@kya-os/mcp 1.10.1 → 1.12.0

package/dist/audit/merkle.js

@@ -0,0 +1,195 @@
+const DIGEST_PATTERN = /^sha256:([a-f0-9]{64})$/;
+function digestBytes(digest) {
+    const match = DIGEST_PATTERN.exec(digest);
+    if (match === null)
+        throw new TypeError('Expected sha256:<lowercase-hex> digest');
+    const hex = match[1];
+    const bytes = new Uint8Array(32);
+    for (let index = 0; index < bytes.length; index += 1) {
+        bytes[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16);
+    }
+    return bytes;
+}
+function concat(...values) {
+    const result = new Uint8Array(values.reduce((size, value) => size + value.length, 0));
+    let offset = 0;
+    for (const value of values) {
+        result.set(value, offset);
+        offset += value.length;
+    }
+    return result;
+}
+function largestPowerOfTwoLessThan(value) {
+    let power = 1;
+    while (power * 2 < value)
+        power *= 2;
+    return power;
+}
+function validateSize(size, label) {
+    if (!Number.isSafeInteger(size) || size < 0) {
+        throw new RangeError(`${label} must be a non-negative safe integer`);
+    }
+}
+/** RFC 9162 section 2 Merkle tree over immutable audit-entry digests. */
+export class Rfc9162MerkleTree {
+    hasher;
+    constructor(hasher) {
+        this.hasher = hasher;
+    }
+    async leafHash(entryDigest) {
+        return this.hasher.sha256(concat(Uint8Array.of(0x00), digestBytes(entryDigest)));
+    }
+    async nodeHash(left, right) {
+        return this.hasher.sha256(concat(Uint8Array.of(0x01), digestBytes(left), digestBytes(right)));
+    }
+    async root(leaves) {
+        if (leaves.length === 0)
+            return this.hasher.sha256(new Uint8Array());
+        if (leaves.length === 1)
+            return this.leafHash(leaves[0]);
+        const split = largestPowerOfTwoLessThan(leaves.length);
+        const [left, right] = await Promise.all([
+            this.root(leaves.slice(0, split)),
+            this.root(leaves.slice(split)),
+        ]);
+        return this.nodeHash(left, right);
+    }
+    async inclusionProof(leaves, leafIndex) {
+        validateSize(leafIndex, 'Leaf index');
+        if (leaves.length === 0 || leafIndex >= leaves.length) {
+            throw new RangeError('Leaf index must identify a leaf in the tree');
+        }
+        return this.buildInclusionProof(leaves, leafIndex);
+    }
+    async buildInclusionProof(leaves, leafIndex) {
+        if (leaves.length === 1)
+            return [];
+        const split = largestPowerOfTwoLessThan(leaves.length);
+        if (leafIndex < split) {
+            const [path, sibling] = await Promise.all([
+                this.buildInclusionProof(leaves.slice(0, split), leafIndex),
+                this.root(leaves.slice(split)),
+            ]);
+            return [...path, sibling];
+        }
+        const [path, sibling] = await Promise.all([
+            this.buildInclusionProof(leaves.slice(split), leafIndex - split),
+            this.root(leaves.slice(0, split)),
+        ]);
+        return [...path, sibling];
+    }
+    async verifyInclusion(input) {
+        try {
+            validateSize(input.leafIndex, 'Leaf index');
+            validateSize(input.treeSize, 'Tree size');
+            if (input.treeSize === 0 || input.leafIndex >= input.treeSize)
+                return false;
+            let leafPosition = input.leafIndex;
+            let lastNodePosition = input.treeSize - 1;
+            let calculated = await this.leafHash(input.leaf);
+            for (const sibling of input.auditPath) {
+                if (lastNodePosition === 0)
+                    return false;
+                if ((leafPosition & 1) === 1 || leafPosition === lastNodePosition) {
+                    calculated = await this.nodeHash(sibling, calculated);
+                    while ((leafPosition & 1) === 0 && leafPosition !== 0) {
+                        leafPosition = Math.floor(leafPosition / 2);
+                        lastNodePosition = Math.floor(lastNodePosition / 2);
+                    }
+                }
+                else {
+                    calculated = await this.nodeHash(calculated, sibling);
+                }
+                leafPosition = Math.floor(leafPosition / 2);
+                lastNodePosition = Math.floor(lastNodePosition / 2);
+            }
+            return lastNodePosition === 0 && calculated === input.root;
+        }
+        catch {
+            return false;
+        }
+    }
+    async consistencyProof(leaves, oldSize) {
+        validateSize(oldSize, 'Old tree size');
+        if (oldSize === 0 || oldSize > leaves.length) {
+            throw new RangeError('Old tree size must be between 1 and the new tree size');
+        }
+        if (oldSize === leaves.length)
+            return [];
+        return this.buildConsistencyProof(oldSize, leaves, true);
+    }
+    async buildConsistencyProof(oldSize, leaves, completeSubtree) {
+        if (oldSize === leaves.length) {
+            return completeSubtree ? [] : [await this.root(leaves)];
+        }
+        const split = largestPowerOfTwoLessThan(leaves.length);
+        if (oldSize <= split) {
+            const [path, rightRoot] = await Promise.all([
+                this.buildConsistencyProof(oldSize, leaves.slice(0, split), completeSubtree),
+                this.root(leaves.slice(split)),
+            ]);
+            return [...path, rightRoot];
+        }
+        const [path, leftRoot] = await Promise.all([
+            this.buildConsistencyProof(oldSize - split, leaves.slice(split), false),
+            this.root(leaves.slice(0, split)),
+        ]);
+        return [...path, leftRoot];
+    }
+    async verifyConsistency(input) {
+        try {
+            validateSize(input.oldSize, 'Old tree size');
+            validateSize(input.newSize, 'New tree size');
+            if (input.oldSize === 0 || input.oldSize > input.newSize)
+                return false;
+            if (input.oldSize === input.newSize) {
+                return input.auditPath.length === 0 && input.oldRoot === input.newRoot;
+            }
+            let oldNode = input.oldSize - 1;
+            let newNode = input.newSize - 1;
+            while ((oldNode & 1) === 1) {
+                oldNode = Math.floor(oldNode / 2);
+                newNode = Math.floor(newNode / 2);
+            }
+            let pathIndex = 0;
+            let oldCalculated;
+            let newCalculated;
+            if (oldNode === 0) {
+                oldCalculated = input.oldRoot;
+                newCalculated = input.oldRoot;
+            }
+            else {
+                const first = input.auditPath[pathIndex++];
+                if (first === undefined)
+                    return false;
+                oldCalculated = first;
+                newCalculated = first;
+            }
+            for (; pathIndex < input.auditPath.length; pathIndex += 1) {
+                if (newNode === 0)
+                    return false;
+                const sibling = input.auditPath[pathIndex];
+                if ((oldNode & 1) === 1 || oldNode === newNode) {
+                    oldCalculated = await this.nodeHash(sibling, oldCalculated);
+                    newCalculated = await this.nodeHash(sibling, newCalculated);
+                    while ((oldNode & 1) === 0 && oldNode !== 0) {
+                        oldNode = Math.floor(oldNode / 2);
+                        newNode = Math.floor(newNode / 2);
+                    }
+                }
+                else {
+                    newCalculated = await this.nodeHash(newCalculated, sibling);
+                }
+                oldNode = Math.floor(oldNode / 2);
+                newNode = Math.floor(newNode / 2);
+            }
+            return newNode === 0 &&
+                oldCalculated === input.oldRoot &&
+                newCalculated === input.newRoot;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+//# sourceMappingURL=merkle.js.map

