node has issued — active and revoked.
+     * Admin-token-gated.
+     */
+    async list() {
+        return this.rpc.call("tenzro_listApiKeys", {});
+    }
+    /**
+     * Revoke an API key by its non-secret `key_id`. Admin-token-gated.
+     *
+     * Fails with `-32004` if the target is an `operator_protected` key
+     * (those cannot be revoked via RPC, by anyone, including an admin).
+     * Rotate that class by updating the operator secret + restart.
+     */
+    async revoke(keyId) {
+        return this.rpc.call("tenzro_revokeApiKey", {
+            key_id: keyId,
+        });
+    }
+    // ── Subject surface (X-Tenzro-Api-Key authenticated) ─────────────
+    /**
+     * List every API key belonging to the caller's own subject.
+     * Requires `TENZRO_API_KEY` in the environment.
+     */
+    async listMine() {
+        return this.rpc.call("tenzro_listMyApiKeys", {});
+    }
+    /**
+     * Revoke an API key belonging to the caller's own subject.
+     * Requires `TENZRO_API_KEY` in the environment.
+     *
+     * Only `subject`-class keys are eligible. The error for "no such key"
+     * and "not your key" is intentionally the same so ownership cannot be
+     * probed.
+     */
+    async revokeMine(keyId) {
+        return this.rpc.call("tenzro_revokeMyApiKey", {
+            key_id: keyId,
+        });
+    }
+}
+exports.ApiKeyClient = ApiKeyClient;
+//# sourceMappingURL=api-key.js.map

package/dist/api-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.js","sourceRoot":"","sources":["../src/api-key.ts"],"names":[],"mappings":";;;AA2EA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAa,YAAY;IACM;IAA7B,YAA6B,GAAc;QAAd,QAAG,GAAH,GAAG,CAAW;IAAG,CAAC;IAE/C,oEAAoE;IAEpE;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAM,CAAC,MAA0B;QACrC,MAAM,IAAI,GAA4B;YACpC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,SAAS;SACjC,CAAC;QACF,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,oBAAoB,EAAE,CAAC;YACzD,IAAI,CAAC,0BAA0B,GAAG,IAAI,CAAC;QACzC,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAgB,qBAAqB,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI;QACR,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAa,oBAAoB,EAAE,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAqB,qBAAqB,EAAE;YAC9D,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;IACL,CAAC;IAED,oEAAoE;IAEpE;;;OAGG;IACH,KAAK,CAAC,QAAQ;QACZ,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAe,sBAAsB,EAAE,EAAE,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU,CAAC,KAAa;QAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAqB,uBAAuB,EAAE;YAChE,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;IACL,CAAC;CACF;AA3ED,oCA2EC"}

package/dist/axelar.d.ts

@@ -0,0 +1,54 @@
+import type { RpcClient } from './rpc';
+export interface AxelarChain {
+    chain_id: string;
+    family: string;
+    gateway?: string;
+    gas_service?: string;
+}
+export interface AxelarCallContractRequest {
+    source_chain: string;
+    destination_chain: string;
+    destination_address: string;
+    payload_hex: string;
+    gas_token?: string;
+    gas_amount?: string;
+}
+export interface AxelarCallContractResult {
+    payload_hash: string;
+    source_chain: string;
+    destination_chain: string;
+}
+export interface AxelarPayGasRequest {
+    payload_hash: string;
+    source_chain: string;
+    destination_chain: string;
+    destination_address: string;
+    gas_token: string;
+    gas_amount: string;
+}
+export interface AxelarPayGasResult {
+    paid: boolean;
+    gas_token: string;
+    gas_amount: string;
+}
+export interface AxelarMessage {
+    payload_hash: string;
+    source_chain: string;
+    destination_chain: string;
+    destination_address: string;
+    status: string;
+}
+/**
+ * Axelar GMP client — Cosmos / Move / Stellar / XRPL / Hyperliquid /
+ * Filecoin EVM / Kava reach via canonical `call_contract` + Gas
+ * Service pre-pay; correlation id is `keccak256(payload)`.
+ */
+export declare class AxelarClient {
+    private readonly rpc;
+    constructor(rpc: RpcClient);
+    listChains(): Promise<AxelarChain[]>;
+    callContract(req: AxelarCallContractRequest): Promise<AxelarCallContractResult>;
+    payGas(req: AxelarPayGasRequest): Promise<AxelarPayGasResult>;
+    getMessage(payloadHash: string): Promise<AxelarMessage | null>;
+}
+//# sourceMappingURL=axelar.d.ts.map

