@kya-os/mcp 1.10.1 → 1.12.0

package/dist/audit/read-contract.d.ts

@@ -0,0 +1,445 @@
+import { z } from 'zod';
+import { type AuditReadEntriesPage } from './read-service.js';
+import type { AuditBundleConsistencyProofV1, AuditBundleInclusionProofV1, AuditHead, AuditLedgerRef, DecimalString, SignedAuditEntryV1 } from './types.js';
+/**
+ * Network wire contract for the operator-facing audit READ/replay API - the
+ * request and response envelopes an HTTP or RPC transport carries. Each
+ * envelope is schema-tagged (like the producer event and recorder receipt) so
+ * versioning and validation are explicit at the boundary. Responses embed the
+ * recorder's own signed artifacts, so a client validates the envelope here and
+ * then re-verifies the artifacts with {@link AuditArtifactVerifier}.
+ */
+export declare const AUDIT_HEAD_REQUEST_SCHEMA_ID: "https://schema.kya-os.org/v1/protocol/audit/head-request/v1.0.0";
+export declare const AUDIT_HEAD_RESPONSE_SCHEMA_ID: "https://schema.kya-os.org/v1/protocol/audit/head-response/v1.0.0";
+export declare const AUDIT_LIST_ENTRIES_REQUEST_SCHEMA_ID: "https://schema.kya-os.org/v1/protocol/audit/list-entries-request/v1.0.0";
+export declare const AUDIT_LIST_ENTRIES_RESPONSE_SCHEMA_ID: "https://schema.kya-os.org/v1/protocol/audit/list-entries-response/v1.0.0";
+export declare const AUDIT_INCLUSION_PROOF_REQUEST_SCHEMA_ID: "https://schema.kya-os.org/v1/protocol/audit/inclusion-proof-request/v1.0.0";
+export declare const AUDIT_INCLUSION_PROOF_RESPONSE_SCHEMA_ID: "https://schema.kya-os.org/v1/protocol/audit/inclusion-proof-response/v1.0.0";
+export declare const AUDIT_CONSISTENCY_PROOF_REQUEST_SCHEMA_ID: "https://schema.kya-os.org/v1/protocol/audit/consistency-proof-request/v1.0.0";
+export declare const AUDIT_CONSISTENCY_PROOF_RESPONSE_SCHEMA_ID: "https://schema.kya-os.org/v1/protocol/audit/consistency-proof-response/v1.0.0";
+export declare const auditHeadSchema: z.ZodObject<{
+    ledgerId: z.ZodString;
+    ledgerEpochId: z.ZodString;
+    sequence: z.ZodString;
+    entryDigest: z.ZodString;
+}, z.core.$strict>;
+export interface AuditHeadRequestV1 {
+    schema: typeof AUDIT_HEAD_REQUEST_SCHEMA_ID;
+    ledger: AuditLedgerRef;
+}
+export interface AuditHeadResponseV1 {
+    schema: typeof AUDIT_HEAD_RESPONSE_SCHEMA_ID;
+    head: AuditHead | null;
+}
+export declare const auditHeadRequestSchema: z.ZodObject<{
+    schema: z.ZodLiteral<"https://schema.kya-os.org/v1/protocol/audit/head-request/v1.0.0">;
+    ledger: z.ZodObject<{
+        ledgerId: z.ZodString;
+        ledgerEpochId: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const auditHeadResponseSchema: z.ZodObject<{
+    schema: z.ZodLiteral<"https://schema.kya-os.org/v1/protocol/audit/head-response/v1.0.0">;
+    head: z.ZodNullable<z.ZodObject<{
+        ledgerId: z.ZodString;
+        ledgerEpochId: z.ZodString;
+        sequence: z.ZodString;
+        entryDigest: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export interface AuditListEntriesRequestV1 {
+    schema: typeof AUDIT_LIST_ENTRIES_REQUEST_SCHEMA_ID;
+    ledger: AuditLedgerRef;
+    afterSequence?: DecimalString;
+    limit?: number;
+}
+export interface AuditListEntriesResponseV1 {
+    schema: typeof AUDIT_LIST_ENTRIES_RESPONSE_SCHEMA_ID;
+    entries: SignedAuditEntryV1[];
+    head: AuditHead | null;
+    nextAfterSequence: DecimalString | null;
+}
+export declare const auditListEntriesRequestSchema: z.ZodObject<{
+    schema: z.ZodLiteral<"https://schema.kya-os.org/v1/protocol/audit/list-entries-request/v1.0.0">;
+    ledger: z.ZodObject<{
+        ledgerId: z.ZodString;
+        ledgerEpochId: z.ZodString;
+    }, z.core.$strict>;
+    afterSequence: z.ZodOptional<z.ZodString>;
+    limit: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export declare const auditListEntriesResponseSchema: z.ZodObject<{
+    schema: z.ZodLiteral<"https://schema.kya-os.org/v1/protocol/audit/list-entries-response/v1.0.0">;
+    entries: z.ZodArray<z.ZodObject<{
+        core: z.ZodObject<{
+            schema: z.ZodLiteral<"https://schema.kya-os.org/v1/protocol/audit/entry/v1.0.0">;
+            ledgerId: z.ZodString;
+            ledgerEpochId: z.ZodString;
+            sequence: z.ZodString;
+            previousEntryDigest: z.ZodNullable<z.ZodString>;
+            recordedAt: z.ZodNumber;
+            recorder: z.ZodObject<{
+                did: z.ZodString;
+                kid: z.ZodString;
+                alg: z.ZodEnum<{
+                    EdDSA: "EdDSA";
+                    ES256: "ES256";
+                }>;
+            }, z.core.$strict>;
