@izagood/avcs 0.13.0 → 0.14.0

package/dist/hub/transportAuth.js

@@ -0,0 +1,127 @@
+// Transport-layer authentication for hub requests (SSH-style public-key auth over HTTP).
+//
+// Unlike `authorizePush` in hubServer.ts — which authenticates individual GOVERNANCE
+// OBJECTS (an operation/decision carries an ed25519 signature over its own oid) — this
+// authenticates the REQUEST/CONNECTION, the way `git clone git@host` proves possession
+// of a key before the server speaks. The model mirrors SSH exactly:
+//
+//   ~/.ssh/id_ed25519        →  the local actor's private key (.avcs/private/<id>.json)
+//   authorized_keys          →  the hub's `member:<keyId>` ref → Membership.publicKey
+//   challenge-response nonce →  a per-request signature over the request itself
+//
+// No secret is transmitted: the client signs a canonical description of the request with
+// its private key, the server verifies against the registered public key. Replay is
+// bounded by a freshness window on the timestamp plus a seen-nonce cache. The two layers
+// are orthogonal and share one keypair: transport auth answers "are you a registered
+// member at all" (failure → 401); object-level `authorizePush` answers "is THIS object
+// validly signed by a sufficiently-privileged role" (failure → 403).
+import { randomBytes } from "node:crypto";
+import { sha256hex } from "../core/canonical.js";
+import { signMessage, verifyMessage } from "../core/identity.js";
+/** Authorization scheme token. `Authorization: AVCS-Sig keyId="...", ts="...", ...`. */
+export const AUTH_SCHEME = "AVCS-Sig";
+/** Default freshness window for a request signature (ms). A request whose `ts` is more
+ *  than this far from the server clock (either direction) is rejected as stale/replayed. */
+export const DEFAULT_AUTH_WINDOW_MS = 300_000; // 5 minutes
+/**
+ * The exact byte string both sides sign/verify. Binds the signature to the method, the
+ * request target, a timestamp (freshness) and a nonce (replay), plus a hash of the body
+ * so a captured signature cannot be replayed against different content.
+ */
+export function canonicalRequest(method, path, ts, nonce, body) {
+    return `${method.toUpperCase()}\n${path}\n${ts}\n${nonce}\n${sha256hex(body)}`;
+}
+/** Build an `Authorization: AVCS-Sig …` header value, signing the request with the local
+ *  actor's private key. `body` is the exact request body the client will send (""for none). */
+export function buildAuthHeader(args) {
+    const ts = args.ts ?? new Date().toISOString();
+    const nonce = args.nonce ?? randomBytes(12).toString("base64url");
+    const sig = signMessage(args.privateKey, canonicalRequest(args.method, args.path, ts, nonce, args.body ?? ""));
+    return `${AUTH_SCHEME} keyId="${args.keyId}", ts="${ts}", nonce="${nonce}", sig="${sig}"`;
+}
+/** Parse an AVCS-Sig Authorization header. Returns null on any scheme/field mismatch. */
+export function parseAuthHeader(header) {
+    if (!header)
+        return null;
+    const trimmed = header.trim();
+    if (!trimmed.startsWith(`${AUTH_SCHEME} `))
+        return null;
+    const rest = trimmed.slice(AUTH_SCHEME.length + 1);
+    const fields = {};
+    // key="value" pairs, comma-separated. Values may contain base64url (no quotes/commas).
+    const re = /(\w+)="([^"]*)"/g;
+    let m;
+    while ((m = re.exec(rest)) !== null)
+        fields[m[1]] = m[2];
+    const { keyId, ts, nonce, sig } = fields;
+    if (!keyId || !ts || !nonce || !sig)
+        return null;
+    return { keyId, ts, nonce, sig };
+}
+/**
+ * A bounded seen-nonce cache for replay protection. Entries expire after `ttlMs` (the
+ * freshness window — a nonce can only be replayed within it anyway) and the map is
+ * capped so a hostile client cannot grow it without bound.
+ */
+export class NonceCache {
+    #seen = new Map(); // nonce → expiry epoch ms
+    #ttlMs;
+    #max;
+    constructor(ttlMs = DEFAULT_AUTH_WINDOW_MS, max = 100_000) {
+        this.#ttlMs = ttlMs;
+        this.#max = max;
+    }
+    /** Record a nonce; returns false if it was already seen (a replay). */
+    check(nonce, now) {
+        this.#evict(now);
+        if (this.#seen.has(nonce))
+            return false;
+        if (this.#seen.size >= this.#max) {
+            // Hard cap reached even after eviction: drop the oldest insertion to stay bounded.
+            const oldest = this.#seen.keys().next().value;
+            if (oldest !== undefined)
+                this.#seen.delete(oldest);
+        }
+        this.#seen.set(nonce, now + this.#ttlMs);
+        return true;
+    }
+    #evict(now) {
+        for (const [n, exp] of this.#seen) {
+            if (exp <= now)
+                this.#seen.delete(n);
+            else
+                break; // Map preserves insertion order; later entries expire no earlier... see note
+        }
+    }
+}
+/**
+ * Verify a request's AVCS-Sig credential. Steps, in order:
+ *  1. parse the header,
+ *  2. reject a stale/future timestamp (outside the freshness window),
+ *  3. reject a replayed nonce,
+ *  4. resolve the keyId to a public key (unknown key → unauthenticated),
+ *  5. verify the signature over the canonical request.
+ * Any failure returns `{ ok: false, reason }` for a 401 body. Success returns the keyId.
+ */
+export async function verifyAuth(args) {
+    const cred = parseAuthHeader(args.header);
+    if (!cred)
+        return { ok: false, reason: "missing or malformed AVCS-Sig Authorization header" };
+    const window = args.windowMs ?? DEFAULT_AUTH_WINDOW_MS;
+    const tsMs = Date.parse(cred.ts);
+    if (!Number.isFinite(tsMs))
+        return { ok: false, reason: "invalid timestamp" };
+    if (Math.abs(args.now - tsMs) > window)
+        return { ok: false, reason: "request timestamp outside freshness window" };
+    if (args.nonceCache && !args.nonceCache.check(cred.nonce, args.now)) {
+        return { ok: false, reason: "nonce already used (replay)" };
+    }
+    const publicKey = await args.resolvePublicKey(cred.keyId);
+    if (!publicKey)
+        return { ok: false, reason: `unknown signing key ${cred.keyId}` };
+    const msg = canonicalRequest(args.method, args.path, cred.ts, cred.nonce, args.body);
+    if (!verifyMessage(publicKey, msg, cred.sig))
+        return { ok: false, reason: "request signature does not verify" };
+    return { ok: true, keyId: cred.keyId };
+}
+//# sourceMappingURL=transportAuth.js.map

