@decionis/agent-safe-pipeline 0.1.4 → 0.2.0

package/README.md

@@ -73,6 +73,18 @@ DECIONIS_API_URL=https://api.decionis.com
 DECIONIS_API_KEY=server-side-secret
 ```
 
+`DecionisGate` and `DecionisGrantVerifier` accept `apiKey` as a string or as a function read at
+each request. A deployment whose credential rotates inside a process's life gives the function: the
+next request carries the new value, a request already in flight keeps the one it sent, and nothing
+has to be rebuilt to make that true. A credential that does not rotate stays a string.
+
+```ts
+const gate = new DecionisGate({
+  baseUrl: process.env.DECIONIS_API_URL!,
+  apiKey: () => secrets.current("DECIONIS_API_KEY"),
+});
+```
+
 ## Quick start: enforcement
 
 The complete production path in one file. The proposal comes from the agent; everything else comes
@@ -137,6 +149,17 @@ if (result.outcome === "COMPLETED") {
 The executor validates parameters against the handler's schema before the grant is claimed, and the
 grant is claimed before the handler runs. If either step fails, the handler is never invoked.
 
+The trusted context also accepts an optional `expectedEffectDigest` (`sha256:` plus 64 lowercase hex):
+a digest-only commitment to the downstream state predicted before dispatch. It is bound into the
+canonical intent hash and into the signed grant, and `DecionisGrantVerifier` refuses the authorization
+unless the returned grant echoes exactly that digest. The agent proposal can never carry it, and an
+intent that omits it hashes byte-identically to before the field existed. After the attempt, a trusted
+runtime that observed the effect may pass an `AuthorityEffectEvidence` record as `effectEvidence` to
+`DecionisGrantVerifier.finalize`, and read the authority's own `AuthorityEffectReport` back through
+`effectReport(authorization)`. See
+[execution intent](https://github.com/decionis/agent-safe-pipeline/blob/master/docs/execution-intent.md)
+and [execution outcomes](https://github.com/decionis/agent-safe-pipeline/blob/master/docs/execution-outcomes.md).
+
 ## Outcomes
 
 Decionis returns one of three verdicts. The executor turns a verdict into exactly one execution
@@ -150,18 +173,46 @@ outcome.
 
 `SafeExecutor.run` resolves to a discriminated result rather than throwing:
 
-| `outcome`                | Meaning                                                                                                                                                                                   |
-| ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `COMPLETED`              | The grant was consumed and the handler returned. `result` holds its value.                                                                                                                |
-| `BLOCKED`                | Nothing ran. `reason` names the refusal: a non-authoritative or non-`ALLOW` decision, a missing or invalid grant, an intent binding or conformance failure, or an unavailable audit sink. |
-| `FAILED_BEFORE_DISPATCH` | The grant was consumed but the handler failed before reaching the provider. Safe to reason about.                                                                                         |
-| `UNKNOWN_AFTER_DISPATCH` | The provider was called and its outcome is unknown. A `recovery` reference supports reconciliation.                                                                                       |
+| `outcome`                 | Meaning                                                                                                                                                                                   |
+| ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `COMPLETED`               | The grant was consumed and the handler returned. `result` holds its value.                                                                                                                |
+| `BLOCKED`                 | Nothing ran. `reason` names the refusal: a non-authoritative or non-`ALLOW` decision, a missing or invalid grant, an intent binding or conformance failure, or an unavailable audit sink. |
+| `FAILED_BEFORE_DISPATCH`  | The grant was consumed but the handler failed before reaching the provider. Safe to reason about.                                                                                         |
+| `DEFINITELY_NOT_EXECUTED` | The provider was called and refused deterministically. `reason` is its own code. Nothing was effected and there is nothing to reconcile.                                                  |
+| `UNKNOWN_AFTER_DISPATCH`  | The provider was called and its outcome is unknown. A `recovery` reference supports reconciliation.                                                                                       |
+
+A handler reports that last-but-one case by throwing `ProviderRefusal` from inside `dispatch.run`,
+with the provider's own reason code. Only a deterministic refusal belongs in it: a timeout, a 5xx
+or an unreadable answer is not a refusal, and reporting one as a refusal would turn "nobody knows"
+into "definitely not".
 
 Every outcome that consumed a grant also reports `finalization` (`RECORDED`, `PENDING`, or
 `UNSUPPORTED`). The executor records `COMMITTED`, `FAILED`, or `INDETERMINATE` with Decionis after
 the attempt so commit evidence joins the Decision Dossier chain. Finalization is evidence, never
 authority: it cannot change `outcome` or `executed`.
 
+### What each record establishes
+
+Fluent summaries lose these distinctions first. Each row names the record or state, what it
+establishes, and what it does not.
+
+| Record or state                                           | What it establishes                                                                                                                                                                                                                                                                                                                                                                                                                             | What it does not establish                                                                                                                                                                                                                                                                  |
+| --------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Captured intent (`IntentCapture`, `intentHash`)           | The exact action, target, and parameters the agent proposed, bound to trusted tenant, actor, and downstream context, hashed and expiring                                                                                                                                                                                                                                                                                                        | That the agent's facts, identities, or amounts are true; that anything may execute                                                                                                                                                                                                          |
+| Verified human approval (Presence `receiptDossierId`)     | A named person approved that exact intent hash under the assurance the receipt records                                                                                                                                                                                                                                                                                                                                                          | Permission to execute: Decionis re-evaluates policy with the receipt, and only that evaluation can issue a grant                                                                                                                                                                            |
+| Execution grant (`authorization` on an `ALLOW`)           | Permission for one attempt at one intent, claimed once through the `AuthorizationVerifier` immediately before the handler runs                                                                                                                                                                                                                                                                                                                  | Anything after expiry, for another intent hash, or on a second presentation; a dossier identifier, an invitation link, or an earlier `ALLOW` is not a substitute                                                                                                                            |
+| Decision Dossier (`decisionId`, `dossierId`)              | The record of why Decionis allowed, escalated, or blocked: policy snapshot, inputs, evidence, and grant metadata                                                                                                                                                                                                                                                                                                                                | An execution credential; proof that the underlying business judgement was right                                                                                                                                                                                                             |
+| Single claim, `COMPLETED`                                 | The grant was consumed once and the trusted handler returned a provider result                                                                                                                                                                                                                                                                                                                                                                  | An exactly-once downstream business effect or independent confirmation of settlement; whether an observation counts as `CONFIRMED` is the authority's judgement, not this package's                                                                                                         |
+| `UNKNOWN_AFTER_DISPATCH`, finalized `INDETERMINATE`       | Dispatch began and completion could not be proved                                                                                                                                                                                                                                                                                                                                                                                               | Permission to repeat the side effect: reconcile through provider idempotency and read-only lookup, never by a second dispatch                                                                                                                                                               |
+| `DEFINITELY_NOT_EXECUTED`, finalized `FAILED`             | Dispatch began, the provider refused it deterministically, and nothing was effected                                                                                                                                                                                                                                                                                                                                                             | Permission to try again: the refusal was about this attempt, and another needs a fresh decision and a fresh grant                                                                                                                                                                           |
+| Shadow observation (`ShadowPipeline`, `mode: "SHADOW"`)   | What Decionis would have decided about an action that already ran: a verdict and a dossier, no grant                                                                                                                                                                                                                                                                                                                                            | Enforcement, a grant, or a no-write test environment; the production write happened as before                                                                                                                                                                                               |
+| Library boundary (this package)                           | Intent capture, the gate, verification, and claim-before-handler dispatch inside the trusted integration                                                                                                                                                                                                                                                                                                                                        | Host isolation, IAM, network egress, credential storage, or incident response; see the [threat model](https://github.com/decionis/agent-safe-pipeline/blob/master/THREAT-MODEL.md) and [trust boundary](https://github.com/decionis/agent-safe-pipeline/blob/master/docs/trust-boundary.md) |
+| Trusted executor (`createTrustedExecutor`)                | What one process verifies about itself and enforces at its own door: the host posture `HostPosture` can observe, caller principals with roles and their own credentials, egress sealed to the origins `EgressPolicy` was configured with, a durable attempt journal reconciled by `StartupReconciler`, the ceilings in `HardLimits`, BEAP-vocabulary effect evidence, `HaltSwitch`, and hash-chained evidence with an offline-verifiable export | Node or kernel isolation, a CNI actually enforcing the NetworkPolicies the kit declares, an HSM or KMS, the authority's policy, or a bank's core correctness                                                                                                                                |
+| Executor evidence bundle (`agent-safe.evidence-bundle/1`) | What one executor process can say about an incident: both hash-chained streams as it still held them, the open attempts, the posture by check, the chain heads, a configuration digest, and every file's own digest                                                                                                                                                                                                                             | Origin, unless a signature over the manifest verifies against a key the reader brought; completeness, since it carries a bounded window and says how many lines it dropped; and it holds no parameter, no provider body, no secret and no digest of one                                     |
+
+The sequence that produces both records, and two synthetic records side by side, are in
+[Decision Dossiers](https://github.com/decionis/agent-safe-pipeline/blob/master/docs/decision-dossiers.md).
