@attestry/sdk 0.6.0

package/dist/resources/abac-policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"abac-policies.js","sourceRoot":"","sources":["../../src/resources/abac-policies.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,mEAAmE;AACnE,6BAA6B;AAC7B,EAAE;AACF,0EAA0E;AAC1E,0EAA0E;AAC1E,0EAA0E;AAC1E,0EAA0E;AAC1E,0EAA0E;AAC1E,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,uEAAuE;AACvE,uEAAuE;AACvE,oEAAoE;AACpE,kEAAkE;AAClE,kEAAkE;AAClE,mEAAmE;AACnE,6BAA6B;AAC7B,EAAE;AACF,wDAAwD;AACxD,8DAA8D;AAC9D,oEAAoE;AACpE,kEAAkE;AAClE,kEAAkE;AAClE,iEAAiE;AACjE,oEAAoE;AACpE,oEAAoE;AACpE,kEAAkE;AAClE,EAAE;AACF,6DAA6D;AAC7D,oEAAoE;AACpE,sEAAsE;AACtE,gEAAgE;AAChE,+DAA+D;AAC/D,EAAE;AACF,sEAAsE;AACtE,qEAAqE;AACrE,sBAAsB;AACtB,oEAAoE;AACpE,iEAAiE;AACjE,uEAAuE;AACvE,qEAAqE;AACrE,aAAa;AACb,uEAAuE;AACvE,sDAAsD;AACtD,qEAAqE;AACrE,gEAAgE;AAChE,gEAAgE;AAChE,4DAA4D;AAC5D,8DAA8D;AAC9D,uEAAuE;AACvE,+DAA+D;AAC/D,iEAAiE;AACjE,qEAAqE;AACrE,6DAA6D;AAC7D,4DAA4D;AAC5D,gEAAgE;AAChE,mEAAmE;AACnE,gDAAgD;AAChD,uEAAuE;AACvE,iEAAiE;AACjE,4DAA4D;AAC5D,EAAE;AACF,0EAA0E;AAC1E,iEAAiE;AACjE,qEAAqE;AACrE,qEAAqE;AACrE,mEAAmE;AACnE,oEAAoE;AACpE,oEAAoE;AACpE,kEAAkE;AAClE,kDAAkD;AAClD,EAAE;AACF,qEAAqE;AACrE,kEAAkE;AAClE,mEAAmE;AACnE,qEAAqE;AACrE,qEAAqE;AACrE,0CAA0C;AAC1C,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,gEAAgE;AAChE,4CAA4C;AAC5C,EAAE;AACF,+DAA+D;AAC/D,iEAAiE;AACjE,8CAA8C;AAG9C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,+EAA+E;AAC/E,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,wEAAwE;AACxE,sEAAsE;AACtE,8BAA8B;AAC9B,EAAE;AACF,yEAAyE;AACzE,kEAAkE;AAClE,wBAAwB;AACxB,EAAE;AACF,kEAAkE;AAClE,sEAAsE;AACtE,6CAA6C;AAE7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CAAC;IACjD,SAAS;IACT,aAAa;IACb,WAAW;IACX,cAAc;IACd,UAAU;IACV,OAAO;IACP,UAAU;IACV,WAAW;IACX,cAAc;IACd,aAAa;CACL,CAAC,CAAC;AAEZ;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/C,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,QAAQ;CACA,CAAC,CAAC;AAEZ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,MAAM,CAAU,CAAC,CAAC;AAE7E,+EAA+E;AAC/E,EAAE;AACF,qEAAqE;AACrE,mEAAmE;AACnE,oCAAoC;AAEpC,iFAAiF;AACjF,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACnC,0EAA0E;AAC1E,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAC3C,qEAAqE;AACrE,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,wEAAwE;AACxE,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,+EAA+E;AAC/E,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,kEAAkE;AAClE,mEAAmE;AACnE,sEAAsE;AACtE,gEAAgE;AAChE,+DAA+D;AAC/D,mEAAmE;AACnE,oDAAoD;AACpD,EAAE;AACF,sEAAsE;AACtE,qEAAqE;AACrE,yDAAyD;AACzD,sEAAsE;AACtE,mEAAmE;AACnE,oEAAoE;AACpE,oEAAoE;AACpE,qEAAqE;AACrE,qEAAqE;AACrE,qDAAqD;AACrD,MAAM,UAAU,GACd,+EAA+E,CAAC;AAElF,8DAA8D;AAC9D,sEAAsE;AACtE,kEAAkE;AAClE,qEAAqE;AACrE,2DAA2D;AAC3D,EAAE;AACF,mEAAmE;AACnE,uEAAuE;AACvE,+DAA+D;AAC/D,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;AAoXnC,+EAA+E;AAE/E;;;;;;;GAOG;AACH,MAAM,OAAO,oBAAoB;IACF;IAA7B,YAA6B,MAAsB;QAAtB,WAAM,GAAN,MAAM,CAAgB;IAAG,CAAC;IAEvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+GG;IACH,IAAI,CACF,OAAwB;QAExB,OAAO,IAAI,CAAC,MAAM;aACf,QAAQ,CAA2B;YAClC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,uBAAuB;YAC7B,OAAO;SACR,CAAC;aACD,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,gCAAgC,CAAC,MAAM,CAAC,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmKG;IACH,MAAM,CACJ,KAA4B,EAC5B,OAAwB;QAExB,uCAAuC;QACvC,IACE,KAAK,KAAK,IAAI;YACd,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EACpB,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,8DAA8D;gBAC5D,0DAA0D;gBAC1D,iDAAiD,CACpD,CAAC;QACJ,CAAC;QAED,4DAA4D;QAC5D,wDAAwD;QACxD,yDAAyD;QACzD,4DAA4D;QAC5D,yDAAyD;QACzD,gEAAgE;QAChE,6DAA6D;QAC7D,yDAAyD;QACzD,0DAA0D;QAC1D,sDAAsD;QACtD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAY,OAAO;YAC9B,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,qBAAqB,CAAC;YACtD,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,cAAc,GAAG,YAAY,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QAC1D,MAAM,cAAc,GAAY,cAAc;YAC5C,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE,qBAAqB,CAAC;YAC7D,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACpD,MAAM,WAAW,GAAY,WAAW;YACtC,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,qBAAqB,CAAC;YAC1D,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAChD,MAAM,SAAS,GAAY,SAAS;YAClC,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,qBAAqB,CAAC;YACxD,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAChD,MAAM,SAAS,GAAY,SAAS;YAClC,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,qBAAqB,CAAC;YACxD,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACtD,MAAM,YAAY,GAAY,YAAY;YACxC,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,WAAW,EAAE,qBAAqB,CAAC;YAC3D,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACpD,MAAM,WAAW,GAAY,WAAW;YACtC,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,qBAAqB,CAAC;YAC1D,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,UAAU,GAAY,UAAU;YACpC,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,qBAAqB,CAAC;YACzD,CAAC,CAAC,SAAS,CAAC;QAEd,2EAA2E;QAE3E,kDAAkD;QAClD,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,IAAI,SAAS,CACjB,iDAAiD;gBAC/C,QAAQ,YAAY,CAAC,OAAO,CAAC,GAAG,CACnC,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,SAAS,CACjB,wDAAwD,CACzD,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;YAC5C,MAAM,IAAI,SAAS,CACjB,mEAAmE;gBACjE,GAAG,sBAAsB,eAAe,OAAO,CAAC,MAAM,GAAG,CAC5D,CAAC;QACJ,CAAC;QAED,mCAAmC;QACnC,IAAI,CAAC,WAAW,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9C,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,SAAS,CACjB,qDAAqD;gBACnD,QAAQ,YAAY,CAAC,WAAW,CAAC,GAAG,CACvC,CAAC;QACJ,CAAC;QACD,IACE,CAAE,qBAA2C,CAAC,QAAQ,CAAC,WAAW,CAAC,EACnE,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,mDAAmD;gBACjD,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,WAAW,IAAI,CACjE,CAAC;QACJ,CAAC;QAED,iCAAiC;QACjC,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,SAAS,CACjB,mDAAmD;gBACjD,QAAQ,YAAY,CAAC,SAAS,CAAC,GAAG,CACrC,CAAC;QACJ,CAAC;QACD,IAAI,CAAE,mBAAyC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,SAAS,CACjB,iDAAiD;gBAC/C,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,SAAS,IAAI,CAC7D,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,IAAI,CAAC,YAAY,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAChD,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;QACtE,CAAC;QACD,IACE,YAAY,KAAK,IAAI;YACrB,OAAO,YAAY,KAAK,QAAQ;YAChC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAC3B,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,+DAA+D;gBAC7D,QAAQ,YAAY,CAAC,YAAY,CAAC,+BAA+B;gBACjE,sDAAsD,CACzD,CAAC;QACJ,CAAC;QAED,0EAA0E;QAE1E,iEAAiE;QACjE,iEAAiE;QACjE,iEAAiE;QACjE,6DAA6D;QAC7D,iEAAiE;QACjE,gEAAgE;QAChE,8DAA8D;QAC9D,6DAA6D;QAC7D,oEAAoE;QACpE,2DAA2D;QAC3D,2BAA2B;QAC3B,IAAI,cAAc,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACnD,IAAI,cAAc,KAAK,IAAI,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;gBAClE,MAAM,IAAI,SAAS,CACjB,gEAAgE;oBAC9D,qBAAqB,YAAY,CAAC,cAAc,CAAC,GAAG,CACvD,CAAC;YACJ,CAAC;YACD,IACE,OAAO,cAAc,KAAK,QAAQ;gBAClC,cAAc,CAAC,MAAM,GAAG,6BAA6B,EACrD,CAAC;gBACD,MAAM,IAAI,SAAS,CACjB,gEAAgE;oBAC9D,aAAa,6BAA6B,SAAS;oBACnD,QAAQ,cAAc,CAAC,MAAM,GAAG,CACnC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,IAAI,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACzC,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,IAAI,SAAS,CACjB,gEAAgE;oBAC9D,QAAQ,YAAY,CAAC,SAAS,CAAC,GAAG,CACrC,CAAC;YACJ,CAAC;YACD,IAAI,CAAE,mBAAyC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,SAAS,CACjB,iDAAiD;oBAC/C,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,SAAS,IAAI,CAC7D,CAAC;YACJ,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,IAAI,WAAW,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC7C,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrE,MAAM,IAAI,SAAS,CACjB,iEAAiE;oBAC/D,gBAAgB,YAAY,CAAC,WAAW,CAAC,GAAG,CAC/C,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,SAAS,CACjB,4DAA4D;oBAC1D,gBAAgB,WAAW,GAAG,CACjC,CAAC;YACJ,CAAC;YACD,IACE,WAAW,GAAG,mBAAmB;gBACjC,WAAW,GAAG,mBAAmB,EACjC,CAAC;gBACD,MAAM,IAAI,SAAS,CACjB,qDAAqD;oBACnD,IAAI,mBAAmB,KAAK,mBAAmB,IAAI;oBACnD,QAAQ,WAAW,GAAG,CACzB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,IAAI,UAAU,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC3C,IAAI,OAAO,UAAU,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,SAAS,CACjB,kEAAkE;oBAChE,QAAQ,YAAY,CAAC,UAAU,CAAC,GAAG,CACtC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,MAAM,IAAI,GAA4B;YACpC,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,WAAW;YACrB,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,YAAY;SACxB,CAAC;QACF,IAAI,cAAc,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACnD,gEAAgE;YAChE,4DAA4D;YAC5D,+DAA+D;YAC/D,8DAA8D;YAC9D,oDAAoD;YACpD,IAAI,CAAC,WAAW,GAAG,cAAc,CAAC;QACpC,CAAC;QACD,IAAI,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACzC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QAC1B,CAAC;QACD,IAAI,WAAW,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC7C,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC;QAC9B,CAAC;QACD,IAAI,UAAU,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC3C,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC;QAC5B,CAAC;QAED,OAAO,IAAI,CAAC,MAAM;aACf,QAAQ,CAAa;YACpB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,uBAAuB;YAC7B,IAAI;YACJ,OAAO;SACR,CAAC;aACD,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuHG;IACH,QAAQ,CAAC,EAAU,EAAE,OAAwB;QAC3C,mBAAmB,CAAC,EAAE,EAAE,uBAAuB,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC,MAAM;aACf,QAAQ,CAAa;YACpB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,yBAAyB,EAAE,EAAE;YACnC,OAAO;SACR,CAAC;aACD,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgJG;IACH,MAAM,CACJ,EAAU,EACV,KAA4B,EAC5B,OAAwB;QAExB,8DAA8D;QAC9D,0DAA0D;QAC1D,gBAAgB;QAChB,mBAAmB,CAAC,EAAE,EAAE,qBAAqB,CAAC,CAAC;QAE/C,+DAA+D;QAC/D,+DAA+D;QAC/D,kCAAkC;QAClC,IACE,KAAK,KAAK,IAAI;YACd,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EACpB,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,iEAAiE;gBAC/D,gEAAgE;gBAChE,yDAAyD,CAC5D,CAAC;QACJ,CAAC;QAED,4DAA4D;QAC5D,mEAAmE;QACnE,+DAA+D;QAC/D,mEAAmE;QACnE,8DAA8D;QAC9D,kEAAkE;QAClE,iEAAiE;QACjE,kCAAkC;QAClC,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAY,OAAO;YAC9B,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,qBAAqB,CAAC;YACtD,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,cAAc,GAAG,YAAY,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QAC1D,MAAM,cAAc,GAAY,cAAc;YAC5C,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE,qBAAqB,CAAC;YAC7D,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACpD,MAAM,WAAW,GAAY,WAAW;YACtC,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,qBAAqB,CAAC;YAC1D,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAChD,MAAM,SAAS,GAAY,SAAS;YAClC,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,qBAAqB,CAAC;YACxD,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAChD,MAAM,SAAS,GAAY,SAAS;YAClC,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,qBAAqB,CAAC;YACxD,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACtD,MAAM,YAAY,GAAY,YAAY;YACxC,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,WAAW,EAAE,qBAAqB,CAAC;YAC3D,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACpD,MAAM,WAAW,GAAY,WAAW;YACtC,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,qBAAqB,CAAC;YAC1D,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,UAAU,GAAY,UAAU;YACpC,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,qBAAqB,CAAC;YACzD,CAAC,CAAC,SAAS,CAAC;QAEd,0EAA0E;QAC1E,0DAA0D;QAC1D,mEAAmE;QACnE,oEAAoE;QACpE,UAAU;QAEV,uDAAuD;QACvD,IAAI,OAAO,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAChC,MAAM,IAAI,SAAS,CACjB,8DAA8D;oBAC5D,QAAQ,YAAY,CAAC,OAAO,CAAC,GAAG,CACnC,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,SAAS,CACjB,qEAAqE,CACtE,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;gBAC5C,MAAM,IAAI,SAAS,CACjB,gEAAgE;oBAC9D,MAAM,sBAAsB,eAAe,OAAO,CAAC,MAAM,GAAG,CAC/D,CAAC;YACJ,