package/dist/audit/merkle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"merkle.js","sourceRoot":"","sources":["../../src/audit/merkle.ts"],"names":[],"mappings":"AAGA,MAAM,cAAc,GAAG,yBAAyB,CAAC;AAkBjD,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;IAClF,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACtB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,KAAK,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,GAAG,MAA6B;IAC9C,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACtF,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAa;IAC9C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,CAAC,GAAG,KAAK;QAAE,KAAK,IAAI,CAAC,CAAC;IACrC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,KAAa;IAC/C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,UAAU,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,OAAO,iBAAiB;IACC;IAA7B,YAA6B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEpD,KAAK,CAAC,QAAQ,CAAC,WAAmB;QAChC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,KAAa;QACxC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAC9B,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,EACnB,WAAW,CAAC,IAAI,CAAC,EACjB,WAAW,CAAC,KAAK,CAAC,CACnB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAyB;QAClC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,yBAAyB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;SAC/B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAyB,EAAE,SAAiB;QAC/D,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACtD,MAAM,IAAI,UAAU,CAAC,6CAA6C,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAC/B,MAAyB,EACzB,SAAiB;QAEjB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,yBAAyB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,SAAS,GAAG,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACxC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,SAAS,CAAC;gBAC3D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;aAC/B,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC;YAChE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;SAClC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAiC;QACrD,IAAI,CAAC;YACH,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YAC5C,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAC1C,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAE5E,IAAI,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC;YACnC,IAAI,gBAAgB,GAAG,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC;YAC1C,IAAI,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAEjD,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACtC,IAAI,gBAAgB,KAAK,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACzC,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,YAAY,KAAK,gBAAgB,EAAE,CAAC;oBAClE,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;oBACtD,OAAO,CAAC,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;wBACtD,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;wBAC5C,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC;oBACtD,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBACxD,CAAC;gBACD,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;gBAC5C,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC;YACtD,CAAC;YACD,OAAO,gBAAgB,KAAK,CAAC,IAAI,UAAU,KAAK,KAAK,CAAC,IAAI,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAyB,EAAE,OAAe;QAC/D,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACvC,IAAI,OAAO,KAAK,CAAC,IAAI,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YAC7C,MAAM,IAAI,UAAU,CAAC,uDAAuD,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,OAAO,KAAK,MAAM,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3D,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,OAAe,EACf,MAAyB,EACzB,eAAwB;QAExB,IAAI,OAAO,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAC9B,OAAO,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,KAAK,GAAG,yBAAyB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC1C,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,eAAe,CAAC;gBAC5E,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;aAC/B,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,IAAI,EAAE,SAAS,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACzC,IAAI,CAAC,qBAAqB,CAAC,OAAO,GAAG,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;YACvE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;SAClC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAmC;QACzD,IAAI,CAAC;YACH,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAC7C,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAC7C,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO;gBAAE,OAAO,KAAK,CAAC;YACvE,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;gBACpC,OAAO,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC;YACzE,CAAC;YAED,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;YAChC,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;YAChC,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;gBAClC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;YACpC,CAAC;YAED,IAAI,SAAS,GAAG,CAAC,CAAC;YAClB,IAAI,aAAqB,CAAC;YAC1B,IAAI,aAAqB,CAAC;YAC1B,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;gBAClB,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC;gBAC9B,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC3C,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC;gBACtC,aAAa,GAAG,KAAK,CAAC;gBACtB,aAAa,GAAG,KAAK,CAAC;YACxB,CAAC;YAED,OAAO,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,IAAI,CAAC,EAAE,CAAC;gBAC1D,IAAI,OAAO,KAAK,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAChC,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,SAAS,CAAE,CAAC;gBAC5C,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;oBAC/C,aAAa,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;oBAC5D,aAAa,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;oBAC5D,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;wBAC5C,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;wBAClC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;oBACpC,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,aAAa,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;gBAC9D,CAAC;gBACD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;gBAClC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;YACpC,CAAC;YAED,OAAO,OAAO,KAAK,CAAC;gBAClB,aAAa,KAAK,KAAK,CAAC,OAAO;gBAC/B,aAAa,KAAK,KAAK,CAAC,OAAO,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}