+
 ## Human approval through Presence
 
 When policy escalates, a person must approve that exact intent with independently signed evidence.
@@ -231,6 +282,94 @@ rewritten between them.
 | Shadow      | `ShadowPipeline` over `DecionisGate` with `mode: "SHADOW"`    | What Decionis would have decided about actions that already run; no grant issued |
 | Enforcement | `DecionisGate` plus `DecionisGrantVerifier` in `SafeExecutor` | Nothing runs without an independent decision and a consumed single-use grant     |
 
+### Selecting the gate from the environment
+
+`createGate` moves an integration between those stages with configuration alone. It takes the
+authority and verifier you already run, and reads one variable to decide whether Decionis runs
+beside them:
+
+```ts
+import { createFixtureAuthorityPair, createGate } from "@decionis/agent-safe-pipeline";
+
+const gate = createGate({
+  local: createFixtureAuthorityPair(() => "BLOCK", { unsafeAllowDevelopmentFixture: true }),
+  tenantId: "00000000-0000-4000-8000-000000000001",
+});
+const captured = new IntentCapture().capture(proposal, { tenantId: gate.tenantId, ...trusted });
+const decision = await gate.authority.evaluate(captured);
+const result = await new SafeExecutor(registry, gate.verifier).run(captured, decision);
+```
+
+| Variable                           | Default                    | Effect                                                                                                                                                                                                           |
+| ---------------------------------- | -------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `DECIONIS_API_KEY`                 | unset                      | Unset: `gate.authority` and `gate.verifier` are the `local` objects themselves, and no client is constructed. Set: `DecionisGate` runs beside `local` through `ShadowGate`.                                      |
+| `DECIONIS_TENANT_ID`               | required with the key      | The key's organization. Decionis binds every intent to it, so `gate.tenantId` returns it for the capture; without the key, `gate.tenantId` is the `tenantId` you passed.                                         |
+| `DECIONIS_MODE`                    | `SHADOW`                   | `SHADOW`: the local decision governs execution and the hosted one is recorded on `decision.hosted`. `ENFORCEMENT`: the hosted decision governs, claimed through `DecionisGrantVerifier`; local can only tighten. |
+| `DECIONIS_API_URL`                 | `https://api.decionis.com` | HTTPS only, unless `DECIONIS_ALLOW_INSECURE_LOOPBACK=true` names a loopback double.                                                                                                                              |
+| `DECIONIS_TIMEOUT_MS`              | `DecionisGate`'s default   | Budget for the hosted call. A call past it is recorded as fail-closed.                                                                                                                                           |
+| `DECIONIS_ALLOW_INSECURE_LOOPBACK` | unset                      | `true` permits `http://127.0.0.1` for `LocalAuthority`.                                                                                                                                                          |
+
+`ShadowGate` never returns a decision less restrictive than the local authority's, in either mode. A
+hosted timeout, network error, non-2xx response, malformed body, or binding mismatch is recorded on
+`decision.hosted` as `failClosed` with verdict `BLOCK`: in `SHADOW` that changes nothing about
+execution, in `ENFORCEMENT` it blocks. A hosted variable that cannot be honoured (`DECIONIS_MODE`
+outside `SHADOW` and `ENFORCEMENT`, a missing `DECIONIS_TENANT_ID`, a non-HTTPS URL) throws at
+construction rather than falling back to local, so a misconfiguration is never mistaken for hosted
+mode.
+
+`DecionisGate` sends `User-Agent: agent-safe-pipeline/<version>` on every call, and `source`
+(`{ repo, example }`, on `createGate` or the gate itself) is appended to it as a comment. It is
+client identification for the authority's own accounting, never decision input, and it is sent only
+when a call is made at all.
+
+`printDecision(decision, { out })` writes what Decionis said, when it was asked, and nothing when
+it was not: the governing verdict, the hosted verdict with its standing (`governs`, `recorded
+beside the local verdict`, or `failed closed`), the dossier identifier, the page that verifies it
+when the authority attached one (`decision.hosted.verificationUrl`), and the command that verifies
+it offline. Pass `out: process.stderr` where stdout is a transport, as in a stdio MCP server, and
+`verifyCommand` to name your own verification step; the default names this repository's
+`pnpm decionis:verify <dossier-id>`, which fetches the signed record with your key and checks its
+Ed25519 proof bundle against the authority's public JWKS offline.
