@mcpose/audit 2.0.0 → 2.0.2

package/README.md

@@ -0,0 +1,120 @@
+# @mcpose/audit
+
+[![npm](https://img.shields.io/npm/v/@mcpose/audit)](https://www.npmjs.com/package/@mcpose/audit)
+[![license](https://img.shields.io/npm/l/@mcpose/audit)](https://github.com/amir-gorji/mcpose/blob/main/LICENSE)
+
+**Tamper-evident audit middleware for [mcpose](https://www.npmjs.com/package/mcpose).**
+
+`@mcpose/audit` turns every tool call flowing through an mcpose proxy into a tamper-evident **audit event**: HMAC-chained to its predecessor, hashed, and — for high-sensitivity calls — encrypted at rest. When a **session** closes, it emits a signed **replay manifest** with a Merkle root and per-event proofs, so any third party can verify that a single event happened without access to the full log.
+
+## When to reach for it
+
+You operate an MCP server in a regulated environment (e.g. financial services) and need to prove, after the fact, exactly which tool calls happened, by whom, in what order — with cryptographic evidence that the record has not been altered, inserted into, or truncated.
+
+## Install
+
+```bash
+npm install @mcpose/audit mcpose
+```
+
+`mcpose` is a peer dependency. Requires Node.js 18+ (uses `node:crypto`).
+
+## Quick start
+
+```ts
+import {
+  createAuditMiddleware,
+  createDefaultSigningKeyProvider,
+  createSensitivityResolver,
+} from '@mcpose/audit';
+import { startHttpProxy } from 'mcpose';
+
+// Supplied by your application:
+//   backend       — an mcpose BackendClient (see `mcpose` docs)
+//   auditLog      — your durable sink for audit events
+//   manifestStore — your durable sink for replay manifests
+//   piiMW         — an upstream redaction middleware
+//   extractJwt    — your resolveIdentity function
+
+// The signing secret never leaves the process; all subkeys derive from it.
+const signingKey = createDefaultSigningKeyProvider(process.env.AUDIT_SECRET!);
+
+// Map tools to a sensitivity tier. Unknown tools resolve to 'high'.
+const sensitivityResolver = createSensitivityResolver({
+  get_balance:    'low',
+  search_trades:  'medium',
+  transfer_funds: 'high',
+});
+
+const auditHandle = createAuditMiddleware({
+  signingKey,
+  sensitivityResolver,
+  onEvent: (event) => auditLog.append(event),
+  onManifest: (manifest) => manifestStore.save(manifest),
+});
+
+await startHttpProxy(
+  backend,
+  { toolMiddleware: [piiMW, auditHandle.middleware] },
+  {
+    resolveIdentity: extractJwt,
+    // Flush the replay manifest when the session ends.
+    onSessionClosed: (sessionId) => auditHandle.closeSession(sessionId),
+  },
+);
+```
+
+## How it works
+
+- **Audit event** — a record of one tool call: `identity`, `tool`, `outcome`, input/output hashes, and a `chainHash` linking it to the previous event. `AuditEvent` is a discriminated union on `sensitivityTier`.
+- **Sensitivity tier** (`low` | `medium` | `high`) — decides whether the event stores plaintext (`inputRaw`/`outputRaw`) or AES-256-GCM ciphertext (`inputEncrypted`/`outputEncrypted`). Unknown tools default to `high`.
+- **Replay manifest** — produced at session close: a Merkle root over every event's `chainHash`, individual `MerkleProof`s, and a signature over the root. Proves *what happened*; it does not re-execute calls.
+
+## Security model
+
+The append-only HMAC chain makes insertion, deletion, or reordering of events detectable; the signed Merkle root anchors the whole session; high-tier payloads are encrypted at rest.
+
+> **The signing secret is the root of all of it.** The per-entry **chain key** and the per-event AES **encryption root** are derived from the secret *through* the `SigningKeyProvider.sign()` oracle with domain separation — never from the public **key id**. The key id (`ReplayManifest.signedBy`) is a public identifier only; **never use it as key material**, and never hand-roll the chain or encryption keys. See **[ADR-0003](https://github.com/amir-gorji/mcpose/blob/main/docs/adr/0003-audit-subkeys-derived-from-signing-oracle.md)** for the reasoning and the attack it closes.
+
+For production, implement `SigningKeyProvider` against your KMS rather than holding the secret in process. `createDefaultSigningKeyProvider` is HMAC-SHA256 in-process signing, suitable for development and single-trust deployments.
+
+## API surface
+
+| Export | Purpose |
+|---|---|
+| `createAuditMiddleware(options)` | Returns `{ middleware, closeSession }`. Add `middleware` to the pipeline; call `closeSession(sessionId)` to emit the manifest. |
+| `createSensitivityResolver(map, override?)` | Build a `SensitivityResolverFn`; `override` takes precedence over the static map. |
+| `createDefaultSigningKeyProvider(secret)` | In-process HMAC-SHA256 `SigningKeyProvider`. |
+| `computeMerkleRoot` · `computeMerkleProof` · `verifyMerkleProof` | Low-level Merkle helpers for independent verification. |
+
+**Key types:** `AuditEvent` (`LowAuditEvent` \| `MediumAuditEvent` \| `HighAuditEvent`), `AuditEventBase`, `SensitivityTier`, `SensitivityResolverFn`, `SigningKeyProvider`, `AuditOptions`, `AuditMiddlewareHandle`, `ReplayManifest`, `MerkleProof`, `CostMetadata`.
+
+### `AuditOptions`
+
+```ts
+interface AuditOptions {
+  signingKey: SigningKeyProvider;
+  sensitivityResolver: SensitivityResolverFn;
+  onEvent: (event: AuditEvent) => void | Promise<void>;
+  onManifest?: (manifest: ReplayManifest) => void | Promise<void>;
+  hashAlgorithm?: 'SHA-256';   // default: SHA-256
+  includeRejections?: boolean; // default: true
+  includeCost?: boolean;       // default: true
+}
+```
+
+`closeSession(sessionId)` returns `undefined` if the session had no events or is unknown. Wire it to `HttpProxyOptions.onSessionClosed`.
+
+## Testing
+
+Verify chains and manifests in your test suite with [`@mcpose/testing`](https://www.npmjs.com/package/@mcpose/testing) — `assertAuditChainIntegrity`, `assertReplayManifestValid`, `assertPiiRedacted`.
+
+## Documentation
+
+- [Full README & API reference](https://github.com/amir-gorji/mcpose#mcposeaudit)
+- [ADR-0003 — audit subkeys derived from the signing oracle](https://github.com/amir-gorji/mcpose/blob/main/docs/adr/0003-audit-subkeys-derived-from-signing-oracle.md)
+- [CONTEXT.md](https://github.com/amir-gorji/mcpose/blob/main/CONTEXT.md) — canonical domain glossary
+
+## License
+
+MIT © Amir Gorji