package/dist/audit/mirror-service.d.ts

@@ -0,0 +1,19 @@
+import type { AuditHasher } from './crypto.js';
+import type { AuditJournalProvider } from './providers/journal.js';
+import type { AuditLedgerRef, AuditVerificationPolicyV1, SignedAuditEntryV1 } from './types.js';
+import type { AuditArtifactVerifier } from './verifier.js';
+export interface AuditMirrorServiceOptions {
+    ledger: AuditLedgerRef;
+    journal: AuditJournalProvider;
+    verifier: AuditArtifactVerifier;
+    verificationPolicy: AuditVerificationPolicyV1;
+    hasher: AuditHasher;
+}
+/** Verified mirror ingestion. It persists exact recorder envelopes and never resequences/signs. */
+export declare class AuditMirrorService {
+    private readonly options;
+    constructor(options: AuditMirrorServiceOptions);
+    ingest(entry: SignedAuditEntryV1): Promise<SignedAuditEntryV1>;
+    private continuityFailure;
+}
+//# sourceMappingURL=mirror-service.d.ts.map

package/dist/audit/mirror-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mirror-service.d.ts","sourceRoot":"","sources":["../../src/audit/mirror-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,KAAK,EACV,cAAc,EACd,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAE3D,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,EAAE,oBAAoB,CAAC;IAC9B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,kBAAkB,EAAE,yBAAyB,CAAC;IAC9C,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,mGAAmG;AACnG,qBAAa,kBAAkB;IACjB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,yBAAyB;IAEzD,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAiEpE,OAAO,CAAC,iBAAiB;CAM1B"}

package/dist/audit/mirror-service.js

@@ -0,0 +1,54 @@
+import { hashAuditValue } from './crypto.js';
+import { AUDIT_ERROR_CODES, AuditProtocolError } from './errors.js';
+/** Verified mirror ingestion. It persists exact recorder envelopes and never resequences/signs. */
+export class AuditMirrorService {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async ingest(entry) {
+        if (entry.core.ledgerId !== this.options.ledger.ledgerId ||
+            entry.core.ledgerEpochId !== this.options.ledger.ledgerEpochId) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.LEDGER_MISMATCH, 'Mirror entry belongs to a different ledger epoch');
+        }
+        const report = await this.options.verifier.verifyEntries([entry], this.options.verificationPolicy);
+        if (report.cryptographicIntegrity.verdict !== 'valid') {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.MIRROR_VERIFICATION_FAILED, 'Mirror rejected an entry that failed historical artifact verification', { reasonCodes: report.cryptographicIntegrity.reasonCodes });
+        }
+        const idempotencyKey = await hashAuditValue(this.options.hasher, 'org.kya-os.audit.mirror-idempotency.v1', { ledgerId: entry.core.ledgerId, entryDigest: entry.entryDigest });
+        const duplicate = await this.options.journal.getByIdempotencyKey(entry.core.ledgerId, idempotencyKey);
+        if (duplicate !== null) {
+            if (duplicate.entryDigest !== entry.entryDigest)
+                this.continuityFailure();
+            return duplicate;
+        }
+        const head = await this.options.journal.getHead(this.options.ledger);
+        const entrySequence = BigInt(entry.core.sequence);
+        if ((head === null && entrySequence > 0n) ||
+            (head !== null && entrySequence > BigInt(head.sequence) + 1n)) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.MIRROR_OUT_OF_ORDER, 'Mirror entry arrived before its predecessor and may be retried', { sequence: entry.core.sequence, observedHeadSequence: head?.sequence ?? null });
+        }
+        const continuous = head === null
+            ? entry.core.sequence === '0' && entry.core.previousEntryDigest === null
+            : entrySequence === BigInt(head.sequence) + 1n &&
+                entry.core.previousEntryDigest === head.entryDigest;
+        if (!continuous)
+            this.continuityFailure();
+        const result = await this.options.journal.compareAndAppend({
+            ledger: this.options.ledger,
+            expectedHead: head,
+            entry,
+            idempotencyKey,
+        });
+        if (result.kind === 'appended' || result.kind === 'duplicate')
+            return result.entry;
+        const racedDuplicate = await this.options.journal.getByIdempotencyKey(entry.core.ledgerId, idempotencyKey);
+        if (racedDuplicate?.entryDigest === entry.entryDigest)
+            return racedDuplicate;
+        this.continuityFailure();
+    }
+    continuityFailure() {
+        throw new AuditProtocolError(AUDIT_ERROR_CODES.MIRROR_CONTINUITY_FAILED, 'Mirror entry does not exactly extend the observed recorder chain');
+    }
+}
+//# sourceMappingURL=mirror-service.js.map

