@kya-os/mcp 1.10.1 → 1.11.0

package/dist/audit/recorder-service.d.ts

@@ -0,0 +1,78 @@
+import { type AuditHasher, type AuditSigner } from './crypto.js';
+import type { AuditEvidenceProvider } from './providers/evidence.js';
+import type { AuditJournalProvider } from './providers/journal.js';
+import type { AuditRecorderSubmission } from './providers/recorder-client.js';
+import type { Digest, PartyRef, ProtocolBindingId, SignedAuditEntryV1 } from './types.js';
+export interface AuditClock {
+    now(): number;
+}
+export interface AuthenticatedAuditSubmissionContext {
+    producerAuthority: string;
+    tenantAuthority: string;
+    /** Exact authenticated producer binding for non-public or non-DID identifiers. */
+    producerRef?: PartyRef;
+    /** Exact authenticated tenant binding for opaque or commitment-based tenant identifiers. */
+    tenantRef?: PartyRef;
+}
+export interface AuditSubmissionAuthorizer {
+    authorize(input: {
+        submission: AuditRecorderSubmission;
+        context: AuthenticatedAuditSubmissionContext;
+    }): Promise<boolean> | boolean;
+}
+/**
+ * Authoritative epoch-transition port. A successful result means the predecessor terminal
+ * checkpoint was verified and the predecessor epoch was atomically sealed against new appends.
+ * Implementations must be idempotent for identical transition inputs.
+ */
+export interface AuditEpochTransitionGuard {
+    verifyAndSeal(input: {
+        ledgerId: string;
+        previousEpochId: string;
+        nextEpochId: string;
+        previousTerminalCheckpointDigest: Digest;
+    }): Promise<boolean>;
+}
+export interface AuditRecorderServiceConfig {
+    ledgerId: string;
+    ledgerEpochId: string;
+    tenantRef: PartyRef;
+    binding: ProtocolBindingId;
+    sourceId: string;
+    journal: AuditJournalProvider;
+    signer: AuditSigner;
+    hasher: AuditHasher;
+    clock: AuditClock;
+    evidence?: AuditEvidenceProvider;
+    authorizer?: AuditSubmissionAuthorizer;
+    previousEpochId?: string;
+    previousTerminalCheckpointDigest?: Digest;
+    epochTransitionGuard?: AuditEpochTransitionGuard;
+    maxAppendConflicts?: number;
+}
+export declare class AuditRecorderService {
+    private readonly config;
+    private readonly maxAppendConflicts;
+    private initialization?;
+    constructor(config: AuditRecorderServiceConfig);
+    submitAuthenticated(submission: AuditRecorderSubmission, context: AuthenticatedAuditSubmissionContext): Promise<SignedAuditEntryV1>;
+    /**
+     * Best-effort compensation for write-ahead evidence whose append failed: the
+     * ciphertext is disposed only after re-confirming that no committed entry
+     * claims this event identity, so a raced idempotent commit is never stripped
+     * of its evidence. Failures here leave orphans for operator retention tooling.
+     */
+    private disposeUncommittedEvidence;
+    private validateSubmissionEnvelope;
+    private validateEventAuthority;
+    private persistSubmittedEvidence;
+    private ensureInitialized;
+    private validateExistingGenesis;
+    private genesisEvent;
+    private appendEvent;
+    private identifyEvent;
+    private resolveDuplicate;
+    private buildCandidate;
+    private ledgerRef;
+}
+//# sourceMappingURL=recorder-service.d.ts.map

package/dist/audit/recorder-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recorder-service.d.ts","sourceRoot":"","sources":["../../src/audit/recorder-service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkB,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AASjF,OAAO,KAAK,EAAE,qBAAqB,EAA0B,MAAM,yBAAyB,CAAC;AAC7F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAS9E,OAAO,KAAK,EAIV,MAAM,EACN,QAAQ,EACR,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,UAAU;IACzB,GAAG,IAAI,MAAM,CAAC;CACf;AAED,MAAM,WAAW,mCAAmC;IAClD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,kFAAkF;IAClF,WAAW,CAAC,EAAE,QAAQ,CAAC;IACvB,4FAA4F;IAC5F,SAAS,CAAC,EAAE,QAAQ,CAAC;CACtB;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,CAAC,KAAK,EAAE;QACf,UAAU,EAAE,uBAAuB,CAAC;QACpC,OAAO,EAAE,mCAAmC,CAAC;KAC9C,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CAChC;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,aAAa,CAAC,KAAK,EAAE;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,MAAM,CAAC;QACpB,gCAAgC,EAAE,MAAM,CAAC;KAC1C,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