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcpose/audit",
-  "version": "2.0.0",
+  "version": "2.0.2",
   "description": "Integrity-chained audit middleware for mcpose — HMAC chain, Merkle proofs, ReplayManifest",
   "type": "module",
   "main": "./dist/index.js",
@@ -11,18 +11,8 @@
       "default": "./dist/index.js"
     }
   },
-  "files": [
-    "dist",
-    "README.md"
-  ],
-  "keywords": [
-    "mcp",
-    "audit",
-    "compliance",
-    "fintech",
-    "hmac",
-    "merkle"
-  ],
+  "files": ["dist", "README.md"],
+  "keywords": ["mcp", "audit", "compliance", "fintech", "hmac", "merkle"],
   "author": "Amir Gorji",
   "license": "MIT",
   "repository": {
@@ -30,6 +20,11 @@
     "url": "git+https://github.com/amir-gorji/mcpose.git",
     "directory": "packages/audit"
   },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "ts:ci": "tsc --noEmit",
+    "test": "vitest run --passWithNoTests"
+  },
   "peerDependencies": {
     "mcpose": ">=2.0.0"
   },
@@ -37,11 +32,6 @@
     "@types/node": "^22.0.0",
     "typescript": "^5.0.0",
     "vitest": "^3.0.0",
-    "mcpose": "2.0.1"
-  },
-  "scripts": {
-    "build": "tsc -p tsconfig.build.json",
-    "ts:ci": "tsc --noEmit",
-    "test": "vitest run --passWithNoTests"
+    "mcpose": "workspace:*"
   }
-}
+}

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Amir Gorji
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/dist/__tests__/middleware.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=middleware.test.d.ts.map

package/dist/__tests__/middleware.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"middleware.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/middleware.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/middleware.test.js

