@attested-intelligence/aga-mcp-server 2.0.1 → 2.2.0

package/README.md

@@ -1,124 +1,197 @@
-# @attested-intelligence/aga-mcp-server v2.0.0
-
-[![MCP Badge](https://lobehub.com/badge/mcp/attested-intelligence-aga-mcp-server)](https://lobehub.com/mcp/attested-intelligence-aga-mcp-server)
-
-MCP server implementing the Attested Governance Artifact (AGA) protocol - cryptographic compliance enforcement for autonomous AI systems.
-
-## What It Does
-
-This server acts as a **Portal** (zero-trust Policy Enforcement Point) for AI agents. Every tool call is attested, measured against a sealed cryptographic reference, and logged to a tamper-evident continuity chain with signed receipts.
-
-**20 tools, 3 resources, 3 prompts, 159 tests**
-
-## 20 MCP Tools
-
-| # | Tool | Description |
-| --- | --- | --- |
-| 1 | `aga_server_info` | Server identity, keys, portal state, framework alignment |
-| 2 | `aga_init_chain` | Initialize continuity chain with genesis event |
-| 3 | `aga_create_artifact` | Attest subject, generate sealed Policy Artifact |
-| 4 | `aga_measure_subject` | Measure subject, compare to sealed ref, generate receipt |
-| 5 | `aga_verify_artifact` | Verify artifact signature against issuer key |
-| 6 | `aga_start_monitoring` | Start/restart behavioral monitoring with baseline |
-| 7 | `aga_get_portal_state` | Current portal enforcement state and TTL |
-| 8 | `aga_trigger_measurement` | Trigger measurement with specific type |
-| 9 | `aga_generate_receipt` | Generate signed measurement receipt manually |
-| 10 | `aga_export_bundle` | Package artifact + receipts + Merkle proofs |
-| 11 | `aga_verify_bundle` | 4-step offline bundle verification |
-| 12 | `aga_disclose_claim` | Privacy-preserving disclosure with auto-substitution |
-| 13 | `aga_get_chain` | Get chain events with optional integrity verification |
-| 14 | `aga_quarantine_status` | Quarantine state and forensic capture status |
-| 15 | `aga_revoke_artifact` | Mid-session artifact revocation |
-| 16 | `aga_set_verification_tier` | Set verification tier (BRONZE/SILVER/GOLD) |
-| 17 | `aga_demonstrate_lifecycle` | Full lifecycle: attest, measure, checkpoint, verify |
-| 18 | `aga_measure_behavior` | Behavioral drift detection (tool patterns) |
-| 19 | `aga_delegate_to_subagent` | Constrained sub-agent delegation (scope only diminishes) |
-| 20 | `aga_rotate_keys` | Key rotation with chain event |
-
-## 3 Resources
-
-| Resource | URI | Description |
-| --- | --- | --- |
-| Protocol Spec | `aga://specification/protocol-v2` | Full protocol specification with SPIFFE alignment |
-| Sample Bundle | `aga://resources/sample-bundle` | Sample evidence bundle documentation |
-| Crypto Primitives | `aga://resources/crypto-primitives` | Cryptographic primitives documentation |
-
-## 3 Prompts
-
-| Prompt | Description |
-|--------|-------------|
-| `nccoe-demo` | 4-phase NCCoE lab demo with behavioral drift |
-| `governance-report` | Session governance summary report |
-| `drift-analysis` | Drift event analysis and remediation |
-
-## CoSAI MCP Security Threat Coverage
-
-The AGA MCP Server addresses all 12 threat categories identified in the
-[CoSAI MCP Security whitepaper](https://github.com/cosai-oasis/ws4-secure-design-agentic-systems/blob/main/model-context-protocol-security.md)
-(Coalition for Secure AI / OASIS, January 2026).
-
-| CoSAI Category | Threat Domain | AGA Governance Mechanism |
-|---|---|---|
-| T1: Improper Authentication | Identity & Access | Ed25519 artifact signatures, pinned issuer keys, TTL re-attestation, key rotation chain events |
-| T2: Missing Access Control | Identity & Access | Portal as mandatory enforcement boundary, sealed constraints, delegation with scope diminishment |
-| T3: Input Validation Failures | Input Handling | Runtime measurement against sealed reference, behavioral drift detection |
-| T4: Data/Control Boundary Failures | Input Handling | Behavioral baseline (permitted tools, forbidden sequences, rate limits), phantom execution forensics |
-| T5: Inadequate Data Protection | Data & Code | Salted commitments, privacy-preserving disclosure with substitution, inference risk prevention |
-| T6: Missing Integrity Controls | Data & Code | Content-addressable hash binding, 10 measurement embodiments, continuous runtime verification |
-| T7: Session/Transport Security | Network & Transport | TTL-based artifact expiration, fail-closed on expiry, mid-session revocation, Ed25519 signed receipts |
-| T8: Network Isolation Failures | Network & Transport | Two-process architecture, agent holds no credentials, NETWORK_ISOLATE enforcement action |
-| T9: Trust Boundary Failures | Trust & Design | Enforcement pre-committed by human authorities in sealed artifact, not delegated to LLM |
-| T10: Resource Management | Trust & Design | Per-tool rate limits in behavioral baseline, configurable measurement cadence (10ms to 3600s) |
