@harrylabsj/kiwi 0.6.0

package/dist/trust/records/evaluator.js

@@ -0,0 +1,122 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * trust/records — 评估器（从事实观察推导 trust_level 建议值，基线 §27 / §28）。
+ *
+ * 评估规则确定、可测、无模型参与：
+ *   - 初始 T0；
+ *   - 成功交换 ≥ successToT1 → T1（成功发现/交互）；
+ *   - 连续验签成功 ≥ consecutiveVerifiedToT2 → T2（验签身份连续有效）；
+ *   - 对端在 establishedRelationships（部署配置）→ T3；
+ *   - signature_failure / replay 超阈值，或存在 third_party_adjudicated 争议
+ *     → 拒绝（rejected），level 置 T0（fail-closed，§4.6）；
+ *   - 未解决争议保守封顶：mutually_acknowledged → 封顶 T1；local_asserted → 封顶 T2。
+ *
+ * 维度分离（§27/§28）：trust level 只控制协议/自动化风险。dispute 是 reputation
+ * 维度 —— 评估器只对已知事实做保守封顶/拒绝，不把本地单方标记伪装成全球事实，
+ * 也不让 reputation 直接写进协议 level。reputation 以 ReputationSignal 透传，
+ * 无数据时 Ranker 侧拿到显式 unknown（绝不 0.5）。
+ */
+import { trustLevelRank } from "../identity/trust-policy.js";
+export const DEFAULT_TRUST_EVALUATOR_CONFIG = {
+    successToT1: 1,
+    consecutiveVerifiedToT2: 3,
+    signatureFailureRejectThreshold: 3,
+    replayRejectThreshold: 2,
+};
+/** 无 reputation 数据的默认来源：恒返回显式 unknown（§27：绝不 0.5）。 */
+export const NO_REPUTATION = {
+    score: () => ({ status: "unknown" }),
+};
+/** 把 record 转成 evaluatePolicy 的 record 输入（WP1 集成，见 trust-policy.ts）。 */
+export function recordPolicyInput(record) {
+    return { trustLevel: record.trust_level, rejected: record.rejected };
+}
+function hasDispute(record, classification) {
+    return record.local_asserted_disputes.some((d) => d.classification === classification);
+}
+function hasUnresolvedDispute(record, classification) {
+    return record.local_asserted_disputes.some((d) => d.classification === classification && d.resolved !== true);
+}
+/**
+ * 从事实推导 trust_level 建议值（纯函数，无模型参与）。输入是 record 的事实面，
+ * 结论字段（trust_level / rejected / evaluated_at）不参与推导。
+ */
+export function evaluateTrustRecord(record, options = {}) {
+    const cfg = options.config ?? DEFAULT_TRUST_EVALUATOR_CONFIG;
+    const reputation = options.reputation?.score(record.counterparty_identity) ??
+        NO_REPUTATION.score(record.counterparty_identity);
+    // 1. 拒绝门（硬阈值，先于升级判定，fail-closed）。
+    if (record.signature_failure_count >= cfg.signatureFailureRejectThreshold) {
+        return {
+            level: "T0",
+            rejected: true,
+            reason: `signature_failure_count ${record.signature_failure_count} >= ${cfg.signatureFailureRejectThreshold}`,
+            applied: ["rejected_signature_failures"],
+            reputation,
+        };
+    }
+    if (record.replay_detected_count >= cfg.replayRejectThreshold) {
+        return {
+            level: "T0",
+            rejected: true,
+            reason: `replay_detected_count ${record.replay_detected_count} >= ${cfg.replayRejectThreshold}`,
+            applied: ["rejected_replay"],
+            reputation,
+        };
+    }
+    if (hasDispute(record, "third_party_adjudicated")) {
+        return {
+            level: "T0",
+            rejected: true,
+            reason: "third_party_adjudicated dispute on record (adjudicated against counterparty)",
+            applied: ["rejected_adjudicated_dispute"],
+            reputation,
+        };
+    }
+    // 2. 升级路径（一次性取最高）。
+    let level;
+    const applied = [];
+    if (options.establishedRelationships?.has(record.counterparty_identity)) {
+        level = "T3";
+        applied.push("established_relationship_t3");
+    }
+    else if (record.consecutive_verified_exchanges >= cfg.consecutiveVerifiedToT2) {
+        level = "T2";
+        applied.push("signature_continuity_t2");
+    }
+    else if (record.successful_exchanges >= cfg.successToT1) {
+        level = "T1";
+        applied.push("successful_exchange_t1");
+    }
+    else {
+        level = "T0";
+        applied.push("initial_t0");
+    }
+    // 3. 未解决争议保守封顶（只降不升）。
+    if (hasUnresolvedDispute(record, "mutually_acknowledged") &&
+        trustLevelRank(level) > trustLevelRank("T1")) {
+        level = "T1";
+        applied.push("capped_mutual_dispute");
+    }
+    if (hasUnresolvedDispute(record, "local_asserted") &&
+        trustLevelRank(level) > trustLevelRank("T2")) {
+        level = "T2";