CAAC;QACH,CAAC;QAED,0DAA0D;QAC1D,+DAA+D;QAC/D,IAAI,cAAc,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACnD,IAAI,cAAc,KAAK,IAAI,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;gBAClE,MAAM,IAAI,SAAS,CACjB,gEAAgE;oBAC9D,qBAAqB,YAAY,CAAC,cAAc,CAAC,GAAG,CACvD,CAAC;YACJ,CAAC;YACD,IACE,OAAO,cAAc,KAAK,QAAQ;gBAClC,cAAc,CAAC,MAAM,GAAG,6BAA6B,EACrD,CAAC;gBACD,MAAM,IAAI,SAAS,CACjB,gEAAgE;oBAC9D,aAAa,6BAA6B,SAAS;oBACnD,QAAQ,cAAc,CAAC,MAAM,GAAG,CACnC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,IAAI,WAAW,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC7C,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;gBACpC,MAAM,IAAI,SAAS,CACjB,kEAAkE;oBAChE,QAAQ,YAAY,CAAC,WAAW,CAAC,GAAG,CACvC,CAAC;YACJ,CAAC;YACD,IACE,CAAE,qBAA2C,CAAC,QAAQ,CAAC,WAAW,CAAC,EACnE,CAAC;gBACD,MAAM,IAAI,SAAS,CACjB,mDAAmD;oBACjD,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,WAAW,IAAI,CACjE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,sCAAsC;QACtC,IAAI,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACzC,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,IAAI,SAAS,CACjB,gEAAgE;oBAC9D,QAAQ,YAAY,CAAC,SAAS,CAAC,GAAG,CACrC,CAAC;YACJ,CAAC;YACD,IAAI,CAAE,mBAAyC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,SAAS,CACjB,iDAAiD;oBAC/C,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,SAAS,IAAI,CAC7D,CAAC;YACJ,CAAC;QACH,CAAC;QAED,sCAAsC;QACtC,IAAI,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACzC,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,IAAI,SAAS,CACjB,gEAAgE;oBAC9D,QAAQ,YAAY,CAAC,SAAS,CAAC,GAAG,CACrC,CAAC;YACJ,CAAC;YACD,IAAI,CAAE,mBAAyC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,SAAS,CACjB,iDAAiD;oBAC/C,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,SAAS,IAAI,CAC7D,CAAC;YACJ,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,IAAI,YAAY,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/C,IACE,YAAY,KAAK,IAAI;gBACrB,OAAO,YAAY,KAAK,QAAQ;gBAChC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAC3B,CAAC;gBACD,MAAM,IAAI,SAAS,CACjB,+DAA+D;oBAC7D,qBAAqB,YAAY,CAAC,YAAY,CAAC,SAAS;oBACxD,wDAAwD;oBACxD,sBAAsB,CACzB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,8CAA8C;QAC9C,IAAI,WAAW,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC7C,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrE,MAAM,IAAI,SAAS,CACjB,iEAAiE;oBAC/D,gBAAgB,YAAY,CAAC,WAAW,CAAC,GAAG,CAC/C,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,SAAS,CACjB,4DAA4D;oBAC1D,gBAAgB,WAAW,GAAG,CACjC,CAAC;YACJ,CAAC;YACD,IACE,WAAW,GAAG,mBAAmB;gBACjC,WAAW,GAAG,mBAAmB,EACjC,CAAC;gBACD,MAAM,IAAI,SAAS,CACjB,qDAAqD;oBACnD,IAAI,mBAAmB,KAAK,mBAAmB,IAAI;oBACnD,QAAQ,WAAW,GAAG,CACzB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,mCAAmC;QACnC,IAAI,UAAU,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC3C,IAAI,OAAO,UAAU,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,SAAS,CACjB,kEAAkE;oBAChE,QAAQ,YAAY,CAAC,UAAU,CAAC,GAAG,CACtC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,IAAI,OAAO,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC;QACtB,CAAC;QACD,IAAI,cAAc,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACnD,6DAA6D;YAC7D,IAAI,CAAC,WAAW,GAAG,cAAc,CAAC;QACpC,CAAC;QACD,IAAI,WAAW,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC7C,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC;QAC9B,CAAC;QACD,IAAI,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACzC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QAC1B,CAAC;QACD,IAAI,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACzC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QAC1B,CAAC;QACD,IAAI,YAAY,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/C,IAAI,CAAC,SAAS,GAAG,YAAY,CAAC;QAChC,CAAC;QACD,IAAI,WAAW,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC7C,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC;QAC9B,CAAC;QACD,IAAI,UAAU,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC3C,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC;QAC5B,CAAC;QAED,0EAA0E;QAC1E,iEAAiE;QACjE,mEAAmE;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,8CAA8C;QAC9C,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,SAAS,CACjB,mEAAmE;gBACjE,gEAAgE;gBAChE,8DAA8D;gBAC9D,aAAa,CAChB,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,MAAM;aACf,QAAQ,CAAa;YACpB,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,yBAAyB,EAAE,EAAE;YACnC,IAAI;YACJ,OAAO;SACR,CAAC;aACD,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyHG;IACH,MAAM,CAAC,EAAU,EAAE,OAAwB;QACzC,mBAAmB,CAAC,EAAE,EAAE,qBAAqB,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,MAAM;aACf,QAAQ,CAAa;YACpB,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,yBAAyB,EAAE,EAAE;YACnC,OAAO;SACR,CAAC;aACD,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACzE,CAAC;CACF;AAED,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,mBAAmB,CAAC,EAAW,EAAE,UAAkB;IAC1D,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CAAC,GAAG,UAAU,qCAAqC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CACjB,GAAG,UAAU,+CAA+C;YAC1D,iEAAiE;YACjE,yCAAyC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,CACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,gCAAgC,CACvC,MAAe;IAEf,IACE,MAAM,KAAK,IAAI;QACf,OAAO,MAAM,KAAK,QAAQ;QAC1B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EACrB,CAAC;QACD,MAAM,IAAI,aAAa,CACrB,iEAAiE;YAC/D,QAAQ,YAAY,CAAC,MAAM,CAAC,GAAG,CAClC,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAE9C,iEAAiE;IACjE,iEAAiE;IACjE,qBAAqB;IACrB,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,aAAa,CACrB,4DAA4D;YAC1D,QAAQ,YAAY,CAAC,KAAK,CAAC,GAAG,CACjC,CAAC;IACJ,CAAC;IAED,iCAAiC;IACjC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,aAAa,CACrB,4DAA4D;YAC1D,QAAQ,YAAY,CAAC,KAAK,CAAC,GAAG,CACjC,CAAC;IACJ,CAAC;IAED,OAAO,MAAkC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,SAAS,kBAAkB,CACzB,MAAe,EACf,UAAkB;IAElB,IACE,MAAM,KAAK,IAAI;QACf,OAAO,MAAM,KAAK,QAAQ;QAC1B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EACrB,CAAC;QACD,MAAM,IAAI,aAAa,CACrB,GAAG,UAAU,gDAAgD;YAC3D,QAAQ,YAAY,CAAC