@grantex/sdk 0.6.0 → 0.7.0

package/dist/evidence/document.js

@@ -0,0 +1,298 @@
+/**
+ * Strict parsing of evidence package bytes.
+ *
+ * A package is valid only as its own RFC 8785 canonical form (optionally
+ * followed by one line feed). Anything a JSON parser would silently resolve -
+ * a duplicate member, a byte-order mark, whitespace, another spelling of a
+ * number - is refused, so every byte of a package is significant. The parser
+ * accepts exactly the JSON text Python's `json.loads` accepts, so both SDKs
+ * reach the same verdict.
+ */
+import { CanonicalizationError, canonicalize } from './canonical.js';
+import { VerificationCode, VerificationFailure } from './result.js';
+export const DEFAULT_MAX_BYTES = 64 * 1024 * 1024;
+const NUMBER_BYTES = new Set(Array.from('-+.eE0123456789', (c) => c.charCodeAt(0)));
+const NUMBER_OPENERS = new Set(Array.from(':,[', (c) => c.charCodeAt(0)));
+const SIMPLE_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** A string as RFC 8785 writes it (used for paths and messages). */
+export function jsonText(value) {
+    try {
+        return canonicalize(value);
+    }
+    catch {
+        return JSON.stringify(value);
+    }
+}
+/** Append a member name or array index to a field path. */
+export function formatPath(base, key) {
+    if (typeof key === 'number')
+        return `${base}[${key}]`;
+    if (SIMPLE_NAME.test(key))
+        return base ? `${base}.${key}` : key;
+    return `${base}[${jsonText(key)}]`;
+}
+class ParseError extends Error {
+}
+class DuplicateKey extends Error {
+    member;
+    constructor(member) {
+        super(member);
+        this.member = member;
+    }
+}
+class BadConstant extends Error {
+}
+const NUMBER = /-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][-+]?[0-9]+)?/y;
+class Parser {
+    text;
+    index = 0;
+    constructor(text) {
+        this.text = text;
+    }
+    parse() {
+        this.skip();
+        const value = this.value();
+        this.skip();
+        if (this.index !== this.text.length)
+            throw new ParseError(`extra data at ${this.index}`);
+        return value;
+    }
+    skip() {
+        const t = this.text;
+        while (this.index < t.length) {
+            const c = t.charCodeAt(this.index);
+            if (c === 0x20 || c === 0x09 || c === 0x0a || c === 0x0d)
+                this.index++;
+            else
+                break;
+        }
+    }
+    value() {
+        const t = this.text;
+        const c = t[this.index];
+        if (c === '{')
+            return this.object();
+        if (c === '[')
+            return this.array();
+        if (c === '"')
+            return this.string();
+        if (t.startsWith('null', this.index)) {
+            this.index += 4;
+            return null;
+        }
+        if (t.startsWith('true', this.index)) {
+            this.index += 4;
+            return true;
+        }
+        if (t.startsWith('false', this.index)) {
+            this.index += 5;
+            return false;
+        }
+        if (t.startsWith('NaN', this.index) || t.startsWith('Infinity', this.index) || t.startsWith('-Infinity', this.index)) {
+            throw new BadConstant(t.startsWith('NaN', this.index) ? 'NaN' : 'Infinity');
+        }
+        NUMBER.lastIndex = this.index;
+        const match = NUMBER.exec(t);
+        if (!match)
+            throw new ParseError(`unexpected character at ${this.index}`);
+        this.index += match[0].length;
+        return Number(match[0]);
+    }
+    object() {
+        const t = this.text;
+        const out = Object.create(null);
+        this.index++;
+        this.skip();
+        if (t[this.index] === '}') {
+            this.index++;
+            return out;
+        }
+        for (;;) {
+            if (t[this.index] !== '"')
+                throw new ParseError(`expected member name at ${this.index}`);
+            const name = this.string();
+            this.skip();
+            if (t[this.index] !== ':')
+                throw new ParseError(`expected ':' at ${this.index}`);
+            this.index++;
+            this.skip();
+            const value = this.value();
+            if (Object.prototype.hasOwnProperty.call(out, name))
+                throw new DuplicateKey(name);
+            out[name] = value;
+            this.skip();
+            const next = t[this.index];
+            this.index++;
+            if (next === '}')
+                return out;
+            if (next !== ',')
+                throw new ParseError(`expected ',' or '}' at ${this.index - 1}`);
+            this.skip();
+        }
+    }
+    array() {
+        const t = this.text;
+        const out = [];
+        this.index++;
+        this.skip();
+        if (t[this.index] === ']') {
+            this.index++;
+            return out;
+        }
+        for (;;) {
+            out.push(this.value());
+            this.skip();
+            const next = t[this.index];
+            this.index++;
+            if (next === ']')
+                return out;
+            if (next !== ',')
+                throw new ParseError(`expected ',' or ']' at ${this.index - 1}`);
+            this.skip();
+        }
+    }
+    string() {
+        const t = this.text;
+        let out = '';
+        let start = ++this.index;
+        for (;;) {
+            if (this.index >= t.length)
+                throw new ParseError('unterminated string');
+            const code = t.charCodeAt(this.index);
+            if (code === 0x22) {
+                out += t.slice(start, this.index);
+                this.index++;
+                return out;
+            }
+            if (code < 0x20)
+                throw new ParseError(`control character in string at ${this.index}`);
