@kya-os/mcp 1.10.1 → 1.11.0

package/dist/audit/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/audit/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAY,MAAM,MAAM,CAAC;AAE5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAGnE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAM/C,MAAM,OAAO,yBAAyB;IACP;IAA7B,YAA6B,MAAsB;QAAtB,WAAM,GAAN,MAAM,CAAgB;IAAG,CAAC;IAEvD,KAAK,CAAC,MAAM,CAAC,IAAgB;QAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,MAAgB,CAAC;IAC1B,CAAC;CACF;AAiBD,iFAAiF;AACjF,MAAM,OAAO,gCAAgC;IACd;IAA7B,YAA6B,IAAkC;QAAlC,SAAI,GAAJ,IAAI,CAA8B;IAAG,CAAC;IAEnE,KAAK,CAAC,MAAM,CAAC,OAAmB,EAAE,GAAW,EAAE,MAAiB;QAC9D,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,GAAG,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,GAAG,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YAC/B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3E,IAAI,MAAM,CAAC,eAAe,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;gBAC3C,MAAM,CAAC,eAAe,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;gBACzC,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YACzD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,OAAO,qBAAqB;IAErB;IACQ;IAFnB,YACW,GAAc,EACN,UAAqB;QAD7B,QAAG,GAAH,GAAG,CAAW;QACN,eAAU,GAAV,UAAU,CAAW;IACrC,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,OAAmB;QAC5B,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC;aAC5B,kBAAkB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;aAC5D,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAmB,EACnB,MAAc,EACd,KAAc;IAEd,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,SAAS,CAAC,8DAA8D,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACrE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACvB,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC"}

package/dist/audit/errors.d.ts

@@ -0,0 +1,29 @@
+export declare const AUDIT_ERROR_CODES: {
+    readonly INVALID_EVENT: "AUDIT_INVALID_EVENT";
+    readonly LEDGER_MISMATCH: "AUDIT_LEDGER_MISMATCH";
+    readonly EPOCH_MISMATCH: "AUDIT_EPOCH_MISMATCH";
+    readonly EVENT_ID_CONFLICT: "AUDIT_EVENT_ID_CONFLICT";
+    readonly APPEND_CONFLICT_EXHAUSTED: "AUDIT_APPEND_CONFLICT_EXHAUSTED";
+    readonly JOURNAL_FAILURE: "AUDIT_JOURNAL_FAILURE";
+    readonly EVIDENCE_FAILURE: "AUDIT_EVIDENCE_FAILURE";
+    readonly EVIDENCE_INTEGRITY: "AUDIT_EVIDENCE_INTEGRITY";
+    readonly EVIDENCE_LEGAL_HOLD: "AUDIT_EVIDENCE_LEGAL_HOLD";
+    readonly EVIDENCE_ACCESS_DENIED: "AUDIT_EVIDENCE_ACCESS_DENIED";
+    readonly CHECKPOINT_INVALID: "AUDIT_CHECKPOINT_INVALID";
+    readonly CHECKPOINT_ROLLBACK: "AUDIT_CHECKPOINT_ROLLBACK";
+    readonly CHECKPOINT_CONFLICT: "AUDIT_CHECKPOINT_CONFLICT";
+    readonly CHECKPOINT_PUBLICATION_FAILED: "AUDIT_CHECKPOINT_PUBLICATION_FAILED";
+    readonly PROJECTION_CONFLICT: "AUDIT_PROJECTION_CONFLICT";
+    readonly MIRROR_VERIFICATION_FAILED: "AUDIT_MIRROR_VERIFICATION_FAILED";
+    readonly MIRROR_CONTINUITY_FAILED: "AUDIT_MIRROR_CONTINUITY_FAILED";
+    readonly MIRROR_OUT_OF_ORDER: "AUDIT_MIRROR_OUT_OF_ORDER";
+    readonly UNAUTHORIZED_SUBMISSION: "AUDIT_UNAUTHORIZED_SUBMISSION";
+    readonly INVALID_CONFIGURATION: "AUDIT_INVALID_CONFIGURATION";
+};
+export type AuditErrorCode = (typeof AUDIT_ERROR_CODES)[keyof typeof AUDIT_ERROR_CODES];
+export declare class AuditProtocolError extends Error {
+    readonly code: AuditErrorCode;
+    readonly details?: Readonly<Record<string, unknown>> | undefined;
+    constructor(code: AuditErrorCode, message: string, details?: Readonly<Record<string, unknown>> | undefined, options?: ErrorOptions);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/audit/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/audit/errors.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;CAqBpB,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAC;AAExF,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,QAAQ,CAAC,IAAI,EAAE,cAAc;IAE7B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAF3C,IAAI,EAAE,cAAc,EAC7B,OAAO,EAAE,MAAM,EACN,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,YAAA,EACpD,OAAO,CAAC,EAAE,YAAY;CAKzB"}