+            eventDigest: z.ZodString;
+            event: z.ZodObject<{
+                schema: z.ZodLiteral<"https://schema.kya-os.org/v1/protocol/audit/event/v1.0.0">;
+                eventId: z.ZodString;
+                eventType: z.ZodEnum<{
+                    "session.established": "session.established";
+                    "session.rejected": "session.rejected";
+                    "session.expired": "session.expired";
+                    "session.replay_rejected": "session.replay_rejected";
+                    "tool.call.started": "tool.call.started";
+                    "tool.call.completed": "tool.call.completed";
+                    "tool.call.failed": "tool.call.failed";
+                    "tool.call.denied": "tool.call.denied";
+                    "tool.call.challenged": "tool.call.challenged";
+                    "proof.generated": "proof.generated";
+                    "proof.verified": "proof.verified";
+                    "proof.rejected": "proof.rejected";
+                    "delegation.issued": "delegation.issued";
+                    "delegation.verified": "delegation.verified";
+                    "delegation.rejected": "delegation.rejected";
+                    "delegation.revoked": "delegation.revoked";
+                    "delegation.cascade_revoked": "delegation.cascade_revoked";
+                    "delegation.outbound_attached": "delegation.outbound_attached";
+                    "authorization.evaluated": "authorization.evaluated";
+                    "authorization.approved": "authorization.approved";
+                    "authorization.denied": "authorization.denied";
+                    "authorization.step_up_required": "authorization.step_up_required";
+                    "grant.used": "grant.used";
+                    "consent.requested": "consent.requested";
+                    "consent.approved": "consent.approved";
+                    "consent.denied": "consent.denied";
+                    "credential.required": "credential.required";
+                    "credential.verified": "credential.verified";
+                    "credential.failed": "credential.failed";
+                    "key.rotated": "key.rotated";
+                    "policy.changed": "policy.changed";
+                    "configuration.changed": "configuration.changed";
+                    "integrity_suite.transitioned": "integrity_suite.transitioned";
+                    "ledger.epoch.started": "ledger.epoch.started";
+                    "ledger.epoch.transitioned": "ledger.epoch.transitioned";
+                    "checkpoint.created": "checkpoint.created";
+                    "checkpoint.anchored": "checkpoint.anchored";
+                    "checkpoint.anchor_failed": "checkpoint.anchor_failed";
+                    "evidence.disposed": "evidence.disposed";
+                    "projection.reconciled": "projection.reconciled";
+                    "audit.source_high_water": "audit.source_high_water";
+                    "audit.accessed": "audit.accessed";
+                    "audit.exported": "audit.exported";
+                    "legal_hold.applied": "legal_hold.applied";
+                    "retention.executed": "retention.executed";
+                }>;
+                eventVersion: z.ZodLiteral<"1.0.0">;
+                binding: z.ZodString;
+                occurredAt: z.ZodNumber;
+                tenantRef: z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+                source: z.ZodObject<{
+                    producer: z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+                    sourceId: z.ZodString;
+                    sourceSequence: z.ZodOptional<z.ZodString>;
+                    previousSourceEventDigest: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>;
+                correlationId: z.ZodOptional<z.ZodString>;
+                causationId: z.ZodOptional<z.ZodString>;
+                trace: z.ZodOptional<z.ZodObject<{
+                    traceId: z.ZodOptional<z.ZodString>;
+                    spanId: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>>;
+                session: z.ZodOptional<z.ZodObject<{
+                    ref: z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+                    handshakeNonceCommitment: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>>;
+                actor: z.ZodOptional<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
+                responsibleParty: z.ZodOptional<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