+
+### One variable, a key issued in the run
+
+`createHostedGate` is `createGate` with one more way onto Decionis, for the moment a developer has
+nothing but a clone:
+
+```ts
+import { createHostedGate, printHostedOutcome } from "@decionis/agent-safe-pipeline";
+
+const gate = await createHostedGate({
+  local: createFixtureAuthorityPair(() => "BLOCK", { unsafeAllowDevelopmentFixture: true }),
+  tenantId: "00000000-0000-4000-8000-000000000001",
+  source: { repo: "owner/name", example: "basic-agent", surface: "github" },
+});
+const decision = await gate.authority.evaluate(captured);
+await printHostedOutcome(gate, decision);
+```
+
+| `DECIONIS_HOSTED` | `DECIONIS_API_KEY` | What runs                                                                                                                                                                                                                                  |
+| ----------------- | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| unset             | unset              | The local pair, untouched; `printHostedOutcome` writes one hint line.                                                                                                                                                                      |
+| any               | set                | Exactly `createGate`: the key and `DECIONIS_TENANT_ID` from the environment, in `DECIONIS_MODE`.                                                                                                                                           |
+| `1`               | unset              | The credential this user keeps for this authority (`agentsafe login`, or an earlier run), else a free provisional workspace minted now from `POST /v1/public/agents/provision`, stored for the next run, and named on standard error once. |
+
+A provisional workspace needs no account, no email and no card; its key evaluates in `SHADOW`
+only, so the local verdict still governs and the hosted decision and its signed Decision Dossier
+are recorded beside it. The credential lives in `$AGENTSAFE_HOME`, else
+`$XDG_CONFIG_HOME/agentsafe`, else `~/.config/agentsafe/credentials.json`, readable by its owner
+alone, the same file `agentsafe login` writes; `NODE_ENV=production` refuses the whole path, as
+it refuses every stored login. `resolveHostedCredentials` is the same resolution for a process
+that is not a gate, such as the trusted executor. The provisioning call carries the client
+identification (`repo`, `example`, `surface`) in its `User-Agent`, and nothing else about the
+machine.
+
+`printHostedOutcome(gate, decision, { out })` is how an example ends: `printDecision`, then the
+signed record itself, fetched with the run's own key from `GET /v1/protocol/dossiers/{id}`
+(`gate.fetchDossier`) and shown by its proof: the algorithm, the key, when it was issued, how many
+artifacts it covers, and the issuer tier, `provisional_anonymous` for a workspace without an
+account. `fetchSignedDossier`, `summarizeDossier` and `printSignedDossier` are the parts.
+
 ## Local testing
 
 `@decionis/agent-safe-pipeline/testing` ships `LocalPresence` and `LocalAuthority`: loopback doubles
@@ -273,8 +412,10 @@ them from the testing entry. See
 | -------------- | ------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
 | Intent         | `IntentCapture`, `CanonicalIntentHasher`, `ExecutionIntentSchema`, `AgentProposalSchema`          | Build the immutable `agent-safe.intent/1` binding and its canonical SHA-256 hash               |
 | Decision       | `DecionisGate`, `DecisionAuthority`, `GateDecision`, `FailClosedDecision`                         | Obtain an independent `ALLOW` / `ESCALATE` / `BLOCK` decision with dossier identifiers         |
+| Selection      | `createGate`, `ShadowGate`, `SelectedGate`, `HostedEvaluation`, `printDecision`                   | Choose local, shadow, or enforcement from the environment; combine and report the two verdicts |
 | Human approval | `PresenceApprovalCoordinator`, `ManagedEscalationRequest`, `HumanApprovalEvidence`                | Coordinate DIRECT Presence ceremonies or request MANAGED orchestration by Decionis             |
 | Execution      | `SafeExecutor`, `ActionRegistry`, `DecionisGrantVerifier`, `AuthorizationVerifier`, `ReplayStore` | Claim the single-use grant, validate parameters, invoke a sealed handler, finalize the attempt |
+| Effect         | `AuthorityEffectEvidence`, `AuthorityEffectReport`, `DecionisGrantVerifier.effectReport`          | Forward a trusted runtime's downstream observation on finalize and read the authority's answer |
 | Observation    | `ShadowPipeline`, `ShadowObservation`                                                             | Record what the authority would have decided without granting execution                        |
 | Audit          | `AuditRecorder`, `AuditEventV1`, `AuditSink`                                                      | Emit immutable, redacted lifecycle records through one bounded sink call                       |
 | Testing        | `LocalPresence`, `LocalAuthority`, `createFixtureAuthorityPair` (from `/testing`)                 | Loopback doubles and fixture authorities for development and CI                                |
@@ -304,6 +445,10 @@ before integrating a real downstream API.
 
 ## Assurance and supply chain
 
+The reviewer's route through all of it, with what each piece of evidence establishes and what it
+does not, is
+[EVALUATION-PATH.md](https://github.com/decionis/agent-safe-pipeline/blob/master/EVALUATION-PATH.md).
+
 - **Provenance.** Every release is published through npm trusted publishing with a provenance
   attestation, from a keyless-signed release tag, and archived under Zenodo concept DOI
   [`10.5281/zenodo.22312955`](https://doi.org/10.5281/zenodo.22312955).
@@ -334,13 +479,18 @@ Runnable, offline, and fixture-backed unless noted. Each one uses this package u
 - [`presence-live-approval`](https://github.com/decionis/agent-safe-pipeline/tree/master/examples/presence-live-approval): DIRECT Presence enforcement against the real services with a FIDO2 or FIDO2-plus-liveness ceremony (needs credentials).
 - [`presence-managed-approval`](https://github.com/decionis/agent-safe-pipeline/tree/master/examples/presence-managed-approval): Decionis-managed Presence orchestration against the real services (needs credentials).
 - [`golden-adversarial-demo`](https://github.com/decionis/agent-safe-pipeline/tree/master/examples/golden-adversarial-demo): one golden path, eight attacks, zero unauthorized executions.
+- [`whisper-boundary-demo`](https://github.com/decionis/agent-safe-pipeline/tree/master/examples/whisper-boundary-demo): the same proof for a shopping agent — six attacks, zero unauthorized effects.
+- [`crm-outreach-demo`](https://github.com/decionis/agent-safe-pipeline/tree/master/examples/crm-outreach-demo): who can approve a sales agent's CRM update or outbound message — six attacks, a lost provider response reconciled once, zero unauthorized effects.
+- [`trusted-executor`](https://github.com/decionis/agent-safe-pipeline/tree/master/examples/trusted-executor): the proof of `@decionis/agentsafe`, the execution boundary as one deployable process — an HTTP trusted executor in front of these components — over real HTTP against the loopback doubles, and the adopter's template; the image, Kubernetes manifest and shadow-to-enforcement runbook are in the repository's [deployment kit](https://github.com/decionis/agent-safe-pipeline/blob/master/deploy/README.md).
 
 ## Open core
 
-Everything in the repository is Apache-2.0: the architecture, the intent contract, the execution
-boundary, the client adapters, the audit contract, shadow mode, the conformance vectors, and the
-examples. Decionis operates the policy control plane behind `DecionisGate`: policy evaluation, grant
-issuance and atomic consumption, Decision Dossier signing and retention, and Presence.
+This package and the repository's architecture, intent contract, execution boundary, client
+adapters, audit contract, shadow mode, conformance vectors, and examples are Apache-2.0. The sole
+license exception is the dedicated MIT-licensed Claude Desktop wrapper in
+`packages/commerce-mcp-claude-extension`; the CommerceGate runtime it bundles remains Apache-2.0.
+Decionis operates the policy control plane behind `DecionisGate`: policy evaluation, grant issuance
+and atomic consumption, Decision Dossier signing and retention, and Presence.
 [OPEN-CORE.md](https://github.com/decionis/agent-safe-pipeline/blob/master/OPEN-CORE.md) states the
 boundary and the commitments that keep it stable.