package/dist/audit/errors.js

@@ -0,0 +1,33 @@
+export const AUDIT_ERROR_CODES = {
+    INVALID_EVENT: 'AUDIT_INVALID_EVENT',
+    LEDGER_MISMATCH: 'AUDIT_LEDGER_MISMATCH',
+    EPOCH_MISMATCH: 'AUDIT_EPOCH_MISMATCH',
+    EVENT_ID_CONFLICT: 'AUDIT_EVENT_ID_CONFLICT',
+    APPEND_CONFLICT_EXHAUSTED: 'AUDIT_APPEND_CONFLICT_EXHAUSTED',
+    JOURNAL_FAILURE: 'AUDIT_JOURNAL_FAILURE',
+    EVIDENCE_FAILURE: 'AUDIT_EVIDENCE_FAILURE',
+    EVIDENCE_INTEGRITY: 'AUDIT_EVIDENCE_INTEGRITY',
+    EVIDENCE_LEGAL_HOLD: 'AUDIT_EVIDENCE_LEGAL_HOLD',
+    EVIDENCE_ACCESS_DENIED: 'AUDIT_EVIDENCE_ACCESS_DENIED',
+    CHECKPOINT_INVALID: 'AUDIT_CHECKPOINT_INVALID',
+    CHECKPOINT_ROLLBACK: 'AUDIT_CHECKPOINT_ROLLBACK',
+    CHECKPOINT_CONFLICT: 'AUDIT_CHECKPOINT_CONFLICT',
+    CHECKPOINT_PUBLICATION_FAILED: 'AUDIT_CHECKPOINT_PUBLICATION_FAILED',
+    PROJECTION_CONFLICT: 'AUDIT_PROJECTION_CONFLICT',
+    MIRROR_VERIFICATION_FAILED: 'AUDIT_MIRROR_VERIFICATION_FAILED',
+    MIRROR_CONTINUITY_FAILED: 'AUDIT_MIRROR_CONTINUITY_FAILED',
+    MIRROR_OUT_OF_ORDER: 'AUDIT_MIRROR_OUT_OF_ORDER',
+    UNAUTHORIZED_SUBMISSION: 'AUDIT_UNAUTHORIZED_SUBMISSION',
+    INVALID_CONFIGURATION: 'AUDIT_INVALID_CONFIGURATION',
+};
+export class AuditProtocolError extends Error {
+    code;
+    details;
+    constructor(code, message, details, options) {
+        super(message, options);
+        this.code = code;
+        this.details = details;
+        this.name = 'AuditProtocolError';
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/audit/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/audit/errors.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,aAAa,EAAE,qBAAqB;IACpC,eAAe,EAAE,uBAAuB;IACxC,cAAc,EAAE,sBAAsB;IACtC,iBAAiB,EAAE,yBAAyB;IAC5C,yBAAyB,EAAE,iCAAiC;IAC5D,eAAe,EAAE,uBAAuB;IACxC,gBAAgB,EAAE,wBAAwB;IAC1C,kBAAkB,EAAE,0BAA0B;IAC9C,mBAAmB,EAAE,2BAA2B;IAChD,sBAAsB,EAAE,8BAA8B;IACtD,kBAAkB,EAAE,0BAA0B;IAC9C,mBAAmB,EAAE,2BAA2B;IAChD,mBAAmB,EAAE,2BAA2B;IAChD,6BAA6B,EAAE,qCAAqC;IACpE,mBAAmB,EAAE,2BAA2B;IAChD,0BAA0B,EAAE,kCAAkC;IAC9D,wBAAwB,EAAE,gCAAgC;IAC1D,mBAAmB,EAAE,2BAA2B;IAChD,uBAAuB,EAAE,+BAA+B;IACxD,qBAAqB,EAAE,6BAA6B;CAC5C,CAAC;AAIX,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAEhC;IAEA;IAHX,YACW,IAAoB,EAC7B,OAAe,EACN,OAA2C,EACpD,OAAsB;QAEtB,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QALf,SAAI,GAAJ,IAAI,CAAgB;QAEpB,YAAO,GAAP,OAAO,CAAoC;QAIpD,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF"}