-| T11: Supply Chain Failures | Operational | Content-addressable hashing at attestation, runtime hash comparison blocks modified components |
-| T12: Insufficient Observability | Operational | Signed receipts, tamper-evident continuity chain, Merkle anchoring, offline evidence bundles |
-
-Full mapping details available via the `aga://specification` resource.
-
-## Quick Start
-
-```bash
-npm install && npm run build && npm test
-```
-
-## Connect to an MCP Client
-
-Add to your MCP client config:
-
-```json
-{
-  "mcpServers": {
-    "aga": { "command": "node", "args": ["/path/to/aga-mcp-server/dist/index.js"] }
-  }
-}
-```
-
-## Architecture
-
-```
-MCP Client
-    │ JSON-RPC over stdio
-    ▼
-src/server.ts - 20 tools + 3 resources + 3 prompts
-    │
-    ├── src/tools/          20 individual tool handlers
-    ├── src/core/           Protocol logic (artifact, chain, portal, etc.)
-    ├── src/crypto/         Ed25519 + SHA-256 + Merkle + canonical JSON
-    ├── src/middleware/     Zero-trust governance PEP
-    ├── src/storage/        In-memory + optional SQLite
-    ├── src/resources/      Protocol docs + crypto primitives
-    └── src/prompts/        Demo + report + analysis prompts
-```
-
-## Test Coverage
-
-| Suite | Tests | What |
-|-------|-------|------|
-| Crypto | 33 | SHA-256, Ed25519, Merkle, salt, canonical, keys |
-| Core | 56 | Artifact, chain, portal, governance, behavioral, delegation, privacy, revocation, fail-closed |
-| Tools | 25 | All 20 tool handlers |
-| Integration | 38 | Bundle tamper, lifecycle, performance, NCCoE demo, crucible compatibility |
-| **Total** | **159** | |
-
-## License
-
-MIT - Attested Intelligence Holdings LLC
+# AGA - Attested Governance Artifacts
+
+Cryptographic runtime governance for AI agents and autonomous systems.
+
+[![npm](https://img.shields.io/npm/v/@attested-intelligence/aga-mcp-server)](https://www.npmjs.com/package/@attested-intelligence/aga-mcp-server)
+[![PyPI](https://img.shields.io/pypi/v/aga-governance)](https://pypi.org/project/aga-governance/)
+[![License: BUSL-1.1](https://img.shields.io/badge/License-BUSL--1.1-blue.svg)](LICENSE)
+[![Tests](https://img.shields.io/badge/tests-355%2B-brightgreen)](https://github.com/attestedintelligence/AGA)
+
+```bash
+# Try it now
+pip install aga-governance
+python -m aga demo
+python -m aga verify demo-bundle.json
+```
+
+## What This Does
+
+AGA generates sealed, cryptographically signed Policy Artifacts that bind subject identity to authorized behavior and enforce that binding continuously at runtime. A two-process Portal architecture holds all cryptographic keys while the governed agent holds none - the agent cannot self-authorize, bypass enforcement, or forge receipts.
+
+**Seal. Enforce. Prove.**
+
+## Architecture
+
+```
+Policy Author          Portal (Keys)          Subject (Agent)
+     |                     |                       |
+[Seal Artifact]  ------>  [Store Reference]        |
+     |                     |                       |
+     |              [Continuous Measurement] <---- [Runtime State]
+     |                     |                       |
+     |              [Drift Detected?]              |
+     |                  /     \                    |
+     |            Yes /       \ No                 |
+     |               /         \                   |
+     |     [Enforce Action]  [Append Receipt]      |
+     |            |              |                 |
+     |     [Signed Receipt]     |                 |
+     |            |              |                 |
+     |     [Continuity Chain] <-+                 |
+     |            |                               |
+     |     [Evidence Bundle]                      |
+     |            |                               |
+     v     [Offline Verify]                       v
+```
+
+### Core Operations
+
+- **Seal:** Attest subject state, compute sealed hash (SHA-256, no delimiters), sign with Ed25519 over RFC 8785 canonical JSON
+- **Enforce:** Portal measures runtime state against sealed reference, executes enforcement on drift (7 graduated actions including phantom execution for forensic capture)
+- **Prove:** Evidence Bundles with Merkle inclusion proofs enable offline verification by any third party using only standard cryptographic libraries
+
+## Use with Claude Desktop
+
+Add to your Claude Desktop MCP config (`claude_desktop_config.json`):
+
+```json
+{
+  "mcpServers": {
+    "aga": {
+      "command": "npx",
+      "args": ["-y", "@attested-intelligence/aga-mcp-server"]
+    }
+  }
+}
+```
+
+Claude can then seal artifacts, measure integrity, generate evidence bundles, and verify compliance through natural language.
+
+## MCP Tools (20)
+
+| Category | Tools |
+|----------|-------|
