@kya-os/mcp-i-cloudflare 1.12.4 → 1.13.0

package/dist/audit/deployment-binding.js

@@ -0,0 +1,364 @@
+import { CryptoProviderAuditHasher, WebCryptoEvidenceEncryptor, } from "@kya-os/mcp/audit";
+import { createHmacRuntimeAuditContextFactory, } from "@kya-os/mcp-i-runtime";
+import { z } from "zod";
+import { WebCryptoProvider } from "../providers/crypto";
+import { CloudflareAuditProducerBinding, createCloudflareAuditTrail, } from "./durable-producer";
+export const KYA_OS_AUDIT_DISCOVERY_PATH = "/.well-known/kya-os-audit";
+export const KYA_OS_AUDIT_CANARY_PATH = "/_kya/audit/canary";
+const DEPLOYMENT_BINDING_SCHEMA = "https://schema.kya-os.org/v1/protocol/audit/deployment-binding/v1.0.0";
+const PROBE_FORMAT = "org.kya-os.audit.runtime-capabilities.v1";
+const CANARY_EVENT_TYPE = "configuration.changed";
+const auditProfileSchema = z.enum(["AAP-0", "AAP-1", "AAP-2", "AAP-3", "AAP-4"]);
+const deliverySchema = z.enum(["best-effort", "buffered", "required"]);
+const digestSchema = z.string().regex(/^sha256:[0-9a-f]{64}$/);
+const evidenceRefSchema = z.object({
+    objectId: z.string().min(1),
+    ciphertextDigest: digestSchema,
+    plaintextCommitment: digestSchema.optional(),
+    mediaType: z.string().min(1),
+    size: z.string().regex(/^(0|[1-9][0-9]*)$/),
+    encryption: z.object({
+        suite: z.literal("A256GCM"),
+        keyId: z.string().min(1),
+        nonce: z.string().min(1),
+        aadDigest: digestSchema,
+    }).strict(),
+}).strict();
+const partyRefSchemaV3 = z.discriminatedUnion("kind", [
+    z.object({ kind: z.literal("public_did"), did: z.string().startsWith("did:") }).strict(),
+    z.object({ kind: z.literal("pairwise_did"), did: z.string().startsWith("did:") }).strict(),
+    z.object({
+        kind: z.literal("keyed_commitment"),
+        value: digestSchema,
+        keyId: z.string().min(1),
+    }).strict(),
+    z.object({ kind: z.literal("evidence_ref"), ref: evidenceRefSchema }).strict(),
+]);
+const signerRefSchemaV3 = z.object({
+    did: z.string().startsWith("did:"),
+    kid: z.string().min(1),
+    alg: z.enum(["EdDSA", "ES256"]),
+}).strict();
+const auditDeploymentConfigSchema = z.object({
+    enabled: z.boolean(),
+    requestedProfile: auditProfileSchema,
+    delivery: deliverySchema,
+    evidenceMode: z.enum(["none", "encrypted-separate", "encrypted-inline"]),
+    retentionClass: z.string().min(1).max(128),
+    retentionDays: z.number().int().min(0).max(3650),
+    residency: z.enum(["inherit-project", "us", "eu", "global"]),
+    keyCustody: z.enum(["none", "checkpoint-managed", "customer-managed-kms"]),
+    recorderTopology: z.enum(["none", "self-hosted", "managed", "verified-mirror"]),
+}).strict();
+const deploymentBindingSchema = z.object({
+    schema: z.literal(DEPLOYMENT_BINDING_SCHEMA),
+    config: auditDeploymentConfigSchema,
+    readiness: z.object({
+        requestedProfile: auditProfileSchema,
+        effectiveProfile: auditProfileSchema,
+        status: z.enum(["disabled", "ready", "degraded"]),
+        reasonCodes: z.array(z.string().min(1).max(128)),
+        canary: z.unknown().nullable(),
+    }).strict(),
+    protocolBinding: z.string().startsWith("urn:kya-os:audit-binding:"),
+    tenantRef: partyRefSchemaV3,
+    producerRef: partyRefSchemaV3,
+    recorderSigner: signerRefSchemaV3,
+    recorderPublicJwk: z.record(z.string(), z.unknown()).refine((value) => typeof value.kty === "string" && value.kty.length > 0, "Recorder public JWK must declare kty"),
+    secretReferences: z.object({
+        producerInternalToken: z.literal("KYA_OS_AUDIT_PRODUCER_INTERNAL_TOKEN"),
+        referenceSecret: z.literal("KYA_OS_AUDIT_REFERENCE_SECRET"),
+        evidenceKey: z.literal("KYA_OS_AUDIT_EVIDENCE_KEY").optional(),
+    }).strict(),
+}).strict();
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function requiredString(env, key) {
+    const value = env[key];
+    if (typeof value !== "string" || value.trim() === "") {
+        throw new Error(`Canonical audit deployment requires ${String(key)}`);
+    }
+    return value;
+}
+function parseBinding(raw) {
+    if (raw === undefined || raw.trim() === "")
+        return undefined;
+    let candidate;
+    try {
+        candidate = JSON.parse(raw);
+    }
+    catch {
+        throw new Error("KYA_OS_AUDIT_CONFIG must be valid JSON");
+    }
+    return deploymentBindingSchema.parse(candidate);
+}
+function profileLevel(profile) {
+    return Number(profile.slice(-1));
+}
+function configuredProfile(requested, delivery, durable) {
+    if (!durable)
+        return "AAP-0";
+    const maximum = delivery === "best-effort" ? 1 : 2;
+    return `AAP-${Math.min(profileLevel(requested), maximum)}`;
+}
+function capabilitiesFor(env, binding, configured) {
+    const durable = env.AUDIT_PRODUCER !== undefined;
+    const delivery = binding?.config.delivery ?? "buffered";
+    const requested = binding?.config.requestedProfile ?? "AAP-2";
+    const evidenceRequested = binding?.config.evidenceMode !== "none";
+    const evidenceAvailable = configured
+        ? evidenceRequested && typeof env.KYA_OS_AUDIT_EVIDENCE_KEY === "string"
+        : true;
+    return {
+        profile: configuredProfile(requested, delivery, durable),
+        recorderTopology: durable ? (binding?.config.recorderTopology ?? "managed") : "none",
+        delivery,
+        journalDurability: durable ? "durable" : "none",
+        atomicAppend: durable,
+        sourceHighWater: durable,
+        // Checkpoints/observers/anchors are recorder-side services. The producer
+        // cannot claim them merely because the requested profile names them.
