@kya-os/mcp 1.10.1 → 1.12.0

package/dist/audit/checkpoint-coordinator.js

@@ -0,0 +1,112 @@
+import { AUDIT_ERROR_CODES, AuditProtocolError } from './errors.js';
+/**
+ * Coordinates post-commit checkpoint publication. A failed publication never
+ * rolls back or rewrites the already signed checkpoint.
+ */
+export class AuditCheckpointCoordinator {
+    options;
+    observers;
+    anchors;
+    maxAttempts;
+    constructor(options) {
+        this.options = options;
+        this.observers = options.observers ?? [];
+        this.anchors = options.anchors ?? [];
+        this.maxAttempts = options.maxPublishAttempts ?? 1;
+        if (!Number.isSafeInteger(this.maxAttempts) || this.maxAttempts < 1) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.INVALID_CONFIGURATION, 'Checkpoint publication attempts must be a positive safe integer');
+        }
+        const requirements = options.requirements;
+        if (requirements !== undefined &&
+            (!Number.isSafeInteger(requirements.minimumObservers) ||
+                requirements.minimumObservers < 0)) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.INVALID_CONFIGURATION, 'Minimum checkpoint observers must be a non-negative safe integer');
+        }
+    }
+    async createAndPublish(ledger) {
+        const checkpoint = await this.options.checkpoints.createCheckpoint(ledger);
+        const observations = [];
+        const anchors = [];
+        const failures = [];
+        await Promise.all(this.observers.map(async (provider, providerIndex) => {
+            const outcome = await this.publishWithRetry('observer', providerIndex, () => provider.publish(checkpoint));
+            if (outcome.ok)
+                observations.push(outcome.value);
+            else
+                failures.push(outcome.failure);
+        }));
+        await Promise.all(this.anchors.map(async (provider, providerIndex) => {
+            const outcome = await this.publishWithRetry('anchor', providerIndex, () => provider.publish(checkpoint), provider.kind);
+            if (outcome.ok)
+                anchors.push(outcome.value);
+            else
+                failures.push(outcome.failure);
+        }));
+        observations.sort((left, right) => left.core.observerId.localeCompare(right.core.observerId));
+        anchors.sort((left, right) => left.kind.localeCompare(right.kind) || left.providerId.localeCompare(right.providerId));
+        failures.sort((left, right) => left.role.localeCompare(right.role) || left.providerIndex - right.providerIndex);
+        const result = { checkpoint, observations, anchors, failures };
+        this.assertRequirements(result);
+        await this.options.onPublished?.(result);
+        return result;
+    }
+    async publishWithRetry(role, providerIndex, publish, kind) {
+        let lastError;
+        for (let attempt = 1; attempt <= this.maxAttempts; attempt += 1) {
+            try {
+                return { ok: true, value: await publish() };
+            }
+            catch (error) {
+                lastError = error;
+                if (attempt < this.maxAttempts) {
+                    try {
+                        await this.options.backoff?.({ role, providerIndex, attempt, error });
+                    }
+                    catch (backoffError) {
+                        return {
+                            ok: false,
+                            failure: {
+                                role,
+                                providerIndex,
+                                ...(kind === undefined ? {} : { kind }),
+                                attempts: attempt,
+                                error: new AggregateError([error, backoffError], 'Checkpoint publication backoff failed'),
+                            },
+                        };
+                    }
+                }
+            }
+        }
+        return {
+            ok: false,
+            failure: {
+                role,
+                providerIndex,
+                ...(kind === undefined ? {} : { kind }),
+                attempts: this.maxAttempts,
+                error: lastError,
+            },
+        };
+    }
+    assertRequirements(result) {
+        const requirements = this.options.requirements;
+        if (requirements === undefined)
+            return;
+        const missingKinds = [...new Set(requirements.requiredAnchorKinds)].filter((kind) => !result.anchors.some((receipt) => receipt.kind === kind));
+        if (result.observations.length < requirements.minimumObservers || missingKinds.length > 0) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.CHECKPOINT_PUBLICATION_FAILED, 'Signed checkpoint did not obtain the required external publication evidence', {
+                checkpointDigest: result.checkpoint.checkpointDigest,
+                requiredObservers: requirements.minimumObservers,
+                publishedObservers: result.observations.length,
+                missingAnchorKinds: missingKinds,
+                failedProviders: result.failures.map(({ role, providerIndex, kind, attempts }) => ({
+                    role,
+                    providerIndex,
+                    ...(kind === undefined ? {} : { kind }),
+                    attempts,
+                })),
+            });
+        }
+    }
+}
+//# sourceMappingURL=checkpoint-coordinator.js.map

