@emilia-protocol/gate 0.10.0 → 0.13.0

package/dist/reports/auditor-workpaper.js

@@ -0,0 +1,545 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — auditor control-testing workpaper (ITGC / SOX-shaped).
+ *
+ * The artifact an external auditor's control test consumes: a pinned population
+ * of guarded gate decisions over a period, a deterministic (seed-reproducible,
+ * RNG-free) attribute sample, per-item attribute observations tied to named
+ * evidence-log fields, and an exception list — computed from the gate's
+ * tamper-evident evidence log. Pure function: same entries + same options in,
+ * identical JSON out (pin `now` for a byte-stable artifact).
+ *
+ * HONESTY BOUNDARY (carried inside the artifact): this workpaper SUPPORTS the
+ * auditor's control test. It never performs, reviews, or concludes the test —
+ * the sign-off fields are ALWAYS emitted null and rendered as blanks for the
+ * auditor to complete. A refusal (deny decision) is the deny-by-default control
+ * operating as designed and is NOT a control exception.
+ *
+ * Fail closed: missing client/engagement/control reference, an invalid or
+ * inverted period, a non-integer sample size, or a missing sample seed is an
+ * error, not a guess. Entries that cannot be verified as log records are
+ * EXCLUDED from the population and surfaced as integrity_warnings — the
+ * workpaper never samples what it cannot account for. Window is half-open
+ * [periodStart, periodEnd): an entry stamped exactly at periodEnd belongs to
+ * the NEXT period, so adjacent workpapers never double-count.
+ */
+import crypto from 'node:crypto';
+export const AUDIT_WORKPAPER_VERSION = 'EP-GATE-AUDIT-WORKPAPER-v1';
+/**
+ * Mandatory honesty header. Present verbatim in every workpaper and every
+ * rendered view; a document without it is not an EP-GATE-AUDIT-WORKPAPER-v1.
+ */
+export const AUDIT_WORKPAPER_HONESTY_NOTICE = 'This workpaper was prepared from the deploying organization\'s tamper-evident '
+    + 'evidence log to SUPPORT control testing. It supplies the population, a '
+    + 'reproducible sample, and per-item attribute observations; it does not perform '
+    + 'the test. The auditor performs and concludes the test and remains responsible '
+    + 'for sample evaluation and any conclusion drawn. This is not an audit opinion, '
+    + 'and nothing in this document constitutes a conclusion, certification, or '
+    + 'attestation by the preparer or by EMILIA Gate.';
+/**
+ * Refusal treatment is a structural statement of the format, not commentary:
+ * a denial is the control WORKING, so it can never be a control exception.
+ */
+export const REFUSAL_TREATMENT = 'A refusal (deny decision) is the deny-by-default control operating as designed: '
+    + 'the gate withheld execution. Refusals are therefore NOT control exceptions. '
+    + 'Attributes A1-A5 describe properties of a granted authorization and are recorded '
+    + 'as not_applicable on refusals; only A6 (the refusal was durably logged in the '
+    + 'tamper-evident chain) is tested on a refusal.';
+/**
+ * The attribute test plan. Each attribute names the evidence-log field(s) the
+ * observation is read from, so the auditor can retrace every pass/fail to the
+ * underlying record. Missing or malformed evidence FAILS the attribute — an
+ * observation the log cannot support is never presumed to pass.
+ */
+export const AUDIT_ATTRIBUTES = [
+    {
+        id: 'A1',
+        name: 'receipt_verified_against_pinned_issuer',
+        evidence_field: 'signer',
+        test: 'The decision records the pinned issuer key that verified the receipt signature. The gate sets `signer` only after Ed25519 verification against pinned/registry issuer keys; an allow without a recorded signer fails.',
+    },
+    {
+        id: 'A2',
+        name: 'credited_assurance_tier_meets_required',
+        evidence_field: 'have_tier, required_tier',
+        test: 'The cryptographically credited assurance tier meets or exceeds the tier the manifest requires for this action. An unknown or missing tier on either side fails (fail closed).',
+    },
+    {
+        id: 'A3',
+        name: 'not_a_replay',
+        evidence_field: 'reason, receipt_id',
+        test: 'The authorization was granted on a fresh presentation: the decision reason is `allow` and a stable issuer-generated receipt_id (the replay-defense key) is present. Without a receipt_id, replay detection is impossible for this decision.',
+    },
+    {
+        id: 'A4',
+        name: 'one_time_consumption_recorded',
+        evidence_field: 'consumption_mode',
+        test: 'One-time consumption of the receipt was actually recorded (`consume` or `reserve`). Mode `none` means replay defense was explicitly bypassed for this decision and fails.',