+| **Identity** | `get_server_info`, `get_portal_state` |
+| **Lifecycle** | `init_chain`, `attest_subject`, `revoke_artifact` |
+| **Enforcement** | `measure_integrity`, `measure_behavior`, `verify_chain` |
+| **Evidence** | `create_checkpoint`, `generate_evidence_bundle`, `verify_bundle_offline` |
+| **Privacy** | `request_claim`, `list_claims` |
+| **Delegation** | `delegate_to_subagent` |
+| **Audit** | `get_receipts`, `get_chain_events` |
+
+## Quick Start
+
+```bash
+git clone https://github.com/attestedintelligence/AGA.git
+cd AGA
+npm install
+npm test
+```
+
+### Python SDK
+
+```bash
+pip install aga-governance
+python -m aga demo
+python -m aga verify demo-bundle.json
+```
+
+### Generate and Verify an Evidence Bundle
+
+```bash
+npx tsx scripts/generate-evidence-bundle.mjs
+node independent-verifier/verify.js aga-evidence/evidence-bundle.json
+```
+
+## MCP Governance Proxy
+
+Run AGA as a transparent proxy between any MCP client and any MCP server. Every tool call gets evaluated against policy and produces a signed receipt.
+
+```bash
+# Start the proxy with an upstream MCP server
+npx tsx src/proxy/index.ts start --upstream "npx -y @modelcontextprotocol/server-filesystem /tmp/test" --profile standard
+
+# Export the evidence bundle
+npx tsx src/proxy/index.ts export --output evidence.json
+
+# Verify
+npx tsx src/proxy/index.ts verify evidence.json
+```
+
+The proxy intercepts `tools/call` requests, evaluates them against a sealed policy artifact, and generates signed receipts. Permitted calls are forwarded to the downstream server. Denied calls return an MCP error. Every decision is hash-linked into a tamper-evident chain.
+
+Three built-in policy profiles:
+- **permissive** - log everything, block nothing (default)
+- **standard** - rate limits + blocks destructive operations
+- **restrictive** - explicit tool allowlist, all unknown tools denied
+
+## Deployment Scenarios
+
+| Scenario | Description | Key Feature |
+|----------|-------------|-------------|
+| Air-Gapped Audit | Portable evidence bundles for DDIL environments | No network connectivity required |
+| SCADA/ICS Enforcement | Real-time integrity monitoring for industrial control | O(1) receipt generation, deterministic bounds |
+| Autonomous Safe-State | Automatic transition to safe profiles on drift | 7 graduated enforcement actions |
+| Model Deployment Gate | Policy-enforced model release to production | Integrity verification before execution |
+| Cloud Governance | Cryptographic governance for cloud infrastructure | Evidence isolation, multi-tenant support |
+| SOC/IR Evidence | Incident response bundles with chain-of-custody | Forensic-grade audit trails |
+
+## Cryptographic Primitives
+
+| Primitive | Purpose |
+|-----------|---------|
+| Ed25519 | Digital signatures (artifact sealing, receipt signing) |
+| SHA-256 | Content integrity (sealed hash computation) |
+| BLAKE2b-256 | Artifact fingerprinting |
+| RFC 8785 (JCS) | Canonical JSON serialization |
+| HKDF-SHA256 | Key derivation |
+| Merkle Trees | Checkpoint anchoring to immutable storage |
+
+## Test Suite
+
+355+ automated tests (218 TypeScript + 137 Python) covering the full AGA lifecycle:
+
+```bash
+npm test                              # TypeScript tests
+cd aga-python && python -m pytest     # Python tests
+```
+
+## Project Structure
+
+```
+src/                   # Core protocol: artifacts, receipts, chain, Merkle, crypto, portal state machine
+  core/                # Governance primitives (artifact, receipt, chain, portal, bundle)
+  crypto/              # Ed25519, SHA-256, BLAKE2b, Merkle, JCS canonicalization
+  proxy/               # MCP governance proxy (transparent interception + policy enforcement)
+  tools/               # MCP tool handlers (20 tools)
+  middleware/          # Zero-trust governance enforcement wrapper
+aga-python/            # Python SDK with @governed decorator (PyPI: aga-governance)
+independent-verifier/  # Standalone verifier with zero AGA imports
+scenarios/             # Deployment scenarios (SCADA, drone, AI agent)
+tests/                 # TypeScript test suite (218 tests)
+```
+
+## Links
+
+- [Website](https://attestedintelligence.com)
+- [Technology](https://attestedintelligence.com/technology)
+- [Diligence Materials](https://attestedintelligence.com/diligence)
+- [MCP Server (npm)](https://www.npmjs.com/package/@attested-intelligence/aga-mcp-server)
+- [Python SDK (PyPI)](https://pypi.org/project/aga-governance/)
+- [Interactive Verifier](https://attestedintelligence.com/verify)
+
+## Security
+
+See [SECURITY.md](SECURITY.md) for vulnerability reporting.
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup and guidelines.
+
+## License
+
+[BUSL-1.1](LICENSE) - Business Source License 1.1
+
+---
+
+Attested Intelligence Holdings LLC