package/dist/audit/checkpoint-coordinator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpoint-coordinator.js","sourceRoot":"","sources":["../../src/audit/checkpoint-coordinator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AA+CpE;;;GAGG;AACH,MAAM,OAAO,0BAA0B;IAKR;IAJZ,SAAS,CAA6C;IACtD,OAAO,CAAiC;IACxC,WAAW,CAAS;IAErC,YAA6B,OAA0C;QAA1C,YAAO,GAAP,OAAO,CAAmC;QACrE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,kBAAkB,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,qBAAqB,EACvC,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QAC1C,IAAI,YAAY,KAAK,SAAS;YAC5B,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,gBAAgB,CAAC;gBACnD,YAAY,CAAC,gBAAgB,GAAG,CAAC,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,qBAAqB,EACvC,kEAAkE,CACnE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAsB;QAC3C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC3E,MAAM,YAAY,GAAgC,EAAE,CAAC;QACrD,MAAM,OAAO,GAAyB,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAwC,EAAE,CAAC;QAEzD,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CACzC,UAAU,EACV,aAAa,EACb,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CACnC,CAAC;YACF,IAAI,OAAO,CAAC,EAAE;gBAAE,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;;gBAC5C,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE;YACnE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CACzC,QAAQ,EACR,aAAa,EACb,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAClC,QAAQ,CAAC,IAAI,CACd,CAAC;YACF,IAAI,OAAO,CAAC,EAAE;gBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;;gBACvC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC,CAAC;QAEJ,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9F,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC3B,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1F,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC5B,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC/D,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,IAA+C,EAC/C,aAAqB,EACrB,OAAyB,EACzB,IAAiC;QAKjC,IAAI,SAAkB,CAAC;QACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,WAAW,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAChE,IAAI,CAAC;gBACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,OAAO,EAAE,EAAE,CAAC;YAC9C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,GAAG,KAAK,CAAC;gBAClB,IAAI,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC/B,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;oBACxE,CAAC;oBAAC,OAAO,YAAY,EAAE,CAAC;wBACtB,OAAO;4BACL,EAAE,EAAE,KAAK;4BACT,OAAO,EAAE;gCACP,IAAI;gCACJ,aAAa;gCACb,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;gCACvC,QAAQ,EAAE,OAAO;gCACjB,KAAK,EAAE,IAAI,cAAc,CACvB,CAAC,KAAK,EAAE,YAAY,CAAC,EACrB,uCAAuC,CACxC;6BACF;yBACF,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI;gBACJ,aAAa;gBACb,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;gBACvC,QAAQ,EAAE,IAAI,CAAC,WAAW;gBAC1B,KAAK,EAAE,SAAS;aACjB;SACF,CAAC;IACJ,CAAC;IAEO,kBAAkB,CAAC,MAAwC;QACjE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;QAC/C,IAAI,YAAY,KAAK,SAAS;YAAE,OAAO;QACvC,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAClF,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC;QAC5D,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,YAAY,CAAC,gBAAgB,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1F,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,6BAA6B,EAC/C,6EAA6E,EAC7E;gBACE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,gBAAgB;gBACpD,iBAAiB,EAAE,YAAY,CAAC,gBAAgB;gBAChD,kBAAkB,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM;gBAC9C,kBAAkB,EAAE,YAAY;gBAChC,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;oBACjF,IAAI;oBACJ,aAAa;oBACb,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;oBACvC,QAAQ;iBACT,CAAC,CAAC;aACJ,CACF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/audit/checkpoint.d.ts

@@ -0,0 +1,59 @@
+import type { AuditHasher, AuditSigner } from './crypto.js';
+import type { AuditJournalProvider } from './providers/journal.js';
+import type { AuditLedgerRef, AuditMerkleConsistencyProofV1, AuditMerkleInclusionProofV1, DecimalString, Digest, SignedAuditCheckpointV1 } from './types.js';
+export type AuditCheckpointPutResult = {
+    kind: 'inserted';
+    checkpoint: SignedAuditCheckpointV1;
+} | {
+    kind: 'existing';
+    checkpoint: SignedAuditCheckpointV1;
+} | {
+    kind: 'conflict';
+    checkpoint: SignedAuditCheckpointV1;
+};
+export interface AuditCheckpointStore {
+    getLatest(ledger: AuditLedgerRef): Promise<SignedAuditCheckpointV1 | null>;
+    getByTreeSize(ledger: AuditLedgerRef, treeSize: DecimalString): Promise<SignedAuditCheckpointV1 | null>;
+    putIfAbsent(checkpoint: SignedAuditCheckpointV1): Promise<AuditCheckpointPutResult>;
+}
+/** Ephemeral reference store; durable adapters must preserve the same CAS semantics. */
+export declare class MemoryAuditCheckpointStore implements AuditCheckpointStore {
+    private readonly checkpoints;
+    private readonly latest;
+    getLatest(ledger: AuditLedgerRef): Promise<SignedAuditCheckpointV1 | null>;
+    getByTreeSize(ledger: AuditLedgerRef, treeSize: DecimalString): Promise<SignedAuditCheckpointV1 | null>;
+    putIfAbsent(checkpoint: SignedAuditCheckpointV1): Promise<AuditCheckpointPutResult>;
+}
+export interface AuditCheckpointBuilderOptions {
+    journal: AuditJournalProvider;
+    store: AuditCheckpointStore;
+    signer: AuditSigner;
+    hasher: AuditHasher;
+    clock?: {
+        now(): number;
+    };
+    onCheckpointCreated?: (checkpoint: SignedAuditCheckpointV1) => Promise<void> | void;
+}
+/** Creates append-only RFC 9162 checkpoints from a stable journal high-water mark. */
+export declare class AuditCheckpointBuilder {
+    private readonly options;
+    private readonly tree;
+    private readonly clock;
+    constructor(options: AuditCheckpointBuilderOptions);
+    createCheckpoint(ledger: AuditLedgerRef): Promise<SignedAuditCheckpointV1>;
+    inclusionProof(ledger: AuditLedgerRef, sequence: DecimalString, checkpoint: SignedAuditCheckpointV1): Promise<AuditMerkleInclusionProofV1>;
+    consistencyProof(ledger: AuditLedgerRef, oldTreeSize: DecimalString, checkpoint: SignedAuditCheckpointV1): Promise<AuditMerkleConsistencyProofV1>;
+    rootForRange(ledger: AuditLedgerRef, treeSize: DecimalString): Promise<Digest>;
+    verifyInclusion(entryDigest: Digest, checkpoint: SignedAuditCheckpointV1, proof: AuditMerkleInclusionProofV1): Promise<boolean>;
+    verifyConsistency(input: {
+        oldTreeSize: DecimalString;
+        oldRoot: Digest;
+        checkpoint: SignedAuditCheckpointV1;
+        proof: AuditMerkleConsistencyProofV1;
+    }): Promise<boolean>;
+    private snapshotAtHead;
+    private entriesForCheckpoint;
+    private readEntries;
+    private assertCheckpointLedger;
+}
+//# sourceMappingURL=checkpoint.d.ts.map