package/dist/audit/evidence.d.ts

@@ -0,0 +1,45 @@
+import type { AuditHasher } from './crypto.js';
+import type { AuditEvidenceProvider, EncryptedEvidenceInput, EvidenceAccessContext, EvidenceRetentionCommand, EvidenceRetentionResult } from './providers/evidence.js';
+import type { Digest, EvidenceRef } from './types.js';
+export interface EvidenceEncryptionInput {
+    plaintext: Uint8Array;
+    mediaType: string;
+    key: CryptoKey;
+    keyId: string;
+    aad: Uint8Array;
+    plaintextCommitment?: Digest;
+}
+export interface EvidenceEncryptorConfig {
+    crypto: Crypto;
+    hasher: AuditHasher;
+    randomBytes(length: number): Promise<Uint8Array>;
+}
+/** Randomized AES-256-GCM evidence encryption with opaque object addressing. */
+export declare class WebCryptoEvidenceEncryptor {
+    private readonly config;
+    constructor(config: EvidenceEncryptorConfig);
+    encrypt(input: EvidenceEncryptionInput): Promise<EncryptedEvidenceInput>;
+    decrypt(input: EncryptedEvidenceInput, key: CryptoKey, aad: Uint8Array): Promise<Uint8Array>;
+}
+export interface MemoryAuditEvidenceProviderOptions {
+    authorizeAccess?(input: {
+        ref: EvidenceRef;
+        context: EvidenceAccessContext;
+    }): Promise<boolean> | boolean;
+    onAccess?(input: {
+        ref: EvidenceRef;
+        context: EvidenceAccessContext;
+        result: 'found' | 'missing' | 'disposed' | 'denied';
+    }): Promise<void> | void;
+}
+export declare class MemoryAuditEvidenceProvider implements AuditEvidenceProvider {
+    private readonly hasher;
+    private readonly options;
+    private readonly states;
+    constructor(hasher: AuditHasher, options?: MemoryAuditEvidenceProviderOptions);
+    putIfAbsent(input: EncryptedEvidenceInput): Promise<EvidenceRef>;
+    has(ref: EvidenceRef): Promise<boolean>;
+    get(ref: EvidenceRef, context: EvidenceAccessContext): Promise<Uint8Array | null>;
+    applyRetention(command: EvidenceRetentionCommand): Promise<EvidenceRetentionResult>;
+}
+//# sourceMappingURL=evidence.d.ts.map

package/dist/audit/evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../../src/audit/evidence.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,OAAO,KAAK,EACV,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,UAAU,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,SAAS,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,UAAU,CAAC;IAChB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;IACpB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAClD;AAED,gFAAgF;AAChF,qBAAa,0BAA0B;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,uBAAuB;IAEtD,OAAO,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAwCxE,OAAO,CACX,KAAK,EAAE,sBAAsB,EAC7B,GAAG,EAAE,SAAS,EACd,GAAG,EAAE,UAAU,GACd,OAAO,CAAC,UAAU,CAAC;CAkCvB;AAQD,MAAM,WAAW,kCAAkC;IACjD,eAAe,CAAC,CAAC,KAAK,EAAE;QACtB,GAAG,EAAE,WAAW,CAAC;QACjB,OAAO,EAAE,qBAAqB,CAAC;KAChC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAC/B,QAAQ,CAAC,CAAC,KAAK,EAAE;QACf,GAAG,EAAE,WAAW,CAAC;QACjB,OAAO,EAAE,qBAAqB,CAAC;QAC/B,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;KACrD,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC1B;AAED,qBAAa,2BAA4B,YAAW,qBAAqB;IAIrE,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJ1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;gBAGxC,MAAM,EAAE,WAAW,EACnB,OAAO,GAAE,kCAAuC;IAG7D,WAAW,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,WAAW,CAAC;IA6BhE,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAKvC,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAmBjF,cAAc,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,CAAC;CAyB1F"}