package/SECURITY.md

@@ -0,0 +1,59 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in AGA, please report it responsibly.
+
+**Email:** [admin@attestedintelligence.com](mailto:admin@attestedintelligence.com)
+
+**Subject line:** `[SECURITY] AGA Vulnerability Report`
+
+### What to Include
+
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact assessment
+- Suggested fix (if you have one)
+
+### Response Timeline
+
+- **Acknowledgment:** Within 48 hours of receipt
+- **Initial assessment:** Within 5 business days
+- **Resolution target:** Dependent on severity, typically within 30 days for critical issues
+
+### Scope
+
+This policy covers:
+
+- The AGA reference implementation (`src/`, `independent-verifier/`)
+- The MCP server (`@attested-intelligence/aga-mcp-server`)
+- Cryptographic operations (signing, verification, hash computation, chain integrity)
+- Evidence Bundle generation and verification
+
+### Out of Scope
+
+- The attestedintelligence.com website (report separately to the same email)
+- Third-party dependencies (report to the upstream maintainer, but let us know)
+- Social engineering or phishing attacks
+
+### Cryptographic Considerations
+
+AGA relies on Ed25519 signatures, SHA-256 hashing, BLAKE2b-256 fingerprinting, and Merkle tree anchoring. If you identify a weakness in how these primitives are applied (not the primitives themselves), that is a valid report.
+
+Key areas of concern:
+
+- Sealed hash computation correctness
+- Receipt chain integrity (hash linking)
+- Merkle checkpoint verification
+- Key separation enforcement between Portal and agent
+- Evidence Bundle completeness and tamper detection
+
+### Disclosure
+
+We follow coordinated disclosure. Please do not publicly disclose vulnerabilities until we have released a fix or 90 days have elapsed, whichever comes first.
+
+We do not currently operate a bug bounty program.
+
+---
+
+Attested Intelligence Holdings LLC