package/dist/audit/checkpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpoint.d.ts","sourceRoot":"","sources":["../../src/audit/checkpoint.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAM5D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,KAAK,EACV,cAAc,EACd,6BAA6B,EAC7B,2BAA2B,EAC3B,aAAa,EACb,MAAM,EACN,uBAAuB,EAExB,MAAM,YAAY,CAAC;AAwCpB,MAAM,MAAM,wBAAwB,GAChC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,UAAU,EAAE,uBAAuB,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,UAAU,EAAE,uBAAuB,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,UAAU,EAAE,uBAAuB,CAAA;CAAE,CAAC;AAE9D,MAAM,WAAW,oBAAoB;IACnC,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAC3E,aAAa,CACX,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAC3C,WAAW,CAAC,UAAU,EAAE,uBAAuB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACrF;AAED,wFAAwF;AACxF,qBAAa,0BAA2B,YAAW,oBAAoB;IACrE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA8C;IAC1E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8C;IAE/D,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAI1E,aAAa,CACjB,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAIpC,WAAW,CAAC,UAAU,EAAE,uBAAuB,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAmB1F;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,oBAAoB,CAAC;IAC9B,KAAK,EAAE,oBAAoB,CAAC;IAC5B,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,CAAC,EAAE;QAAE,GAAG,IAAI,MAAM,CAAA;KAAE,CAAC;IAC1B,mBAAmB,CAAC,EAAE,CAAC,UAAU,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACrF;AAED,sFAAsF;AACtF,qBAAa,sBAAsB;IAIrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoB;IACzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;gBAEb,OAAO,EAAE,6BAA6B;IAK7D,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAwE1E,cAAc,CAClB,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,aAAa,EACvB,UAAU,EAAE,uBAAuB,GAClC,OAAO,CAAC,2BAA2B,CAAC;IAqBjC,gBAAgB,CACpB,MAAM,EAAE,cAAc,EACtB,WAAW,EAAE,aAAa,EAC1B,UAAU,EAAE,uBAAuB,GAClC,OAAO,CAAC,6BAA6B,CAAC;IAcnC,YAAY,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC;IAc9E,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,uBAAuB,EACnC,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,OAAO,CAAC;IAWb,iBAAiB,CAAC,KAAK,EAAE;QAC7B,WAAW,EAAE,aAAa,CAAC;QAC3B,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,uBAAuB,CAAC;QACpC,KAAK,EAAE,6BAA6B,CAAC;KACtC,GAAG,OAAO,CAAC,OAAO,CAAC;YAeN,cAAc;YAkBd,oBAAoB;YAmBpB,WAAW;IAiBzB,OAAO,CAAC,sBAAsB;CAY/B"}

