@kya-os/mcp 1.10.0 → 1.11.0

package/dist/audit/adapters/legacy-audit-log.d.ts

@@ -0,0 +1,20 @@
+import { AuditLogProvider } from '../../providers/audit-log.js';
+import type { AuditContext, AuditEventContext } from '../../types/protocol.js';
+import type { AuditTrailService } from '../service.js';
+export interface LegacyAuditSinkAdapterOptions {
+    identityKind?: 'public_did' | 'pairwise_did';
+    resourceKind?: 'public_did' | 'pairwise_did';
+}
+/**
+ * 1.x compatibility bridge. It captures legacy calls in the new ledger but can
+ * claim only legacy/capture coverage because the old shape lacks lifecycle data.
+ */
+export declare class LegacyAuditSinkAdapter extends AuditLogProvider {
+    private readonly trail;
+    private readonly options;
+    readonly capability: "legacy-capture";
+    constructor(trail: Pick<AuditTrailService, 'record'>, options?: LegacyAuditSinkAdapterOptions);
+    logAuditRecord(context: AuditContext): Promise<void>;
+    logEvent(context: AuditEventContext): Promise<void>;
+}
+//# sourceMappingURL=legacy-audit-log.d.ts.map

package/dist/audit/adapters/legacy-audit-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-audit-log.d.ts","sourceRoot":"","sources":["../../../src/audit/adapters/legacy-audit-log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,KAAK,EAAwB,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAE7E,MAAM,WAAW,6BAA6B;IAC5C,YAAY,CAAC,EAAE,YAAY,GAAG,cAAc,CAAC;IAC7C,YAAY,CAAC,EAAE,YAAY,GAAG,cAAc,CAAC;CAC9C;AAED;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,gBAAgB;IAIxD,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJ1B,QAAQ,CAAC,UAAU,EAAG,gBAAgB,CAAU;gBAG7B,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,EACxC,OAAO,GAAE,6BAAkC;IAKxD,cAAc,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBpD,QAAQ,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;CAgB1D"}

package/dist/audit/adapters/legacy-audit-log.js

@@ -0,0 +1,56 @@
+import { AuditLogProvider } from '../../providers/audit-log.js';
+/**
+ * 1.x compatibility bridge. It captures legacy calls in the new ledger but can
+ * claim only legacy/capture coverage because the old shape lacks lifecycle data.
+ */
+export class LegacyAuditSinkAdapter extends AuditLogProvider {
+    trail;
+    options;
+    capability = 'legacy-capture';
+    constructor(trail, options = {}) {
+        super();
+        this.trail = trail;
+        this.options = options;
+    }
+    async logAuditRecord(context) {
+        const verified = context.verified === 'yes';
+        await this.trail.record({
+            eventType: verified ? 'proof.verified' : 'proof.rejected',
+            actor: { kind: this.options.identityKind ?? 'public_did', did: context.identity.did },
+            resource: { kind: this.options.resourceKind ?? 'public_did', did: context.session.audience },
+            action: { category: 'legacy.audit-record' },
+            outcome: verified ? 'succeeded' : 'failed',
+            ...(verified ? {} : { reason: { code: 'LEGACY_VERIFICATION_FAILED' } }),
+            ...(context.scopeId === undefined ? {} : {
+                authorization: {
+                    source: 'policy',
+                    decision: verified ? 'allowed' : 'denied',
+                    scopeId: context.scopeId,
+                },
+            }),
+            evidence: [],
+            details: {
+                family: 'proof',
+                phase: verified ? 'verified' : 'rejected',
+                verificationCode: verified ? 'LEGACY_VERIFIED_CLAIM' : 'LEGACY_REJECTED_CLAIM',
+            },
+        });
+    }
+    async logEvent(context) {
+        const input = {
+            eventType: 'configuration.changed',
+            actor: { kind: this.options.identityKind ?? 'public_did', did: context.identity.did },
+            resource: { kind: this.options.resourceKind ?? 'public_did', did: context.session.audience },
+            action: { category: 'legacy.event' },
+            outcome: 'unknown',
+            reason: { code: 'LEGACY_EVENT_CAPTURE' },
+            evidence: [],
+            details: {
+                family: 'key',
+                phase: 'configuration_changed',
+            },
+        };
+        await this.trail.record(input);
+    }
+}
+//# sourceMappingURL=legacy-audit-log.js.map