+                resource: z.ZodOptional<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
+                action: z.ZodObject<{
+                    category: z.ZodString;
+                    name: z.ZodOptional<z.ZodString>;
+                    detailRef: z.ZodOptional<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
+                }, z.core.$strict>;
+                outcome: z.ZodEnum<{
+                    denied: "denied";
+                    unknown: "unknown";
+                    failed: "failed";
+                    challenged: "challenged";
+                    succeeded: "succeeded";
+                }>;
+                reason: z.ZodOptional<z.ZodObject<{
+                    code: z.ZodString;
+                    detailRef: z.ZodOptional<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
+                }, z.core.$strict>>;
+                authorization: z.ZodOptional<z.ZodObject<{
+                    source: z.ZodEnum<{
+                        delegation: "delegation";
+                        anonymous: "anonymous";
+                        grant: "grant";
+                        policy: "policy";
+                    }>;
+                    decision: z.ZodEnum<{
+                        needs_authorization: "needs_authorization";
+                        allowed: "allowed";
+                        denied: "denied";
+                        step_up_required: "step_up_required";
+                    }>;
+                    scopeId: z.ZodOptional<z.ZodString>;
+                    delegationRef: z.ZodOptional<z.ZodString>;
+                    delegationCredentialDigest: z.ZodOptional<z.ZodString>;
+                    delegationChainDigests: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    statusEvidence: z.ZodOptional<z.ZodArray<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>>;
+                    grantRef: z.ZodOptional<z.ZodString>;
+                    policyId: z.ZodOptional<z.ZodString>;
+                    policyVersion: z.ZodOptional<z.ZodString>;
+                    policyDigest: z.ZodOptional<z.ZodString>;
+                    verificationCode: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>>;
+                proof: z.ZodOptional<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
+                evidence: z.ZodArray<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
+                details: z.ZodDiscriminatedUnion<readonly [z.ZodObject<{
+                    family: z.ZodLiteral<"session">;
+                    phase: z.ZodEnum<{
+                        expired: "expired";
+                        established: "established";
+                        rejected: "rejected";
+                        replay_rejected: "replay_rejected";
+                    }>;
+                    reasonCode: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>, z.ZodObject<{
+                    family: z.ZodLiteral<"tool">;
+                    phase: z.ZodEnum<{
+                        denied: "denied";
+                        started: "started";
+                        completed: "completed";
+                        failed: "failed";
+                        challenged: "challenged";
+                    }>;
+                    attempt: z.ZodString;
+                    idempotencyRef: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>, z.ZodObject<{
+                    family: z.ZodLiteral<"proof">;
+                    phase: z.ZodEnum<{
+                        rejected: "rejected";
+                        generated: "generated";
+                        verified: "verified";
+                    }>;
+                    proofDigest: z.ZodOptional<z.ZodString>;
+                    verificationCode: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>, z.ZodObject<{
+                    family: z.ZodLiteral<"delegation">;
+                    phase: z.ZodEnum<{
+                        revoked: "revoked";
+                        rejected: "rejected";
+                        verified: "verified";
+                        issued: "issued";
+                        cascade_revoked: "cascade_revoked";
+                        outbound_attached: "outbound_attached";
+                    }>;
+                    delegationRef: z.ZodString;
+                    parentRef: z.ZodOptional<z.ZodString>;
+                    statusEvidence: z.ZodOptional<z.ZodArray<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>>;
+                }, z.core.$strict>, z.ZodObject<{
+                    family: z.ZodLiteral<"authorization">;
+                    phase: z.ZodEnum<{