,QAAQ,CAAC;IACpB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,oBAAoB,CAAC;IAC9B,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,UAAU,CAAC;IAClB,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC,UAAU,CAAC,EAAE,yBAAyB,CAAC;IACvC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gCAAgC,CAAC,EAAE,MAAM,CAAC;IAC1C,oBAAoB,CAAC,EAAE,yBAAyB,CAAC;IACjD,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AA+BD,qBAAa,oBAAoB;IAInB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAHnC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,cAAc,CAAC,CAA8B;gBAExB,MAAM,EAAE,0BAA0B;IAiBzD,mBAAmB,CACvB,UAAU,EAAE,uBAAuB,EACnC,OAAO,EAAE,mCAAmC,GAC3C,OAAO,CAAC,kBAAkB,CAAC;IAqC9B;;;;;OAKG;YACW,0BAA0B;IAwBxC,OAAO,CAAC,0BAA0B;IAelC,OAAO,CAAC,sBAAsB;YAuBhB,wBAAwB;YAuCxB,iBAAiB;IAuC/B,OAAO,CAAC,uBAAuB;IAgC/B,OAAO,CAAC,YAAY;YAiCN,WAAW;YAwEX,aAAa;IAkB3B,OAAO,CAAC,gBAAgB;YAWV,cAAc;IAuC5B,OAAO,CAAC,SAAS;CAMlB"}

package/dist/audit/recorder-service.js

@@ -0,0 +1,331 @@
+import { canonicalizeJson, canonicalizeJsonBytes } from '../utils/canonical-json.js';
+import { AUDIT_ERROR_CODES, AuditProtocolError } from './errors.js';
+import { hashAuditValue } from './crypto.js';
+import { AUDIT_DIGEST_DOMAINS, buildAuditRecorderReceiptCore, collectAuditEvidenceRefs, digestAuditEntry, digestAuditEvidenceManifest, digestAuditEvent, } from './integrity.js';
+import { AUDIT_ENTRY_SCHEMA_ID, AUDIT_EVENT_SCHEMA_ID, AUDIT_INTEGRITY_SUITE, parseAuditEntryCore, parseAuditProducerEvent, parseSignedAuditEntry, } from './schemas.js';
+function deepFreeze(value) {
+    if (typeof value !== 'object' || value === null || Object.isFrozen(value))
+        return value;
+    for (const child of Object.values(value))
+        deepFreeze(child);
+    return Object.freeze(value);
+}
+function sameHead(left, right) {
+    if (left === null || right === null)
+        return left === right;
+    return left.entryDigest === right.entryDigest && left.sequence === right.sequence;
+}
+function sameSigner(left, right) {
+    return left.did === right.did && left.kid === right.kid && left.alg === right.alg;
+}
+function sameParty(left, right) {
+    return canonicalizeJson(left) === canonicalizeJson(right);
+}
+function authorityMatchesParty(authority, boundRef, claimedRef) {
+    if (boundRef !== undefined)
+        return sameParty(boundRef, claimedRef);
+    return (claimedRef.kind === 'public_did' || claimedRef.kind === 'pairwise_did') &&
+        claimedRef.did === authority;
+}
+export class AuditRecorderService {
+    config;
+    maxAppendConflicts;
+    initialization;
+    constructor(config) {
+        this.config = config;
+        if ((config.previousEpochId === undefined) !==
+            (config.previousTerminalCheckpointDigest === undefined)) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.INVALID_CONFIGURATION, 'Previous epoch ID and terminal checkpoint digest must be supplied together');
+        }
+        if (config.previousEpochId !== undefined && config.epochTransitionGuard === undefined) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.INVALID_CONFIGURATION, 'Epoch transitions require an authoritative verify-and-seal guard');
+        }
+        this.maxAppendConflicts = config.maxAppendConflicts ?? 256;
+    }
+    async submitAuthenticated(submission, context) {
+        this.validateSubmissionEnvelope(submission, context);
+        const producerEvent = parseAuditProducerEvent(submission.producerEvent);
+        this.validateEventAuthority(producerEvent, context);
+        if (this.config.authorizer !== undefined &&
+            !(await this.config.authorizer.authorize({ submission, context }))) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.UNAUTHORIZED_SUBMISSION, 'Audit producer is not authorized for this ledger');
+        }
+        const identity = await this.identifyEvent(producerEvent, context);
+        const duplicate = await this.config.journal.getByIdempotencyKey(this.config.ledgerId, identity.idempotencyKey);
+        if (duplicate !== null)
+            return this.resolveDuplicate(duplicate, identity.eventDigest);
+        // Only a new append must target the active epoch. Logical-ledger idempotency
+        // is resolved first so a redelivered submission pinned to a retained earlier
+        // epoch returns its original entry instead of wedging on EPOCH_MISMATCH.