@@ -1,152 +0,0 @@
-import { describe, it, expect, vi } from 'vitest';
-import { createAuditMiddleware } from '../middleware.js';
-import { createDefaultSigningKeyProvider } from '../signingKey.js';
-import { createSensitivityResolver } from '../sensitivity.js';
-import { createProxyContext } from 'mcpose';
-const identity = {
-    sub: 'user-1',
-    type: 'human',
-    roles: ['analyst'],
-    claims: {},
-    resolvedAt: '2026-06-01T00:00:00.000Z',
-    source: 'jwt',
-};
-function makeOptions(overrides = {}) {
-    return {
-        signingKey: createDefaultSigningKeyProvider('test-secret'),
-        sensitivityResolver: createSensitivityResolver({ search: 'low', transfer: 'high' }),
-        onEvent: vi.fn(),
-        ...overrides,
-    };
-}
-function makeCtx(sessionId) {
-    return createProxyContext({ transport: 'http', identity, sessionId });
-}
-function makeReq(tool, args = {}) {
-    return {
-        method: 'tools/call',
-        params: { name: tool, arguments: args },
-    };
-}
-describe('createAuditMiddleware — tracer bullet', () => {
-    it('calls onEvent after a successful tool call', async () => {
-        const onEvent = vi.fn();
-        const { middleware } = createAuditMiddleware(makeOptions({ onEvent }));
-        const ctx = makeCtx('session-1');
-        await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
-        expect(onEvent).toHaveBeenCalledOnce();
-        const event = onEvent.mock.calls[0][0];
-        expect(event.tool).toBe('search');
-        expect(event.outcome).toBe('success');
-        expect(event.identity.sub).toBe('user-1');
-        expect(event.sessionId).toBe('session-1');
-        expect(event.sensitivityTier).toBe('low');
-    });
-    it('records error outcome when next throws', async () => {
-        const onEvent = vi.fn();
-        const { middleware } = createAuditMiddleware(makeOptions({ onEvent }));
-        await expect(middleware(makeReq('search'), async () => { throw new Error('upstream down'); }, makeCtx())).rejects.toThrow('upstream down');
-        const event = onEvent.mock.calls[0][0];
-        expect(event.outcome).toBe('error');
-    });
-    it('sets replayManifestPosition sequentially within a session', async () => {
-        const events = [];
-        const { middleware } = createAuditMiddleware(makeOptions({ onEvent: (e) => events.push(e) }));
-        const ctx = makeCtx('sess-seq');
-        await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
-        await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
-        await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
-        expect(events.map((e) => e.replayManifestPosition)).toEqual([0, 1, 2]);
-    });
-});
-describe('createAuditMiddleware — HMAC chain', () => {
-    it('first event chainHash is non-empty', async () => {
-        const events = [];
-        const { middleware } = createAuditMiddleware(makeOptions({ onEvent: (e) => events.push(e) }));
-        await middleware(makeReq('search'), async () => ({ content: [] }), makeCtx('s1'));
-        expect(events[0].chainHash).toBeTruthy();
-        expect(events[0].chainHash.length).toBeGreaterThan(0);
-    });
-    it('each chainHash differs from the previous (chain advances)', async () => {
-        const events = [];
-        const { middleware } = createAuditMiddleware(makeOptions({ onEvent: (e) => events.push(e) }));
-        const ctx = makeCtx('s2');
-        for (let i = 0; i < 5; i++) {
-            await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
-        }
-        const hashes = events.map((e) => e.chainHash);
-        const unique = new Set(hashes);
-        expect(unique.size).toBe(5);
-    });
-});
-describe('createAuditMiddleware — sensitivity tiers', () => {
-    it('low-tier event has inputRaw and outputRaw', async () => {
-        const events = [];
-        const { middleware } = createAuditMiddleware(makeOptions({ onEvent: (e) => events.push(e) }));
-        await middleware(makeReq('search', { q: 'hello' }), async () => ({ content: [{ type: 'text', text: 'result' }] }), makeCtx());
-        const event = events[0];
-        expect(event.sensitivityTier).toBe('low');
-        if (event.sensitivityTier === 'low') {
-            expect(event.inputRaw).toEqual({ q: 'hello' });
-        }
-    });
-    it('high-tier event has encrypted fields, no inputRaw/outputRaw', async () => {
-        const events = [];
-        const { middleware } = createAuditMiddleware(makeOptions({ onEvent: (e) => events.push(e) }));
-        await middleware(makeReq('transfer', { amount: 1000 }), async () => ({ content: [] }), makeCtx());
-        const event = events[0];
-        expect(event.sensitivityTier).toBe('high');
-        if (event.sensitivityTier === 'high') {
-            expect(typeof event.inputEncrypted).toBe('string');
-            expect(typeof event.outputEncrypted).toBe('string');
-            expect('inputRaw' in event).toBe(false);
-        }
-    });
-});
-describe('createAuditMiddleware — closeSession', () => {
-    it('returns undefined for unknown session', async () => {
-        const { closeSession } = createAuditMiddleware(makeOptions());
-        const result = await closeSession('no-such-session');
-        expect(result).toBeUndefined();
-    });
-    it('returns undefined for session with no events', async () => {
-        const { closeSession } = createAuditMiddleware(makeOptions());
-        const result = await closeSession('empty-session');
-        expect(result).toBeUndefined();
-    });
-    it('returns ReplayManifest with correct fields after events', async () => {
-        const onManifest = vi.fn();
-        const { middleware, closeSession } = createAuditMiddleware(makeOptions({ onManifest }));
-        const ctx = makeCtx('sess-manifest');
-        await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
-        await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
-        const manifest = await closeSession('sess-manifest');
-        expect(manifest).toBeDefined();
-        expect(manifest.sessionId).toBe('sess-manifest');
-        expect(manifest.eventCount).toBe(2);
-        expect(manifest.merkleRoot).toBeTruthy();
-        expect(manifest.merkleProofs).toHaveLength(2);
-        expect(manifest.signature).toBeTruthy();
-        expect(manifest.signedBy).toBeTruthy();
-        expect(onManifest).toHaveBeenCalledOnce();
-        expect(onManifest.mock.calls[0][0]).toEqual(manifest);
-    });
-});
-describe('createAuditMiddleware — Merkle proof', () => {
-    it('proof for each event verifies against the merkle root', async () => {
-        const { verifyMerkleProof } = await import('../chain.js');
-        const events = [];
-        const { middleware, closeSession } = createAuditMiddleware(makeOptions({ onEvent: (e) => events.push(e) }));
-        const ctx = makeCtx('sess-merkle');
-        for (let i = 0; i < 4; i++) {
-            await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
-        }
-        const manifest = await closeSession('sess-merkle');
-        expect(manifest).toBeDefined();
-        for (let i = 0; i < events.length; i++) {
-            const valid = verifyMerkleProof(events[i].chainHash, manifest.merkleProofs[i], manifest.merkleRoot);
-            expect(valid).toBe(true);
-        }
-    });
-});
-//# sourceMappingURL=middleware.test.js.map