package/dist/adapters/openclaw.d.ts

@@ -0,0 +1,43 @@
+/**
+ * OpenClaw Config Adapter
+ * Detects and patches openclaw.json to route MCP servers through the AGA governance proxy.
+ *
+ * All OpenClaw assumptions are documented inline. When a real OpenClaw instance
+ * becomes available, validate each assumption.
+ *
+ * Patent: USPTO App. No. 19/433,835
+ * Copyright (c) 2026 Attested Intelligence Holdings LLC
+ * SPDX-License-Identifier: MIT
+ */
+export interface McpServerConfig {
+    name: string;
+    command?: string;
+    args?: string[];
+    url?: string;
+    env?: Record<string, string>;
+    [key: string]: unknown;
+}
+export interface AgentConfigAdapter {
+    detect(configPath?: string): Promise<{
+        found: boolean;
+        path: string;
+        version?: string;
+    }>;
+    readMcpServers(): Promise<McpServerConfig[]>;
+    patchMcpServers(proxyPort: number, originals: McpServerConfig[]): Promise<void>;
+    restore(): Promise<void>;
+}
+export declare class OpenClawAdapter implements AgentConfigAdapter {
+    private configPath;
+    private backupPath;
+    private getDefaultPath;
+    detect(configPath?: string): Promise<{
+        found: boolean;
+        path: string;
+        version?: string;
+    }>;
+    readMcpServers(): Promise<McpServerConfig[]>;
+    patchMcpServers(proxyPort: number, originals: McpServerConfig[]): Promise<void>;
+    restore(): Promise<void>;
+}
+//# sourceMappingURL=openclaw.d.ts.map

package/dist/adapters/openclaw.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openclaw.d.ts","sourceRoot":"","sources":["../../src/adapters/openclaw.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAmBH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzF,cAAc,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC7C,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,qBAAa,eAAgB,YAAW,kBAAkB;IACxD,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,UAAU,CAAuB;IAEzC,OAAO,CAAC,cAAc;IAIhB,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAqBxF,cAAc,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAW5C,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA6B/E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAU/B"}