+        if (submission.expectedLedgerEpochId !== undefined &&
+            submission.expectedLedgerEpochId !== this.config.ledgerEpochId) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.EPOCH_MISMATCH, 'Wrong audit ledger epoch');
+        }
+        await this.ensureInitialized();
+        await this.persistSubmittedEvidence(submission.encryptedEvidence, producerEvent);
+        try {
+            return await this.appendEvent(producerEvent, context, false, identity);
+        }
+        catch (error) {
+            await this.disposeUncommittedEvidence(submission.encryptedEvidence, identity);
+            throw error;
+        }
+    }
+    /**
+     * Best-effort compensation for write-ahead evidence whose append failed: the
+     * ciphertext is disposed only after re-confirming that no committed entry
+     * claims this event identity, so a raced idempotent commit is never stripped
+     * of its evidence. Failures here leave orphans for operator retention tooling.
+     */
+    async disposeUncommittedEvidence(evidence, identity) {
+        if (evidence.length === 0 || this.config.evidence === undefined)
+            return;
+        try {
+            const committed = await this.config.journal.getByIdempotencyKey(this.config.ledgerId, identity.idempotencyKey);
+            if (committed !== null)
+                return;
+            for (const item of evidence) {
+                await this.config.evidence.applyRetention({
+                    kind: 'dispose',
+                    ref: item.ref,
+                    authorizedBy: 'audit-recorder',
+                    reason: 'append_failed_uncommitted',
+                });
+            }
+        }
+        catch {
+            // Retaining an orphan is preferable to disposing racing committed evidence.
+        }
+    }
+    validateSubmissionEnvelope(submission, context) {
+        if (!context.producerAuthority || !context.tenantAuthority) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.UNAUTHORIZED_SUBMISSION, 'Authenticated producer and tenant authority are required');
+        }
+        if (submission.ledgerId !== this.config.ledgerId) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.LEDGER_MISMATCH, 'Wrong audit ledger');
+        }
+    }
+    validateEventAuthority(event, context) {
+        if (!authorityMatchesParty(context.producerAuthority, context.producerRef, event.source.producer)) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.UNAUTHORIZED_SUBMISSION, 'Event producer does not match the authenticated producer authority');
+        }
+        if (!sameParty(event.tenantRef, this.config.tenantRef) ||
+            !authorityMatchesParty(context.tenantAuthority, context.tenantRef, event.tenantRef)) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.UNAUTHORIZED_SUBMISSION, 'Event tenant does not match the authenticated tenant authority');
+        }
+    }
+    async persistSubmittedEvidence(evidence, event) {
+        if (evidence.length === 0)
+            return;
+        if (this.config.evidence === undefined) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.EVIDENCE_FAILURE, 'Encrypted evidence was submitted but no evidence provider is configured');
+        }
+        try {
+            const refs = new Map(collectAuditEvidenceRefs(event).map((ref) => [ref.objectId, ref]));
+            const submitted = new Set();
+            for (const item of evidence) {
+                const referenced = refs.get(item.ref.objectId);
+                if (submitted.has(item.ref.objectId) || referenced === undefined ||
+                    canonicalizeJson(referenced) !== canonicalizeJson(item.ref)) {
+                    throw new AuditProtocolError(AUDIT_ERROR_CODES.EVIDENCE_FAILURE, 'Submitted evidence does not exactly match a unique frozen event reference', { objectId: item.ref.objectId });
+                }
+                submitted.add(item.ref.objectId);
+                await this.config.evidence.putIfAbsent(item);
+            }
+        }
+        catch (error) {
+            if (error instanceof AuditProtocolError &&
+                error.code === AUDIT_ERROR_CODES.EVIDENCE_FAILURE)
+                throw error;
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.EVIDENCE_FAILURE, 'Required evidence could not be persisted', undefined, { cause: error });
+        }
+    }
+    async ensureInitialized() {
+        const ledger = this.ledgerRef();
+        const existingHead = await this.config.journal.getHead(ledger);
+        if (existingHead !== null) {
+            const first = this.config.journal.readRange({ ...ledger, limit: 1 });
+            for await (const entry of first)
+                return this.validateExistingGenesis(entry);