+    },
+    {
+        id: 'A5',
+        name: 'named_principal_present',
+        evidence_field: 'subject',
+        test: 'A named principal (the receipt subject) is recorded on the decision, attributing the authorization to a human identity as pinned by the deployer.',
+    },
+    {
+        id: 'A6',
+        name: 'decision_logged_tamper_evident',
+        evidence_field: 'hash, prev_hash, seq',
+        test: 'The decision is a well-formed record of the hash-chained evidence log: 64-hex record hash, non-empty prev_hash, non-negative integer seq.',
+    },
+];
+const TIER_RANK = { software: 0, class_a: 1, quorum: 2 };
+const HEX64 = /^[0-9a-f]{64}$/;
+function sha256hex(s) {
+    return crypto.createHash('sha256').update(s, 'utf8').digest('hex');
+}
+function toMs(t) {
+    if (t == null)
+        return null;
+    const ms = typeof t === 'number' ? t : Date.parse(t);
+    return Number.isFinite(ms) ? ms : null;
+}
+function nonEmptyString(v) {
+    return typeof v === 'string' && v.length > 0;
+}
+/* ------------------------- attribute observations ------------------------ */
+function observeA1(e) {
+    return { pass: nonEmptyString(e.signer), observed: nonEmptyString(e.signer) ? e.signer : 'signer absent' };
+}
+function observeA2(e) {
+    const have = e.have_tier;
+    const req = e.required_tier;
+    const pass = nonEmptyString(have) && nonEmptyString(req)
+        && TIER_RANK[have] !== undefined && TIER_RANK[req] !== undefined
+        && TIER_RANK[have] >= TIER_RANK[req];
+    return { pass, observed: `credited=${have ?? 'absent'} required=${req ?? 'absent'}` };
+}
+function observeA3(e) {
+    const pass = e.reason === 'allow' && nonEmptyString(e.receipt_id);
+    return { pass, observed: `reason=${e.reason ?? 'absent'} receipt_id=${nonEmptyString(e.receipt_id) ? e.receipt_id : 'absent'}` };
+}
+function observeA4(e) {
+    const pass = e.consumption_mode === 'consume' || e.consumption_mode === 'reserve';
+    return { pass, observed: `consumption_mode=${e.consumption_mode ?? 'absent'}` };
+}
+function observeA5(e) {
+    return { pass: nonEmptyString(e.subject), observed: nonEmptyString(e.subject) ? e.subject : 'subject absent' };
+}
+function observeA6(e) {
+    const pass = nonEmptyString(e.hash) && HEX64.test(e.hash)
+        && nonEmptyString(e.prev_hash)
+        && Number.isInteger(e.seq) && e.seq >= 0;
+    return {
+        pass,
+        observed: `hash=${nonEmptyString(e.hash) && HEX64.test(e.hash) ? 'well-formed' : 'malformed'} prev_hash=${nonEmptyString(e.prev_hash) ? 'present' : 'absent'} seq=${Number.isInteger(e.seq) ? e.seq : 'absent'}`,
+    };
+}
+const OBSERVERS = { A1: observeA1, A2: observeA2, A3: observeA3, A4: observeA4, A5: observeA5, A6: observeA6 };
+/** Attributes tested even on a refusal (the refusal itself must be accounted for). */
+const REFUSAL_TESTED = new Set(['A6']);
+function testItem(e) {
+    const isRefusal = e.allow === false;
+    const attributes = AUDIT_ATTRIBUTES.map((a) => {
+        if (isRefusal && !REFUSAL_TESTED.has(a.id)) {
+            return {
+                id: a.id,
+                name: a.name,
+                evidence_field: a.evidence_field,
+                result: 'not_applicable',
+                observed: `refusal (reason=${e.reason ?? 'unspecified'}) — control operated as designed; attribute describes a granted authorization`,
+            };
+        }
+        const { pass, observed } = OBSERVERS[a.id](e);
+        return { id: a.id, name: a.name, evidence_field: a.evidence_field, result: pass ? 'pass' : 'fail', observed };
+    });
+    return {
+        hash: e.hash,
+        seq: Number.isInteger(e.seq) ? e.seq : null,
+        at: e.at,
+        action: nonEmptyString(e.action) ? e.action : null,
+        verdict: isRefusal ? 'refusal' : 'allow',
+        reason: nonEmptyString(e.reason) ? e.reason : null,
+        attributes,
+    };
+}
+/* --------------------------------- build --------------------------------- */
+/**
+ * Build the control-testing workpaper over a slice of the evidence log.
+ *
+ * Population = every well-formed guarded decision entry in the half-open
+ * window [periodStart, periodEnd). `population_hash` pins the population
+ * itself: sha256 over the lexicographically sorted entry hashes, newline-
+ * joined — the auditor can recompute it from the listed items.
+ *
+ * Sampling is deterministic and RNG-free: for each population entry compute
+ * sha256(sampleSeed + entry_hash) as lowercase hex; order ascending (ties
+ * broken by entry hash); select the first sampleSize entries. Reproducible by
+ * the auditor from the same seed and the same population. sampleSize >= the
+ * population size selects the full population ("100% examination").
