@graphrefly/graphrefly 0.45.0 → 0.46.0

package/dist/chunk-FW23JYNQ.js

@@ -0,0 +1,454 @@
+import {
+  TopicGraph
+} from "./chunk-Q3EYOCZB.js";
+import {
+  domainMeta
+} from "./chunk-FMPF42Q4.js";
+
+// src/utils/inspect/audit.ts
+import {
+  batch,
+  DATA,
+  defaultHash,
+  monotonicNs,
+  NodeImpl,
+  node,
+  placeholderArgs,
+  policyFromRules,
+  wallClockNs
+} from "@graphrefly/pure-ts/core";
+import { keepalive, reactiveLog } from "@graphrefly/pure-ts/extra";
+import {
+  Graph,
+  watchTopologyTree
+} from "@graphrefly/pure-ts/graph";
+function auditMeta(kind, extra) {
+  return domainMeta("audit", kind, extra);
+}
+var DEFAULT_INCLUDE_TYPES = /* @__PURE__ */ new Set([
+  "data",
+  "error",
+  "complete",
+  "teardown"
+]);
+var AuditTrailGraph = class extends Graph {
+  entries;
+  count;
+  /**
+   * Effective set of event types this trail records (EH-18). Reflects
+   * either the caller-supplied `opts.includeTypes` or the default set
+   * (`["data", "error", "complete", "teardown"]`). Captured at construction
+   * — each instance owns its own clone, so a default-using trail can never
+   * leak mutations into the module-level default set.
+   *
+   * **Mutation contract.** Type-system read-only via `ReadonlySet`. Runtime
+   * mutation through an unsafe cast (`(audit.includeTypes as Set<...>)
+   * .add(...)`) is unsupported — it would desync the field from the
+   * recording closure, which captured the original `Set` reference at
+   * construction. The runtime does NOT enforce immutability beyond the
+   * type contract; consumers must respect it.
+   *
+   * Use this to validate that a `complianceSnapshot.fingerprint` was
+   * computed against the same recording surface — fingerprints are stable
+   * only when the recording set is identical across snapshots.
+   */
+  includeTypes;
+  _log;
+  _target;
+  constructor(target, opts) {
+    super(opts.name ?? `${target.name}_audit`, opts.graph);
+    this._target = target;
+    this._log = reactiveLog([], {
+      name: "entries",
+      ...opts.maxSize != null ? { maxSize: opts.maxSize } : {}
+    });
+    this.entries = this._log.entries;
+    this.add(this.entries, { name: "entries" });
+    this.count = this.derived(
+      "count",
+      ["entries"],
+      (batchData, ctx) => {
+        const data = batchData.map(
+          (batch2, i) => batch2 != null && batch2.length > 0 ? batch2.at(-1) : ctx.prevData[i]
+        );
+        return [data[0].length];
+      },
+      { meta: auditMeta("count") }
+    );
+    this.addDisposer(keepalive(this.count));
+    const includeTypes = opts.includeTypes != null ? new Set(opts.includeTypes) : new Set(DEFAULT_INCLUDE_TYPES);
+    this.includeTypes = includeTypes;
+    const filter = opts.filter;
+    let seq = 0;
+    const handle = target.observe({ timeline: true, structured: true });
+    const offEvent = handle.onEvent((event) => {
+      if (event.type === "derived") return;
+      const type = event.type;
+      if (!includeTypes.has(type)) return;
+      const path = event.path ?? "";
+      const entry = {
+        seq: seq++,
+        timestamp_ns: event.timestamp_ns ?? monotonicNs(),
+        wall_clock_ns: wallClockNs(),
+        path,
+        type
+      };
+      const node2 = path ? safeNode(target, path) : void 0;
+      const lastMutation = node2?.lastMutation;
+      if (lastMutation != null) entry.actor = lastMutation.actor;
+      if (type === "data") entry.value = event.data;
+      if (type === "error") entry.error = event.data;
+      const annotation = path ? safeAnnotation(target, path) : void 0;
+      if (annotation != null) entry.annotation = annotation;
+      if (filter != null && !filter(entry)) return;
+      this._log.append(entry);
+    });
+    this.addDisposer(() => {
+      offEvent();
+      handle.dispose();
+    });
+    this.addDisposer(() => this._log.disposeAllViews());
+  }
+  /** All entries currently in the ring (snapshot). */
+  all() {
+    return this.entries.cache ?? [];
+  }
+  /** Entries matching `path`. Order preserved. */
+  byNode(path) {
+    return this.all().filter((e) => e.path === path);
+  }
+  /** Entries whose `actor.id` matches. Use `byActorType` for type filtering. */
+  byActor(actorId) {
+    return this.all().filter((e) => e.actor?.id === actorId);
+  }
+  /** Entries whose `actor.type` matches (e.g. `"llm"`, `"human"`). */
+  byActorType(type) {
+    return this.all().filter((e) => e.actor?.type === type);
+  }
+  /**
+   * Entries with `timestamp_ns` in `[start_ns, end_ns)` (end exclusive).
+   * Omit `end_ns` to query open-ended.
+   */
+  byTimeRange(start_ns, end_ns) {
+    return this.all().filter((e) => {
+      if (e.timestamp_ns < start_ns) return false;
+      if (end_ns != null && e.timestamp_ns >= end_ns) return false;
+      return true;
+    });
+  }
+  /** Reference to the audited graph (escape hatch for tooling). */
+  get target() {
+    return this._target;
+  }
+};
+function auditTrail(target, opts = {}) {
+  return new AuditTrailGraph(target, opts);
+}
+var PolicyGateGraph = class extends Graph {
+  policies;
+  violations;
+  violationCount;
+  _target;
+  _mode;
+  _currentGuard;
+  constructor(target, policies, opts) {
+    super(opts.name ?? `${target.name}_policy`, opts.graph);
+    this._target = target;
+    this._mode = opts.mode ?? "audit";
+    const policiesNode = isNode(policies) ? policies : node([], { name: "policies", initial: policies });
+    this.policies = policiesNode;
+    this.add(this.policies, { name: "policies" });
+    this.violations = new TopicGraph("violations", {
+      retainedLimit: opts.violationsLimit ?? 1e3
+    });
+    this.mount("violations", this.violations);
+    this.violationCount = this.derived(
+      "violationCount",
+      ["violations::events"],
+      (batchData, ctx) => {
+        const data = batchData.map(
+          (batch2, i) => batch2 != null && batch2.length > 0 ? batch2.at(-1) : ctx.prevData[i]
+        );
+        return [data[0].length];
+      },
+      {
+        meta: auditMeta("policy_violation_count")
+      }
+    );
+    this.addDisposer(keepalive(this.violationCount));
+    const initialRules = policiesNode.cache ?? [];
+    let latestRules = initialRules;
+    this._currentGuard = policyFromRules(latestRules);
+    const offPolicies = policiesNode.subscribe((msgs) => {
+      for (const m of msgs) {
+        if (m[0] === DATA) {
+          latestRules = m[1] ?? [];
+          this._currentGuard = policyFromRules(latestRules);
+        }
+      }
+    });
+    this.addDisposer(offPolicies);
+    const pathsOpt = opts.paths;
+    const pathsNode = isNode(pathsOpt) ? pathsOpt : void 0;
+    const pathsExplicit = pathsOpt != null;
+    const initialPaths = pathsNode != null ? pathsNode.cache ?? [] : pathsExplicit ? [...pathsOpt] : void 0;
+    let latestPaths = initialPaths;
+    const paths = latestPaths ?? collectPaths(target);
+    if (this._mode !== "enforce" && pathsNode != null) {
+      const offAuditPaths = pathsNode.subscribe((msgs) => {
+        for (const m of msgs) {
+          if (m[0] !== DATA) continue;
+          latestPaths = m[1] ?? [];
+        }
+      });
+      this.addDisposer(offAuditPaths);
+    }
+    if (this._mode === "enforce") {
+      const restorers = /* @__PURE__ */ new Map();
+      const wrapAndPush = (path) => {
+        if (restorers.has(path)) return;
+        const node2 = safeNode(target, path);
+        if (!(node2 instanceof NodeImpl)) return;