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.JOURNAL_FAILURE, 'Ledger head exists without genesis');
+        }
+        if (this.config.previousEpochId !== undefined) {
+            const verifiedAndSealed = await this.config.epochTransitionGuard.verifyAndSeal({
+                ledgerId: this.config.ledgerId,
+                previousEpochId: this.config.previousEpochId,
+                nextEpochId: this.config.ledgerEpochId,
+                previousTerminalCheckpointDigest: this.config.previousTerminalCheckpointDigest,
+            });
+            if (!verifiedAndSealed) {
+                throw new AuditProtocolError(AUDIT_ERROR_CODES.INVALID_CONFIGURATION, 'Predecessor checkpoint could not be verified and sealed');
+            }
+        }
+        this.initialization ??= this.appendEvent(this.genesisEvent(), {
+            producerAuthority: this.config.signer.ref.did,
+            tenantAuthority: 'audit-recorder',
+            producerRef: { kind: 'public_did', did: this.config.signer.ref.did },
+            tenantRef: this.config.tenantRef,
+        }, true).finally(() => {
+            this.initialization = undefined;
+        });
+        return this.initialization;
+    }
+    validateExistingGenesis(candidate) {
+        try {
+            const entry = parseSignedAuditEntry(candidate);
+            const details = entry.core.event.details;
+            const valid = entry.core.sequence === '0' &&
+                entry.core.previousEntryDigest === null &&
+                entry.core.ledgerId === this.config.ledgerId &&
+                entry.core.ledgerEpochId === this.config.ledgerEpochId &&
+                sameSigner(entry.core.recorder, this.config.signer.ref) &&
+                entry.core.event.eventType === 'ledger.epoch.started' &&
+                entry.core.event.binding === this.config.binding &&
+                entry.core.event.source.sourceId === this.config.sourceId &&
+                entry.core.event.source.producer.kind === 'public_did' &&
+                entry.core.event.source.producer.did === this.config.signer.ref.did &&
+                sameParty(entry.core.event.tenantRef, this.config.tenantRef) &&
+                details.family === 'ledger' &&
+                details.phase === 'epoch_started' &&
+                details.previousEpochId === this.config.previousEpochId &&
+                details.previousTerminalCheckpointDigest ===
+                    this.config.previousTerminalCheckpointDigest;
+            if (!valid)
+                throw new Error('Genesis does not match recorder epoch configuration');
+            return entry;
+        }
+        catch (error) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.JOURNAL_FAILURE, 'Existing ledger genesis does not match the authoritative recorder configuration', undefined, { cause: error });
+        }
+    }
+    genesisEvent() {
+        return parseAuditProducerEvent({
+            schema: AUDIT_EVENT_SCHEMA_ID,
+            eventId: `genesis:${this.config.ledgerId}:${this.config.ledgerEpochId}`,
+            eventType: 'ledger.epoch.started',
+            eventVersion: '1.0.0',
+            binding: this.config.binding,
+            occurredAt: this.config.clock.now(),
+            tenantRef: this.config.tenantRef,
+            source: {
+                producer: { kind: 'public_did', did: this.config.signer.ref.did },
+                sourceId: this.config.sourceId,
+                sourceSequence: '0',
+            },
+            resource: { kind: 'public_did', did: this.config.signer.ref.did },
+            action: { category: 'ledger.epoch' },
+            outcome: 'succeeded',
+            evidence: [],
+            details: {
+                family: 'ledger',
+                phase: 'epoch_started',
+                ...(this.config.previousEpochId
+                    ? {
+                        previousEpochId: this.config.previousEpochId,
+                        previousTerminalCheckpointDigest: this.config.previousTerminalCheckpointDigest,
+                    }
+                    : {}),
+            },
+            privacy: { classification: 'internal', retentionClass: 'integrity-ledger' },
+        });
+    }
+    async appendEvent(event, context, genesis = false, knownIdentity) {
+        const { eventDigest, idempotencyKey } = knownIdentity ??
+            await this.identifyEvent(event, context);
+        const duplicate = await this.config.journal.getByIdempotencyKey(this.config.ledgerId, idempotencyKey);
+        if (duplicate !== null) {
+            // A raced replica genesis differs only in recorder-authored timing, so it
+            // resolves through epoch-configuration validation, not content identity.