 
@@ -349,6 +499,15 @@ boundary and the commitments that keep it stable.
 Decionis Research defines the architecture, this package demonstrates it as tested code, and the
 Decionis platform operates it as a hosted authority.
 
+The banking profile of the protocol, whose reference runtime builds on this package, is published at
+[banking.decionis.com](https://banking.decionis.com) (BEAP v1.0, published 2026-09-15; the profile
+Decionis publishes and implements, not a standard approved by any body). The Commerce Gate this repository's MCP server fronts is at
+[commerce.decionis.com](https://commerce.decionis.com).
+The proof-of-human infrastructure this package's `PresenceApprovalCoordinator` coordinates with is
+described at [decionis.com/proof-of-human-infrastructure](https://decionis.com/proof-of-human-infrastructure)
+and runs at [presence.decionis.com](https://presence.decionis.com); production enforcement there is
+sales-assisted.
+
 - Jejelowo, Festus. "The Execution Verifiability Gap: Why Model Governance Cannot Authorize
   Consequential Actions." Decionis Research, version 1.0, 21 August 2026.
   [Canonical article](https://decionis.com/research/execution-verifiability-gap) ·

package/dist/Index.d.ts

@@ -1,15 +1,23 @@
 export * from "./approval/PresenceApprovalCoordinator.js";
 export * from "./audit/AuditRecorder.js";
+export * from "./decision/CreateGate.js";
 export * from "./decision/DecisionAuthority.js";
 export * from "./decision/DecionisGate.js";
 export * from "./decision/FixtureDecisionAuthority.js";
+export * from "./decision/Provision.js";
+export * from "./decision/ShadowGate.js";
 export * from "./execution/ActionRegistry.js";
 export * from "./execution/AuthorizationVerifier.js";
 export * from "./execution/ReplayStore.js";
 export * from "./execution/SafeExecutor.js";
+export type { ClientSource } from "./http/ClientIdentification.js";
+export * from "./http/StoredCredentials.js";
 export * from "./intent/CanonicalIntentHasher.js";
 export * from "./intent/ExecutionIntent.js";
 export * from "./intent/IntentCapture.js";
 export * from "./intent/JsonValue.js";
+export * from "./report/DecisionReport.js";
+export * from "./report/DossierReport.js";
+export * from "./report/HostedOutcome.js";
 export * from "./shadow/ShadowPipeline.js";
 //# sourceMappingURL=Index.d.ts.map

package/dist/Index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Index.d.ts","sourceRoot":"","sources":["../src/Index.ts"],"names":[],"mappings":"AAAA,cAAc,2CAA2C,CAAC;AAC1D,cAAc,0BAA0B,CAAC;AACzC,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wCAAwC,CAAC;AACvD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,sCAAsC,CAAC;AACrD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,mCAAmC,CAAC;AAClD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,4BAA4B,CAAC"}
+{"version":3,"file":"Index.d.ts","sourceRoot":"","sources":["../src/Index.ts"],"names":[],"mappings":"AAAA,cAAc,2CAA2C,CAAC;AAC1D,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wCAAwC,CAAC;AACvD,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,sCAAsC,CAAC;AACrD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,YAAY,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACnE,cAAc,6BAA6B,CAAC;AAC5C,cAAc,mCAAmC,CAAC;AAClD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC"}

package/dist/Index.js

@@ -1,15 +1,22 @@
 export * from "./approval/PresenceApprovalCoordinator.js";
 export * from "./audit/AuditRecorder.js";
+export * from "./decision/CreateGate.js";
 export * from "./decision/DecisionAuthority.js";
 export * from "./decision/DecionisGate.js";
 export * from "./decision/FixtureDecisionAuthority.js";
+export * from "./decision/Provision.js";
+export * from "./decision/ShadowGate.js";
 export * from "./execution/ActionRegistry.js";
 export * from "./execution/AuthorizationVerifier.js";
 export * from "./execution/ReplayStore.js";
 export * from "./execution/SafeExecutor.js";
+export * from "./http/StoredCredentials.js";
 export * from "./intent/CanonicalIntentHasher.js";
 export * from "./intent/ExecutionIntent.js";
 export * from "./intent/IntentCapture.js";
 export * from "./intent/JsonValue.js";
+export * from "./report/DecisionReport.js";
+export * from "./report/DossierReport.js";
+export * from "./report/HostedOutcome.js";
 export * from "./shadow/ShadowPipeline.js";
 //# sourceMappingURL=Index.js.map

package/dist/Index.js.map

@@ -1 +1 @@
-{"version":3,"file":"Index.js","sourceRoot":"","sources":["../src/Index.ts"],"names":[],"mappings":"AAAA,cAAc,2CAA2C,CAAC;AAC1D,cAAc,0BAA0B,CAAC;AACzC,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wCAAwC,CAAC;AACvD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,sCAAsC,CAAC;AACrD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,mCAAmC,CAAC;AAClD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,4BAA4B,CAAC"}
+{"version":3,"file":"Index.js","sourceRoot":"","sources":["../src/Index.ts"],"names":[],"mappings":"AAAA,cAAc,2CAA2C,CAAC;AAC1D,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wCAAwC,CAAC;AACvD,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,sCAAsC,CAAC;AACrD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAE5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,mCAAmC,CAAC;AAClD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC"}

package/dist/audit/AuditRecorder.d.ts

@@ -2,7 +2,7 @@ import type { GateDecision } from "../decision/DecisionAuthority.js";
 import type { CapturedIntent } from "../intent/ExecutionIntent.js";
 import type { JsonObject, JsonValue } from "../intent/JsonValue.js";
 import type { VerifiedAuthorization } from "../execution/AuthorizationVerifier.js";
-export type AuditEventType = "INTENT_CAPTURED" | "AUTHORITY_DECISION" | "AUTHORITY_FAILED_CLOSED" | "PRESENCE_ESCALATED" | "PRESENCE_RESOLVED" | "SHADOW_EVALUATED" | "GRANT_CONSUMED" | "EXECUTION_STARTED" | "EXECUTION_COMPLETED" | "EXECUTION_BLOCKED" | "EXECUTION_FAILED_BEFORE_DISPATCH" | "EXECUTION_OUTCOME_UNKNOWN" | "RECONCILIATION_COMPLETED" | "RECONCILIATION_NOT_EXECUTED" | "RECONCILIATION_UNKNOWN";
+export type AuditEventType = "INTENT_CAPTURED" | "AUTHORITY_DECISION" | "AUTHORITY_FAILED_CLOSED" | "PRESENCE_ESCALATED" | "PRESENCE_RESOLVED" | "SHADOW_EVALUATED" | "GRANT_CONSUMED" | "EXECUTION_STARTED" | "EXECUTION_COMPLETED" | "EXECUTION_BLOCKED" | "EXECUTION_FAILED_BEFORE_DISPATCH" | "EXECUTION_REFUSED_AFTER_DISPATCH" | "EXECUTION_OUTCOME_UNKNOWN" | "RECONCILIATION_COMPLETED" | "RECONCILIATION_NOT_EXECUTED" | "RECONCILIATION_UNKNOWN";
 export type AuditAuthority = "AUTHORITATIVE" | "OBSERVATIONAL" | "NON_AUTHORITATIVE";
 export interface AuditPolicyRevision {
     readonly policyId: string;

package/dist/audit/AuditRecorder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuditRecorder.d.ts","sourceRoot":"","sources":["../../src/audit/AuditRecorder.