,MAAM,CAAC,GAAG,CAClC,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAE9C,sBAAsB;IACtB,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,aAAa,CACrB,GAAG,UAAU,wCAAwC;YACnD,QAAQ,YAAY,CAAC,EAAE,CAAC,GAAG,CAC9B,CAAC;IACJ,CAAC;IAED,yBAAyB;IACzB,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,aAAa,CACrB,GAAG,UAAU,2CAA2C;YACtD,QAAQ,YAAY,CAAC,KAAK,CAAC,GAAG,CACjC,CAAC;IACJ,CAAC;IAED,iBAAiB;IACjB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,aAAa,CACrB,GAAG,UAAU,0CAA0C;YACrD,QAAQ,YAAY,CAAC,IAAI,CAAC,GAAG,CAChC,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,EAAE,aAAa,CAAC;QAClD,CAAC,CAAC,GAAG,CAAC,WAAW;QACjB,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,aAAa,CACrB,GAAG,UAAU,iDAAiD;YAC5D,gBAAgB,YAAY,CAAC,WAAW,CAAC,GAAG,CAC/C,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,aAAa,CACrB,GAAG,UAAU,8CAA8C;YACzD,QAAQ,YAAY,CAAC,QAAQ,CAAC,GAAG,CACpC,CAAC;IACJ,CAAC;IAED,mDAAmD;IACnD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,aAAa,CACrB,GAAG,UAAU,4CAA4C;YACvD,QAAQ,YAAY,CAAC,MAAM,CAAC,GAAG,CAClC,CAAC;IACJ,CAAC;IAED,mDAAmD;IACnD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,aAAa,CACrB,GAAG,UAAU,4CAA4C;YACvD,QAAQ,YAAY,CAAC,MAAM,CAAC,GAAG,CAClC,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,8CAA8C;IAC9C,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EACxB,CAAC;QACD,MAAM,IAAI,aAAa,CACrB,GAAG,UAAU,iDAAiD;YAC5D,eAAe,YAAY,CAAC,SAAS,CAAC,GAAG,CAC5C,CAAC;IACJ,CAAC;IAED,qBAAqB;IACrB,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,aAAa,CACrB,GAAG,UAAU,8CAA8C;YACzD,QAAQ,YAAY,CAAC,QAAQ,CAAC,GAAG,CACpC,CAAC;IACJ,CAAC;IAED,qBAAqB;IACrB,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,IAAI,OAAO,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,aAAa,CACrB,GAAG,UAAU,8CAA8C;YACzD,QAAQ,YAAY,CAAC,OAAO,CAAC,GAAG,CACnC,CAAC;IACJ,CAAC;IAED,oCAAoC;IACpC,MAAM,eAAe,GAAG,YAAY,CAAC,GAAG,EAAE,iBAAiB,CAAC;QAC1D,CAAC,CAAC,GAAG,CAAC,eAAe;QACrB,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,eAAe,KAAK,IAAI,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE,CAAC;QACpE,MAAM,IAAI,aAAa,CACrB,GAAG,UAAU,8CAA8C;YACzD,uBAAuB,YAAY,CAAC,eAAe,CAAC,GAAG,CAC1D,CAAC;IACJ,CAAC;IAED,wDAAwD;IACxD,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,IAAI,aAAa,CACrB,GAAG,UAAU,+CAA+C;YAC1D,QAAQ,YAAY,CAAC,SAAS,CAAC,GAAG,CACrC,CAAC;IACJ,CAAC;IAED,iCAAiC;IACjC,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,IAAI,aAAa,CACrB,GAAG,UAAU,+CAA+C;YAC1D,QAAQ,YAAY,CAAC,SAAS,CAAC,GAAG,CACrC,CAAC;IACJ,CAAC;IAED,OAAO,MAAoB,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACzC,OAAO,OAAO,KAAK,CAAC;AACtB,CAAC"}

package/dist/resources/audit-log.d.ts

@@ -0,0 +1,588 @@
+import type { AttestryClient } from "../client.js";
+import type { RequestOptions } from "../types.js";
+/**
+ * Public closed-enum of supported wire formats. Mirrors the kernel's
+ * `VALID_FORMATS` const at `src/lib/audit-log/export-helpers.ts:15-19`.
+ * Drift-pinned in `src/lib/incidents/__tests__/sdk-drift.test.ts`.
+ *
+ * Forward-compat: when a future format is added (e.g., `csv`), bump the
+ * SDK minor version and extend this array. The kernel's parseFormat
+ * function returns 400 for any value outside this set; the SDK
+ * pre-rejects invalid values synchronously as `TypeError` (build-round
+ * D5 — closed-enum input validates at the SDK boundary so the failure
+ * is faster + clearer than waiting for the server's 400).
+ */
+export declare const AUDIT_LOG_EXPORT_FORMATS: readonly ["jsonl", "ecs", "cef"];
+export type AuditLogExportFormat = (typeof AUDIT_LOG_EXPORT_FORMATS)[number];
+/**
+ * Wire shape for `format=jsonl`. Source-of-truth at kernel
+ * `src/lib/audit-log/export-helpers.ts:115-150` (`rowToWireJson`).
+ *
+ * Stable wire format — distinct from the raw Drizzle row, so a column
+ * rename in the DB doesn't churn the wire. The SDK mirrors this verbatim;
+ * a kernel-side rename surfaces via the drift pin in `sdk-drift.test.ts`.
+ *
+ * `details` is `unknown` (jsonb) — the kernel emits whatever the row's
+ * `details` column contains (any JSON value, OR null when the column
+ * was null). Consumers parse based on the row's `action` (e.g.,
+ * `"login"` → `{userAgent, ip}` shape; `"settings_updated"` →
+ * `{key, oldValue, newValue}`). Forward-compatible with future kernel
+ * action additions — the SDK does NOT enforce a per-action shape.
+ *
+ * `entryHash` / `previousEntryHash` form the audit-log's tamper-evidence
+ * chain: `entryHash` is `sha256:<hex64>` over the row's canonical
+ * payload; `previousEntryHash` is the prior row's `entryHash` (or null
+ * for the very first row OR for rows ingested before chaining was
+ * enabled). Consumers verify the chain by replaying — same conceptual
+ * shape as decisions.verifyChain, but for audit events.
+ */
+export interface AuditLogRecord {
+    /** UUID. */
+    id: string;
+    /** ISO-8601 UTC, microsecond precision (`YYYY-MM-DDTHH:MM:SS.sssZ`). */
+    timestamp: string;
+    /** UUID — the org that owns the row. Same as the caller's auth org. */
+    orgId: string;
+    /** UUID; null for cron / system actions where no user is involved. */
+    userId: string | null;
+    /** E.g. `"login"`, `"decision.created"`, `"webhook_endpoint_created"`. */
+    action: string;
+    /** E.g. `"session"`, `"decision_record"`, `"webhook_endpoint"`. */
+    resourceType: string | null;
+    /** ID of the affected resource (UUID for db rows; key for opaque ids). */
+    resourceId: string | null;
+    /** jsonb — any JSON value OR null. Per-action shape varies. */
+    details: unknown;
+    /** Source IP (INET → string). Null for non-network actions. */
+    ipAddress: string | null;
+    /** UA string. Null for non-browser actors. */
+    userAgent: string | null;
+    /** Session id (opaque). Null for non-session actors (api-key, cron). */
+    sessionId: string | null;
+    /**
+     * `sha256:<hex64>` — hash of canonical row payload. NULL for rows
+     * ingested before tamper-evidence chaining was enabled.