+            return genesis
+                ? this.validateExistingGenesis(duplicate)
+                : this.resolveDuplicate(duplicate, eventDigest);
+        }
+        const ledger = this.ledgerRef();
+        for (let attempt = 0; attempt <= this.maxAppendConflicts; attempt += 1) {
+            const head = await this.config.journal.getHead(ledger);
+            if (genesis && head !== null) {
+                const raced = await this.config.journal.getByIdempotencyKey(this.config.ledgerId, idempotencyKey);
+                if (raced !== null)
+                    return this.validateExistingGenesis(raced);
+            }
+            const candidate = await this.buildCandidate(event, eventDigest, head, genesis);
+            let result;
+            try {
+                result = await this.config.journal.compareAndAppend({
+                    ledger,
+                    expectedHead: head,
+                    entry: candidate,
+                    idempotencyKey,
+                });
+            }
+            catch (error) {
+                throw new AuditProtocolError(AUDIT_ERROR_CODES.JOURNAL_FAILURE, 'Audit journal append failed', undefined, { cause: error });
+            }
+            if (result.kind === 'appended' || result.kind === 'duplicate') {
+                return result.kind === 'duplicate'
+                    ? this.resolveDuplicate(result.entry, eventDigest)
+                    : result.entry;
+            }
+            if (result.kind === 'idempotency_conflict') {
+                return this.resolveDuplicate(result.existing, eventDigest);
+            }
+            if (sameHead(head, result.actualHead)) {
+                throw new AuditProtocolError(AUDIT_ERROR_CODES.JOURNAL_FAILURE, 'Audit journal reported a head conflict without advancing its head');
+            }
+        }
+        throw new AuditProtocolError(AUDIT_ERROR_CODES.APPEND_CONFLICT_EXHAUSTED, 'Audit append conflict retry budget exhausted');
+    }
+    async identifyEvent(event, context) {
+        const eventDigest = await digestAuditEvent(this.config.hasher, event);
+        const idempotencyKey = await hashAuditValue(this.config.hasher, AUDIT_DIGEST_DOMAINS.idempotency, {
+            ledgerId: this.config.ledgerId,
+            producerAuthority: context.producerAuthority,
+            sourceId: event.source.sourceId,
+            eventId: event.eventId,
+        });
+        return { eventDigest, idempotencyKey };
+    }
+    resolveDuplicate(existing, digest) {
+        if (existing.eventDigest !== digest) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.EVENT_ID_CONFLICT, 'Authenticated producer event identity was reused with different content', { eventId: existing.core.event.eventId });
+        }
+        return existing;
+    }
+    async buildCandidate(event, eventDigest, head, genesis) {
+        const sequence = head === null ? '0' : (BigInt(head.sequence) + 1n).toString();
+        if (genesis !== (sequence === '0')) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.JOURNAL_FAILURE, genesis ? 'Genesis must be the first epoch entry' : 'Producer event cannot replace genesis');
+        }
+        const recordedAt = this.config.clock.now();
+        const evidenceManifestDigest = await digestAuditEvidenceManifest(this.config.hasher, event);
+        const core = parseAuditEntryCore({
+            schema: AUDIT_ENTRY_SCHEMA_ID,
+            ledgerId: this.config.ledgerId,
+            ledgerEpochId: this.config.ledgerEpochId,
+            sequence,
+            previousEntryDigest: head?.entryDigest ?? null,
+            recordedAt,
+            recorder: this.config.signer.ref,
+            eventDigest,
+            event,
+            evidenceManifestDigest,
+            integritySuite: AUDIT_INTEGRITY_SUITE,
+        });
+        const entryDigest = await digestAuditEntry(this.config.hasher, core);
+        const receiptCore = buildAuditRecorderReceiptCore(core, entryDigest);
+        const jws = await this.config.signer.sign(canonicalizeJsonBytes(receiptCore));
+        return deepFreeze({
+            core,
+            eventDigest,
+            entryDigest,
+            recorderReceipt: { core: receiptCore, jws },
+        });
+    }
+    ledgerRef() {
+        return {
+            ledgerId: this.config.ledgerId,
+            ledgerEpochId: this.config.ledgerEpochId,
+        };
+    }
+}
+//# sourceMappingURL=recorder-service.js.map