+        applied.push("capped_local_dispute");
+    }
+    return { level, rejected: false, applied, reputation };
+}
+//# sourceMappingURL=evaluator.js.map

package/dist/trust/records/evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.js","sourceRoot":"","sources":["../../../src/trust/records/evaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,cAAc,EAAmB,MAAM,6BAA6B,CAAC;AAoB9E,MAAM,CAAC,MAAM,8BAA8B,GAAyB;IAClE,WAAW,EAAE,CAAC;IACd,uBAAuB,EAAE,CAAC;IAC1B,+BAA+B,EAAE,CAAC;IAClC,qBAAqB,EAAE,CAAC;CACzB,CAAC;AAiCF,sDAAsD;AACtD,MAAM,CAAC,MAAM,aAAa,GAAqB;IAC7C,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;CACrC,CAAC;AAEF,wEAAwE;AACxE,MAAM,UAAU,iBAAiB,CAAC,MAA+B;IAI/D,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,UAAU,CAAC,MAAwB,EAAE,cAAqC;IACjF,OAAO,MAAM,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,cAAc,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAwB,EACxB,cAAqC;IAErC,OAAO,MAAM,CAAC,uBAAuB,CAAC,IAAI,CACxC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,cAAc,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,CAClE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAwB,EACxB,UAA2B,EAAE;IAE7B,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,8BAA8B,CAAC;IAC7D,MAAM,UAAU,GACd,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC;QACvD,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAEpD,kCAAkC;IAClC,IAAI,MAAM,CAAC,uBAAuB,IAAI,GAAG,CAAC,+BAA+B,EAAE,CAAC;QAC1E,OAAO;YACL,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,2BAA2B,MAAM,CAAC,uBAAuB,OAAO,GAAG,CAAC,+BAA+B,EAAE;YAC7G,OAAO,EAAE,CAAC,6BAA6B,CAAC;YACxC,UAAU;SACX,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,qBAAqB,IAAI,GAAG,CAAC,qBAAqB,EAAE,CAAC;QAC9D,OAAO;YACL,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,yBAAyB,MAAM,CAAC,qBAAqB,OAAO,GAAG,CAAC,qBAAqB,EAAE;YAC/F,OAAO,EAAE,CAAC,iBAAiB,CAAC;YAC5B,UAAU;SACX,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,EAAE,yBAAyB,CAAC,EAAE,CAAC;QAClD,OAAO;YACL,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,8EAA8E;YACtF,OAAO,EAAE,CAAC,8BAA8B,CAAC;YACzC,UAAU;SACX,CAAC;IACJ,CAAC;IAED,mBAAmB;IACnB,IAAI,KAAiB,CAAC;IACtB,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,IAAI,OAAO,CAAC,wBAAwB,EAAE,GAAG,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACxE,KAAK,GAAG,IAAI,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC9C,CAAC;SAAM,IAAI,MAAM,CAAC,8BAA8B,IAAI,GAAG,CAAC,uBAAuB,EAAE,CAAC;QAChF,KAAK,GAAG,IAAI,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC1C,CAAC;SAAM,IAAI,MAAM,CAAC,oBAAoB,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QAC1D,KAAK,GAAG,IAAI,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACzC,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,IAAI,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7B,CAAC;IAED,sBAAsB;IACtB,IACE,oBAAoB,CAAC,MAAM,EAAE,uBAAuB,CAAC;QACrD,cAAc,CAAC,KAAK,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,EAC5C,CAAC;QACD,KAAK,GAAG,IAAI,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACxC,CAAC;IACD,IACE,oBAAoB,CAAC,MAAM,EAAE,gBAAgB,CAAC;QAC9C,cAAc,CAAC,KAAK,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,EAC5C,CAAC;QACD,KAAK,GAAG,IAAI,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACzD,CAAC"}

package/dist/trust/records/index.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * trust/records — WP1 CounterpartyTrustRecord（对端信任记录）。
+ *
+ * 观察是事实，评估是结论，两者分离：TrustRecordStore.observe 只聚合事实；
+ * 评估器从事实推导 trust_level 建议值（T0-T3）。TrustPolicy 可选用 record 作为
+ * 输入（trust-policy.ts 的 PolicyEvaluationInput.record）。
+ */
+export { TrustRecordStore } from "./store.js";
+export type { EvaluateResult, ObservationResult, TrustRecordStoreOptions } from "./store.js";
+export { DEFAULT_TRUST_EVALUATOR_CONFIG, evaluateTrustRecord, NO_REPUTATION, recordPolicyInput, } from "./evaluator.js";
+export type { EvaluateOptions, EvaluationResult, EvaluationRule, TrustEvaluatorConfig, } from "./evaluator.js";
+export { computeAgentCardFingerprint, DISPUTE_CLASSIFICATIONS, TRUST_RECORD_SCHEMA_VERSION, } from "./types.js";
+export type { AgentCardIdentityMaterial, CounterpartyTrustRecord, DisputeClassification, DisputeRecord, ObservationKind, ReputationSignal, ReputationSource, TrustObservation, TrustRecordFacts, } from "./types.js";