+ *
+ * @param {Array<object>} entries  evidence.all() (or a durable export of it)
+ * @param {object} [o]
+ * @param {string} [o.client]       audit client / deploying organization (required)
+ * @param {string} [o.engagement]   engagement reference (required)
+ * @param {string} [o.controlRef]   control identifier under test (required)
+ * @param {string|number} [o.periodStart]  inclusive window start (ISO or epoch ms)
+ * @param {string|number} [o.periodEnd]    EXCLUSIVE window end (ISO or epoch ms)
+ * @param {number} [o.sampleSize]   positive integer sample size (required)
+ * @param {string} [o.sampleSeed]   seed pinning the sample selection (required)
+ * @param {number|Function} [o.now=Date.now]  clock for generated_at (pin for determinism)
+ * @returns {object} EP-GATE-AUDIT-WORKPAPER-v1 document
+ */
+export function buildAuditWorkpaper(entries = [], { client, engagement, controlRef, periodStart, periodEnd, sampleSize, sampleSeed, now = Date.now, } = {}) {
+    if (!Array.isArray(entries))
+        throw new Error('audit workpaper: entries must be an array (evidence.all())');
+    if (!nonEmptyString(client))
+        throw new Error('audit workpaper: client is required');
+    if (!nonEmptyString(engagement))
+        throw new Error('audit workpaper: engagement is required');
+    if (!nonEmptyString(controlRef))
+        throw new Error('audit workpaper: controlRef is required');
+    const startMs = toMs(periodStart);
+    const endMs = toMs(periodEnd);
+    if (startMs == null || endMs == null) {
+        throw new Error('audit workpaper: periodStart and periodEnd must be ISO timestamps or epoch ms');
+    }
+    if (endMs <= startMs)
+        throw new Error('audit workpaper: empty or inverted period (periodEnd must be after periodStart)');
+    if (!Number.isInteger(sampleSize) || sampleSize < 1) {
+        throw new Error('audit workpaper: sampleSize must be a positive integer');
+    }
+    if (!nonEmptyString(sampleSeed)) {
+        throw new Error('audit workpaper: sampleSeed is required — the sample must be reproducible by the auditor');
+    }
+    // Scope + integrity pass. Out-of-window records are out of scope; records we
+    // cannot verify as log entries are warned AND excluded — never sampled over.
+    const warnings = [];
+    const population = []; // guarded decision entries, in supplied (log) order
+    let inWindow = 0;
+    let outsideWindow = 0;
+    let notGuarded = 0;
+    let executions = 0;
+    entries.forEach((e, index) => {
+        const ref = { index, seq: e && typeof e === 'object' && Number.isInteger(e.seq) ? e.seq : null };
+        if (!e || typeof e !== 'object' || Array.isArray(e)) {
+            warnings.push({ ...ref, problem: 'not_an_object' });
+            return;
+        }
+        // An entry whose timestamp cannot be parsed cannot be placed in ANY period;
+        // it is warned, never silently assigned in or out of the window.
+        const t = toMs(e.at);
+        if (t == null) {
+            warnings.push({ ...ref, problem: 'missing_or_unparseable_at' });
+            return;
+        }
+        if (t < startMs || t >= endMs) {
+            outsideWindow += 1;
+            return;
+        }
+        if (!nonEmptyString(e.hash)) {
+            warnings.push({ ...ref, problem: 'missing_hash' });
+            return;
+        }
+        if (e.kind !== 'decision' && e.kind !== 'execution') {
+            warnings.push({ ...ref, problem: 'unknown_kind', kind: e.kind ?? null });
+            return;
+        }
+        inWindow += 1;
+        if (e.kind === 'execution') {
+            executions += 1;
+            return;
+        }
+        if (typeof e.allow !== 'boolean') {
+            warnings.push({ ...ref, problem: 'decision_missing_allow' });
+            inWindow -= 1;
+            return;
+        }
+        if (e.reason === 'not_guarded') {
+            notGuarded += 1;
+            return;
+        } // ran OUTSIDE the control — not in the tested population
+        population.push(e);
+    });
+    // Pin the population itself: order-independent hash over the entry hashes.
+    const popHashes = population.map((e) => e.hash);
+    const populationHash = sha256hex([...popHashes].sort().join('\n'));
+    // Deterministic, RNG-free sampling — reproducible from (seed, population).
+    const keyed = population
+        .map((e) => ({ e, key: sha256hex(sampleSeed + e.hash) }))
+        .sort((a, b) => (a.key < b.key ? -1 : a.key > b.key ? 1 : (a.e.hash < b.e.hash ? -1 : 1)));
+    const fullPopulation = sampleSize >= population.length;
+    const selected = fullPopulation ? keyed : keyed.slice(0, sampleSize);
+    const testedItems = selected.map(({ e }) => testItem(e));
+    // Exceptions = failed attributes on sampled items. Refusals cannot produce
+    // A1-A5 exceptions by construction (not_applicable) — see REFUSAL_TREATMENT.
+    const exceptions = [];
+    for (const item of testedItems) {
+        for (const a of item.attributes) {
+            if (a.result === 'fail') {
+                exceptions.push({
+                    entry_hash: item.hash,
+                    seq: item.seq,
+                    at: item.at,
+                    action: item.action,
+                    attribute: a.id,
+                    name: a.name,
+                    evidence_field: a.evidence_field,
+                    observed: a.observed,
+                });
+            }
+        }
+    }
+    // Chain head at export time: the last supplied entry carrying a hash.