package/dist/adapters/openclaw.js

@@ -0,0 +1,86 @@
+/**
+ * OpenClaw Config Adapter
+ * Detects and patches openclaw.json to route MCP servers through the AGA governance proxy.
+ *
+ * All OpenClaw assumptions are documented inline. When a real OpenClaw instance
+ * becomes available, validate each assumption.
+ *
+ * Patent: USPTO App. No. 19/433,835
+ * Copyright (c) 2026 Attested Intelligence Holdings LLC
+ * SPDX-License-Identifier: MIT
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+export class OpenClawAdapter {
+    configPath = null;
+    backupPath = null;
+    getDefaultPath() {
+        return path.join(os.homedir(), '.openclaw', 'openclaw.json');
+    }
+    async detect(configPath) {
+        const p = configPath ?? this.getDefaultPath();
+        this.configPath = p;
+        this.backupPath = p + '.aga-backup';
+        if (!fs.existsSync(p)) {
+            return { found: false, path: p };
+        }
+        try {
+            const config = JSON.parse(fs.readFileSync(p, 'utf-8'));
+            return {
+                found: true,
+                path: p,
+                version: config.version ?? config.openclaw_version ?? undefined,
+            };
+        }
+        catch {
+            return { found: false, path: p };
+        }
+    }
+    async readMcpServers() {
+        if (!this.configPath)
+            throw new Error('Call detect() first');
+        const config = JSON.parse(fs.readFileSync(this.configPath, 'utf-8'));
+        const servers = config.mcpServers ?? {};
+        return Object.entries(servers).map(([name, entry]) => ({
+            name,
+            ...entry,
+        }));
+    }
+    async patchMcpServers(proxyPort, originals) {
+        if (!this.configPath || !this.backupPath)
+            throw new Error('Call detect() first');
+        // Backup original
+        const originalContent = fs.readFileSync(this.configPath, 'utf-8');
+        fs.writeFileSync(this.backupPath, originalContent);
+        const config = JSON.parse(originalContent);
+        // Rewrite each MCP server entry to point at the proxy
+        // The proxy will forward to the original command/URL
+        for (const server of originals) {
+            if (config.mcpServers?.[server.name]) {
+                const original = config.mcpServers[server.name];
+                // Store original config for the proxy to use
+                config.mcpServers[server.name] = {
+                    // Point at proxy instead
+                    url: `http://127.0.0.1:${proxyPort}`,
+                    // Preserve metadata
+                    _aga_original: original,
+                    _aga_governed: true,
+                };
+            }
+        }
+        fs.writeFileSync(this.configPath, JSON.stringify(config, null, 2));
+    }
+    async restore() {
+        if (!this.configPath || !this.backupPath)
+            throw new Error('Call detect() first');
+        if (fs.existsSync(this.backupPath)) {
+            fs.copyFileSync(this.backupPath, this.configPath);
+            fs.unlinkSync(this.backupPath);
+        }
+        else {
+            throw new Error('No backup found - cannot restore');
+        }
+    }
+}
+//# sourceMappingURL=openclaw.js.map

package/dist/adapters/openclaw.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openclaw.js","sourceRoot":"","sources":["../../src/adapters/openclaw.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AA+B9B,MAAM,OAAO,eAAe;IAClB,UAAU,GAAkB,IAAI,CAAC;IACjC,UAAU,GAAkB,IAAI,CAAC;IAEjC,cAAc;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAmB;QAC9B,MAAM,CAAC,GAAG,UAAU,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC,UAAU,GAAG,CAAC,GAAG,aAAa,CAAC;QAEpC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACnC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YACvD,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,CAAC;gBACP,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,gBAAgB,IAAI,SAAS;aAChE,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACnC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAE7D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACrD,IAAI;YACJ,GAAI,KAAiC;SACtC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,SAA4B;QACnE,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAEjF,kBAAkB;QAClB,MAAM,eAAe,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAClE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAE3C,sDAAsD;QACtD,qDAAqD;QACrD,KAAK,MAAM,MAAM,IAAI,SAAS,EAAE,CAAC;YAC/B,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAEhD,6CAA6C;gBAC7C,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG;oBAC/B,yBAAyB;oBACzB,GAAG,EAAE,oBAAoB,SAAS,EAAE;oBACpC,oBAAoB;oBACpB,aAAa,EAAE,QAAQ;oBACvB,aAAa,EAAE,IAAI;iBACpB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAEjF,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACnC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YAClD,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;CACF"}

package/dist/core/bundle.d.ts

@@ -1,6 +1,13 @@
 import type { KeyPair, MerkleInclusionProof } from '../crypto/types.js';
-import type { EvidenceBundle, PolicyArtifact, SignedReceipt, CheckpointReference } from './types.js';
-export declare function generateBundle(artifact: PolicyArtifact, receipts: SignedReceipt[], proofs: MerkleInclusionProof[], checkpoint: CheckpointReference, kp: KeyPair): EvidenceBundle;
+import type { EvidenceBundle, PolicyArtifact, SignedReceipt, CheckpointReference, VerificationTier } from './types.js';
+/**
+ * Generate an evidence bundle. Original signature preserved for backward compatibility.
+ * Tiered bundle generation (CAISI §3b):
+ *   BRONZE - artifact + receipts only (proofs omitted)
+ *   SILVER - artifact + receipts + Merkle proofs
+ *   GOLD   - artifact + receipts + Merkle proofs + anchor checkpoint reference
+ */
+export declare function generateBundle(artifact: PolicyArtifact, receipts: SignedReceipt[], proofs: MerkleInclusionProof[], checkpoint: CheckpointReference, kp: KeyPair, tier?: VerificationTier): EvidenceBundle;
 export interface VerificationResult {
     step1_artifact_sig: boolean;
     step2_receipt_sigs: boolean;