package/dist/audit/mirror-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mirror-service.js","sourceRoot":"","sources":["../../src/audit/mirror-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAiBpE,mGAAmG;AACnG,MAAM,OAAO,kBAAkB;IACA;IAA7B,YAA6B,OAAkC;QAAlC,YAAO,GAAP,OAAO,CAA2B;IAAG,CAAC;IAEnE,KAAK,CAAC,MAAM,CAAC,KAAyB;QACpC,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ;YACtD,KAAK,CAAC,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YACjE,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,eAAe,EACjC,kDAAkD,CACnD,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CACtD,CAAC,KAAK,CAAC,EACP,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAChC,CAAC;QACF,IAAI,MAAM,CAAC,sBAAsB,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YACtD,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,0BAA0B,EAC5C,uEAAuE,EACvE,EAAE,WAAW,EAAE,MAAM,CAAC,sBAAsB,CAAC,WAAW,EAAE,CAC3D,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,cAAc,CACzC,IAAI,CAAC,OAAO,CAAC,MAAM,EACnB,wCAAwC,EACxC,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAClE,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAC9D,KAAK,CAAC,IAAI,CAAC,QAAQ,EACnB,cAAc,CACf,CAAC;QACF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,IAAI,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;gBAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC1E,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrE,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,aAAa,GAAG,EAAE,CAAC;YACvC,CAAC,IAAI,KAAK,IAAI,IAAI,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,mBAAmB,EACrC,gEAAgE,EAChE,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,QAAQ,IAAI,IAAI,EAAE,CAChF,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,KAAK,IAAI;YAC9B,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,mBAAmB,KAAK,IAAI;YACxE,CAAC,CAAC,aAAa,KAAK,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE;gBAC5C,KAAK,CAAC,IAAI,CAAC,mBAAmB,KAAK,IAAI,CAAC,WAAW,CAAC;QACxD,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC;YACzD,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YAC3B,YAAY,EAAE,IAAI;YAClB,KAAK;YACL,cAAc;SACf,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC;QACnF,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CACnE,KAAK,CAAC,IAAI,CAAC,QAAQ,EACnB,cAAc,CACf,CAAC;QACF,IAAI,cAAc,EAAE,WAAW,KAAK,KAAK,CAAC,WAAW;YAAE,OAAO,cAAc,CAAC;QAC7E,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC3B,CAAC;IAEO,iBAAiB;QACvB,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,wBAAwB,EAC1C,kEAAkE,CACnE,CAAC;IACJ,CAAC;CACF"}