+                        denied: "denied";
+                        step_up_required: "step_up_required";
+                        evaluated: "evaluated";
+                        approved: "approved";
+                        grant_used: "grant_used";
+                    }>;
+                    policyDigest: z.ZodOptional<z.ZodString>;
+                    grantRef: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>, z.ZodObject<{
+                    family: z.ZodLiteral<"consent">;
+                    phase: z.ZodEnum<{
+                        denied: "denied";
+                        approved: "approved";
+                        requested: "requested";
+                        credential_required: "credential_required";
+                        credential_verified: "credential_verified";
+                        credential_failed: "credential_failed";
+                    }>;
+                    consentRef: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>, z.ZodObject<{
+                    family: z.ZodLiteral<"key">;
+                    phase: z.ZodEnum<{
+                        rotated: "rotated";
+                        policy_changed: "policy_changed";
+                        configuration_changed: "configuration_changed";
+                        integrity_suite_transitioned: "integrity_suite_transitioned";
+                    }>;
+                    previousSigner: z.ZodOptional<z.ZodObject<{
+                        did: z.ZodString;
+                        kid: z.ZodString;
+                        alg: z.ZodEnum<{
+                            EdDSA: "EdDSA";
+                            ES256: "ES256";
+                        }>;
+                    }, z.core.$strict>>;
+                    nextSigner: z.ZodOptional<z.ZodObject<{
+                        did: z.ZodString;
+                        kid: z.ZodString;
+                        alg: z.ZodEnum<{
+                            EdDSA: "EdDSA";
+                            ES256: "ES256";
+                        }>;
+                    }, z.core.$strict>>;
+                    configurationDigest: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>, z.ZodObject<{
+                    family: z.ZodLiteral<"ledger">;
+                    phase: z.ZodEnum<{
+                        epoch_started: "epoch_started";
+                        epoch_transitioned: "epoch_transitioned";
+                        checkpoint_created: "checkpoint_created";
+                        checkpoint_anchored: "checkpoint_anchored";
+                        checkpoint_anchor_failed: "checkpoint_anchor_failed";
+                        evidence_disposed: "evidence_disposed";
+                        projection_reconciled: "projection_reconciled";
+                    }>;
+                    checkpointDigest: z.ZodOptional<z.ZodString>;
+                    previousEpochId: z.ZodOptional<z.ZodString>;
+                    previousTerminalCheckpointDigest: z.ZodOptional<z.ZodString>;
+                    successorEpochIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    targetEvidenceRef: z.ZodOptional<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
+                }, z.core.$strict>, z.ZodObject<{
+                    family: z.ZodLiteral<"administration">;
+                    phase: z.ZodEnum<{
+                        source_high_water: "source_high_water";
+                        accessed: "accessed";
+                        exported: "exported";
+                        legal_hold_applied: "legal_hold_applied";
+                        retention_executed: "retention_executed";
+                    }>;
+                    purpose: z.ZodOptional<z.ZodString>;
+                    sourceSequence: z.ZodOptional<z.ZodString>;
+                    selectionDigest: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>], "family">;
+                privacy: z.ZodObject<{
+                    classification: z.ZodEnum<{
+                        public: "public";
+                        internal: "internal";
+                        confidential: "confidential";
+                        restricted: "restricted";
+                    }>;
+                    retentionClass: z.ZodString;
+                    legalHold: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>;
+            }, z.core.$strict>;
+            evidenceManifestDigest: z.ZodString;
+            integritySuite: z.ZodLiteral<"KYA-AUDIT-JCS-SHA256-JWS-2026">;
+        }, z.core.$strict>;
+        eventDigest: z.ZodString;
+        entryDigest: z.ZodString;