package/dist/core/bundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../../src/core/bundle.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAErG,wBAAgB,cAAc,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,UAAU,EAAE,mBAAmB,EAAE,EAAE,EAAE,OAAO,GAAG,cAAc,CAGhL;AAED,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,EAAE,OAAO,CAAC;IAAC,kBAAkB,EAAE,OAAO,CAAC;IACzD,mBAAmB,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,iBAAiB,GAAG,OAAO,CAAC;IACxE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;CACpC;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,GAAG,kBAAkB,CAanG"}
+{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../../src/core/bundle.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEvH;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,UAAU,EAAE,mBAAmB,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,gBAAgB,GAAG,cAAc,CAUzM;AAED,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,EAAE,OAAO,CAAC;IAAC,kBAAkB,EAAE,OAAO,CAAC;IACzD,mBAAmB,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,iBAAiB,GAAG,OAAO,CAAC;IACxE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;CACpC;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,GAAG,kBAAkB,CAanG"}

package/dist/core/bundle.js

@@ -1,8 +1,22 @@
 import { signStr, sigToB64, b64ToSig, hexToPk, verifyStr, pkToHex } from '../crypto/sign.js';
 import { verifyProof } from '../crypto/merkle.js';
 import { canonicalize } from '../utils/canonical.js';
-export function generateBundle(artifact, receipts, proofs, checkpoint, kp) {
-    const unsigned = { artifact, receipts, merkle_proofs: proofs, checkpoint_reference: checkpoint, public_key: pkToHex(kp.publicKey) };
+/**
+ * Generate an evidence bundle. Original signature preserved for backward compatibility.
+ * Tiered bundle generation (CAISI §3b):
+ *   BRONZE - artifact + receipts only (proofs omitted)
+ *   SILVER - artifact + receipts + Merkle proofs
+ *   GOLD   - artifact + receipts + Merkle proofs + anchor checkpoint reference
+ */
+export function generateBundle(artifact, receipts, proofs, checkpoint, kp, tier) {
+    const effectiveTier = tier ?? 'GOLD';
+    const bundleProofs = effectiveTier === 'BRONZE' ? [] : proofs;
+    const bundleCheckpoint = effectiveTier === 'GOLD' ? checkpoint : {
+        ...checkpoint,
+        transaction_id: effectiveTier === 'BRONZE' ? '' : checkpoint.transaction_id,
+        anchor_network: effectiveTier === 'BRONZE' ? '' : checkpoint.anchor_network,
+    };
+    const unsigned = { artifact, receipts, merkle_proofs: bundleProofs, checkpoint_reference: bundleCheckpoint, public_key: pkToHex(kp.publicKey), verification_tier: effectiveTier };
     return { ...unsigned, bundle_signature: sigToB64(signStr(canonicalize(unsigned), kp.secretKey)) };
 }
 export function verifyBundleOffline(bundle, pinnedPkHex) {