+            if (code !== 0x5c) {
+                this.index++;
+                continue;
+            }
+            out += t.slice(start, this.index);
+            const escape = t[this.index + 1];
+            this.index += 2;
+            switch (escape) {
+                case '"':
+                    out += '"';
+                    break;
+                case '\\':
+                    out += '\\';
+                    break;
+                case '/':
+                    out += '/';
+                    break;
+                case 'b':
+                    out += String.fromCharCode(0x08);
+                    break;
+                case 'f':
+                    out += String.fromCharCode(0x0c);
+                    break;
+                case 'n':
+                    out += String.fromCharCode(0x0a);
+                    break;
+                case 'r':
+                    out += String.fromCharCode(0x0d);
+                    break;
+                case 't':
+                    out += String.fromCharCode(0x09);
+                    break;
+                case 'u': {
+                    const hex = t.slice(this.index, this.index + 4);
+                    if (!/^[0-9a-fA-F]{4}$/.test(hex))
+                        throw new ParseError(`invalid escape at ${this.index}`);
+                    out += String.fromCharCode(parseInt(hex, 16));
+                    this.index += 4;
+                    break;
+                }
+                default:
+                    throw new ParseError(`invalid escape at ${this.index - 1}`);
+            }
+            start = this.index;
+        }
+    }
+}
+function hasBadNumber(value) {
+    const stack = [value];
+    while (stack.length) {
+        const item = stack.pop();
+        if (typeof item === 'number') {
+            if (!Number.isFinite(item))
+                return true;
+        }
+        else if (Array.isArray(item)) {
+            stack.push(...item);
+        }
+        else if (item !== null && typeof item === 'object') {
+            stack.push(...Object.values(item));
+        }
+    }
+    return false;
+}
+function inNumber(buffer, index) {
+    let start = index;
+    while (start > 0 && NUMBER_BYTES.has(buffer[start - 1]))
+        start--;
+    if (start === 0 || !NUMBER_OPENERS.has(buffer[start - 1]))
+        return false;
+    return start < index || (index < buffer.length && NUMBER_BYTES.has(buffer[index]));
+}
+/** Parse package bytes, refusing anything that is not canonical JSON. */
+export function parseCanonical(data, maxBytes = DEFAULT_MAX_BYTES) {
+    if (data.length > maxBytes) {
+        throw new VerificationFailure(VerificationCode.TOO_LARGE, `package is ${data.length} bytes; the limit is ${maxBytes}`);
+    }
+    if (data.length >= 3 && data[0] === 0xef && data[1] === 0xbb && data[2] === 0xbf) {
+        throw new VerificationFailure(VerificationCode.MALFORMED_JSON, 'package starts with a byte-order mark');
+    }
+    let text;
+    try {
+        text = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(data);
+    }
+    catch {
+        throw new VerificationFailure(VerificationCode.MALFORMED_JSON, 'package is not UTF-8');
+    }
+    let value;
+    try {
+        value = new Parser(text).parse();
+    }
+    catch (err) {
+        if (err instanceof DuplicateKey) {
+            throw new VerificationFailure(VerificationCode.DUPLICATE_KEY, `member ${jsonText(err.member)} appears more than once in one object`);
+        }
+        if (err instanceof BadConstant) {
+            throw new VerificationFailure(VerificationCode.NON_CANONICAL_NUMBER, `${err.message} is not a JSON number`);
+        }
+        const message = err instanceof Error ? err.message : String(err);
+        throw new VerificationFailure(VerificationCode.MALFORMED_JSON, `package is not valid JSON: ${message}`);
+    }
+    if (hasBadNumber(value)) {
+        throw new VerificationFailure(VerificationCode.NON_CANONICAL_NUMBER, 'a number has no exact IEEE-754 double form');
+    }
+    let canonical;
+    try {
+        canonical = new TextEncoder().encode(canonicalize(value));
+    }
+    catch (err) {
+        if (err instanceof CanonicalizationError || err instanceof RangeError) {
+            throw new VerificationFailure(VerificationCode.NON_CANONICAL_DOCUMENT, `package has no canonical form: ${err.message}`);
+        }
+        throw err;
+    }
+    const body = data.length > 0 && data[data.length - 1] === 0x0a ? data.subarray(0, data.length - 1) : data;
+    let same = body.length === canonical.length;
+    let index = 0;
+    const limit = Math.min(body.length, canonical.length);
+    while (index < limit && body[index] === canonical[index])
+        index++;
+    same = same && index === limit;
+    if (!same) {
+        if (inNumber(body, index)) {
+            throw new VerificationFailure(VerificationCode.NON_CANONICAL_NUMBER, `number at byte ${index} is not in RFC 8785 form`);
+        }
+        throw new VerificationFailure(VerificationCode.NON_CANONICAL_DOCUMENT, `package bytes differ from their RFC 8785 form at byte ${index}`);
+    }
+    return value;
+}
+//# sourceMappingURL=document.js.map