+        const pathGuard = (actor, action) => {
+          const ok = this._currentGuard(actor, action);
+          if (!ok) {
+            this._publishViolation(actor, action, path, "blocked");
+          }
+          return ok;
+        };
+        restorers.set(path, node2._pushGuard(pathGuard));
+      };
+      for (const path of paths) wrapAndPush(path);
+      if (pathsNode != null) {
+        const offReactivePaths = pathsNode.subscribe((msgs) => {
+          for (const m of msgs) {
+            if (m[0] !== DATA) continue;
+            const next = m[1] ?? [];
+            const nextSet = new Set(next);
+            const prevSet = new Set(latestPaths ?? []);
+            batch(() => {
+              for (const p of prevSet) {
+                if (nextSet.has(p)) continue;
+                const r = restorers.get(p);
+                if (r != null) {
+                  r();
+                  restorers.delete(p);
+                }
+              }
+              for (const p of nextSet) {
+                if (prevSet.has(p)) continue;
+                wrapAndPush(p);
+              }
+              latestPaths = next;
+            });
+          }
+        });
+        this.addDisposer(offReactivePaths);
+      }
+      if (!pathsExplicit) {
+        const offTopology = watchTopologyTree(target, (event, emitter, prefix) => {
+          if (event.kind === "added") {
+            if (event.nodeKind === "node") {
+              wrapAndPush(`${prefix}${event.name}`);
+            } else {
+              const child = emitter._mounts.get(event.name);
+              if (!(child instanceof Graph)) return;
+              const mountPrefix = `${prefix}${event.name}::`;
+              const localPaths = collectPaths(child);
+              for (const localPath of localPaths) {
+                wrapAndPush(
+                  localPath === "" ? `${prefix}${event.name}` : `${mountPrefix}${localPath}`
+                );
+              }
+            }
+          } else if (event.kind === "removed") {
+            if (event.nodeKind === "node") {
+              const qp = `${prefix}${event.name}`;
+              const r = restorers.get(qp);
+              if (r != null) {
+                r();
+                restorers.delete(qp);
+              }
+            } else {
+              const mountQp = `${prefix}${event.name}`;
+              const mountPrefix = `${mountQp}::`;
+              for (const [p, r] of restorers) {
+                if (p === mountQp || p.startsWith(mountPrefix)) {
+                  r();
+                  restorers.delete(p);
+                }
+              }
+            }
+          }
+        });
+        this.addDisposer(offTopology);
+      } else {
+        const offCleanup = target.topology.subscribe((msgs) => {
+          for (const m of msgs) {
+            if (m[0] !== DATA) continue;
+            const event = m[1];
+            if (event.kind !== "removed" || event.nodeKind !== "node") continue;
+            const r = restorers.get(event.name);
+            if (r != null) {
+              r();
+              restorers.delete(event.name);
+            }
+          }
+        });
+        this.addDisposer(offCleanup);
+      }
+      this.addDisposer(() => {
+        for (const r of restorers.values()) r();
+        restorers.clear();
+      });
+    } else {
+      const handle = target.observe({ timeline: true, structured: true });
+      const off = handle.onEvent((event) => {
+        if (event.type !== "data" && event.type !== "error") return;
+        const path = event.path ?? "";
+        if (!path) return;
+        if (latestPaths != null && !latestPaths.includes(path)) return;
+        const actor = event.actor ?? safeNode(target, path)?.lastMutation?.actor;
+        if (actor == null) return;
+        const action = "write";
+        if (this._currentGuard(actor, action)) return;
+        this._publishViolation(actor, action, path, "observed");
+      });
+      this.addDisposer(() => {
+        off();
+        handle.dispose();
+      });
+    }
+  }
+  _publishViolation(actor, action, path, result) {
+    this.violations.publish({
+      timestamp_ns: monotonicNs(),
+      wall_clock_ns: wallClockNs(),
+      path,
+      actor,
+      action,
+      mode: this._mode,
+      result
+    });
+  }
+  /** Snapshot of recorded violations. */
+  all() {
+    return this.violations.retained();
+  }
+  get mode() {
+    return this._mode;
+  }
+  get target() {
+    return this._target;
+  }
+};
+function policyGate(target, policies, opts = {}) {
+  const g = new PolicyGateGraph(target, policies, opts);
+  g.tagFactory("policyGate", placeholderArgs(opts));
+  return g;
+}
+function complianceSnapshot(target, opts = {}) {
+  const result = {
+    format_version: 1,
+    timestamp_ns: monotonicNs(),
+    wall_clock_ns: wallClockNs(),
+    graph: target.snapshot()
+  };
+  if (opts.actor != null) result.actor = opts.actor;
+  if (opts.audit != null) {
+    const entries = [...opts.audit.all()];
+    result.audit = { count: entries.length, entries };
+  }
+  if (opts.policies != null) {
+    const rules = opts.policies.policies.cache ?? [];
+    result.policies = {
+      mode: opts.policies.mode,
+      rules,
+      violations: [...opts.policies.all()]
+    };
+  }
+  const fingerprint = computeFingerprint(result);
+  return { ...result, fingerprint };
+}
+function isNode(x) {
+  return typeof x === "object" && x !== null && "subscribe" in x;
+}
+function safeNode(target, path) {
+  try {
+    return target.node(path);
+  } catch {
+    return void 0;
+  }
+}
+function safeAnnotation(target, path) {
+  try {
+    return target.annotation(path);
+  } catch {
+    return void 0;
+  }
+}
+function collectPaths(target) {
+  const described = target.describe({ detail: "minimal" });
+  return Object.keys(described.nodes);
+}
+function computeFingerprint(value) {
+  return defaultHash(JSON.stringify(canonicalize(value)));
+}
+function canonicalize(value) {
+  const stack = /* @__PURE__ */ new Set();
+  const walk = (v) => {
+    if (v === void 0) return { __undefined: true };
+    if (v === null) return null;
+    const t = typeof v;
+    if (t === "bigint") return { __bigint: v.toString() };
+    if (t !== "object") return v;
+    const obj = v;
+    if (stack.has(obj)) return { __circular: true };
+    stack.add(obj);
+    try {
+      if (Array.isArray(obj)) {
+        return obj.map(walk);
+      }
+      if (obj instanceof Date) {
+        return { __date: obj.toISOString() };
+      }
+      if (obj instanceof RegExp) {
+        return { __regexp: { source: obj.source, flags: obj.flags } };
+      }
+      if (obj instanceof Map) {
+        const entries = [...obj.entries()].map(([k, mv]) => [
+          walk(k),
+          walk(mv)
+        ]);
+        return { __map: entries };
+      }
+      if (obj instanceof Set) {
+        const items = [...obj].map(walk);
+        return { __set: items };
+      }
+      if (ArrayBuffer.isView(obj)) {
+        const ta = obj;
+        const arr = new Array(ta.length);
+        for (let i = 0; i < ta.length; i++) arr[i] = ta[i] ?? 0;
+        return { __typed_array: { ctor: obj.constructor.name, data: arr } };
+      }
+      const out = {};
+      for (const k of Object.keys(obj).sort()) {
+        out[k] = walk(obj[k]);
+      }
+      return out;
+    } finally {
+      stack.delete(obj);
+    }
+  };
+  return walk(value);
+}
+
+export {
+  AuditTrailGraph,