package/dist/audit/recorder-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recorder-service.js","sourceRoot":"","sources":["../../src/audit/recorder-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,cAAc,EAAsC,MAAM,aAAa,CAAC;AACjF,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,wBAAwB,EACxB,gBAAgB,EAChB,2BAA2B,EAC3B,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AA+DtB,SAAS,UAAU,CAAI,KAAQ;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,QAAQ,CAAC,IAAsB,EAAE,KAAuB;IAC/D,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,KAAK,KAAK,CAAC;IAC3D,OAAO,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC;AACpF,CAAC;AAED,SAAS,UAAU,CAAC,IAAwB,EAAE,KAAyB;IACrE,OAAO,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC;AACpF,CAAC;AAED,SAAS,SAAS,CAAC,IAAc,EAAE,KAAe;IAChD,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,qBAAqB,CAC5B,SAAiB,EACjB,QAA8B,EAC9B,UAAoB;IAEpB,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACnE,OAAO,CAAC,UAAU,CAAC,IAAI,KAAK,YAAY,IAAI,UAAU,CAAC,IAAI,KAAK,cAAc,CAAC;QAC7E,UAAU,CAAC,GAAG,KAAK,SAAS,CAAC;AACjC,CAAC;AAED,MAAM,OAAO,oBAAoB;IAIF;IAHZ,kBAAkB,CAAS;IACpC,cAAc,CAA+B;IAErD,YAA6B,MAAkC;QAAlC,WAAM,GAAN,MAAM,CAA4B;QAC7D,IAAI,CAAC,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC;YACxC,CAAC,MAAM,CAAC,gCAAgC,KAAK,SAAS,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,qBAAqB,EACvC,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,MAAM,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACtF,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,qBAAqB,EACvC,kEAAkE,CACnE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,GAAG,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,UAAmC,EACnC,OAA4C;QAE5C,IAAI,CAAC,0BAA0B,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACrD,MAAM,aAAa,GAAG,uBAAuB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QACxE,IAAI,CAAC,sBAAsB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS;YACtC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,uBAAuB,EACzC,kDAAkD,CACnD,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAC7D,IAAI,CAAC,MAAM,CAAC,QAAQ,EACpB,QAAQ,CAAC,cAAc,CACxB,CAAC;QACF,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;QAEtF,6EAA6E;QAC7E,6EAA6E;QAC7E,yEAAyE;QACzE,IAAI,UAAU,CAAC,qBAAqB,KAAK,SAAS;YAChD,UAAU,CAAC,qBAAqB,KAAK,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YACjE,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,MAAM,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;QACjF,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;YAC9E,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,0BAA0B,CACtC,QAA2C,EAC3C,QAAoC;QAEpC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO;QACxE,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAC7D,IAAI,CAAC,MAAM,CAAC,QAAQ,EACpB,QAAQ,CAAC,cAAc,CACxB,CAAC;YACF,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO;YAC/B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;oBACxC,IAAI,EAAE,SAAS;oBACf,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,YAAY,EAAE,gBAAgB;oBAC9B,MAAM,EAAE,2BAA2B;iBACpC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;QAC9E,CAAC;IACH,CAAC;IAEO,0BAA0B,CAChC,UAAmC,EACnC,OAA4C;QAE5C,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YAC3D,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,uBAAuB,EACzC,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACjD,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAEO,sBAAsB,CAC5B,KAA+B,EAC/B,OAA4C;QAE5C,IAAI,CAAC,qBAAqB,CACxB,OAAO,CAAC,iBAAiB,EACzB,OAAO,CAAC,WAAW,EACnB,KAAK,CAAC,MAAM,CAAC,QAAQ,CACtB,EAAE,CAAC;YACF,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,uBAAuB,EACzC,oEAAoE,CACrE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YACpD,CAAC,qBAAqB,CAAC,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,uBAAuB,EACzC,gEAAgE,CACjE,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,wBAAwB,CACpC,QAA2C,EAC3C,KAA+B;QAE/B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAClC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,gBAAgB,EAClC,yEAAyE,CAC1E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;YACxF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;YACpC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC/C,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,UAAU,KAAK,SAAS;oBAC9D,gBAAgB,CAAC,UAAU,CAAC,KAAK,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9D,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,gBAAgB,EAClC,2EAA2E,EAC3E,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAChC,CAAC;gBACJ,CAAC;gBACD,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACjC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kBAAkB;gBACrC,KAAK,CAAC,IAAI,KAAK,iBAAiB,CAAC,gBAAgB;gBAAE,MAAM,KAAK,CAAC;YACjE,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,gBAAgB,EAClC,0CAA0C,EAC1C,SAAS,EACT,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YACrE,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK;gBAAE,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;YAC5E,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,eAAe,EAAE,oCAAoC,CAAC,CAAC;QACxG,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YAC9C,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,oBAAqB,CAAC,aAAa,CAAC;gBAC9E,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC9B,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;gBAC5C,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;gBACtC,gCAAgC,EAAE,IAAI,CAAC,MAAM,CAAC,gCAAiC;aAChF,CAAC,CAAC;YACH,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,qBAAqB,EACvC,yDAAyD,CAC1D,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC,WAAW,CACtC,IAAI,CAAC,YAAY,EAAE,EACnB;YACE,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG;YAC7C,eAAe,EAAE,gBAAgB;YACjC,WAAW,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;YACpE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;SACjC,EACD,IAAI,CACL,CAAC,OAAO,CAAC,GAAG,EAAE;YACb,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAEO,uBAAuB,CAAC,SAA6B;QAC3D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YACzC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,GAAG;gBACvC,KAAK,CAAC,IAAI,CAAC,mBAAmB,KAAK,IAAI;gBACvC,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC5C,KAAK,CAAC,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC,MAAM,CAAC,aAAa;gBACtD,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;gBACvD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,KAAK,sBAAsB;gBACrD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;gBAChD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ;gBACzD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;gBACtD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG;gBACnE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;gBAC5D,OAAO,CAAC,MAAM,KAAK,QAAQ;gBAC3B,OAAO,CAAC,KAAK,KAAK,eAAe;gBACjC,OAAO,CAAC,eAAe,KAAK,IAAI,CAAC,MAAM,CAAC,eAAe;gBACvD,OAAO,CAAC,gCAAgC;oBACtC,IAAI,CAAC,MAAM,CAAC,gCAAgC,CAAC;YACjD,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACnF,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,eAAe,EACjC,iFAAiF,EACjF,SAAS,EACT,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,OAAO,uBAAuB,CAAC;YAC7B,MAAM,EAAE,qBAAqB;YAC7B,OAAO,EAAE,WAAW,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE;YACvE,SAAS,EAAE,sBAAsB;YACjC,YAAY,EAAE,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YACnC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAChC,MAAM,EAAE;gBACN,QAAQ,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;gBACjE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC9B,cAAc,EAAE,GAAG;aACpB;YACD,QAAQ,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;YACjE,MAAM,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE;YACpC,OAAO,EAAE,WAAW;YACpB,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE;gBACP,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,eAAe;gBACtB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe;oBAC7B,CAAC,CAAC;wBACE,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;wBAC5C,gCAAgC,EAC9B,IAAI,CAAC,MAAM,CAAC,gCAAgC;qBAC/C;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;YACD,OAAO,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAC5E,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,KAA+B,EAC/B,OAA4C,EAC5C,OAAO,GAAG,KAAK,EACf,aAA+D;QAE/D,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,GAAG,aAAa;YACnD,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE3C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAC7D,IAAI,CAAC,MAAM,CAAC,QAAQ,EACpB,cAAc,CACf,CAAC;QACF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,0EAA0E;YAC1E,yEAAyE;YACzE,OAAO,OAAO;gBACZ,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC;gBACzC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,kBAAkB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACvD,IAAI,OAAO,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CACzD,IAAI,CAAC,MAAM,CAAC,QAAQ,EACpB,cAAc,CACf,CAAC;gBACF,IAAI,KAAK,KAAK,IAAI;oBAAE,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;YACjE,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YAC/E,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC;oBAClD,MAAM;oBACN,YAAY,EAAE,IAAI;oBAClB,KAAK,EAAE,SAAS;oBAChB,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,eAAe,EACjC,6BAA6B,EAC7B,SAAS,EACT,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;YACJ,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC9D,OAAO,MAAM,CAAC,IAAI,KAAK,WAAW;oBAChC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC;oBAClD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACnB,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,eAAe,EACjC,mEAAmE,CACpE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,yBAAyB,EAC3C,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,KAA+B,EAC/B,OAA4C;QAE5C,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACtE,MAAM,cAAc,GAAG,MAAM,cAAc,CACzC,IAAI,CAAC,MAAM,CAAC,MAAM,EAClB,oBAAoB,CAAC,WAAW,EAChC;YACE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;YAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CACF,CAAC;QACF,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;IACzC,CAAC;IAEO,gBAAgB,CAAC,QAA4B,EAAE,MAAc;QACnE,IAAI,QAAQ,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;YACpC,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,iBAAiB,EACnC,yEAAyE,EACzE,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CACzC,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,KAA+B,EAC/B,WAAmB,EACnB,IAAsB,EACtB,OAAgB;QAEhB,MAAM,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC/E,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,eAAe,EACjC,OAAO,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC,uCAAuC,CAC5F,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC3C,MAAM,sBAAsB,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC5F,MAAM,IAAI,GAAG,mBAAmB,CAAC;YAC/B,MAAM,EAAE,qBAAqB;YAC7B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;YACxC,QAAQ;YACR,mBAAmB,EAAE,IAAI,EAAE,WAAW,IAAI,IAAI;YAC9C,UAAU;YACV,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG;YAChC,WAAW;YACX,KAAK;YACL,sBAAsB;YACtB,cAAc,EAAE,qBAAqB;SACtC,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACrE,MAAM,WAAW,GAAG,6BAA6B,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC;QAC9E,OAAO,UAAU,CAAC;YAChB,IAAI;YACJ,WAAW;YACX,WAAW;YACX,eAAe,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;SACf,CAAC,CAAC;IAClC,CAAC;IAEO,SAAS;QACf,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;SAChC,CAAC;IACb,CAAC;CACF"}