+        merkleCheckpoints: false,
+        independentObservation: false,
+        supportingAnchors: [],
+        evidenceRetention: evidenceAvailable
+            ? (binding?.config.evidenceMode === "encrypted-inline" ? "inline" : "separate")
+            : "none",
+    };
+}
+function publicCapabilities(capabilities) {
+    const { profile: _profile, ...mechanics } = capabilities;
+    return mechanics;
+}
+function configuredEnvPresent(env, binding) {
+    return binding !== undefined && binding.config.enabled &&
+        env.AUDIT_PRODUCER !== undefined &&
+        typeof env.KYA_OS_AUDIT_RECORDER_URL === "string" &&
+        typeof env.KYA_OS_AUDIT_INGEST_KEY === "string" &&
+        typeof env.KYA_OS_AUDIT_LEDGER_ID === "string" &&
+        typeof env.KYA_OS_AUDIT_LEDGER_EPOCH_ID === "string" &&
+        typeof env.KYA_OS_AUDIT_SOURCE_ID === "string" &&
+        typeof env.KYA_OS_AUDIT_PRODUCER_INTERNAL_TOKEN === "string" &&
+        typeof env.KYA_OS_AUDIT_REFERENCE_SECRET === "string";
+}
+export function resolveAuditRuntimeProbe(env) {
+    const binding = parseBinding(env.KYA_OS_AUDIT_CONFIG);
+    const configured = configuredEnvPresent(env, binding);
+    return {
+        format: PROBE_FORMAT,
+        configured,
+        enabled: configured && binding?.config.enabled === true,
+        capabilities: publicCapabilities(capabilitiesFor(env, binding, configured)),
+        canaryEndpoint: KYA_OS_AUDIT_CANARY_PATH,
+    };
+}
+export function createCloudflareAuditRuntimeFromEnv(env) {
+    const binding = parseBinding(env.KYA_OS_AUDIT_CONFIG);
+    if (binding === undefined || !binding.config.enabled)
+        return undefined;
+    if (!configuredEnvPresent(env, binding)) {
+        throw new Error("Canonical audit deployment binding is incomplete");
+    }
+    const ledgerId = requiredString(env, "KYA_OS_AUDIT_LEDGER_ID");
+    const ledgerEpochId = requiredString(env, "KYA_OS_AUDIT_LEDGER_EPOCH_ID");
+    const sourceId = requiredString(env, "KYA_OS_AUDIT_SOURCE_ID");
+    const capabilities = capabilitiesFor(env, binding, true);
+    const instanceName = `${ledgerId}\0${sourceId}`;
+    const producer = new CloudflareAuditProducerBinding({
+        namespace: env.AUDIT_PRODUCER,
+        instanceName,
+        delivery: binding.config.delivery,
+        internalToken: requiredString(env, "KYA_OS_AUDIT_PRODUCER_INTERNAL_TOKEN"),
+    });
+    const trail = createCloudflareAuditTrail({
+        env,
+        instanceName,
+        delivery: binding.config.delivery,
+        ledgerId,
+        expectedLedgerEpochId: ledgerEpochId,
+        tenantRef: binding.tenantRef,
+        producer: binding.producerRef,
+        sourceId,
+        binding: binding.protocolBinding,
+        privacy: {
+            classification: "internal",
+            retentionClass: binding.config.retentionClass,
+        },
+        capabilities,
+    });
+    const auditTrail = {
+        trail,
+        sourceId,
+        context: createHmacRuntimeAuditContextFactory({
+            secret: requiredString(env, "KYA_OS_AUDIT_REFERENCE_SECRET"),
+            keyId: "kya-os-audit-reference-v1",
+        }),
+    };
+    return { binding, capabilities, auditTrail, trail, producer };
+}
+function base64urlToBytes(value) {
+    if (!/^[A-Za-z0-9_-]+$/.test(value)) {
+        throw new Error("KYA_OS_AUDIT_EVIDENCE_KEY must be unpadded base64url");
+    }
+    const base64 = value.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
+    const binary = atob(padded);
+    return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+}
+async function canaryEvidence(env, eventId) {