package/dist/__tests__/middleware.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"middleware.test.js","sourceRoot":"","sources":["../../src/__tests__/middleware.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,+BAA+B,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAG9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AAE5C,MAAM,QAAQ,GAAa;IACzB,GAAG,EAAE,QAAQ;IACb,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,CAAC,SAAS,CAAC;IAClB,MAAM,EAAE,EAAE;IACV,UAAU,EAAE,0BAA0B;IACtC,MAAM,EAAE,KAAK;CACd,CAAC;AAEF,SAAS,WAAW,CAAC,YAAmC,EAAE;IACxD,OAAO;QACL,UAAU,EAAE,+BAA+B,CAAC,aAAa,CAAC;QAC1D,mBAAmB,EAAE,yBAAyB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnF,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE;QAChB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,SAAkB;IACjC,OAAO,kBAAkB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,OAAgC,EAAE;IAC/D,OAAO;QACL,MAAM,EAAE,YAAqB;QAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;KACxC,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACxB,MAAM,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QAEjC,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAExE,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,EAAE,CAAC;QACvC,MAAM,KAAK,GAAe,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACxB,MAAM,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAEvE,MAAM,MAAM,CACV,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAC5F,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAEnC,MAAM,KAAK,GAAe,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,MAAM,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAC1C,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAChD,CAAC;QACF,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QAEhC,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QACxE,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QACxE,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAExE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,MAAM,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAC1C,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAChD,CAAC;QACF,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAClF,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,MAAM,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAC1C,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAChD,CAAC;QACF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2CAA2C,EAAE,GAAG,EAAE;IACzD,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,MAAM,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAC1C,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAChD,CAAC;QACF,MAAM,UAAU,CACd,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EACjC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,EAC7D,OAAO,EAAE,CACV,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,eAAe,KAAK,KAAK,EAAE,CAAC;YACpC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,MAAM,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAC1C,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAChD,CAAC;QACF,MAAM,UAAU,CACd,OAAO,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EACrC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAC7B,OAAO,EAAE,CACV,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,eAAe,KAAK,MAAM,EAAE,CAAC;YACrC,MAAM,CAAC,OAAO,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnD,MAAM,CAAC,OAAO,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACpD,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACpD,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,EAAE,YAAY,EAAE,GAAG,qBAAqB,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,iBAAiB,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,YAAY,EAAE,GAAG,qBAAqB,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,eAAe,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,UAAU,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,qBAAqB,CACxD,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC,CAC5B,CAAC;QACF,MAAM,GAAG,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;QACrC,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QACxE,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAExE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,eAAe,CAAC,CAAC;QAErD,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/B,MAAM,CAAC,QAAS,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAClD,MAAM,CAAC,QAAS,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,QAAS,CAAC,UAAU,CAAC,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,CAAC,QAAS,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,QAAS,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,CAAC;QACzC,MAAM,CAAC,QAAS,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,CAAC,UAAU,CAAC,CAAC,oBAAoB,EAAE,CAAC;QAC1C,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACpD,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,qBAAqB,CACxD,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAChD,CAAC;QACF,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAE/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,iBAAiB,CAC7B,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EACnB,QAAS,CAAC,YAAY,CAAC,CAAC,CAAC,EACzB,QAAS,CAAC,UAAU,CACrB,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/sensitivity.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=sensitivity.test.d.ts.map