package/dist/axelar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"axelar.d.ts","sourceRoot":"","sources":["../src/axelar.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAEvC,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,wBAAwB;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,qBAAa,YAAY;IACX,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,SAAS;IAErC,UAAU,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAIpC,YAAY,CAChB,GAAG,EAAE,yBAAyB,GAC7B,OAAO,CAAC,wBAAwB,CAAC;IAO9B,MAAM,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAI7D,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;CAKrE"}

package/dist/axelar.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AxelarClient = void 0;
+/**
+ * Axelar GMP client — Cosmos / Move / Stellar / XRPL / Hyperliquid /
+ * Filecoin EVM / Kava reach via canonical `call_contract` + Gas
+ * Service pre-pay; correlation id is `keccak256(payload)`.
+ */
+class AxelarClient {
+    rpc;
+    constructor(rpc) {
+        this.rpc = rpc;
+    }
+    async listChains() {
+        return this.rpc.call('tenzro_axelarListChains', []);
+    }
+    async callContract(req) {
+        return this.rpc.call('tenzro_axelarCallContract', [req]);
+    }
+    async payGas(req) {
+        return this.rpc.call('tenzro_axelarPayGas', [req]);
+    }
+    async getMessage(payloadHash) {
+        return this.rpc.call('tenzro_axelarGetMessage', [
+            { payload_hash: payloadHash },
+        ]);
+    }
+}
+exports.AxelarClient = AxelarClient;
+//# sourceMappingURL=axelar.js.map

package/dist/axelar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"axelar.js","sourceRoot":"","sources":["../src/axelar.ts"],"names":[],"mappings":";;;AA+CA;;;;GAIG;AACH,MAAa,YAAY;IACM;IAA7B,YAA6B,GAAc;QAAd,QAAG,GAAH,GAAG,CAAW;IAAG,CAAC;IAE/C,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAgB,yBAAyB,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,GAA8B;QAE9B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAClB,2BAA2B,EAC3B,CAAC,GAAG,CAAC,CACN,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAwB;QACnC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAqB,qBAAqB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,WAAmB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAuB,yBAAyB,EAAE;YACpE,EAAE,YAAY,EAAE,WAAW,EAAE;SAC9B,CAAC,CAAC;IACL,CAAC;CACF;AAzBD,oCAyBC"}

package/dist/babylon.d.ts

@@ -0,0 +1,46 @@
+import type { RpcClient } from './rpc';
+export interface RegisterFinalityProviderRequest {
+    validator: string;
+    btc_pk: string;
+    commission_bps: number;
+}
+export interface FinalityProvider {
+    validator: string;
+    btc_pk: string;
+    commission_bps: number;
+    active: boolean;
+}
+export interface BabylonTotalStake {
+    validator: string;
+    total_satoshis: number;
+    delegation_count: number;
+}
+export interface SubmitFinalitySignatureRequest {
+    validator: string;
+    block_hash: string;
+    eots_signature: string;
+}
+export interface BtcDelegation {
+    delegator_btc_pk: string;
+    validator: string;
+    satoshis: number;
+    start_height: number;
+    end_height?: number | null;
+}
+/**
+ * Babylon Bitcoin staking client. Register a Tenzro validator as a
+ * Babylon finality provider so it is economically secured by native
+ * BTC; submit EOTS (Extractable One-Time Signatures) over Tenzro block
+ * hashes to avoid slashing.
+ */
+export declare class BabylonClient {
+    private readonly rpc;
+    constructor(rpc: RpcClient);
+    registerFinalityProvider(req: RegisterFinalityProviderRequest): Promise<FinalityProvider>;
+    getFinalityProvider(validator: string): Promise<FinalityProvider | null>;
+    listFinalityProviders(): Promise<FinalityProvider[]>;
+    totalStakeForProvider(validator: string): Promise<BabylonTotalStake>;
+    submitFinalitySignature(req: SubmitFinalitySignatureRequest): Promise<unknown>;
+    listDelegations(validator: string): Promise<BtcDelegation[]>;
+}
+//# sourceMappingURL=babylon.d.ts.map