package/dist/evidence/document.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document.js","sourceRoot":"","sources":["../../src/evidence/document.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEpE,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAElD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1E,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAE/C,oEAAoE;AACpE,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,GAAoB;IAC3D,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,IAAI,IAAI,GAAG,GAAG,CAAC;IACtD,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAChE,OAAO,GAAG,IAAI,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;AACrC,CAAC;AAED,MAAM,UAAW,SAAQ,KAAK;CAAG;AAEjC,MAAM,YAAa,SAAQ,KAAK;IACT,MAAM;IAA3B,YAAqB,MAAc;QACjC,KAAK,CAAC,MAAM,CAAC,CAAC;sBADK,MAAM;IAE3B,CAAC;CACF;AAED,MAAM,WAAY,SAAQ,KAAK;CAAG;AAElC,MAAM,MAAM,GAAG,uDAAuD,CAAC;AAEvE,MAAM,MAAM;IAGmB,IAAI;IAFzB,KAAK,GAAG,CAAC,CAAC;IAElB,YAA6B,IAAY;oBAAZ,IAAI;IAAW,CAAC;IAE7C,KAAK;QACH,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,UAAU,CAAC,iBAAiB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACzF,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,IAAI;QACV,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;QACpB,OAAO,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;gBAAE,IAAI,CAAC,KAAK,EAAE,CAAC;;gBAClE,MAAM;QACb,CAAC;IACH,CAAC;IAEO,KAAK;QACX,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;QACpB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;YAChB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrH,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,UAAU,CAAC,2BAA2B,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC9B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IAEO,MAAM;QACZ,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;QACpB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAA4B,CAAC;QAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,OAAO,GAAG,CAAC;QACb,CAAC;QACD,SAAS,CAAC;YACR,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG;gBAAE,MAAM,IAAI,UAAU,CAAC,2BAA2B,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACzF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG;gBAAE,MAAM,IAAI,UAAU,CAAC,mBAAmB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACjF,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3B,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC;gBAAE,MAAM,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;YAClF,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YAClB,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,IAAI,IAAI,KAAK,GAAG;gBAAE,OAAO,GAAG,CAAC;YAC7B,IAAI,IAAI,KAAK,GAAG;gBAAE,MAAM,IAAI,UAAU,CAAC,0BAA0B,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;YACnF,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK;QACX,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;QACpB,MAAM,GAAG,GAAc,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,OAAO,GAAG,CAAC;QACb,CAAC;QACD,SAAS,CAAC;YACR,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACvB,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,IAAI,IAAI,KAAK,GAAG;gBAAE,OAAO,GAAG,CAAC;YAC7B,IAAI,IAAI,KAAK,GAAG;gBAAE,MAAM,IAAI,UAAU,CAAC,0BAA0B,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;YACnF,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,CAAC;IACH,CAAC;IAEO,MAAM;QACZ,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;QACpB,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,KAAK,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC;QACzB,SAAS,CAAC;YACR,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM;gBAAE,MAAM,IAAI,UAAU,CAAC,qBAAqB,CAAC,CAAC;YACxE,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC;YACb,CAAC;YACD,IAAI,IAAI,GAAG,IAAI;gBAAE,MAAM,IAAI,UAAU,CAAC,kCAAkC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACtF,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,SAAS;YACX,CAAC;YACD,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAClC,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACjC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;YAChB,QAAQ,MAAM,EAAE,CAAC;gBACf,KAAK,GAAG;oBAAE,GAAG,IAAI,GAAG,CAAC;oBAAC,MAAM;gBAC5B,KAAK,IAAI;oBAAE,GAAG,IAAI,IAAI,CAAC;oBAAC,MAAM;gBAC9B,KAAK,GAAG;oBAAE,GAAG,IAAI,GAAG,CAAC;oBAAC,MAAM;gBAC5B,KAAK,GAAG;oBAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;oBAAC,MAAM;gBAClD,KAAK,GAAG;oBAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;oBAAC,MAAM;gBAClD,KAAK,GAAG;oBAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;oBAAC,MAAM;gBAClD,KAAK,GAAG;oBAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;oBAAC,MAAM;gBAClD,KAAK,GAAG;oBAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;oBAAC,MAAM;gBAClD,KAAK,GAAG,EAAE,CAAC;oBACT,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;oBAChD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;wBAAE,MAAM,IAAI,UAAU,CAAC,qBAAqB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;oBAC3F,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;oBAC9C,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;oBAChB,MAAM;gBACR,CAAC;gBACD;oBACE,MAAM,IAAI,UAAU,CAAC,qBAAqB,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACrB,CAAC;IACH,CAAC;CACF;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,KAAK,GAAc,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC1C,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,MAAkB,EAAE,KAAa;IACjD,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,OAAO,KAAK,GAAG,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC;QAAE,KAAK,EAAE,CAAC;IAClE,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACzE,OAAO,KAAK,GAAG,KAAK,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAE,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,cAAc,CAAC,IAAgB,EAAE,QAAQ,GAAW,iBAAiB;IACnF,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,mBAAmB,CAC3B,gBAAgB,CAAC,SAAS,EAC1B,cAAc,IAAI,CAAC,MAAM,wBAAwB,QAAQ,EAAE,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACjF,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,cAAc,EAAE,uCAAuC,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,cAAc,EAAE,sBAAsB,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,YAAY,EAAE,CAAC;YAChC,MAAM,IAAI,mBAAmB,CAC3B,gBAAgB,CAAC,aAAa,EAC9B,UAAU,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,uCAAuC,CACtE,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;YAC/B,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,GAAG,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC;QAC9G,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,cAAc,EAAE,8BAA8B,OAAO,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,4CAA4C,CAAC,CAAC;IACrH,CAAC;IACD,IAAI,SAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,qBAAqB,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;YACtE,MAAM,IAAI,mBAAmB,CAC3B,gBAAgB,CAAC,sBAAsB,EACvC,kCAAkC,GAAG,CAAC,OAAO,EAAE,CAChD,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1G,IAAI,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,CAAC;IAC5C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACtD,OAAO,KAAK,GAAG,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,CAAC;IAClE,IAAI,GAAG,IAAI,IAAI,KAAK,KAAK,KAAK,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,mBAAmB,CAC3B,gBAAgB,CAAC,oBAAoB,EACrC,kBAAkB,KAAK,0BAA0B,CAClD,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,mBAAmB,CAC3B,gBAAgB,CAAC,sBAAsB,EACvC,yDAAyD,KAAK,EAAE,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/evidence/hashing.d.ts

@@ -0,0 +1,37 @@
+/** Classes of value that are keyed per case unless disclosed (sorted). */
+export declare const IDENTIFIER_CLASSES: readonly ['approver', 'content', 'principal', 'record', 'subject'];
+export type IdentifierClass = (typeof IDENTIFIER_CLASSES)[number];
+export type PseudonymClass = Exclude<IdentifierClass, 'content'>;
+/** Metadata member only the auth service writes; `/v1/audit/log` refuses it. */
+export declare const PLATFORM_MARKER = "grantex:platform";
+type Json = Record<string, unknown>;
+/** `sha256:` followed by the lower-case hex SHA-256 of `data`. */
+export declare function digestBytes(data: Uint8Array | string): string;
+/** Digest of the RFC 8785 canonical form of a JSON value. */
+export declare function digest(value: unknown): string;
+/** `chain.genesis`: digest of `{case, format, privacy, version}`. */
+export declare function headerHash(pkg: Json): string;
+/** Digest of an entry with its `hash` member removed. */
+export declare function entryHash(entry: Json): string;
+/** `chain.root`: digest of `{alg, canonicalization, genesis, head, length}`. */
+export declare function chainRoot(chain: Json): string;
+/** The decision-grant `action_hash`: `"sha256:" + base64url(SHA-256(JCS(action)))`. */
+export declare function decisionActionHash(action: Json): string;
+/** Hash of an auth-service audit entry, exactly as the audit chain stores it. */
+export declare function auditEntryHash(entry: Json): string;
+/** `HMAC-SHA256(tenantKey, JCS(["grantex-evidence-case-v1", tenantId, caseId]))`. */
+export declare function caseKey(tenantKey: Uint8Array, tenantId: string, caseId: string): Buffer;
+/** `"pz:" + base64url(HMAC(caseKey, JCS(["pseudonym-v1", class, value])))`. */
+export declare function pseudonym(key: Uint8Array, identifierClass: PseudonymClass, value: string): string;
+/** Stable per-case pseudonym for an identifier (derives the case key first). */
+export declare function pseudonymise(tenantKey: Uint8Array, tenantId: string, caseId: string, identifierClass: PseudonymClass, value: string): string;
+/** `"hmac-sha256:" + hex(HMAC(caseKey, JCS(["content-v1", digest])))`: tool input/output digests. */
+export declare function keyedContentDigest(key: Uint8Array, valueDigest: string): string;
+/** `"ak:" + base64url(HMAC(caseKey, JCS(["action-v1", action_hash])))`: replaces `action_hash` while the subject is pseudonymised. */
+export declare function actionReference(key: Uint8Array, actionHash: string): string;
+/** Whether `value` has the pseudonym form `pz:` + 43 base64url characters. */
+export declare function isPseudonym(value: unknown): boolean;
+/** Whether `value` has the form `ak:` + 43 base64url characters. */
+export declare function isActionReference(value: unknown): boolean;
+export {};
+//# sourceMappingURL=hashing.d.ts.map

package/dist/evidence/hashing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hashing.d.ts","sourceRoot":"","sources":["../../src/evidence/hashing.ts"],"names":[],"mappings":"AASA,0EAA0E;AAC1E,eAAO,MAAM,kBAAkB,YAAI,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AACrG,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAClE,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;AAEjE,gFAAgF;AAChF,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAOlD,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAIpC,kEAAkE;AAClE,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAE7D;AAED,6DAA6D;AAC7D,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE7C;AAQD,qEAAqE;AACrE,wBAAgB,UAAU,CAAC,GAAG,EAAE,IAAI,GAAG,MAAM,CAE5C;AAED,yDAAyD;AACzD,wBAAgB,SAAS,CAAC,KAAK,EAAE,IAAI,GAAG,MAAM,CAI7C;AAED,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,KAAK,EAAE,IAAI,GAAG,MAAM,CAE7C;AAED,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,IAAI,GAAG,MAAM,CAEvD;AAED,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,KAAK,EAAE,IAAI,GAAG,MAAM,CAgBlD;AAED,qFAAqF;AACrF,wBAAgB,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAGvF;AAMD,+EAA+E;AAC/E,wBAAgB,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,eAAe,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAKjG;AAED,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5I;AAED,qGAAqG;AACrG,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAE/E;AAED,sIAAsI;AACtI,wBAAgB,eAAe,CAAC,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,8EAA8E;AAC9E,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEnD;AAED,oEAAoE;AACpE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEzD"}

package/dist/evidence/hashing.js

@@ -0,0 +1,106 @@
+/**
+ * Hashes and keyed pseudonyms used by evidence packages (spec/evidence-package.md,
+ * "Identifiers and privacy" and "Hash chain"). Every keyed value is an
+ * HMAC-SHA256 under a per-case key over the RFC 8785 form of a JSON array.
