@kya-os/mcp 1.10.1 → 1.12.0

package/dist/audit/read-service.d.ts

@@ -0,0 +1,99 @@
+import type { AuditCheckpointBuilder, AuditCheckpointStore } from './checkpoint.js';
+import type { AuditJournalProvider } from './providers/journal.js';
+import type { AuditBundleConsistencyProofV1, AuditBundleInclusionProofV1, AuditHead, AuditLedgerRef, DecimalString, SignedAuditCheckpointV1, SignedAuditEntryV1 } from './types.js';
+/**
+ * Operator-facing read surface over an authoritative audit ledger.
+ *
+ * This is the counterpart to the producer-facing {@link AuditRecorderClient}:
+ * where that writes signed entries, this reads them back for browsing, replay,
+ * and independent verification. It is deliberately transport-agnostic - an HTTP
+ * or RPC boundary serialises to and from these methods - so the same contract
+ * serves the in-process reference recorder, a hosted recorder, and a
+ * dashboard client.
+ *
+ * Every returned artifact is the recorder's own signed object; a caller can
+ * re-verify it with {@link AuditArtifactVerifier} without trusting this service.
+ * Checkpoint-derived proofs are optional: a service built without checkpoint
+ * access rejects those calls with {@link AUDIT_ERROR_CODES.INVALID_CONFIGURATION}
+ * rather than fabricating a result.
+ */
+export interface AuditReadService {
+    /** Current chain head (highest sequence + its entry digest), or null when empty. */
+    getHead(ledger: AuditLedgerRef): Promise<AuditHead | null>;
+    /**
+     * A forward, sequence-ordered page of signed entries. The page echoes the
+     * ledger {@link AuditHead} so a caller can tell whether it has reached the
+     * tip, and a `nextAfterSequence` cursor for the following page (null at end).
+     */
+    listEntries(query: AuditReadEntriesQuery): Promise<AuditReadEntriesPage>;
+    /** The latest signed checkpoint for the ledger, or null when none exists yet. */
+    getLatestCheckpoint(ledger: AuditLedgerRef): Promise<SignedAuditCheckpointV1 | null>;
+    /**
+     * A self-contained Merkle inclusion proof binding one entry to the latest
+     * checkpoint's signed root - the artifact a client uses to prove an entry is
+     * in the ledger without downloading the whole ledger.
+     */
+    getInclusionProof(query: AuditInclusionProofQuery): Promise<AuditBundleInclusionProofV1>;
+    /**
+     * A Merkle consistency proof that the ledger at `oldTreeSize` is an append-only
+     * prefix of the latest checkpoint - the artifact that proves history was never
+     * rewritten between two checkpoints.
+     */
+    getConsistencyProof(query: AuditConsistencyProofQuery): Promise<AuditBundleConsistencyProofV1>;
+}
+export interface AuditReadEntriesQuery extends AuditLedgerRef {
+    /** Exclusive lower bound: return entries whose sequence is strictly greater. */
+    afterSequence?: DecimalString;
+    /** Maximum entries to return; clamped to [1, {@link MAX_READ_ENTRIES_LIMIT}]. */
+    limit?: number;
+}
+export interface AuditReadEntriesPage {
+    entries: SignedAuditEntryV1[];
+    /** The ledger head at read time, so a caller knows if more entries exist beyond this page. */
+    head: AuditHead | null;
+    /** Cursor for the next page (pass as `afterSequence`), or null when this page reached the head. */
+    nextAfterSequence: DecimalString | null;
+}
+export interface AuditInclusionProofQuery extends AuditLedgerRef {
+    sequence: DecimalString;
+}
+export interface AuditConsistencyProofQuery extends AuditLedgerRef {
+    /** Tree size of an earlier signed checkpoint to prove the latest is consistent with. */
+    oldTreeSize: DecimalString;
+}
+/** Checkpoint read access, injected to enable proof operations. */
+export interface AuditCheckpointReadAccess {
+    builder: AuditCheckpointBuilder;
+    store: AuditCheckpointStore;
+}
+export interface AuditReadServiceDeps {
+    journal: AuditJournalProvider;
+    /** Enables `getLatestCheckpoint`/`getInclusionProof`/`getConsistencyProof`. */
+    checkpoints?: AuditCheckpointReadAccess;
+}
+export declare const DEFAULT_READ_ENTRIES_LIMIT = 100;
+export declare const MAX_READ_ENTRIES_LIMIT = 1000;
+/**
+ * Reference read service backed by an {@link AuditJournalProvider} and, when
+ * proofs are needed, an {@link AuditCheckpointReadAccess}.
+ *
+ * Reads ride the journal's ordered `readRange`, so paging cost is independent of
+ * ledger size. Pagination fetches one extra entry to detect a further page
+ * without a second round trip.