+        recorderReceipt: z.ZodObject<{
+            core: z.ZodObject<{
+                schema: z.ZodLiteral<"https://schema.kya-os.org/v1/protocol/audit/receipt/v1.0.0">;
+                ledgerId: z.ZodString;
+                ledgerEpochId: z.ZodString;
+                sequence: z.ZodString;
+                eventId: z.ZodString;
+                entryDigest: z.ZodString;
+                previousEntryDigest: z.ZodNullable<z.ZodString>;
+                recordedAt: z.ZodNumber;
+                recorder: z.ZodObject<{
+                    did: z.ZodString;
+                    kid: z.ZodString;
+                    alg: z.ZodEnum<{
+                        EdDSA: "EdDSA";
+                        ES256: "ES256";
+                    }>;
+                }, z.core.$strict>;
+                integritySuite: z.ZodLiteral<"KYA-AUDIT-JCS-SHA256-JWS-2026">;
+            }, z.core.$strict>;
+            jws: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+    head: z.ZodNullable<z.ZodObject<{
+        ledgerId: z.ZodString;
+        ledgerEpochId: z.ZodString;
+        sequence: z.ZodString;
+        entryDigest: z.ZodString;
+    }, z.core.$strict>>;
+    nextAfterSequence: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export interface AuditInclusionProofRequestV1 {
+    schema: typeof AUDIT_INCLUSION_PROOF_REQUEST_SCHEMA_ID;
+    ledger: AuditLedgerRef;
+    sequence: DecimalString;
+}
+export interface AuditInclusionProofResponseV1 {
+    schema: typeof AUDIT_INCLUSION_PROOF_RESPONSE_SCHEMA_ID;
+    proof: AuditBundleInclusionProofV1;
+}
+export declare const auditInclusionProofRequestSchema: z.ZodObject<{
+    schema: z.ZodLiteral<"https://schema.kya-os.org/v1/protocol/audit/inclusion-proof-request/v1.0.0">;
+    ledger: z.ZodObject<{
+        ledgerId: z.ZodString;
+        ledgerEpochId: z.ZodString;
+    }, z.core.$strict>;
+    sequence: z.ZodString;
+}, z.core.$strict>;
+export declare const auditInclusionProofResponseSchema: z.ZodObject<{
+    schema: z.ZodLiteral<"https://schema.kya-os.org/v1/protocol/audit/inclusion-proof-response/v1.0.0">;
+    proof: z.ZodObject<{
+        ledgerId: z.ZodString;
+        ledgerEpochId: z.ZodString;
+        sequence: z.ZodString;
+        entryDigest: z.ZodString;
+        checkpointDigest: z.ZodString;
+        proof: z.ZodObject<{
+            leafIndex: z.ZodString;
+            treeSize: z.ZodString;
+            auditPath: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export interface AuditConsistencyProofRequestV1 {
+    schema: typeof AUDIT_CONSISTENCY_PROOF_REQUEST_SCHEMA_ID;
+    ledger: AuditLedgerRef;
+    oldTreeSize: DecimalString;
+}
+export interface AuditConsistencyProofResponseV1 {
+    schema: typeof AUDIT_CONSISTENCY_PROOF_RESPONSE_SCHEMA_ID;
+    proof: AuditBundleConsistencyProofV1;
+}
+export declare const auditConsistencyProofRequestSchema: z.ZodObject<{
+    schema: z.ZodLiteral<"https://schema.kya-os.org/v1/protocol/audit/consistency-proof-request/v1.0.0">;
+    ledger: z.ZodObject<{
+        ledgerId: z.ZodString;
+        ledgerEpochId: z.ZodString;
+    }, z.core.$strict>;
+    oldTreeSize: z.ZodString;
+}, z.core.$strict>;
+export declare const auditConsistencyProofResponseSchema: z.ZodObject<{
+    schema: z.ZodLiteral<"https://schema.kya-os.org/v1/protocol/audit/consistency-proof-response/v1.0.0">;
+    proof: z.ZodObject<{
+        ledgerId: z.ZodString;
+        ledgerEpochId: z.ZodString;
+        oldCheckpointDigest: z.ZodString;
+        newCheckpointDigest: z.ZodString;
+        proof: z.ZodObject<{
+            oldTreeSize: z.ZodString;
+            newTreeSize: z.ZodString;
+            auditPath: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare function parseAuditHeadRequest(input: unknown): AuditHeadRequestV1;
+export declare function parseAuditHeadResponse(input: unknown): AuditHeadResponseV1;
+export declare function parseAuditListEntriesRequest(input: unknown): AuditListEntriesRequestV1;
+export declare function parseAuditListEntriesResponse(input: unknown): AuditListEntriesResponseV1;
+export declare function parseAuditInclusionProofRequest(input: unknown): AuditInclusionProofRequestV1;
+export declare function parseAuditInclusionProofResponse(input: unknown): AuditInclusionProofResponseV1;
+export declare function parseAuditConsistencyProofRequest(input: unknown): AuditConsistencyProofRequestV1;
+export declare function parseAuditConsistencyProofResponse(input: unknown): AuditConsistencyProofResponseV1;
+export declare function toAuditHeadResponse(head: AuditHead | null): AuditHeadResponseV1;