package/dist/audit/replay-bundle.d.ts

@@ -0,0 +1,52 @@
+import type { AuditHasher, AuditSignatureVerifier, AuditSigner } from './crypto.js';
+import type { AuditBundleDisposition, AuditBundleSelectionV1, AuditAnchorReceipt, AuditReplayBundleV1, AuditVerificationPolicyV1, AuditVerificationReportV1, SignedAuditCheckpointV1 } from './types.js';
+import { AuditArtifactVerifier } from './verifier.js';
+export declare const AUDIT_BUNDLE_MEDIA_TYPES: Readonly<{
+    entries: "application/vnd.kya-os.audit.entries.v1+json";
+    checkpoints: "application/vnd.kya-os.audit.checkpoints.v1+json";
+    inclusionProofs: "application/vnd.kya-os.audit.inclusion-proofs.v1+json";
+    consistencyProofs: "application/vnd.kya-os.audit.consistency-proofs.v1+json";
+    observations: "application/vnd.kya-os.audit.observations.v1+json";
+    anchors: "application/vnd.kya-os.audit.anchors.v1+json";
+    verificationReport: "application/vnd.kya-os.audit.verification-report.v1+json";
+}>;
+export type AuditBundleComponentInput = {
+    path: string;
+    mediaType: string;
+    disposition: 'included';
+    content: unknown;
+} | {
+    path: string;
+    mediaType: string;
+    disposition: Exclude<AuditBundleDisposition, 'included'>;
+    reasonCode: string;
+};
+export interface AuditReplayBundleExportInput {
+    bundleId: string;
+    purpose: string;
+    verificationPolicyDigest: `sha256:${string}`;
+    selections: readonly AuditBundleSelectionV1[];
+    components: readonly AuditBundleComponentInput[];
+}
+export interface AuditReplayBundleExporterOptions {
+    hasher: AuditHasher;
+    signer: AuditSigner;
+    clock: {
+        now(): number;
+    };
+}
+/** Produces deterministic, signed-inventory evidence bundles. */
+export declare class AuditReplayBundleExporter {
+    private readonly options;
+    constructor(options: AuditReplayBundleExporterOptions);
+    export(input: AuditReplayBundleExportInput): Promise<AuditReplayBundleV1>;
+}
+export interface VerifyAuditBundleDependencies {
+    hasher: AuditHasher;
+    signatures: AuditSignatureVerifier;
+    artifacts?: AuditArtifactVerifier;
+    verifySupportingAnchor?: (checkpoint: SignedAuditCheckpointV1, receipt: AuditAnchorReceipt) => Promise<boolean>;
+}
+/** Offline bundle verification. Trust is supplied only through the policy argument. */
+export declare function verifyAuditBundle(bundle: AuditReplayBundleV1 | unknown, policy: AuditVerificationPolicyV1, dependencies: VerifyAuditBundleDependencies): Promise<AuditVerificationReportV1>;
+//# sourceMappingURL=replay-bundle.d.ts.map

package/dist/audit/replay-bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay-bundle.d.ts","sourceRoot":"","sources":["../../src/audit/replay-bundle.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAepF,OAAO,KAAK,EAGV,sBAAsB,EAItB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EAEnB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EAGxB,MAAM,YAAY,CAAC;AACpB,OAAO,EAEL,qBAAqB,EAEtB,MAAM,eAAe,CAAC;AAMvB,eAAO,MAAM,wBAAwB;;;;;;;;EAQnC,CAAC;AAEH,MAAM,MAAM,yBAAyB,GACjC;IACE,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,UAAU,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;CAClB,GACD;IACE,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC,sBAAsB,EAAE,UAAU,CAAC,CAAC;IACzD,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEN,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,wBAAwB,EAAE,UAAU,MAAM,EAAE,CAAC;IAC7C,UAAU,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAC9C,UAAU,EAAE,SAAS,yBAAyB,EAAE,CAAC;CAClD;AAED,MAAM,WAAW,gCAAgC;IAC/C,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE;QAAE,GAAG,IAAI,MAAM,CAAA;KAAE,CAAC;CAC1B;AAqDD,iEAAiE;AACjE,qBAAa,yBAAyB;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,gCAAgC;IAEhE,MAAM,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,mBAAmB,CAAC;CA6DhF;AAED,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,WAAW,CAAC;IACpB,UAAU,EAAE,sBAAsB,CAAC;IACnC,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,sBAAsB,CAAC,EAAE,CACvB,UAAU,EAAE,uBAAuB,EACnC,OAAO,EAAE,kBAAkB,KACxB,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB;AAwVD,uFAAuF;AACvF,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,mBAAmB,GAAG,OAAO,EACrC,MAAM,EAAE,yBAAyB,EACjC,YAAY,EAAE,6BAA6B,GAC1C,OAAO,CAAC,yBAAyB,CAAC,CAiMpC"}