+ */
+export declare class LocalAuditReadService implements AuditReadService {
+    private readonly journal;
+    private readonly checkpoints?;
+    constructor(deps: AuditReadServiceDeps);
+    getHead(ledger: AuditLedgerRef): Promise<AuditHead | null>;
+    listEntries(query: AuditReadEntriesQuery): Promise<AuditReadEntriesPage>;
+    getLatestCheckpoint(ledger: AuditLedgerRef): Promise<SignedAuditCheckpointV1 | null>;
+    getInclusionProof(query: AuditInclusionProofQuery): Promise<AuditBundleInclusionProofV1>;
+    getConsistencyProof(query: AuditConsistencyProofQuery): Promise<AuditBundleConsistencyProofV1>;
+    private requireCheckpoints;
+    private requireLatestCheckpoint;
+    private entryAtSequence;
+}
+/** One-call composition helper mirroring {@link createLocalAuditRecorder}. */
+export declare function createLocalAuditReadService(deps: AuditReadServiceDeps): AuditReadService;
+//# sourceMappingURL=read-service.d.ts.map

package/dist/audit/read-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-service.d.ts","sourceRoot":"","sources":["../../src/audit/read-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEpF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,KAAK,EACV,6BAA6B,EAC7B,2BAA2B,EAC3B,SAAS,EACT,cAAc,EACd,aAAa,EACb,uBAAuB,EACvB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,gBAAgB;IAC/B,oFAAoF;IACpF,OAAO,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAE3D;;;;OAIG;IACH,WAAW,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEzE,iFAAiF;IACjF,mBAAmB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAErF;;;;OAIG;IACH,iBAAiB,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAEzF;;;;OAIG;IACH,mBAAmB,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;CAChG;AAED,MAAM,WAAW,qBAAsB,SAAQ,cAAc;IAC3D,gFAAgF;IAChF,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,8FAA8F;IAC9F,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;IACvB,mGAAmG;IACnG,iBAAiB,EAAE,aAAa,GAAG,IAAI,CAAC;CACzC;AAED,MAAM,WAAW,wBAAyB,SAAQ,cAAc;IAC9D,QAAQ,EAAE,aAAa,CAAC;CACzB;AAED,MAAM,WAAW,0BAA2B,SAAQ,cAAc;IAChE,wFAAwF;IACxF,WAAW,EAAE,aAAa,CAAC;CAC5B;AAED,mEAAmE;AACnE,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,sBAAsB,CAAC;IAChC,KAAK,EAAE,oBAAoB,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,+EAA+E;IAC/E,WAAW,CAAC,EAAE,yBAAyB,CAAC;CACzC;AAED,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAC9C,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAsB3C;;;;;;;GAOG;AACH,qBAAa,qBAAsB,YAAW,gBAAgB;IAC5D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAA4B;gBAE7C,IAAI,EAAE,oBAAoB;IAKtC,OAAO,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAIpD,WAAW,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAuBxE,mBAAmB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAIpF,iBAAiB,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAgBxF,mBAAmB,CACvB,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,6BAA6B,CAAC;IA0BzC,OAAO,CAAC,kBAAkB;YAUZ,uBAAuB;YAevB,eAAe;CAqB9B;AAED,8EAA8E;AAC9E,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,oBAAoB,GAAG,gBAAgB,CAExF"}

package/dist/audit/read-service.js

@@ -0,0 +1,124 @@
+import { AUDIT_ERROR_CODES, AuditProtocolError } from './errors.js';
+export const DEFAULT_READ_ENTRIES_LIMIT = 100;
+export const MAX_READ_ENTRIES_LIMIT = 1000;
+function clampLimit(limit) {
+    if (limit === undefined || !Number.isFinite(limit))
+        return DEFAULT_READ_ENTRIES_LIMIT;
+    return Math.max(1, Math.min(MAX_READ_ENTRIES_LIMIT, Math.trunc(limit)));
+}
+function ledgerOf(ref) {
+    return { ledgerId: ref.ledgerId, ledgerEpochId: ref.ledgerEpochId };
+}
+function requireDecimal(value, label) {
+    if (!/^(0|[1-9][0-9]*)$/.test(value)) {
+        throw new AuditProtocolError(AUDIT_ERROR_CODES.CHECKPOINT_INVALID, `${label} must be a canonical non-negative decimal string`, { [label]: value });
+    }
+    return BigInt(value);
+}
+/**
+ * Reference read service backed by an {@link AuditJournalProvider} and, when
+ * proofs are needed, an {@link AuditCheckpointReadAccess}.
+ *
+ * Reads ride the journal's ordered `readRange`, so paging cost is independent of
+ * ledger size. Pagination fetches one extra entry to detect a further page
+ * without a second round trip.