package/dist/audit/evidence.js

@@ -0,0 +1,151 @@
+import { base64urlDecodeToBytes, base64urlEncodeFromBytes } from '../utils/base64.js';
+import { AUDIT_ERROR_CODES, AuditProtocolError } from './errors.js';
+/** Randomized AES-256-GCM evidence encryption with opaque object addressing. */
+export class WebCryptoEvidenceEncryptor {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    async encrypt(input) {
+        if (input.key.algorithm.name !== 'AES-GCM') {
+            throw new TypeError('Evidence encryption key must use AES-GCM');
+        }
+        if (input.aad.byteLength === 0) {
+            throw new TypeError('Evidence encryption requires entity-scoped authenticated data');
+        }
+        const nonce = await this.config.randomBytes(12);
+        const objectRandom = await this.config.randomBytes(16);
+        const encrypted = await this.config.crypto.subtle.encrypt({
+            name: 'AES-GCM',
+            iv: toArrayBuffer(nonce),
+            additionalData: toArrayBuffer(input.aad),
+            tagLength: 128,
+        }, input.key, toArrayBuffer(input.plaintext));
+        const ciphertext = new Uint8Array(encrypted);
+        const ciphertextDigest = await this.config.hasher.sha256(ciphertext);
+        const aadDigest = await this.config.hasher.sha256(input.aad);
+        const ref = {
+            objectId: `evi_${base64urlEncodeFromBytes(objectRandom)}`,
+            ciphertextDigest,
+            ...(input.plaintextCommitment
+                ? { plaintextCommitment: input.plaintextCommitment }
+                : {}),
+            mediaType: input.mediaType,
+            size: String(ciphertext.byteLength),
+            encryption: {
+                suite: 'A256GCM',
+                keyId: input.keyId,
+                nonce: base64urlEncodeFromBytes(nonce),
+                aadDigest,
+            },
+        };
+        return { ref: Object.freeze(ref), ciphertext };
+    }
+    async decrypt(input, key, aad) {
+        if (aad.byteLength === 0) {
+            throw new TypeError('Evidence decryption requires entity-scoped authenticated data');
+        }
+        const ciphertextDigest = await this.config.hasher.sha256(input.ciphertext);
+        const aadDigest = await this.config.hasher.sha256(aad);
+        if (ciphertextDigest !== input.ref.ciphertextDigest ||
+            aadDigest !== input.ref.encryption.aadDigest) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.EVIDENCE_INTEGRITY, 'Evidence ciphertext or authenticated metadata digest does not match');
+        }
+        try {
+            const plaintext = await this.config.crypto.subtle.decrypt({
+                name: 'AES-GCM',
+                iv: toArrayBuffer(base64urlDecodeToBytes(input.ref.encryption.nonce)),
+                additionalData: toArrayBuffer(aad),
+                tagLength: 128,
+            }, key, toArrayBuffer(input.ciphertext));
+            return new Uint8Array(plaintext);
+        }
+        catch (error) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.EVIDENCE_INTEGRITY, 'Evidence AEAD verification failed', undefined, { cause: error });
+        }
+    }
+}
+export class MemoryAuditEvidenceProvider {
+    hasher;
+    options;
+    states = new Map();
+    constructor(hasher, options = {}) {
+        this.hasher = hasher;
+        this.options = options;
+    }
+    async putIfAbsent(input) {
+        const actualDigest = await this.hasher.sha256(input.ciphertext);
+        if (actualDigest !== input.ref.ciphertextDigest ||
+            String(input.ciphertext.byteLength) !== input.ref.size) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.EVIDENCE_INTEGRITY, 'Evidence bytes do not match their ciphertext digest or size');
+        }
+        const existing = this.states.get(input.ref.objectId);
+        if (existing !== undefined) {
+            if (existing.ref.ciphertextDigest !== input.ref.ciphertextDigest ||
+                existing.ciphertext === null ||
+                !bytesEqual(existing.ciphertext, input.ciphertext)) {
+                throw new AuditProtocolError(AUDIT_ERROR_CODES.EVIDENCE_INTEGRITY, 'Opaque evidence object ID collision');
+            }
+            return existing.ref;
+        }
+        this.states.set(input.ref.objectId, {
+            ref: input.ref,
+            ciphertext: new Uint8Array(input.ciphertext),
+            holds: new Set(),
+        });
+        return input.ref;
+    }
+    async has(ref) {
+        return this.states.get(ref.objectId)?.ciphertext !== null &&
+            this.states.has(ref.objectId);
+    }
+    async get(ref, context) {
+        if (this.options.authorizeAccess !== undefined &&
+            !(await this.options.authorizeAccess({ ref, context }))) {
+            await this.options.onAccess?.({ ref, context, result: 'denied' });
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.EVIDENCE_ACCESS_DENIED, 'Evidence access policy denied this actor and purpose');
+        }
+        const state = this.states.get(ref.objectId);
+        const result = state === undefined
+            ? 'missing'
+            : state.ciphertext === null ? 'disposed' : 'found';
+        await this.options.onAccess?.({ ref, context, result });
+        return state?.ciphertext === null || state === undefined
+            ? null
+            : new Uint8Array(state.ciphertext);
+    }
+    async applyRetention(command) {
+        const state = this.states.get(command.ref.objectId);
+        if (state === undefined)
+            return { ref: command.ref, state: 'missing' };
+        if (command.kind === 'legal_hold') {
+            state.holds.add(command.holdId);
+            return { ref: state.ref, state: 'held' };
+        }
+        if (command.kind === 'release_hold') {
+            state.holds.delete(command.holdId);
+            return {
+                ref: state.ref,
+                state: state.ciphertext === null ? 'disposed' : state.holds.size > 0 ? 'held' : 'retained',
+            };
+        }
+        if (state.holds.size > 0) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.EVIDENCE_LEGAL_HOLD, 'Evidence cannot be disposed while a legal hold is active', { holdIds: [...state.holds] });
+        }
+        state.ciphertext = null;
+        return { ref: state.ref, state: 'disposed' };
+    }
+}
+function bytesEqual(left, right) {
+    if (left.byteLength !== right.byteLength)
+        return false;
+    let difference = 0;
+    for (let index = 0; index < left.byteLength; index += 1) {
+        difference |= left[index] ^ right[index];
+    }
+    return difference === 0;
+}
+function toArrayBuffer(bytes) {
+    return Uint8Array.from(bytes).buffer;
+}
+//# sourceMappingURL=evidence.js.map