+     */
+    entryHash: string | null;
+    /**
+     * Previous row's `entryHash`. NULL for the very first row in the
+     * chain OR for rows ingested before chaining.
+     */
+    previousEntryHash: string | null;
+}
+/**
+ * Input shape for `auditLog.export(input?)`. All fields optional.
+ *
+ * Defaults applied server-side AND mirrored in the SDK's input
+ * validation:
+ *   - `format`: defaults to `"jsonl"` (kernel's `parseFormat` default)
+ *   - `cursor`: defaults to none (start from the most-recent row)
+ *   - `limit`: defaults to 1000 (kernel's `DEFAULT_LIMIT`)
+ *   - `autoPaginate`: defaults to `true` (SDK-side; kernel has no opinion)
+ *
+ * `cursor` flow: the SDK reads `x-attestry-next-cursor` from each
+ * page's response headers and passes it as `?cursor=<value>` on the
+ * next page. Auto-pagination consumers don't need to manage cursors
+ * themselves; explicit-cursor consumers call `export()` with
+ * `autoPaginate: false` and inspect... actually, the SDK CANNOT expose
+ * the response header through the async-iterator protocol cleanly.
+ * For explicit-cursor mode today, consumers call `export()` with
+ * `autoPaginate: false`, drain the iterator (one page worth of rows),
+ * and call again with the previously-returned next-cursor. (Returning
+ * the cursor through the iterator's protocol would require a
+ * non-standard hybrid shape; documented as build-round D3.)
+ */
+export interface AuditLogExportInput {
+    /**
+     * Wire format. Defaults to `"jsonl"` if omitted. The SDK pre-validates
+     * against `AUDIT_LOG_EXPORT_FORMATS` and throws `TypeError` synchronously
+     * for any value outside the closed enum (build-round D5).
+     */
+    format?: AuditLogExportFormat;
+    /**
+     * Cursor. Compound `<ISO-8601-UTC>:<UUID>` (preferred — strict tuple
+     * ordering across same-timestamp rows) OR bare ISO-8601 UTC (legacy
+     * fallback — may skip same-microsecond rows; the kernel emits this
+     * shape only on requests-from-old-clients but accepts both forms).
+     * The SDK forwards verbatim — kernel's regex is the format authority.
+     */
+    cursor?: string;
+    /**
+     * Page size. 1-5000; kernel clamps to 5000 silently. SDK rejects
+     * `NaN` / `Infinity` / `<= 0` / non-integer as TypeError (more
+     * strict than kernel's silent coerce-to-1000 — fail-loud-and-
+     * synchronous; build-round D4).
+     */
+    limit?: number;
+    /**
+     * When `true` (the default), the iterator transparently walks all
+     * pages until the kernel stops emitting `x-attestry-next-cursor`.
+     * When `false`, the iterator yields only the first page's rows and
+     * stops; consumers fetch the next page by calling `export()` again
+     * with the next cursor. (Caller-managed-cursor mode is documented
+     * but cumbersome — see JSDoc on the input field.)
+     */
+    autoPaginate?: boolean;
+}
+/**
+ * Result of `client.auditLog.verifyChain()`. Source-of-truth lives at
+ * the kernel route `src/app/api/v1/audit-chain/verify/route.ts:66-73`
+ * (the `successResponse({...})` literal) and `src/lib/crypto/audit-chain.ts:50-55`
+ * (the `verifyAuditChain` return-type literal that the route uses).
+ *
+ * **Critical contract**: this shape is returned for BOTH valid and
+ * invalid chains. `valid: false` is NOT an error — the kernel answered
+ * the customer's question (is this audit log tampered?) and the SDK
+ * resolves the Promise with the verdict body. Top-level structural
+ * failures (auth, rate limit, internal) throw `AttestryAPIError`.
+ * **Mirror of `decisions.verifyChain`'s contract** (carry-forward
+ * invariant #12 — chainValid:false / valid:false is a verdict, not
+ * an error).
+ *
+ * **Field semantics**:
+ *   - `valid`: `true` iff every audit-log entry's `entryHash`
+ *     matches the recomputed hash AND every entry's
+ *     `previousEntryHash` matches the prior entry's `entryHash`.
+ *     Empty audit logs verify as `true` (vacuous truth).
+ *   - `entriesVerified`: count of entries verified successfully
+ *     BEFORE the first broken link (or all entries on a valid
+ *     chain). On a tampered chain, equals the broken entry's index
+ *     in the ordered list; consumers can show "verified up to N
+ *     entries". `0` on empty logs AND when the very first entry
+ *     fails verification.
+ *   - `totalEntries`: total count of audit-log entries fetched
+ *     (post-truncation — the kernel caps at 5000 entries via the
+ *     `.limit(5000)` clause at `route.ts:51`; orgs with more than
+ *     5000 entries see only the oldest 5000 verified).
+ *   - `firstEntry`: ISO-8601 UTC timestamp of the OLDEST entry in
+ *     the fetched window. `null` if `totalEntries === 0`. Always
+ *     present in the body (kernel emits it unconditionally with
+ *     null fallback at `route.ts:63`); ALWAYS-PRESENT field on the
+ *     wire even though its value may be null.
+ *   - `lastEntry`: ISO-8601 UTC timestamp of the NEWEST entry in
+ *     the fetched window. `null` if `totalEntries === 0`. Same
+ *     emission semantics as `firstEntry`.
+ *   - `brokenAt`: UUID of the entry where the chain broke, OR
+ *     **OMITTED ENTIRELY from the wire when the chain is intact**.
+ *     The kernel uses a conditional spread:
+ *     `...(result.brokenAtId ? { brokenAt: result.brokenAtId } : {})`
+ *     so the field is an own-property only on broken chains. The
+ *     SDK preserves this faithfully — consumers detect "broken
+ *     chain" via `result.valid === false` (closed-enum boolean),
+ *     NOT via `result.brokenAt === undefined` (which is
+ *     prototype-pollution-unsafe — see the JSDoc on `verifyChain()`
+ *     for the full rationale).
+ *
+ * **Silent kernel-side truncation** (invariant #50): the kernel's
+ * audit-log fetch is capped at 5000 entries (`route.ts:51`). For an
+ * org with >5000 audit-log entries, the verifier sees only the
+ * oldest 5000; the newest entries are NOT verified by this call.
+ * The kernel does NOT emit a "truncated" flag — `totalEntries`
+ * equals the number of rows fetched, NOT the org's full audit-log
+ * row count. **Documented kernel surface gap**; the SDK does NOT
+ * mask. A future kernel raise to a higher limit or pagination would
+ * be additive (the SDK forwards `totalEntries` verbatim).
+ *
+ * **Mirror of `decisions.verifyChain`'s `ChainVerificationResult`
+ * but with different field names** — the org-wide audit-log
+ * verifier is a separate kernel function with separate vocabulary:
+ *   - `valid` vs decisions' `chainValid`
+ *   - `entriesVerified` vs decisions' `lastVerifiedSequence`
+ *   - `totalEntries` vs decisions' `recordCount`
+ *   - `brokenAt` (single UUID, optional own-property) vs decisions'
+ *     `tamperedRecordIds: string[]` + `brokenRecordIds: string[]`
+ *     (always-present arrays, distinguish security vs ops)
+ * Drift-pinned kernel-side in `sdk-drift.test.ts` (build round).