package/dist/audit/adapters/legacy-audit-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-audit-log.js","sourceRoot":"","sources":["../../../src/audit/adapters/legacy-audit-log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAShE;;;GAGG;AACH,MAAM,OAAO,sBAAuB,SAAQ,gBAAgB;IAIvC;IACA;IAJV,UAAU,GAAG,gBAAyB,CAAC;IAEhD,YACmB,KAAwC,EACxC,UAAyC,EAAE;QAE5D,KAAK,EAAE,CAAC;QAHS,UAAK,GAAL,KAAK,CAAmC;QACxC,YAAO,GAAP,OAAO,CAAoC;IAG9D,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAqB;QACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC;QAC5C,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACtB,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB;YACzD,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,YAAY,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE;YACrF,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,YAAY,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE;YAC5F,MAAM,EAAE,EAAE,QAAQ,EAAE,qBAAqB,EAAE;YAC3C,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;YAC1C,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,EAAE,CAAC;YACvE,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACvC,aAAa,EAAE;oBACb,MAAM,EAAE,QAAiB;oBACzB,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAkB,CAAC,CAAC,CAAC,QAAiB;oBAC3D,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB;aACF,CAAC;YACF,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;gBACzC,gBAAgB,EAAE,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,uBAAuB;aAC/E;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAA0B;QACvC,MAAM,KAAK,GAAyB;YAClC,SAAS,EAAE,uBAAuB;YAClC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,YAAY,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE;YACrF,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,YAAY,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE;YAC5F,MAAM,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE;YACpC,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE;YACxC,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE;gBACP,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,uBAAuB;aAC/B;SACF,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;CACF"}

package/dist/audit/adapters/mcp.d.ts

@@ -0,0 +1,105 @@
+import type { AuditTrailService } from '../service.js';
+import type { AuditEventDetails, AuthorizationEvidence, Digest, PartyRef } from '../types.js';
+export interface McpAuditContext {
+    actor?: PartyRef;
+    responsibleParty?: PartyRef;
+    authorization?: AuthorizationEvidence;
+    correlationId?: string;
+    causationId?: string;
+}
+export interface McpAuditEventAdapterOptions {
+    includeToolNames?: boolean;
+}
+/** Privacy-minimal translation from MCP lifecycle signals to binding-neutral events. */
+export declare class McpAuditEventAdapter {
+    private readonly trail;
+    private readonly options;
+    constructor(trail: Pick<AuditTrailService, 'record'>, options?: McpAuditEventAdapterOptions);
+    session(phase: Extract<AuditEventDetails, {
+        family: 'session';
+    }>['phase'], input: {
+        succeeded: boolean;
+        reasonCode?: string;
+        context?: McpAuditContext;
+    }): Promise<void>;
+    tool(phase: Extract<AuditEventDetails, {
+        family: 'tool';
+    }>['phase'], input: {
+        toolName: string;
+        outcome: 'succeeded' | 'failed' | 'denied' | 'challenged' | 'unknown';
+        attempt?: string;
+        reasonCode?: string;
+        context?: McpAuditContext;
+    }): Promise<void>;
+    proof(phase: Extract<AuditEventDetails, {
+        family: 'proof';
+    }>['phase'], input: {
+        outcome: 'succeeded' | 'failed';
+        proofDigest?: Digest;
+        verificationCode?: string;
+        context?: McpAuditContext;
+    }): Promise<void>;
+    authorization(phase: Extract<AuditEventDetails, {
+        family: 'authorization';
+    }>['phase'], input: {
+        outcome: 'succeeded' | 'denied' | 'challenged';
+        reasonCode?: string;
+        policyDigest?: Digest;
+        grantRef?: string;
+        context?: McpAuditContext;
+    }): Promise<void>;
+    delegation(phase: Extract<AuditEventDetails, {
+        family: 'delegation';
+    }>['phase'], input: {
+        delegationRef: string;
+        outcome: 'succeeded' | 'failed' | 'denied';
+        reasonCode?: string;
+        parentRef?: string;
+        context?: McpAuditContext;
+    }): Promise<void>;
+    consent(phase: Extract<AuditEventDetails, {
+        family: 'consent';
+    }>['phase'], input: {
+        outcome: 'succeeded' | 'failed' | 'denied' | 'challenged';
+        consentRef?: string;
+        reasonCode?: string;
+        context?: McpAuditContext;
+    }): Promise<void>;
+    key(phase: Extract<AuditEventDetails, {
+        family: 'key';
+    }>['phase'], input: {
+        outcome: 'succeeded' | 'failed';
+        reasonCode?: string;
+        previousSigner?: Extract<AuditEventDetails, {
+            family: 'key';
+        }>['previousSigner'];
+        nextSigner?: Extract<AuditEventDetails, {
+            family: 'key';
+        }>['nextSigner'];
+        configurationDigest?: Digest;
+        context?: McpAuditContext;
+    }): Promise<void>;
+    ledger(phase: Extract<AuditEventDetails, {
+        family: 'ledger';
+    }>['phase'], input: {
+        outcome: 'succeeded' | 'failed';
+        reasonCode?: string;
+        checkpointDigest?: Digest;
+        previousEpochId?: string;
+        previousTerminalCheckpointDigest?: Digest;
+        successorEpochIds?: string[];
+        context?: McpAuditContext;
+    }): Promise<void>;
+    administration(phase: Extract<AuditEventDetails, {
+        family: 'administration';
+    }>['phase'], input: {
+        outcome: 'succeeded' | 'failed' | 'denied';
+        reasonCode?: string;
+        purpose?: string;
+        sourceSequence?: string;
+        selectionDigest?: Digest;
+        context?: McpAuditContext;
+    }): Promise<void>;
+    private context;
+}
+//# sourceMappingURL=mcp.d.ts.map