package/dist/core/bundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../../src/core/bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAIrD,MAAM,UAAU,cAAc,CAAC,QAAwB,EAAE,QAAyB,EAAE,MAA8B,EAAE,UAA+B,EAAE,EAAW;IAC9J,MAAM,QAAQ,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,oBAAoB,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;IACpI,OAAO,EAAE,GAAG,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;AACpG,CAAC;AAQD,MAAM,UAAU,mBAAmB,CAAC,MAAsB,EAAE,WAAmB;IAC7E,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;IACnD,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAClD,IAAI,EAAE,GAAG,IAAI,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAAC,EAAE,GAAG,KAAK,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,UAAU,aAAa,CAAC,CAAC;QAAC,CAAC;IAC9J,CAAC;IACD,IAAI,EAAE,GAAG,IAAI,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,EAAE,GAAG,KAAK,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAAC,CAAC;IAAC,CAAC;IACtI,OAAO,EAAE,kBAAkB,EAAE,EAAE,EAAE,kBAAkB,EAAE,EAAE,EAAE,mBAAmB,EAAE,EAAE,EAAE,YAAY,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC;AACvJ,CAAC"}
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../../src/core/bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAIrD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,QAAwB,EAAE,QAAyB,EAAE,MAA8B,EAAE,UAA+B,EAAE,EAAW,EAAE,IAAuB;IACvL,MAAM,aAAa,GAAG,IAAI,IAAI,MAAM,CAAC;IACrC,MAAM,YAAY,GAAG,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9D,MAAM,gBAAgB,GAAwB,aAAa,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QACpF,GAAG,UAAU;QACb,cAAc,EAAE,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc;QAC3E,cAAc,EAAE,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc;KAC5E,CAAC;IACF,MAAM,QAAQ,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC;IAClL,OAAO,EAAE,GAAG,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;AACpG,CAAC;AAQD,MAAM,UAAU,mBAAmB,CAAC,MAAsB,EAAE,WAAmB;IAC7E,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;IACnD,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAClD,IAAI,EAAE,GAAG,IAAI,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAAC,EAAE,GAAG,KAAK,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,UAAU,aAAa,CAAC,CAAC;QAAC,CAAC;IAC9J,CAAC;IACD,IAAI,EAAE,GAAG,IAAI,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,EAAE,GAAG,KAAK,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAAC,CAAC;IAAC,CAAC;IACtI,OAAO,EAAE,kBAAkB,EAAE,EAAE,EAAE,kBAAkB,EAAE,EAAE,EAAE,mBAAmB,EAAE,EAAE,EAAE,YAAY,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC;AACvJ,CAAC"}

package/dist/core/identity.d.ts

@@ -1,14 +1,23 @@
+import type { KeyPair } from '../crypto/types.js';
+import type { ContinuityEvent } from './types.js';
+export { keyFingerprint } from '../crypto/sign.js';
 /**
- * Identity operations: key fingerprinting, validation, rotation.
+ * Check whether a key is still valid given its issuance time and TTL.
+ * NCCoE §2: non-biometric identity validity check.
  */
-import { keyFingerprint, isKeyValid } from '../crypto/keys.js';
-import type { KeyPair } from '../types.js';
-export { keyFingerprint, isKeyValid };
-export interface KeyRotationResult {
+export declare function isKeyValid(issuedAt: string, ttlSeconds: number): boolean;
+/**
+ * Generate a new key pair for rotation, returning both old and new for
+ * a transition period defined by policy. NCCoE §3: key rotation.
+ */
+export declare function rotateKeyPair(currentKeyPair: KeyPair): {
+    oldKeyPair: KeyPair;
     newKeyPair: KeyPair;
-    newPublicKeyHex: string;
-    oldPublicKeyHex: string;
-    rotatedAt: string;
-}
-export declare function rotateKeys(oldKP: KeyPair): KeyRotationResult;
+};
+/**
+ * Record a key rotation event on the continuity chain.
+ * NCCoE §3: "Key rotation is handled by including both old and new public keys
+ * during a transition period defined by policy."
+ */
+export declare function recordKeyRotation(prevEvent: ContinuityEvent, keypairType: string, oldPublicKeyHex: string, newPublicKeyHex: string, reason: string, signingKeyPair: KeyPair): ContinuityEvent;
 //# sourceMappingURL=identity.d.ts.map

package/dist/core/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/core/identity.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,cAAc,EAAE,UAAU,EAAiB,MAAM,mBAAmB,CAAC;AAE9E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;AAEtC,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,OAAO,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,CAQ5D"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/core/identity.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAqB,MAAM,YAAY,CAAC;AAGrE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAExE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,cAAc,EAAE,OAAO,GAAG;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CAGnG;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,eAAe,EAC1B,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,EACvB,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,OAAO,GACtB,eAAe,CAUjB"}