package/dist/audit/checkpoint.js

@@ -0,0 +1,219 @@
+import { canonicalizeJsonBytes } from '../utils/canonical-json.js';
+import { hashAuditValue } from './crypto.js';
+import { AUDIT_DIGEST_DOMAINS } from './integrity.js';
+import { AUDIT_ERROR_CODES, AuditProtocolError } from './errors.js';
+import { Rfc9162MerkleTree } from './merkle.js';
+import { parseAuditCheckpointCore } from './schemas.js';
+const CHECKPOINT_SCHEMA = 'https://schema.kya-os.org/v1/protocol/audit/checkpoint/v1.0.0';
+const CHECKPOINT_SUITE = 'KYA-AUDIT-RFC9162-SHA256-JWS-2026';
+function ledgerKey(ledger) {
+    return `${ledger.ledgerId}\0${ledger.ledgerEpochId}`;
+}
+function checkpointKey(ledger, treeSize) {
+    return `${ledgerKey(ledger)}\0${treeSize}`;
+}
+function parseDecimal(value, label) {
+    if (!/^(0|[1-9][0-9]*)$/.test(value)) {
+        throw new AuditProtocolError(AUDIT_ERROR_CODES.CHECKPOINT_INVALID, `${label} must be a canonical non-negative decimal string`);
+    }
+    return BigInt(value);
+}
+function toSafeNumber(value, label) {
+    if (value > BigInt(Number.MAX_SAFE_INTEGER)) {
+        throw new AuditProtocolError(AUDIT_ERROR_CODES.CHECKPOINT_INVALID, `${label} exceeds this implementation's safe in-memory proof range`);
+    }
+    return Number(value);
+}
+function deepFreeze(value) {
+    if (typeof value !== 'object' || value === null || Object.isFrozen(value))
+        return value;
+    for (const child of Object.values(value))
+        deepFreeze(child);
+    return Object.freeze(value);
+}
+/** Ephemeral reference store; durable adapters must preserve the same CAS semantics. */
+export class MemoryAuditCheckpointStore {
+    checkpoints = new Map();
+    latest = new Map();
+    async getLatest(ledger) {
+        return this.latest.get(ledgerKey(ledger)) ?? null;
+    }
+    async getByTreeSize(ledger, treeSize) {
+        return this.checkpoints.get(checkpointKey(ledger, treeSize)) ?? null;
+    }
+    async putIfAbsent(checkpoint) {
+        const ledger = checkpoint.core;
+        const key = checkpointKey(ledger, checkpoint.core.treeSize);
+        const existing = this.checkpoints.get(key);
+        if (existing !== undefined) {
+            return existing.checkpointDigest === checkpoint.checkpointDigest
+                ? { kind: 'existing', checkpoint: existing }
+                : { kind: 'conflict', checkpoint: existing };
+        }
+        const frozen = deepFreeze(checkpoint);
+        this.checkpoints.set(key, frozen);
+        const current = this.latest.get(ledgerKey(ledger));
+        if (current === undefined ||
+            BigInt(current.core.treeSize) < BigInt(checkpoint.core.treeSize)) {
+            this.latest.set(ledgerKey(ledger), frozen);
+        }
+        return { kind: 'inserted', checkpoint: frozen };
+    }
+}
+/** Creates append-only RFC 9162 checkpoints from a stable journal high-water mark. */
+export class AuditCheckpointBuilder {
+    options;
+    tree;
+    clock;
+    constructor(options) {
+        this.options = options;
+        this.tree = new Rfc9162MerkleTree(options.hasher);
+        this.clock = options.clock ?? Date;
+    }
+    async createCheckpoint(ledger) {
+        const entries = await this.snapshotAtHead(ledger);
+        if (entries.length === 0) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.CHECKPOINT_INVALID, 'Cannot checkpoint an empty audit epoch');
+        }
+        const treeSize = String(entries.length);
+        const previous = await this.options.store.getLatest(ledger);
+        if (previous !== null) {
+            const previousSize = parseDecimal(previous.core.treeSize, 'Previous tree size');
+            if (previousSize > BigInt(entries.length)) {
+                throw new AuditProtocolError(AUDIT_ERROR_CODES.CHECKPOINT_ROLLBACK, 'Journal tree size is behind the latest signed checkpoint');
+            }
+            if (previousSize === BigInt(entries.length)) {
+                const currentRoot = await this.tree.root(entries.map((entry) => entry.entryDigest));
+                if (previous.core.rootDigest !== currentRoot ||
+                    previous.core.headEntryDigest !== entries[entries.length - 1].entryDigest) {
+                    throw new AuditProtocolError(AUDIT_ERROR_CODES.CHECKPOINT_CONFLICT, 'Journal content forked at the latest checkpointed tree size');
+                }
+                return previous;
+            }
+        }
+        const first = entries[0];
+        const last = entries[entries.length - 1];
+        const core = parseAuditCheckpointCore({
+            schema: CHECKPOINT_SCHEMA,
+            checkpointId: `checkpoint:${ledger.ledgerId}:${ledger.ledgerEpochId}:${treeSize}`,
+            ...ledger,
+            treeSize,
+            firstSequence: first.core.sequence,
+            lastSequence: last.core.sequence,
+            rootDigest: await this.tree.root(entries.map((entry) => entry.entryDigest)),
+            headEntryDigest: last.entryDigest,
+            previousCheckpointDigest: previous?.checkpointDigest ?? null,
+            createdAt: this.clock.now(),
+            issuer: this.options.signer.ref,
+            integritySuite: CHECKPOINT_SUITE,
+        });
+        const checkpointDigest = await hashAuditValue(this.options.hasher, AUDIT_DIGEST_DOMAINS.checkpoint, core);
+        const candidate = deepFreeze({
+            core,
+            checkpointDigest,
+            jws: await this.options.signer.sign(canonicalizeJsonBytes(core)),