package/dist/audit/evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../../src/audit/evidence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAEtF,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAyBpE,gFAAgF;AAChF,MAAM,OAAO,0BAA0B;IACR;IAA7B,YAA6B,MAA+B;QAA/B,WAAM,GAAN,MAAM,CAAyB;IAAG,CAAC;IAEhE,KAAK,CAAC,OAAO,CAAC,KAA8B;QAC1C,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC3C,MAAM,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,SAAS,CAAC,+DAA+D,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAChD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CACvD;YACE,IAAI,EAAE,SAAS;YACf,EAAE,EAAE,aAAa,CAAC,KAAK,CAAC;YACxB,cAAc,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC;YACxC,SAAS,EAAE,GAAG;SACf,EACD,KAAK,CAAC,GAAG,EACT,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAC/B,CAAC;QACF,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAgB;YACvB,QAAQ,EAAE,OAAO,wBAAwB,CAAC,YAAY,CAAC,EAAE;YACzD,gBAAgB;YAChB,GAAG,CAAC,KAAK,CAAC,mBAAmB;gBAC3B,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,EAAE;gBACpD,CAAC,CAAC,EAAE,CAAC;YACP,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;YACnC,UAAU,EAAE;gBACV,KAAK,EAAE,SAAS;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,KAAK,EAAE,wBAAwB,CAAC,KAAK,CAAC;gBACtC,SAAS;aACV;SACF,CAAC;QACF,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,OAAO,CACX,KAA6B,EAC7B,GAAc,EACd,GAAe;QAEf,IAAI,GAAG,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,SAAS,CAAC,+DAA+D,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3E,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,gBAAgB,KAAK,KAAK,CAAC,GAAG,CAAC,gBAAgB;YACjD,SAAS,KAAK,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;YAC/C,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,kBAAkB,EACpC,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CACvD;gBACE,IAAI,EAAE,SAAS;gBACf,EAAE,EAAE,aAAa,CAAC,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;gBACrE,cAAc,EAAE,aAAa,CAAC,GAAG,CAAC;gBAClC,SAAS,EAAE,GAAG;aACf,EACD,GAAG,EACH,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAChC,CAAC;YACF,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,kBAAkB,EACpC,mCAAmC,EACnC,SAAS,EACT,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAoBD,MAAM,OAAO,2BAA2B;IAInB;IACA;IAJF,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAE3D,YACmB,MAAmB,EACnB,UAA8C,EAAE;QADhD,WAAM,GAAN,MAAM,CAAa;QACnB,YAAO,GAAP,OAAO,CAAyC;IAChE,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,KAA6B;QAC7C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAChE,IAAI,YAAY,KAAK,KAAK,CAAC,GAAG,CAAC,gBAAgB;YAC7C,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACzD,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,kBAAkB,EACpC,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,QAAQ,CAAC,GAAG,CAAC,gBAAgB,KAAK,KAAK,CAAC,GAAG,CAAC,gBAAgB;gBAC9D,QAAQ,CAAC,UAAU,KAAK,IAAI;gBAC5B,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,kBAAkB,EACpC,qCAAqC,CACtC,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC,GAAG,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE;YAClC,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,UAAU,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;YAC5C,KAAK,EAAE,IAAI,GAAG,EAAU;SACzB,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,GAAG,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAgB;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,UAAU,KAAK,IAAI;YACvD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAgB,EAAE,OAA8B;QACxD,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS;YAC5C,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAClE,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,sBAAsB,EACxC,sDAAsD,CACvD,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS;YAChC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;QACrD,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,OAAO,KAAK,EAAE,UAAU,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YACtD,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAiC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAEvE,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAClC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAChC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAC3C,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACpC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACnC,OAAO;gBACL,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,KAAK,EAAE,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU;aAC3F,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,mBAAmB,EACrC,0DAA0D,EAC1D,EAAE,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAC9B,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;QACxB,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC/C,CAAC;CACF;AAED,SAAS,UAAU,CAAC,IAAgB,EAAE,KAAiB;IACrD,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,UAAU,IAAI,IAAI,CAAC,KAAK,CAAE,GAAG,KAAK,CAAC,KAAK,CAAE,CAAC;IAC7C,CAAC;IACD,OAAO,UAAU,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;AACvC,CAAC"}