package/dist/audit/projection.d.ts

@@ -0,0 +1,90 @@
+import type { AuditJournalProvider } from './providers/journal.js';
+import type { AuditLedgerRef, AuditProducerEventCoreV1, Digest, SignedAuditEntryV1 } from './types.js';
+export interface AuditProjectionOffset {
+    sequence: string;
+    entryDigest: Digest;
+}
+export interface AuditTimelineProjectionV1 {
+    ledgerId: string;
+    ledgerEpochId: string;
+    sequence: string;
+    entryDigest: Digest;
+    eventId: string;
+    eventType: AuditProducerEventCoreV1['eventType'];
+    occurredAt: number;
+    recordedAt: number;
+    outcome: AuditProducerEventCoreV1['outcome'];
+    correlationId?: string;
+    causationId?: string;
+    chainStatus: 'chained';
+}
+export type AuditProjectionApplyResult = {
+    kind: 'applied';
+} | {
+    kind: 'duplicate';
+} | {
+    kind: 'conflict';
+    actualOffset: AuditProjectionOffset | null;
+};
+export interface AuditProjectionProvider {
+    readonly capabilities: {
+        durability: 'ephemeral' | 'durable';
+        atomicOffset: true;
+    };
+    getOffset(projectionId: string, ledger: AuditLedgerRef): Promise<AuditProjectionOffset | null>;
+    compareAndApply(input: {
+        projectionId: string;
+        ledger: AuditLedgerRef;
+        expectedOffset: AuditProjectionOffset | null;
+        entry: SignedAuditEntryV1;
+        record: AuditTimelineProjectionV1;
+    }): Promise<AuditProjectionApplyResult>;
+    reset(projectionId: string, ledger: AuditLedgerRef): Promise<void>;
+    read(projectionId: string, ledger: AuditLedgerRef): Promise<AuditTimelineProjectionV1[]>;
+}
+/** Ephemeral reference projection. It is disposable and never an integrity authority. */
+export declare class MemoryAuditProjectionProvider implements AuditProjectionProvider {
+    readonly capabilities: {
+        durability: "ephemeral";
+        atomicOffset: true;
+    };
+    private readonly offsets;
+    private readonly records;
+    getOffset(projectionId: string, ledger: AuditLedgerRef): Promise<AuditProjectionOffset | null>;
+    compareAndApply(input: {
+        projectionId: string;
+        ledger: AuditLedgerRef;
+        expectedOffset: AuditProjectionOffset | null;
+        entry: SignedAuditEntryV1;
+        record: AuditTimelineProjectionV1;
+    }): Promise<AuditProjectionApplyResult>;
+    reset(projectionId: string, ledger: AuditLedgerRef): Promise<void>;
+    read(projectionId: string, ledger: AuditLedgerRef): Promise<AuditTimelineProjectionV1[]>;
+    /** Explicit fault-injection seam for adapter conformance and recovery tests. */
+    corruptOffsetForTesting(projectionId: string, ledger: AuditLedgerRef, offset: AuditProjectionOffset): void;
+}
+export interface AuditProjectionWorkerOptions {
+    projectionId: string;
+    journal: AuditJournalProvider;
+    projections: AuditProjectionProvider;
+}
+export interface AuditProjectionReconciliation {
+    status: 'empty' | 'pending' | 'verified' | 'gap_detected';
+    journalHead: Awaited<ReturnType<AuditJournalProvider['getHead']>>;
+    projectionHead: AuditProjectionOffset | null;
+}
+/** Deterministically derives query/UI state from the immutable ledger. */
+export declare class AuditProjectionWorker {
+    private readonly options;
+    constructor(options: AuditProjectionWorkerOptions);
+    synchronize(ledger: AuditLedgerRef): Promise<{
+        applied: number;
+        duplicates: number;
+    }>;
+    rebuild(ledger: AuditLedgerRef): Promise<{
+        applied: number;
+        duplicates: number;
+    }>;
+    reconcile(ledger: AuditLedgerRef): Promise<AuditProjectionReconciliation>;
+}
+//# sourceMappingURL=projection.d.ts.map

package/dist/audit/projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projection.d.ts","sourceRoot":"","sources":["../../src/audit/projection.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,KAAK,EACV,cAAc,EACd,wBAAwB,EACxB,MAAM,EACN,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,wBAAwB,CAAC,WAAW,CAAC,CAAC;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAC7C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,SAAS,CAAC;CACxB;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,YAAY,EAAE,qBAAqB,GAAG,IAAI,CAAA;CAAE,CAAC;AAErE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,EAAE;QAAE,UAAU,EAAE,WAAW,GAAG,SAAS,CAAC;QAAC,YAAY,EAAE,IAAI,CAAA;KAAE,CAAC;IACnF,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IAC/F,eAAe,CAAC,KAAK,EAAE;QACrB,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,EAAE,cAAc,CAAC;QACvB,cAAc,EAAE,qBAAqB,GAAG,IAAI,CAAC;QAC7C,KAAK,EAAE,kBAAkB,CAAC;QAC1B,MAAM,EAAE,yBAAyB,CAAC;KACnC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACxC,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAAC;CAC1F;AAgCD,yFAAyF;AACzF,qBAAa,6BAA8B,YAAW,uBAAuB;IAC3E,QAAQ,CAAC,YAAY;;;MAAqE;IAC1F,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4C;IACpE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkD;IAEpE,SAAS,CACb,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAKlC,eAAe,CAAC,KAAK,EAAE;QAC3B,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,EAAE,cAAc,CAAC;QACvB,cAAc,EAAE,qBAAqB,GAAG,IAAI,CAAC;QAC7C,KAAK,EAAE,kBAAkB,CAAC;QAC1B,MAAM,EAAE,yBAAyB,CAAC;KACnC,GAAG,OAAO,CAAC,0BAA0B,CAAC;IA2BjC,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAMlE,IAAI,CACR,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAIvC,gFAAgF;IAChF,uBAAuB,CACrB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,qBAAqB,GAC5B,IAAI;CAGR;AAED,MAAM,WAAW,4BAA4B;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,oBAAoB,CAAC;IAC9B,WAAW,EAAE,uBAAuB,CAAC;CACtC;AAED,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,cAAc,CAAC;IAC1D,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAClE,cAAc,EAAE,qBAAqB,GAAG,IAAI,CAAC;CAC9C;AAED,0EAA0E;AAC1E,qBAAa,qBAAqB;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,4BAA4B;IAS5D,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAiCrF,OAAO,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAKjF,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,6BAA6B,CAAC;CAoBhF"}