package/dist/babylon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"babylon.d.ts","sourceRoot":"","sources":["../src/babylon.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAEvC,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,8BAA8B;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;GAKG;AACH,qBAAa,aAAa;IACZ,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,SAAS;IAErC,wBAAwB,CAC5B,GAAG,EAAE,+BAA+B,GACnC,OAAO,CAAC,gBAAgB,CAAC;IAOtB,mBAAmB,CACvB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAO7B,qBAAqB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAOpD,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAOpE,uBAAuB,CAC3B,GAAG,EAAE,8BAA8B,GAClC,OAAO,CAAC,OAAO,CAAC;IAIb,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;CAKnE"}

package/dist/babylon.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BabylonClient = void 0;
+/**
+ * Babylon Bitcoin staking client. Register a Tenzro validator as a
+ * Babylon finality provider so it is economically secured by native
+ * BTC; submit EOTS (Extractable One-Time Signatures) over Tenzro block
+ * hashes to avoid slashing.
+ */
+class BabylonClient {
+    rpc;
+    constructor(rpc) {
+        this.rpc = rpc;
+    }
+    async registerFinalityProvider(req) {
+        return this.rpc.call('tenzro_babylonRegisterFinalityProvider', [req]);
+    }
+    async getFinalityProvider(validator) {
+        return this.rpc.call('tenzro_babylonGetFinalityProvider', [{ validator }]);
+    }
+    async listFinalityProviders() {
+        return this.rpc.call('tenzro_babylonListFinalityProviders', []);
+    }
+    async totalStakeForProvider(validator) {
+        return this.rpc.call('tenzro_babylonTotalStakeForProvider', [{ validator }]);
+    }
+    async submitFinalitySignature(req) {
+        return this.rpc.call('tenzro_babylonSubmitFinalitySignature', [req]);
+    }
+    async listDelegations(validator) {
+        return this.rpc.call('tenzro_babylonListDelegations', [
+            { validator },
+        ]);
+    }
+}
+exports.BabylonClient = BabylonClient;
+//# sourceMappingURL=babylon.js.map

package/dist/babylon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"babylon.js","sourceRoot":"","sources":["../src/babylon.ts"],"names":[],"mappings":";;;AAmCA;;;;;GAKG;AACH,MAAa,aAAa;IACK;IAA7B,YAA6B,GAAc;QAAd,QAAG,GAAH,GAAG,CAAW;IAAG,CAAC;IAE/C,KAAK,CAAC,wBAAwB,CAC5B,GAAoC;QAEpC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAClB,wCAAwC,EACxC,CAAC,GAAG,CAAC,CACN,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,SAAiB;QAEjB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAClB,mCAAmC,EACnC,CAAC,EAAE,SAAS,EAAE,CAAC,CAChB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,qBAAqB;QACzB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAClB,qCAAqC,EACrC,EAAE,CACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,SAAiB;QAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAClB,qCAAqC,EACrC,CAAC,EAAE,SAAS,EAAE,CAAC,CAChB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,GAAmC;QAEnC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,uCAAuC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB;QACrC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAkB,+BAA+B,EAAE;YACrE,EAAE,SAAS,EAAE;SACd,CAAC,CAAC;IACL,CAAC;CACF;AA9CD,sCA8CC"}