+ */
+export class LocalAuditReadService {
+    journal;
+    checkpoints;
+    constructor(deps) {
+        this.journal = deps.journal;
+        this.checkpoints = deps.checkpoints;
+    }
+    getHead(ledger) {
+        return this.journal.getHead(ledgerOf(ledger));
+    }
+    async listEntries(query) {
+        const limit = clampLimit(query.limit);
+        const ledger = ledgerOf(query);
+        // Over-fetch by one: if the journal yields limit+1, a further page exists.
+        const collected = [];
+        for await (const entry of this.journal.readRange({
+            ...ledger,
+            ...(query.afterSequence === undefined ? {} : { afterSequence: query.afterSequence }),
+            limit: limit + 1,
+        })) {
+            collected.push(entry);
+            if (collected.length > limit)
+                break;
+        }
+        const hasMore = collected.length > limit;
+        const entries = hasMore ? collected.slice(0, limit) : collected;
+        const nextAfterSequence = hasMore ? entries[entries.length - 1].core.sequence : null;
+        const head = await this.journal.getHead(ledger);
+        return { entries, head, nextAfterSequence };
+    }
+    async getLatestCheckpoint(ledger) {
+        return this.requireCheckpoints().store.getLatest(ledgerOf(ledger));
+    }
+    async getInclusionProof(query) {
+        const checkpoints = this.requireCheckpoints();
+        const ledger = ledgerOf(query);
+        const checkpoint = await this.requireLatestCheckpoint(checkpoints, ledger);
+        const entry = await this.entryAtSequence(ledger, query.sequence);
+        const proof = await checkpoints.builder.inclusionProof(ledger, query.sequence, checkpoint);
+        return Object.freeze({
+            ledgerId: ledger.ledgerId,
+            ledgerEpochId: ledger.ledgerEpochId,
+            sequence: query.sequence,
+            entryDigest: entry.entryDigest,
+            checkpointDigest: checkpoint.checkpointDigest,
+            proof,
+        });
+    }
+    async getConsistencyProof(query) {
+        const checkpoints = this.requireCheckpoints();
+        const ledger = ledgerOf(query);
+        const newCheckpoint = await this.requireLatestCheckpoint(checkpoints, ledger);
+        const oldCheckpoint = await checkpoints.store.getByTreeSize(ledger, query.oldTreeSize);
+        if (oldCheckpoint === null) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.CHECKPOINT_INVALID, 'No signed checkpoint exists at the requested old tree size', { oldTreeSize: query.oldTreeSize });
+        }
+        const proof = await checkpoints.builder.consistencyProof(ledger, query.oldTreeSize, newCheckpoint);
+        return Object.freeze({
+            ledgerId: ledger.ledgerId,
+            ledgerEpochId: ledger.ledgerEpochId,
+            oldCheckpointDigest: oldCheckpoint.checkpointDigest,
+            newCheckpointDigest: newCheckpoint.checkpointDigest,
+            proof,
+        });
+    }
+    requireCheckpoints() {
+        if (this.checkpoints === undefined) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.INVALID_CONFIGURATION, 'This read service was built without checkpoint access; proofs are unavailable');
+        }
+        return this.checkpoints;
+    }
+    async requireLatestCheckpoint(checkpoints, ledger) {
+        const checkpoint = await checkpoints.store.getLatest(ledger);
+        if (checkpoint === null) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.CHECKPOINT_INVALID, 'No signed checkpoint exists for this ledger yet', { ledgerId: ledger.ledgerId });
+        }
+        return checkpoint;
+    }
+    async entryAtSequence(ledger, sequence) {
+        const value = requireDecimal(sequence, 'sequence');
+        // `readRange` is exclusive on afterSequence, so start one below the target.