+export declare function toAuditListEntriesResponse(page: AuditReadEntriesPage): AuditListEntriesResponseV1;
+export declare function toAuditInclusionProofResponse(proof: AuditBundleInclusionProofV1): AuditInclusionProofResponseV1;
+export declare function toAuditConsistencyProofResponse(proof: AuditBundleConsistencyProofV1): AuditConsistencyProofResponseV1;
+//# sourceMappingURL=read-contract.d.ts.map

package/dist/audit/read-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-contract.d.ts","sourceRoot":"","sources":["../../src/audit/read-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,OAAO,EAA0B,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,KAAK,EACV,6BAA6B,EAC7B,2BAA2B,EAC3B,SAAS,EACT,cAAc,EACd,aAAa,EACb,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB;;;;;;;GAOG;AAEH,eAAO,MAAM,4BAA4B,EACvC,iEAA0E,CAAC;AAC7E,eAAO,MAAM,6BAA6B,EACxC,kEAA2E,CAAC;AAC9E,eAAO,MAAM,oCAAoC,EAC/C,yEAAkF,CAAC;AACrF,eAAO,MAAM,qCAAqC,EAChD,0EAAmF,CAAC;AACtF,eAAO,MAAM,uCAAuC,EAClD,4EAAqF,CAAC;AACxF,eAAO,MAAM,wCAAwC,EACnD,6EAAsF,CAAC;AACzF,eAAO,MAAM,yCAAyC,EACpD,8EAAuF,CAAC;AAC1F,eAAO,MAAM,0CAA0C,EACrD,+EAAwF,CAAC;AAW3F,eAAO,MAAM,eAAe;;;;;kBAKjB,CAAC;AAYZ,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,OAAO,4BAA4B,CAAC;IAC5C,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,6BAA6B,CAAC;IAC7C,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;CACxB;AAED,eAAO,MAAM,sBAAsB;;;;;;kBAGxB,CAAC;AAEZ,eAAO,MAAM,uBAAuB;;;;;;;;kBAGzB,CAAC;AAMZ,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,OAAO,oCAAoC,CAAC;IACpD,MAAM,EAAE,cAAc,CAAC;IACvB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,OAAO,qCAAqC,CAAC;IACrD,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;IACvB,iBAAiB,EAAE,aAAa,GAAG,IAAI,CAAC;CACzC;AAED,eAAO,MAAM,6BAA6B;;;;;;;;kBAK/B,CAAC;AAEZ,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAKhC,CAAC;AAMZ,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,OAAO,uCAAuC,CAAC;IACvD,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,aAAa,CAAC;CACzB;AAED,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,OAAO,wCAAwC,CAAC;IACxD,KAAK,EAAE,2BAA2B,CAAC;CACpC;AAED,eAAO,MAAM,gCAAgC;;;;;;;kBAIlC,CAAC;AAEZ,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;kBAGnC,CAAC;AAMZ,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,OAAO,yCAAyC,CAAC;IACzD,MAAM,EAAE,cAAc,CAAC;IACvB,WAAW,EAAE,aAAa,CAAC;CAC5B;AAED,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,OAAO,0CAA0C,CAAC;IAC1D,KAAK,EAAE,6BAA6B,CAAC;CACtC;AAED,eAAO,MAAM,kCAAkC;;;;;;;kBAIpC,CAAC;AAEZ,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;kBAGrC,CAAC;AAMZ,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CAExE;AACD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,CAE1E;AACD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,yBAAyB,CAEtF;AACD,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,0BAA0B,CAExF;AACD,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,4BAA4B,CAE5F;AACD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,OAAO,GAAG,6BAA6B,CAE9F;AACD,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,OAAO,GAAG,8BAA8B,CAEhG;AACD,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,OAAO,GAAG,+BAA+B,CAElG;AAOD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,GAAG,mBAAmB,CAE/E;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,oBAAoB,GAAG,0BAA0B,CAOjG;AAED,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,2BAA2B,GACjC,6BAA6B,CAE/B;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,6BAA6B,GACnC,+BAA+B,CAEjC"}

package/dist/audit/read-contract.js

@@ -0,0 +1,126 @@
+import { z } from 'zod';
+import { auditBundleConsistencyProofSchema, auditBundleInclusionProofSchema, decimalStringSchema, digestSchema, signedAuditEntrySchema, } from './schemas.js';
+import { MAX_READ_ENTRIES_LIMIT } from './read-service.js';
+/**
+ * Network wire contract for the operator-facing audit READ/replay API - the
+ * request and response envelopes an HTTP or RPC transport carries. Each
+ * envelope is schema-tagged (like the producer event and recorder receipt) so
+ * versioning and validation are explicit at the boundary. Responses embed the
+ * recorder's own signed artifacts, so a client validates the envelope here and
+ * then re-verifies the artifacts with {@link AuditArtifactVerifier}.
+ */
+export const AUDIT_HEAD_REQUEST_SCHEMA_ID = 'https://schema.kya-os.org/v1/protocol/audit/head-request/v1.0.0';
+export const AUDIT_HEAD_RESPONSE_SCHEMA_ID = 'https://schema.kya-os.org/v1/protocol/audit/head-response/v1.0.0';
+export const AUDIT_LIST_ENTRIES_REQUEST_SCHEMA_ID = 'https://schema.kya-os.org/v1/protocol/audit/list-entries-request/v1.0.0';