+    let chainHead = null;
+    for (let i = entries.length - 1; i >= 0; i -= 1) {
+        const e = entries[i];
+        if (e && typeof e === 'object' && nonEmptyString(e.hash)) {
+            chainHead = e.hash;
+            break;
+        }
+    }
+    const nowMs = typeof now === 'function' ? now() : now;
+    return {
+        '@version': AUDIT_WORKPAPER_VERSION,
+        notice: AUDIT_WORKPAPER_HONESTY_NOTICE,
+        client,
+        engagement,
+        control: {
+            ref: controlRef,
+            name: 'EMILIA Gate — deny-by-default authorization of consequential machine actions',
+            statement: 'Guarded actions execute only with a valid, in-scope, sufficiently-assured, fresh, one-time authorization receipt from a named principal; every decision (allow or refusal) is appended to a hash-chained, tamper-evident evidence log.',
+        },
+        period: { start: new Date(startMs).toISOString(), end: new Date(endMs).toISOString(), end_exclusive: true },
+        generated_at: new Date(nowMs).toISOString(),
+        population: {
+            size: population.length,
+            population_hash: populationHash,
+            hash_method: 'sha256 over the lexicographically sorted entry hashes, newline-joined',
+            excluded: {
+                outside_window: outsideWindow,
+                not_guarded_passthroughs: notGuarded,
+                executions,
+                integrity_warnings: warnings.length,
+            },
+            items: population.map((e) => ({
+                hash: e.hash,
+                seq: Number.isInteger(e.seq) ? e.seq : null,
+                at: e.at,
+                action: nonEmptyString(e.action) ? e.action : null,
+                allow: e.allow,
+                reason: nonEmptyString(e.reason) ? e.reason : null,
+            })),
+        },
+        sampling: {
+            method: 'Deterministic attribute sampling, no RNG: for each population entry compute sha256(seed + entry_hash) as lowercase hex; order ascending (ties broken by entry hash); select the first sample_size entries. Reproducible from the same seed and the same population.',
+            seed: sampleSeed,
+            requested_size: sampleSize,
+            selected_size: selected.length,
+            full_population: fullPopulation,
+            basis: fullPopulation ? '100% examination' : 'attribute sample',
+            selected: selected.map(({ e }) => e.hash),
+        },
+        attribute_testing: {
+            plan: AUDIT_ATTRIBUTES,
+            refusal_treatment: REFUSAL_TREATMENT,
+            items: testedItems,
+        },
+        exceptions: {
+            total: exceptions.length,
+            refusals_are_not_exceptions: REFUSAL_TREATMENT,
+            items: exceptions,
+        },
+        completeness: {
+            entries_supplied: entries.length,
+            entries_in_window: inWindow,
+            population_size: population.length,
+            first_population_hash: popHashes[0] ?? null,
+            last_population_hash: popHashes[popHashes.length - 1] ?? null,
+            chain_head: chainHead,
+        },
+        integrity_warnings: warnings,
+        // The module NEVER concludes. These are the auditor's fields, emitted null
+        // by construction and rendered as blanks to fill.
+        conclusion: { tested_by: null, reviewed_by: null, conclusion: null },
+    };
+}
+/* -------------------------------- markdown ------------------------------- */
+/**
+ * Table cells must not break the table; the source strings are log-derived.
+ * Backslash is escaped FIRST: escaping only the pipe turns a log-derived
+ * `a\|b` into `a\\|b`, where the `\\` renders as a literal backslash and
+ * leaves the pipe live as a cell delimiter, letting an action or refusal
+ * reason split its cell and shift every column after it.
+ */
+function cell(v) {
+    return String(v ?? '—')
+        .replace(/\\/g, '\\\\')
+        .replace(/\|/g, '\\|')
+        .replace(/\r?\n/g, ' ');
+}
+const BLANK = '`____________________`';
+function resultMark(r) {
+    return r === 'pass' ? 'pass' : r === 'fail' ? 'FAIL' : 'n/a';
+}
+/**
+ * Render the workpaper for the audit file. Refuses any document that is not a
+ * verbatim EP-GATE-AUDIT-WORKPAPER-v1: wrong @version, an altered or removed
+ * honesty notice, or machine-filled sign-off fields (the format defines them
+ * as always-null; a filled conclusion did not come from this module and must
+ * never render as an apparently machine-supported conclusion).
+ */
+export function renderMarkdown(pack) {
+    if (!pack || typeof pack !== 'object' || pack['@version'] !== AUDIT_WORKPAPER_VERSION) {
+        throw new Error(`audit workpaper: renderMarkdown requires an ${AUDIT_WORKPAPER_VERSION} document`);
+    }
+    if (pack.notice !== AUDIT_WORKPAPER_HONESTY_NOTICE) {
+        throw new Error('audit workpaper: refusing to render a document whose honesty notice was altered or removed');
+    }
+    const c = pack.conclusion;
+    if (!c || typeof c !== 'object' || c.tested_by !== null || c.reviewed_by !== null || c.conclusion !== null) {
+        throw new Error('audit workpaper: refusing to render — sign-off fields must be null (the auditor completes them on the rendered workpaper, never in the machine artifact)');
+    }
+    const L = [];
+    L.push('# Control-Testing Workpaper — EMILIA Gate');
+    L.push('');
+    L.push(`> ${pack.notice}`);
+    L.push('');
+    L.push(`- **Format:** ${AUDIT_WORKPAPER_VERSION}`);
+    L.push(`- **Client:** ${cell(pack.client)}`);
+    L.push(`- **Engagement:** ${cell(pack.engagement)}`);
+    L.push(`- **Control:** ${cell(pack.control.ref)} — ${cell(pack.control.name)}`);
+    L.push(`- **Period:** ${pack.period.start} — ${pack.period.end} (end exclusive)`);