package/dist/audit/index.d.ts

@@ -0,0 +1,27 @@
+export * from './types.js';
+export * from './schemas.js';
+export * from './assurance.js';
+export * from './crypto.js';
+export * from './integrity.js';
+export * from './errors.js';
+export * from './evidence.js';
+export * from './merkle.js';
+export * from './checkpoint.js';
+export * from './checkpoint-coordinator.js';
+export * from './projection.js';
+export * from './verifier.js';
+export * from './replay-bundle.js';
+export * from './service.js';
+export * from './mirror-service.js';
+export * from './recorder-service.js';
+export * from './providers/evidence.js';
+export * from './providers/journal.js';
+export * from './providers/memory-journal.js';
+export * from './providers/recorder-client.js';
+export * from './providers/observer.js';
+export * from './providers/anchor.js';
+export * from './providers/outbox.js';
+export * from './providers/source-state.js';
+export * from './adapters/legacy-audit-log.js';
+export * from './adapters/mcp.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/audit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,mBAAmB,CAAC"}

package/dist/audit/index.js

@@ -0,0 +1,27 @@
+export * from './types.js';
+export * from './schemas.js';
+export * from './assurance.js';
+export * from './crypto.js';
+export * from './integrity.js';
+export * from './errors.js';
+export * from './evidence.js';
+export * from './merkle.js';
+export * from './checkpoint.js';
+export * from './checkpoint-coordinator.js';
+export * from './projection.js';
+export * from './verifier.js';
+export * from './replay-bundle.js';
+export * from './service.js';
+export * from './mirror-service.js';
+export * from './recorder-service.js';
+export * from './providers/evidence.js';
+export * from './providers/journal.js';
+export * from './providers/memory-journal.js';
+export * from './providers/recorder-client.js';
+export * from './providers/observer.js';
+export * from './providers/anchor.js';
+export * from './providers/outbox.js';
+export * from './providers/source-state.js';
+export * from './adapters/legacy-audit-log.js';
+export * from './adapters/mcp.js';
+//# sourceMappingURL=index.js.map

package/dist/audit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,mBAAmB,CAAC"}

package/dist/audit/integrity.d.ts

@@ -0,0 +1,19 @@
+import type { AuditHasher } from './crypto.js';
+import type { AuditEntryCoreV1, AuditProducerEventCoreV1, AuditRecorderReceiptCoreV1, Digest, EvidenceRef } from './types.js';
+export declare function collectAuditEvidenceRefs(event: AuditProducerEventCoreV1): EvidenceRef[];
+export declare const AUDIT_DIGEST_DOMAINS: Readonly<{
+    event: "org.kya-os.audit.event.v1";
+    entry: "org.kya-os.audit.entry.v1";
+    evidenceManifest: "org.kya-os.audit.evidence-manifest.v1";
+    idempotency: "org.kya-os.audit.idempotency.v1";
+    checkpoint: "org.kya-os.audit.checkpoint.v1";
+    observation: "org.kya-os.audit.observation.v1";
+    bundleManifest: "org.kya-os.audit.bundle-manifest.v1";
+    bundleComponent: "org.kya-os.audit.bundle-component.v1";
+}>;
+export declare function collectAuditEvidenceManifest(event: AuditProducerEventCoreV1): unknown;
+export declare function buildAuditRecorderReceiptCore(core: AuditEntryCoreV1, entryDigest: Digest): AuditRecorderReceiptCoreV1;
+export declare function digestAuditEvent(hasher: AuditHasher, event: AuditProducerEventCoreV1): Promise<Digest>;
+export declare function digestAuditEntry(hasher: AuditHasher, entry: AuditEntryCoreV1): Promise<Digest>;
+export declare function digestAuditEvidenceManifest(hasher: AuditHasher, event: AuditProducerEventCoreV1): Promise<Digest>;
+//# sourceMappingURL=integrity.d.ts.map