package/dist/audit/projection.js

@@ -0,0 +1,142 @@
+import { AUDIT_ERROR_CODES, AuditProtocolError } from './errors.js';
+function key(projectionId, ledger) {
+    return `${projectionId}\0${ledger.ledgerId}\0${ledger.ledgerEpochId}`;
+}
+function offsetsEqual(left, right) {
+    if (left === null || right === null)
+        return left === right;
+    return left.sequence === right.sequence && left.entryDigest === right.entryDigest;
+}
+function project(entry) {
+    const event = entry.core.event;
+    return Object.freeze({
+        ledgerId: entry.core.ledgerId,
+        ledgerEpochId: entry.core.ledgerEpochId,
+        sequence: entry.core.sequence,
+        entryDigest: entry.entryDigest,
+        eventId: event.eventId,
+        eventType: event.eventType,
+        occurredAt: event.occurredAt,
+        recordedAt: entry.core.recordedAt,
+        outcome: event.outcome,
+        ...(event.correlationId === undefined ? {} : { correlationId: event.correlationId }),
+        ...(event.causationId === undefined ? {} : { causationId: event.causationId }),
+        chainStatus: 'chained',
+    });
+}
+/** Ephemeral reference projection. It is disposable and never an integrity authority. */
+export class MemoryAuditProjectionProvider {
+    capabilities = { durability: 'ephemeral', atomicOffset: true };
+    offsets = new Map();
+    records = new Map();
+    async getOffset(projectionId, ledger) {
+        const offset = this.offsets.get(key(projectionId, ledger));
+        return offset === undefined ? null : { ...offset };
+    }
+    async compareAndApply(input) {
+        const projectionKey = key(input.projectionId, input.ledger);
+        const actualOffset = this.offsets.get(projectionKey) ?? null;
+        const existing = this.records.get(projectionKey)?.find((record) => record.sequence === input.entry.core.sequence);
+        if (existing !== undefined) {
+            return existing.entryDigest === input.entry.entryDigest
+                ? { kind: 'duplicate' }
+                : { kind: 'conflict', actualOffset };
+        }
+        if (!offsetsEqual(actualOffset, input.expectedOffset)) {
+            return { kind: 'conflict', actualOffset };
+        }
+        const expectedSequence = actualOffset === null ? 0n : BigInt(actualOffset.sequence) + 1n;
+        if (BigInt(input.entry.core.sequence) !== expectedSequence) {
+            return { kind: 'conflict', actualOffset };
+        }
+        const records = this.records.get(projectionKey) ?? [];
+        records.push(Object.freeze({ ...input.record }));
+        this.records.set(projectionKey, records);
+        this.offsets.set(projectionKey, {
+            sequence: input.entry.core.sequence,
+            entryDigest: input.entry.entryDigest,
+        });
+        return { kind: 'applied' };
+    }
+    async reset(projectionId, ledger) {
+        const projectionKey = key(projectionId, ledger);
+        this.offsets.delete(projectionKey);
+        this.records.delete(projectionKey);
+    }
+    async read(projectionId, ledger) {
+        return (this.records.get(key(projectionId, ledger)) ?? []).map((record) => ({ ...record }));
+    }
+    /** Explicit fault-injection seam for adapter conformance and recovery tests. */
+    corruptOffsetForTesting(projectionId, ledger, offset) {
+        this.offsets.set(key(projectionId, ledger), { ...offset });
+    }
+}
+/** Deterministically derives query/UI state from the immutable ledger. */
+export class AuditProjectionWorker {
+    options;
+    constructor(options) {
+        this.options = options;
+        if (!options.projectionId) {
+            throw new AuditProtocolError(AUDIT_ERROR_CODES.INVALID_CONFIGURATION, 'Projection ID is required');
+        }
+    }
+    async synchronize(ledger) {
+        let offset = await this.options.projections.getOffset(this.options.projectionId, ledger);
+        let applied = 0;
+        let duplicates = 0;
+        for await (const entry of this.options.journal.readRange({
+            ...ledger,
+            ...(offset === null ? {} : { afterSequence: offset.sequence }),
+        })) {
+            const result = await this.options.projections.compareAndApply({
+                projectionId: this.options.projectionId,
+                ledger,
+                expectedOffset: offset,
+                entry,
+                record: project(entry),
+            });
+            if (result.kind === 'conflict') {
+                throw new AuditProtocolError(AUDIT_ERROR_CODES.PROJECTION_CONFLICT, 'Projection offset conflicted with the ordered ledger', {
+                    sequence: entry.core.sequence,
+                    expectedOffset: offset,
+                    actualOffset: result.actualOffset,
+                });
+            }
+            if (result.kind === 'applied')
+                applied += 1;
+            else
+                duplicates += 1;
+            offset = { sequence: entry.core.sequence, entryDigest: entry.entryDigest };
+        }
+        return { applied, duplicates };
+    }
+    async rebuild(ledger) {
+        await this.options.projections.reset(this.options.projectionId, ledger);
+        return this.synchronize(ledger);
+    }
+    async reconcile(ledger) {
+        const [journalHead, projectionHead] = await Promise.all([
+            this.options.journal.getHead(ledger),
+            this.options.projections.getOffset(this.options.projectionId, ledger),
+        ]);
+        let status;
+        if (journalHead === null && projectionHead === null)
+            status = 'empty';
+        else if (journalHead !== null && projectionHead === null)
+            status = 'pending';
+        else if (journalHead === null || projectionHead === null)
+            status = 'gap_detected';
+        else if (journalHead.sequence === projectionHead.sequence) {
+            status = journalHead.entryDigest === projectionHead.entryDigest
+                ? 'verified'
+                : 'gap_detected';
+        }
+        else {
+            status = BigInt(projectionHead.sequence) < BigInt(journalHead.sequence)
+                ? 'pending'
+                : 'gap_detected';
+        }
+        return { status, journalHead, projectionHead };
+    }
+}
+//# sourceMappingURL=projection.js.map