+  auditTrail,
+  PolicyGateGraph,
+  policyGate,
+  complianceSnapshot
+};
+//# sourceMappingURL=chunk-FW23JYNQ.js.map

package/dist/chunk-FW23JYNQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/utils/inspect/audit.ts"],"sourcesContent":["/**\n * Audit, policy enforcement, and compliance export (roadmap §9.2).\n *\n * Three composed factories that wrap any {@link Graph} with the harness\n * accountability layer:\n *\n * - {@link auditTrail} — reactive mutation log with by-node/by-actor/by-time\n *   queries.\n * - {@link policyGate} — reactive ABAC gate (Tier 2.3 rename of\n *   `policyEnforcer`); in `\"audit\"` mode records would-be denials, in\n *   `\"enforce\"` mode pushes guards onto target nodes so subsequent writes\n *   throw {@link GuardDenied}.\n * - {@link complianceSnapshot} — point-in-time export of graph state +\n *   audit trail + policies for regulatory archival.\n *\n * @module\n */\nimport type { Actor, GuardAction, NodeGuard, PolicyRuleData } from \"@graphrefly/pure-ts/core\";\nimport {\n\tbatch,\n\tDATA,\n\tdefaultHash,\n\tmonotonicNs,\n\ttype Node,\n\tNodeImpl,\n\tnode,\n\tplaceholderArgs,\n\tpolicyFromRules,\n\twallClockNs,\n} from \"@graphrefly/pure-ts/core\";\nimport { keepalive, reactiveLog } from \"@graphrefly/pure-ts/extra\";\nimport {\n\tGraph,\n\ttype GraphOptions,\n\ttype GraphPersistSnapshot,\n\ttype TopologyEvent,\n\twatchTopologyTree,\n} from \"@graphrefly/pure-ts/graph\";\nimport { domainMeta } from \"../../base/meta/domain-meta.js\";\nimport { TopicGraph } from \"../messaging/index.js\";\n\n// ---------------------------------------------------------------------------\n// Shared types\n// ---------------------------------------------------------------------------\n\n/** A single recorded mutation/event in an {@link AuditTrailGraph}. */\nexport interface AuditEntry {\n\tseq: number;\n\ttimestamp_ns: number;\n\twall_clock_ns: number;\n\tpath: string;\n\ttype:\n\t\t| \"data\"\n\t\t| \"dirty\"\n\t\t| \"resolved\"\n\t\t| \"invalidate\"\n\t\t| \"pause\"\n\t\t| \"resume\"\n\t\t| \"complete\"\n\t\t| \"error\"\n\t\t| \"teardown\";\n\tactor?: Actor;\n\tvalue?: unknown;\n\terror?: unknown;\n\tannotation?: string;\n}\n\nfunction auditMeta(kind: string, extra?: Record<string, unknown>): Record<string, unknown> {\n\treturn domainMeta(\"audit\", kind, extra);\n}\n\n// ---------------------------------------------------------------------------\n// auditTrail\n// ---------------------------------------------------------------------------\n\nconst DEFAULT_INCLUDE_TYPES: ReadonlySet<AuditEntry[\"type\"]> = new Set([\n\t\"data\",\n\t\"error\",\n\t\"complete\",\n\t\"teardown\",\n]);\n\n/** Options for {@link auditTrail}. */\nexport interface AuditTrailOptions {\n\tname?: string;\n\tgraph?: GraphOptions;\n\t/** Ring-buffer cap for the underlying `reactiveLog`. Default: unbounded. */\n\tmaxSize?: number;\n\t/**\n\t * Which event types to record. Default: `[\"data\", \"error\", \"complete\",\n\t * \"teardown\"]` — the user-meaningful set. Opt in to mid-wave protocol\n\t * events (`\"dirty\"`, `\"resolved\"`, `\"invalidate\"`, `\"pause\"`, `\"resume\"`)\n\t * by listing them explicitly. Note: those tier-1/tier-2 events do not\n\t * carry an `actor` (no `lastMutation` populated) — record them only for\n\t * protocol-level diagnostics.\n\t */\n\tincludeTypes?: readonly AuditEntry[\"type\"][];\n\t/** Per-event filter; return false to skip. */\n\tfilter?: (entry: AuditEntry) => boolean;\n}\n\n/**\n * Mounted audit log — `entries` exposes the reactive `AuditEntry[]`; query\n * helpers are sync convenience wrappers over the cached snapshot.\n */\nexport class AuditTrailGraph extends Graph {\n\treadonly entries: Node<readonly AuditEntry[]>;\n\treadonly count: Node<number>;\n\t/**\n\t * Effective set of event types this trail records (EH-18). Reflects\n\t * either the caller-supplied `opts.includeTypes` or the default set\n\t * (`[\"data\", \"error\", \"complete\", \"teardown\"]`). Captured at construction\n\t * — each instance owns its own clone, so a default-using trail can never\n\t * leak mutations into the module-level default set.\n\t *\n\t * **Mutation contract.** Type-system read-only via `ReadonlySet`. Runtime\n\t * mutation through an unsafe cast (`(audit.includeTypes as Set<...>)\n\t * .add(...)`) is unsupported — it would desync the field from the\n\t * recording closure, which captured the original `Set` reference at\n\t * construction. The runtime does NOT enforce immutability beyond the\n\t * type contract; consumers must respect it.\n\t *\n\t * Use this to validate that a `complianceSnapshot.fingerprint` was\n\t * computed against the same recording surface — fingerprints are stable\n\t * only when the recording set is identical across snapshots.\n\t */\n\treadonly includeTypes: ReadonlySet<AuditEntry[\"type\"]>;\n\tprivate readonly _log;\n\tprivate readonly _target: Graph;\n\n\tconstructor(target: Graph, opts: AuditTrailOptions) {\n\t\tsuper(opts.name ?? `${target.name}_audit`, opts.graph);\n\t\tthis._target = target;\n\t\tthis._log = reactiveLog<AuditEntry>([], {\n\t\t\tname: \"entries\",\n\t\t\t...(opts.maxSize != null ? { maxSize: opts.maxSize } : {}),\n\t\t});\n\t\tthis.entries = this._log.entries;\n\t\tthis.add(this.entries, { name: \"entries\" });\n\n\t\tthis.count = this.derived<number>(\n\t\t\t\"count\",\n\t\t\t[\"entries\"],\n\t\t\t(batchData, ctx) => {\n\t\t\t\tconst data = batchData.map((batch, i) =>\n\t\t\t\t\tbatch != null && batch.length > 0 ? batch.at(-1) : ctx.prevData[i],\n\t\t\t\t);\n\t\t\t\treturn [(data[0] as readonly AuditEntry[]).length];\n\t\t\t},\n\t\t\t{ meta: auditMeta(\"count\") },\n\t\t);\n\t\tthis.addDisposer(keepalive(this.count));\n\n\t\t// Always clone — DEFAULT_INCLUDE_TYPES is a module-level singleton and\n\t\t// must not be shared across instances (a cast-and-mutate via\n\t\t// `audit.includeTypes` would otherwise corrupt every default audit\n\t\t// trail in the process).\n\t\tconst includeTypes: Set<AuditEntry[\"type\"]> =\n\t\t\topts.includeTypes != null ? new Set(opts.includeTypes) : new Set(DEFAULT_INCLUDE_TYPES);\n\t\tthis.includeTypes = includeTypes;\n\t\tconst filter = opts.filter;\n\n\t\t// Monotonic per-trail. **Stagnates** (does not wrap) past\n\t\t// `Number.MAX_SAFE_INTEGER` — IEEE-754 imprecision means `seq + 1 === seq`\n\t\t// once `seq` exceeds 2^53; subsequent records would carry the same\n\t\t// stagnant value and break uniqueness. At 100k events/sec that's\n\t\t// ~3000 years — not a practical concern.\n\t\tlet seq = 0;\n\t\tconst handle = target.observe({ timeline: true, structured: true });\n\t\tconst offEvent = handle.onEvent((event) => {\n\t\t\t// `event.type` includes \"derived\" (causal-trace recompute marker) which\n\t\t\t// isn't a recordable mutation — skip it. Cast through narrowed type\n\t\t\t// after the discriminator check.\n\t\t\tif (event.type === \"derived\") return;\n\t\t\tconst type = event.type as AuditEntry[\"type\"];\n\t\t\tif (!includeTypes.has(type)) return;\n\t\t\tconst path = event.path ?? \"\";\n\t\t\tconst entry: AuditEntry = {\n\t\t\t\tseq: seq++,\n\t\t\t\ttimestamp_ns: event.timestamp_ns ?? monotonicNs(),\n\t\t\t\twall_clock_ns: wallClockNs(),\n\t\t\t\tpath,\n\t\t\t\ttype,\n\t\t\t};\n\t\t\t// Attribution + value enrichment.