+        });
+        const result = await this.options.store.putIfAbsent(candidate);
+        if (result.kind === 'conflict') {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.CHECKPOINT_CONFLICT, 'A different checkpoint already exists at this tree size', { treeSize });
+        }
+        if (result.kind === 'inserted') {
+            await this.options.onCheckpointCreated?.(result.checkpoint);
+        }
+        return result.checkpoint;
+    }
+    async inclusionProof(ledger, sequence, checkpoint) {
+        this.assertCheckpointLedger(ledger, checkpoint);
+        const entries = await this.entriesForCheckpoint(ledger, checkpoint);
+        const index = entries.findIndex((entry) => entry.core.sequence === sequence);
+        if (index < 0) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.CHECKPOINT_INVALID, 'Sequence is not included in the checkpoint', { sequence, treeSize: checkpoint.core.treeSize });
+        }
+        return deepFreeze({
+            leafIndex: String(index),
+            treeSize: checkpoint.core.treeSize,
+            auditPath: await this.tree.inclusionProof(entries.map((entry) => entry.entryDigest), index),
+        });
+    }
+    async consistencyProof(ledger, oldTreeSize, checkpoint) {
+        this.assertCheckpointLedger(ledger, checkpoint);
+        const entries = await this.entriesForCheckpoint(ledger, checkpoint);
+        const oldSize = toSafeNumber(parseDecimal(oldTreeSize, 'Old tree size'), 'Old tree size');
+        return deepFreeze({
+            oldTreeSize,
+            newTreeSize: checkpoint.core.treeSize,
+            auditPath: await this.tree.consistencyProof(entries.map((entry) => entry.entryDigest), oldSize),
+        });
+    }
+    async rootForRange(ledger, treeSize) {
+        const size = toSafeNumber(parseDecimal(treeSize, 'Tree size'), 'Tree size');
+        if (size === 0)
+            return this.tree.root([]);
+        const entries = await this.readEntries(ledger, size);
+        if (entries.length !== size) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.CHECKPOINT_INVALID, 'Journal does not contain the requested tree range', { treeSize });
+        }
+        return this.tree.root(entries.map((entry) => entry.entryDigest));
+    }
+    async verifyInclusion(entryDigest, checkpoint, proof) {
+        if (proof.treeSize !== checkpoint.core.treeSize)
+            return false;
+        return this.tree.verifyInclusion({
+            leaf: entryDigest,
+            leafIndex: toSafeNumber(parseDecimal(proof.leafIndex, 'Leaf index'), 'Leaf index'),
+            treeSize: toSafeNumber(parseDecimal(proof.treeSize, 'Tree size'), 'Tree size'),
+            root: checkpoint.core.rootDigest,
+            auditPath: proof.auditPath,
+        });
+    }
+    async verifyConsistency(input) {
+        if (input.proof.oldTreeSize !== input.oldTreeSize ||
+            input.proof.newTreeSize !== input.checkpoint.core.treeSize)
+            return false;
+        return this.tree.verifyConsistency({
+            oldSize: toSafeNumber(parseDecimal(input.oldTreeSize, 'Old tree size'), 'Old tree size'),
+            newSize: toSafeNumber(parseDecimal(input.checkpoint.core.treeSize, 'New tree size'), 'New tree size'),
+            oldRoot: input.oldRoot,
+            newRoot: input.checkpoint.core.rootDigest,
+            auditPath: input.proof.auditPath,
+        });
+    }
+    async snapshotAtHead(ledger) {
+        const head = await this.options.journal.getHead(ledger);
+        if (head === null)
+            return [];
+        const expectedCount = toSafeNumber(parseDecimal(head.sequence, 'Journal head sequence') + 1n, 'Journal tree size');
+        const entries = await this.readEntries(ledger, expectedCount);
+        const last = entries[entries.length - 1];
+        if (entries.length !== expectedCount || last?.entryDigest !== head.entryDigest) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.JOURNAL_FAILURE, 'Journal could not provide a stable range through its reported head');
+        }
+        return entries;
+    }
+    async entriesForCheckpoint(ledger, checkpoint) {
+        const size = toSafeNumber(parseDecimal(checkpoint.core.treeSize, 'Checkpoint tree size'), 'Checkpoint tree size');
+        const entries = await this.readEntries(ledger, size);
+        if (entries.length !== size || entries[entries.length - 1]?.entryDigest !==
+            checkpoint.core.headEntryDigest) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.CHECKPOINT_INVALID, 'Journal range does not match the signed checkpoint head');
+        }
+        return entries;
+    }
+    async readEntries(ledger, limit) {
+        const result = [];
+        for await (const entry of this.options.journal.readRange({ ...ledger, limit })) {
+            if (BigInt(entry.core.sequence) !== BigInt(result.length)) {
+                throw new AuditProtocolError(AUDIT_ERROR_CODES.JOURNAL_FAILURE, 'Audit journal range is not contiguous from sequence zero');
+            }
+            result.push(entry);
+        }
+        return result;
+    }
+    assertCheckpointLedger(ledger, checkpoint) {
+        if (checkpoint.core.ledgerId !== ledger.ledgerId ||
+            checkpoint.core.ledgerEpochId !== ledger.ledgerEpochId) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.LEDGER_MISMATCH, 'Checkpoint belongs to a different ledger or epoch');
+        }
+    }
+}
+//# sourceMappingURL=checkpoint.js.map