package/dist/audit/adapters/mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../../src/audit/adapters/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,KAAK,EACV,iBAAiB,EACjB,qBAAqB,EACrB,MAAM,EACN,QAAQ,EACT,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,gBAAgB,CAAC,EAAE,QAAQ,CAAC;IAC5B,aAAa,CAAC,EAAE,qBAAqB,CAAC;IACtC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,2BAA2B;IAC1C,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAMD,wFAAwF;AACxF,qBAAa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,EACxC,OAAO,GAAE,2BAAgC;IAGtD,OAAO,CACX,KAAK,EAAE,OAAO,CAAC,iBAAiB,EAAE;QAAE,MAAM,EAAE,SAAS,CAAA;KAAE,CAAC,CAAC,OAAO,CAAC,EACjE,KAAK,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,eAAe,CAAA;KAAE,GAC5E,OAAO,CAAC,IAAI,CAAC;IAeV,IAAI,CACR,KAAK,EAAE,OAAO,CAAC,iBAAiB,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,OAAO,CAAC,EAC9D,KAAK,EAAE;QACL,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,YAAY,GAAG,SAAS,CAAC;QACtE,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,eAAe,CAAC;KAC3B,GACA,OAAO,CAAC,IAAI,CAAC;IAiBV,KAAK,CACT,KAAK,EAAE,OAAO,CAAC,iBAAiB,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC,OAAO,CAAC,EAC/D,KAAK,EAAE;QACL,OAAO,EAAE,WAAW,GAAG,QAAQ,CAAC;QAChC,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,OAAO,CAAC,EAAE,eAAe,CAAC;KAC3B,GACA,OAAO,CAAC,IAAI,CAAC;IAiBV,aAAa,CACjB,KAAK,EAAE,OAAO,CAAC,iBAAiB,EAAE;QAAE,MAAM,EAAE,eAAe,CAAA;KAAE,CAAC,CAAC,OAAO,CAAC,EACvE,KAAK,EAAE;QACL,OAAO,EAAE,WAAW,GAAG,QAAQ,GAAG,YAAY,CAAC;QAC/C,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,eAAe,CAAC;KAC3B,GACA,OAAO,CAAC,IAAI,CAAC;IAqBV,UAAU,CACd,KAAK,EAAE,OAAO,CAAC,iBAAiB,EAAE;QAAE,MAAM,EAAE,YAAY,CAAA;KAAE,CAAC,CAAC,OAAO,CAAC,EACpE,KAAK,EAAE;QACL,aAAa,EAAE,MAAM,CAAC;QACtB,OAAO,EAAE,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,eAAe,CAAC;KAC3B,GACA,OAAO,CAAC,IAAI,CAAC;IAkBV,OAAO,CACX,KAAK,EAAE,OAAO,CAAC,iBAAiB,EAAE;QAAE,MAAM,EAAE,SAAS,CAAA;KAAE,CAAC,CAAC,OAAO,CAAC,EACjE,KAAK,EAAE;QACL,OAAO,EAAE,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,YAAY,CAAC;QAC1D,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,eAAe,CAAC;KAC3B,GACA,OAAO,CAAC,IAAI,CAAC;IAoBV,GAAG,CACP,KAAK,EAAE,OAAO,CAAC,iBAAiB,EAAE;QAAE,MAAM,EAAE,KAAK,CAAA;KAAE,CAAC,CAAC,OAAO,CAAC,EAC7D,KAAK,EAAE;QACL,OAAO,EAAE,WAAW,GAAG,QAAQ,CAAC;QAChC,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,cAAc,CAAC,EAAE,OAAO,CAAC,iBAAiB,EAAE;YAAE,MAAM,EAAE,KAAK,CAAA;SAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC;QACjF,UAAU,CAAC,EAAE,OAAO,CAAC,iBAAiB,EAAE;YAAE,MAAM,EAAE,KAAK,CAAA;SAAE,CAAC,CAAC,YAAY,CAAC,CAAC;QACzE,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,OAAO,CAAC,EAAE,eAAe,CAAC;KAC3B,GACA,OAAO,CAAC,IAAI,CAAC;IAyBV,MAAM,CACV,KAAK,EAAE,OAAO,CAAC,iBAAiB,EAAE;QAAE,MAAM,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC,OAAO,CAAC,EAChE,KAAK,EAAE;QACL,OAAO,EAAE,WAAW,GAAG,QAAQ,CAAC;QAChC,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gCAAgC,CAAC,EAAE,MAAM,CAAC;QAC1C,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC7B,OAAO,CAAC,EAAE,eAAe,CAAC;KAC3B,GACA,OAAO,CAAC,IAAI,CAAC;IAiCV,cAAc,CAClB,KAAK,EAAE,OAAO,CAAC,iBAAiB,EAAE;QAAE,MAAM,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAC,OAAO,CAAC,EACxE,KAAK,EAAE;QACL,OAAO,EAAE,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,OAAO,CAAC,EAAE,eAAe,CAAC;KAC3B,GACA,OAAO,CAAC,IAAI,CAAC;IA4BhB,OAAO,CAAC,OAAO;CAchB"}

