@emilia-protocol/gate 0.11.0 → 0.14.0

package/dist/roster.d.ts

@@ -0,0 +1,113 @@
+/**
+ * EMILIA Gate — signer-roster sync from an enterprise IdP (EP-GATE-ROSTER-v1).
+ *
+ * The boring key story: WHO may approve is an HR fact, not a crypto fact. This
+ * module turns a SCIM-like IdP export into a versioned signer roster and
+ * reconciles a key registry (key-registry.js) against it, so a deprovisioned
+ * employee STOPS being an acceptable approver on the next sync. Fail closed:
+ *   - only `active === true` users' keys are ever pinned; anything else
+ *     (false, missing, truthy-but-not-boolean) never pins;
+ *   - a user absent from the import — offboarded, or silently dropped by a
+ *     broken IdP export — has every previously pinned key revoked;
+ *   - a kid claimed by two principals (or carrying two different key
+ *     materials) is CONTESTED: it pins nothing and is revoked if present;
+ *   - an import that would leave ZERO active signers requires an explicit
+ *     `allowEmpty` acknowledgment, so an empty/broken IdP response cannot
+ *     silently mass-revoke every approver.
+ *
+ * importRoster/diffRoster are pure (inputs in, artifact out; `importedAt` is
+ * the caller-supplied clock). applyRosterToRegistry mutates the given registry
+ * through its real API: key-registry CAN express revocation (`revoke(kid, at)`,
+ * hard and fail-closed), so reconciliation performs it directly and the
+ * returned `revoked` list is the exact set of revocations performed.
+ */
+export declare const ROSTER_VERSION = "EP-GATE-ROSTER-v1";
+/**
+ * Import a SCIM-like IdP user export into a signer roster.
+ * @param {Array<{id:string, userName:string, active:boolean, emails?:any, keys?:Array<{kid:string, publicKey:string}>}>} idpUsers
+ * @param {object} [o]
+ * @param {string} [o.source]        IdP provenance, e.g. 'scim:okta:acme' (required)
+ * @param {string|number} [o.importedAt]  import time (ISO or ms); the caller's clock
+ * @param {boolean} [o.allowEmpty=false]  acknowledge an import with zero active signers
+ * @returns {{version:string, source:string, imported_at:string, signers:Array<{principal:string, kid:string, publicKey:string, active:boolean}>, integrity_warnings:object[]}}
+ */
+export declare function importRoster(idpUsers: any, { source, importedAt, allowEmpty, }?: {
+    source?: string;
+    importedAt?: string | number;
+    allowEmpty?: boolean;
+}): {
+    version: string;
+    source: string;
+    imported_at: string;
+    signers: {
+        principal: string;
+        kid: string;
+        publicKey: string;
+        active: boolean;
+    }[];
+    integrity_warnings: Record<string, any>[];
+};
+/**
+ * Diff two rosters at the principal level.
+ * `removed`/`deactivated` carry the PREVIOUS roster's kids — the revocation
+ * candidates; `added` carries the next roster's kids.
+ * @returns {{added:Array<{principal:string,kids:string[]}>, removed:Array<{principal:string,kids:string[]}>, deactivated:Array<{principal:string,kids:string[]}>}}
+ */
+export declare function diffRoster(previous: any, next: any): {
+    added: {
+        principal: string;
+        kids: string[];
+    }[];
+    removed: {
+        principal: string;
+        kids: string[];
+    }[];
+    deactivated: {
+        principal: string;
+        kids: string[];
+    }[];
+};
+/**
+ * Reconcile a key registry (createKeyRegistry) against a roster:
+ *   - PIN each ACTIVE, uncontested signer's key not already present;
+ *   - REVOKE every registry kid not owned by an active roster signer — absent
+ *     or inactive means deprovisioned. The registry passed here must therefore
+ *     be DEDICATED to roster-managed approver keys.
+ * key-registry's API DOES express revocation (revoke(kid, at) — hard,
+ * fail-closed), so revocations are performed directly; `revoked` is the exact
+ * set performed, returned for the caller's evidence trail.