\n\t\t\tconst node = path ? safeNode(target, path) : undefined;\n\t\t\tconst lastMutation = node?.lastMutation;\n\t\t\tif (lastMutation != null) entry.actor = lastMutation.actor;\n\t\t\tif (type === \"data\") entry.value = (event as { data: unknown }).data;\n\t\t\tif (type === \"error\") entry.error = (event as { data: unknown }).data;\n\t\t\tconst annotation = path ? safeAnnotation(target, path) : undefined;\n\t\t\tif (annotation != null) entry.annotation = annotation;\n\t\t\tif (filter != null && !filter(entry)) return;\n\t\t\tthis._log.append(entry);\n\t\t});\n\n\t\tthis.addDisposer(() => {\n\t\t\toffEvent();\n\t\t\thandle.dispose();\n\t\t});\n\t\tthis.addDisposer(() => this._log.disposeAllViews());\n\t}\n\n\t/** All entries currently in the ring (snapshot). */\n\tall(): readonly AuditEntry[] {\n\t\treturn (this.entries.cache as readonly AuditEntry[] | undefined) ?? [];\n\t}\n\n\t/** Entries matching `path`. Order preserved. */\n\tbyNode(path: string): readonly AuditEntry[] {\n\t\treturn this.all().filter((e) => e.path === path);\n\t}\n\n\t/** Entries whose `actor.id` matches. Use `byActorType` for type filtering. */\n\tbyActor(actorId: string): readonly AuditEntry[] {\n\t\treturn this.all().filter((e) => e.actor?.id === actorId);\n\t}\n\n\t/** Entries whose `actor.type` matches (e.g. `\"llm\"`, `\"human\"`). */\n\tbyActorType(type: string): readonly AuditEntry[] {\n\t\treturn this.all().filter((e) => e.actor?.type === type);\n\t}\n\n\t/**\n\t * Entries with `timestamp_ns` in `[start_ns, end_ns)` (end exclusive).\n\t * Omit `end_ns` to query open-ended.\n\t */\n\tbyTimeRange(start_ns: number, end_ns?: number): readonly AuditEntry[] {\n\t\treturn this.all().filter((e) => {\n\t\t\tif (e.timestamp_ns < start_ns) return false;\n\t\t\tif (end_ns != null && e.timestamp_ns >= end_ns) return false;\n\t\t\treturn true;\n\t\t});\n\t}\n\n\t/** Reference to the audited graph (escape hatch for tooling). */\n\tget target(): Graph {\n\t\treturn this._target;\n\t}\n}\n\n/**\n * Wraps any {@link Graph} with a reactive audit trail recording every event\n * matching `includeTypes` (default: data + error + complete + teardown).\n *\n * Each entry carries `seq`, `timestamp_ns` (monotonic), `wall_clock_ns`,\n * `path`, `type`, and — when available — `actor`, `value`, `error`, and the\n * `graph.trace()` reasoning annotation for the path.\n *\n * The returned graph mounts an `entries` node + `count` derived. Query\n * helpers (`byNode`, `byActor`, `byTimeRange`) operate on the cached\n * snapshot synchronously.\n */\nexport function auditTrail(target: Graph, opts: AuditTrailOptions = {}): AuditTrailGraph {\n\treturn new AuditTrailGraph(target, opts);\n}\n\n// ---------------------------------------------------------------------------\n// policyGate (renamed from `policyEnforcer` per Tier 2.3 — joins the\n// gate-family disambiguation: `valve` (boolean) / `budgetGate` (numeric) /\n// `approvalGate` (human judgment) / `policyGate` (ABAC rules))\n// ---------------------------------------------------------------------------\n\n/** A single policy denial recorded by {@link PolicyGateGraph}. */\nexport interface PolicyViolation {\n\ttimestamp_ns: number;\n\twall_clock_ns: number;\n\tpath: string;\n\tactor: Actor;\n\taction: GuardAction;\n\tmode: \"audit\" | \"enforce\";\n\t/** `\"observed\"` (audit mode after-the-fact) or `\"blocked\"` (enforce mode pre-write). */\n\tresult: \"observed\" | \"blocked\";\n}\n\n/** Options for {@link policyGate}. */\nexport interface PolicyGateOptions {\n\tname?: string;\n\tgraph?: GraphOptions;\n\t/**\n\t * `\"audit\"` (default) — observe events and record would-be denials;\n\t * does not block writes. Audit mode requires `lastMutation` attribution\n\t * on the audited node — anonymous/internal writes (no `actor` passed,\n\t * unguarded node) are skipped silently because the policy cannot be\n\t * evaluated without an actor.\n\t *\n\t * `\"enforce\"` — push guards onto target nodes so disallowed writes\n\t * throw {@link GuardDenied}. Reverted on dispose.\n\t */\n\tmode?: \"audit\" | \"enforce\";\n\t/**\n\t * Restrict enforcement to specific node paths (qualified). When omitted,\n\t * applies to every node visible in `target.describe()` at construction\n\t * time (subgraphs are walked transitively) AND subscribes to the full\n\t * topology tree via {@link watchTopologyTree}, so nodes added to\n\t * `target` OR any transitively-mounted subgraph after construction are\n\t * guarded automatically (enforce mode only).\n\t *\n\t * Accepts a static `readonly string[]` or a reactive\n\t * `Node<readonly string[]>` (Tier 3.4 — F.9 reactive primitive carve-out).\n\t * When a `Node` is passed, the enforcer rebinds the guarded path set on\n\t * every emission: paths added to the new set get wrapped, paths removed\n\t * from the new set get released, and the audit-mode allow-list filter\n\t * uses the latest cached value. Static-array callers retain the current\n\t * \"caller owns the path set\" semantics.\n\t *\n\t * **Cost:** unrestricted mode runs `describe({detail:\"minimal\"})` once\n\t * at construction (O(N) over the graph tree) plus one topology\n\t * subscription per graph instance in the mount tree. Restricted mode\n\t * (static or reactive) skips both and disables `watchTopologyTree`\n\t * dynamic coverage — for reactive callers, the path-set Node is the\n\t * single source of truth for which paths are guarded.\n\t */\n\tpaths?: readonly string[] | Node<readonly string[]>;\n\t/**\n\t * Ring-buffer cap for the violations topic. Default: 1000. Static\n\t * number only — reactive form is deferred pending TopicGraph reactive\n\t * `retainedLimit` support (see Tier 10.8 design follow-up in\n\t * `docs/optimizations.md`).\n\t */\n\tviolationsLimit?: number;\n}\n\n/**\n * Reactive ABAC enforcement layer. Policies are reactive — pass a\n * `Node<readonly PolicyRuleData[]>` to allow LLMs (or any reactive source)\n * to update them at runtime; the enforcer rebinds its internal\n * {@link NodeGuard} on every push.\n */\nexport class PolicyGateGraph extends Graph {\n\treadonly policies: Node<readonly PolicyRuleData[]>;\n\treadonly violations: TopicGraph<PolicyViolation>;\n\treadonly violationCount: Node<number>;\n\tprivate readonly _target: Graph;\n\tprivate readonly _mode: \"audit\" | \"enforce\";\n\tprivate _currentGuard: NodeGuard;\n\n\tconstructor(\n\t\ttarget: Graph,\n\t\tpolicies: readonly PolicyRuleData[] | Node<readonly PolicyRuleData[]>,\n\t\topts: PolicyGateOptions,\n\t) {\n\t\tsuper(opts.name ?? `${target.name}_policy`, opts.graph);\n\t\tthis._target = target;\n\t\tthis._mode = opts.mode ?? \"audit\";\n\n\t\tconst policiesNode = isNode(policies)\n\t\t\t? policies\n\t\t\t: node<readonly PolicyRuleData[]>([], { name: \"policies\", initial: policies });\n\t\tthis.policies = policiesNode;\n\t\tthis.add(this.policies, { name: \"policies\" });\n\n\t\tthis.violations = new TopicGraph<PolicyViolation>(\"violations\", {\n\t\t\tretainedLimit: opts.violationsLimit ?? 1000,\n\t\t});\n\t\tthis.mount(\"violations\", this.violations);\n\n\t\tthis.violationCount = this.derived<number>(\n\t\t\t\"violationCount\",\n\t\t\t[\"violations::events\"],\n\t\t\t(batchData, ctx) => {\n\t\t\t\tconst data = batchData.map((batch, i) =>\n\t\t\t\t\tbatch != null && batch.length > 0 ? batch.at(-1) : ctx.prevData[i],\n\t\t\t\t);\n\t\t\t\treturn [(data[0] as readonly PolicyViolation[]).length];\n\t\t\t},\n\t\t\t{\n\t\t\t\tmeta: auditMeta(\"policy_violation_count\"),\n\t\t\t},\n\t\t);\n\t\tthis.addDisposer(keepalive(this.violationCount));\n\n\t\t// Factory-time seed (COMPOSITION-GUIDE §28): cache the latest rules\n\t\t// inside a closure, refresh on each subscribe-pushed update, and read\n\t\t// closure inside the guard so policy updates take effect immediately.