+    if (env.KYA_OS_AUDIT_EVIDENCE_KEY === undefined)
+        return undefined;
+    const keyBytes = base64urlToBytes(env.KYA_OS_AUDIT_EVIDENCE_KEY);
+    if (keyBytes.byteLength !== 32) {
+        throw new Error("KYA_OS_AUDIT_EVIDENCE_KEY must decode to 32 bytes");
+    }
+    const key = await crypto.subtle.importKey("raw", Uint8Array.from(keyBytes).buffer, "AES-GCM", false, ["encrypt"]);
+    const hasher = new CryptoProviderAuditHasher(new WebCryptoProvider());
+    const encryptor = new WebCryptoEvidenceEncryptor({
+        crypto,
+        hasher,
+        randomBytes: async (length) => crypto.getRandomValues(new Uint8Array(length)),
+    });
+    return encryptor.encrypt({
+        plaintext: new TextEncoder().encode(JSON.stringify({ kind: "audit-canary", eventId })),
+        mediaType: "application/json",
+        key,
+        keyId: "kya-os-audit-evidence-v1",
+        aad: new TextEncoder().encode(`org.kya-os.audit.canary\0${eventId}`),
+    });
+}
+function recordedEntry(result) {
+    return result.status === "recorded" ? result.entry : undefined;
+}
+function constantTimeEqual(expected, actual) {
+    const left = new TextEncoder().encode(expected);
+    const right = new TextEncoder().encode(actual);
+    let difference = left.byteLength ^ right.byteLength;
+    const length = Math.max(left.byteLength, right.byteLength);
+    for (let index = 0; index < length; index += 1) {
+        difference |= (left[index] ?? 0) ^ (right[index] ?? 0);
+    }
+    return difference === 0;
+}
+function authorizedCanary(request, env) {
+    const expected = env.KYA_OS_AUDIT_PRODUCER_INTERNAL_TOKEN;
+    if (typeof expected !== "string" || expected.length === 0)
+        return false;
+    const authorization = request.headers.get("Authorization") ?? "";
+    return authorization.startsWith("Bearer ") &&
+        constantTimeEqual(expected, authorization.slice("Bearer ".length));
+}
+function json(value, status = 200) {
+    return new Response(JSON.stringify(value), {
+        status,
+        headers: {
+            "Content-Type": "application/json; charset=utf-8",
+            "Cache-Control": "no-store",
+        },
+    });
+}
+export async function runAuditRuntimeCanary(request, env) {
+    if (!authorizedCanary(request, env)) {
+        return json({ error: "AUDIT_CANARY_UNAUTHORIZED" }, 401);
+    }
+    const runtime = createCloudflareAuditRuntimeFromEnv(env);
+    if (runtime === undefined) {
+        return json({ error: "AUDIT_NOT_CONFIGURED" }, 503);
+    }
+    const observedAt = Date.now();
+    const eventId = `canary:${crypto.randomUUID()}`;
+    const evidence = await canaryEvidence(env, eventId);
+    const input = {
+        eventId,
+        eventType: CANARY_EVENT_TYPE,
+        occurredAt: observedAt,
+        action: {
+            category: "audit.canary",
+            ...(evidence === undefined ? {} : { detailRef: evidence.ref }),
+        },
+        outcome: "succeeded",
+        evidence: evidence === undefined ? [] : [evidence.ref],
+        details: {
+            family: "key",
+            phase: "configuration_changed",
+        },
+    };
+    const first = await runtime.trail.record(input, evidence === undefined ? undefined : { encryptedEvidence: [evidence] });
+    const duplicate = await runtime.trail.record(input, evidence === undefined ? undefined : { encryptedEvidence: [evidence] });
+    let flush;
+    if (runtime.binding.config.delivery === "buffered") {
+        flush = await runtime.trail.flush(10);
+    }
+    const entry = recordedEntry(first) ?? recordedEntry(duplicate) ??