+ * Mirrors `grantex.evidence._hashing` in the Python SDK.
+ */
+import { createHash, createHmac } from 'node:crypto';
+import { canonicalize } from './canonical.js';
+/** Classes of value that are keyed per case unless disclosed (sorted). */
+export const IDENTIFIER_CLASSES = ['approver', 'content', 'principal', 'record', 'subject'];
+/** Metadata member only the auth service writes; `/v1/audit/log` refuses it. */
+export const PLATFORM_MARKER = 'grantex:platform';
+const PSEUDONYM = /^pz:[A-Za-z0-9_-]{43}$/;
+const ACTION_REF = /^ak:[A-Za-z0-9_-]{43}$/;
+const HEADER_MEMBERS = ['case', 'format', 'privacy', 'version'];
+const CHAIN_MEMBERS = ['alg', 'canonicalization', 'genesis', 'head', 'length'];
+const utf8 = (text) => Buffer.from(text, 'utf8');
+/** `sha256:` followed by the lower-case hex SHA-256 of `data`. */
+export function digestBytes(data) {
+    return `sha256:${createHash('sha256').update(data).digest('hex')}`;
+}
+/** Digest of the RFC 8785 canonical form of a JSON value. */
+export function digest(value) {
+    return digestBytes(utf8(canonicalize(value)));
+}
+function pick(source, names) {
+    const out = {};
+    for (const name of names)
+        out[name] = source[name];
+    return out;
+}
+/** `chain.genesis`: digest of `{case, format, privacy, version}`. */
+export function headerHash(pkg) {
+    return digest(pick(pkg, HEADER_MEMBERS));
+}
+/** Digest of an entry with its `hash` member removed. */
+export function entryHash(entry) {
+    const copy = {};
+    for (const [name, value] of Object.entries(entry))
+        if (name !== 'hash')
+            copy[name] = value;
+    return digest(copy);
+}
+/** `chain.root`: digest of `{alg, canonicalization, genesis, head, length}`. */
+export function chainRoot(chain) {
+    return digest(pick(chain, CHAIN_MEMBERS));
+}
+/** The decision-grant `action_hash`: `"sha256:" + base64url(SHA-256(JCS(action)))`. */
+export function decisionActionHash(action) {
+    return `sha256:${createHash('sha256').update(utf8(canonicalize(action))).digest('base64url')}`;
+}
+/** Hash of an auth-service audit entry, exactly as the audit chain stores it. */
+export function auditEntryHash(entry) {
+    const c = (value) => canonicalize(value);
+    const text = '{'
+        + `"id":${c(entry['id'])},`
+        + `"agentId":${c(entry['agentId'])},`
+        + `"agentDid":${c(entry['agentDid'])},`
+        + `"grantId":${c(entry['grantId'])},`
+        + `"principalId":${c(entry['principalId'])},`
+        + `"developerId":${c(entry['developerId'])},`
+        + `"action":${c(entry['action'])},`
+        + `"metadata":${c(entry['metadata'])},`
+        + `"timestamp":${c(entry['timestamp'])},`
+        + `"prevHash":${c(entry['prevHash'] ?? null)},`
+        + `"status":${c(entry['status'])}`
+        + '}';
+    return createHash('sha256').update(utf8(text)).digest('hex');
+}
+/** `HMAC-SHA256(tenantKey, JCS(["grantex-evidence-case-v1", tenantId, caseId]))`. */
+export function caseKey(tenantKey, tenantId, caseId) {
+    if (tenantKey.length < 32)
+        throw new Error('pseudonymisation key must be at least 32 bytes');
+    return createHmac('sha256', tenantKey).update(utf8(canonicalize(['grantex-evidence-case-v1', tenantId, caseId]))).digest();
+}
+function mac(key, parts) {
+    return createHmac('sha256', key).update(utf8(canonicalize(parts))).digest();
+}
+/** `"pz:" + base64url(HMAC(caseKey, JCS(["pseudonym-v1", class, value])))`. */
+export function pseudonym(key, identifierClass, value) {
+    if (!['approver', 'principal', 'record', 'subject'].includes(identifierClass)) {
+        throw new Error(`not an identifier class: ${String(identifierClass)}`);
+    }
+    return `pz:${mac(key, ['pseudonym-v1', identifierClass, value]).toString('base64url')}`;
+}
+/** Stable per-case pseudonym for an identifier (derives the case key first). */
+export function pseudonymise(tenantKey, tenantId, caseId, identifierClass, value) {
+    return pseudonym(caseKey(tenantKey, tenantId, caseId), identifierClass, value);
+}
+/** `"hmac-sha256:" + hex(HMAC(caseKey, JCS(["content-v1", digest])))`: tool input/output digests. */
+export function keyedContentDigest(key, valueDigest) {
+    return `hmac-sha256:${mac(key, ['content-v1', valueDigest]).toString('hex')}`;
+}
+/** `"ak:" + base64url(HMAC(caseKey, JCS(["action-v1", action_hash])))`: replaces `action_hash` while the subject is pseudonymised. */
+export function actionReference(key, actionHash) {
+    return `ak:${mac(key, ['action-v1', actionHash]).toString('base64url')}`;
+}
+/** Whether `value` has the pseudonym form `pz:` + 43 base64url characters. */
+export function isPseudonym(value) {
+    return typeof value === 'string' && PSEUDONYM.test(value);
+}
+/** Whether `value` has the form `ak:` + 43 base64url characters. */
+export function isActionReference(value) {
+    return typeof value === 'string' && ACTION_REF.test(value);
+}
+//# sourceMappingURL=hashing.js.map