+    L.push(`- **Generated:** ${pack.generated_at}`);
+    L.push('');
+    L.push('## Control under test');
+    L.push('');
+    L.push(pack.control.statement);
+    L.push('');
+    L.push('## Population');
+    L.push('');
+    L.push(`- Guarded decisions in window: **${pack.population.size}**`);
+    L.push(`- Population hash: \`${cell(pack.population.population_hash)}\` (${pack.population.hash_method})`);
+    L.push(`- Excluded: ${pack.population.excluded.outside_window} outside window, ${pack.population.excluded.not_guarded_passthroughs} not-guarded pass-through(s), ${pack.population.excluded.executions} execution record(s), ${pack.population.excluded.integrity_warnings} integrity warning(s)`);
+    if (pack.population.items.length === 0) {
+        L.push('');
+        L.push('_No guarded decisions in the period. A zero-activity population is a valid (boring) result, not an error._');
+    }
+    else {
+        L.push('');
+        L.push('| Seq | At | Action | Verdict | Reason | Entry hash |');
+        L.push('| ---: | --- | --- | --- | --- | --- |');
+        for (const it of pack.population.items) {
+            L.push(`| ${cell(it.seq)} | ${cell(it.at)} | ${cell(it.action)} | ${it.allow ? 'allow' : 'refusal'} | ${cell(it.reason)} | \`${cell(it.hash)}\` |`);
+        }
+    }
+    L.push('');
+    L.push('## Sampling');
+    L.push('');
+    L.push(`- Method: ${pack.sampling.method}`);
+    L.push(`- Seed: \`${cell(pack.sampling.seed)}\``);
+    L.push(`- Requested: ${pack.sampling.requested_size} · Selected: ${pack.sampling.selected_size} · Basis: **${pack.sampling.basis}**`);
+    if (pack.sampling.selected.length) {
+        L.push('- Selected entry hashes (selection order):');
+        for (const h of pack.sampling.selected)
+            L.push(`  - \`${cell(h)}\``);
+    }
+    else {
+        L.push('- Selected entry hashes: _none (empty population)_');
+    }
+    L.push('');
+    L.push('## Attribute test plan');
+    L.push('');
+    L.push('| # | Attribute | Evidence field(s) | Test |');
+    L.push('| --- | --- | --- | --- |');
+    for (const a of pack.attribute_testing.plan) {
+        L.push(`| ${a.id} | ${cell(a.name)} | ${cell(a.evidence_field)} | ${cell(a.test)} |`);
+    }
+    L.push('');
+    L.push(`> ${pack.attribute_testing.refusal_treatment}`);
+    L.push('');
+    L.push('## Attribute results');
+    if (pack.attribute_testing.items.length === 0) {
+        L.push('');
+        L.push('_No items sampled (empty population)._');
+    }
+    else {
+        L.push('');
+        L.push('| Item | At | Action | Verdict | A1 | A2 | A3 | A4 | A5 | A6 |');
+        L.push('| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |');
+        for (const it of pack.attribute_testing.items) {
+            const marks = it.attributes.map((a) => resultMark(a.result));
+            L.push(`| \`${cell(it.hash)}\` | ${cell(it.at)} | ${cell(it.action)} | ${it.verdict} | ${marks.join(' | ')} |`);
+        }
+        L.push('');
+        L.push('Observations (per attribute, per item):');
+        L.push('');
+        for (const it of pack.attribute_testing.items) {
+            L.push(`- \`${cell(it.hash)}\` (${it.verdict}${it.reason ? `, reason: ${cell(it.reason)}` : ''})`);
+            for (const a of it.attributes) {
+                L.push(`  - ${a.id} ${cell(a.name)} [${resultMark(a.result)}] — ${cell(a.evidence_field)}: ${cell(a.observed)}`);
+            }
+        }
+    }
+    L.push('');
+    L.push('## Exceptions');
+    L.push('');
+    L.push(`> ${pack.exceptions.refusals_are_not_exceptions}`);
+    L.push('');
+    if (pack.exceptions.total === 0) {
+        L.push('No exceptions: no sampled item failed an applicable attribute.');
+    }
+    else {
+        L.push(`${pack.exceptions.total} failed attribute observation(s):`);
+        L.push('');
+        L.push('| Entry hash | Seq | Attribute | Evidence field(s) | Observed |');
+        L.push('| --- | ---: | --- | --- | --- |');
+        for (const x of pack.exceptions.items) {
+            L.push(`| \`${cell(x.entry_hash)}\` | ${cell(x.seq)} | ${x.attribute} ${cell(x.name)} | ${cell(x.evidence_field)} | ${cell(x.observed)} |`);
+        }
+    }
+    L.push('');
+    L.push('## Completeness');
+    L.push('');
+    L.push(`- Log entries supplied: ${pack.completeness.entries_supplied} · in window: ${pack.completeness.entries_in_window} · population: ${pack.completeness.population_size}`);
+    L.push(`- First population hash: ${pack.completeness.first_population_hash ? `\`${cell(pack.completeness.first_population_hash)}\`` : '—'}`);
+    L.push(`- Last population hash: ${pack.completeness.last_population_hash ? `\`${cell(pack.completeness.last_population_hash)}\`` : '—'}`);
+    L.push(`- Evidence chain head at export: ${pack.completeness.chain_head ? `\`${cell(pack.completeness.chain_head)}\`` : '—'}`);
+    L.push('');
+    L.push('## Integrity warnings');
+    if (pack.integrity_warnings.length === 0) {
+        L.push('');
+        L.push('None.');
+    }
+    else {
+        L.push('');
+        L.push(`${pack.integrity_warnings.length} supplied entr(ies) could not be verified as log records and are EXCLUDED from the population above:`);
+        L.push('');
+        L.push('| Index | Seq | Problem |');
+        L.push('| ---: | ---: | --- |');
+        for (const w of pack.integrity_warnings) {
+            L.push(`| ${w.index} | ${cell(w.seq)} | ${cell(w.problem)} |`);
+        }
+    }
+    L.push('');
+    L.push('## Sign-off (auditor completes)');
+    L.push('');
+    L.push('_These fields are intentionally blank. The preparer of this workpaper does not perform, review, or conclude the test._');
+    L.push('');
+    L.push('| Field | Entry |');