+        await runtime.producer.receipt(eventId);
+    const sourceState = await runtime.trail.getSourceState();
+    let conflictRejected = false;
+    try {
+        const conflict = await runtime.trail.record({
+            ...input,
+            action: { category: "audit.canary.conflict" },
+        });
+        conflictRejected = conflict.status === "failed";
+    }
+    catch {
+        conflictRejected = true;
+    }
+    const sourceSequence = entry?.core.event.source.sourceSequence;
+    const checks = [
+        { id: "recorder_round_trip", passed: entry?.core.event.eventId === eventId },
+        {
+            id: "verified_receipt",
+            passed: entry !== undefined &&
+                entry.recorderReceipt.core.entryDigest === entry.entryDigest,
+        },
+        {
+            id: "idempotent_retry",
+            passed: first.event.source.sourceSequence === duplicate.event.source.sourceSequence,
+        },
+        { id: "event_identity_conflict", passed: conflictRejected },
+        {
+            id: "source_state",
+            passed: sourceSequence !== undefined &&
+                BigInt(sourceState.highestReceipted) >= BigInt(sourceSequence) &&
+                !sourceState.pendingSequences.includes(sourceSequence),
+        },
+        ...(runtime.binding.config.delivery === "buffered"
+            ? [{ id: "buffered_outbox", passed: flush?.failed === 0 && (flush?.delivered ?? 0) >= 1 }]
+            : []),
+        ...(evidence === undefined
+            ? []
+            : [{
+                    id: "evidence_write_verified",
+                    passed: entry?.core.event.evidence.some((ref) => ref.ciphertextDigest === evidence.ref.ciphertextDigest) === true,
+                }]),
+    ];
+    const result = {
+        passed: checks.every((check) => check.passed),
+        observedAt,
+        capabilities: publicCapabilities(runtime.capabilities),
+        checks,
+        ...(entry === undefined ? {} : { bundleHash: entry.entryDigest }),
+    };
+    return json(result, result.passed ? 200 : 503);
+}
+export async function handleAuditRuntimeControlRequest(request, env) {
+    const url = new URL(request.url);
+    if (request.method === "GET" && url.pathname === KYA_OS_AUDIT_DISCOVERY_PATH) {
+        return json(resolveAuditRuntimeProbe(env));
+    }
+    if (request.method === "POST" && url.pathname === KYA_OS_AUDIT_CANARY_PATH) {
+        return runAuditRuntimeCanary(request, env);
+    }
+    return null;
+}
+export function recorderConfigurationFromBinding(binding) {
+    if (!isRecord(binding.recorderPublicJwk)) {
+        throw new Error("Recorder public JWK is malformed");
+    }
+    return {
+        signer: binding.recorderSigner,
+        publicJwk: binding.recorderPublicJwk,
+    };
+}
+//# sourceMappingURL=deployment-binding.js.map

package/dist/audit/deployment-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-binding.js","sourceRoot":"","sources":["../../src/audit/deployment-binding.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,0BAA0B,GAS3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oCAAoC,GAErC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAE5B,MAAM,CAAC,MAAM,2BAA2B,GAAG,2BAAoC,CAAC;AAChF,MAAM,CAAC,MAAM,wBAAwB,GAAG,oBAA6B,CAAC;AAEtE,MAAM,yBAAyB,GAC7B,uEAAgF,CAAC;AACnF,MAAM,YAAY,GAAG,0CAAmD,CAAC;AACzE,MAAM,iBAAiB,GAAG,uBAAgC,CAAC;AAE3D,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AACjF,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AACvE,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;AAC/D,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,gBAAgB,EAAE,YAAY;IAC9B,mBAAmB,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,SAAS,EAAE,YAAY;KACxB,CAAC,CAAC,MAAM,EAAE;CACZ,CAAC,CAAC,MAAM,EAAE,CAAC;AACZ,MAAM,gBAAgB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACpD,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACxF,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1F,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACnC,KAAK,EAAE,YAAY;QACnB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACzB,CAAC,CAAC,MAAM,EAAE;IACX,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;CAC/E,CAAC,CAAC;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;IAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;CAChC,CAAC,CAAC,MAAM,EAAE,CAAC;AACZ,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,gBAAgB,EAAE,kBAAkB;IACpC,QAAQ,EAAE,cAAc;IACxB,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;IACxE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC5D,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;IAC1E,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;CAChF,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC;IAC5C,MAAM,EAAE,2BAA2B;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,gBAAgB,EAAE,kBAAkB;QACpC,gBAAgB,EAAE,kBAAkB;QACpC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QACjD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC/B,CAAC,CAAC,MAAM,EAAE;IACX,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,2BAA2B,CAAC;IACnE,SAAS,EAAE,gBAAgB;IAC3B,WAAW,EAAE,gBAAgB;IAC7B,cAAc,EAAE,iBAAiB;IACjC,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