package/dist/audit/projection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projection.js","sourceRoot":"","sources":["../../src/audit/projection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAgDpE,SAAS,GAAG,CAAC,YAAoB,EAAE,MAAsB;IACvD,OAAO,GAAG,YAAY,KAAK,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,YAAY,CACnB,IAAkC,EAClC,KAAmC;IAEnC,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,KAAK,KAAK,CAAC;IAC3D,OAAO,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC;AACpF,CAAC;AAED,SAAS,OAAO,CAAC,KAAyB;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;IAC/B,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;QAC7B,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa;QACvC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;QAC7B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;QACjC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;QACpF,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9E,WAAW,EAAE,SAAkB;KAChC,CAAC,CAAC;AACL,CAAC;AAED,yFAAyF;AACzF,MAAM,OAAO,6BAA6B;IAC/B,YAAY,GAAG,EAAE,UAAU,EAAE,WAAoB,EAAE,YAAY,EAAE,IAAa,EAAE,CAAC;IACzE,OAAO,GAAG,IAAI,GAAG,EAAiC,CAAC;IACnD,OAAO,GAAG,IAAI,GAAG,EAAuC,CAAC;IAE1E,KAAK,CAAC,SAAS,CACb,YAAoB,EACpB,MAAsB;QAEtB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3D,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAMrB;QACC,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAChE,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,QAAQ,CAAC,WAAW,KAAK,KAAK,CAAC,KAAK,CAAC,WAAW;gBACrD,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE;gBACvB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;YACtD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;QAC5C,CAAC;QACD,MAAM,gBAAgB,GAAG,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QACzF,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,gBAAgB,EAAE,CAAC;YAC3D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;QAC5C,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE;YAC9B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ;YACnC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;SACrC,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,YAAoB,EAAE,MAAsB;QACtD,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,IAAI,CACR,YAAoB,EACpB,MAAsB;QAEtB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9F,CAAC;IAED,gFAAgF;IAChF,uBAAuB,CACrB,YAAoB,EACpB,MAAsB,EACtB,MAA6B;QAE7B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAC7D,CAAC;CACF;AAcD,0EAA0E;AAC1E,MAAM,OAAO,qBAAqB;IACH;IAA7B,YAA6B,OAAqC;QAArC,YAAO,GAAP,OAAO,CAA8B;QAChE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,qBAAqB,EACvC,2BAA2B,CAC5B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAsB;QACtC,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACzF,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;YACvD,GAAG,MAAM;YACT,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;SAC/D,CAAC,EAAE,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC;gBAC5D,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;gBACvC,MAAM;gBACN,cAAc,EAAE,MAAM;gBACtB,KAAK;gBACL,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC;aACvB,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC/B,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,mBAAmB,EACrC,sDAAsD,EACtD;oBACE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;oBAC7B,cAAc,EAAE,MAAM;oBACtB,YAAY,EAAE,MAAM,CAAC,YAAY;iBAClC,CACF,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC,CAAC;;gBACvC,UAAU,IAAI,CAAC,CAAC;YACrB,MAAM,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;QAC7E,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAsB;QAClC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAsB;QACpC,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACtD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC;SACtE,CAAC,CAAC;QACH,IAAI,MAA+C,CAAC;QACpD,IAAI,WAAW,KAAK,IAAI,IAAI,cAAc,KAAK,IAAI;YAAE,MAAM,GAAG,OAAO,CAAC;aACjE,IAAI,WAAW,KAAK,IAAI,IAAI,cAAc,KAAK,IAAI;YAAE,MAAM,GAAG,SAAS,CAAC;aACxE,IAAI,WAAW,KAAK,IAAI,IAAI,cAAc,KAAK,IAAI;YAAE,MAAM,GAAG,cAAc,CAAC;aAC7E,IAAI,WAAW,CAAC,QAAQ,KAAK,cAAc,CAAC,QAAQ,EAAE,CAAC;YAC1D,MAAM,GAAG,WAAW,CAAC,WAAW,KAAK,cAAc,CAAC,WAAW;gBAC7D,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,cAAc,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC;gBACrE,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,cAAc,CAAC;QACrB,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;IACjD,CAAC;CACF"}

package/dist/audit/providers/anchor.d.ts

@@ -0,0 +1,23 @@
+import type { AuditAnchorReceipt, SignedAuditCheckpointV1 } from '../types.js';
+export interface AuditAnchorProvider {
+    readonly capability: 'supporting-anchor';
+    readonly kind: AuditAnchorReceipt['kind'];
+    publish(checkpoint: SignedAuditCheckpointV1): Promise<AuditAnchorReceipt>;
+    verify(checkpoint: SignedAuditCheckpointV1, receipt: AuditAnchorReceipt): Promise<boolean>;
+}
+/** Test/development adapter; production WORM/TSA/SCITT integrations implement the same port. */
+export declare class MemorySupportingAnchorProvider implements AuditAnchorProvider {
+    private readonly config;
+    readonly capability: "supporting-anchor";
+    readonly kind: AuditAnchorReceipt['kind'];
+    constructor(config: {
+        kind: AuditAnchorReceipt['kind'];
+        providerId: string;
+        clock: {
+            now(): number;
+        };
+    });
+    publish(checkpoint: SignedAuditCheckpointV1): Promise<AuditAnchorReceipt>;
+    verify(checkpoint: SignedAuditCheckpointV1, receipt: AuditAnchorReceipt): Promise<boolean>;
+}
+//# sourceMappingURL=anchor.d.ts.map