package/dist/audit/adapters/mcp.js

@@ -0,0 +1,213 @@
+function boundedReference(value, maxLength = 256) {
+    return value.slice(0, maxLength);
+}
+/** Privacy-minimal translation from MCP lifecycle signals to binding-neutral events. */
+export class McpAuditEventAdapter {
+    trail;
+    options;
+    constructor(trail, options = {}) {
+        this.trail = trail;
+        this.options = options;
+    }
+    async session(phase, input) {
+        await this.trail.record({
+            eventType: `session.${phase}`,
+            ...this.context(input.context),
+            action: { category: 'session' },
+            outcome: input.succeeded ? 'succeeded' : 'failed',
+            ...(input.reasonCode === undefined ? {} : { reason: { code: input.reasonCode } }),
+            evidence: [],
+            details: {
+                family: 'session', phase,
+                ...(input.reasonCode === undefined ? {} : { reasonCode: input.reasonCode }),
+            },
+        });
+    }
+    async tool(phase, input) {
+        await this.trail.record({
+            eventType: `tool.call.${phase}`,
+            ...this.context(input.context),
+            action: {
+                category: 'tool.call',
+                ...(this.options.includeToolNames
+                    ? { name: boundedReference(input.toolName) }
+                    : {}),
+            },
+            outcome: input.outcome,
+            ...(input.reasonCode === undefined ? {} : { reason: { code: input.reasonCode } }),
+            evidence: [],
+            details: { family: 'tool', phase, attempt: input.attempt ?? '1' },
+        });
+    }
+    async proof(phase, input) {
+        await this.trail.record({
+            eventType: `proof.${phase}`,
+            ...this.context(input.context),
+            action: { category: 'proof' },
+            outcome: input.outcome,
+            evidence: [],
+            details: {
+                family: 'proof', phase,
+                ...(input.proofDigest === undefined ? {} : { proofDigest: input.proofDigest }),
+                ...(input.verificationCode === undefined
+                    ? {}
+                    : { verificationCode: input.verificationCode }),
+            },
+        });
+    }
+    async authorization(phase, input) {
+        const eventType = phase === 'grant_used'
+            ? 'grant.used'
+            : `authorization.${phase}`;
+        await this.trail.record({
+            eventType,
+            ...this.context(input.context),
+            action: { category: 'authorization' },
+            outcome: input.outcome,
+            ...(input.reasonCode === undefined ? {} : { reason: { code: input.reasonCode } }),
+            evidence: [],
+            details: {
+                family: 'authorization', phase,
+                ...(input.policyDigest === undefined ? {} : { policyDigest: input.policyDigest }),
+                ...(input.grantRef === undefined
+                    ? {}
+                    : { grantRef: boundedReference(input.grantRef) }),
+            },
+        });
+    }
+    async delegation(phase, input) {
+        await this.trail.record({
+            eventType: `delegation.${phase}`,
+            ...this.context(input.context),
+            action: { category: 'delegation' },
+            outcome: input.outcome,
+            ...(input.reasonCode === undefined ? {} : { reason: { code: input.reasonCode } }),
+            evidence: [],
+            details: {
+                family: 'delegation', phase,
+                delegationRef: boundedReference(input.delegationRef),
+                ...(input.parentRef === undefined
+                    ? {}
+                    : { parentRef: boundedReference(input.parentRef) }),
+            },
+        });
+    }
+    async consent(phase, input) {
+        const eventType = phase.startsWith('credential_')
+            ? `credential.${phase.slice('credential_'.length)}`
+            : `consent.${phase}`;
+        await this.trail.record({
+            eventType: eventType,
+            ...this.context(input.context),
+            action: { category: 'consent' },
+            outcome: input.outcome,
+            ...(input.reasonCode === undefined ? {} : { reason: { code: input.reasonCode } }),
+            evidence: [],
+            details: {
+                family: 'consent', phase,
+                ...(input.consentRef === undefined
+                    ? {}
+                    : { consentRef: boundedReference(input.consentRef) }),
+            },