CACzD,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAChE,sCAAsC,CACvC;IACD,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC;QACzB,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,sCAAsC,CAAC;QACxE,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,+BAA+B,CAAC;QAC3D,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC,QAAQ,EAAE;KAC/D,CAAC,CAAC,MAAM,EAAE;CACZ,CAAC,CAAC,MAAM,EAAE,CAAC;AA6BZ,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,cAAc,CAAC,GAAkB,EAAE,GAAwB;IAClE,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,GAAuB;IAC3C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC7D,IAAI,SAAkB,CAAC;IACvB,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,uBAAuB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,YAAY,CAAC,OAAqC;IACzD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,iBAAiB,CACxB,SAAuC,EACvC,QAAuC,EACvC,OAAgB;IAEhB,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IAC7B,MAAM,OAAO,GAAG,QAAQ,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,EAAkC,CAAC;AAC7F,CAAC;AAED,SAAS,eAAe,CACtB,GAAkB,EAClB,OAA2C,EAC3C,UAAmB;IAEnB,MAAM,OAAO,GAAG,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC;IACjD,MAAM,QAAQ,GAAG,OAAO,EAAE,MAAM,CAAC,QAAQ,IAAI,UAAU,CAAC;IACxD,MAAM,SAAS,GAAG,OAAO,EAAE,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAC;IAC9D,MAAM,iBAAiB,GAAG,OAAO,EAAE,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC;IAClE,MAAM,iBAAiB,GAAG,UAAU;QAClC,CAAC,CAAC,iBAAiB,IAAI,OAAO,GAAG,CAAC,yBAAyB,KAAK,QAAQ;QACxE,CAAC,CAAC,IAAI,CAAC;IACT,OAAO;QACL,OAAO,EAAE,iBAAiB,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC;QACxD,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,gBAAgB,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM;QACpF,QAAQ;QACR,iBAAiB,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;QAC/C,YAAY,EAAE,OAAO;QACrB,eAAe,EAAE,OAAO;QACxB,yEAAyE;QACzE,qEAAqE;QACrE,iBAAiB,EAAE,KAAK;QACxB,sBAAsB,EAAE,KAAK;QAC7B,iBAAiB,EAAE,EAAE;QACrB,iBAAiB,EAAE,iBAAiB;YAClC,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,KAAK,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;YAC/E,CAAC,CAAC,MAAM;KACX,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,YAA+B;IACzD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,SAAS,EAAE,GAAG,YAAY,CAAC;IACzD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAkB,EAAE,OAA2C;IAC3F,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;QACpD,GAAG,CAAC,cAAc,KAAK,SAAS;QAChC,OAAO,GAAG,CAAC,yBAAyB,KAAK,QAAQ;QACjD,OAAO,GAAG,CAAC,uBAAuB,KAAK,QAAQ;QAC/C,OAAO,GAAG,CAAC,sBAAsB,KAAK,QAAQ;QAC9C,OAAO,GAAG,CAAC,4BAA4B,KAAK,QAAQ;QACpD,OAAO,GAAG,CAAC,sBAAsB,KAAK,QAAQ;QAC9C,OAAO,GAAG,CAAC,oCAAoC,KAAK,QAAQ;QAC5D,OAAO,GAAG,CAAC,6BAA6B,KAAK,QAAQ,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,GAAkB;IACzD,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACtD,OAAO;QACL,MAAM,EAAE,YAAY;QACpB,UAAU;QACV,OAAO,EAAE,UAAU,IAAI,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI;QACvD,YAAY,EAAE,kBAAkB,CAAC,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAC3E,cAAc,EAAE,wBAAwB;KACzC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,GAAkB;IAElB,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACtD,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACvE,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,GAAG,QAAQ,KAAK,QAAQ,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,8BAA8B,CAAC;QAClD,SAAS,EAAE,GAAG,CAAC,cAAe;QAC9B,YAAY;QACZ,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;QACjC,aAAa,EAAE,cAAc,CAAC,GAAG,EAAE,sCAAsC,CAAC;KAC3E,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,0BAA0B,CAAC;QACvC,GAAG;QACH,YAAY;QACZ,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;QACjC,QAAQ;QACR,qBAAqB,EAAE,aAAa;QACpC,SAAS,EAAE,OAAO,CAAC,SAAqB;QACxC,QAAQ,EAAE,OAAO,CAAC,WAAuB;QACzC,QAAQ;QACR,OAAO,EAAE,OAAO,CAAC,eAAoC;QACrD,OAAO,EAAE;YACP,cAAc,EAAE,UAAU;YAC1B,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc;SAC9C;QACD,YAAY;KACb,CAAC,CAAC;IACH,MAAM,UAAU,GAAuB;QACrC,KAAK;QACL,QAAQ;QACR,OAAO,EAAE,oCAAoC,CAAC;YAC5C,MAAM,EAAE,cAAc,CAAC,GAAG,EAAE,+BAA+B,CAAC;YAC5D,KAAK,EAAE,2BAA2B;SACnC,CAAC;KACH,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,GAAkB,EAClB,OAAe;IAEf,IAAI,GAAG,CAAC,yBAAyB,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACjE,IAAI,QAAQ,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAqB,EAC/C,SAAS,EACT,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,yBAAyB,CAAC,IAAI,iBAAiB,EAAE,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,IAAI,0BAA0B,CAAC;QAC/C,MAAM;QACN,MAAM;QACN,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;KAC9E,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,OAAO,CAAC;QACvB,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC;QACtF,SAAS,EAAE,kBAAkB;QAC7B,GAAG;QACH,KAAK,EAAE,0BAA0B;QACjC,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,4BAA4B,OAAO,EAAE,CAAC;KACrE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,MAAuB;IAC5C,OAAO,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB,EAAE,MAAc;IACzD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,UAAU,GAAG,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC3D,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/C,UAAU,