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAEnF,MAAM,MAAM,cAAc,GACtB,iBAAiB,GACjB,oBAAoB,GACpB,yBAAyB,GACzB,oBAAoB,GACpB,mBAAmB,GACnB,kBAAkB,GAClB,gBAAgB,GAChB,mBAAmB,GACnB,qBAAqB,GACrB,mBAAmB,GACnB,kCAAkC,GAClC,2BAA2B,GAC3B,0BAA0B,GAC1B,6BAA6B,GAC7B,wBAAwB,CAAC;AAE7B,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG,eAAe,GAAG,mBAAmB,CAAC;AAErF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,UAAU,MAAM,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,UAAU,MAAM,EAAE,CAAC;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;QACrC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;QAC5C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;KAC3C,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;IACjD,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAClD;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,oFAAoF;IACpF,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,uBAAuB,CAAC;IAC9C,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,GAAG,0BAA0B,CAAC;IACpE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,KAAK,SAAS,GAAG,SAAS,CAAC;IACnF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,2BAA4B,SAAQ,mBAAmB;IACtE,mFAAmF;IACnF,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,CACL,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,2BAA2B,GAAG,IAAI,CAAC,GAAG,2BAA2B,GAAG,IAAI,CAAC;CACrF;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,GAC9D;IACE,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,iBAAiB,GAAG,mBAAmB,GAAG,aAAa,CAAC;IACrF,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;CACzB,CAAC;AAiBN;;;;GAIG;AACH,qBAAa,aAAa;IAOL,OAAO,CAAC,QAAQ,CAAC,OAAO;IAN3C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6C;IAC3E,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAsB;IACxD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;gBAEJ,OAAO,EAAE,oBAAoB;IAYjE,IAAW,+BAA+B,IAAI,OAAO,CAEpD;IAEY,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAyB9D,OAAO,CAAC,KAAK;IAmEb,OAAO,CAAC,UAAU;IAiClB,OAAO,CAAC,QAAQ;IAehB,OAAO,CAAC,QAAQ;IAkChB,OAAO,CAAC,SAAS;IAKjB,OAAO,CAAC,SAAS;IAOjB,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAS/B,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAI/B,OAAO,CAAC,MAAM,CAAC,YAAY;IAI3B,OAAO,CAAC,MAAM,CAAC,UAAU;CAS1B;AAED,4FAA4F;AAC5F,qBAAa,2BAA2B;IAIpC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAH3B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAGhB,QAAQ,EAAE,2BAA2B,EACtD,SAAS,SAAQ;IAKN,MAAM,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,uBAAuB,CAAC;CA6C3E"}
+{"version":3,"file":"AuditRecorder.d.ts","sourceRoot":"","sources":["../../src/audit/AuditRecorder.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAEnF,MAAM,MAAM,cAAc,GACtB,iBAAiB,GACjB,oBAAoB,GACpB,yBAAyB,GACzB,oBAAoB,GACpB,mBAAmB,GACnB,kBAAkB,GAClB,gBAAgB,GAChB,mBAAmB,GACnB,qBAAqB,GACrB,mBAAmB,GACnB,kCAAkC,GAClC,kCAAkC,GAClC,2BAA2B,GAC3B,0BAA0B,GAC1B,6BAA6B,GAC7B,wBAAwB,CAAC;AAE7B,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG,eAAe,GAAG,mBAAmB,CAAC;AAErF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,UAAU,MAAM,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,UAAU,MAAM,EAAE,CAAC;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;QACrC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;QAC5C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;KAC3C,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;IACjD,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAClD;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,oFAAoF;IACpF,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,uBAAuB,CAAC;IAC9C,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,GAAG,0BAA0B,CAAC;IACpE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,KAAK,SAAS,GAAG,SAAS,CAAC;IACnF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,2BAA4B,SAAQ,mBAAmB;IACtE,mFAAmF;IACnF,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,CACL,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,2BAA2B,GAAG,IAAI,CAAC,GAAG,2BAA2B,GAAG,IAAI,CAAC;CACrF;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,GAC9D;IACE,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,iBAAiB,GAAG,mBAAmB,GAAG,aAAa,CAAC;IACrF,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;CACzB,CAAC;AAiBN;;;;GAIG;AACH,qBAAa,aAAa;IAOL,OAAO,CAAC,QAAQ,CAAC,OAAO;IAN3C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6C;IAC3E,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAsB;IACxD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;gBAEJ,OAAO,EAAE,oBAAoB;IAYjE,IAAW,+BAA+B,IAAI,OAAO,CAEpD;IAEY,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAyB9D,OAAO,CAAC,KAAK;IAmEb,OAAO,CAAC,UAAU;IAiClB,OAAO,CAAC,QAAQ;IAehB,OAAO,CAAC,QAAQ;IAkChB,OAAO,CAAC,SAAS;IAKjB,OAAO,CAAC,SAAS;IAOjB,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAS/B,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAI/B,OAAO,CAAC,MAAM,CAAC,YAAY;IAI3B,OAAO,CAAC,MAAM,CAAC,UAAU;CAS1B;AAED,4FAA4F;AAC5F,qBAAa,2BAA2B;IAIpC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAH3B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAGhB,QAAQ,EAAE,2BAA2B,EACtD,SAAS,SAAQ;IAKN,MAAM,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,uBAAuB,CAAC;CA6C3E"}

package/dist/audit/AuditRecorder.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuditRecorder.js","sourceRoot":"","sources":["../../src/audit/AuditRecorder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAoHzC,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAC/C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAiB;IAChD,eAAe;IACf,eAAe;IACf,mBAAmB;CACpB,CAAC,CAAC;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAA0B,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AACxF,MAAM,uBAAuB,GAC3B,wFAAwF,CAAC;AAC3F,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,CAAC;AAEpC;;;;GAIG;AACH,MAAM,OAAO,aAAa;IAOY;IANnB,SAAS,CAAS;IAClB,aAAa,CAA6C;IAC1D,iBAAiB,CAAsB;IACvC,KAAK,CAAa;IAClB,QAAQ,CAAe;IAExC,YAAoC,OAA6B;QAA7B,YAAO,GAAP,OAAO,CAAsB;QAC/D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACxE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,aAAa,CAAC;QAC5D,IAAI,CAAC,iBAAiB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC;QAC/C,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,GAAG,oBAAoB,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,iBAAiB;YAAE,aAAa,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAChF,CAAC;IAED,IAAW,+BAA+B;QACxC,OAAO,IAAI,CAAC,aAAa,KAAK,0BAA0B,CAAC;IAC3D,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,KAAuB;QACzC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,SAAS,GAAG,MAAM,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;gBACvD,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,MAAM,MAAM,GAAG,CAAC,MAAe,EAAQ,EAAE;oBACvC,IAAI,OAAO;wBAAE,OAAO;oBACpB,OAAO,GAAG,IAAI,CAAC;oBACf,YAAY,CAAC,OAAO,CAAC,CAAC;oBACtB,OAAO,CAAC,MAAM,CAAC,CAAC;gBAClB,CAAC,CAAC;gBACF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBAChE,KAAK,OAAO,CAAC,OAAO,EAAE;qBACnB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;qBACtD,IAAI,CACH,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAClB,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CACpB,CAAC;YACN,CAAC,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAuB;QACnC,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/D,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACtD,IACE,KAAK,CAAC,UAAU,KAAK,SAAS;YAC9B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,EAC5D,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,EAAE,WAAW,IAAI,EAAE,CAAC;QAC3E,IAAI,WAAW,CAAC,MAAM,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC5E,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,aAAa,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACrF,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,SAAS,KAAK,kBAAkB,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,OAAO,IAAI,IAAI,CAAC;QACjE,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC;QAClE,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,SAAS,IAAI,SAAS,CAAC;QAC5E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC;QAC9D,qEAAqE;QACrE,IAAI,SAAS,KAAK,eAAe,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,UAAU,KAAK,SAAS;YAAE,aAAa,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACzE,IAAI,SAAS,KAAK,SAAS;YAAE,aAAa,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACvE,IAAI,OAAO,KAAK,SAAS;YAAE,aAAa,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACtD,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ;YAC/B,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC;YACnE,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,KAAK,GAAiB;YAC1B,aAAa,EAAE,oBAAoB;YACnC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE;YACtD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS;YACT,WAAW,EAAE;gBACX,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ;gBACxC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;gBACrC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS;oBACnD,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC3D,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;gBACnD,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;gBACjD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