package/dist/audit/providers/anchor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anchor.d.ts","sourceRoot":"","sources":["../../../src/audit/providers/anchor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE/E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,CAAC,UAAU,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC1E,MAAM,CACJ,UAAU,EAAE,uBAAuB,EACnC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB;AAED,gGAAgG;AAChG,qBAAa,8BAA+B,YAAW,mBAAmB;IAI5D,OAAO,CAAC,QAAQ,CAAC,MAAM;IAHnC,QAAQ,CAAC,UAAU,EAAG,mBAAmB,CAAU;IACnD,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;gBAEb,MAAM,EAAE;QACnC,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACjC,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE;YAAE,GAAG,IAAI,MAAM,CAAA;SAAE,CAAC;KAC1B;IAIK,OAAO,CAAC,UAAU,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAUzE,MAAM,CACV,UAAU,EAAE,uBAAuB,EACnC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,OAAO,CAAC;CAKpB"}

package/dist/audit/providers/anchor.js

@@ -0,0 +1,25 @@
+/** Test/development adapter; production WORM/TSA/SCITT integrations implement the same port. */
+export class MemorySupportingAnchorProvider {
+    config;
+    capability = 'supporting-anchor';
+    kind;
+    constructor(config) {
+        this.config = config;
+        this.kind = config.kind;
+    }
+    async publish(checkpoint) {
+        return Object.freeze({
+            schema: 'https://schema.kya-os.org/v1/protocol/audit/anchor-receipt/v1.0.0',
+            kind: this.config.kind,
+            providerId: this.config.providerId,
+            checkpointDigest: checkpoint.checkpointDigest,
+            issuedAt: this.config.clock.now(),
+        });
+    }
+    async verify(checkpoint, receipt) {
+        return receipt.kind === this.config.kind &&
+            receipt.providerId === this.config.providerId &&
+            receipt.checkpointDigest === checkpoint.checkpointDigest;
+    }
+}
+//# sourceMappingURL=anchor.js.map

package/dist/audit/providers/anchor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anchor.js","sourceRoot":"","sources":["../../../src/audit/providers/anchor.ts"],"names":[],"mappings":"AAYA,gGAAgG;AAChG,MAAM,OAAO,8BAA8B;IAIZ;IAHpB,UAAU,GAAG,mBAA4B,CAAC;IAC1C,IAAI,CAA6B;IAE1C,YAA6B,MAI5B;QAJ4B,WAAM,GAAN,MAAM,CAIlC;QACC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,UAAmC;QAC/C,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,mEAAmE;YAC3E,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACtB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;YAClC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;YAC7C,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;SAClC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CACV,UAAmC,EACnC,OAA2B;QAE3B,OAAO,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI;YACtC,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU;YAC7C,OAAO,CAAC,gBAAgB,KAAK,UAAU,CAAC,gBAAgB,CAAC;IAC7D,CAAC;CACF"}

package/dist/audit/providers/evidence.d.ts

@@ -0,0 +1,36 @@
+import type { EvidenceRef } from '../types.js';
+export interface EncryptedEvidenceInput {
+    ref: EvidenceRef;
+    ciphertext: Uint8Array;
+}
+export interface AuditEvidenceProvider {
+    putIfAbsent(input: EncryptedEvidenceInput): Promise<EvidenceRef>;
+    has(ref: EvidenceRef): Promise<boolean>;
+    get(ref: EvidenceRef, context: EvidenceAccessContext): Promise<Uint8Array | null>;
+    applyRetention(command: EvidenceRetentionCommand): Promise<EvidenceRetentionResult>;
+}
+export interface EvidenceAccessContext {
+    actor: string;
+    purpose: string;
+}
+export type EvidenceRetentionCommand = {
+    kind: 'dispose';
+    ref: EvidenceRef;
+    authorizedBy: string;
+    reason: string;
+} | {
+    kind: 'legal_hold';
+    ref: EvidenceRef;
+    holdId: string;
+    authorizedBy: string;
+} | {
+    kind: 'release_hold';
+    ref: EvidenceRef;
+    holdId: string;
+    authorizedBy: string;
+};
+export interface EvidenceRetentionResult {
+    ref: EvidenceRef;
+    state: 'retained' | 'held' | 'disposed' | 'missing';
+}
+//# sourceMappingURL=evidence.d.ts.map

package/dist/audit/providers/evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../../../src/audit/providers/evidence.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,WAAW,CAAC;IACjB,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACjE,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAClF,cAAc,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACrF;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,wBAAwB,GAChC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,WAAW,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3E;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,GAAG,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,GAAG,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAErF,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,WAAW,CAAC;IACjB,KAAK,EAAE,UAAU,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;CACrD"}