+export const AUDIT_LIST_ENTRIES_RESPONSE_SCHEMA_ID = 'https://schema.kya-os.org/v1/protocol/audit/list-entries-response/v1.0.0';
+export const AUDIT_INCLUSION_PROOF_REQUEST_SCHEMA_ID = 'https://schema.kya-os.org/v1/protocol/audit/inclusion-proof-request/v1.0.0';
+export const AUDIT_INCLUSION_PROOF_RESPONSE_SCHEMA_ID = 'https://schema.kya-os.org/v1/protocol/audit/inclusion-proof-response/v1.0.0';
+export const AUDIT_CONSISTENCY_PROOF_REQUEST_SCHEMA_ID = 'https://schema.kya-os.org/v1/protocol/audit/consistency-proof-request/v1.0.0';
+export const AUDIT_CONSISTENCY_PROOF_RESPONSE_SCHEMA_ID = 'https://schema.kya-os.org/v1/protocol/audit/consistency-proof-response/v1.0.0';
+// ---------------------------------------------------------------------------
+// Shared primitives
+// ---------------------------------------------------------------------------
+const ledgerRefSchema = z.object({
+    ledgerId: z.string().min(1).max(256),
+    ledgerEpochId: z.string().min(1).max(256),
+}).strict();
+export const auditHeadSchema = z.object({
+    ledgerId: z.string().min(1).max(256),
+    ledgerEpochId: z.string().min(1).max(256),
+    sequence: decimalStringSchema,
+    entryDigest: digestSchema,
+}).strict();
+function deepFreeze(value) {
+    if (typeof value !== 'object' || value === null || Object.isFrozen(value))
+        return value;
+    for (const child of Object.values(value))
+        deepFreeze(child);
+    return Object.freeze(value);
+}
+export const auditHeadRequestSchema = z.object({
+    schema: z.literal(AUDIT_HEAD_REQUEST_SCHEMA_ID),
+    ledger: ledgerRefSchema,
+}).strict();
+export const auditHeadResponseSchema = z.object({
+    schema: z.literal(AUDIT_HEAD_RESPONSE_SCHEMA_ID),
+    head: auditHeadSchema.nullable(),
+}).strict();
+export const auditListEntriesRequestSchema = z.object({
+    schema: z.literal(AUDIT_LIST_ENTRIES_REQUEST_SCHEMA_ID),
+    ledger: ledgerRefSchema,
+    afterSequence: decimalStringSchema.optional(),
+    limit: z.number().int().positive().max(MAX_READ_ENTRIES_LIMIT).optional(),
+}).strict();
+export const auditListEntriesResponseSchema = z.object({
+    schema: z.literal(AUDIT_LIST_ENTRIES_RESPONSE_SCHEMA_ID),
+    entries: z.array(signedAuditEntrySchema),
+    head: auditHeadSchema.nullable(),
+    nextAfterSequence: decimalStringSchema.nullable(),
+}).strict();
+export const auditInclusionProofRequestSchema = z.object({
+    schema: z.literal(AUDIT_INCLUSION_PROOF_REQUEST_SCHEMA_ID),
+    ledger: ledgerRefSchema,
+    sequence: decimalStringSchema,
+}).strict();
+export const auditInclusionProofResponseSchema = z.object({
+    schema: z.literal(AUDIT_INCLUSION_PROOF_RESPONSE_SCHEMA_ID),
+    proof: auditBundleInclusionProofSchema,
+}).strict();
+export const auditConsistencyProofRequestSchema = z.object({
+    schema: z.literal(AUDIT_CONSISTENCY_PROOF_REQUEST_SCHEMA_ID),
+    ledger: ledgerRefSchema,
+    oldTreeSize: decimalStringSchema,
+}).strict();
+export const auditConsistencyProofResponseSchema = z.object({
+    schema: z.literal(AUDIT_CONSISTENCY_PROOF_RESPONSE_SCHEMA_ID),
+    proof: auditBundleConsistencyProofSchema,
+}).strict();
+// ---------------------------------------------------------------------------
+// Parsers - validate untrusted wire input, then freeze.
+// ---------------------------------------------------------------------------
+export function parseAuditHeadRequest(input) {
+    return deepFreeze(auditHeadRequestSchema.parse(input));
+}
+export function parseAuditHeadResponse(input) {
+    return deepFreeze(auditHeadResponseSchema.parse(input));
+}
+export function parseAuditListEntriesRequest(input) {
+    return deepFreeze(auditListEntriesRequestSchema.parse(input));
+}
+export function parseAuditListEntriesResponse(input) {
+    return deepFreeze(auditListEntriesResponseSchema.parse(input));
+}
+export function parseAuditInclusionProofRequest(input) {
+    return deepFreeze(auditInclusionProofRequestSchema.parse(input));
+}
+export function parseAuditInclusionProofResponse(input) {
+    return deepFreeze(auditInclusionProofResponseSchema.parse(input));
+}
+export function parseAuditConsistencyProofRequest(input) {
+    return deepFreeze(auditConsistencyProofRequestSchema.parse(input));
+}
+export function parseAuditConsistencyProofResponse(input) {
+    return deepFreeze(auditConsistencyProofResponseSchema.parse(input));
+}
+// ---------------------------------------------------------------------------
+// Serializers - wrap a read-service result in its wire envelope. A transport
+// (e.g. an HTTP recorder) calls these to answer a request.