package/dist/audit/checkpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpoint.js","sourceRoot":"","sources":["../../src/audit/checkpoint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAYxD,MAAM,iBAAiB,GACrB,+DAAwE,CAAC;AAC3E,MAAM,gBAAgB,GAAG,mCAA4C,CAAC;AAEtE,SAAS,SAAS,CAAC,MAAsB;IACvC,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,aAAa,CAAC,MAAsB,EAAE,QAAuB;IACpE,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,YAAY,CAAC,KAAoB,EAAE,KAAa;IACvD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,kBAAkB,EACpC,GAAG,KAAK,kDAAkD,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,KAAa;IAChD,IAAI,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,kBAAkB,EACpC,GAAG,KAAK,2DAA2D,CACpE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,UAAU,CAAI,KAAQ;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAgBD,wFAAwF;AACxF,MAAM,OAAO,0BAA0B;IACpB,WAAW,GAAG,IAAI,GAAG,EAAmC,CAAC;IACzD,MAAM,GAAG,IAAI,GAAG,EAAmC,CAAC;IAErE,KAAK,CAAC,SAAS,CAAC,MAAsB;QACpC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,MAAsB,EACtB,QAAuB;QAEvB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,UAAmC;QACnD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC;QAC/B,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,QAAQ,CAAC,gBAAgB,KAAK,UAAU,CAAC,gBAAgB;gBAC9D,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE;gBAC5C,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;QACjD,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACnD,IAAI,OAAO,KAAK,SAAS;YACvB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAClD,CAAC;CACF;AAWD,sFAAsF;AACtF,MAAM,OAAO,sBAAsB;IAIJ;IAHZ,IAAI,CAAoB;IACxB,KAAK,CAAoB;IAE1C,YAA6B,OAAsC;QAAtC,YAAO,GAAP,OAAO,CAA+B;QACjE,IAAI,CAAC,IAAI,GAAG,IAAI,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAsB;QAC3C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,kBAAkB,EACpC,wCAAwC,CACzC,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,YAAY,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;YAChF,IAAI,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,mBAAmB,EACrC,0DAA0D,CAC3D,CAAC;YACJ,CAAC;YACD,IAAI,YAAY,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;gBACpF,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,KAAK,WAAW;oBAC1C,QAAQ,CAAC,IAAI,CAAC,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC;oBAC7E,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,mBAAmB,EACrC,6DAA6D,CAC9D,CAAC;gBACJ,CAAC;gBACD,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,wBAAwB,CAAC;YACpC,MAAM,EAAE,iBAAiB;YACzB,YAAY,EAAE,cAAc,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,aAAa,IAAI,QAAQ,EAAE;YACjF,GAAG,MAAM;YACT,QAAQ;YACR,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;YAClC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;YAChC,UAAU,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAC3E,eAAe,EAAE,IAAI,CAAC,WAAW;YACjC,wBAAwB,EAAE,QAAQ,EAAE,gBAAgB,IAAI,IAAI;YAC5D,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG;YAC/B,cAAc,EAAE,gBAAgB;SACjC,CAAC,CAAC;QACH,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAC3C,IAAI,CAAC,OAAO,CAAC,MAAM,EACnB,oBAAoB,CAAC,UAAU,EAC/B,IAAI,CACL,CAAC;QACF,MAAM,SAAS,GAAG,UAAU,CAAC;YAC3B,IAAI;YACJ,gBAAgB;YAChB,GAAG,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;SACjE,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,mBAAmB,EACrC,yDAAyD,EACzD,EAAE,QAAQ,EAAE,CACb,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,MAAM,CAAC,UAAU,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,MAAsB,EACtB,QAAuB,EACvB,UAAmC;QAEnC,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QAC7E,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,kBAAkB,EACpC,4CAA4C,EAC5C,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,CACjD,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC;YAChB,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC;YACxB,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ;YAClC,SAAS,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CACvC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,EACzC,KAAK,CACN;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,MAAsB,EACtB,WAA0B,EAC1B,UAAmC;QAEnC,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAC1F,OAAO,UAAU,CAAC;YAChB,WAAW;YACX,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ;YACrC,SAAS,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CACzC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,EACzC,OAAO,CACR;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAsB,EAAE,QAAuB;QAChE,MAAM,IAAI,GAAG,YAAY,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;QAC5E,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,kBAAkB,EACpC,mDAAmD,EACnD,EAAE,QAAQ,EAAE,CACb,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,WAAmB,EACnB,UAAmC,EACnC,KAAkC;QAElC,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9D,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;YAC/B,IAAI,EAAE,WAAW;YACjB,SAAS,EAAE,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,YAAY,CAAC;YAClF,QAAQ,EAAE,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,WAAW,CAAC;YAC9E,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,UAAU;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAKvB;QACC,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;YAC/C,KAAK,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC3E,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC;YACjC,OAAO,EAAE,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,eAAe,CAAC;YACxF,OAAO,EAAE,YAAY,CACnB,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,EAC7D,eAAe,CAChB;YACD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU;YACzC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;SACjC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,MAAsB;QACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;QAC7B,MAAM,aAAa,GAAG,YAAY,CAChC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,GAAG,EAAE,EACzD,mBAAmB,CACpB,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,MAAM,KAAK,aAAa,IAAI,IAAI,EAAE,WAAW,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/E,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,eAAe,EACjC,oEAAoE,CACrE,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,MAAsB,EACtB,UAAmC;QAEnC,MAAM,IAAI,GAAG,YAAY,CACvB,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,sBAAsB,CAAC,EAC9D,sBAAsB,CACvB,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,WAAW;YACrE,UAAU,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAClC,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,kBAAkB,EACpC,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,MAAsB,EACtB,KAAa;QAEb,MAAM,MAAM,GAAyB,EAAE,CAAC;QACxC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YAC/E,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,eAAe,EACjC,0DAA0D,CAC3D,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,sBAAsB,CAC5B,MAAsB,EACtB,UAAmC;QAEnC,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;YAC9C,UAAU,CAAC,IAAI,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;YACzD,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,eAAe,EACjC,mDAAmD,CACpD,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/audit/cli.d.ts