+        const afterSequence = value > 1n ? String(value - 1n) : undefined;
+        for await (const entry of this.journal.readRange({
+            ...ledger,
+            ...(afterSequence === undefined ? {} : { afterSequence }),
+            limit: 1,
+        })) {
+            if (entry.core.sequence === sequence)
+                return entry;
+            break;
+        }
+        throw new AuditProtocolError(AUDIT_ERROR_CODES.CHECKPOINT_INVALID, 'No entry exists at the requested sequence', { sequence });
+    }
+}
+/** One-call composition helper mirroring {@link createLocalAuditRecorder}. */
+export function createLocalAuditReadService(deps) {
+    return new LocalAuditReadService(deps);
+}
+//# sourceMappingURL=read-service.js.map

package/dist/audit/read-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-service.js","sourceRoot":"","sources":["../../src/audit/read-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AA6FpE,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAC9C,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAE3C,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,0BAA0B,CAAC;IACtF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB;IACnC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,cAAc,CAAC,KAAoB,EAAE,KAAa;IACzD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,kBAAkB,EACpC,GAAG,KAAK,kDAAkD,EAC1D,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CACnB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAqB;IACf,OAAO,CAAuB;IAC9B,WAAW,CAA6B;IAEzD,YAAY,IAA0B;QACpC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACtC,CAAC;IAED,OAAO,CAAC,MAAsB;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA4B;QAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE/B,2EAA2E;QAC3E,MAAM,SAAS,GAAyB,EAAE,CAAC;QAC3C,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YAC/C,GAAG,MAAM;YACT,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;YACpF,KAAK,EAAE,KAAK,GAAG,CAAC;SACjB,CAAC,EAAE,CAAC;YACH,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtB,IAAI,SAAS,CAAC,MAAM,GAAG,KAAK;gBAAE,MAAM;QACtC,CAAC;QAED,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,KAAK,CAAC;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,MAAM,iBAAiB,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEhD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAsB;QAC9C,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAA+B;QACrD,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC3F,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;YAC7C,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,KAAiC;QAEjC,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC9E,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACvF,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,kBAAkB,EACpC,4DAA4D,EAC5D,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CACnC,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,gBAAgB,CACtD,MAAM,EACN,KAAK,CAAC,WAAW,EACjB,aAAa,CACd,CAAC;QACF,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,mBAAmB,EAAE,aAAa,CAAC,gBAAgB;YACnD,mBAAmB,EAAE,aAAa,CAAC,gBAAgB;YACnD,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAEO,kBAAkB;QACxB,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,qBAAqB,EACvC,+EAA+E,CAChF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,uBAAuB,CACnC,WAAsC,EACtC,MAAsB;QAEtB,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,kBAAkB,EACpC,iDAAiD,EACjD,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAC9B,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,MAAsB,EACtB,QAAuB;QAEvB,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACnD,4EAA4E;QAC5E,MAAM,aAAa,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClE,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YAC/C,GAAG,MAAM;YACT,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;YACzD,KAAK,EAAE,CAAC;SACT,CAAC,EAAE,CAAC;YACH,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YACnD,MAAM;QACR,CAAC;QACD,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,kBAAkB,EACpC,2CAA2C,EAC3C,EAAE,QAAQ,EAAE,CACb,CAAC;IACJ,CAAC;CACF;AAED,8EAA8E;AAC9E,MAAM,UAAU,2BAA2B,CAAC,IAA0B;IACpE,OAAO,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC"}

package/dist/audit/recorder-service.d.ts

@@ -0,0 +1,78 @@
+import { type AuditHasher, type AuditSigner } from './crypto.js';
+import type { AuditEvidenceProvider } from './providers/evidence.js';
+import type { AuditJournalProvider } from './providers/journal.js';
+import type { AuditRecorderSubmission } from './providers/recorder-client.js';
+import type { Digest, PartyRef, ProtocolBindingId, SignedAuditEntryV1 } from './types.js';
+export interface AuditClock {
+    now(): number;
+}
+export interface AuthenticatedAuditSubmissionContext {
+    producerAuthority: string;
+    tenantAuthority: string;
+    /** Exact authenticated producer binding for non-public or non-DID identifiers. */
+    producerRef?: PartyRef;
+    /** Exact authenticated tenant binding for opaque or commitment-based tenant identifiers. */
+    tenantRef?: PartyRef;
+}
+export interface AuditSubmissionAuthorizer {
+    authorize(input: {
+        submission: AuditRecorderSubmission;
+        context: AuthenticatedAuditSubmissionContext;
+    }): Promise<boolean> | boolean;
+}
+/**
+ * Authoritative epoch-transition port. A successful result means the predecessor terminal
+ * checkpoint was verified and the predecessor epoch was atomically sealed against new appends.
+ * Implementations must be idempotent for identical transition inputs.
+ */
+export interface AuditEpochTransitionGuard {
+    verifyAndSeal(input: {
+        ledgerId: string;
+        previousEpochId: string;
+        nextEpochId: string;
+        previousTerminalCheckpointDigest: Digest;
+    }): Promise<boolean>;
+}
+export interface AuditRecorderServiceConfig {
+    ledgerId: string;
+    ledgerEpochId: string;
+    tenantRef: PartyRef;
+    binding: ProtocolBindingId;
+    sourceId: string;
+    journal: AuditJournalProvider;
+    signer: AuditSigner;
+    hasher: AuditHasher;
+    clock: AuditClock;
+    evidence?: AuditEvidenceProvider;
+    authorizer?: AuditSubmissionAuthorizer;
+    previousEpochId?: string;
+    previousTerminalCheckpointDigest?: Digest;
+    epochTransitionGuard?: AuditEpochTransitionGuard;
+    maxAppendConflicts?: number;
+}
+export declare class AuditRecorderService {
+    private readonly config;
+    private readonly maxAppendConflicts;
+    private initialization?;
+    constructor(config: AuditRecorderServiceConfig);
+    submitAuthenticated(submission: AuditRecorderSubmission, context: AuthenticatedAuditSubmissionContext): Promise<SignedAuditEntryV1>;
+    /**
+     * Best-effort compensation for write-ahead evidence whose append failed: the
+     * ciphertext is disposed only after re-confirming that no committed entry
+     * claims this event identity, so a raced idempotent commit is never stripped
+     * of its evidence. Failures here leave orphans for operator retention tooling.