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,UAAU,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgB,EAAE,GAAkB;IAC5D,MAAM,QAAQ,GAAG,GAAG,CAAC,oCAAoC,CAAC;IAC1D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IACjE,OAAO,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;QACxC,iBAAiB,CAAC,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,MAAM,GAAG,GAAG;IACxC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;QACzC,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,iCAAiC;YACjD,eAAe,EAAE,UAAU;SAC5B;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAgB,EAChB,GAAkB;IAElB,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,OAAO,GAAG,mCAAmC,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,UAAU,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG;QACZ,OAAO;QACP,SAAS,EAAE,iBAAiB;QAC5B,UAAU,EAAE,UAAU;QACtB,MAAM,EAAE;YACN,QAAQ,EAAE,cAAc;YACxB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;SAC/D;QACD,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QACtD,OAAO,EAAE;YACP,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,uBAAuB;SAC/B;KACmD,CAAC;IAEvD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CACtC,KAAK,EACL,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,QAAQ,CAAC,EAAE,CACvE,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAC1C,KAAK,EACL,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,QAAQ,CAAC,EAAE,CACvE,CAAC;IACF,IAAI,KAAwD,CAAC;IAC7D,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnD,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,SAAS,CAAC;QAC5D,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;IACzD,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;YAC1C,GAAG,KAAK;YACR,MAAM,EAAE,EAAE,QAAQ,EAAE,uBAAuB,EAAE;SAC9C,CAAC,CAAC;QACH,gBAAgB,GAAG,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED,MAAM,cAAc,GAAG,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC;IAC/D,MAAM,MAAM,GAAG;QACb,EAAE,EAAE,EAAE,qBAAqB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,EAAE;QAC5E;YACE,EAAE,EAAE,kBAAkB;YACtB,MAAM,EAAE,KAAK,KAAK,SAAS;gBACzB,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;SAC/D;QACD;YACE,EAAE,EAAE,kBAAkB;YACtB,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc;SACpF;QACD,EAAE,EAAE,EAAE,yBAAyB,EAAE,MAAM,EAAE,gBAAgB,EAAE;QAC3D;YACE,EAAE,EAAE,cAAc;YAClB,MAAM,EAAE,cAAc,KAAK,SAAS;gBAClC,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC;gBAC9D,CAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,cAAc,CAAC;SACzD;QACD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,KAAK,UAAU;YAChD,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1F,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,QAAQ,KAAK,SAAS;YACxB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC;oBACC,EAAE,EAAE,yBAAyB;oBAC7B,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CACrC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,gBAAgB,KAAK,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAChE,KAAK,IAAI;iBACX,CAAC,CAAC;KACR,CAAC;IACF,MAAM,MAAM,GAA6B;QACvC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;QAC7C,UAAU;QACV,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC;QACtD,MAAM;QACN,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;KAClE,CAAC;IACF,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,OAAgB,EAChB,GAAkB;IAElB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,2BAA2B,EAAE,CAAC;QAC7E,OAAO,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,wBAAwB,EAAE,CAAC;QAC3E,OAAO,qBAAqB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,OAA+B;IAI9E,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,cAA2B;QAC3C,SAAS,EAAE,OAAO,CAAC,iBAAiB;KACrC,CAAC;AACJ,CAAC"}

package/dist/audit/durable-producer.d.ts

@@ -0,0 +1,151 @@
+import type { DurableObjectNamespace, DurableObjectState } from "@cloudflare/workers-types";
+import { type AuditCapabilities, type AuditDeliveryMode, type AuditHasher, type AuditOutboxItem, type AuditOutboxProvider, type AuditRecorderClient, type AuditRecorderSubmission, type AuditSourceState, type AuditSourceStateProvider, type AuditTrailConfiguration, type SignedAuditEntryV1 } from "@kya-os/mcp/audit";
+export declare const AUDIT_PRODUCER_BINDING: "AUDIT_PRODUCER";
+export declare const AUDIT_PRODUCER_CLASS_NAME: "AuditProducer";
+export interface AuditProducerServiceBinding {
+    fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+}
+/** Bindings consumed inside the AuditProducer Durable Object. */
+export interface AuditProducerEnv {
+    KYA_OS_AUDIT_CONFIG?: string;
+    KYA_OS_AUDIT_RECORDER_URL?: string;
+    KYA_OS_AUDIT_INGEST_KEY?: string;
+    KYA_OS_AUDIT_RECORDER_SERVICE?: AuditProducerServiceBinding;
+    KYA_OS_AUDIT_PRODUCER_INTERNAL_TOKEN?: string;
+    KYA_OS_AUDIT_MAX_ATTEMPTS?: string;
+    KYA_OS_AUDIT_RETRY_BASE_MS?: string;
+    KYA_OS_AUDIT_RETRY_MAX_MS?: string;
+    KYA_OS_AUDIT_DELIVERY_BATCH_SIZE?: string;
+    KYA_OS_AUDIT_DEAD_LETTER_RETENTION_MS?: string;
+    KYA_OS_AUDIT_RECEIPT_RETENTION_MS?: string;
+}
+export interface CloudflareAuditProducerEnv {
+    AUDIT_PRODUCER?: DurableObjectNamespace;
+    KYA_OS_AUDIT_PRODUCER_INTERNAL_TOKEN?: string;
+}
+export interface AuditProducerRetryPolicy {
+    maxAttempts: number;