+ */
+export interface AuditChainVerificationResult {
+    /**
+     * `true` iff the org's audit-log hash chain is intact. Empty logs
+     * verify as `true` (vacuous truth). On `false`, inspect `brokenAt`
+     * for the offending entry's UUID.
+     */
+    valid: boolean;
+    /**
+     * Count of entries verified successfully BEFORE the first broken
+     * link. Equals `totalEntries` on a valid chain; less than
+     * `totalEntries` on a broken chain (consumers show "verified up
+     * to N entries").
+     */
+    entriesVerified: number;
+    /**
+     * Total entries fetched by the kernel. **Capped at 5000 per call**
+     * by the kernel's `.limit(5000)` at `route.ts:51`. For orgs with
+     * more than 5000 audit-log entries, this is the number of rows
+     * verified, NOT the org's full audit-log row count. Documented
+     * kernel surface gap.
+     */
+    totalEntries: number;
+    /**
+     * ISO-8601 UTC timestamp of the OLDEST entry in the fetched
+     * window. `null` if `totalEntries === 0`. Always present on the
+     * wire (kernel emits the field unconditionally with null
+     * fallback at `route.ts:63`).
+     */
+    firstEntry: string | null;
+    /**
+     * ISO-8601 UTC timestamp of the NEWEST entry in the fetched
+     * window. `null` if `totalEntries === 0`. Same emission semantics
+     * as `firstEntry`.
+     */
+    lastEntry: string | null;
+    /**
+     * UUID of the entry where the chain broke. **OMITTED from the
+     * wire when the chain is intact** — the kernel uses a conditional
+     * spread `...(result.brokenAtId ? { brokenAt: result.brokenAtId } : {})`
+     * at `route.ts:72`. On a valid chain, the field is NOT an
+     * own-property of the response. Consumers detect "broken chain"
+     * via `result.valid === false` (the closed-enum boolean is the
+     * pollution-safe discriminator); reading `result.brokenAt`
+     * yields `undefined` on a valid chain.
+     */
+    brokenAt?: string;
+}
+/**
+ * AuditLog resource — sibling to `IncidentsResource`, `DecisionsResource`,
+ * `ChatResource`. Today wraps two endpoints (`export` + `verifyChain`);
+ * the class is the landing pad for future audit-log methods.
+ */
+export declare class AuditLogResource {
+    private readonly client;
+    constructor(client: AttestryClient);
+    /**
+     * Stream audit-log rows in the requested format. Returns an
+     * async-iterable that yields per-row frames.
+     *
+     * **Format-discriminated yield types** (TypeScript narrows via the
+     * overload signatures):
+     *   - `format: "jsonl"` (default) → `AsyncIterable<AuditLogRecord>`
+     *   - `format: "ecs"` → `AsyncIterable<unknown>` (consumer parses ECS event)
+     *   - `format: "cef"` → `AsyncIterable<string>` (raw CEF lines)
+     *
+     * **Auto-pagination** (default — `autoPaginate !== false`): the
+     * iterator transparently walks back through history, fetching the
+     * next page whenever the current page exhausts and the kernel emits
+     * `x-attestry-next-cursor`. Stops when the kernel's response omits
+     * the header (last page).
+     *
+     * **Single-page mode** (`autoPaginate: false`): the iterator yields
+     * only the first page's rows then stops. The next-cursor IS NOT
+     * exposed through the iterator protocol — consumers either pass
+     * `autoPaginate` (default) and trust the SDK to walk, OR pass an
+     * explicit `cursor` they tracked from a previous response (rare;
+     * the response header isn't surfaced through the iterator today —
+     * build-round D3).
+     *
+     * **Dual-auth admin scope**: the kernel route gates on
+     * `requireSessionOrApiKey(request, { sessionRoles: ["admin"],
+     * apiKeyPermissions: [API_KEY_PERMISSIONS.ADMIN] })` — the identical
+     * dual-auth pattern the abacPolicies cluster uses. The SDK's
+     * transport always sends `x-api-key`, so the api-key path is the
+     * only one reachable from SDK consumers: **HTTP 401** for no /
+     * invalid / expired api-key, **HTTP 403** for a valid api-key whose
+     * permissions do NOT include `ADMIN`. Pin BOTH branches separately.
+     * (Corrected — session-22 hostile review #2: the prior "401 for
+     * both" claim mis-read the kernel test, which MOCKS the auth error;
+     * the real dual-auth middleware returns 403 for insufficient
+     * permission, same as the abacPolicies cluster.)
+     *
+     * **Order**: rows arrive DESC by `(timestamp, id)` — newest first.
+     * Auto-pagination preserves this order across page boundaries.
+     *
+     * **Errors thrown FROM the iterator** (long-lived stream semantics —
+     * symmetric with `decisions.stream` / `decisions.export`):
+     *   - `AttestryAPIError` (status 400) — invalid `format` (server-side;
+     *     SDK pre-rejects via TypeError), or invalid `cursor` (malformed
+     *     ISO/UUID).
+     *   - `AttestryAPIError` (status 401) — no / invalid / expired
+     *     api-key.
+     *   - `AttestryAPIError` (status 403) — a valid api-key whose
+     *     permissions do NOT include `ADMIN`. Distinct from 401 — pin
+     *     both branches separately.
+     *   - `AttestryAPIError` (status 429) — rate limit (auto-retried by
+     *     default; initial fetch only — invariant #20 — but each page's
+     *     INITIAL fetch is independent so 429-on-page-2 retries cleanly).
+     *   - `AttestryAPIError` (status 500) — internal error during streaming;
+     *     scrubbed message.
+     *   - `AttestryAPIError` — wrong content-type for the requested format
+     *     (proxy / LB error page wrapped at 200; the transport's
+     *     `expectedContentType` guard fails fast).
+     *   - `AttestryError("auditLog.export: NDJSON line was not a JSON object")` —
+     *     defensive; the kernel always emits objects in `jsonl` / `ecs`.
+     *   - `AttestryError("auditLog.export: NDJSON record missing required
+     *     fields or wrong type")` — defensive; jsonl-mode shape validation
+     *     fails. Server emits the rowToWireJson shape verbatim.
+     *   - `AttestryError("network error during stream: ...")` — TCP drop /
+     *     proxy hang-up mid-stream. Wrapped by the parser primitives.
+     *   - `AttestryError("request aborted by caller")` — `options.signal`
+     *     fired (pre-aborted or mid-flight).
+     *   - `TypeError` (synchronous, no fetch issued) — input failed
+     *     SDK-side validation.
+     *
+     * **Notably ABSENT from the error surface**:
+     *   - **No 402 plan-limit** — admin-only; no per-org quota gate.
+     *   - **No 422** — the route uses inline string parsing, not Zod, for
+     *     query params. Format validation returns 400 (not 422 like
+     *     decisions.list).
+     *   - **No 404** — orgId is implicit from auth; cross-org access is
+     *     impossible (rows filtered by `auth.orgId`).
+     *   - **No 413** — kernel's `MAX_LIMIT = 5000` is enforced by silent
+     *     clamp, not 413. A request with `limit=10000` succeeds with
+     *     5000 rows.
+     *   - **No "stream ended without trailer" error** — different from
+     *     `decisions.export`. The audit-log/export route does NOT emit a
+     *     body trailer; the cursor lives in headers, the empty page is
+     *     a valid stop signal. (Build-round D8.)
+     *
+     * **SDK-side validation** (synchronous `TypeError`, no fetch issued):
+     *   - `input` itself: optional; when provided, must be a non-null,
+     *     non-array object.