package/dist/trust/records/index.js

@@ -0,0 +1,26 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * trust/records — WP1 CounterpartyTrustRecord（对端信任记录）。
+ *
+ * 观察是事实，评估是结论，两者分离：TrustRecordStore.observe 只聚合事实；
+ * 评估器从事实推导 trust_level 建议值（T0-T3）。TrustPolicy 可选用 record 作为
+ * 输入（trust-policy.ts 的 PolicyEvaluationInput.record）。
+ */
+export { TrustRecordStore } from "./store.js";
+export { DEFAULT_TRUST_EVALUATOR_CONFIG, evaluateTrustRecord, NO_REPUTATION, recordPolicyInput, } from "./evaluator.js";
+export { computeAgentCardFingerprint, DISPUTE_CLASSIFICATIONS, TRUST_RECORD_SCHEMA_VERSION, } from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/trust/records/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/trust/records/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAG9C,OAAO,EACL,8BAA8B,EAC9B,mBAAmB,EACnB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAQxB,OAAO,EACL,2BAA2B,EAC3B,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,YAAY,CAAC"}

package/dist/trust/records/store.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { EvaluationResult, EvaluateOptions } from "./evaluator.js";
+import type { CounterpartyTrustRecord, TrustObservation } from "./types.js";
+export interface TrustRecordStoreOptions {
+    /** 基础数据目录；记录落在 `<dir>/trust/`。 */
+    dir: string;
+    /** 可注入时钟（RFC 3339）；缺省用 new Date().toISOString()。 */
+    now?: () => string;
+    /** 评估器配置（阈值 / establishedRelationships / reputation 来源）。 */
+    evaluator?: EvaluateOptions;
+}
+export interface ObservationResult {
+    /** 更新后的完整 record（含新推导的结论）。 */
+    record: CounterpartyTrustRecord;
+    /** 本次评估结论。 */
+    evaluation: EvaluationResult;
+    /** Agent Card 指纹是否变化（告警信号；持久化于 fingerprint_changes）。 */
+    fingerprintChanged: boolean;
+    previousFingerprint?: string;
+    currentFingerprint?: string;
+}
+export interface EvaluateResult {
+    record: CounterpartyTrustRecord;
+    evaluation: EvaluationResult;
+}
+export declare class TrustRecordStore {
+    private readonly baseDir;
+    private readonly trustDir;
+    private readonly now;
+    private readonly evaluator;
+    constructor(options: TrustRecordStoreOptions);
+    private ensureTrustDir;
+    /** 对端身份 → 安全文件名：`trust-<sha256(identity)>.json`（身份在文件内自描述）。 */
+    private filePathFor;
+    /** 原子写（对齐 supervisor/manifest.ts：同目录临时文件 + fsync + rename，0600）。 */
+    private writeFileAtomic;
+    /**
+     * 读取并校验记录；缺失或形状非法返回 null。损坏记录视同未知（对端回到 T0）：
+     * fail-closed —— 宁可信得少，不可把结论建立在被破坏的记录上。
+     */
+    private readRecord;
+    private parseRecord;
+    /** 读取记录；未知/损坏返回 null。 */
+    get(identity: string): CounterpartyTrustRecord | null;
+    /** 是否存在记录。 */
+    has(identity: string): boolean;
+    /** 所有已落账的对端身份。 */
+    list(): string[];
+    /** 删除记录；不存在返回 false。 */
+    remove(identity: string): boolean;
+    /**
+     * 追加一条事实观察并落盘。只改事实面；结论由评估器重新推导（评估得出而非自填）。
+     * 指纹与已存不同 → 返回 fingerprintChanged 告警，并持久化计数。
+     */
+    observe(input: TrustObservation): ObservationResult;
+    /**
+     * 对已落盘记录重新推导结论并落盘（如部署配置 establishedRelationships 变化后
+     * 重新评估）。只改结论，不改事实。无记录返回 null。
+     */
+    evaluate(identity: string): EvaluateResult | null;
+}

package/dist/trust/records/store.js

@@ -0,0 +1,339 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * trust/records — TrustRecordStore：CounterpartyTrustRecord 持久化 + 观察聚合
+ * （基线 §27 / §28 / WP1）。
+ *
+ * 观察是事实，评估是结论，两者分离：
+ *   - observe(observation)：append 一条事实观察，只改事实面；trust_level /
+ *     rejected 由评估器重新推导，observe 本身无法直接写结论（TrustObservation
+ *     没有 level 字段）。
+ *   - evaluate(identity)：对已落盘记录按当前事实 + 部署配置重新推导并落盘结论。
+ *
+ * 持久化（对齐 idempotency/ledger 的原子写）：目录 0700、文件 0600；写采用
+ * 同目录临时文件（wx + fsync）+ rename，要么旧记录完整，要么新记录完整，永不撕裂。
+ * 读侧校验记录形状，损坏记录返回 null（→ 对端视为未知 T0，fail-closed）。
+ *
+ * Agent Card 指纹变更检测：observe 发现携带指纹与已存指纹不同时产生告警信号
+ * （fingerprintChanged），并持久化 fingerprint_changes 计数 —— 即使调用方错过
+ * 返回值，重启后 get() 也能发现身份锚发生过变更（不是静默接受）。
+ */
+import { chmodSync, closeSync, existsSync, fsyncSync, mkdirSync, openSync, readdirSync, readFileSync, renameSync, rmSync, writeSync, } from "node:fs";
+import path from "node:path";
+import { sha256Hex } from "../../negotiation/jcs.js";