package/dist/caip-helpers.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Pure helpers around the submitted `tenzro` CASA namespace
+ * (`ChainAgnostic/namespaces#184`). These functions reference the
+ * frozen spec values and are safe to use without an RPC round-trip:
+ * parsing, validation, and constants.
+ *
+ * For runtime-derived identifiers (the CAIP-2 reference, which depends
+ * on the genesis block hash for the network the wallet is connected
+ * to), use the `CaipClient` from `./caip.ts`.
+ */
+/** CAIP-2 namespace string for Tenzro. */
+export declare const TENZRO_CAIP2_NAMESPACE = "tenzro";
+/**
+ * SLIP-44 coin index for native TNZO. Pre-registered until
+ * `satoshilabs/slips#2015` merges; the string form `"tenzro"` is also
+ * accepted on input by the node-side helpers.
+ */
+export declare const TENZRO_SLIP44_COIN_INDEX = 1414421071;
+/** Asset namespaces supported by the CAIP-19 Tenzro encoding. */
+export type CaipAssetNamespace = 'slip44' | 'token' | 'nft';
+/**
+ * Validate that a string looks like a Tenzro CAIP-2 chain id —
+ * `tenzro:<32-hex chars>`. Does NOT verify the reference is the live
+ * network's genesis hash; for that, compare against `CaipClient.caip2()`.
+ */
+export declare function isTenzroCaip2(chainId: string): boolean;
+/**
+ * Build a Tenzro CAIP-2 chain id from a 16-byte reference (the first
+ * 16 bytes of the genesis block hash). Pass either a `Uint8Array` of
+ * length 16, a 32-char lowercase hex string, or a `0x`-prefixed
+ * 34-char hex string. Throws if the reference is the wrong length.
+ */
+export declare function buildTenzroCaip2(reference: Uint8Array | string): string;
+/**
+ * Parse a Tenzro CAIP-2 chain id into `{ namespace, reference }`.
+ * Returns `null` if the input doesn't match the Tenzro shape.
+ */
+export declare function parseTenzroCaip2(chainId: string): {
+    namespace: 'tenzro';
+    reference: string;
+} | null;
+/**
+ * Validate a Tenzro CAIP-10 account id: `tenzro:<32-hex>:<address>`.
+ * Tenzro addresses are 32 bytes (64-hex), but base58btc inputs are
+ * accepted on the node side and normalized, so this validator only
+ * checks the structural shape of the canonical hex form.
+ */
+export declare function isTenzroCaip10(accountId: string): boolean;
+/**
+ * Validate a Tenzro CAIP-19 asset id and return its parts. Returns
+ * `null` if the input doesn't match the Tenzro shape.
+ *
+ * Forms:
+ *   - `tenzro:<chainRef>/slip44:1414421071` (native TNZO)
+ *   - `tenzro:<chainRef>/token:<64-hex>`
+ *   - `tenzro:<chainRef>/nft:<64-hex>/<tokenId>`
+ */
+export declare function parseTenzroCaip19(assetId: string): {
+    chainRef: string;
+    namespace: CaipAssetNamespace;
+    reference: string;
+    tokenId?: string;
+} | null;
+//# sourceMappingURL=caip-helpers.d.ts.map

package/dist/caip-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caip-helpers.d.ts","sourceRoot":"","sources":["../src/caip-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,0CAA0C;AAC1C,eAAO,MAAM,sBAAsB,WAAW,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,aAAgB,CAAC;AAEtD,iEAAiE;AACjE,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,OAAO,GAAG,KAAK,CAAC;AAE5D;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAoBvE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,GACd;IAAE,SAAS,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAGnD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,kBAAkB,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,CAaP"}