+ * A kid the registry has EVER revoked is never re-pinned (a rehire gets a new
+ * key; revoked key material stays dead).
+ * @param {object} roster    an EP-GATE-ROSTER-v1 roster
+ * @param {object} registry  createKeyRegistry() instance (add/revoke/status)
+ * @param {object} [o]
+ * @param {string|number} [o.revokedAt=roster.imported_at]  revocation timestamp
+ * @returns {{pinned:Array<{principal:string,kid:string}>, already_pinned:string[], revoked:Array<{kid:string,revoked_at:string|number,reason:string}>, refused:Array<{principal:string,kid:string,reason:string}>}}
+ */
+export declare function applyRosterToRegistry(roster: any, registry: any, { revokedAt }?: {
+    revokedAt?: string | number;
+}): {
+    pinned: {
+        principal: string;
+        kid: string;
+    }[];
+    already_pinned: string[];
+    revoked: {
+        kid: string;
+        revoked_at: string | number;
+        reason: string;
+    }[];
+    refused: {
+        principal: string;
+        kid: string;
+        reason: string;
+    }[];
+};
+declare const _default: {
+    ROSTER_VERSION: string;
+    importRoster: typeof importRoster;
+    diffRoster: typeof diffRoster;
+    applyRosterToRegistry: typeof applyRosterToRegistry;
+};
+export default _default;
+//# sourceMappingURL=roster.d.ts.map

package/dist/roster.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roster.d.ts","sourceRoot":"","sources":["../src/roster.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,eAAO,MAAM,cAAc,sBAAsB,CAAC;AAElD;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,QAAQ,KAAA,EAAE,EACrC,MAAM,EACN,UAAU,EACV,UAAkB,GACnB,GAAE;IACD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,UAAU,CAAC,EAAE,OAAO,CAAC;CACjB;;;;;;;;;;;EA0FL;AA4BD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,QAAQ,KAAA,EAAE,IAAI,KAAA;;mBAKb,MAAM;cAAQ,MAAM,EAAE;;;mBACpB,MAAM;cAAQ,MAAM,EAAE;;;mBAClB,MAAM;cAAQ,MAAM,EAAE;;EAWvD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,KAAA,EAAE,QAAQ,KAAA,EAAE,EAAE,SAAS,EAAE,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;CAAO;;mBAkC9E,MAAM;aAAO,MAAM;;;;aAExB,MAAM;oBAAc,MAAM,GAAG,MAAM;gBAAU,MAAM;;;mBAC7C,MAAM;aAAO,MAAM;gBAAU,MAAM;;EA4BhE;;;;;;;AAED,wBAAmF"}

package/dist/roster.js

@@ -0,0 +1,261 @@
+// @ts-nocheck
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — signer-roster sync from an enterprise IdP (EP-GATE-ROSTER-v1).
+ *
+ * The boring key story: WHO may approve is an HR fact, not a crypto fact. This
+ * module turns a SCIM-like IdP export into a versioned signer roster and
+ * reconciles a key registry (key-registry.js) against it, so a deprovisioned
+ * employee STOPS being an acceptable approver on the next sync. Fail closed:
+ *   - only `active === true` users' keys are ever pinned; anything else
+ *     (false, missing, truthy-but-not-boolean) never pins;
+ *   - a user absent from the import — offboarded, or silently dropped by a
+ *     broken IdP export — has every previously pinned key revoked;
+ *   - a kid claimed by two principals (or carrying two different key
+ *     materials) is CONTESTED: it pins nothing and is revoked if present;
+ *   - an import that would leave ZERO active signers requires an explicit
+ *     `allowEmpty` acknowledgment, so an empty/broken IdP response cannot
+ *     silently mass-revoke every approver.
+ *
+ * importRoster/diffRoster are pure (inputs in, artifact out; `importedAt` is
+ * the caller-supplied clock). applyRosterToRegistry mutates the given registry
+ * through its real API: key-registry CAN express revocation (`revoke(kid, at)`,
+ * hard and fail-closed), so reconciliation performs it directly and the
+ * returned `revoked` list is the exact set of revocations performed.