package/dist/hub/transportAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transportAuth.js","sourceRoot":"","sources":["../../src/hub/transportAuth.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,EAAE;AACF,qFAAqF;AACrF,uFAAuF;AACvF,uFAAuF;AACvF,oEAAoE;AACpE,EAAE;AACF,wFAAwF;AACxF,sFAAsF;AACtF,gFAAgF;AAChF,EAAE;AACF,yFAAyF;AACzF,oFAAoF;AACpF,yFAAyF;AACzF,qFAAqF;AACrF,uFAAuF;AACvF,qEAAqE;AAErE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEjE,wFAAwF;AACxF,MAAM,CAAC,MAAM,WAAW,GAAG,UAAU,CAAC;AAEtC;4FAC4F;AAC5F,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC,CAAC,YAAY;AAU3D;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,IAAY,EAAE,EAAU,EAAE,KAAa,EAAE,IAAY;IACpG,OAAO,GAAG,MAAM,CAAC,WAAW,EAAE,KAAK,IAAI,KAAK,EAAE,KAAK,KAAK,KAAK,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;AACjF,CAAC;AAED;+FAC+F;AAC/F,MAAM,UAAU,eAAe,CAAC,IAQ/B;IACC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/G,OAAO,GAAG,WAAW,WAAW,IAAI,CAAC,KAAK,UAAU,EAAE,aAAa,KAAK,WAAW,GAAG,GAAG,CAAC;AAC5F,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,eAAe,CAAC,MAAiC;IAC/D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,uFAAuF;IACvF,MAAM,EAAE,GAAG,kBAAkB,CAAC;IAC9B,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IAC3D,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IACzC,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,UAAU;IACrB,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,0BAA0B;IAC7D,MAAM,CAAS;IACf,IAAI,CAAS;IAEb,YAAY,QAAgB,sBAAsB,EAAE,GAAG,GAAG,OAAO;QAC/D,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,KAAa,EAAE,GAAW;QAC9B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACjC,mFAAmF;YACnF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC9C,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAClC,IAAI,GAAG,IAAI,GAAG;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;;gBAChC,MAAM,CAAC,6EAA6E;QAC3F,CAAC;IACH,CAAC;CACF;AASD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAShC;IACC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oDAAoD,EAAE,CAAC;IAE9F,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,IAAI,sBAAsB,CAAC;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC9E,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;IAEnH,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;IAElF,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACrF,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IAEhH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;AACzC,CAAC"}