+        });
+    }
+    async key(phase, input) {
+        const eventTypes = {
+            rotated: 'key.rotated',
+            policy_changed: 'policy.changed',
+            configuration_changed: 'configuration.changed',
+            integrity_suite_transitioned: 'integrity_suite.transitioned',
+        };
+        await this.trail.record({
+            eventType: eventTypes[phase],
+            ...this.context(input.context),
+            action: { category: 'configuration' },
+            outcome: input.outcome,
+            ...(input.reasonCode === undefined ? {} : { reason: { code: input.reasonCode } }),
+            evidence: [],
+            details: {
+                family: 'key', phase,
+                ...(input.previousSigner === undefined ? {} : { previousSigner: input.previousSigner }),
+                ...(input.nextSigner === undefined ? {} : { nextSigner: input.nextSigner }),
+                ...(input.configurationDigest === undefined
+                    ? {}
+                    : { configurationDigest: input.configurationDigest }),
+            },
+        });
+    }
+    async ledger(phase, input) {
+        const eventTypes = {
+            epoch_started: 'ledger.epoch.started',
+            epoch_transitioned: 'ledger.epoch.transitioned',
+            checkpoint_created: 'checkpoint.created',
+            checkpoint_anchored: 'checkpoint.anchored',
+            checkpoint_anchor_failed: 'checkpoint.anchor_failed',
+            evidence_disposed: 'evidence.disposed',
+            projection_reconciled: 'projection.reconciled',
+        };
+        await this.trail.record({
+            eventType: eventTypes[phase],
+            ...this.context(input.context),
+            action: { category: 'audit.ledger' },
+            outcome: input.outcome,
+            ...(input.reasonCode === undefined ? {} : { reason: { code: input.reasonCode } }),
+            evidence: [],
+            details: {
+                family: 'ledger', phase,
+                ...(input.checkpointDigest === undefined
+                    ? {}
+                    : { checkpointDigest: input.checkpointDigest }),
+                ...(input.previousEpochId === undefined ? {} : { previousEpochId: input.previousEpochId }),
+                ...(input.previousTerminalCheckpointDigest === undefined
+                    ? {}
+                    : { previousTerminalCheckpointDigest: input.previousTerminalCheckpointDigest }),
+                ...(input.successorEpochIds === undefined
+                    ? {}
+                    : { successorEpochIds: input.successorEpochIds }),
+            },
+        });
+    }
+    async administration(phase, input) {
+        const eventTypes = {
+            source_high_water: 'audit.source_high_water',
+            accessed: 'audit.accessed',
+            exported: 'audit.exported',
+            legal_hold_applied: 'legal_hold.applied',
+            retention_executed: 'retention.executed',
+        };
+        await this.trail.record({
+            eventType: eventTypes[phase],
+            ...this.context(input.context),
+            action: { category: 'audit.administration' },
+            outcome: input.outcome,
+            ...(input.reasonCode === undefined ? {} : { reason: { code: input.reasonCode } }),
+            evidence: [],
+            details: {
+                family: 'administration', phase,
+                ...(input.purpose === undefined ? {} : { purpose: input.purpose }),
+                ...(input.sourceSequence === undefined
+                    ? {}
+                    : { sourceSequence: input.sourceSequence }),
+                ...(input.selectionDigest === undefined
+                    ? {}
+                    : { selectionDigest: input.selectionDigest }),
+            },
+        });
+    }
+    context(context) {
+        if (context === undefined)
+            return {};
+        return {
+            ...(context.actor === undefined ? {} : { actor: context.actor }),
+            ...(context.responsibleParty === undefined
+                ? {}
+                : { responsibleParty: context.responsibleParty }),
+            ...(context.authorization === undefined
+                ? {}
+                : { authorization: context.authorization }),
+            ...(context.correlationId === undefined ? {} : { correlationId: context.correlationId }),
+            ...(context.causationId === undefined ? {} : { causationId: context.causationId }),
+        };
+    }
+}
+//# sourceMappingURL=mcp.js.map