package/dist/audit/integrity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.d.ts","sourceRoot":"","sources":["../../src/audit/integrity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,OAAO,KAAK,EACV,gBAAgB,EAChB,wBAAwB,EACxB,0BAA0B,EAC1B,MAAM,EACN,WAAW,EAEZ,MAAM,YAAY,CAAC;AAMpB,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,wBAAwB,GAAG,WAAW,EAAE,CAoBvF;AAED,eAAO,MAAM,oBAAoB;;;;;;;;;EAS/B,CAAC;AAEH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAIrF;AAED,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,gBAAgB,EACtB,WAAW,EAAE,MAAM,GAClB,0BAA0B,CAa5B;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,MAAM,CAAC,CAMjB"}

package/dist/audit/integrity.js

@@ -0,0 +1,64 @@
+import { hashAuditValue } from './crypto.js';
+function partyEvidence(party) {
+    return party?.kind === 'evidence_ref' ? [party.ref] : [];
+}
+export function collectAuditEvidenceRefs(event) {
+    const detailsEvidence = event.details.family === 'delegation'
+        ? event.details.statusEvidence ?? []
+        : event.details.family === 'ledger' && event.details.targetEvidenceRef !== undefined
+            ? [event.details.targetEvidenceRef]
+            : [];
+    return [
+        ...partyEvidence(event.tenantRef),
+        ...partyEvidence(event.source.producer),
+        ...partyEvidence(event.session?.ref),
+        ...partyEvidence(event.actor),
+        ...partyEvidence(event.responsibleParty),
+        ...partyEvidence(event.resource),
+        ...(event.proof === undefined ? [] : [event.proof]),
+        ...event.evidence,
+        ...(event.action.detailRef === undefined ? [] : [event.action.detailRef]),
+        ...(event.reason?.detailRef === undefined ? [] : [event.reason.detailRef]),
+        ...(event.authorization?.statusEvidence ?? []),
+        ...detailsEvidence,
+    ];
+}
+export const AUDIT_DIGEST_DOMAINS = Object.freeze({
+    event: 'org.kya-os.audit.event.v1',
+    entry: 'org.kya-os.audit.entry.v1',
+    evidenceManifest: 'org.kya-os.audit.evidence-manifest.v1',
+    idempotency: 'org.kya-os.audit.idempotency.v1',
+    checkpoint: 'org.kya-os.audit.checkpoint.v1',
+    observation: 'org.kya-os.audit.observation.v1',
+    bundleManifest: 'org.kya-os.audit.bundle-manifest.v1',
+    bundleComponent: 'org.kya-os.audit.bundle-component.v1',
+});
+export function collectAuditEvidenceManifest(event) {
+    return {
+        refs: collectAuditEvidenceRefs(event),
+    };
+}
+export function buildAuditRecorderReceiptCore(core, entryDigest) {
+    return {
+        schema: 'https://schema.kya-os.org/v1/protocol/audit/receipt/v1.0.0',
+        ledgerId: core.ledgerId,
+        ledgerEpochId: core.ledgerEpochId,
+        sequence: core.sequence,
+        eventId: core.event.eventId,
+        entryDigest,
+        previousEntryDigest: core.previousEntryDigest,
+        recordedAt: core.recordedAt,
+        recorder: core.recorder,
+        integritySuite: 'KYA-AUDIT-JCS-SHA256-JWS-2026',
+    };
+}
+export async function digestAuditEvent(hasher, event) {
+    return hashAuditValue(hasher, AUDIT_DIGEST_DOMAINS.event, event);
+}
+export async function digestAuditEntry(hasher, entry) {
+    return hashAuditValue(hasher, AUDIT_DIGEST_DOMAINS.entry, entry);
+}
+export async function digestAuditEvidenceManifest(hasher, event) {
+    return hashAuditValue(hasher, AUDIT_DIGEST_DOMAINS.evidenceManifest, collectAuditEvidenceManifest(event));
+}
+//# sourceMappingURL=integrity.js.map