+     */
+    private disposeUncommittedEvidence;
+    private validateSubmissionEnvelope;
+    private validateEventAuthority;
+    private persistSubmittedEvidence;
+    private ensureInitialized;
+    private validateExistingGenesis;
+    private genesisEvent;
+    private appendEvent;
+    private identifyEvent;
+    private resolveDuplicate;
+    private buildCandidate;
+    private ledgerRef;
+}
+//# sourceMappingURL=recorder-service.d.ts.map

package/dist/audit/recorder-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recorder-service.d.ts","sourceRoot":"","sources":["../../src/audit/recorder-service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkB,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AASjF,OAAO,KAAK,EAAE,qBAAqB,EAA0B,MAAM,yBAAyB,CAAC;AAC7F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAS9E,OAAO,KAAK,EAIV,MAAM,EACN,QAAQ,EACR,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,UAAU;IACzB,GAAG,IAAI,MAAM,CAAC;CACf;AAED,MAAM,WAAW,mCAAmC;IAClD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,kFAAkF;IAClF,WAAW,CAAC,EAAE,QAAQ,CAAC;IACvB,4FAA4F;IAC5F,SAAS,CAAC,EAAE,QAAQ,CAAC;CACtB;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,CAAC,KAAK,EAAE;QACf,UAAU,EAAE,uBAAuB,CAAC;QACpC,OAAO,EAAE,mCAAmC,CAAC;KAC9C,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CAChC;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,aAAa,CAAC,KAAK,EAAE;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,MAAM,CAAC;QACpB,gCAAgC,EAAE,MAAM,CAAC;KAC1C,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,QAAQ,CAAC;IACpB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,oBAAoB,CAAC;IAC9B,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,UAAU,CAAC;IAClB,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC,UAAU,CAAC,EAAE,yBAAyB,CAAC;IACvC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gCAAgC,CAAC,EAAE,MAAM,CAAC;IAC1C,oBAAoB,CAAC,EAAE,yBAAyB,CAAC;IACjD,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AA+BD,qBAAa,oBAAoB;IAInB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAHnC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,cAAc,CAAC,CAA8B;gBAExB,MAAM,EAAE,0BAA0B;IAiBzD,mBAAmB,CACvB,UAAU,EAAE,uBAAuB,EACnC,OAAO,EAAE,mCAAmC,GAC3C,OAAO,CAAC,kBAAkB,CAAC;IAqC9B;;;;;OAKG;YACW,0BAA0B;IAwBxC,OAAO,CAAC,0BAA0B;IAelC,OAAO,CAAC,sBAAsB;YAuBhB,wBAAwB;YAuCxB,iBAAiB;IAuC/B,OAAO,CAAC,uBAAuB;IAgC/B,OAAO,CAAC,YAAY;YAiCN,WAAW;YAwEX,aAAa;IAkB3B,OAAO,CAAC,gBAAgB;YAWV,cAAc;IAuC5B,OAAO,CAAC,SAAS;CAMlB"}

package/dist/audit/recorder-service.js

@@ -0,0 +1,331 @@
+import { canonicalizeJson, canonicalizeJsonBytes } from '../utils/canonical-json.js';
+import { AUDIT_ERROR_CODES, AuditProtocolError } from './errors.js';
+import { hashAuditValue } from './crypto.js';
+import { AUDIT_DIGEST_DOMAINS, buildAuditRecorderReceiptCore, collectAuditEvidenceRefs, digestAuditEntry, digestAuditEvidenceManifest, digestAuditEvent, } from './integrity.js';
+import { AUDIT_ENTRY_SCHEMA_ID, AUDIT_EVENT_SCHEMA_ID, AUDIT_INTEGRITY_SUITE, parseAuditEntryCore, parseAuditProducerEvent, parseSignedAuditEntry, } from './schemas.js';
+function deepFreeze(value) {
+    if (typeof value !== 'object' || value === null || Object.isFrozen(value))
+        return value;
+    for (const child of Object.values(value))
+        deepFreeze(child);
+    return Object.freeze(value);
+}
+function sameHead(left, right) {
+    if (left === null || right === null)
+        return left === right;
+    return left.entryDigest === right.entryDigest && left.sequence === right.sequence;
+}
+function sameSigner(left, right) {
+    return left.did === right.did && left.kid === right.kid && left.alg === right.alg;
+}
+function sameParty(left, right) {
+    return canonicalizeJson(left) === canonicalizeJson(right);
+}
+function authorityMatchesParty(authority, boundRef, claimedRef) {
+    if (boundRef !== undefined)