package/dist/audit/adapters/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../src/audit/adapters/mcp.ts"],"names":[],"mappings":"AAoBA,SAAS,gBAAgB,CAAC,KAAa,EAAE,SAAS,GAAG,GAAG;IACtD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AACnC,CAAC;AAED,wFAAwF;AACxF,MAAM,OAAO,oBAAoB;IAEZ;IACA;IAFnB,YACmB,KAAwC,EACxC,UAAuC,EAAE;QADzC,UAAK,GAAL,KAAK,CAAmC;QACxC,YAAO,GAAP,OAAO,CAAkC;IACzD,CAAC;IAEJ,KAAK,CAAC,OAAO,CACX,KAAiE,EACjE,KAA6E;QAE7E,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACtB,SAAS,EAAE,WAAW,KAAK,EAA2B;YACtD,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YAC9B,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE;YAC/B,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;YACjD,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;YACjF,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE;gBACP,MAAM,EAAE,SAAS,EAAE,KAAK;gBACxB,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;aAC5E;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CACR,KAA8D,EAC9D,KAMC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACtB,SAAS,EAAE,aAAa,KAAK,EAA2B;YACxD,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YAC9B,MAAM,EAAE;gBACN,QAAQ,EAAE,WAAW;gBACrB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB;oBAC/B,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;oBAC5C,CAAC,CAAC,EAAE,CAAC;aACR;YACD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;YACjF,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,GAAG,EAAE;SAClE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK,CACT,KAA+D,EAC/D,KAKC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACtB,SAAS,EAAE,SAAS,KAAK,EAAuB;YAChD,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YAC9B,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE;YAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,EAAE,KAAK;gBACtB,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC9E,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS;oBACtC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC;aAClD;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,KAAuE,EACvE,KAMC;QAED,MAAM,SAAS,GAAG,KAAK,KAAK,YAAY;YACtC,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,iBAAiB,KAAK,EAAW,CAAC;QACtC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACtB,SAAS;YACT,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YAC9B,MAAM,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE;YACrC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;YACjF,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE;gBACP,MAAM,EAAE,eAAe,EAAE,KAAK;gBAC9B,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;gBACjF,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS;oBAC9B,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;aACpD;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CACd,KAAoE,EACpE,KAMC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACtB,SAAS,EAAE,cAAc,KAAK,EAA2B;YACzD,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YAC9B,MAAM,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE;YAClC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;YACjF,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE;gBACP,MAAM,EAAE,YAAY,EAAE,KAAK;gBAC3B,aAAa,EAAE,gBAAgB,CAAC,KAAK,CAAC,aAAa,CAAC;gBACpD,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS;oBAC/B,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,SAAS,EAAE,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;aACtD;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CACX,KAAiE,EACjE,KAKC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC;YAC/C,CAAC,CAAC,cAAc,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE;YACnD,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACtB,SAAS,EAAE,SAAgC;YAC3C,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YAC9B,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE;YAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;YACjF,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE;gBACP,MAAM,EAAE,SAAS,EAAE,KAAK;gBACxB,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS;oBAChC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,UAAU,EAAE,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;aACxD;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,CACP,KAA6D,EAC7D,KAOC;QAED,MAAM,UAAU,GAAG;YACjB,OAAO,EAAE,aAAa;YACtB,cAAc,EAAE,gBAAgB;YAChC,qBAAqB,EAAE,uBAAuB;YAC9C,4BAA4B,EAAE,8BAA8B;SACpD,CAAC;QACX,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACtB,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC;YAC5B,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YAC9B,MAAM,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE;YACrC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;YACjF,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE;gBACP,MAAM,EAAE,KAAK,EAAE,KAAK;gBACpB,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC;gBACvF,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;gBAC3E,GAAG,CAAC,KAAK,CAAC,mBAAmB,KAAK,SAAS;oBACzC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,EAAE,CAAC;aACxD;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CACV,KAAgE,EAChE,KAQC;QAED,MAAM,UAAU,GAAG;YACjB,aAAa,EAAE,sBAAsB;YACrC,kBAAkB,EAAE,2BAA2B;YAC/C,kBAAkB,EAAE,oBAAoB;YACxC,mBAAmB,EAAE,qBAAqB;YAC1C,wBAAwB,EAAE,0BAA0B;YACpD,iBAAiB,EAAE,mBAAmB;YACtC,qBAAqB,EAAE,uBAAuB;SACtC,CAAC;QACX,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACtB,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC;YAC5B,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YAC9B,MAAM,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;YACjF,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE;gBACP,MAAM,EAAE,QAAQ,EAAE,KAAK;gBACvB,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS;oBACtC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC;gBACjD,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;gBAC1F,GAAG,CAAC,KAAK,CAAC,gCAAgC,KAAK,SAAS;oBACtD,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,gCAAgC,EAAE,KAAK,CAAC,gCAAgC,EAAE,CAAC;gBACjF,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS;oBACvC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC;aACpD;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,KAAwE,EACxE,KAOC;QAED,MAAM,UAAU,GAAG;YACjB,iBAAiB,EAAE,yBAAyB;YAC5C,QAAQ,EAAE,gBAAgB;YAC1B,QAAQ,EAAE,gBAAgB;YAC1B,kBAAkB,EAAE,oBAAoB;YACxC,kBAAkB,EAAE,oBAAoB;SAChC,CAAC;QACX,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACtB,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC;YAC5B,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YAC9B,MAAM,EAAE,EAAE,QAAQ,EAAE,sBAAsB,EAAE;YAC5C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;YACjF,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE;gBACP,MAAM,EAAE,gBAAgB,EAAE,KAAK;gBAC/B,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClE,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS;oBACpC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC;gBAC7C,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS;oBACrC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;aAChD;SACF,CAAC,CAAC;IACL,CAAC;IAEO,OAAO,CAAC,OAAoC;QAClD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACrC,OAAO;YACL,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;YAChE,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;YACnD,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;YAC7C,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;YACxF,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;SACnF,CAAC;IACJ,CAAC;CACF"}