+import { isTrustLevel } from "../identity/trust-policy.js";
+import { evaluateTrustRecord } from "./evaluator.js";
+import { DISPUTE_CLASSIFICATIONS, TRUST_RECORD_SCHEMA_VERSION } from "./types.js";
+let tmpSeq = 0;
+function isCount(v) {
+    return typeof v === "number" && Number.isInteger(v) && v >= 0;
+}
+function isStringMap(v) {
+    return (v !== null &&
+        typeof v === "object" &&
+        !Array.isArray(v) &&
+        Object.values(v).every((x) => typeof x === "string"));
+}
+function isDisputeRecord(v) {
+    if (v === null || typeof v !== "object" || Array.isArray(v))
+        return false;
+    const d = v;
+    return (typeof d.dispute_id === "string" &&
+        typeof d.occurred_at === "string" &&
+        typeof d.classification === "string" &&
+        DISPUTE_CLASSIFICATIONS.includes(d.classification));
+}
+function optionalString(v) {
+    return typeof v === "string" ? v : undefined;
+}
+function appendDispute(existing, input, observedAt) {
+    const classification = input.dispute?.classification ?? "local_asserted";
+    const reason = input.dispute?.reason;
+    const disputeId = input.dispute?.dispute_id ??
+        `dispute-${sha256Hex(`${input.counterparty_identity}|${classification}|${reason ?? ""}|${observedAt}`)}`;
+    const index = existing.findIndex((d) => d.dispute_id === disputeId);
+    if (index !== -1) {
+        // 同 id 观察：只做状态更新（如 resolved/reason），不重复追加。
+        const current = existing[index];
+        const next = [...existing];
+        next[index] = {
+            ...current,
+            ...(input.dispute?.resolved !== undefined ? { resolved: input.dispute.resolved } : {}),
+            ...(reason !== undefined ? { reason } : {}),
+        };
+        return next;
+    }
+    const entry = { dispute_id: disputeId, classification, occurred_at: observedAt };
+    if (reason !== undefined)
+        entry.reason = reason;
+    if (input.dispute?.resolved !== undefined)
+        entry.resolved = input.dispute.resolved;
+    return [...existing, entry];
+}
+export class TrustRecordStore {
+    baseDir;
+    trustDir;
+    now;
+    evaluator;
+    constructor(options) {
+        this.baseDir = options.dir;
+        this.trustDir = path.join(options.dir, "trust");
+        this.now = options.now ?? (() => new Date().toISOString());
+        this.evaluator = options.evaluator ?? {};
+    }
+    ensureTrustDir() {
+        mkdirSync(this.trustDir, { recursive: true, mode: 0o700 });
+        chmodSync(this.trustDir, 0o700);
+        return this.trustDir;
+    }
+    /** 对端身份 → 安全文件名：`trust-<sha256(identity)>.json`（身份在文件内自描述）。 */
+    filePathFor(identity) {
+        const dir = this.ensureTrustDir();
+        return path.resolve(dir, `trust-${sha256Hex(identity)}.json`);
+    }
+    /** 原子写（对齐 supervisor/manifest.ts：同目录临时文件 + fsync + rename，0600）。 */
+    writeFileAtomic(filePath, record) {
+        const tmp = `${filePath}.tmp-${process.pid}-${++tmpSeq}`;
+        const fd = openSync(tmp, "wx", 0o600);
+        try {
+            writeSync(fd, `${JSON.stringify(record, null, 2)}\n`);
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        renameSync(tmp, filePath);
+        chmodSync(filePath, 0o600);
+    }
+    /**
+     * 读取并校验记录；缺失或形状非法返回 null。损坏记录视同未知（对端回到 T0）：
+     * fail-closed —— 宁可信得少，不可把结论建立在被破坏的记录上。
+     */
+    readRecord(identity) {
+        const filePath = this.filePathFor(identity);
+        if (!existsSync(filePath))
+            return null;
+        return this.parseRecord(filePath);
+    }
+    parseRecord(filePath) {
+        let raw;
+        try {
+            raw = readFileSync(filePath, "utf-8");
+        }
+        catch {
+            return null;
+        }
+        let value;
+        try {
+            value = JSON.parse(raw);
+        }
+        catch {
+            return null;
+        }
+        if (value === null || typeof value !== "object" || Array.isArray(value))
+            return null;
+        const r = value;
+        if (typeof r.counterparty_identity !== "string" ||
+            r.counterparty_identity.length === 0 ||
+            typeof r.first_seen !== "string" ||
+            typeof r.last_seen !== "string" ||