+    baseDelayMs: number;
+    maxDelayMs: number;
+    batchSize: number;
+    deadLetterRetentionMs: number;
+    receiptRetentionMs: number;
+}
+export interface AuditProducerDeadLetter {
+    eventId: string;
+    sourceId: string;
+    sourceSequence?: string;
+    attempts: number;
+    enqueuedAt: number;
+    deadLetteredAt: number;
+    lastError: string;
+}
+interface StoredOutboxItem extends AuditOutboxItem {
+    availableAt: number;
+}
+interface AuditDeliveryStore {
+    enqueue(item: AuditOutboxItem, now: number): void;
+    pending(now: number, limit: number, blockedSources: ReadonlySet<string>): StoredOutboxItem[];
+    markDelivered(eventId: string, entry: SignedAuditEntryV1, now: number): void;
+    markDeliveredFromReceipt(eventId: string, now: number): boolean;
+    markFailed(eventId: string, error: unknown, now: number, policy: AuditProducerRetryPolicy): {
+        state: "pending" | "dead";
+        attempts: number;
+        availableAt?: number;
+    };
+    nextAlarmAt(now: number, policy: AuditProducerRetryPolicy): number | null;
+    prune(now: number, policy: AuditProducerRetryPolicy): void;
+    deadLetters(limit: number): AuditProducerDeadLetter[];
+    redrive(eventId: string, now: number): boolean;
+    receipt(eventId: string): SignedAuditEntryV1 | undefined;
+    saveReceipt(eventId: string, entry: SignedAuditEntryV1, now: number): void;
+}
+interface AlarmScheduler {
+    setAlarm(scheduledTime: number | Date): Promise<void>;
+    deleteAlarm(): Promise<void>;
+}
+export declare function resolveAuditProducerRetryPolicy(env: AuditProducerEnv): AuditProducerRetryPolicy;
+export declare function auditRetryDelayMs(attempts: number, policy: Pick<AuditProducerRetryPolicy, "baseDelayMs" | "maxDelayMs">): number;
+/** Pure delivery coordinator; persistence and alarms are injected for deterministic tests. */
+export declare class AuditProducerDeliveryEngine {
+    private readonly store;
+    private readonly recorder;
+    private readonly alarms;
+    private readonly policy;
+    private readonly clock;
+    constructor(store: AuditDeliveryStore, recorder: () => AuditRecorderClient, alarms: AlarmScheduler, policy: AuditProducerRetryPolicy, clock?: {
+        now(): number;
+    });
+    enqueue(item: AuditOutboxItem): Promise<void>;
+    flush(): Promise<{
+        delivered: number;
+        failed: number;
+        deadLettered: number;
+    }>;
+    scheduleNext(): Promise<void>;
+}
+/**
+ * SQLite-backed producer boundary. It is deliberately separate from the MCP
+ * agent Durable Object, so recorder latency and retry alarms cannot mutate or
+ * stall authorization, consent, delegation, or session state.
+ */
+export declare class AuditProducer {
+    private readonly state;
+    private readonly env;
+    private readonly store;
+    private readonly policy;
+    private readonly delivery;
+    private readonly ready;
+    private recorderClient?;
+    constructor(state: DurableObjectState, env: AuditProducerEnv);
+    fetch(request: Request): Promise<Response>;
+    alarm(): Promise<void>;
+    private recorder;
+}
+export interface CloudflareAuditProducerBindingOptions {
+    namespace: DurableObjectNamespace;
+    instanceName: string;
+    delivery: AuditDeliveryMode;
+    internalToken?: string;
+}
+/** Client-side port used by AuditTrailService in the MCP worker. */
+export declare class CloudflareAuditProducerBinding implements AuditRecorderClient, AuditOutboxProvider, AuditSourceStateProvider {
+    private readonly options;
+    readonly capabilities: {
+        readonly durability: "durable";
+        readonly fifoPerSource: true;
+        readonly atomicClaim: true;
+    };
+    private readonly stub;
+    constructor(options: CloudflareAuditProducerBindingOptions);
+    submit(input: AuditRecorderSubmission): Promise<SignedAuditEntryV1>;
+    enqueue(item: AuditOutboxItem): Promise<void>;
+    pending(limit?: number): AsyncIterable<AuditOutboxItem>;
+    markDelivered(eventId: string): Promise<void>;
+    markFailed(eventId: string, error: unknown): Promise<void>;
+    claimEvent(sourceId: string, eventId: string): Promise<{
+        sequence: string;
+        previousSourceEventDigest?: `sha256:${string}`;
+    }>;
+    markEmitted(sourceId: string, eventId: string, sequence: string, eventDigest: `sha256:${string}`): Promise<void>;
+    markReceipted(sourceId: string, sequence: string, entryDigest: `sha256:${string}`): Promise<void>;
+    getState(sourceId: string): Promise<AuditSourceState>;
+    /** Return only a locally verified recorder entry retained by the producer. */
+    receipt(eventId: string): Promise<SignedAuditEntryV1 | undefined>;
+    private request;
+}
+type CloudflareAuditTrailBase = Pick<AuditTrailConfiguration, "ledgerId" | "expectedLedgerEpochId" | "tenantRef" | "producer" | "sourceId" | "binding" | "privacy" | "eventIdFactory" | "onDeliveryFailure" | "onSourceStateFailure">;
+export interface CreateCloudflareAuditTrailOptions extends CloudflareAuditTrailBase {
+    env: CloudflareAuditProducerEnv;
+    delivery: AuditDeliveryMode;
+    capabilities?: AuditCapabilities;
+    instanceName?: string;
+    hasher?: AuditHasher;