;aAC9C;YACD,UAAU;YACV,OAAO;YACP,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC;YAC7B,UAAU,EACR,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,GAAG,KAAK;YACtF,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;SACxC,CAAC;QACF,OAAO,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAEO,UAAU,CAChB,QAAwB,EACxB,QAAsB,EACtB,QAAkC;QAElC,MAAM,YAAY,GAAG,QAAQ,EAAE,YAAY,IAAI,QAAQ,CAAC,UAAU,CAAC;QACnE,MAAM,mBAAmB,GAAG,QAAQ,EAAE,mBAAmB,IAAI,QAAQ,CAAC,UAAU,CAAC;QACjF,MAAM,iBAAiB,GAAG,QAAQ,EAAE,iBAAiB,IAAI,QAAQ,CAAC,SAAS,CAAC;QAC5E,aAAa,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAC7C,aAAa,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC;QAChD,IAAI,iBAAiB,KAAK,IAAI;YAAE,aAAa,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;QAElF,IAAI,MAAM,GAA+B,IAAI,CAAC;QAC9C,IAAI,QAAQ,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YACnC,aAAa,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACzD,aAAa,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC3D,IAAI,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1C,aAAa,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC1D,CAAC;YACD,aAAa,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACnD,MAAM,GAAG,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAClC,CAAC;QACD,OAAO;YACL,YAAY;YACZ,mBAAmB;YACnB,MAAM;YACN,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAEO,QAAQ,CAAC,KAA2C;QAC1D,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClD,MAAM,MAAM,GAAe,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS;YACpF,MAAM,QAAQ,GACZ,IAAI,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9F,IAAI,QAAQ,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,kBAAkB,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAEO,QAAQ,CAAC,KAAgB,EAAE,KAAa,EAAE,KAA0B;QAC1E,IAAI,KAAK,GAAG,kBAAkB;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC3E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,MAAM,GAAG,mBAAmB;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAC1F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACxF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBACzB,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;gBACnB,IAAI,KAAK,CAAC,OAAO,GAAG,oBAAoB;oBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;gBACxF,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;YAChD,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAY,CAAC;QAC1D,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,IAAI,GAAe,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;gBACxE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAChD,CAAC;YACD,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;YACnB,IAAI,KAAK,CAAC,OAAO,GAAG,oBAAoB;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YACxF,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,SAAS,CAAC,KAAa;QAC7B,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,SAAS,CAAC,KAAW;QAC3B,IAAI,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,MAAM,CAAC,gBAAgB,CAAC,SAAyB;QACvD,IAAI,SAAS,KAAK,iBAAiB;YAAE,OAAO,mBAAmB,CAAC;QAChE,IAAI,SAAS,KAAK,kBAAkB;YAAE,OAAO,eAAe,CAAC;QAC7D,IAAI,SAAS,KAAK,oBAAoB,IAAI,SAAS,KAAK,mBAAmB,EAAE,CAAC;YAC5E,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IAEO,MAAM,CAAC,gBAAgB,CAAC,KAAa;QAC3C,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC/E,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,KAAa;QACvC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC3E,CAAC;IAEO,MAAM,CAAC,UAAU,CAAI,KAAQ;QACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3E,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC,EAAE,CAAC;gBACpE,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,4FAA4F;AAC5F,MAAM,OAAO,2BAA2B;IAInB;IAHF,SAAS,CAAS;IAEnC,YACmB,QAAqC,EACtD,SAAS,GAAG,KAAK;QADA,aAAQ,GAAR,QAAQ,CAA6B;QAGtD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,KAAmB;QACrC,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC;QAC3C,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAClD,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACtD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAChC,CAAC,OAAO,EAAE,EAAE;YACV,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,MAAM,GAAG,CAAC,KAAqD,EAAQ,EAAE;gBAC7E,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC,CAAC;YACF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACpE,KAAK,OAAO,CAAC,OAAO,EAAE;iBACnB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;iBACvF,IAAI,CACH,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC9B,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CACxB,CAAC;QACN,CAAC,CACF,CAAC;QACF,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC7E,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACpE,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU,EAAE,CAAC;YAC7F,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACzD,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;YACzC,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACvD,CAAC;QACD,IACE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YAChD,CAAC,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACvC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC;YACzC,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EACrC,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACnD,CAAC;QACD,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC;SACzC,CAAC;IACJ,CAAC;CACF;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IACzD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,QAAQ,IAAI,IAAI,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"AuditRecorder.js","sourceRoot":"","sources":["../../src/audit/AuditRecorder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAqHzC,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAC/C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAiB;IAChD,eAAe;IACf,eAAe;IACf,mBAAmB;CACpB,CAAC,CAAC;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAA0B,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AACxF,MAAM,uBAAuB,GAC3B,wFAAwF,CAAC;AAC3F,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,CAAC;AAEpC;;;;GAIG;AACH,MAAM,OAAO,aAAa;IAOY;IANnB,SAAS,CAAS;IAClB,aAAa,CAA6C;IAC1D,iBAAiB,CAAsB;IACvC,KAAK,CAAa;IAClB,QAAQ,CAAe;IAExC,YAAoC,OAA6B;QAA7B,YAAO,GAAP,OAAO,CAAsB;QAC/D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACxE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,aAAa,CAAC;QAC5D,IAAI,CAAC,iBAAiB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC;QAC/C,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,GAAG,oBAAoB,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,iBAAiB;YAAE,aAAa,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAChF,CAAC;IAED,IAAW,+BAA+B;QACxC,OAAO,IAAI,CAAC,aAAa,KAAK,0BAA0B,CAAC;IAC3D,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,KAAuB;QACzC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,SAAS,GAAG,MAAM,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;gBACvD,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,MAAM,MAAM,GAAG,CAAC,MAAe,EAAQ,EAAE;oBACvC,IAAI,OAAO;wBAAE,OAAO;oBACpB,OAAO,GAAG,IAAI,CAAC;oBACf,YAAY,CAAC,OAAO,CAAC,CAAC;oBACtB,OAAO,CAAC,MAAM,CAAC,CAAC;gBAClB,CAAC,CAAC;gBACF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBAChE,KAAK,OAAO,CAAC,OAAO,EAAE;qBACnB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;qBACtD,IAAI,CACH,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAClB,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CACpB,CAAC;YACN,CAAC,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAuB;QACnC,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/D,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACtD,IACE,KAAK,CAAC,UAAU,KAAK,SAAS;YAC9B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,EAC5D,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,EAAE,WAAW,IAAI,EAAE,CAAC;QAC3E,IAAI,WAAW,CAAC,MAAM,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC5E,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,aAAa,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACrF,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