+            typeof r.evaluated_at !== "string" ||
+            !isTrustLevel(r.trust_level) ||
+            !isCount(r.successful_exchanges) ||
+            !isCount(r.consecutive_verified_exchanges) ||
+            !isCount(r.invalid_schema_count) ||
+            !isCount(r.timeout_count) ||
+            !isCount(r.replay_detected_count) ||
+            !isCount(r.signature_failure_count) ||
+            !isCount(r.fingerprint_changes) ||
+            r.schema_version !== TRUST_RECORD_SCHEMA_VERSION ||
+            !Array.isArray(r.local_asserted_disputes) ||
+            !r.local_asserted_disputes.every(isDisputeRecord) ||
+            !isStringMap(r.capability_versions)) {
+            return null;
+        }
+        return {
+            counterparty_identity: r.counterparty_identity,
+            domain: optionalString(r.domain),
+            agent_card_fingerprint: optionalString(r.agent_card_fingerprint),
+            provider: optionalString(r.provider),
+            capability_versions: r.capability_versions,
+            first_seen: r.first_seen,
+            last_seen: r.last_seen,
+            last_fingerprint_change_at: optionalString(r.last_fingerprint_change_at),
+            successful_exchanges: r.successful_exchanges,
+            consecutive_verified_exchanges: r.consecutive_verified_exchanges,
+            invalid_schema_count: r.invalid_schema_count,
+            timeout_count: r.timeout_count,
+            replay_detected_count: r.replay_detected_count,
+            signature_failure_count: r.signature_failure_count,
+            local_asserted_disputes: r.local_asserted_disputes,
+            fingerprint_changes: r.fingerprint_changes,
+            schema_version: TRUST_RECORD_SCHEMA_VERSION,
+            trust_level: r.trust_level,
+            evaluated_at: r.evaluated_at,
+            rejected: typeof r.rejected === "boolean" ? r.rejected : false,
+            rejection_reason: optionalString(r.rejection_reason),
+        };
+    }
+    /** 读取记录；未知/损坏返回 null。 */
+    get(identity) {
+        return this.readRecord(identity);
+    }
+    /** 是否存在记录。 */
+    has(identity) {
+        return this.readRecord(identity) !== null;
+    }
+    /** 所有已落账的对端身份。 */
+    list() {
+        const dir = this.ensureTrustDir();
+        const out = [];
+        for (const name of readdirSync(dir)) {
+            if (!name.startsWith("trust-") || !name.endsWith(".json"))
+                continue;
+            const record = this.parseRecord(path.join(dir, name));
+            if (record !== null)
+                out.push(record.counterparty_identity);
+        }
+        return out;
+    }
+    /** 删除记录；不存在返回 false。 */
+    remove(identity) {
+        const filePath = this.filePathFor(identity);
+        if (!existsSync(filePath))
+            return false;
+        rmSync(filePath);
+        return true;
+    }
+    /**
+     * 追加一条事实观察并落盘。只改事实面；结论由评估器重新推导（评估得出而非自填）。
+     * 指纹与已存不同 → 返回 fingerprintChanged 告警，并持久化计数。
+     */
+    observe(input) {
+        const identity = input.counterparty_identity;
+        if (identity.length === 0) {
+            throw new TypeError("TrustRecordStore.observe: counterparty_identity must be non-empty");
+        }
+        const observedAt = input.observed_at ?? this.now();
+        const existing = this.readRecord(identity);
+        const record = existing ?? {
+            counterparty_identity: identity,
+            domain: undefined,
+            agent_card_fingerprint: undefined,
+            provider: undefined,
+            capability_versions: {},
+            first_seen: observedAt,
+            last_seen: observedAt,
+            successful_exchanges: 0,
+            consecutive_verified_exchanges: 0,
+            invalid_schema_count: 0,
+            timeout_count: 0,
+            replay_detected_count: 0,
+            signature_failure_count: 0,
+            local_asserted_disputes: [],
+            fingerprint_changes: 0,
+            schema_version: TRUST_RECORD_SCHEMA_VERSION,
+            trust_level: "T0",
+            evaluated_at: observedAt,
+            rejected: false,
+        };