\n\t\tconst initialRules = (policiesNode.cache as readonly PolicyRuleData[] | undefined) ?? [];\n\t\tlet latestRules: readonly PolicyRuleData[] = initialRules;\n\t\tthis._currentGuard = policyFromRules(latestRules);\n\t\tconst offPolicies = policiesNode.subscribe((msgs) => {\n\t\t\tfor (const m of msgs) {\n\t\t\t\tif (m[0] === DATA) {\n\t\t\t\t\tlatestRules = (m[1] as readonly PolicyRuleData[] | undefined) ?? [];\n\t\t\t\t\tthis._currentGuard = policyFromRules(latestRules);\n\t\t\t\t}\n\t\t\t}\n\t\t});\n\t\tthis.addDisposer(offPolicies);\n\n\t\t// Resolve `paths` option to its three modes:\n\t\t//   (a) undefined → dynamic coverage via watchTopologyTree\n\t\t//   (b) static readonly string[] → caller owns the set\n\t\t//   (c) Node<readonly string[]> → reactive set; rebind on each emission\n\t\t// `latestPaths` is the closure-mirror of the current path set (or\n\t\t// undefined for dynamic coverage). It is read by:\n\t\t//   - the audit-mode observe callback (allow-list filter)\n\t\t//   - the reactive-paths rebind subscription (diff against next set)\n\t\t// Mirrors the `latestRules` pattern used for `policiesNode` above\n\t\t// (COMPOSITION-GUIDE §28 factory-time seed).\n\t\tconst pathsOpt = opts.paths;\n\t\tconst pathsNode: Node<readonly string[]> | undefined = isNode(pathsOpt)\n\t\t\t? (pathsOpt as Node<readonly string[]>)\n\t\t\t: undefined;\n\t\t// `pathsExplicit` mirrors the legacy \"caller provided a path set\" branch\n\t\t// — true for both static-array and Node-of-array forms; false only when\n\t\t// `opts.paths` is omitted (dynamic-coverage mode).\n\t\tconst pathsExplicit = pathsOpt != null;\n\t\tconst initialPaths: readonly string[] | undefined =\n\t\t\tpathsNode != null\n\t\t\t\t? ((pathsNode.cache as readonly string[] | undefined) ?? [])\n\t\t\t\t: pathsExplicit\n\t\t\t\t\t? [...(pathsOpt as readonly string[])]\n\t\t\t\t\t: undefined;\n\t\t// `latestPaths` is undefined ONLY in dynamic-coverage mode.\n\t\tlet latestPaths: readonly string[] | undefined = initialPaths;\n\t\t// Initial sweep set for the enforce-mode wrap loop.\n\t\tconst paths = latestPaths ?? collectPaths(target);\n\n\t\t// Audit-mode reactive-paths subscription. Enforce mode handles its own\n\t\t// subscription (it also needs to diff old↔new to wrap/release guards);\n\t\t// audit mode just needs `latestPaths` to track the latest cache so the\n\t\t// allow-list filter stays current. Wired here, before the mode branch,\n\t\t// so it runs in audit mode only — enforce mode wires its own\n\t\t// rebinding subscription with diffing logic (DRY would require an\n\t\t// always-on tracker that enforce mode then ignores; the small\n\t\t// duplication keeps the enforce-mode branch self-contained).\n\t\tif (this._mode !== \"enforce\" && pathsNode != null) {\n\t\t\tconst offAuditPaths = pathsNode.subscribe((msgs) => {\n\t\t\t\tfor (const m of msgs) {\n\t\t\t\t\tif (m[0] !== DATA) continue;\n\t\t\t\t\tlatestPaths = (m[1] as readonly string[] | undefined) ?? [];\n\t\t\t\t}\n\t\t\t});\n\t\t\tthis.addDisposer(offAuditPaths);\n\t\t}\n\n\t\tif (this._mode === \"enforce\") {\n\t\t\t// Track which paths are currently guarded so dynamic adds don't\n\t\t\t// double-wrap and removed nodes release guard handles.\n\t\t\tconst restorers = new Map<string, () => void>();\n\t\t\tconst wrapAndPush = (path: string): void => {\n\t\t\t\tif (restorers.has(path)) return;\n\t\t\t\tconst node = safeNode(target, path);\n\t\t\t\tif (!(node instanceof NodeImpl)) return;\n\t\t\t\tconst pathGuard: NodeGuard = (actor, action) => {\n\t\t\t\t\tconst ok = this._currentGuard(actor, action);\n\t\t\t\t\tif (!ok) {\n\t\t\t\t\t\tthis._publishViolation(actor, action, path, \"blocked\");\n\t\t\t\t\t}\n\t\t\t\t\treturn ok;\n\t\t\t\t};\n\t\t\t\trestorers.set(path, node._pushGuard(pathGuard));\n\t\t\t};\n\t\t\t// Initial sweep: guard every path present at construction.\n\t\t\tfor (const path of paths) wrapAndPush(path);\n\n\t\t\t// Reactive paths rebind: when `paths` is a Node, every DATA emission\n\t\t\t// replaces `latestPaths` and diffs against the previous set —\n\t\t\t// added paths get wrapped, removed paths release their guard. No\n\t\t\t// imperative orchestration; the diff falls out of the closure-mirror\n\t\t\t// + subscribe pattern (mirrors `policiesNode` above).\n\t\t\tif (pathsNode != null) {\n\t\t\t\tconst offReactivePaths = pathsNode.subscribe((msgs) => {\n\t\t\t\t\tfor (const m of msgs) {\n\t\t\t\t\t\tif (m[0] !== DATA) continue;\n\t\t\t\t\t\tconst next = (m[1] as readonly string[] | undefined) ?? [];\n\t\t\t\t\t\tconst nextSet = new Set(next);\n\t\t\t\t\t\tconst prevSet = new Set(latestPaths ?? []);\n\t\t\t\t\t\t// Wrap rebind in `batch()` (qa D7) — guards are imperative\n\t\t\t\t\t\t// graph mutations; if `paths` and `policies` co-emit in an\n\t\t\t\t\t\t// outer batch (atomic config swap), each handler's mutations\n\t\t\t\t\t\t// would otherwise unwind in arbitrary order, letting an\n\t\t\t\t\t\t// in-flight write hit a half-rebound guard set. Batching\n\t\t\t\t\t\t// coalesces release + wrap into a single deferred drain.\n\t\t\t\t\t\tbatch(() => {\n\t\t\t\t\t\t\t// Release paths that fell out of the new set.\n\t\t\t\t\t\t\tfor (const p of prevSet) {\n\t\t\t\t\t\t\t\tif (nextSet.has(p)) continue;\n\t\t\t\t\t\t\t\tconst r = restorers.get(p);\n\t\t\t\t\t\t\t\tif (r != null) {\n\t\t\t\t\t\t\t\t\tr();\n\t\t\t\t\t\t\t\t\trestorers.delete(p);\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t// Wrap newly-added paths.\n\t\t\t\t\t\t\tfor (const p of nextSet) {\n\t\t\t\t\t\t\t\tif (prevSet.has(p)) continue;\n\t\t\t\t\t\t\t\twrapAndPush(p);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tlatestPaths = next;\n\t\t\t\t\t\t});\n\t\t\t\t\t}\n\t\t\t\t});\n\t\t\t\tthis.addDisposer(offReactivePaths);\n\t\t\t}\n\n\t\t\t// Dynamic coverage: when `paths` was NOT explicitly provided, follow\n\t\t\t// the full topology tree (target + every transitively-mounted\n\t\t\t// subgraph, including subgraphs mounted after construction) so late\n\t\t\t// adds at any depth get guarded. `prefix` carries the qualified\n\t\t\t// path-prefix from `target` to the emitter graph.\n\t\t\tif (!pathsExplicit) {\n\t\t\t\tconst offTopology = watchTopologyTree(target, (event, emitter, prefix) => {\n\t\t\t\t\tif (event.kind === \"added\") {\n\t\t\t\t\t\tif (event.nodeKind === \"node\") {\n\t\t\t\t\t\t\twrapAndPush(`${prefix}${event.name}`);\n\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t// Mount added. Walk just the newly-mounted subgraph's local\n\t\t\t\t\t\t\t// paths (scoped describe — O(M) in the mounted subtree)\n\t\t\t\t\t\t\t// rather than re-describing the entire target tree. The\n\t\t\t\t\t\t\t// emitter is the PARENT of the new mount; resolve the child\n\t\t\t\t\t\t\t// via its `_mounts` map.\n\t\t\t\t\t\t\tconst child = emitter._mounts.get(event.name);\n\t\t\t\t\t\t\tif (!(child instanceof Graph)) return;\n\t\t\t\t\t\t\tconst mountPrefix = `${prefix}${event.name}::`;\n\t\t\t\t\t\t\tconst localPaths = collectPaths(child);\n\t\t\t\t\t\t\tfor (const localPath of localPaths) {\n\t\t\t\t\t\t\t\t// `localPath` is relative to `child`; qualify with the\n\t\t\t\t\t\t\t\t// mount prefix so guard keys stay target-rooted.\n\t\t\t\t\t\t\t\twrapAndPush(\n\t\t\t\t\t\t\t\t\tlocalPath === \"\" ? `${prefix}${event.name}` : `${mountPrefix}${localPath}`,\n\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t} else if (event.kind === \"removed\") {\n\t\t\t\t\t\t// TEARDOWN already unhooks the guard; release bookkeeping so\n\t\t\t\t\t\t// re-adds under the same qualified path re-wrap cleanly.