package/dist/evidence/hashing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hashing.js","sourceRoot":"","sources":["../../src/evidence/hashing.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,0EAA0E;AAC1E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAIrG,gFAAgF;AAChF,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAElD,MAAM,SAAS,GAAG,wBAAwB,CAAC;AAC3C,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAC5C,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAU,CAAC;AACzE,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAU,CAAC;AAIxF,MAAM,IAAI,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAEjE,kEAAkE;AAClE,MAAM,UAAU,WAAW,CAAC,IAAyB;IACnD,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,OAAO,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,IAAI,CAAC,MAAY,EAAE,KAAwB;IAClD,MAAM,GAAG,GAAS,EAAE,CAAC;IACrB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,UAAU,CAAC,GAAS;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,SAAS,CAAC,KAAW;IACnC,MAAM,IAAI,GAAS,EAAE,CAAC;IACtB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,IAAI,KAAK,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC3F,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,SAAS,CAAC,KAAW;IACnC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,kBAAkB,CAAC,MAAY;IAC7C,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;AACjG,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,KAAW;IACxC,MAAM,CAAC,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,GAAG;UACZ,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG;UACzB,aAAa,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG;UACnC,cAAc,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG;UACrC,aAAa,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG;UACnC,iBAAiB,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG;UAC3C,iBAAiB,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG;UAC3C,YAAY,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG;UACjC,cAAc,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG;UACrC,eAAe,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG;UACvC,cAAc,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,GAAG;UAC7C,YAAY,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE;UAChC,GAAG,CAAC;IACR,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,OAAO,CAAC,SAAqB,EAAE,QAAgB,EAAE,MAAc;IAC7E,IAAI,SAAS,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC7F,OAAO,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,0BAA0B,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AAC7H,CAAC;AAED,SAAS,GAAG,CAAC,GAAe,EAAE,KAAgB;IAC5C,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AAC9E,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,SAAS,CAAC,GAAe,EAAE,eAA+B,EAAE,KAAa;IACvF,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,YAAY,CAAC,SAAqB,EAAE,QAAgB,EAAE,MAAc,EAAE,eAA+B,EAAE,KAAa;IAClI,OAAO,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;AACjF,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,kBAAkB,CAAC,GAAe,EAAE,WAAmB;IACrE,OAAO,eAAe,GAAG,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAChF,CAAC;AAED,sIAAsI;AACtI,MAAM,UAAU,eAAe,CAAC,GAAe,EAAE,UAAkB;IACjE,OAAO,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC"}

package/dist/evidence/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Evidence packages: build, canonicalise and verify (PRD G-5).
+ *
+ * One JSON document per case: the grant chain root to leaf with purposes and
+ * caps, every tool call with keyed input and output digests and the upstream
+ * records it returned, run context (model, prompt, policy and schema
+ * versions), policy evaluations with inputs, recommendations and screening
+ * dispositions with citations, human decisions and revocations - in a hash
+ * chain whose root is recorded in the auth service's audit chain and may be
+ * signed by the service. Specified in `spec/evidence-package.md`; the Python
+ * SDK (`grantex.evidence`) implements the same rules, and both are tested
+ * against `spec/examples/evidence/`.
+ */
+export { buildPackage, anchorAuditEntry, attachAnchor, attachSignature, serializePackage, type BuiltPackage, type EvidenceRecord, type PrivacySettings, } from './build.js';
+export { CanonicalizationError, canonicalize } from './canonical.js';
+export { MAX_CLOCK_SKEW_MS, type SemanticSummary } from './checks.js';
+export { DEFAULT_MAX_BYTES } from './document.js';
+export { IDENTIFIER_CLASSES, PLATFORM_MARKER, actionReference, auditEntryHash, caseKey, chainRoot, decisionActionHash, digest, digestBytes, entryHash, headerHash, isActionReference, isPseudonym, keyedContentDigest, pseudonym, pseudonymise, type IdentifierClass, type PseudonymClass, } from './hashing.js';
+export { EvidenceBuildError, VerificationCode, VerificationFailure, verificationResultToJson, type VerificationCodeValue, type VerificationResult, } from './result.js';
+export { isValidTimestamp, timestampMs } from './schema.js';
+export { SIGNATURE_TYPE, protectedHeader, signRoot, signedPayload, signingInput, verifySignature, type EvidenceSignature } from './signature.js';
+export { upstreamRecordsFor, type UpstreamRecordTrace } from './trace.js';
+export { FORMAT, SUPPORTED_VERSIONS, checkDocument, verifyPackage, type VerifyOptions } from './verify.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/evidence/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/evidence/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,eAAe,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,cAAc,EACd,OAAO,EACP,SAAS,EACT,kBAAkB,EAClB,MAAM,EACN,WAAW,EACX,SAAS,EACT,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,kBAAkB,EAClB,SAAS,EACT,YAAY,EACZ,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACjJ,OAAO,EAAE,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/evidence/index.js

@@ -0,0 +1,24 @@
+/**
+ * Evidence packages: build, canonicalise and verify (PRD G-5).