+        if (Date.parse(observedAt) < Date.parse(record.first_seen))
+            record.first_seen = observedAt;
+        if (Date.parse(observedAt) > Date.parse(record.last_seen))
+            record.last_seen = observedAt;
+        if (input.domain !== undefined && record.domain === undefined)
+            record.domain = input.domain;
+        if (input.provider !== undefined && record.provider === undefined)
+            record.provider = input.provider;
+        // Agent Card 指纹变更检测（identity 锚；告警而非静默接受）。
+        let fingerprintChanged = false;
+        const previousFingerprint = record.agent_card_fingerprint;
+        if (input.agent_card_fingerprint !== undefined) {
+            if (record.agent_card_fingerprint === undefined) {
+                record.agent_card_fingerprint = input.agent_card_fingerprint;
+            }
+            else if (record.agent_card_fingerprint !== input.agent_card_fingerprint) {
+                fingerprintChanged = true;
+                record.fingerprint_changes += 1;
+                record.last_fingerprint_change_at = observedAt;
+                record.agent_card_fingerprint = input.agent_card_fingerprint;
+                // 身份锚变更：先前的验签连续性不再适用于新 identity 材料。
+                record.consecutive_verified_exchanges = 0;
+            }
+        }
+        switch (input.kind) {
+            case "exchange_success":
+                record.successful_exchanges += 1;
+                record.consecutive_verified_exchanges += 1;
+                if (input.capability_versions !== undefined) {
+                    record.capability_versions = {
+                        ...record.capability_versions,
+                        ...input.capability_versions,
+                    };
+                }
+                break;
+            case "schema_invalid":
+                record.invalid_schema_count += 1;
+                break;
+            case "timeout":
+                record.timeout_count += 1;
+                break;
+            case "replay_detected":
+                record.replay_detected_count += 1;
+                record.consecutive_verified_exchanges = 0;
+                break;
+            case "signature_failure":
+                record.signature_failure_count += 1;
+                record.consecutive_verified_exchanges = 0;
+                break;
+            case "dispute":
+                record.local_asserted_disputes = appendDispute(record.local_asserted_disputes, input, observedAt);
+                break;
+        }
+        // 结论只由评估器推导。
+        const evaluation = evaluateTrustRecord(record, this.evaluator);
+        record.trust_level = evaluation.level;
+        record.rejected = evaluation.rejected;
+        record.rejection_reason = evaluation.rejected ? evaluation.reason : undefined;
+        record.evaluated_at = observedAt;
+        this.writeFileAtomic(this.filePathFor(identity), record);
+        return {
+            record,
+            evaluation,
+            fingerprintChanged,
+            ...(fingerprintChanged
+                ? { previousFingerprint, currentFingerprint: record.agent_card_fingerprint }
+                : {}),
+        };
+    }
+    /**
+     * 对已落盘记录重新推导结论并落盘（如部署配置 establishedRelationships 变化后
+     * 重新评估）。只改结论，不改事实。无记录返回 null。
+     */
+    evaluate(identity) {
+        const record = this.readRecord(identity);
+        if (record === null)
+            return null;
+        const evaluation = evaluateTrustRecord(record, this.evaluator);
+        record.trust_level = evaluation.level;
+        record.rejected = evaluation.rejected;
+        record.rejection_reason = evaluation.rejected ? evaluation.reason : undefined;
+        record.evaluated_at = this.now();
+        this.writeFileAtomic(this.filePathFor(identity), record);
+        return { record, evaluation };