+ */
+export const ROSTER_VERSION = 'EP-GATE-ROSTER-v1';
+/**
+ * Import a SCIM-like IdP user export into a signer roster.
+ * @param {Array<{id:string, userName:string, active:boolean, emails?:any, keys?:Array<{kid:string, publicKey:string}>}>} idpUsers
+ * @param {object} [o]
+ * @param {string} [o.source]        IdP provenance, e.g. 'scim:okta:acme' (required)
+ * @param {string|number} [o.importedAt]  import time (ISO or ms); the caller's clock
+ * @param {boolean} [o.allowEmpty=false]  acknowledge an import with zero active signers
+ * @returns {{version:string, source:string, imported_at:string, signers:Array<{principal:string, kid:string, publicKey:string, active:boolean}>, integrity_warnings:object[]}}
+ */
+export function importRoster(idpUsers, { source, importedAt, allowEmpty = false, } = {}) {
+    if (!Array.isArray(idpUsers))
+        throw new Error('roster import: idpUsers must be an array');
+    if (!source || typeof source !== 'string') {
+        throw new Error('roster import: source (IdP provenance, e.g. "scim:okta:acme") is required');
+    }
+    const atMs = importedAt == null
+        ? Date.now()
+        : (typeof importedAt === 'number' ? importedAt : Date.parse(importedAt));
+    if (!Number.isFinite(atMs))
+        throw new Error('roster import: importedAt is not a valid time');
+    const warnings = [];
+    const candidates = [];
+    const usersByPrincipal = new Map();
+    for (const u of idpUsers) {
+        // A user without a stable id AND a userName cannot be diffed or revoked
+        // reliably later — excluded, never an approver.
+        if (!u || typeof u !== 'object'
+            || typeof u.id !== 'string' || !u.id
+            || typeof u.userName !== 'string' || !u.userName) {
+            warnings.push({ code: 'malformed_user', id: u?.id ?? null, userName: u?.userName ?? null });
+            continue;
+        }
+        const principal = u.userName;
+        usersByPrincipal.set(principal, (usersByPrincipal.get(principal) || 0) + 1);
+        const active = u.active === true; // strictly boolean true; anything else never pins
+        for (const k of Array.isArray(u.keys) ? u.keys : []) {
+            if (!k || typeof k.kid !== 'string' || !k.kid
+                || typeof k.publicKey !== 'string' || !k.publicKey) {
+                warnings.push({ code: 'malformed_key', principal, kid: k?.kid ?? null });
+                continue;
+            }
+            candidates.push({ principal, kid: k.kid, publicKey: k.publicKey, active });
+        }
+    }
+    // Two IdP users claiming one principal: identity is ambiguous — neither pins.
+    const contestedPrincipals = new Set();
+    for (const [principal, count] of usersByPrincipal) {
+        if (count > 1) {
+            contestedPrincipals.add(principal);
+            warnings.push({ code: 'duplicate_principal', principal, users: count });
+        }
+    }
+    let entries = candidates.filter((c) => !contestedPrincipals.has(c.principal));
+    // Exact-duplicate rows collapse silently (same principal + kid + key).
+    const seen = new Set();
+    entries = entries.filter((c) => {
+        const id = `${c.principal}\n${c.kid}\n${c.publicKey}`;
+        if (seen.has(id))
+            return false;
+        seen.add(id);
+        return true;
+    });
+    // One kid claimed by two principals, or one kid carrying two key materials,
+    // is an integrity failure: the contested kid pins NOTHING for anyone.
+    const byKid = new Map();
+    for (const c of entries) {
+        const g = byKid.get(c.kid) || { principals: new Set(), keys: new Set() };
+        g.principals.add(c.principal);
+        g.keys.add(c.publicKey);
+        byKid.set(c.kid, g);
+    }
+    const contestedKids = new Set();
+    for (const [kid, g] of byKid) {
+        if (g.principals.size > 1 || g.keys.size > 1) {
+            contestedKids.add(kid);
+            warnings.push({ code: 'duplicate_kid', kid, principals: [...g.principals].sort() });
+        }
+    }
+    entries = entries.filter((c) => !contestedKids.has(c.kid));
+    // Mass-deprovision guard: a roster with zero active signers would, on apply,
+    // revoke EVERY approver. That is indistinguishable from a broken IdP export,
+    // so it requires the operator's explicit acknowledgment.