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+export interface AuditCliIo {
+    readText(path: string): Promise<string>;
+    write(text: string): void;
+    writeError(text: string): void;
+}
+export declare function runAuditCli(args: readonly string[], io?: AuditCliIo): Promise<number>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/audit/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/audit/cli.ts"],"names":[],"mappings":";AAwCA,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAiBD,wBAAsB,WAAW,CAC/B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,GAAE,UAAsB,GACzB,OAAO,CAAC,MAAM,CAAC,CA2CjB"}

package/dist/audit/cli.js

@@ -0,0 +1,85 @@
+#!/usr/bin/env node
+import { readFile } from 'node:fs/promises';
+import { CryptoProviderAuditHasher } from './crypto.js';
+import { CompactJwsAuditSignatureVerifier } from './crypto.js';
+import { verifyAuditBundle } from './replay-bundle.js';
+import { parseAuditVerificationPolicy } from './schemas.js';
+import { NodeCryptoProvider } from '../providers/node-crypto.js';
+import { z } from 'zod';
+const auditCliKeyFileSchema = z.object({
+    keys: z.array(z.object({
+        kid: z.string().min(1).max(2304),
+        jwk: z.record(z.string(), z.unknown()),
+    }).strict()).max(10_000),
+}).strict().superRefine((value, context) => {
+    const kids = value.keys.map((item) => item.kid);
+    if (new Set(kids).size !== kids.length) {
+        context.addIssue({ code: 'custom', path: ['keys'], message: 'Key IDs must be unique' });
+    }
+    for (const [index, item] of value.keys.entries()) {
+        if (typeof item.jwk['kid'] === 'string' && item.jwk['kid'] !== item.kid) {
+            context.addIssue({
+                code: 'custom',
+                path: ['keys', index, 'jwk', 'kid'],
+                message: 'JWK kid must match the key-file kid',
+            });
+        }
+    }
+});
+const defaultIo = {
+    readText: (path) => readFile(path, 'utf8'),
+    write: (text) => process.stdout.write(text),
+    writeError: (text) => process.stderr.write(text),
+};
+const usage = 'Usage: kya-audit verify <bundle.json> --policy <policy.json> --keys <keys.json>\n';
+function option(args, name) {
+    const index = args.indexOf(name);
+    if (index < 0 || args.indexOf(name, index + 1) >= 0)
+        return undefined;
+    const value = args[index + 1];
+    return value === undefined || value.startsWith('-') ? undefined : value;
+}
+export async function runAuditCli(args, io = defaultIo) {
+    if (args[0] === '--help' || args[0] === '-h' || args[0] === 'help') {
+        io.write(usage);
+        return 0;
+    }
+    if (args[0] !== 'verify' || args[1] === undefined) {
+        io.writeError(usage);
+        return 2;
+    }
+    const policyPath = option(args, '--policy');
+    const keysPath = option(args, '--keys');
+    if (policyPath === undefined || keysPath === undefined) {
+        io.writeError('Both --policy and --keys are required; bundle contents cannot bootstrap trust.\n');
+        return 2;
+    }
+    try {
+        const [bundle, policy, keyFile] = await Promise.all([
+            io.readText(args[1]).then((value) => JSON.parse(value)),
+            io.readText(policyPath).then((value) => parseAuditVerificationPolicy(JSON.parse(value))),
+            io.readText(keysPath).then((value) => auditCliKeyFileSchema.parse(JSON.parse(value))),
+        ]);
+        const keys = new Map(keyFile.keys.map((item) => [item.kid, item.jwk]));
+        const signatures = new CompactJwsAuditSignatureVerifier({
+            async resolve(signer) {
+                return keys.get(signer.kid) ?? null;
+            },
+        });
+        const report = await verifyAuditBundle(bundle, policy, {
+            hasher: new CryptoProviderAuditHasher(new NodeCryptoProvider()),
+            signatures,
+        });
+        io.write(`${JSON.stringify(report, null, 2)}\n`);
+        const dimensions = Object.values(report).filter((value) => typeof value === 'object' && value !== null && 'verdict' in value);
+        return dimensions.some((dimension) => dimension.verdict === 'invalid') ? 1 : 0;
+    }
+    catch (error) {
+        io.writeError(`Audit verification failed: ${error instanceof Error ? error.message : String(error)}\n`);
+        return 2;
+    }
+}
+if (process.argv[1]?.endsWith('/audit/cli.js') || process.argv[1]?.endsWith('\\audit\\cli.js')) {
+    process.exitCode = await runAuditCli(process.argv.slice(2));
+}
+//# sourceMappingURL=cli.js.map

package/dist/audit/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/audit/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAM5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,MAAM,qBAAqB,GAA+B,CAAC,CAAC,MAAM,CAAC;IACjE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAChC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;KACvC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;CACzB,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACvC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACjD,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YACxE,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;gBACnC,OAAO,EAAE,qCAAqC;aAC/C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAQH,MAAM,SAAS,GAAe;IAC5B,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAC1C,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;IAC3C,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;CACjD,CAAC;AAEF,MAAM,KAAK,GAAG,mFAAmF,CAAC;AAElG,SAAS,MAAM,CAAC,IAAuB,EAAE,IAAY;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAuB,EACvB,KAAiB,SAAS;IAE1B,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACnE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAClD,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACxC,IAAI,UAAU,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACvD,EAAE,CAAC,UAAU,CAAC,kFAAkF,CAAC,CAAC;QAClG,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAClD,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAwB,CAAC;YAC9E,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACrC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAA8B,CAAC;YAC/E,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;SACtF,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACvE,MAAM,UAAU,GAAG,IAAI,gCAAgC,CAAC;YACtD,KAAK,CAAC,OAAO,CAAC,MAAiB;gBAC7B,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;YACtC,CAAC;SACF,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE;YACrD,MAAM,EAAE,IAAI,yBAAyB,CAAC,IAAI,kBAAkB,EAAE,CAAC;YAC/D,UAAU;SACX,CAAC,CAAC;QACH,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAGpD,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,IAAI,KAAK,CAAC,CAAC;QACxE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,EAAE,CAAC,UAAU,CAAC,8BAA8B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxG,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;IAC/F,OAAO,CAAC,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC"}