+     *   - `input.format`: optional; one of `"jsonl"` / `"ecs"` / `"cef"`
+     *     when provided. Pre-validated against the closed enum
+     *     (`AUDIT_LOG_EXPORT_FORMATS`).
+     *   - `input.cursor`: optional; non-empty string when provided.
+     *     Lone-surrogate guard via `assertEncodableQueryString`
+     *     (carry-forward invariant #32). Format check (compound
+     *     `<ISO>:<UUID>` regex) deferred to server's `parseCursor`.
+     *   - `input.limit`: optional; positive finite integer when provided.
+     *     `NaN` / `Infinity` / `<= 0` / non-integer rejected. (Kernel's
+     *     silent coerce-to-1000 is more permissive — SDK rejects loudly;
+     *     build-round D4.)
+     *   - `input.autoPaginate`: optional; boolean when provided.
+     *
+     * **Lazy**: the request is NOT issued until the first iteration.
+     * Pass `options.signal` for cancellation — pre-aborted causes the
+     * first iteration to throw `AttestryError` with no fetch issued;
+     * mid-flight abort surfaces as `AttestryError` from the iterator.
+     *
+     * @example Walk all admin events, newest first
+     * ```ts
+     * for await (const row of client.auditLog.export()) {
+     *   // row: AuditLogRecord
+     *   if (row.action === "api_key_created") notify(row);
+     * }
+     * ```
+     *
+     * @example ECS for SIEM ingest
+     * ```ts
+     * for await (const event of client.auditLog.export({ format: "ecs" })) {
+     *   // event: unknown — consumer parses as ECS 8.x
+     *   await elasticIngest(event);
+     * }
+     * ```
+     *
+     * @example CEF for ArcSight
+     * ```ts
+     * for await (const line of client.auditLog.export({ format: "cef" })) {
+     *   // line: string starting with "CEF:0|Attestry|..."
+     *   await arcsightForward(line);
+     * }
+     * ```
+     *
+     * @example One page at a time (manual cursor — rare)
+     * ```ts
+     * const firstPage = client.auditLog.export({ autoPaginate: false, limit: 100 });
+     * for await (const row of firstPage) { process(row); }
+     * // The next-cursor is NOT exposed through the iterator. To paginate
+     * // manually, the caller must track the last-seen `(timestamp, id)`
+     * // and supply it as `cursor` on the next call. Most consumers want
+     * // auto-paginate (the default) instead.
+     * ```
+     */
+    export(): AsyncIterable<AuditLogRecord>;
+    export(input: {
+        format: "ecs";
+    } & Omit<AuditLogExportInput, "format">, options?: RequestOptions): AsyncIterable<unknown>;
+    export(input: {
+        format: "cef";
+    } & Omit<AuditLogExportInput, "format">, options?: RequestOptions): AsyncIterable<string>;
+    export(input?: AuditLogExportInput, options?: RequestOptions): AsyncIterable<AuditLogRecord>;
+    /**
+     * Verify the integrity of the org's audit-log hash chain. Returns
+     * an `AuditChainVerificationResult` describing whether the chain is
+     * intact, and (when broken) the UUID of the entry where verification
+     * failed.
+     *
+     * Wraps `GET /api/v1/audit-chain/verify` — no input, no query
+     * parameters, no body. The caller's org is implicit from auth; the
+     * kernel fetches up to 5000 audit-log entries ordered ascending by
+     * timestamp and runs `verifyAuditChain()` on them.
+     *
+     * **API-key auth scope** (uses `requireApiKey` DIRECT — distinct
+     * from BOTH siblings): the kernel route calls `requireApiKey(request)`
+     * at `route.ts:31` with NO permission scoping AND NO subsequent
+     * role check. Any valid API key for the org can verify the chain.
+     * Returns **HTTP 401** for no/invalid API key; the `requireApiKey`
+     * branch does NOT distinguish "no key" from "invalid key". **Note**:
+     * `auditLog.export` ALSO calls `requireApiKey(request)` directly at
+     * its route but then performs a separate role/permission check
+     * (ADMIN-only — see audit-log/export route). `verifyChain()` is
+     * distinct: NO role check, NO permission filter. The 403 path is
+     * unreachable for this route, and ALL valid api-keys in the org
+     * succeed (in contrast to `auditLog.export` where only ADMIN keys
+     * succeed).
+     *
+     * **Kernel-side invariant (session-19 review-3 L2 carry-forward)**:
+     * the route at `route.ts:32` reads `apiKeyUser.orgId` and passes
+     * it directly to the Drizzle `eq(schema.auditLog.orgId, orgId)`
+     * filter without a null-guard. The SDK assumes the kernel's
+     * `requireApiKey` returns an `ApiKeyUser` with a non-null `orgId`
+     * (i.e., the `apiKeys` table's `orgId` column is NOT NULL). If
+     * a future schema migration relaxes that constraint, the route
+     * could match zero rows on a malformed key and return a vacuous-
+     * truth `valid: true` verdict, masking actual chain tampering.
+     * This is a kernel-side hardening concern (SDK cannot detect
+     * it from the wire); flagged here so a future kernel-hardening
+     * audit knows to add a runtime guard in `requireApiKey`.
+     *
+     * **CRITICAL contract — does NOT throw on `valid: false`** (carry-
+     * forward invariant #12). The kernel returns HTTP 200 with
+     * `valid: false` on a tampered chain; the SDK MUST resolve the
+     * Promise with the verdict body. Top-level structural failures
+     * (auth, rate limit, internal) throw `AttestryAPIError`. Mirror of
+     * `decisions.verifyChain`'s same contract.
+     *
+     * **NO `writeAuditLog` side effect** — the verifier is quiet
+     * (asymmetric with `gate.evaluate` / `batch.submit` which both write
+     * audit-log entries). Writing to the audit log while verifying it
+     * would be ironic; the kernel team avoided this. `auditLog.verifyChain`
+     * is a pure read.
+     *
+     * **Silent kernel-side truncation at 5000 entries** (invariant #50).
+     * The kernel's audit-log fetch is capped at 5000 entries
+     * (`route.ts:51`: `.limit(5000)`). For an org with more than 5000
+     * audit-log entries, only the OLDEST 5000 are verified by this call.
+     * The kernel does NOT emit a "truncated" flag — `totalEntries`
+     * equals the number of rows fetched, NOT the org's full audit-log
+     * row count. **Documented kernel surface gap**; the SDK does NOT
+     * mask. Consumers with high-volume audit logs should be aware that
+     * the kernel's verifier sees a stale window of the chain. A future
+     * kernel pagination or higher limit would be additive (the SDK
+     * forwards `totalEntries` verbatim).
+     *
+     * **Kernel-side 30-second timeout** (`maxDuration = 30` at
+     * `route.ts:14`). The SDK does NOT enforce a client-side timeout
+     * (consumers manage via `options.signal`), but the kernel's
+     * function-runtime cap bounds the verification latency on the
+     * server side. Cron-job consumers should budget call latency
+     * relative to this cap — a near-5000-entry verification can take
+     * tens of seconds under high SHA-256 load. A future kernel raise
+     * (e.g., 30 → 60s) would relax this cap; downstream cron-job
+     * sizing assumptions should be revisited.