+    if (!allowEmpty && !entries.some((e) => e.active)) {
+        throw new Error('roster import: zero active signers (mass-deprovision guard) — pass allowEmpty:true to acknowledge revoking every approver');
+    }
+    entries.sort((a, b) => (a.principal < b.principal ? -1 : a.principal > b.principal ? 1
+        : a.kid < b.kid ? -1 : a.kid > b.kid ? 1 : 0));
+    return {
+        version: ROSTER_VERSION,
+        source,
+        imported_at: new Date(atMs).toISOString(),
+        signers: entries.map(({ principal, kid, publicKey, active }) => ({ principal, kid, publicKey, active })),
+        integrity_warnings: warnings,
+    };
+}
+/** A roster must be well-formed before it can drive a diff or a registry mutation. */
+function assertRoster(r, name) {
+    if (!r || r.version !== ROSTER_VERSION || !Array.isArray(r.signers)) {
+        throw new Error(`roster: ${name} is not an ${ROSTER_VERSION} roster`);
+    }
+    for (const s of r.signers) {
+        if (!s || typeof s.principal !== 'string' || !s.principal
+            || typeof s.kid !== 'string' || !s.kid
+            || typeof s.publicKey !== 'string' || !s.publicKey
+            || typeof s.active !== 'boolean') {
+            throw new Error(`roster: ${name} contains a malformed signer entry`);
+        }
+    }
+}
+function groupByPrincipal(roster) {
+    const m = new Map();
+    for (const s of roster.signers) {
+        const g = m.get(s.principal) || { kids: new Set(), active: false };
+        g.kids.add(s.kid);
+        if (s.active === true)
+            g.active = true;
+        m.set(s.principal, g);
+    }
+    return m;
+}
+/**
+ * Diff two rosters at the principal level.
+ * `removed`/`deactivated` carry the PREVIOUS roster's kids — the revocation
+ * candidates; `added` carries the next roster's kids.
+ * @returns {{added:Array<{principal:string,kids:string[]}>, removed:Array<{principal:string,kids:string[]}>, deactivated:Array<{principal:string,kids:string[]}>}}
+ */
+export function diffRoster(previous, next) {
+    assertRoster(previous, 'previous');
+    assertRoster(next, 'next');
+    const prev = groupByPrincipal(previous);
+    const nxt = groupByPrincipal(next);
+    const added = [];
+    const removed = [];
+    const deactivated = [];
+    for (const [principal, g] of nxt) {
+        if (!prev.has(principal))
+            added.push({ principal, kids: [...g.kids].sort() });
+    }
+    for (const [principal, g] of prev) {
+        if (!nxt.has(principal)) {
+            removed.push({ principal, kids: [...g.kids].sort() });
+            continue;
+        }
+        if (g.active && !nxt.get(principal).active)
+            deactivated.push({ principal, kids: [...g.kids].sort() });
+    }
+    const byPrincipal = (a, b) => (a.principal < b.principal ? -1 : a.principal > b.principal ? 1 : 0);
+    added.sort(byPrincipal);
+    removed.sort(byPrincipal);
+    deactivated.sort(byPrincipal);
+    return { added, removed, deactivated };
+}
+/**
+ * Reconcile a key registry (createKeyRegistry) against a roster:
+ *   - PIN each ACTIVE, uncontested signer's key not already present;
+ *   - REVOKE every registry kid not owned by an active roster signer — absent
+ *     or inactive means deprovisioned. The registry passed here must therefore
+ *     be DEDICATED to roster-managed approver keys.
+ * key-registry's API DOES express revocation (revoke(kid, at) — hard,
+ * fail-closed), so revocations are performed directly; `revoked` is the exact
+ * set performed, returned for the caller's evidence trail.