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/trust/records/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/trust/records/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACL,SAAS,EACT,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,UAAU,EACV,MAAM,EACN,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAiClF,IAAI,MAAM,GAAG,CAAC,CAAC;AAEf,SAAS,OAAO,CAAC,CAAU;IACzB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,WAAW,CAAC,CAAU;IAC7B,OAAO,CACL,CAAC,KAAK,IAAI;QACV,OAAO,CAAC,KAAK,QAAQ;QACrB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACjB,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CACrD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,CAAU;IACjC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,CACL,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAChC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QACjC,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ;QACnC,uBAA6C,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,CAAU;IAChC,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CACpB,QAAyB,EACzB,KAAuB,EACvB,UAAkB;IAElB,MAAM,cAAc,GAA0B,KAAK,CAAC,OAAO,EAAE,cAAc,IAAI,gBAAgB,CAAC;IAChG,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;IACrC,MAAM,SAAS,GACb,KAAK,CAAC,OAAO,EAAE,UAAU;QACzB,WAAW,SAAS,CAAC,GAAG,KAAK,CAAC,qBAAqB,IAAI,cAAc,IAAI,MAAM,IAAI,EAAE,IAAI,UAAU,EAAE,CAAC,EAAE,CAAC;IAC3G,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC;IACpE,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,2CAA2C;QAC3C,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAE,CAAC;QACjC,MAAM,IAAI,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,GAAG;YACZ,GAAG,OAAO;YACV,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAkB,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;IAChG,IAAI,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;IAChD,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS;QAAE,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;IACnF,OAAO,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,OAAO,gBAAgB;IACV,OAAO,CAAS;IAChB,QAAQ,CAAS;IACjB,GAAG,CAAe;IAClB,SAAS,CAAkB;IAE5C,YAAY,OAAgC;QAC1C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IAC3C,CAAC;IAEO,cAAc;QACpB,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,+DAA+D;IACvD,WAAW,CAAC,QAAgB;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChE,CAAC;IAED,oEAAoE;IAC5D,eAAe,CAAC,QAAgB,EAAE,MAA+B;QACvE,MAAM,GAAG,GAAG,GAAG,QAAQ,QAAQ,OAAO,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC;QACzD,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,SAAS,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACtD,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;QACD,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC1B,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACK,UAAU,CAAC,QAAgB;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAEO,WAAW,CAAC,QAAgB;QAClC,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrF,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,IACE,OAAO,CAAC,CAAC,qBAAqB,KAAK,QAAQ;YAC3C,CAAC,CAAC,qBAAqB,CAAC,MAAM,KAAK,CAAC;YACpC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;YAChC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;YAC/B,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;YAClC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;YAC5B,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC;YAChC,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC;YAC1C,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC;YAChC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;YACzB,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC;YACjC,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;YACnC,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC;YAC/B,CAAC,CAAC,cAAc,KAAK,2BAA2B;YAChD,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;YACzC,CAAC,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,eAAe,CAAC;YACjD,CAAC,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,EACnC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,qBAAqB,EAAE,CAAC,CAAC,qBAAqB;YAC9C,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC;YAChC,sBAAsB,EAAE,cAAc,CAAC,CAAC,CAAC,sBAAsB,CAAC;YAChE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC;YACpC,mBAAmB,EAAE,CAAC,CAAC,mBAA6C;YACpE,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,0BAA0B,EAAE,cAAc,CAAC,CAAC,CAAC,0BAA0B,CAAC;YACxE,oBAAoB,EAAE,CAAC,CAAC,oBAAoB;YAC5C,8BAA8B,EAAE,CAAC,CAAC,8BAA8B;YAChE,oBAAoB,EAAE,CAAC,CAAC,oBAAoB;YAC5C,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,qBAAqB,EAAE,CAAC,CAAC,qBAAqB