package/dist/__tests__/sensitivity.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sensitivity.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/sensitivity.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/sensitivity.test.js

@@ -1,27 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { createSensitivityResolver } from '../sensitivity.js';
-const identity = {
-    sub: 'u1',
-    type: 'human',
-    roles: [],
-    claims: {},
-    resolvedAt: new Date().toISOString(),
-    source: 'jwt',
-};
-describe('createSensitivityResolver', () => {
-    it('returns the mapped tier for a known tool', () => {
-        const resolve = createSensitivityResolver({ transfer_funds: 'high', get_balance: 'low' });
-        expect(resolve('transfer_funds', identity, {})).toBe('high');
-        expect(resolve('get_balance', identity, {})).toBe('low');
-    });
-    it('returns high for an unknown tool', () => {
-        const resolve = createSensitivityResolver({ get_balance: 'low' });
-        expect(resolve('unknown_tool', identity, {})).toBe('high');
-    });
-    it('override fn takes precedence over the static map', () => {
-        const resolve = createSensitivityResolver({ get_balance: 'low' }, (_tool, _identity, args) => (args.pii ? 'high' : 'low'));
-        expect(resolve('get_balance', identity, { pii: true })).toBe('high');
-        expect(resolve('get_balance', identity, {})).toBe('low');
-    });
-});
-//# sourceMappingURL=sensitivity.test.js.map

package/dist/__tests__/sensitivity.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sensitivity.test.js","sourceRoot":"","sources":["../../src/__tests__/sensitivity.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAG9D,MAAM,QAAQ,GAAa;IACzB,GAAG,EAAE,IAAI;IACT,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,EAAE;IACT,MAAM,EAAE,EAAE;IACV,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IACpC,MAAM,EAAE,KAAK;CACd,CAAC;AAEF,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,OAAO,GAAG,yBAAyB,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1F,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,OAAO,GAAG,yBAAyB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,OAAO,GAAG,yBAAyB,CACvC,EAAE,WAAW,EAAE,KAAK,EAAE,EACtB,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CACxD,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrE,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/signingKey.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=signingKey.test.d.ts.map

package/dist/__tests__/signingKey.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"signingKey.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/signingKey.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/signingKey.test.js

@@ -1,37 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { createDefaultSigningKeyProvider } from '../signingKey.js';
-describe('createDefaultSigningKeyProvider', () => {
-    it('has correct shape', () => {
-        const provider = createDefaultSigningKeyProvider('secret');
-        expect(provider.algorithm).toBe('HMAC-SHA256');
-        expect(typeof provider.keyId).toBe('string');
-        expect(provider.keyId.length).toBeGreaterThan(0);
-        expect(typeof provider.sign).toBe('function');
-    });
-    it('sign returns a non-empty buffer', async () => {
-        const provider = createDefaultSigningKeyProvider('secret');
-        const sig = await provider.sign(Buffer.from('hello'));
-        expect(sig).toBeInstanceOf(Buffer);
-        expect(sig.length).toBeGreaterThan(0);
-    });
-    it('same secret + same data → same signature (deterministic)', async () => {
-        const p1 = createDefaultSigningKeyProvider('secret');
-        const p2 = createDefaultSigningKeyProvider('secret');
-        const data = Buffer.from('test-data');
-        const [s1, s2] = await Promise.all([p1.sign(data), p2.sign(data)]);
-        expect(s1.toString('hex')).toBe(s2.toString('hex'));
-    });
-    it('different secrets → different signatures', async () => {
-        const p1 = createDefaultSigningKeyProvider('secret-a');
-        const p2 = createDefaultSigningKeyProvider('secret-b');
-        const data = Buffer.from('test-data');
-        const [s1, s2] = await Promise.all([p1.sign(data), p2.sign(data)]);
-        expect(s1.toString('hex')).not.toBe(s2.toString('hex'));
-    });
-    it('accepts Buffer as secret', async () => {
-        const provider = createDefaultSigningKeyProvider(Buffer.from('secret'));
-        const sig = await provider.sign(Buffer.from('data'));
-        expect(sig).toBeInstanceOf(Buffer);
-    });
-});
-//# sourceMappingURL=signingKey.test.js.map