+        return sameParty(boundRef, claimedRef);
+    return (claimedRef.kind === 'public_did' || claimedRef.kind === 'pairwise_did') &&
+        claimedRef.did === authority;
+}
+export class AuditRecorderService {
+    config;
+    maxAppendConflicts;
+    initialization;
+    constructor(config) {
+        this.config = config;
+        if ((config.previousEpochId === undefined) !==
+            (config.previousTerminalCheckpointDigest === undefined)) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.INVALID_CONFIGURATION, 'Previous epoch ID and terminal checkpoint digest must be supplied together');
+        }
+        if (config.previousEpochId !== undefined && config.epochTransitionGuard === undefined) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.INVALID_CONFIGURATION, 'Epoch transitions require an authoritative verify-and-seal guard');
+        }
+        this.maxAppendConflicts = config.maxAppendConflicts ?? 256;
+    }
+    async submitAuthenticated(submission, context) {
+        this.validateSubmissionEnvelope(submission, context);
+        const producerEvent = parseAuditProducerEvent(submission.producerEvent);
+        this.validateEventAuthority(producerEvent, context);
+        if (this.config.authorizer !== undefined &&
+            !(await this.config.authorizer.authorize({ submission, context }))) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.UNAUTHORIZED_SUBMISSION, 'Audit producer is not authorized for this ledger');
+        }
+        const identity = await this.identifyEvent(producerEvent, context);
+        const duplicate = await this.config.journal.getByIdempotencyKey(this.config.ledgerId, identity.idempotencyKey);
+        if (duplicate !== null)
+            return this.resolveDuplicate(duplicate, identity.eventDigest);
+        // Only a new append must target the active epoch. Logical-ledger idempotency
+        // is resolved first so a redelivered submission pinned to a retained earlier
+        // epoch returns its original entry instead of wedging on EPOCH_MISMATCH.
+        if (submission.expectedLedgerEpochId !== undefined &&
+            submission.expectedLedgerEpochId !== this.config.ledgerEpochId) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.EPOCH_MISMATCH, 'Wrong audit ledger epoch');
+        }
+        await this.ensureInitialized();
+        await this.persistSubmittedEvidence(submission.encryptedEvidence, producerEvent);
+        try {
+            return await this.appendEvent(producerEvent, context, false, identity);
+        }
+        catch (error) {
+            await this.disposeUncommittedEvidence(submission.encryptedEvidence, identity);
+            throw error;
+        }
+    }
+    /**
+     * Best-effort compensation for write-ahead evidence whose append failed: the
+     * ciphertext is disposed only after re-confirming that no committed entry
+     * claims this event identity, so a raced idempotent commit is never stripped
+     * of its evidence. Failures here leave orphans for operator retention tooling.
+     */
+    async disposeUncommittedEvidence(evidence, identity) {
+        if (evidence.length === 0 || this.config.evidence === undefined)
+            return;
+        try {
+            const committed = await this.config.journal.getByIdempotencyKey(this.config.ledgerId, identity.idempotencyKey);
+            if (committed !== null)
+                return;
+            for (const item of evidence) {
+                await this.config.evidence.applyRetention({
+                    kind: 'dispose',
+                    ref: item.ref,
+                    authorizedBy: 'audit-recorder',
+                    reason: 'append_failed_uncommitted',
+                });
+            }
+        }
+        catch {
+            // Retaining an orphan is preferable to disposing racing committed evidence.