+    clock?: {
+        now(): number;
+    };
+}
+/** Compose the core audit trail with durable Cloudflare producer mechanics. */
+export declare function createCloudflareAuditTrail(options: CreateCloudflareAuditTrailOptions): import("@kya-os/mcp").AuditTrailService;
+export {};
+//# sourceMappingURL=durable-producer.d.ts.map

package/dist/audit/durable-producer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"durable-producer.d.ts","sourceRoot":"","sources":["../../src/audit/durable-producer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,sBAAsB,EACtB,kBAAkB,EACnB,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EAML,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAE5B,KAAK,kBAAkB,EAExB,MAAM,mBAAmB,CAAC;AAS3B,eAAO,MAAM,sBAAsB,EAAG,gBAAyB,CAAC;AAChE,eAAO,MAAM,yBAAyB,EAAG,eAAwB,CAAC;AAElE,MAAM,WAAW,2BAA2B;IAC1C,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxE;AAED,iEAAiE;AACjE,MAAM,WAAW,gBAAgB;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,6BAA6B,CAAC,EAAE,2BAA2B,CAAC;IAC5D,oCAAoC,CAAC,EAAE,MAAM,CAAC;IAC9C,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,gCAAgC,CAAC,EAAE,MAAM,CAAC;IAC1C,qCAAqC,CAAC,EAAE,MAAM,CAAC;IAC/C,iCAAiC,CAAC,EAAE,MAAM,CAAC;CAC5C;AAED,MAAM,WAAW,0BAA0B;IACzC,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,oCAAoC,CAAC,EAAE,MAAM,CAAC;CAC/C;AAED,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CACnB;AAqBD,UAAU,gBAAiB,SAAQ,eAAe;IAChD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,kBAAkB;IAC1B,OAAO,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAClD,OAAO,CACL,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,GAClC,gBAAgB,EAAE,CAAC;IACtB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7E,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAChE,UAAU,CACR,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,OAAO,EACd,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,wBAAwB,GAC/B;QAAE,KAAK,EAAE,SAAS,GAAG,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzE,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,GAAG,MAAM,GAAG,IAAI,CAAC;IAC1E,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAAC;IAC3D,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,uBAAuB,EAAE,CAAC;IACtD,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/C,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAC;IACzD,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5E;AAED,UAAU,cAAc;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B;AA+BD,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,gBAAgB,GACpB,wBAAwB,CA8B1B;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,IAAI,CAAC,wBAAwB,EAAE,aAAa,GAAG,YAAY,CAAC,GACnE,MAAM,CAGR;AA6ND,8FAA8F;AAC9F,qBAAa,2BAA2B;IAEpC,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAJL,KAAK,EAAE,kBAAkB,EACzB,QAAQ,EAAE,MAAM,mBAAmB,EACnC,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,wBAAwB,EAChC,KAAK,GAAE;QAAE,GAAG,IAAI,MAAM,CAAA;KAA8B;IAGjE,OAAO,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAM7C,KAAK,IAAI,OAAO,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IAsCI,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;CASpC;AAslBD;;;;GAIG;AACH,qBAAa,aAAa;IAQtB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG;IARtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA2B;IACjD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAClD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA8B;IACvD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgB;IACtC,OAAO,CAAC,cAAc,CAAC,CAA8B;gBAGlC,KAAK,EAAE,kBAAkB,EACzB,GAAG,EAAE,gBAAgB;IAelC,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAoN1C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAK5B,OAAO,CAAC,QAAQ;CAIjB;AAED,MAAM,WAAW,qCAAqC;IACpD,SAAS,EAAE,sBAAsB,CAAC;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,oEAAoE;AACpE,qBAAa,8BACX,YAAW,mBAAmB,EAAE,mBAAmB,EAAE,wBAAwB;IASjE,OAAO,CAAC,QAAQ,CAAC,OAAO;IAPpC,QAAQ,CAAC,YAAY;;;;MAIV;IACX,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4C;gBAEpC,OAAO,EAAE,qCAAqC;IAQrE,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAWnE,OAAO,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAO5C,OAAO,CAAC,KAAK,SAAM,GAAG,aAAa,CAAC,eAAe,CAAC;IAWrD,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO7C,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAO1D,UAAU,CACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,yBAAyB,CAAC,EAAE,UAAU,MAAM,EAAE,CAAC;KAChD,CAAC;IA0BI,WAAW,CACf,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,UAAU,MAAM,EAAE,GAC9B,OAAO,CAAC,IAAI,CAAC;IAOV,aAAa,CACjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,UAAU,MAAM,EAAE,GAC9B,OAAO,CAAC,IAAI,CAAC;IAOV,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAO3D,8EAA8E;IACxE,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;YAazD,OAAO;CA2BtB;AAED,KAAK,wBAAwB,GAAG,IAAI,CAClC,uBAAuB,EACrB,UAAU,GACV,uBAAuB,GACvB,WAAW,GACX,UAAU,GACV,UAAU,GACV,SAAS,GACT,SAAS,GACT,gBAAgB,GAChB,mBAAmB,GACnB,sBAAsB,CACzB,CAAC;AAEF,MAAM,WAAW,iCACf,SAAQ,wBAAwB;IAChC,GAAG,EAAE,0BAA0B,CAAC;IAChC,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,KAAK,CAAC,EAAE;QAAE,GAAG,IAAI,MAAM,CAAA;KAAE,CAAC;CAC3B;AAED,+EAA+E;AAC/E,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,iCAAiC,2CAkD3C"}