package/dist/audit/crypto.d.ts

@@ -0,0 +1,37 @@
+import { type JWK } from 'jose';
+import type { CryptoProvider } from '../providers/base.js';
+import type { Digest, SignerRef } from './types.js';
+export interface AuditHasher {
+    sha256(data: Uint8Array): Promise<Digest>;
+}
+export declare class CryptoProviderAuditHasher implements AuditHasher {
+    private readonly crypto;
+    constructor(crypto: CryptoProvider);
+    sha256(data: Uint8Array): Promise<Digest>;
+}
+export interface AuditSigner {
+    readonly ref: SignerRef;
+    sign(payload: Uint8Array): Promise<string>;
+}
+export interface AuditSignatureVerifier {
+    verify(payload: Uint8Array, jws: string, signer: SignerRef): Promise<boolean>;
+}
+export type AuditVerificationKey = CryptoKey | JWK | Uint8Array;
+export interface AuditVerificationKeyResolver {
+    resolve(signer: SignerRef): Promise<AuditVerificationKey | null>;
+}
+/** Strict compact-JWS verifier with payload, algorithm, KID, and DID binding. */
+export declare class CompactJwsAuditSignatureVerifier implements AuditSignatureVerifier {
+    private readonly keys;
+    constructor(keys: AuditVerificationKeyResolver);
+    verify(payload: Uint8Array, jws: string, signer: SignerRef): Promise<boolean>;
+}
+/** Reference JWS signer for local WebCrypto/KMS-compatible CryptoKey handles. */
+export declare class CompactJwsAuditSigner implements AuditSigner {
+    readonly ref: SignerRef;
+    private readonly privateKey;
+    constructor(ref: SignerRef, privateKey: CryptoKey);
+    sign(payload: Uint8Array): Promise<string>;
+}
+export declare function hashAuditValue(hasher: AuditHasher, domain: string, value: unknown): Promise<Digest>;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/audit/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/audit/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAKpD,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3C;AAED,qBAAa,yBAA0B,YAAW,WAAW;IAC/C,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,cAAc;IAE7C,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;CAOhD;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/E;AAED,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,GAAG,GAAG,UAAU,CAAC;AAEhE,MAAM,WAAW,4BAA4B;IAC3C,OAAO,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;CAClE;AAED,iFAAiF;AACjF,qBAAa,gCAAiC,YAAW,sBAAsB;IACjE,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,4BAA4B;IAEzD,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;CAcpF;AAED,iFAAiF;AACjF,qBAAa,qBAAsB,YAAW,WAAW;IAErD,QAAQ,CAAC,GAAG,EAAE,SAAS;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBADlB,GAAG,EAAE,SAAS,EACN,UAAU,EAAE,SAAS;IAGlC,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;CAKjD;AAED,wBAAsB,cAAc,CAClC,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,MAAM,CAAC,CAUjB"}

package/dist/audit/crypto.js

@@ -0,0 +1,68 @@
+import { CompactSign, compactVerify } from 'jose';
+import { canonicalizeJsonBytes } from '../utils/canonical-json.js';
+const encoder = new TextEncoder();
+const DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/;
+export class CryptoProviderAuditHasher {
+    crypto;
+    constructor(crypto) {
+        this.crypto = crypto;
+    }
+    async sha256(data) {
+        const digest = await this.crypto.hash(data);
+        if (!DIGEST_PATTERN.test(digest)) {
+            throw new TypeError('Audit hasher must return sha256:<lowercase-hex>');
+        }
+        return digest;
+    }
+}
+/** Strict compact-JWS verifier with payload, algorithm, KID, and DID binding. */
+export class CompactJwsAuditSignatureVerifier {
+    keys;
+    constructor(keys) {
+        this.keys = keys;
+    }
+    async verify(payload, jws, signer) {
+        try {
+            if (!signer.kid.startsWith(`${signer.did}#`))
+                return false;
+            const key = await this.keys.resolve(signer);
+            if (key === null)
+                return false;
+            const result = await compactVerify(jws, key, { algorithms: [signer.alg] });
+            if (result.protectedHeader.alg !== signer.alg ||
+                result.protectedHeader.kid !== signer.kid ||
+                result.payload.length !== payload.length)
+                return false;
+            return result.payload.every((byte, index) => byte === payload[index]);
+        }
+        catch {
+            return false;
+        }
+    }
+}
+/** Reference JWS signer for local WebCrypto/KMS-compatible CryptoKey handles. */
+export class CompactJwsAuditSigner {
+    ref;
+    privateKey;
+    constructor(ref, privateKey) {
+        this.ref = ref;
+        this.privateKey = privateKey;
+    }
+    async sign(payload) {
+        return new CompactSign(payload)
+            .setProtectedHeader({ alg: this.ref.alg, kid: this.ref.kid })
+            .sign(this.privateKey);
+    }
+}
+export async function hashAuditValue(hasher, domain, value) {
+    if (domain.length === 0 || domain.includes('\0')) {
+        throw new TypeError('Audit digest domain must be non-empty and cannot contain NUL');
+    }
+    const domainBytes = encoder.encode(`${domain}\0`);
+    const valueBytes = canonicalizeJsonBytes(value);
+    const input = new Uint8Array(domainBytes.length + valueBytes.length);
+    input.set(domainBytes);
+    input.set(valueBytes, domainBytes.length);
+    return hasher.sha256(input);
+}
+//# sourceMappingURL=crypto.js.map