package/dist/__tests__/signingKey.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"signingKey.test.js","sourceRoot":"","sources":["../../src/__tests__/signingKey.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,+BAA+B,EAAE,MAAM,kBAAkB,CAAC;AAEnE,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC3B,MAAM,QAAQ,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/C,MAAM,CAAC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,QAAQ,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,EAAE,GAAG,+BAA+B,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,EAAE,GAAG,+BAA+B,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,QAAQ,GAAG,+BAA+B,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/chain.d.ts

@@ -1,12 +0,0 @@
-import type { MerkleProof } from './types.js';
-export declare function sha256hex(data: string | Buffer): string;
-export declare function hmacSha256hex(data: string | Buffer, key: Buffer): string;
-/**
- * HMAC-SHA256(JSON(entryWithoutChainHash) + prevChainHash, signingKey).
- * The entry is serialized without its own chainHash to avoid circular dependency.
- */
-export declare function computeChainHash(entryWithoutChainHash: Record<string, unknown>, prevChainHash: string, signingKey: Buffer): string;
-export declare function computeMerkleRoot(hashes: string[]): string;
-export declare function computeMerkleProof(hashes: string[], index: number): MerkleProof;
-export declare function verifyMerkleProof(leafHash: string, proof: MerkleProof, root: string): boolean;
-//# sourceMappingURL=chain.d.ts.map

package/dist/chain.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../src/chain.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAEvD;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAExE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9C,aAAa,EAAE,MAAM,EACrB,UAAU,EAAE,MAAM,GACjB,MAAM,CAGR;AAaD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAQ1D;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,CAoB/E;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,WAAW,EAClB,IAAI,EAAE,MAAM,GACX,OAAO,CAUT"}

package/dist/chain.js

@@ -1,66 +0,0 @@
-import { createHash, createHmac } from 'node:crypto';
-export function sha256hex(data) {
-    return createHash('sha256').update(data).digest('hex');
-}
-export function hmacSha256hex(data, key) {
-    return createHmac('sha256', key).update(data).digest('hex');
-}
-/**
- * HMAC-SHA256(JSON(entryWithoutChainHash) + prevChainHash, signingKey).
- * The entry is serialized without its own chainHash to avoid circular dependency.
- */
-export function computeChainHash(entryWithoutChainHash, prevChainHash, signingKey) {
-    const data = JSON.stringify(entryWithoutChainHash) + prevChainHash;
-    return hmacSha256hex(data, signingKey);
-}
-function nextPow2Layer(hashes) {
-    const layer = [...hashes];
-    // Pad to even length by duplicating the last node (standard Merkle convention)
-    if (layer.length % 2 === 1)
-        layer.push(layer[layer.length - 1]);
-    const next = [];
-    for (let i = 0; i < layer.length; i += 2) {
-        next.push(sha256hex(layer[i] + layer[i + 1]));
-    }
-    return next;
-}
-export function computeMerkleRoot(hashes) {
-    if (hashes.length === 0)
-        return sha256hex('');
-    if (hashes.length === 1)
-        return hashes[0];
-    let layer = [...hashes];
-    while (layer.length > 1) {
-        layer = nextPow2Layer(layer);
-    }
-    return layer[0];
-}
-export function computeMerkleProof(hashes, index) {
-    const siblings = [];
-    const directions = [];
-    let layer = [...hashes];
-    let idx = index;
-    while (layer.length > 1) {
-        // Pad odd layers
-        if (layer.length % 2 === 1)
-            layer.push(layer[layer.length - 1]);
-        const siblingIdx = idx % 2 === 0 ? idx + 1 : idx - 1;
-        siblings.push(layer[siblingIdx]);
-        directions.push(idx % 2 === 0 ? 'right' : 'left');
-        layer = nextPow2Layer(layer.slice(0, layer.length));
-        idx = Math.floor(idx / 2);
-    }
-    return { index, siblings, directions };
-}
-export function verifyMerkleProof(leafHash, proof, root) {
-    let current = leafHash;
-    for (let i = 0; i < proof.siblings.length; i++) {
-        const sibling = proof.siblings[i];
-        const dir = proof.directions[i];
-        current = dir === 'right'
-            ? sha256hex(current + sibling)
-            : sha256hex(sibling + current);
-    }
-    return current === root;
-}
-//# sourceMappingURL=chain.js.map