+        }
+    }
+    validateSubmissionEnvelope(submission, context) {
+        if (!context.producerAuthority || !context.tenantAuthority) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.UNAUTHORIZED_SUBMISSION, 'Authenticated producer and tenant authority are required');
+        }
+        if (submission.ledgerId !== this.config.ledgerId) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.LEDGER_MISMATCH, 'Wrong audit ledger');
+        }
+    }
+    validateEventAuthority(event, context) {
+        if (!authorityMatchesParty(context.producerAuthority, context.producerRef, event.source.producer)) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.UNAUTHORIZED_SUBMISSION, 'Event producer does not match the authenticated producer authority');
+        }
+        if (!sameParty(event.tenantRef, this.config.tenantRef) ||
+            !authorityMatchesParty(context.tenantAuthority, context.tenantRef, event.tenantRef)) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.UNAUTHORIZED_SUBMISSION, 'Event tenant does not match the authenticated tenant authority');
+        }
+    }
+    async persistSubmittedEvidence(evidence, event) {
+        if (evidence.length === 0)
+            return;
+        if (this.config.evidence === undefined) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.EVIDENCE_FAILURE, 'Encrypted evidence was submitted but no evidence provider is configured');
+        }
+        try {
+            const refs = new Map(collectAuditEvidenceRefs(event).map((ref) => [ref.objectId, ref]));
+            const submitted = new Set();
+            for (const item of evidence) {
+                const referenced = refs.get(item.ref.objectId);
+                if (submitted.has(item.ref.objectId) || referenced === undefined ||
+                    canonicalizeJson(referenced) !== canonicalizeJson(item.ref)) {
+                    throw new AuditProtocolError(AUDIT_ERROR_CODES.EVIDENCE_FAILURE, 'Submitted evidence does not exactly match a unique frozen event reference', { objectId: item.ref.objectId });
+                }
+                submitted.add(item.ref.objectId);
+                await this.config.evidence.putIfAbsent(item);
+            }
+        }
+        catch (error) {
+            if (error instanceof AuditProtocolError &&
+                error.code === AUDIT_ERROR_CODES.EVIDENCE_FAILURE)
+                throw error;
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.EVIDENCE_FAILURE, 'Required evidence could not be persisted', undefined, { cause: error });
+        }
+    }
+    async ensureInitialized() {
+        const ledger = this.ledgerRef();
+        const existingHead = await this.config.journal.getHead(ledger);
+        if (existingHead !== null) {
+            const first = this.config.journal.readRange({ ...ledger, limit: 1 });
+            for await (const entry of first)
+                return this.validateExistingGenesis(entry);
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.JOURNAL_FAILURE, 'Ledger head exists without genesis');
+        }
+        if (this.config.previousEpochId !== undefined) {
+            const verifiedAndSealed = await this.config.epochTransitionGuard.verifyAndSeal({
+                ledgerId: this.config.ledgerId,
+                previousEpochId: this.config.previousEpochId,
+                nextEpochId: this.config.ledgerEpochId,
+                previousTerminalCheckpointDigest: this.config.previousTerminalCheckpointDigest,
+            });
+            if (!verifiedAndSealed) {
+                throw new AuditProtocolError(AUDIT_ERROR_CODES.INVALID_CONFIGURATION, 'Predecessor checkpoint could not be verified and sealed');
+            }
+        }
+        this.initialization ??= this.appendEvent(this.genesisEvent(), {
+            producerAuthority: this.config.signer.ref.did,
+            tenantAuthority: 'audit-recorder',
+            producerRef: { kind: 'public_did', did: this.config.signer.ref.did },
+            tenantRef: this.config.tenantRef,
+        }, true).finally(() => {
+            this.initialization = undefined;
+        });
+        return this.initialization;
+    }
+    validateExistingGenesis(candidate) {
+        try {
+            const entry = parseSignedAuditEntry(candidate);
+            const details = entry.core.event.details;
+            const valid = entry.core.sequence === '0' &&
+                entry.core.previousEntryDigest === null &&
+                entry.core.ledgerId === this.config.ledgerId &&
+                entry.core.ledgerEpochId === this.config.ledgerEpochId &&
+                sameSigner(entry.core.recorder, this.config.signer.ref) &&
+                entry.core.event.eventType === 'ledger.epoch.started' &&
+                entry.core.event.binding === this.config.binding &&
+                entry.core.event.source.sourceId === this.config.sourceId &&
+                entry.core.event.source.producer.kind === 'public_did' &&
+                entry.core.event.source.producer.did === this.config.signer.ref.did &&
+                sameParty(entry.core.event.tenantRef, this.config.tenantRef) &&
+                details.family === 'ledger' &&
+                details.phase === 'epoch_started' &&
+                details.previousEpochId === this.config.previousEpochId &&
+                details.previousTerminalCheckpointDigest ===
+                    this.config.previousTerminalCheckpointDigest;
+            if (!valid)
+                throw new Error('Genesis does not match recorder epoch configuration');
+            return entry;
+        }
+        catch (error) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.JOURNAL_FAILURE, 'Existing ledger genesis does not match the authoritative recorder configuration', undefined, { cause: error });
+        }
+    }
+    genesisEvent() {
+        return parseAuditProducerEvent({
+            schema: AUDIT_EVENT_SCHEMA_ID,
+            eventId: `genesis:${this.config.ledgerId}:${this.config.ledgerEpochId}`,
+            eventType: 'ledger.epoch.started',
+            eventVersion: '1.0.0',
+            binding: this.config.binding,
+            occurredAt: this.config.clock.now(),
+            tenantRef: this.config.tenantRef,
+            source: {
+                producer: { kind: 'public_did', did: this.config.signer.ref.did },
+                sourceId: this.config.sourceId,
+                sourceSequence: '0',
+            },
+            resource: { kind: 'public_did', did: this.config.signer.ref.did },
+            action: { category: 'ledger.epoch' },
+            outcome: 'succeeded',
+            evidence: [],
+            details: {
+                family: 'ledger',
+                phase: 'epoch_started',
+                ...(this.config.previousEpochId
+                    ? {
+                        previousEpochId: this.config.previousEpochId,
+                        previousTerminalCheckpointDigest: this.config.previousTerminalCheckpointDigest,
+                    }
+                    : {}),
+            },
+            privacy: { classification: 'internal', retentionClass: 'integrity-ledger' },
+        });
+    }
+    async appendEvent(event, context, genesis = false, knownIdentity) {
+        const { eventDigest, idempotencyKey } = knownIdentity ??