,SAAS,KAAK,kBAAkB,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,OAAO,IAAI,IAAI,CAAC;QACjE,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC;QAClE,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,SAAS,IAAI,SAAS,CAAC;QAC5E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC;QAC9D,qEAAqE;QACrE,IAAI,SAAS,KAAK,eAAe,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,UAAU,KAAK,SAAS;YAAE,aAAa,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACzE,IAAI,SAAS,KAAK,SAAS;YAAE,aAAa,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACvE,IAAI,OAAO,KAAK,SAAS;YAAE,aAAa,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACtD,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ;YAC/B,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC;YACnE,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,KAAK,GAAiB;YAC1B,aAAa,EAAE,oBAAoB;YACnC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE;YACtD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS;YACT,WAAW,EAAE;gBACX,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ;gBACxC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;gBACrC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS;oBACnD,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC3D,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;gBACnD,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;gBACjD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;aAC9C;YACD,UAAU;YACV,OAAO;YACP,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC;YAC7B,UAAU,EACR,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,GAAG,KAAK;YACtF,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;SACxC,CAAC;QACF,OAAO,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAEO,UAAU,CAChB,QAAwB,EACxB,QAAsB,EACtB,QAAkC;QAElC,MAAM,YAAY,GAAG,QAAQ,EAAE,YAAY,IAAI,QAAQ,CAAC,UAAU,CAAC;QACnE,MAAM,mBAAmB,GAAG,QAAQ,EAAE,mBAAmB,IAAI,QAAQ,CAAC,UAAU,CAAC;QACjF,MAAM,iBAAiB,GAAG,QAAQ,EAAE,iBAAiB,IAAI,QAAQ,CAAC,SAAS,CAAC;QAC5E,aAAa,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAC7C,aAAa,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC;QAChD,IAAI,iBAAiB,KAAK,IAAI;YAAE,aAAa,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;QAElF,IAAI,MAAM,GAA+B,IAAI,CAAC;QAC9C,IAAI,QAAQ,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YACnC,aAAa,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACzD,aAAa,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC3D,IAAI,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1C,aAAa,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC1D,CAAC;YACD,aAAa,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACnD,MAAM,GAAG,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAClC,CAAC;QACD,OAAO;YACL,YAAY;YACZ,mBAAmB;YACnB,MAAM;YACN,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAEO,QAAQ,CAAC,KAA2C;QAC1D,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClD,MAAM,MAAM,GAAe,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS;YACpF,MAAM,QAAQ,GACZ,IAAI,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9F,IAAI,QAAQ,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,kBAAkB,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAEO,QAAQ,CAAC,KAAgB,EAAE,KAAa,EAAE,KAA0B;QAC1E,IAAI,KAAK,GAAG,kBAAkB;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC3E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,MAAM,GAAG,mBAAmB;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAC1F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACxF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBACzB,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;gBACnB,IAAI,KAAK,CAAC,OAAO,GAAG,oBAAoB;oBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;gBACxF,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;YAChD,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAY,CAAC;QAC1D,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,IAAI,GAAe,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;gBACxE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAChD,CAAC;YACD,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;YACnB,IAAI,KAAK,CAAC,OAAO,GAAG,oBAAoB;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YACxF,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,SAAS,CAAC,KAAa;QAC7B,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,SAAS,CAAC,KAAW;QAC3B,IAAI,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,MAAM,CAAC,gBAAgB,CAAC,SAAyB;QACvD,IAAI,SAAS,KAAK,iBAAiB;YAAE,OAAO,mBAAmB,CAAC;QAChE,IAAI,SAAS,KAAK,kBAAkB;YAAE,OAAO,eAAe,CAAC;QAC7D,IAAI,SAAS,KAAK,oBAAoB,IAAI,SAAS,KAAK,mBAAmB,EAAE,CAAC;YAC5E,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IAEO,MAAM,CAAC,gBAAgB,CAAC,KAAa;QAC3C,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC/E,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,KAAa;QACvC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC3E,CAAC;IAEO,MAAM,CAAC,UAAU,CAAI,KAAQ;QACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3E,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC,EAAE,CAAC;gBACpE,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,4FAA4F;AAC5F,MAAM,OAAO,2BAA2B;IAInB;IAHF,SAAS,CAAS;IAEnC,YACmB,QAAqC,EACtD,SAAS,GAAG,KAAK;QADA,aAAQ,GAAR,QAAQ,CAA6B;QAGtD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,KAAmB;QACrC,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC;QAC3C,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAClD,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACtD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAChC,CAAC,OAAO,EAAE,EAAE;YACV,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,MAAM,GAAG,CAAC,KAAqD,EAAQ,EAAE;gBAC7E,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC,CAAC;YACF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACpE,KAAK,OAAO,CAAC,OAAO,EAAE;iBACnB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;iBACvF,IAAI,CACH,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC9B,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CACxB,CAAC;QACN,CAAC,CACF,CAAC;QACF,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC7E,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACpE,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU,EAAE,CAAC;YAC7F,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACzD,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;YACzC,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACvD,CAAC;QACD,IACE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YAChD,CAAC,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACvC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC;YACzC,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EACrC,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACnD,CAAC;QACD,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC;SACzC,CAAC;IACJ,CAAC;CACF;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IACzD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,QAAQ,IAAI,IAAI,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/decision/CreateGate.d.ts

@@ -0,0 +1,123 @@
+import { type AuthorizationVerifier } from "../execution/AuthorizationVerifier.js";
+import type { ClientSource } from "../http/ClientIdentification.js";
+import { type CredentialFiles } from "../http/StoredCredentials.js";
+import type { DecisionAuthority, DecisionEvaluationMode } from "./DecisionAuthority.js";
+import { type SignedDossierSummary } from "../report/DossierReport.js";
+import { type ProvisionOptions, type ProvisionedWorkspace } from "./Provision.js";
+export type GateMode = "LOCAL" | DecisionEvaluationMode;
+/** An authority and the verifier that can claim the grants it issues. */
+export interface AuthorityPair {
+    readonly authority: DecisionAuthority;
+    readonly verifier: AuthorizationVerifier;
+}
+export interface SelectedGate extends AuthorityPair {
+    readonly mode: GateMode;
+    /**
+     * The tenant a captured intent must name. In a hosted mode this is the
+     * key's own organization, because Decionis binds every intent to it; in
+     * `LOCAL` mode it is the `tenantId` the caller passed.