package/dist/chain.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"chain.js","sourceRoot":"","sources":["../src/chain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGrD,MAAM,UAAU,SAAS,CAAC,IAAqB;IAC7C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAqB,EAAE,GAAW;IAC9D,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,qBAA8C,EAC9C,aAAqB,EACrB,UAAkB;IAElB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,GAAG,aAAa,CAAC;IACnE,OAAO,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,aAAa,CAAC,MAAgB;IACrC,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IAC1B,+EAA+E;IAC/E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAgB;IAChD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAgB,EAAE,KAAa;IAChE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,UAAU,GAAyB,EAAE,CAAC;IAE5C,IAAI,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IACxB,IAAI,GAAG,GAAG,KAAK,CAAC;IAEhB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,iBAAiB;QACjB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QAEhE,MAAM,UAAU,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QACjC,UAAU,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAElD,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,QAAgB,EAChB,KAAkB,EAClB,IAAY;IAEZ,IAAI,OAAO,GAAG,QAAQ,CAAC;IACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChC,OAAO,GAAG,GAAG,KAAK,OAAO;YACvB,CAAC,CAAC,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC;YAC9B,CAAC,CAAC,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,OAAO,KAAK,IAAI,CAAC;AAC1B,CAAC"}

package/dist/index.d.ts

@@ -1,6 +0,0 @@
-export type { SensitivityTier, SensitivityResolverFn, HashAlgorithm, SigningKeyProvider, CostMetadata, AuditEventBase, LowAuditEvent, MediumAuditEvent, HighAuditEvent, AuditEvent, MerkleProof, ReplayManifest, AuditOptions, AuditMiddlewareHandle, } from './types.js';
-export { createSensitivityResolver } from './sensitivity.js';
-export { createDefaultSigningKeyProvider } from './signingKey.js';
-export { createAuditMiddleware } from './middleware.js';
-export { computeMerkleRoot, computeMerkleProof, verifyMerkleProof } from './chain.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,WAAW,EACX,cAAc,EACd,YAAY,EACZ,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,5 +0,0 @@
-export { createSensitivityResolver } from './sensitivity.js';
-export { createDefaultSigningKeyProvider } from './signingKey.js';
-export { createAuditMiddleware } from './middleware.js';
-export { computeMerkleRoot, computeMerkleProof, verifyMerkleProof } from './chain.js';
-//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC"}

package/dist/middleware.d.ts

@@ -1,3 +0,0 @@
-import type { AuditMiddlewareHandle, AuditOptions } from './types.js';
-export declare function createAuditMiddleware(options: AuditOptions): AuditMiddlewareHandle;
-//# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,qBAAqB,EACrB,YAAY,EAKb,MAAM,YAAY,CAAC;AAkCpB,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,YAAY,GAAG,qBAAqB,CA2FlF"}