+ * A kid the registry has EVER revoked is never re-pinned (a rehire gets a new
+ * key; revoked key material stays dead).
+ * @param {object} roster    an EP-GATE-ROSTER-v1 roster
+ * @param {object} registry  createKeyRegistry() instance (add/revoke/status)
+ * @param {object} [o]
+ * @param {string|number} [o.revokedAt=roster.imported_at]  revocation timestamp
+ * @returns {{pinned:Array<{principal:string,kid:string}>, already_pinned:string[], revoked:Array<{kid:string,revoked_at:string|number,reason:string}>, refused:Array<{principal:string,kid:string,reason:string}>}}
+ */
+export function applyRosterToRegistry(roster, registry, { revokedAt } = {}) {
+    assertRoster(roster, 'roster');
+    // Fail closed on the registry too: never coerce a flat key array here —
+    // asKeyRegistry would build a DETACHED registry and every revocation this
+    // function performs would be silently lost.
+    if (!registry || typeof registry.add !== 'function'
+        || typeof registry.revoke !== 'function' || typeof registry.status !== 'function') {
+        throw new Error('roster apply: registry must expose add/revoke/status (createKeyRegistry)');
+    }
+    const at = revokedAt ?? roster.imported_at;
+    // Recompute kid contests here as well — a hand-built roster must not bypass
+    // the import-time duplicate-kid integrity check.
+    const byKid = new Map();
+    for (const s of roster.signers) {
+        const g = byKid.get(s.kid) || { principals: new Set(), keys: new Set() };
+        g.principals.add(s.principal);
+        g.keys.add(s.publicKey);
+        byKid.set(s.kid, g);
+    }
+    const contested = new Set();
+    for (const [kid, g] of byKid) {
+        if (g.principals.size > 1 || g.keys.size > 1)
+            contested.add(kid);
+    }
+    const activeByKid = new Map();
+    for (const s of roster.signers) {
+        if (s.active === true && !contested.has(s.kid))
+            activeByKid.set(s.kid, s);
+    }
+    const status = registry.status();
+    const everRevoked = new Set(status.filter((e) => e.revoked).map((e) => e.kid));
+    const present = new Set(status.map((e) => e.kid));
+    const pinned = [];
+    const alreadyPinned = [];
+    const revoked = [];
+    const refused = [];
+    for (const s of roster.signers) {
+        if (s.active === true && contested.has(s.kid)) {
+            refused.push({ principal: s.principal, kid: s.kid, reason: 'contested_kid' });
+        }
+    }
+    for (const [kid, s] of activeByKid) {
+        if (everRevoked.has(kid)) {
+            refused.push({ principal: s.principal, kid, reason: 'kid_previously_revoked' });
+            continue;
+        }
+        if (present.has(kid)) {
+            alreadyPinned.push(kid);
+            continue;
+        }
+        registry.add({ kid, key: s.publicKey });
+        pinned.push({ principal: s.principal, kid });
+    }
+    // Absent-or-inactive (and contested) kids stop being acceptable NOW.