+            await this.identifyEvent(event, context);
+        const duplicate = await this.config.journal.getByIdempotencyKey(this.config.ledgerId, idempotencyKey);
+        if (duplicate !== null) {
+            // A raced replica genesis differs only in recorder-authored timing, so it
+            // resolves through epoch-configuration validation, not content identity.
+            return genesis
+                ? this.validateExistingGenesis(duplicate)
+                : this.resolveDuplicate(duplicate, eventDigest);
+        }
+        const ledger = this.ledgerRef();
+        for (let attempt = 0; attempt <= this.maxAppendConflicts; attempt += 1) {
+            const head = await this.config.journal.getHead(ledger);
+            if (genesis && head !== null) {
+                const raced = await this.config.journal.getByIdempotencyKey(this.config.ledgerId, idempotencyKey);
+                if (raced !== null)
+                    return this.validateExistingGenesis(raced);
+            }
+            const candidate = await this.buildCandidate(event, eventDigest, head, genesis);
+            let result;
+            try {
+                result = await this.config.journal.compareAndAppend({
+                    ledger,
+                    expectedHead: head,
+                    entry: candidate,
+                    idempotencyKey,
+                });
+            }
+            catch (error) {
+                throw new AuditProtocolError(AUDIT_ERROR_CODES.JOURNAL_FAILURE, 'Audit journal append failed', undefined, { cause: error });
+            }
+            if (result.kind === 'appended' || result.kind === 'duplicate') {
+                return result.kind === 'duplicate'
+                    ? this.resolveDuplicate(result.entry, eventDigest)
+                    : result.entry;
+            }
+            if (result.kind === 'idempotency_conflict') {
+                return this.resolveDuplicate(result.existing, eventDigest);
+            }
+            if (sameHead(head, result.actualHead)) {
+                throw new AuditProtocolError(AUDIT_ERROR_CODES.JOURNAL_FAILURE, 'Audit journal reported a head conflict without advancing its head');
+            }
+        }
+        throw new AuditProtocolError(AUDIT_ERROR_CODES.APPEND_CONFLICT_EXHAUSTED, 'Audit append conflict retry budget exhausted');
+    }
+    async identifyEvent(event, context) {
+        const eventDigest = await digestAuditEvent(this.config.hasher, event);
+        const idempotencyKey = await hashAuditValue(this.config.hasher, AUDIT_DIGEST_DOMAINS.idempotency, {
+            ledgerId: this.config.ledgerId,
+            producerAuthority: context.producerAuthority,
+            sourceId: event.source.sourceId,
+            eventId: event.eventId,
+        });
+        return { eventDigest, idempotencyKey };
+    }
+    resolveDuplicate(existing, digest) {
+        if (existing.eventDigest !== digest) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.EVENT_ID_CONFLICT, 'Authenticated producer event identity was reused with different content', { eventId: existing.core.event.eventId });
+        }
+        return existing;
+    }
+    async buildCandidate(event, eventDigest, head, genesis) {
+        const sequence = head === null ? '0' : (BigInt(head.sequence) + 1n).toString();
+        if (genesis !== (sequence === '0')) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.JOURNAL_FAILURE, genesis ? 'Genesis must be the first epoch entry' : 'Producer event cannot replace genesis');
+        }
+        const recordedAt = this.config.clock.now();
+        const evidenceManifestDigest = await digestAuditEvidenceManifest(this.config.hasher, event);
+        const core = parseAuditEntryCore({
+            schema: AUDIT_ENTRY_SCHEMA_ID,
+            ledgerId: this.config.ledgerId,
+            ledgerEpochId: this.config.ledgerEpochId,
+            sequence,
+            previousEntryDigest: head?.entryDigest ?? null,
+            recordedAt,
+            recorder: this.config.signer.ref,
+            eventDigest,
+            event,
+            evidenceManifestDigest,
+            integritySuite: AUDIT_INTEGRITY_SUITE,
+        });
+        const entryDigest = await digestAuditEntry(this.config.hasher, core);
+        const receiptCore = buildAuditRecorderReceiptCore(core, entryDigest);
+        const jws = await this.config.signer.sign(canonicalizeJsonBytes(receiptCore));
+        return deepFreeze({
+            core,
+            eventDigest,
+            entryDigest,
+            recorderReceipt: { core: receiptCore, jws },
+        });
+    }
+    ledgerRef() {
+        return {
+            ledgerId: this.config.ledgerId,
+            ledgerEpochId: this.config.ledgerEpochId,
+        };
+    }
+}
+//# sourceMappingURL=recorder-service.js.map