package/dist/audit/integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.js","sourceRoot":"","sources":["../../src/audit/integrity.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAU7C,SAAS,aAAa,CAAC,KAA2B;IAChD,OAAO,KAAK,EAAE,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAA+B;IACtE,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,YAAY;QAC3D,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE;QACpC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,iBAAiB,KAAK,SAAS;YAClF,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC;YACnC,CAAC,CAAC,EAAE,CAAC;IACT,OAAO;QACL,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC;QACjC,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;QACvC,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC;QACpC,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC;QAC7B,GAAG,aAAa,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACxC,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC;QAChC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,GAAG,KAAK,CAAC,QAAQ;QACjB,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1E,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,cAAc,IAAI,EAAE,CAAC;QAC9C,GAAG,eAAe;KACnB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,2BAA2B;IAClC,KAAK,EAAE,2BAA2B;IAClC,gBAAgB,EAAE,uCAAuC;IACzD,WAAW,EAAE,iCAAiC;IAC9C,UAAU,EAAE,gCAAgC;IAC5C,WAAW,EAAE,iCAAiC;IAC9C,cAAc,EAAE,qCAAqC;IACrD,eAAe,EAAE,sCAAsC;CACxD,CAAC,CAAC;AAEH,MAAM,UAAU,4BAA4B,CAAC,KAA+B;IAC1E,OAAO;QACL,IAAI,EAAE,wBAAwB,CAAC,KAAK,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,IAAsB,EACtB,WAAmB;IAEnB,OAAO;QACL,MAAM,EAAE,4DAA4D;QACpE,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO;QAC3B,WAAW;QACX,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,cAAc,EAAE,+BAA+B;KAChD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAmB,EACnB,KAA+B;IAE/B,OAAO,cAAc,CAAC,MAAM,EAAE,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAmB,EACnB,KAAuB;IAEvB,OAAO,cAAc,CAAC,MAAM,EAAE,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAmB,EACnB,KAA+B;IAE/B,OAAO,cAAc,CACnB,MAAM,EACN,oBAAoB,CAAC,gBAAgB,EACrC,4BAA4B,CAAC,KAAK,CAAC,CACpC,CAAC;AACJ,CAAC"}

package/dist/audit/merkle.d.ts

@@ -0,0 +1,31 @@
+import type { AuditHasher } from './crypto.js';
+import type { Digest } from './types.js';
+export interface AuditInclusionVerification {
+    leaf: Digest;
+    leafIndex: number;
+    treeSize: number;
+    root: Digest;
+    auditPath: readonly Digest[];
+}
+export interface AuditConsistencyVerification {
+    oldSize: number;
+    newSize: number;
+    oldRoot: Digest;
+    newRoot: Digest;
+    auditPath: readonly Digest[];
+}
+/** RFC 9162 section 2 Merkle tree over immutable audit-entry digests. */
+export declare class Rfc9162MerkleTree {
+    private readonly hasher;
+    constructor(hasher: AuditHasher);
+    leafHash(entryDigest: Digest): Promise<Digest>;
+    nodeHash(left: Digest, right: Digest): Promise<Digest>;
+    root(leaves: readonly Digest[]): Promise<Digest>;
+    inclusionProof(leaves: readonly Digest[], leafIndex: number): Promise<Digest[]>;
+    private buildInclusionProof;
+    verifyInclusion(input: AuditInclusionVerification): Promise<boolean>;
+    consistencyProof(leaves: readonly Digest[], oldSize: number): Promise<Digest[]>;
+    private buildConsistencyProof;
+    verifyConsistency(input: AuditConsistencyVerification): Promise<boolean>;
+}
+//# sourceMappingURL=merkle.d.ts.map

package/dist/audit/merkle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"merkle.d.ts","sourceRoot":"","sources":["../../src/audit/merkle.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAIzC,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B;AAmCD,yEAAyE;AACzE,qBAAa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAE1C,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI9C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQtD,IAAI,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAWhD,cAAc,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAQvE,mBAAmB;IAoB3B,eAAe,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,OAAO,CAAC;IA8BpE,gBAAgB,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YASvE,qBAAqB;IAuB7B,iBAAiB,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,OAAO,CAAC;CAqD/E"}