package/dist/index.d.ts

@@ -8,6 +8,9 @@ export type { FsckReport } from "./store/objectStore.ts";
 export { startHub, HUB_PROTOCOL_VERSION } from "./hub/hubServer.ts";
 export type { HubHandle } from "./hub/hubServer.ts";
 export { pushToHub, pullFromHub, finalizeOnHub } from "./hub/hubClient.ts";
+export type { HubSigner } from "./hub/hubClient.ts";
+export { buildAuthHeader, parseAuthHeader, verifyAuth, canonicalRequest, NonceCache, AUTH_SCHEME, DEFAULT_AUTH_WINDOW_MS } from "./hub/transportAuth.ts";
+export type { AuthCredential, AuthResult, PublicKeyResolver } from "./hub/transportAuth.ts";
 export { Keyring, generateKeypair, signMessage, verifyMessage } from "./core/identity.ts";
 export type { Keypair, KeyRecord, Signature } from "./core/identity.ts";
 export { Logger, consoleLogger, silentLogger } from "./observe/logger.ts";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAOrC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAG1E,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC7H,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAKjH,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAGtF,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACzE,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGzD,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACpE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAG3E,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC1F,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAGxE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC1E,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,YAAY,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAOrC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAG1E,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC7H,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAKjH,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAGtF,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACzE,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGzD,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACpE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC3E,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAGpD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACzJ,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAG5F,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC1F,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAGxE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC1E,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,YAAY,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -23,6 +23,9 @@ export { ObjectStore, CorruptObjectError } from "./store/objectStore.js";
 // Hub (server + client) — the replication / trust boundary avcshub productionizes
 export { startHub, HUB_PROTOCOL_VERSION } from "./hub/hubServer.js";
 export { pushToHub, pullFromHub, finalizeOnHub } from "./hub/hubClient.js";
+// SSH-style transport auth: embedders (e.g. a hosted hub) inject `resolvePublicKey` into
+// startHub({ auth }); these helpers also let a client build/verify the credential directly.
+export { buildAuthHeader, parseAuthHeader, verifyAuth, canonicalRequest, NonceCache, AUTH_SCHEME, DEFAULT_AUTH_WINDOW_MS } from "./hub/transportAuth.js";
 // Cryptographic actor identity (the app-layer authz backbone)
 export { Keyring, generateKeypair, signMessage, verifyMessage } from "./core/identity.js";
 // Observability seams (avcshub wires these to OTel / a real collector)

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,EAAE;AACF,mFAAmF;AACnF,yFAAyF;AACzF,wFAAwF;AACxF,iFAAiF;AAEjF,+BAA+B;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,mFAAmF;AACnF,uFAAuF;AACvF,sFAAsF;AACtF,wFAAwF;AACxF,6EAA6E;AAC7E,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAE1E,uEAAuE;AACvE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAG7H,iFAAiF;AACjF,qFAAqF;AACrF,yDAAyD;AACzD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEtF,6BAA6B;AAC7B,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGzE,kFAAkF;AAClF,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAEpE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAE3E,8DAA8D;AAC9D,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAG1F,uEAAuE;AACvE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE1E,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,EAAE;AACF,mFAAmF;AACnF,yFAAyF;AACzF,wFAAwF;AACxF,iFAAiF;AAEjF,+BAA+B;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,mFAAmF;AACnF,uFAAuF;AACvF,sFAAsF;AACtF,wFAAwF;AACxF,6EAA6E;AAC7E,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAE1E,uEAAuE;AACvE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAG7H,iFAAiF;AACjF,qFAAqF;AACrF,yDAAyD;AACzD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEtF,6BAA6B;AAC7B,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGzE,kFAAkF;AAClF,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAEpE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAE3E,yFAAyF;AACzF,4FAA4F;AAC5F,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAGzJ,8DAA8D;AAC9D,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAG1F,uEAAuE;AACvE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE1E,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@izagood/avcs",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "type": "module",
   "description": "Agentic Version Control System — an AI-native VCS where intent, session, operation, evidence and decision are first-class objects and code is a materialized projection of an operation graph.",
   "license": "Apache-2.0",