+    const done = new Set();
+    for (const e of status) {
+        if (e.revoked || done.has(e.kid) || activeByKid.has(e.kid))
+            continue;
+        registry.revoke(e.kid, at);
+        done.add(e.kid);
+        revoked.push({ kid: e.kid, revoked_at: at, reason: contested.has(e.kid) ? 'contested_kid' : 'absent_or_inactive' });
+    }
+    return { pinned, already_pinned: alreadyPinned, revoked, refused };
+}
+export default { ROSTER_VERSION, importRoster, diffRoster, applyRosterToRegistry };
+//# sourceMappingURL=roster.js.map

package/dist/roster.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roster.js","sourceRoot":"","sources":["../src/roster.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAElD;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,QAAQ,EAAE,EACrC,MAAM,EACN,UAAU,EACV,UAAU,GAAG,KAAK,MAKhB,EAAE;IACJ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC1F,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,IAAI,IAAI;QAC7B,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;QACZ,CAAC,CAAC,CAAC,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAE7F,MAAM,QAAQ,GAA0B,EAAE,CAAC;IAC3C,MAAM,UAAU,GAA6E,EAAE,CAAC;IAChG,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAE,CAAC;IAEnC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,wEAAwE;QACxE,gDAAgD;QAChD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;eAC1B,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE;eACjC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC;YAC5F,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC7B,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,kDAAkD;QACpF,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACpD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG;mBACxC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;gBACrD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;gBACzE,SAAS;YACX,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,gBAAgB,EAAE,CAAC;QAClD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAE9E,uEAAuE;IACvE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;IACvB,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC7B,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,SAAS,EAAE,CAAC;QACtD,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QACzE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACxB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC7C,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3D,6EAA6E;IAC7E,6EAA6E;IAC7E,yDAAyD;IACzD,IAAI,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,2HAA2H,CAAC,CAAC;IAC/I,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACpF,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEjD,OAAO;QACL,OAAO,EAAE,cAAc;QACvB,MAAM;QACN,WAAW,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;QACzC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACxG,kBAAkB,EAAE,QAAQ;KAC7B,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAS,YAAY,CAAC,CAAC,EAAE,IAAI;IAC3B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,cAAc,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,cAAc,SAAS,CAAC,CAAC;IACxE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,SAAS;eACpD,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG;eACnC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,SAAS;eAC/C,OAAO,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,oCAAoC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAM;IAC9B,MAAM,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;IACpB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACnE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAClB,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;YAAE,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC;QACvC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,QAAQ,EAAE,IAAI;IACvC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACnC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,KAAK,GAA4C,EAAE,CAAC;IAC1D,MAAM,OAAO,GAA4C,EAAE,CAAC;IAC5D,MAAM,WAAW,GAA4C,EAAE,CAAC;IAChE,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC7F,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM;YAAE,WAAW,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClF,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,SAAS,KAAsC,EAAE;IACzG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/B,wEAAwE;IACxE,0EAA0E;IAC1E,4CAA4C;IAC5C,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,CAAC,GAAG,KAAK,UAAU;WAC9C,OAAO,QAAQ,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,EAAE,GAAG,SAAS,IAAI,MAAM,CAAC,WAAW,CAAC;IAE3C,4EAA4E;IAC5E,iDAAiD;IACjD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QACzE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACxB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;IACjC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAElD,MAAM,MAAM,GAAyC,EAAE,CAAC;IACxD,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,OAAO,GAAmE,EAAE,CAAC;IACnF,MAAM,OAAO,GAAyD,EAAE,CAAC;IAEzE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC;QACnC,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAChF,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC5D,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,qEAAqE;IACrE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,SAAS;QACrE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACtH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACrE,CAAC;AAED,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,qBAAqB,EAAE,CAAC"}

package/dist/runtime-monitor.d.ts

@@ -0,0 +1,132 @@
+/**
+ * Runtime bridge for the Gate lifecycle.
+ *
+ * This is deliberately an explicit, reviewable monitor rather than a claim
+ * that TLA+ can be mechanically compiled into JavaScript. Its transition
+ * table mirrors the load-bearing lifecycle invariants in
+ * formal/ep_handshake.tla: an effect follows authorization, consumption is
+ * one-way, and execution evidence follows the effect attempt. A divergence
+ * enters fail-closed safe mode; recovery requires an operator-supplied
+ * authorizer and never re-authorizes an old receipt.
+ */
+export declare const RUNTIME_MONITOR_VERSION = "EP-GATE-RUNTIME-MONITOR-v1";
+export declare const RUNTIME_MONITOR_MODES: Readonly<{
+    NORMAL: "normal";
+    DEGRADED: "degraded";
+    LOCKDOWN: "lockdown";
+}>;
+export declare const RUNTIME_INVARIANTS: Readonly<{
+    CONSUME_ONCE: "ConsumeOnceSafety";
+    WRITE_BYPASS: "WriteBypassSafety";
+    SIGNOFF_BINDING: "SignoffBindingMatch";
+}>;
+/**
+ * Create a process-local monitor. Operators should export divergence events to
+ * durable SIEM/evidence storage through onDivergence; the monitor itself keeps
+ * only a bounded diagnostic buffer.