\n\t\t\t\t\t\tif (event.nodeKind === \"node\") {\n\t\t\t\t\t\t\tconst qp = `${prefix}${event.name}`;\n\t\t\t\t\t\t\tconst r = restorers.get(qp);\n\t\t\t\t\t\t\tif (r != null) {\n\t\t\t\t\t\t\t\tr();\n\t\t\t\t\t\t\t\trestorers.delete(qp);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\tconst mountQp = `${prefix}${event.name}`;\n\t\t\t\t\t\t\tconst mountPrefix = `${mountQp}::`;\n\t\t\t\t\t\t\tfor (const [p, r] of restorers) {\n\t\t\t\t\t\t\t\tif (p === mountQp || p.startsWith(mountPrefix)) {\n\t\t\t\t\t\t\t\t\tr();\n\t\t\t\t\t\t\t\t\trestorers.delete(p);\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t});\n\t\t\t\tthis.addDisposer(offTopology);\n\t\t\t} else {\n\t\t\t\t// Restricted mode: subscribe to target.topology (own-graph only —\n\t\t\t\t// explicit `paths` means caller owns the path set) so node removals\n\t\t\t\t// release their restorers instead of leaking until enforcer dispose.\n\t\t\t\tconst offCleanup = target.topology.subscribe((msgs) => {\n\t\t\t\t\tfor (const m of msgs) {\n\t\t\t\t\t\tif (m[0] !== DATA) continue;\n\t\t\t\t\t\tconst event = m[1] as TopologyEvent;\n\t\t\t\t\t\tif (event.kind !== \"removed\" || event.nodeKind !== \"node\") continue;\n\t\t\t\t\t\tconst r = restorers.get(event.name);\n\t\t\t\t\t\tif (r != null) {\n\t\t\t\t\t\t\tr();\n\t\t\t\t\t\t\trestorers.delete(event.name);\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t});\n\t\t\t\tthis.addDisposer(offCleanup);\n\t\t\t}\n\t\t\tthis.addDisposer(() => {\n\t\t\t\tfor (const r of restorers.values()) r();\n\t\t\t\trestorers.clear();\n\t\t\t});\n\t\t} else {\n\t\t\t// Audit mode: observe writes, evaluate against current guard, record\n\t\t\t// violations without blocking. Use the structured observe stream so\n\t\t\t// `path` and `actor` attribution are supplied without per-node\n\t\t\t// subscription bookkeeping. B9: unattributed writes no longer skip\n\t\t\t// — the ObserveEvent always carries a well-formed `actor` (falling\n\t\t\t// back to `DEFAULT_ACTOR` for anonymous/internal writes), so the\n\t\t\t// policy is evaluated against every write.\n\t\t\tconst handle = target.observe({ timeline: true, structured: true });\n\t\t\tconst off = handle.onEvent((event) => {\n\t\t\t\tif (event.type !== \"data\" && event.type !== \"error\") return;\n\t\t\t\tconst path = event.path ?? \"\";\n\t\t\t\tif (!path) return;\n\t\t\t\t// `latestPaths` is the closure-mirror of the (possibly reactive)\n\t\t\t\t// path allow-list. Undefined = no restriction (dynamic-coverage\n\t\t\t\t// mode); reactive callers see the filter rebind on each emission\n\t\t\t\t// without re-creating the enforcer (Tier 3.4).\n\t\t\t\tif (latestPaths != null && !latestPaths.includes(path)) return;\n\t\t\t\t// Prefer the event-stamped actor (always populated for DATA/ERROR\n\t\t\t\t// post-B9). Fall back to lastMutation for back-compat with any\n\t\t\t\t// consumer stubbing observe events without the field.\n\t\t\t\tconst actor =\n\t\t\t\t\t(event as { actor?: Actor }).actor ?? safeNode(target, path)?.lastMutation?.actor;\n\t\t\t\tif (actor == null) return; // defensive — shouldn't happen post-B9\n\t\t\t\tconst action: GuardAction = \"write\";\n\t\t\t\tif (this._currentGuard(actor, action)) return;\n\t\t\t\tthis._publishViolation(actor, action, path, \"observed\");\n\t\t\t});\n\t\t\tthis.addDisposer(() => {\n\t\t\t\toff();\n\t\t\t\thandle.dispose();\n\t\t\t});\n\t\t}\n\t}\n\n\tprivate _publishViolation(\n\t\tactor: Actor,\n\t\taction: GuardAction,\n\t\tpath: string,\n\t\tresult: \"observed\" | \"blocked\",\n\t): void {\n\t\tthis.violations.publish({\n\t\t\ttimestamp_ns: monotonicNs(),\n\t\t\twall_clock_ns: wallClockNs(),\n\t\t\tpath,\n\t\t\tactor,\n\t\t\taction,\n\t\t\tmode: this._mode,\n\t\t\tresult,\n\t\t});\n\t}\n\n\t/** Snapshot of recorded violations. */\n\tall(): readonly PolicyViolation[] {\n\t\treturn this.violations.retained();\n\t}\n\n\tget mode(): \"audit\" | \"enforce\" {\n\t\treturn this._mode;\n\t}\n\n\tget target(): Graph {\n\t\treturn this._target;\n\t}\n}\n\n/**\n * Wraps a {@link Graph} with reactive policy enforcement. Pass either a\n * static rule list or a {@link Node} of rules (LLM-updatable). Records\n * `PolicyViolation` entries to `violations` topic; in `\"enforce\"` mode also\n * pushes guards onto target nodes so disallowed writes throw.\n *\n * Self-tags via `g.tagFactory(\"policyGate\", placeholderArgs(opts))` so\n * `graph.describe()` surfaces `factory: \"policyGate\"` provenance (Phase 2.5\n * DT5 ride-along, locked with the Tier 2.3 rename).\n */\nexport function policyGate(\n\ttarget: Graph,\n\tpolicies: readonly PolicyRuleData[] | Node<readonly PolicyRuleData[]>,\n\topts: PolicyGateOptions = {},\n): PolicyGateGraph {\n\tconst g = new PolicyGateGraph(target, policies, opts);\n\t// `placeholderArgs` walks `opts` for non-JSON fields (e.g. `policies` may\n\t// be a Node when the caller wants live-updatable rules; `opts.graph` is\n\t// `GraphOptions`). DT5 deferred tag; Tier 2.3 ride-along.\n\tg.tagFactory(\"policyGate\", placeholderArgs(opts as unknown as Record<string, unknown>));\n\treturn g;\n}\n\n// ---------------------------------------------------------------------------\n// complianceSnapshot\n// ---------------------------------------------------------------------------\n\n/** Options for {@link complianceSnapshot}. */\nexport interface ComplianceSnapshotOptions {\n\taudit?: AuditTrailGraph;\n\tpolicies?: PolicyGateGraph;\n\t/** Actor recorded as the snapshot taker. */\n\tactor?: Actor;\n}\n\n/** Output of {@link complianceSnapshot}. JSON-serializable. */\nexport interface ComplianceSnapshotResult {\n\tformat_version: 1;\n\ttimestamp_ns: number;\n\twall_clock_ns: number;\n\tactor?: Actor;\n\tgraph: GraphPersistSnapshot;\n\taudit?: { count: number; entries: AuditEntry[] };\n\tpolicies?: {\n\t\tmode: \"audit\" | \"enforce\";\n\t\trules: readonly PolicyRuleData[];\n\t\tviolations: readonly PolicyViolation[];\n\t};\n\t/**\n\t * Truncated SHA-256 hex (16 chars / ~64 bits) over a canonical encoding\n\t * of every field above (excluding `fingerprint` itself). Deterministic\n\t * across runs given identical inputs. Suitable for casual tamper-evidence\n\t * and content-addressed dedup; for full cryptographic strength, hash the\n\t * canonical JSON externally with Web Crypto / Node `crypto`.\n\t */\n\tfingerprint: string;\n}\n\n/**\n * One-shot point-in-time export of a {@link Graph}'s state plus optional\n * audit + policy bundles. Returns a JSON-serializable object with a\n * deterministic truncated-SHA-256 {@link ComplianceSnapshotResult.fingerprint}\n * over the canonical payload for tamper-evidence in regulatory archival.\n *\n * **Cryptographic strength:** the fingerprint is truncated to 64 bits for\n * compact archival. Collision-resistant for casual integrity checks but NOT\n * sufficient for adversarial tamper-evidence — pair with a full SHA-256\n * (or stronger) over the canonical JSON when regulatory requirements demand\n * collision resistance.