+ *
+ * One JSON document per case: the grant chain root to leaf with purposes and
+ * caps, every tool call with keyed input and output digests and the upstream
+ * records it returned, run context (model, prompt, policy and schema
+ * versions), policy evaluations with inputs, recommendations and screening
+ * dispositions with citations, human decisions and revocations - in a hash
+ * chain whose root is recorded in the auth service's audit chain and may be
+ * signed by the service. Specified in `spec/evidence-package.md`; the Python
+ * SDK (`grantex.evidence`) implements the same rules, and both are tested
+ * against `spec/examples/evidence/`.
+ */
+export { buildPackage, anchorAuditEntry, attachAnchor, attachSignature, serializePackage, } from './build.js';
+export { CanonicalizationError, canonicalize } from './canonical.js';
+export { MAX_CLOCK_SKEW_MS } from './checks.js';
+export { DEFAULT_MAX_BYTES } from './document.js';
+export { IDENTIFIER_CLASSES, PLATFORM_MARKER, actionReference, auditEntryHash, caseKey, chainRoot, decisionActionHash, digest, digestBytes, entryHash, headerHash, isActionReference, isPseudonym, keyedContentDigest, pseudonym, pseudonymise, } from './hashing.js';
+export { EvidenceBuildError, VerificationCode, VerificationFailure, verificationResultToJson, } from './result.js';
+export { isValidTimestamp, timestampMs } from './schema.js';
+export { SIGNATURE_TYPE, protectedHeader, signRoot, signedPayload, signingInput, verifySignature } from './signature.js';
+export { upstreamRecordsFor } from './trace.js';
+export { FORMAT, SUPPORTED_VERSIONS, checkDocument, verifyPackage } from './verify.js';
+//# sourceMappingURL=index.js.map

package/dist/evidence/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/evidence/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,GAIjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAwB,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,cAAc,EACd,OAAO,EACP,SAAS,EACT,kBAAkB,EAClB,MAAM,EACN,WAAW,EACX,SAAS,EACT,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,kBAAkB,EAClB,SAAS,EACT,YAAY,GAGb,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,wBAAwB,GAGzB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAA0B,MAAM,gBAAgB,CAAC;AACjJ,OAAO,EAAE,kBAAkB,EAA4B,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,aAAa,EAAsB,MAAM,aAAa,CAAC"}

package/dist/evidence/result.d.ts

@@ -0,0 +1,88 @@
+/** Verification codes, results and errors for evidence packages. */
+export declare const VerificationCode: {
+    readonly MISSING_ROOT: 'missing_root';
+    readonly TOO_LARGE: 'too_large';
+    readonly MALFORMED_JSON: 'malformed_json';
+    readonly DUPLICATE_KEY: 'duplicate_key';
+    readonly NON_CANONICAL_NUMBER: 'non_canonical_number';
+    readonly NON_CANONICAL_DOCUMENT: 'non_canonical_document';
+    readonly UNSUPPORTED_FORMAT: 'unsupported_format';
+    readonly UNSUPPORTED_VERSION: 'unsupported_version';
+    readonly SCHEMA_VIOLATION: 'schema_violation';
+    readonly PRIVACY_VIOLATION: 'privacy_violation';
+    readonly GENESIS_MISMATCH: 'genesis_mismatch';
+    readonly SEQUENCE_MISMATCH: 'sequence_mismatch';
+    readonly LINK_MISMATCH: 'link_mismatch';
+    readonly ENTRY_HASH_MISMATCH: 'entry_hash_mismatch';
+    readonly HEAD_MISMATCH: 'head_mismatch';
+    readonly LENGTH_MISMATCH: 'length_mismatch';
+    readonly ROOT_MISMATCH: 'root_mismatch';
+    readonly GRANT_CHAIN_BROKEN: 'grant_chain_broken';
+    readonly ENTRIES_OUT_OF_ORDER: 'entries_out_of_order';
+    readonly DUPLICATE_IDENTIFIER: 'duplicate_identifier';
+    readonly DANGLING_REFERENCE: 'dangling_reference';
+    readonly CASE_MISMATCH: 'case_mismatch';
+    readonly ACTION_HASH_MISMATCH: 'action_hash_mismatch';
+    readonly DECISION_INCONSISTENT: 'decision_inconsistent';
+    readonly VALIDITY_VIOLATION: 'validity_violation';
+    readonly AUTHORITY_VIOLATION: 'authority_violation';
+    readonly TOOL_CALL_INCONSISTENT: 'tool_call_inconsistent';
+    readonly ROOT_NOT_TRUSTED: 'root_not_trusted';
+    readonly ANCHOR_MISSING: 'anchor_missing';
+    readonly ANCHOR_HASH_MISMATCH: 'anchor_hash_mismatch';
+    readonly ANCHOR_MISMATCH: 'anchor_mismatch';
+    readonly ANCHOR_NOT_TRUSTED: 'anchor_not_trusted';
+    readonly SIGNATURE_MISSING: 'signature_missing';
+    readonly SIGNATURE_UNVERIFIED: 'signature_unverified';
+    readonly SIGNATURE_KEY_UNKNOWN: 'signature_key_unknown';
+    readonly SIGNATURE_INVALID: 'signature_invalid';
+};
+export type VerificationCodeValue = (typeof VerificationCode)[keyof typeof VerificationCode];
+export interface FailureLocation {
+    entryIndex?: number | null;
+    fieldPath?: string | null;
+    expected?: string | null;
+    actual?: string | null;
+}
+/** The first failed check. Thrown internally, reported in the result. */
+export declare class VerificationFailure extends Error {
+    readonly code: VerificationCodeValue;
+    readonly entryIndex: number | null;
+    readonly fieldPath: string | null;
+    readonly expected: string | null;
+    readonly actual: string | null;
+    constructor(code: VerificationCodeValue, message: string, location?: FailureLocation);
+}
+/**
+ * Outcome of `verifyPackage`. `ok` is true only when every check passed;
+ * otherwise `code` names the first check that failed and `entryIndex`,
+ * `fieldPath`, `expected` and `actual` locate it where that is meaningful.