+ *
+ * @param {{ now?: (() => number) | number, onDivergence?: ((event: object) => any) | null, authorizeRecovery?: ((input: object) => boolean) | null }} [options]
+ */
+export declare function createRuntimeMonitor({ now, onDivergence, authorizeRecovery, }?: {
+    now?: (() => number) | number;
+    onDivergence?: ((event: object) => any) | null;
+    authorizeRecovery?: ((input: object) => boolean) | null;
+}): {
+    version: string;
+    beginCheck({ action, receipt_id }?: {
+        action?: null | undefined;
+        receipt_id?: null | undefined;
+    }): string;
+    preflight({ hasReceipt }?: {
+        hasReceipt?: boolean;
+    }): {
+        ok: boolean;
+        reason?: undefined;
+        mode?: undefined;
+    } | {
+        ok: boolean;
+        reason: string;
+        mode: "degraded" | "lockdown";
+    };
+    minimumAssuranceTier(declaredTier: any): any;
+    recordDecision(cycleId: any, details: any): {
+        ok: boolean;
+        reason: string;
+        event: any;
+    } | {
+        ok: boolean;
+    };
+    beginExecution(cycleId: any, authorization: any): {
+        ok: boolean;
+    };
+    effectReturned(cycleId: any): {
+        ok: boolean;
+        reason: string;
+        event: any;
+    } | {
+        ok: boolean;
+    };
+    effectFailed(cycleId: any): {
+        ok: boolean;
+        reason: string;
+        event: any;
+    } | {
+        ok: boolean;
+    };
+    capabilityRefused(cycleId: any): {
+        ok: boolean;
+        reason: string;
+        event: any;
+    } | {
+        ok: boolean;
+    };
+    consumptionCommitted(cycleId: any): {
+        ok: boolean;
+        reason: string;
+        event: any;
+    } | {
+        ok: boolean;
+    };
+    executionRecorded(cycleId: any): {
+        ok: boolean;
+        reason: string;
+        event: any;
+    } | {
+        ok: boolean;
+    };
+    executionSkipped(cycleId: any): {
+        ok: boolean;
+        reason: string;
+        event: any;
+    } | {
+        ok: boolean;
+    };
+    getMode(): "normal" | "degraded" | "lockdown";
+    getEvents(): any[];
+    getState(cycleId: any): any;
+    recover(input?: {}): {
+        ok: boolean;
+        mode: "normal";
+        reason?: undefined;
+    } | {
+        ok: boolean;
+        reason: string;
+        mode: "degraded" | "lockdown";
+    };
+};
+declare const _default: {
+    createRuntimeMonitor: typeof createRuntimeMonitor;
+    RUNTIME_MONITOR_VERSION: string;
+    RUNTIME_MONITOR_MODES: Readonly<{
+        NORMAL: "normal";
+        DEGRADED: "degraded";
+        LOCKDOWN: "lockdown";
+    }>;
+    RUNTIME_INVARIANTS: Readonly<{
+        CONSUME_ONCE: "ConsumeOnceSafety";
+        WRITE_BYPASS: "WriteBypassSafety";
+        SIGNOFF_BINDING: "SignoffBindingMatch";
+    }>;
+};
+export default _default;
+//# sourceMappingURL=runtime-monitor.d.ts.map

package/dist/runtime-monitor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-monitor.d.ts","sourceRoot":"","sources":["../src/runtime-monitor.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AAEH,eAAO,MAAM,uBAAuB,+BAA+B,CAAC;AACpE,eAAO,MAAM,qBAAqB;;;;EAIhC,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;EAI7B,CAAC;AA0BH;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,GAAc,EACd,YAAmB,EACnB,iBAAwB,GACzB,GAAE;IACD,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,MAAM,CAAC;IAC9B,YAAY,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC;IAC/C,iBAAiB,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,IAAI,CAAC;CACpD;;;;;;+BAoGwB;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgDrD;;;;;;;;;;;;;;;AAED,wBAA4G"}