;YAC9C,uBAAuB,EAAE,CAAC,CAAC,uBAAuB;YAClD,uBAAuB,EAAE,CAAC,CAAC,uBAA0C;YACrE,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;YAC1C,cAAc,EAAE,2BAA2B;YAC3C,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;YAC9D,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,gBAAgB,CAAC;SACrD,CAAC;IACJ,CAAC;IAED,yBAAyB;IACzB,GAAG,CAAC,QAAgB;QAClB,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,cAAc;IACd,GAAG,CAAC,QAAgB;QAClB,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;IAC5C,CAAC;IAED,kBAAkB;IAClB,IAAI;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAClC,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,SAAS;YACpE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YACtD,IAAI,MAAM,KAAK,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,wBAAwB;IACxB,MAAM,CAAC,QAAgB;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,KAAuB;QAC7B,MAAM,QAAQ,GAAG,KAAK,CAAC,qBAAqB,CAAC;QAC7C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,SAAS,CAAC,mEAAmE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE3C,MAAM,MAAM,GAA4B,QAAQ,IAAI;YAClD,qBAAqB,EAAE,QAAQ;YAC/B,MAAM,EAAE,SAAS;YACjB,sBAAsB,EAAE,SAAS;YACjC,QAAQ,EAAE,SAAS;YACnB,mBAAmB,EAAE,EAAE;YACvB,UAAU,EAAE,UAAU;YACtB,SAAS,EAAE,UAAU;YACrB,oBAAoB,EAAE,CAAC;YACvB,8BAA8B,EAAE,CAAC;YACjC,oBAAoB,EAAE,CAAC;YACvB,aAAa,EAAE,CAAC;YAChB,qBAAqB,EAAE,CAAC;YACxB,uBAAuB,EAAE,CAAC;YAC1B,uBAAuB,EAAE,EAAE;YAC3B,mBAAmB,EAAE,CAAC;YACtB,cAAc,EAAE,2BAA2B;YAC3C,WAAW,EAAE,IAAI;YACjB,YAAY,EAAE,UAAU;YACxB,QAAQ,EAAE,KAAK;SAChB,CAAC;QAEF,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC;YAAE,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;QAC3F,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC;YAAE,MAAM,CAAC,SAAS,GAAG,UAAU,CAAC;QACzF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC5F,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;YAC/D,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAEnC,0CAA0C;QAC1C,IAAI,kBAAkB,GAAG,KAAK,CAAC;QAC/B,MAAM,mBAAmB,GAAG,MAAM,CAAC,sBAAsB,CAAC;QAC1D,IAAI,KAAK,CAAC,sBAAsB,KAAK,SAAS,EAAE,CAAC;YAC/C,IAAI,MAAM,CAAC,sBAAsB,KAAK,SAAS,EAAE,CAAC;gBAChD,MAAM,CAAC,sBAAsB,GAAG,KAAK,CAAC,sBAAsB,CAAC;YAC/D,CAAC;iBAAM,IAAI,MAAM,CAAC,sBAAsB,KAAK,KAAK,CAAC,sBAAsB,EAAE,CAAC;gBAC1E,kBAAkB,GAAG,IAAI,CAAC;gBAC1B,MAAM,CAAC,mBAAmB,IAAI,CAAC,CAAC;gBAChC,MAAM,CAAC,0BAA0B,GAAG,UAAU,CAAC;gBAC/C,MAAM,CAAC,sBAAsB,GAAG,KAAK,CAAC,sBAAsB,CAAC;gBAC7D,oCAAoC;gBACpC,MAAM,CAAC,8BAA8B,GAAG,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,kBAAkB;gBACrB,MAAM,CAAC,oBAAoB,IAAI,CAAC,CAAC;gBACjC,MAAM,CAAC,8BAA8B,IAAI,CAAC,CAAC;gBAC3C,IAAI,KAAK,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;oBAC5C,MAAM,CAAC,mBAAmB,GAAG;wBAC3B,GAAG,MAAM,CAAC,mBAAmB;wBAC7B,GAAG,KAAK,CAAC,mBAAmB;qBAC7B,CAAC;gBACJ,CAAC;gBACD,MAAM;YACR,KAAK,gBAAgB;gBACnB,MAAM,CAAC,oBAAoB,IAAI,CAAC,CAAC;gBACjC,MAAM;YACR,KAAK,SAAS;gBACZ,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;gBAC1B,MAAM;YACR,KAAK,iBAAiB;gBACpB,MAAM,CAAC,qBAAqB,IAAI,CAAC,CAAC;gBAClC,MAAM,CAAC,8BAA8B,GAAG,CAAC,CAAC;gBAC1C,MAAM;YACR,KAAK,mBAAmB;gBACtB,MAAM,CAAC,uBAAuB,IAAI,CAAC,CAAC;gBACpC,MAAM,CAAC,8BAA8B,GAAG,CAAC,CAAC;gBAC1C,MAAM;YACR,KAAK,SAAS;gBACZ,MAAM,CAAC,uBAAuB,GAAG,aAAa,CAC5C,MAAM,CAAC,uBAAuB,EAC9B,KAAK,EACL,UAAU,CACX,CAAC;gBACF,MAAM;QACV,CAAC;QAED,aAAa;QACb,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,CAAC,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC;QACtC,MAAM,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACtC,MAAM,CAAC,gBAAgB,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,MAAM,CAAC,YAAY,GAAG,UAAU,CAAC;QAEjC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;QACzD,OAAO;YACL,MAAM;YACN,UAAU;YACV,kBAAkB;YAClB,GAAG,CAAC,kBAAkB;gBACpB,CAAC,CAAC,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,CAAC,sBAAsB,EAAE;gBAC5E,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,QAAgB;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,CAAC,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC;QACtC,MAAM,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACtC,MAAM,CAAC,gBAAgB,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACjC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;QACzD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAChC,CAAC;CACF"}