+ */
+export interface VerificationResult {
+    ok: boolean;
+    code: VerificationCodeValue | null;
+    message: string;
+    entryIndex: number | null;
+    fieldPath: string | null;
+    expected: string | null;
+    actual: string | null;
+    root: string | null;
+    entryCount: number | null;
+    /** `absent`, `internal-consistency-only`, `pinned` (matches a caller-supplied anchor hash) or `signed`. */
+    anchorStatus: 'absent' | 'internal-consistency-only' | 'pinned' | 'signed';
+    /** `absent`, `unchecked` or `verified`. Only a verified service signature proves who exported the package. */
+    signatureStatus: 'absent' | 'unchecked' | 'verified';
+    signatureKid: string | null;
+    unsourcedInputs: number;
+    lateEntries: number;
+    tenantAssertedEntries: number;
+}
+/** JSON form of a result, identical to the Python SDK's `VerificationResult.to_dict()`. */
+export declare function verificationResultToJson(result: VerificationResult): Record<string, unknown>;
+/** A package could not be built from the given input. */
+export declare class EvidenceBuildError extends Error {
+    readonly code: string;
+    readonly fieldPath: string | null;
+    constructor(code: string, message: string, fieldPath?: string | null);
+}
+//# sourceMappingURL=result.d.ts.map

package/dist/evidence/result.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"result.d.ts","sourceRoot":"","sources":["../../src/evidence/result.ts"],"names":[],"mappings":"AAAA,oEAAoE;AAEpE,eAAO,MAAM,gBAAgB;aAC3B,YAAY,EAAE,cAAc;aAC5B,SAAS,EAAE,WAAW;aACtB,cAAc,EAAE,gBAAgB;aAChC,aAAa,EAAE,eAAe;aAC9B,oBAAoB,EAAE,sBAAsB;aAC5C,sBAAsB,EAAE,wBAAwB;aAChD,kBAAkB,EAAE,oBAAoB;aACxC,mBAAmB,EAAE,qBAAqB;aAC1C,gBAAgB,EAAE,kBAAkB;aACpC,iBAAiB,EAAE,mBAAmB;aACtC,gBAAgB,EAAE,kBAAkB;aACpC,iBAAiB,EAAE,mBAAmB;aACtC,aAAa,EAAE,eAAe;aAC9B,mBAAmB,EAAE,qBAAqB;aAC1C,aAAa,EAAE,eAAe;aAC9B,eAAe,EAAE,iBAAiB;aAClC,aAAa,EAAE,eAAe;aAC9B,kBAAkB,EAAE,oBAAoB;aACxC,oBAAoB,EAAE,sBAAsB;aAC5C,oBAAoB,EAAE,sBAAsB;aAC5C,kBAAkB,EAAE,oBAAoB;aACxC,aAAa,EAAE,eAAe;aAC9B,oBAAoB,EAAE,sBAAsB;aAC5C,qBAAqB,EAAE,uBAAuB;aAC9C,kBAAkB,EAAE,oBAAoB;aACxC,mBAAmB,EAAE,qBAAqB;aAC1C,sBAAsB,EAAE,wBAAwB;aAChD,gBAAgB,EAAE,kBAAkB;aACpC,cAAc,EAAE,gBAAgB;aAChC,oBAAoB,EAAE,sBAAsB;aAC5C,eAAe,EAAE,iBAAiB;aAClC,kBAAkB,EAAE,oBAAoB;aACxC,iBAAiB,EAAE,mBAAmB;aACtC,oBAAoB,EAAE,sBAAsB;aAC5C,qBAAqB,EAAE,uBAAuB;aAC9C,iBAAiB,EAAE,mBAAmB;CAC9B,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC;AAE7F,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,yEAAyE;AACzE,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAE/B,YAAY,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,GAAE,eAAoB,EAQvF;CACF;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,2GAA2G;IAC3G,YAAY,EAAE,QAAQ,GAAG,2BAA2B,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC3E,8GAA8G;IAC9G,eAAe,EAAE,QAAQ,GAAG,WAAW,GAAG,UAAU,CAAC;IACrD,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,2FAA2F;AAC3F,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkB5F;AAED,yDAAyD;AACzD,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAElC,YAAY,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,GAAE,MAAM,GAAG,IAAW,EAKzE;CACF"}