\n */\nexport function complianceSnapshot(\n\ttarget: Graph,\n\topts: ComplianceSnapshotOptions = {},\n): ComplianceSnapshotResult {\n\tconst result: Omit<ComplianceSnapshotResult, \"fingerprint\"> = {\n\t\tformat_version: 1,\n\t\ttimestamp_ns: monotonicNs(),\n\t\twall_clock_ns: wallClockNs(),\n\t\tgraph: target.snapshot() as GraphPersistSnapshot,\n\t};\n\tif (opts.actor != null) result.actor = opts.actor;\n\tif (opts.audit != null) {\n\t\tconst entries = [...opts.audit.all()];\n\t\tresult.audit = { count: entries.length, entries };\n\t}\n\tif (opts.policies != null) {\n\t\tconst rules = (opts.policies.policies.cache as readonly PolicyRuleData[] | undefined) ?? [];\n\t\tresult.policies = {\n\t\t\tmode: opts.policies.mode,\n\t\t\trules,\n\t\t\tviolations: [...opts.policies.all()],\n\t\t};\n\t}\n\tconst fingerprint = computeFingerprint(result);\n\treturn { ...result, fingerprint };\n}\n\n// ---------------------------------------------------------------------------\n// Internals\n// ---------------------------------------------------------------------------\n\nfunction isNode<T>(x: unknown): x is Node<T> {\n\treturn typeof x === \"object\" && x !== null && \"subscribe\" in (x as object);\n}\n\nfunction safeNode(target: Graph, path: string): Node | undefined {\n\ttry {\n\t\treturn target.node(path);\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nfunction safeAnnotation(target: Graph, path: string): string | undefined {\n\ttry {\n\t\treturn target.annotation(path);\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\n/**\n * Walks every locally-registered node path in `target`, descending through\n * mounted subgraphs. Returns qualified paths.\n */\nfunction collectPaths(target: Graph): string[] {\n\tconst described = target.describe({ detail: \"minimal\" });\n\treturn Object.keys(described.nodes);\n}\n\n/**\n * Stable canonical JSON → truncated SHA-256 hex fingerprint (16 hex chars,\n * ~64-bit). Uses the same vendored sync SHA-256 as `core/versioning.ts`\n * `defaultHash`, so cross-module fingerprints stay consistent.\n *\n * Canonicalization handles cycles (recursion-stack tracker), `undefined`,\n * `bigint`, `Map`, `Set`, `Date`, `RegExp`, and typed arrays via typed\n * markers — see {@link canonicalize}.\n *\n * **Note:** truncated to 16 hex chars (~64-bit) for compact archival. For\n * full 256-bit cryptographic strength, hash {@link complianceSnapshot} JSON\n * externally with Web Crypto / Node `crypto`.\n */\nfunction computeFingerprint(value: unknown): string {\n\t// Pre-stringify our canonical form so `defaultHash`'s\n\t// `canonicalizeForHash` (which rejects unsafe integers) only ever sees a\n\t// JSON string. Compliance payloads carry `timestamp_ns` values that\n\t// exceed `Number.MAX_SAFE_INTEGER` — JSON.stringify handles them fine,\n\t// the hash function only cares about deterministic input bytes.\n\treturn defaultHash(JSON.stringify(canonicalize(value)));\n}\n\n/**\n * Cycle-safe canonical encoding. Uses a recursion-stack `Set` (push on\n * descent, pop on return) so legitimate DAG re-references are encoded as\n * themselves; only true cycles produce a `__circular: true` marker. Typed\n * markers preserve `undefined` / `bigint` / `Map` / `Set` / `Date` / `RegExp`\n * / typed-array information that bare `JSON.stringify` would silently drop\n * or collide with strings.\n */\nfunction canonicalize(value: unknown): unknown {\n\tconst stack = new Set<object>();\n\tconst walk = (v: unknown): unknown => {\n\t\tif (v === undefined) return { __undefined: true };\n\t\tif (v === null) return null;\n\t\tconst t = typeof v;\n\t\tif (t === \"bigint\") return { __bigint: (v as bigint).toString() };\n\t\tif (t !== \"object\") return v;\n\t\tconst obj = v as object;\n\t\tif (stack.has(obj)) return { __circular: true };\n\t\tstack.add(obj);\n\t\ttry {\n\t\t\tif (Array.isArray(obj)) {\n\t\t\t\treturn (obj as unknown[]).map(walk);\n\t\t\t}\n\t\t\tif (obj instanceof Date) {\n\t\t\t\treturn { __date: obj.toISOString() };\n\t\t\t}\n\t\t\tif (obj instanceof RegExp) {\n\t\t\t\treturn { __regexp: { source: obj.source, flags: obj.flags } };\n\t\t\t}\n\t\t\tif (obj instanceof Map) {\n\t\t\t\tconst entries = [...(obj as Map<unknown, unknown>).entries()].map(([k, mv]) => [\n\t\t\t\t\twalk(k),\n\t\t\t\t\twalk(mv),\n\t\t\t\t]);\n\t\t\t\treturn { __map: entries };\n\t\t\t}\n\t\t\tif (obj instanceof Set) {\n\t\t\t\tconst items = [...(obj as Set<unknown>)].map(walk);\n\t\t\t\treturn { __set: items };\n\t\t\t}\n\t\t\tif (ArrayBuffer.isView(obj)) {\n\t\t\t\tconst ta = obj as unknown as { length: number; [i: number]: number };\n\t\t\t\tconst arr: number[] = new Array(ta.length);\n\t\t\t\tfor (let i = 0; i < ta.length; i++) arr[i] = ta[i] ?? 0;\n\t\t\t\treturn { __typed_array: { ctor: obj.constructor.name, data: arr } };\n\t\t\t}\n\t\t\tconst out: Record<string, unknown> = {};\n\t\t\tfor (const k of Object.keys(obj as Record<string, unknown>).sort()) {\n\t\t\t\tout[k] = walk((obj as Record<string, unknown>)[k]);\n\t\t\t}\n\t\t\treturn out;\n\t\t} finally {\n\t\t\tstack.delete(obj);\n\t\t}\n\t};\n\treturn walk(value);\n}\n\n// `explainPath` / `CausalChain` / `CausalStep` are exported from `graph/`\n// at module root; do not re-export here to keep the namespace boundary clean\n// and avoid duplicate-identifier issues in bundled .d.ts.\n"],"mappings":";;;;;;;;AAkBA;AAAA,EACC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACM;AACP,SAAS,WAAW,mBAAmB;AACvC;AAAA,EACC;AAAA,EAIA;AAAA,OACM;AA8BP,SAAS,UAAU,MAAc,OAA0D;AAC1F,SAAO,WAAW,SAAS,MAAM,KAAK;AACvC;AAMA,IAAM,wBAAyD,oBAAI,IAAI;AAAA,EACtE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD,CAAC;AAyBM,IAAM,kBAAN,cAA8B,MAAM;AAAA,EACjC;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA;AAAA,EACQ;AAAA,EACA;AAAA,EAEjB,YAAY,QAAe,MAAyB;AACnD,UAAM,KAAK,QAAQ,GAAG,OAAO,IAAI,UAAU,KAAK,KAAK;AACrD,SAAK,UAAU;AACf,SAAK,OAAO,YAAwB,CAAC,GAAG;AAAA,MACvC,MAAM;AAAA,MACN,GAAI,KAAK,WAAW,OAAO,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IACzD,CAAC;AACD,SAAK,UAAU,KAAK,KAAK;AACzB,SAAK,IAAI,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1C,SAAK,QAAQ,KAAK;AAAA,MACjB;AAAA,MACA,CAAC,SAAS;AAAA,MACV,CAAC,WAAW,QAAQ;AACnB,cAAM,OAAO,UAAU;AAAA,UAAI,CAACA,QAAO,MAClCA,UAAS,QAAQA,OAAM,SAAS,IAAIA,OAAM,GAAG,EAAE,IAAI,IAAI,SAAS,CAAC;AAAA,QAClE;AACA,eAAO,CAAE,KAAK,CAAC,EAA4B,MAAM;AAAA,MAClD;AAAA,MACA,EAAE,MAAM,UAAU,OAAO,EAAE;AAAA,IAC5B;AACA,SAAK,YAAY,UAAU,KAAK,KAAK,CAAC;AAMtC,UAAM,eACL,KAAK,gBAAgB,OAAO,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,IAAI,qBAAqB;AACvF,SAAK,eAAe;AACpB,UAAM,SAAS,KAAK;AAOpB,QAAI,MAAM;AACV,UAAM,SAAS,OAAO,QAAQ,EAAE,UAAU,MAAM,YAAY,KAAK,CAAC;AAClE,UAAM,WAAW,OAAO,QAAQ,CAAC,UAAU;AAI1C,UAAI,MAAM,SAAS,UAAW;AAC9B,YAAM,OAAO,MAAM;AACnB,UAAI,CAAC,aAAa,IAAI,IAAI,EAAG;AAC7B,YAAM,OAAO,MAAM,QAAQ;AAC3B,YAAM,QAAoB;AAAA,QACzB,KAAK;AAAA,QACL,cAAc,MAAM,gBAAgB,YAAY;AAAA,QAChD,eAAe,YAAY;AAAA,QAC3B;AAAA,QACA;AAAA,MACD;AAEA,YAAMC,QAAO,OAAO,SAAS,QAAQ,IAAI,IAAI;AAC7C,YAAM,eAAeA,OAAM;AAC3B,UAAI,gBAAgB,KAAM,OAAM,QAAQ,aAAa;AACrD,UAAI,SAAS,OAAQ,OAAM,QAAS,MAA4B;AAChE,UAAI,SAAS,QAAS,OAAM,QAAS,MAA4B;AACjE,YAAM,aAAa,OAAO,eAAe,QAAQ,IAAI,IAAI;AACzD,UAAI,cAAc,KAAM,OAAM,aAAa;AAC3C,UAAI,UAAU,QAAQ,CAAC,OAAO,KAAK,EAAG;AACtC,WAAK,KAAK,OAAO,KAAK;AAAA,IACvB,CAAC;AAED,SAAK,YAAY,MAAM;AACtB,eAAS;AACT,aAAO,QAAQ;AAAA,IAChB,CAAC;AACD,SAAK,YAAY,MAAM,KAAK,KAAK,gBAAgB,CAAC;AAAA,EACnD;AAAA;AAAA,EAGA,MAA6B;AAC5B,WAAQ,KAAK,QAAQ,SAA+C,CAAC;AAAA,EACtE;AAAA;AAAA,EAGA,OAAO,MAAqC;AAC3C,WAAO,KAAK,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,IAAI;AAAA,EAChD;AAAA;AAAA,EAGA,QAAQ,SAAwC;AAC/C,WAAO,KAAK,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,OAAO,OAAO;AAAA,EACxD;AAAA;AAAA,EAGA,YAAY,MAAqC;AAChD,WAAO,KAAK,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,SAAS,IAAI;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAY,UAAkB,QAAwC;AACrE,WAAO,KAAK,IAAI,EAAE,OAAO,CAAC,MAAM;AAC/B,UAAI,EAAE,eAAe,SAAU,QAAO;AACtC,UAAI,UAAU,QAAQ,EAAE,gBAAgB,OAAQ,QAAO;AACvD,aAAO;AAAA,IACR,CAAC;AAAA,EACF;AAAA;AAAA,EAGA,IAAI,SAAgB;AACnB,WAAO,KAAK;AAAA,EACb;AACD;AAcO,SAAS,WAAW,QAAe,OAA0B,CAAC,GAAoB;AACxF,SAAO,IAAI,gBAAgB,QAAQ,IAAI;AACxC;AA0EO,IAAM,kBAAN,cAA8B,MAAM;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACQ;AAAA,EACA;AAAA,EACT;AAAA,EAER,YACC,QACA,UACA,MACC;AACD,UAAM,KAAK,QAAQ,GAAG,OAAO,IAAI,WAAW,KAAK,KAAK;AACtD,SAAK,UAAU;AACf,SAAK,QAAQ,KAAK,QAAQ;AAE1B,UAAM,eAAe,OAAO,QAAQ,IACjC,WACA,KAAgC,CAAC,GAAG,EAAE,MAAM,YAAY,SAAS,SAAS,CAAC;AAC9E,SAAK,WAAW;AAChB,SAAK,IAAI,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C,SAAK,aAAa,IAAI,WAA4B,cAAc;AAAA,MAC/D,eAAe,KAAK,mBAAmB;AAAA,IACxC,CAAC;AACD,SAAK,MAAM,cAAc,KAAK,UAAU;AAExC,SAAK,iBAAiB,KAAK;AAAA,MAC1B;AAAA,MACA,CAAC,oBAAoB;AAAA,MACrB,CAAC,WAAW,QAAQ;AACnB,cAAM,OAAO,UAAU;AAAA,UAAI,CAACD,QAAO,MAClCA,UAAS,QAAQA,OAAM,SAAS,IAAIA,OAAM,GAAG,EAAE,IAAI,IAAI,SAAS,CAAC;AAAA,QAClE;AACA,eAAO,CAAE,KAAK,CAAC,EAAiC,MAAM;AAAA,MACvD;AAAA,MACA;AAAA,QACC,MAAM,UAAU,wBAAwB;AAAA,MACzC;AAAA,IACD;AACA,SAAK,YAAY,UAAU,KAAK,cAAc,CAAC;AAK/C,UAAM,eAAgB,aAAa,SAAmD,CAAC;AACvF,QAAI,cAAyC;AAC7C,SAAK,gBAAgB,gBAAgB,WAAW;AAChD,UAAM,cAAc,aAAa,UAAU,CAAC,SAAS;AACpD,iBAAW,KAAK,MAAM;AACrB,YAAI,EAAE,CAAC,MAAM,MAAM;AAClB,wBAAe,EAAE,CAAC,KAA+C,CAAC;AAClE,eAAK,gBAAgB,gBAAgB,WAAW;AAAA,QACjD;AAAA,MACD;AAAA,IACD,CAAC;AACD,SAAK,YAAY,WAAW;AAY5B,UAAM,WAAW,KAAK;AACtB,UAAM,YAAiD,OAAO,QAAQ,IAClE,WACD;AAIH,UAAM,gBAAgB,YAAY;AAClC,UAAM,eACL,aAAa,OACR,UAAU,SAA2C,CAAC,IACxD,gBACC,CAAC,GAAI,QAA8B,IACnC;AAEL,QAAI,cAA6C;AAEjD,UAAM,QAAQ,eAAe,aAAa,MAAM;AAUhD,QAAI,KAAK,UAAU,aAAa,aAAa,MAAM;AAClD,YAAM,gBAAgB,UAAU,UAAU,CAAC,SAAS;AACnD,mBAAW,KAAK,MAAM;AACrB,cAAI,EAAE,CAAC,MAAM,KAAM;AACnB,wBAAe,EAAE,CAAC,KAAuC,CAAC;AAAA,QAC3D;AAAA,MACD,CAAC;AACD,WAAK,YAAY,aAAa;AAAA,IAC/B;AAEA,QAAI,KAAK,UAAU,WAAW;AAG7B,YAAM,YAAY,oBAAI,IAAwB;AAC9C,YAAM,cAAc,CAAC,SAAuB;AAC3C,YAAI,UAAU,IAAI,IAAI,EAAG;AACzB,cAAMC,QAAO,SAAS,QAAQ,IAAI;AAClC,YAAI,EAAEA,iBAAgB,UAAW;AACjC,cAAM,YAAuB,CAAC,OAAO,WAAW;AAC/C,gBAAM,KAAK,KAAK,cAAc,OAAO,MAAM;AAC3C,cAAI,CAAC,IAAI;AACR,iBAAK,kBAAkB,OAAO,QAAQ,MAAM,SAAS;AAAA,UACtD;AACA,iBAAO;AAAA,QACR;AACA,kBAAU,IAAI,MAAMA,MAAK,WAAW,SAAS,CAAC;AAAA,MAC/C;AAEA,iBAAW,QAAQ,MAAO,aAAY,IAAI;AAO1C,UAAI,aAAa,MAAM;AACtB,cAAM,mBAAmB,UAAU,UAAU,CAAC,SAAS;AACtD,qBAAW,KAAK,MAAM;AACrB,gBAAI,EAAE,CAAC,MAAM,KAAM;AACnB,kBAAM,OAAQ,EAAE,CAAC,KAAuC,CAAC;AACzD,kBAAM,UAAU,IAAI,IAAI,IAAI;AAC5B,kBAAM,UAAU,IAAI,IAAI,eAAe,CAAC,CAAC;AAOzC,kBAAM,MAAM;AAEX,yBAAW,KAAK,SAAS;AACxB,oBAAI,QAAQ,IAAI,CAAC,EAAG;AACpB,sBAAM,IAAI,UAAU,IAAI,CAAC;AACzB,oBAAI,KAAK,MAAM;AACd,oBAAE;AACF,4BAAU,OAAO,CAAC;AAAA,gBACnB;AAAA,cACD;AAEA,yBAAW,KAAK,SAAS;AACxB,oBAAI,QAAQ,IAAI,CAAC,EAAG;AACpB,4BAAY,CAAC;AAAA,cACd;AACA,4BAAc;AAAA,YACf,CAAC;AAAA,UACF;AAAA,QACD,CAAC;AACD,aAAK,YAAY,gBAAgB;AAAA,MAClC;AAOA,UAAI,CAAC,eAAe;AACnB,cAAM,cAAc,kBAAkB,QAAQ,CAAC,OAAO,SAAS,WAAW;AACzE,cAAI,MAAM,SAAS,SAAS;AAC3B,gBAAI,MAAM,aAAa,QAAQ;AAC9B,0BAAY,GAAG,MAAM,GAAG,MAAM,IAAI,EAAE;AAAA,YACrC,OAAO;AAMN,oBAAM,QAAQ,QAAQ,QAAQ,IAAI,MAAM,IAAI;AAC5C,kBAAI,EAAE,iBAAiB,OAAQ;AAC/B,oBAAM,cAAc,GAAG,MAAM,GAAG,MAAM,IAAI;AAC1C,oBAAM,aAAa,aAAa,KAAK;AACrC,yBAAW,aAAa,YAAY;AAGnC;AAAA,kBACC,cAAc,KAAK,GAAG,MAAM,GAAG,MAAM,IAAI,KAAK,GAAG,WAAW,GAAG,SAAS;AAAA,gBACzE;AAAA,cACD;AAAA,YACD;AAAA,UACD,WAAW,MAAM,SAAS,WAAW;AAGpC,gBAAI,MAAM,aAAa,QAAQ;AAC9B,oBAAM,KAAK,GAAG,MAAM,GAAG,MAAM,IAAI;AACjC,oBAAM,IAAI,UAAU,IAAI,EAAE;AAC1B,kBAAI,KAAK,MAAM;AACd,kBAAE;AACF,0BAAU,OAAO,EAAE;AAAA,cACpB;AAAA,YACD,OAAO;AACN,oBAAM,UAAU,GAAG,MAAM,GAAG,MAAM,IAAI;AACtC,oBAAM,cAAc,GAAG,OAAO;AAC9B,yBAAW,CAAC,GAAG,CAAC,KAAK,WAAW;AAC/B,oBAAI,MAAM,WAAW,EAAE,WAAW,WAAW,GAAG;AAC/C,oBAAE;AACF,4BAAU,OAAO,CAAC;AAAA,gBACnB;AAAA,cACD;AAAA,YACD;AAAA,UACD;AAAA,QACD,CAAC;AACD,aAAK,YAAY,WAAW;AAAA,MAC7B,OAAO;AAIN,cAAM,aAAa,OAAO,SAAS,UAAU,CAAC,SAAS;AACtD,qBAAW,KAAK,MAAM;AACrB,gBAAI,EAAE,CAAC,MAAM,KAAM;AACnB,kBAAM,QAAQ,EAAE,CAAC;AACjB,gBAAI,MAAM,SAAS,aAAa,MAAM,aAAa,OAAQ;AAC3D,kBAAM,IAAI,UAAU,IAAI,MAAM,IAAI;AAClC,gBAAI,KAAK,MAAM;AACd,gBAAE;AACF,wBAAU,OAAO,MAAM,IAAI;AAAA,YAC5B;AAAA,UACD;AAAA,QACD,CAAC;AACD,aAAK,YAAY,UAAU;AAAA,MAC5B;AACA,WAAK,YAAY,MAAM;AACtB,mBAAW,KAAK,UAAU,OAAO,EAAG,GAAE;AACtC,kBAAU,MAAM;AAAA,MACjB,CAAC;AAAA,IACF,OAAO;AAQN,YAAM,SAAS,OAAO,QAAQ,EAAE,UAAU,MAAM,YAAY,KAAK,CAAC;AAClE,YAAM,MAAM,OAAO,QAAQ,CAAC,UAAU;AACrC,YAAI,MAAM,SAAS,UAAU,MAAM,SAAS,QAAS;AACrD,cAAM,OAAO,MAAM,QAAQ;AAC3B,YAAI,CAAC,KAAM;AAKX,YAAI,eAAe,QAAQ,CAAC,YAAY,SAAS,IAAI,EAAG;AAIxD,cAAM,QACJ,MAA4B,SAAS,SAAS,QAAQ,IAAI,GAAG,cAAc;AAC7E,YAAI,SAAS,KAAM;AACnB,cAAM,SAAsB;AAC5B,YAAI,KAAK,cAAc,OAAO,MAAM,EAAG;AACvC,aAAK,kBAAkB,OAAO,QAAQ,MAAM,UAAU;AAAA,MACvD,CAAC;AACD,WAAK,YAAY,MAAM;AACtB,YAAI;AACJ,eAAO,QAAQ;AAAA,MAChB,CAAC;AAAA,IACF;AAAA,EACD;AAAA,EAEQ,kBACP,OACA,QACA,MACA,QACO;AACP,SAAK,WAAW,QAAQ;AAAA,MACvB,cAAc,YAAY;AAAA,MAC1B,eAAe,YAAY;AAAA,MAC3B;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,KAAK;AAAA,MACX;AAAA,IACD,CAAC;AAAA,EACF;AAAA;AAAA,EAGA,MAAkC;AACjC,WAAO,KAAK,WAAW,SAAS;AAAA,EACjC;AAAA,EAEA,IAAI,OAA4B;AAC/B,WAAO,KAAK;AAAA,EACb;AAAA,EAEA,IAAI,SAAgB;AACnB,WAAO,KAAK;AAAA,EACb;AACD;AAYO,SAAS,WACf,QACA,UACA,OAA0B,CAAC,GACT;AAClB,QAAM,IAAI,IAAI,gBAAgB,QAAQ,UAAU,IAAI;AAIpD,IAAE,WAAW,cAAc,gBAAgB,IAA0C,CAAC;AACtF,SAAO;AACR;AAiDO,SAAS,mBACf,QACA,OAAkC,CAAC,GACR;AAC3B,QAAM,SAAwD;AAAA,IAC7D,gBAAgB;AAAA,IAChB,cAAc,YAAY;AAAA,IAC1B,eAAe,YAAY;AAAA,IAC3B,OAAO,OAAO,SAAS;AAAA,EACxB;AACA,MAAI,KAAK,SAAS,KAAM,QAAO,QAAQ,KAAK;AAC5C,MAAI,KAAK,SAAS,MAAM;AACvB,UAAM,UAAU,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC;AACpC,WAAO,QAAQ,EAAE,OAAO,QAAQ,QAAQ,QAAQ;AAAA,EACjD;AACA,MAAI,KAAK,YAAY,MAAM;AAC1B,UAAM,QAAS,KAAK,SAAS,SAAS,SAAmD,CAAC;AAC1F,WAAO,WAAW;AAAA,MACjB,MAAM,KAAK,SAAS;AAAA,MACpB;AAAA,MACA,YAAY,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC;AAAA,IACpC;AAAA,EACD;AACA,QAAM,cAAc,mBAAmB,MAAM;AAC7C,SAAO,EAAE,GAAG,QAAQ,YAAY;AACjC;AAMA,SAAS,OAAU,GAA0B;AAC5C,SAAO,OAAO,MAAM,YAAY,MAAM,QAAQ,eAAgB;AAC/D;AAEA,SAAS,SAAS,QAAe,MAAgC;AAChE,MAAI;AACH,WAAO,OAAO,KAAK,IAAI;AAAA,EACxB,QAAQ;AACP,WAAO;AAAA,EACR;AACD;AAEA,SAAS,eAAe,QAAe,MAAkC;AACxE,MAAI;AACH,WAAO,OAAO,WAAW,IAAI;AAAA,EAC9B,QAAQ;AACP,WAAO;AAAA,EACR;AACD;AAMA,SAAS,aAAa,QAAyB;AAC9C,QAAM,YAAY,OAAO,SAAS,EAAE,QAAQ,UAAU,CAAC;AACvD,SAAO,OAAO,KAAK,UAAU,KAAK;AACnC;AAeA,SAAS,mBAAmB,OAAwB;AAMnD,SAAO,YAAY,KAAK,UAAU,aAAa,KAAK,CAAC,CAAC;AACvD;AAUA,SAAS,aAAa,OAAyB;AAC9C,QAAM,QAAQ,oBAAI,IAAY;AAC9B,QAAM,OAAO,CAAC,MAAwB;AACrC,QAAI,MAAM,OAAW,QAAO,EAAE,aAAa,KAAK;AAChD,QAAI,MAAM,KAAM,QAAO;AACvB,UAAM,IAAI,OAAO;AACjB,QAAI,MAAM,SAAU,QAAO,EAAE,UAAW,EAAa,SAAS,EAAE;AAChE,QAAI,MAAM,SAAU,QAAO;AAC3B,UAAM,MAAM;AACZ,QAAI,MAAM,IAAI,GAAG,EAAG,QAAO,EAAE,YAAY,KAAK;AAC9C,UAAM,IAAI,GAAG;AACb,QAAI;AACH,UAAI,MAAM,QAAQ,GAAG,GAAG;AACvB,eAAQ,IAAkB,IAAI,IAAI;AAAA,MACnC;AACA,UAAI,eAAe,MAAM;AACxB,eAAO,EAAE,QAAQ,IAAI,YAAY,EAAE;AAAA,MACpC;AACA,UAAI,eAAe,QAAQ;AAC1B,eAAO,EAAE,UAAU,EAAE,QAAQ,IAAI,QAAQ,OAAO,IAAI,MAAM,EAAE;AAAA,MAC7D;AACA,UAAI,eAAe,KAAK;AACvB,cAAM,UAAU,CAAC,GAAI,IAA8B,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM;AAAA,UAC9E,KAAK,CAAC;AAAA,UACN,KAAK,EAAE;AAAA,QACR,CAAC;AACD,eAAO,EAAE,OAAO,QAAQ;AAAA,MACzB;AACA,UAAI,eAAe,KAAK;AACvB,cAAM,QAAQ,CAAC,GAAI,GAAoB,EAAE,IAAI,IAAI;AACjD,eAAO,EAAE,OAAO,MAAM;AAAA,MACvB;AACA,UAAI,YAAY,OAAO,GAAG,GAAG;AAC5B,cAAM,KAAK;AACX,cAAM,MAAgB,IAAI,MAAM,GAAG,MAAM;AACzC,iBAAS,IAAI,GAAG,IAAI,GAAG,QAAQ,IAAK,KAAI,CAAC,IAAI,GAAG,CAAC,KAAK;AACtD,eAAO,EAAE,eAAe,EAAE,MAAM,IAAI,YAAY,MAAM,MAAM,IAAI,EAAE;AAAA,MACnE;AACA,YAAM,MAA+B,CAAC;AACtC,iBAAW,KAAK,OAAO,KAAK,GAA8B,EAAE,KAAK,GAAG;AACnE,YAAI,CAAC,IAAI,KAAM,IAAgC,CAAC,CAAC;AAAA,MAClD;AACA,aAAO;AAAA,IACR,UAAE;AACD,YAAM,OAAO,GAAG;AAAA,IACjB;AAAA,EACD;AACA,SAAO,KAAK,KAAK;AAClB;","names":["batch","node"]}