package/dist/audit/assurance.d.ts

@@ -0,0 +1,22 @@
+export type AuditAssuranceProfile = 'AAP-0' | 'AAP-1' | 'AAP-2' | 'AAP-3' | 'AAP-4';
+export type AuditDeliveryMode = 'best-effort' | 'buffered' | 'required';
+export type AuditSupportingAnchor = 'worm' | 'rfc3161' | 'scitt';
+export interface AuditCapabilities {
+    profile: AuditAssuranceProfile;
+    recorderTopology: 'none' | 'self-hosted' | 'managed' | 'verified-mirror';
+    delivery: AuditDeliveryMode;
+    journalDurability: 'none' | 'ephemeral' | 'durable';
+    atomicAppend: boolean;
+    sourceHighWater: boolean;
+    merkleCheckpoints: boolean;
+    independentObservation: boolean;
+    supportingAnchors: AuditSupportingAnchor[];
+    evidenceRetention: 'none' | 'inline' | 'separate';
+}
+export declare const AUDIT_ASSURANCE_PROFILES: Readonly<Record<AuditAssuranceProfile, {
+    name: string;
+    claim: string;
+}>>;
+/** Fail startup when advertised assurance exceeds configured mechanics. */
+export declare function assertAuditCapabilities(capabilities: AuditCapabilities): void;
+//# sourceMappingURL=assurance.d.ts.map

package/dist/audit/assurance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assurance.d.ts","sourceRoot":"","sources":["../../src/audit/assurance.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AACpF,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG,UAAU,GAAG,UAAU,CAAC;AACxE,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;AAEjE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,gBAAgB,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,GAAG,iBAAiB,CAAC;IACzE,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,iBAAiB,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAAC;IACpD,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,sBAAsB,EAAE,OAAO,CAAC;IAChC,iBAAiB,EAAE,qBAAqB,EAAE,CAAC;IAC3C,iBAAiB,EAAE,MAAM,GAAG,QAAQ,GAAG,UAAU,CAAC;CACnD;AAED,eAAO,MAAM,wBAAwB,EAAE,QAAQ,CAAC,MAAM,CAAC,qBAAqB,EAAE;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf,CAAC,CAMA,CAAC;AAEH,2EAA2E;AAC3E,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,iBAAiB,GAAG,IAAI,CA4B7E"}

package/dist/audit/assurance.js

@@ -0,0 +1,39 @@
+export const AUDIT_ASSURANCE_PROFILES = Object.freeze({
+    'AAP-0': { name: 'None', claim: 'No audit assurance' },
+    'AAP-1': { name: 'Recorded', claim: 'Structured capture of delivered instrumented events' },
+    'AAP-2': { name: 'Chained', claim: 'Ordered tamper-evident accepted history for a declared scope' },
+    'AAP-3': { name: 'Transparent', claim: 'Efficient inclusion, consistency, and declared source-gap evidence' },
+    'AAP-4': { name: 'Observed', claim: 'Conflicting observed views are detectable relative to independently known checkpoints' },
+});
+/** Fail startup when advertised assurance exceeds configured mechanics. */
+export function assertAuditCapabilities(capabilities) {
+    const level = Number(capabilities.profile.slice(-1));
+    if (level === 0)
+        return;
+    if (capabilities.recorderTopology === 'none' || capabilities.journalDurability === 'none') {
+        throw new Error(`${capabilities.profile} requires an audit recorder or verified mirror`);
+    }
+    if (level >= 2) {
+        if (capabilities.journalDurability !== 'durable') {
+            throw new Error(`${capabilities.profile} requires a durable journal`);
+        }
+        if (!capabilities.atomicAppend) {
+            throw new Error(`${capabilities.profile} requires atomic append`);
+        }
+        if (capabilities.delivery === 'best-effort') {
+            throw new Error(`${capabilities.profile} cannot use best-effort delivery`);
+        }
+    }
+    if (level >= 3 && (!capabilities.merkleCheckpoints || !capabilities.sourceHighWater)) {
+        throw new Error(`${capabilities.profile} requires Merkle checkpoints and source high-water evidence`);
+    }
+    if (level >= 4) {
+        if (!capabilities.independentObservation) {
+            throw new Error('AAP-4 requires independent observation with authenticated comparison/gossip');
+        }
+        if (capabilities.supportingAnchors.length === 0) {
+            throw new Error('AAP-4 requires at least one supporting checkpoint receipt');
+        }
+    }
+}
+//# sourceMappingURL=assurance.js.map