+     */
+    readonly tenantId: string;
+}
+export interface CreateGateOptions {
+    /**
+     * The pair that runs when no key is set. It keeps governing execution in
+     * `SHADOW` mode, and in `ENFORCEMENT` mode its authority can only tighten
+     * the hosted decision.
+     */
+    readonly local: AuthorityPair;
+    /** The tenant used when no key is set. */
+    readonly tenantId: string;
+    /** Defaults to `process.env`. */
+    readonly env?: Readonly<Record<string, string | undefined>>;
+    readonly fetch?: typeof fetch;
+    /** Carried in the `User-Agent` of hosted calls only; never sent without a key. */
+    readonly source?: ClientSource;
+}
+/**
+ * Selects the gate from the environment.
+ *
+ * `DECIONIS_API_KEY` unset: returns `local` itself, the same authority and
+ * verifier objects, with no client constructed and no network call. A caller
+ * that sets nothing gets exactly what it gets today.
+ *
+ * `DECIONIS_API_KEY` set: `DecionisGate` runs beside `local` through
+ * `ShadowGate`, in `DECIONIS_MODE` (`SHADOW` by default, `ENFORCEMENT` on
+ * request). `DECIONIS_TENANT_ID` is then required, because Decionis binds
+ * every intent to the key's own organization and refuses any other tenant.
+ * `DECIONIS_API_URL`, `DECIONIS_TIMEOUT_MS` and `DECIONIS_ALLOW_INSECURE_LOOPBACK`
+ * configure the connection the way the trusted executor's do.
+ */
+export declare function createGate(options: CreateGateOptions): SelectedGate;
+export type HostedCredentialSource = "environment" | "stored" | "provisioned";
+/** Where the hosted key came from, for the run to say so; null when the gate is local. */
+export interface HostedCredentials {
+    readonly source: HostedCredentialSource;
+    readonly tenantId: string;
+    readonly endpoint: string;
+    /** The file the key is kept in, when it is kept. */
+    readonly path: string | null;
+    readonly provisional: boolean;
+    /** How a person claims a provisioned workspace, as the authority stated it. */
+    readonly claim: Readonly<Record<string, unknown>> | null;
+}
+export interface HostedGate extends SelectedGate {
+    readonly credentials: HostedCredentials | null;
+    /**
+     * Fetches a dossier this gate's key minted and summarizes its proof; null
+     * when the gate is local. The key stays inside the closure.
+     */
+    readonly fetchDossier: ((dossierId: string) => Promise<{
+        readonly summary: SignedDossierSummary;
+        readonly body: unknown;
+    }>) | null;
+}
+export interface CreateHostedGateOptions extends CreateGateOptions, ResolveHostedCredentialsOptions {
+}
+/** Whether `DECIONIS_HOSTED` asks for the hosted gate. */
+export declare function hostedRequested(env: Readonly<Record<string, string | undefined>>): boolean;
+export interface ResolveHostedCredentialsOptions {
+    readonly env?: Readonly<Record<string, string | undefined>>;
+    readonly fetch?: typeof fetch;
+    readonly source?: ClientSource;
+    /**
+     * Where a provisioned key is kept between runs, so a second run reuses the
+     * workspace instead of minting another: the user's `agentsafe` credential
+     * file by default; `false` keeps nothing.
+     */
+    readonly store?: {
+        readonly home?: string;
+        readonly files?: CredentialFiles;
+    } | false;
+    /** Mints the workspace; the authority's own route by default. */
+    readonly provision?: (options: ProvisionOptions) => Promise<ProvisionedWorkspace>;
+    /** Where the one-time note about a provisioned workspace goes; standard error by default. */
+    readonly notice?: (line: string) => void;
+}
+/** The credentials a hosted run uses, and the environment overlay that carries them. */
+export interface ResolvedHostedCredentials {
+    readonly credentials: HostedCredentials;
+    /** The key, for the one place that must hold it: the environment of the gate or process. */
+    readonly apiKey: string;
+    readonly env: Readonly<Record<string, string | undefined>>;
+}
+/**
+ * Where a hosted run's key comes from, in order: the environment, the
+ * credential this user keeps for this authority, and when there is none and
+ * `DECIONIS_HOSTED` asks, a free provisional workspace minted now, kept for
+ * the next run and named on standard error once. Null when nothing asks for
+ * the hosted path at all.
+ */
+export declare function resolveHostedCredentials(options?: ResolveHostedCredentialsOptions): Promise<ResolvedHostedCredentials | null>;
+/**
+ * The gate `createGate` selects, with one more way onto Decionis: a single
+ * variable. `DECIONIS_HOSTED=1` with no key means the key this user already
+ * keeps for this authority, and when there is none, a free provisional
+ * workspace minted now, kept for the next run, and named on standard error
+ * once. A key in the environment still wins, and no variable at all is
+ * still the local pair. A provisional key evaluates in `SHADOW` only:
+ * recorded beside the local verdict, with a signed dossier, never governing
+ * execution; an owned key set in the environment takes the mode asked for.
+ */
+export declare function createHostedGate(options: CreateHostedGateOptions): Promise<HostedGate>;
+//# sourceMappingURL=CreateGate.d.ts.map

package/dist/decision/CreateGate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateGate.d.ts","sourceRoot":"","sources":["../../src/decision/CreateGate.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACxF,OAAO,EAAsB,KAAK,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAC3F,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAC1B,MAAM,gBAAgB,CAAC;AAGxB,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,sBAAsB,CAAC;AAExD,yEAAyE;AACzE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;CAC1C;AAED,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,0CAA0C;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,iCAAiC;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAKD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,YAAY,CAkCnE;AAgBD,MAAM,MAAM,sBAAsB,GAAG,aAAa,GAAG,QAAQ,GAAG,aAAa,CAAC;AAE9E,0FAA0F;AAC1F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;CAC1D;AAED,MAAM,WAAW,UAAW,SAAQ,YAAY;IAC9C,QAAQ,CAAC,WAAW,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,YAAY,EACjB,CAAC,CACC,SAAS,EAAE,MAAM,KACd,OAAO,CAAC;QAAE,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC,GACjF,IAAI,CAAC;CACV;AAED,MAAM,WAAW,uBACf,SAAQ,iBAAiB,EAAE,+BAA+B;CAAG;AAI/D,0DAA0D;AAC1D,wBAAgB,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,GAAG,OAAO,CAG1F;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAA;KAAE,GAAG,KAAK,CAAC;IACtF,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAClF,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC1C;AAED,wFAAwF;AACxF,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;CAC5D;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,GAAE,+BAAoC,GAC5C,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAkG3C;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,UAAU,CAAC,CAyB5F"}