+     *
+     * **Pollution-safe discriminator pattern** — branch on
+     * `result.valid` (closed-enum boolean) to detect a broken chain,
+     * NOT on `result.brokenAt === undefined`. The kernel emits
+     * `brokenAt` as an OWN-PROPERTY of the response only when the
+     * chain is broken; on a valid chain it's omitted entirely (kernel
+     * uses a conditional spread at `route.ts:72`). Under
+     * `Object.prototype.brokenAt = <value>` pollution, the equality
+     * check walks the prototype and reads the polluted value —
+     * returning false (i.e., "field is present") even when the
+     * own-property is genuinely absent. The SDK's response-side
+     * validator uses `Object.hasOwn` (snapshotted at module load) to
+     * defend against this; consumers should use `result.valid`
+     * directly. Carry-forward of session-17 first-hostile-review
+     * MEDIUM #3 + session-18 build-round baked-in pattern.
+     *
+     * **Errors** — ordered by kernel firing precedence (rate-limit →
+     * auth-pass-or-401 → DB fetch → verifier → 500-catchall):
+     *   - `AttestryAPIError` (status 429) — rate limit FIRES FIRST
+     *     (auto-retried by default — invariant #18; per-IP rate-limit
+     *     key `audit-chain-verify:${ip}` against the standard
+     *     `apiLimiter`).
+     *   - `AttestryAPIError` (status 401) — no API key OR invalid key.
+     *     Single 401 surface (NO 403 — the route has no permission
+     *     filter). Surfaces only when `requireApiKey` throws an
+     *     `AuthError`; the route's catch (route.ts:74-77) propagates
+     *     `error.statusCode` (401 for `AuthError`).
+     *   - `AttestryAPIError` (status 500) — internal kernel error
+     *     (scrubbed message via `internalErrorResponse`). Surfaces
+     *     when the DB connection drops mid-fetch, the verifier
+     *     throws, OR `requireApiKey`'s INFRASTRUCTURE fails (e.g., a
+     *     DB error during the API-key lookup, not an auth-rejection;
+     *     non-`AuthError` errors fall through to the route's
+     *     `internalErrorResponse` catchall at route.ts:78).
+     *   - `AttestryError` ("request aborted by caller") — caller-
+     *     supplied `options.signal` fired (pre-aborted or mid-flight).
+     *   - `AttestryError` (P2 hardening) — kernel response failed
+     *     SDK-side shape validation. See "Response-shape validation"
+     *     below.
+     *   - `AttestryAPIError` (P3 hardening) — kernel response had a
+     *     wrong Content-Type (transport-level guard).
+     *
+     * **Notably ABSENT from the error surface**:
+     *   - **No 400** — this method has no input; nothing to reject for
+     *     malformed input. The route doesn't parse query params or
+     *     body.
+     *   - **No 402 plan-limit** — verifyChain is a READ; no quota.
+     *   - **No 403** — no permission filter on the route (any key with
+     *     a valid org binding succeeds). Asymmetric with
+     *     `auditLog.export` (which gates on ADMIN role).
+     *   - **No 404** — orgId is implicit from auth; no path/query
+     *     parameters that could mismatch.
+     *   - **No 413** — the kernel's `.limit(5000)` silently caps the
+     *     fetch; oversize orgs see a truncated verification (NOT a
+     *     413). Documented kernel surface gap.
+     *   - **No 422** — no Zod schema (no body, no query).
+     *   - **No TypeError from SDK** — this method has no input to
+     *     validate.
+     *
+     * **Response-shape validation** (P2 hardening — symmetric defense
+     * on response side via the module-load `objectHasOwn` snapshot;
+     * mirror of `batch.ts` / `gate.ts` patterns):
+     *   - Rejects with `AttestryError` if the response isn't a non-null,
+     *     non-array object.
+     *   - Rejects if `valid` isn't a boolean.
+     *   - Rejects if `entriesVerified` / `totalEntries` aren't numbers.
+     *   - Rejects if `firstEntry` / `lastEntry` aren't `null` OR a
+     *     string.
+     *   - Rejects if `brokenAt` is OWN-PROPERTY present but NOT a
+     *     string. (When absent, the field is forward-compatibly
+     *     undefined — kernel omits it on valid chains.)
+     *   - Each response field read goes through the module-load
+     *     `objectHasOwn` snapshot — defends against
+     *     `Object.prototype.<field>` pollution masking a missing field.
+     *
+     * **Transport-shape validation** (P3 hardening):
+     *   - Rejects with `AttestryAPIError` if the kernel responds with
+     *     a non-`application/json` Content-Type. NOTE: `valid: false`
+     *     is a normal 200 response and resolves the promise (carry-
+     *     forward invariant #12); only structural failures throw.
+     *
+     * @example Detect a tampered audit log
+     * ```ts
+     * const verdict = await client.auditLog.verifyChain();
+     * if (!verdict.valid) {
+     *   // brokenAt is an OWN-PROPERTY only on broken chains.
+     *   await notifySecurity({
+     *     entryId: verdict.brokenAt,
+     *     verifiedUpTo: verdict.entriesVerified,
+     *     totalEntries: verdict.totalEntries,
+     *   });
+     * }
+     * console.log(`Verified ${verdict.entriesVerified}/${verdict.totalEntries} entries`);
+     * ```
+     *
+     * @example Schedule periodic verification (cron job)
+     * ```ts
+     * // Run hourly from a cron — surfaces tampering within an hour
+     * // of occurrence (high-frequency monitoring for compliance-
+     * // critical orgs).
+     * try {
+     *   const verdict = await client.auditLog.verifyChain();
+     *   if (!verdict.valid) {
+     *     await pageOncall({ brokenAt: verdict.brokenAt });
+     *   }
+     * } catch (err) {
+     *   if (err instanceof AttestryAPIError && err.status === 429) {
+     *     // Back off — verifier is rate-limited per IP.
+     *     return;
+     *   }
+     *   throw err;
+     * }
+     * ```
+     */
+    verifyChain(options?: RequestOptions): Promise<AuditChainVerificationResult>;
+}
+//# sourceMappingURL=audit-log.d.ts.map

package/dist/resources/audit-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../src/resources/audit-log.ts"],"names":[],"mappings":"AAkEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAInD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAmBlD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,kCAI1B,CAAC;AAEZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,cAAc;IAC7B,YAAY;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,0EAA0E;IAC1E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,+DAA+D;IAC/D,OAAO,EAAE,OAAO,CAAC;IACjB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,wEAAwE;IACxE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;OAGG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;OAGG;IACH,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,KAAK,EAAE,OAAO,CAAC;IACf;;;;;OAKG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;OAIG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,qBAAa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,cAAc;IAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2IG;IACH,MAAM,IAAI,aAAa,CAAC,cAAc,CAAC;IACvC,MAAM,CACJ,KAAK,EAAE;QAAE,MAAM,EAAE,KAAK,CAAA;KAAE,GAAG,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,EAC9D,OAAO,CAAC,EAAE,cAAc,GACvB,aAAa,CAAC,OAAO,CAAC;IACzB,MAAM,CACJ,KAAK,EAAE;QAAE,MAAM,EAAE,KAAK,CAAA;KAAE,GAAG,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,EAC9D,OAAO,CAAC,EAAE,cAAc,GACvB,aAAa,CAAC,MAAM,CAAC;IACxB,MAAM,CACJ,KAAK,CAAC,EAAE,mBAAmB,EAC3B,OAAO,CAAC,EAAE,cAAc,GACvB,aAAa,CAAC,cAAc,CAAC;IAyEhC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyLG;IACH,WAAW,CACT,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,4BAA4B,CAAC;CAWzC"}