package/dist/audit/assurance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assurance.js","sourceRoot":"","sources":["../../src/audit/assurance.ts"],"names":[],"mappings":"AAiBA,MAAM,CAAC,MAAM,wBAAwB,GAG/B,MAAM,CAAC,MAAM,CAAC;IAClB,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,EAAE;IACtD,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,qDAAqD,EAAE;IAC3F,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,8DAA8D,EAAE;IACnG,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,oEAAoE,EAAE;IAC7G,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,uFAAuF,EAAE;CAC9H,CAAC,CAAC;AAEH,2EAA2E;AAC3E,MAAM,UAAU,uBAAuB,CAAC,YAA+B;IACrE,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO;IACxB,IAAI,YAAY,CAAC,gBAAgB,KAAK,MAAM,IAAI,YAAY,CAAC,iBAAiB,KAAK,MAAM,EAAE,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,GAAG,YAAY,CAAC,OAAO,gDAAgD,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,IAAI,YAAY,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,GAAG,YAAY,CAAC,OAAO,6BAA6B,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,GAAG,YAAY,CAAC,OAAO,yBAAyB,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,YAAY,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,GAAG,YAAY,CAAC,OAAO,kCAAkC,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,iBAAiB,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,KAAK,CAAC,GAAG,YAAY,CAAC,OAAO,6DAA6D,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,IAAI,CAAC,YAAY,CAAC,sBAAsB,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,YAAY,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/audit/checkpoint-coordinator.d.ts

@@ -0,0 +1,51 @@
+import type { AuditAnchorProvider } from './providers/anchor.js';
+import type { AuditCheckpointObserverProvider } from './providers/observer.js';
+import type { AuditAnchorReceipt, AuditLedgerRef, AuditObservationReceiptV1, SignedAuditCheckpointV1 } from './types.js';
+export interface AuditCheckpointCreator {
+    createCheckpoint(ledger: AuditLedgerRef): Promise<SignedAuditCheckpointV1>;
+}
+export interface AuditCheckpointPublicationFailure {
+    role: 'observer' | 'anchor';
+    providerIndex: number;
+    kind?: AuditAnchorReceipt['kind'];
+    attempts: number;
+    error: unknown;
+}
+export interface AuditCheckpointPublicationResult {
+    checkpoint: SignedAuditCheckpointV1;
+    observations: AuditObservationReceiptV1[];
+    anchors: AuditAnchorReceipt[];
+    failures: AuditCheckpointPublicationFailure[];
+}
+export interface AuditCheckpointCoordinatorOptions {
+    checkpoints: AuditCheckpointCreator;
+    observers?: readonly AuditCheckpointObserverProvider[];
+    anchors?: readonly AuditAnchorProvider[];
+    requirements?: {
+        minimumObservers: number;
+        requiredAnchorKinds: readonly AuditAnchorReceipt['kind'][];
+    };
+    maxPublishAttempts?: number;
+    backoff?: (input: {
+        role: AuditCheckpointPublicationFailure['role'];
+        providerIndex: number;
+        attempt: number;
+        error: unknown;
+    }) => Promise<void>;
+    onPublished?: (result: AuditCheckpointPublicationResult) => Promise<void> | void;
+}
+/**
+ * Coordinates post-commit checkpoint publication. A failed publication never
+ * rolls back or rewrites the already signed checkpoint.
+ */
+export declare class AuditCheckpointCoordinator {
+    private readonly options;
+    private readonly observers;
+    private readonly anchors;
+    private readonly maxAttempts;
+    constructor(options: AuditCheckpointCoordinatorOptions);
+    createAndPublish(ledger: AuditLedgerRef): Promise<AuditCheckpointPublicationResult>;
+    private publishWithRetry;
+    private assertRequirements;
+}
+//# sourceMappingURL=checkpoint-coordinator.d.ts.map

package/dist/audit/checkpoint-coordinator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpoint-coordinator.d.ts","sourceRoot":"","sources":["../../src/audit/checkpoint-coordinator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,KAAK,EACV,kBAAkB,EAClB,cAAc,EACd,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,sBAAsB;IACrC,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC5E;AAED,MAAM,WAAW,iCAAiC;IAChD,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,gCAAgC;IAC/C,UAAU,EAAE,uBAAuB,CAAC;IACpC,YAAY,EAAE,yBAAyB,EAAE,CAAC;IAC1C,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,QAAQ,EAAE,iCAAiC,EAAE,CAAC;CAC/C;AAED,MAAM,WAAW,iCAAiC;IAChD,WAAW,EAAE,sBAAsB,CAAC;IACpC,SAAS,CAAC,EAAE,SAAS,+BAA+B,EAAE,CAAC;IACvD,OAAO,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACzC,YAAY,CAAC,EAAE;QACb,gBAAgB,EAAE,MAAM,CAAC;QACzB,mBAAmB,EAAE,SAAS,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;KAC5D,CAAC;IACF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE;QAChB,IAAI,EAAE,iCAAiC,CAAC,MAAM,CAAC,CAAC;QAChD,aAAa,EAAE,MAAM,CAAC;QACtB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,OAAO,CAAC;KAChB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpB,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,gCAAgC,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAClF;AAED;;;GAGG;AACH,qBAAa,0BAA0B;IAKzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6C;IACvE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;IACzD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAER,OAAO,EAAE,iCAAiC;IAqBjE,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,gCAAgC,CAAC;YAqC3E,gBAAgB;IAgD9B,OAAO,CAAC,kBAAkB;CAwB3B"}