+    L.push('| --- | --- |');
+    L.push(`| Tested by / date | ${BLANK} |`);
+    L.push(`| Reviewed by / date | ${BLANK} |`);
+    L.push(`| Conclusion | ${BLANK} |`);
+    L.push('');
+    return L.join('\n');
+}
+export default {
+    AUDIT_WORKPAPER_VERSION,
+    AUDIT_WORKPAPER_HONESTY_NOTICE,
+    AUDIT_ATTRIBUTES,
+    REFUSAL_TREATMENT,
+    buildAuditWorkpaper,
+    renderMarkdown,
+};
+//# sourceMappingURL=auditor-workpaper.js.map

package/dist/reports/auditor-workpaper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditor-workpaper.js","sourceRoot":"","sources":["../../src/reports/auditor-workpaper.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAIjC,MAAM,CAAC,MAAM,uBAAuB,GAAG,4BAA4B,CAAC;AAEpE;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GACzC,gFAAgF;MAC9E,yEAAyE;MACzE,gFAAgF;MAChF,gFAAgF;MAChF,gFAAgF;MAChF,2EAA2E;MAC3E,gDAAgD,CAAC;AAErD;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,kFAAkF;MAChF,8EAA8E;MAC9E,mFAAmF;MACnF,gFAAgF;MAChF,+CAA+C,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B;QACE,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,wCAAwC;QAC9C,cAAc,EAAE,QAAQ;QACxB,IAAI,EAAE,uNAAuN;KAC9N;IACD;QACE,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,wCAAwC;QAC9C,cAAc,EAAE,0BAA0B;QAC1C,IAAI,EAAE,+KAA+K;KACtL;IACD;QACE,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,cAAc;QACpB,cAAc,EAAE,oBAAoB;QACpC,IAAI,EAAE,6OAA6O;KACpP;IACD;QACE,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,+BAA+B;QACrC,cAAc,EAAE,kBAAkB;QAClC,IAAI,EAAE,2KAA2K;KAClL;IACD;QACE,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,yBAAyB;QAC/B,cAAc,EAAE,SAAS;QACzB,IAAI,EAAE,mJAAmJ;KAC1J;IACD;QACE,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,gCAAgC;QACtC,cAAc,EAAE,sBAAsB;QACtC,IAAI,EAAE,2IAA2I;KAClJ;CACF,CAAC;AAEF,MAAM,SAAS,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AACzD,MAAM,KAAK,GAAG,gBAAgB,CAAC;AAE/B,SAAS,SAAS,CAAC,CAAC;IAClB,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,IAAI,CAAC,CAAC;IACb,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAED,SAAS,cAAc,CAAC,CAAC;IACvB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,+EAA+E;AAE/E,SAAS,SAAS,CAAC,CAAC;IAClB,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;AAC7G,CAAC;AACD,SAAS,SAAS,CAAC,CAAC;IAClB,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC;IACzB,MAAM,GAAG,GAAG,CAAC,CAAC,aAAa,CAAC;IAC5B,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC;WACnD,SAAS,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,SAAS;WAC7D,SAAS,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,IAAI,IAAI,QAAQ,aAAa,GAAG,IAAI,QAAQ,EAAE,EAAE,CAAC;AACxF,CAAC;AACD,SAAS,SAAS,CAAC,CAAC;IAClB,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAClE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,MAAM,IAAI,QAAQ,eAAe,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;AACnI,CAAC;AACD,SAAS,SAAS,CAAC,CAAC;IAClB,MAAM,IAAI,GAAG,CAAC,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,CAAC,gBAAgB,KAAK,SAAS,CAAC;IAClF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAC,gBAAgB,IAAI,QAAQ,EAAE,EAAE,CAAC;AAClF,CAAC;AACD,SAAS,SAAS,CAAC,CAAC;IAClB,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC;AACjH,CAAC;AACD,SAAS,SAAS,CAAC,CAAC;IAClB,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;WACpD,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;WAC3B,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3C,OAAO;QACL,IAAI;QACJ,QAAQ,EAAE,QAAQ,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,cAAc,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,QAAQ,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE;KACjN,CAAC;AACJ,CAAC;AAED,MAAM,SAAS,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;AAE/G,sFAAsF;AACtF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAEvC,SAAS,QAAQ,CAAC,CAAC;IACjB,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC;IACpC,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5C,IAAI,SAAS,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3C,OAAO;gBACL,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,cAAc,EAAE,CAAC,CAAC,cAAc;gBAChC,MAAM,EAAE,gBAAgB;gBACxB,QAAQ,EAAE,mBAAmB,CAAC,CAAC,MAAM,IAAI,aAAa,+EAA+E;aACtI,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;IAChH,CAAC,CAAC,CAAC;IACH,OAAO;QACL,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;QAC3C,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QAClD,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;QACxC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QAClD,UAAU;KACX,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAiB,EAAE,EAAE,EACvD,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,MAU5F,EAAE;IACJ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC3G,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACpF,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC5F,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9B,IAAI,OAAO,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,KAAK,IAAI,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACzH,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAK,UAAqB,GAAG,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAC;IAC9G,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,QAAQ,GAAU,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAU,EAAE,CAAC,CAAC,oDAAoD;IAClF,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE;QAC3B,MAAM,GAAG,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjG,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACrH,4EAA4E;QAC5E,iEAAiE;QACjE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC3F,IAAI,CAAC,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;YAAC,aAAa,IAAI,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC9D,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC5F,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC1I,QAAQ,IAAI,CAAC,CAAC;QACd,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAAC,UAAU,IAAI,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACxD,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAAC,QAAQ,IAAI,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC1H,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YAAC,UAAU,IAAI,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC,CAAC,yDAAyD;QACtH,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,cAAc,GAAG,SAAS,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEnE,2EAA2E;IAC3E,MAAM,KAAK,GAAG,UAAU;SACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SACxD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,cAAc,GAAI,UAAqB,IAAI,UAAU,CAAC,MAAM,CAAC;IACnE,MAAM,QAAQ,GAAG,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAErE,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzD,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,UAAU,GAAU,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAChC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACxB,UAAU,CAAC,IAAI,CAAC;oBACd,UAAU,EAAE,IAAI,CAAC,IAAI;oBACrB,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,EAAE,EAAE,IAAI,CAAC,EAAE;oBACX,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,SAAS,EAAE,CAAC,CAAC,EAAE;oBACf,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,cAAc,EAAE,CAAC,CAAC,cAAc;oBAChC,QAAQ,EAAE,CAAC,CAAC,QAAQ;iBACrB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC;YAAC,MAAM;QAAC,CAAC;IAC1F,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAEtD,OAAO;QACL,UAAU,EAAE,uBAAuB;QACnC,MAAM,EAAE,8BAA8B;QACtC,MAAM;QACN,UAAU;QACV,OAAO,EAAE;YACP,GAAG,EAAE,UAAU;YACf,IAAI,EAAE,8EAA8E;YACpF,SAAS,EAAE,wOAAwO;SACpP;QACD,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;QAC3G,YAAY,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;QAC3C,UAAU,EAAE;YACV,IAAI,EAAE,UAAU,CAAC,MAAM;YACvB,eAAe,EAAE,cAAc;YAC/B,WAAW,EAAE,uEAAuE;YACpF,QAAQ,EAAE;gBACR,cAAc,EAAE,aAAa;gBAC7B,wBAAwB,EAAE,UAAU;gBACpC,UAAU;gBACV,kBAAkB,EAAE,QAAQ,CAAC,MAAM;aACpC;YACD,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC5B,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;gBAC3C,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;gBAClD,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;aACnD,CAAC,CAAC;SACJ;QACD,QAAQ,EAAE;YACR,MAAM,EAAE,qQAAqQ;YAC7Q,IAAI,EAAE,UAAU;YAChB,cAAc,EAAE,UAAU;YAC1B,aAAa,EAAE,QAAQ,CAAC,MAAM;YAC9B,eAAe,EAAE,cAAc;YAC/B,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB;YAC/D,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAC1C;QACD,iBAAiB,EAAE;YACjB,IAAI,EAAE,gBAAgB;YACtB,iBAAiB,EAAE,iBAAiB;YACpC,KAAK,EAAE,WAAW;SACnB;QACD,UAAU,EAAE;YACV,KAAK,EAAE,UAAU,CAAC,MAAM;YACxB,2BAA2B,EAAE,iBAAiB;YAC9C,KAAK,EAAE,UAAU;SAClB;QACD,YAAY,EAAE;YACZ,gBAAgB,EAAE,OAAO,CAAC,MAAM;YAChC,iBAAiB,EAAE,QAAQ;YAC3B,eAAe,EAAE,UAAU,CAAC,MAAM;YAClC,qBAAqB,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI;YAC3C,oBAAoB,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI;YAC7D,UAAU,EAAE,SAAS;SACtB;QACD,kBAAkB,EAAE,QAAQ;QAC5B,2EAA2E;QAC3E,kDAAkD;QAClD,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;KACrE,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E;;;;;;GAMG;AACH,SAAS,IAAI,CAAC,CAAC;IACb,OAAO,MAAM,CAAC,CAAC,IAAI,GAAG,CAAC;SACpB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;SACtB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,KAAK,GAAG,wBAAwB,CAAC;AAEvC,SAAS,UAAU,CAAC,CAAC;IACnB,OAAO,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,IAAI;IACjC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,uBAAuB,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,+CAA+C,uBAAuB,WAAW,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,8BAA8B,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,4FAA4F,CAAC,CAAC;IAChH,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC;IAC1B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC3G,MAAM,IAAI,KAAK,CAAC,0JAA0J,CAAC,CAAC;IAC9K,CAAC;IAED,MAAM,CAAC,GAAa,EAAE,CAAC;IACvB,CAAC,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IACpD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,iBAAiB,uBAAuB,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,MAAM,CAAC,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC;IAClF,CAAC,CAAC,IAAI,CAAC,oBAAoB,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAChC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACxB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,oCAAoC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,CAAC;IACrE,CAAC,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,GAAG,CAAC,CAAC;IAC3G,CAAC,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,oBAAoB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,wBAAwB,iCAAiC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,yBAAyB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,kBAAkB,uBAAuB,CAAC,CAAC;IACnS,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,4GAA4G,CAAC,CAAC;IACvH,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QAChE,CAAC,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;QACjD,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACvC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtJ,CAAC;IACH,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACtB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,QAAQ,CAAC,cAAc,gBAAgB,IAAI,CAAC,QAAQ,CAAC,aAAa,eAAe,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;IACtI,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ;YAAE,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IAC/D,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACjC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IACvD,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxF,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC/B,IAAI,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACnD,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;QACzE,CAAC,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;QACxE,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7D,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClH,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;QAClD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;YAC9C,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACnG,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;gBAC9B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACnH,CAAC;QACH,CAAC;IACH,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACxB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,2BAA2B,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;QAChC,CAAC,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;IAC3E,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,mCAAmC,CAAC,CAAC;QACpE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;QAC1E,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9I,CAAC;IACH,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC1B,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,2BAA2B,IAAI,CAAC,YAAY,CAAC,gBAAgB,iBAAiB,IAAI,CAAC,YAAY,CAAC,iBAAiB,kBAAkB,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,CAAC,CAAC;IAC/K,CAAC,CAAC,IAAI,CAAC,4BAA4B,IAAI,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7I,CAAC,CAAC,IAAI,CAAC,2BAA2B,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1I,CAAC,CAAC,IAAI,CAAC,oCAAoC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/H,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,sGAAsG,CAAC,CAAC;QAChJ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACpC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC1C,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,wHAAwH,CAAC,CAAC;IACjI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC5B,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACxB,CAAC,CAAC,IAAI,CAAC,wBAAwB,KAAK,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,IAAI,CAAC,0BAA0B,KAAK,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC,IAAI,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC;AAED,eAAe;IACb,uBAAuB;IACvB,8BAA8B;IAC9B,gBAAgB;IAChB,iBAAiB;IACjB,mBAAmB;IACnB,cAAc;CACf,CAAC"}

package/dist/reports/external-verification.d.ts

@@ -0,0 +1,76 @@
+export declare const EXTERNAL_VERIFICATION_STATEMENT_VERSION = "EP-EXTERNAL-VERIFICATION-STATEMENT-v1";
+export declare const EXTERNAL_VERIFICATION_DOMAIN = "EP-EXTERNAL-VERIFICATION-STATEMENT-v1\0";
+/** Digest of the signed statement body, excluding the signature envelope. */
+export declare function externalVerificationDigest(statement: any): string;
+/**
+ * Build and sign an external-verifier statement.
+ *
+ * @param {object} args
+ * @param {object} args.verifier {id, name?, organization?}
+ * @param {object} args.subject  what was checked, e.g. {kind:'evidence_log', head:'sha256:...'}
+ * @param {object} args.procedure {id, version?, tool?, command?}
+ * @param {object} args.result {status, checks?, artifact_digest?}
+ * @param {object} [args.inputs] stable digests/ids the procedure consumed
+ * @param {string[]} [args.limitations] honest non-claims
+ * @param {string|number} [args.generated_at] ISO or epoch millis
+ * @param {crypto.KeyObject} privateKey Ed25519 private key
+ */
+export declare function signExternalVerificationStatement(args: any, privateKey: any): Readonly<{
+    signature: {
+        algorithm: string;
+        key_id: string;
+        public_key: string;
+        statement_digest: string;
+        signature_b64u: string;
+    };
+    '@version': string;
+    generated_at: string;
+    verifier: {
+        organization?: any;
+        name?: any;
+        id: any;
+    };
+    subject: any;
+    procedure: any;
+    inputs: any;
+    result: {
+        artifact_digest?: any;
+        status: string;
+        checks: {
+            detail?: any;
+            id: string;
+            ok: boolean;
+        }[];
+    };
+    limitations: any;
+}>;
+/**
+ * Verify a signed external-verifier statement against pinned verifier keys.
+ *
+ * @param {object} statement
+ * @param {{pinnedVerifierKeys?:Array<{verifier_id?:string,key_id?:string,public_key:string}>}} [opts]
+ */
+export declare function verifyExternalVerificationStatement(statement: any, opts?: {
+    pinnedVerifierKeys?: Array<{
+        verifier_id?: string;
+        key_id?: string;
+        public_key: string;
+    }>;
+}): {
+    verified: boolean;
+    accepted: boolean;
+    checks: Record<string, boolean>;
+    reason?: string;
+    statement_digest?: string;
+    verifier_id?: string;
+    key_id?: string;
+};
+declare const _default: {
+    EXTERNAL_VERIFICATION_STATEMENT_VERSION: string;
+    EXTERNAL_VERIFICATION_DOMAIN: string;
+    externalVerificationDigest: typeof externalVerificationDigest;
+    signExternalVerificationStatement: typeof signExternalVerificationStatement;
+    verifyExternalVerificationStatement: typeof verifyExternalVerificationStatement;
+};
+export default _default;
+//# sourceMappingURL=external-verification.d.ts.map

package/dist/reports/external-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-verification.d.ts","sourceRoot":"","sources":["../../src/reports/external-verification.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,uCAAuC,0CAA0C,CAAC;AAC/F,eAAO,MAAM,4BAA4B,4CAA4C,CAAC;AA4BtF,6EAA6E;AAC7E,wBAAgB,0BAA0B,CAAC,SAAS,KAAA,UAEnD;AAWD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iCAAiC,CAAC,IAAI,KAAA,EAAE,UAAU,KAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CjE;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,SAAS,KAAA,EAAE,IAAI,GAAE;IACnE,kBAAkB,CAAC,EAAE,KAAK,CAAC;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACtF,GAAG;IACP,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAqFA;;;;;;;;AAED,wBAME"}