+// ---------------------------------------------------------------------------
+export function toAuditHeadResponse(head) {
+    return { schema: AUDIT_HEAD_RESPONSE_SCHEMA_ID, head };
+}
+export function toAuditListEntriesResponse(page) {
+    return {
+        schema: AUDIT_LIST_ENTRIES_RESPONSE_SCHEMA_ID,
+        entries: page.entries,
+        head: page.head,
+        nextAfterSequence: page.nextAfterSequence,
+    };
+}
+export function toAuditInclusionProofResponse(proof) {
+    return { schema: AUDIT_INCLUSION_PROOF_RESPONSE_SCHEMA_ID, proof };
+}
+export function toAuditConsistencyProofResponse(proof) {
+    return { schema: AUDIT_CONSISTENCY_PROOF_RESPONSE_SCHEMA_ID, proof };
+}
+//# sourceMappingURL=read-contract.js.map

package/dist/audit/read-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-contract.js","sourceRoot":"","sources":["../../src/audit/read-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,iCAAiC,EACjC,+BAA+B,EAC/B,mBAAmB,EACnB,YAAY,EACZ,sBAAsB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,sBAAsB,EAA6B,MAAM,mBAAmB,CAAC;AAUtF;;;;;;;GAOG;AAEH,MAAM,CAAC,MAAM,4BAA4B,GACvC,iEAA0E,CAAC;AAC7E,MAAM,CAAC,MAAM,6BAA6B,GACxC,kEAA2E,CAAC;AAC9E,MAAM,CAAC,MAAM,oCAAoC,GAC/C,yEAAkF,CAAC;AACrF,MAAM,CAAC,MAAM,qCAAqC,GAChD,0EAAmF,CAAC;AACtF,MAAM,CAAC,MAAM,uCAAuC,GAClD,4EAAqF,CAAC;AACxF,MAAM,CAAC,MAAM,wCAAwC,GACnD,6EAAsF,CAAC;AACzF,MAAM,CAAC,MAAM,yCAAyC,GACpD,8EAAuF,CAAC;AAC1F,MAAM,CAAC,MAAM,0CAA0C,GACrD,+EAAwF,CAAC;AAE3F,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CAC1C,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACzC,QAAQ,EAAE,mBAAmB;IAC7B,WAAW,EAAE,YAAY;CAC1B,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,SAAS,UAAU,CAAI,KAAQ;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAgBD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC;IAC/C,MAAM,EAAE,eAAe;CACxB,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC;IAChD,IAAI,EAAE,eAAe,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC,MAAM,EAAE,CAAC;AAoBZ,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,oCAAoC,CAAC;IACvD,MAAM,EAAE,eAAe;IACvB,aAAa,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC7C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE;CAC1E,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC;IACxD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;IACxC,IAAI,EAAE,eAAe,CAAC,QAAQ,EAAE;IAChC,iBAAiB,EAAE,mBAAmB,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC,MAAM,EAAE,CAAC;AAiBZ,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,uCAAuC,CAAC;IAC1D,MAAM,EAAE,eAAe;IACvB,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,wCAAwC,CAAC;IAC3D,KAAK,EAAE,+BAA+B;CACvC,CAAC,CAAC,MAAM,EAAE,CAAC;AAiBZ,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,yCAAyC,CAAC;IAC5D,MAAM,EAAE,eAAe;IACvB,WAAW,EAAE,mBAAmB;CACjC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,0CAA0C,CAAC;IAC7D,KAAK,EAAE,iCAAiC;CACzC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,8EAA8E;AAC9E,wDAAwD;AACxD,8EAA8E;AAE9E,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,OAAO,UAAU,CAAC,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAuB,CAAC,CAAC;AAC/E,CAAC;AACD,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,UAAU,CAAC,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAwB,CAAC,CAAC;AACjF,CAAC;AACD,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,OAAO,UAAU,CAAC,6BAA6B,CAAC,KAAK,CAAC,KAAK,CAA8B,CAAC,CAAC;AAC7F,CAAC;AACD,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,OAAO,UAAU,CAAC,8BAA8B,CAAC,KAAK,CAAC,KAAK,CAA+B,CAAC,CAAC;AAC/F,CAAC;AACD,MAAM,UAAU,+BAA+B,CAAC,KAAc;IAC5D,OAAO,UAAU,CAAC,gCAAgC,CAAC,KAAK,CAAC,KAAK,CAAiC,CAAC,CAAC;AACnG,CAAC;AACD,MAAM,UAAU,gCAAgC,CAAC,KAAc;IAC7D,OAAO,UAAU,CAAC,iCAAiC,CAAC,KAAK,CAAC,KAAK,CAAkC,CAAC,CAAC;AACrG,CAAC;AACD,MAAM,UAAU,iCAAiC,CAAC,KAAc;IAC9D,OAAO,UAAU,CAAC,kCAAkC,CAAC,KAAK,CAAC,KAAK,CAAmC,CAAC,CAAC;AACvG,CAAC;AACD,MAAM,UAAU,kCAAkC,CAAC,KAAc;IAC/D,OAAO,UAAU,CAAC,mCAAmC,CAAC,KAAK,CAAC,KAAK,CAAoC,CAAC,CAAC;AACzG,CAAC;AAED,8EAA8E;AAC9E,6EAA6E;AAC7E,2DAA2D;AAC3D,8EAA8E;AAE9E,MAAM,UAAU,mBAAmB,CAAC,IAAsB;IACxD,OAAO,EAAE,MAAM,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,IAA0B;IACnE,OAAO;QACL,MAAM,EAAE,qCAAqC;QAC7C,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,KAAkC;IAElC,OAAO,EAAE,MAAM,EAAE,wCAAwC,EAAE,KAAK,EAAE,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,KAAoC;IAEpC,OAAO,EAAE,MAAM,EAAE,0CAA0C,EAAE,KAAK,EAAE,CAAC;AACvE,CAAC"}