package/dist/middleware.js

@@ -1,140 +0,0 @@
-import { createCipheriv, randomBytes, createHash } from 'node:crypto';
-import { computeChainHash, computeMerkleProof, computeMerkleRoot, sha256hex } from './chain.js';
-function aesEncrypt(plaintext, key) {
-    const iv = randomBytes(12);
-    const cipher = createCipheriv('aes-256-gcm', key.subarray(0, 32), iv);
-    const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
-    const tag = cipher.getAuthTag();
-    return Buffer.concat([iv, tag, encrypted]).toString('base64');
-}
-function deriveEventKey(chainKey, eventId) {
-    return createHash('sha256').update(chainKey).update(eventId).digest();
-}
-function anonymousIdentity() {
-    return {
-        sub: 'anonymous',
-        type: 'service',
-        roles: [],
-        claims: {},
-        resolvedAt: new Date().toISOString(),
-        source: 'custom',
-    };
-}
-export function createAuditMiddleware(options) {
-    const sessions = new Map();
-    // Derive a stable 32-byte key from the signingKey.keyId (SHA-256 hex of the secret).
-    // Used for HMAC chain hashes (synchronous) and per-event AES-256 encryption.
-    // The async sign() on signingKey is reserved for signing the ReplayManifest root.
-    const chainKey = Buffer.from(options.signingKey.keyId, 'hex');
-    const middleware = async (req, next, ctx) => {
-        const start = Date.now();
-        const identity = ctx.identity ?? anonymousIdentity();
-        const sessionId = ctx.sessionId;
-        if (sessionId && !sessions.has(sessionId)) {
-            sessions.set(sessionId, {
-                events: [],
-                prevChainHash: '',
-                startedAt: new Date().toISOString(),
-                identity,
-            });
-        }
-        const session = sessionId ? sessions.get(sessionId) : undefined;
-        const position = session?.events.length ?? 0;
-        const tool = req.params.name;
-        const args = req.params.arguments ?? {};
-        const tier = options.sensitivityResolver(tool, identity, args);
-        let outcome = 'success';
-        let result;
-        let threw = false;
-        try {
-            result = await next(req);
-        }
-        catch (err) {
-            outcome = 'error';
-            threw = true;
-            result = undefined;
-            const event = buildEvent({
-                ctx, identity, tool, args, result: undefined,
-                duration_ms: Date.now() - start, outcome, position,
-                prevChainHash: session?.prevChainHash ?? '',
-                tier, chainKey,
-            });
-            advanceSession(session, event);
-            await options.onEvent(event);
-            throw err;
-        }
-        if (!threw) {
-            const event = buildEvent({
-                ctx, identity, tool, args, result,
-                duration_ms: Date.now() - start, outcome, position,
-                prevChainHash: session?.prevChainHash ?? '',
-                tier, chainKey,
-            });
-            advanceSession(session, event);
-            await options.onEvent(event);
-        }
-        return result;
-    };
-    const closeSession = async (sessionId) => {
-        const session = sessions.get(sessionId);
-        if (!session || session.events.length === 0)
-            return undefined;
-        sessions.delete(sessionId);
-        const hashes = session.events.map((e) => e.chainHash);
-        const merkleRoot = computeMerkleRoot(hashes);
-        const merkleProofs = hashes.map((_, i) => computeMerkleProof(hashes, i));
-        const signature = (await options.signingKey.sign(Buffer.from(merkleRoot))).toString('hex');
-        const manifest = {
-            sessionId,
-            identity: session.identity,
-            startedAt: session.startedAt,
-            closedAt: new Date().toISOString(),
-            eventCount: session.events.length,
-            merkleRoot,
-            merkleProofs,
-            signedBy: options.signingKey.keyId,
-            signature,
-        };
-        await options.onManifest?.(manifest);
-        return manifest;
-    };
-    return { middleware, closeSession };
-}
-// ── Helpers ────────────────────────────────────────────────────────────────────
-function advanceSession(session, event) {
-    if (!session)
-        return;
-    session.events.push(event);
-    session.prevChainHash = event.chainHash;
-}
-function buildEvent(p) {
-    const stableFields = {
-        id: p.ctx.requestId,
-        timestamp: new Date().toISOString(),
-        ...(p.ctx.sessionId !== undefined ? { sessionId: p.ctx.sessionId } : {}),
-        ...(p.ctx.delegatedFrom !== undefined ? { delegatedFrom: p.ctx.delegatedFrom } : {}),
-        identity: p.identity,
-        tool: p.tool,
-        duration_ms: p.duration_ms,
-        outcome: p.outcome,
-        inputHash: sha256hex(JSON.stringify(p.args)),
-        outputHash: sha256hex(JSON.stringify(p.result ?? null)),
-        replayManifestPosition: p.position,
-    };
-    const chainHash = computeChainHash(stableFields, p.prevChainHash, p.chainKey);
-    const base = { ...stableFields, chainHash };
-    if (p.tier === 'high') {
-        const eventKey = deriveEventKey(p.chainKey, base.id);
-        return {
-            ...base,
-            sensitivityTier: 'high',
-            inputEncrypted: aesEncrypt(JSON.stringify(p.args), eventKey),
-            outputEncrypted: aesEncrypt(JSON.stringify(p.result ?? null), eventKey),
-        };
-    }
-    if (p.tier === 'medium') {
-        return { ...base, sensitivityTier: 'medium', inputRaw: p.args, outputRaw: p.result };
-    }
-    return { ...base, sensitivityTier: 'low', inputRaw: p.args, outputRaw: p.result };
-}
-//# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAUtE,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAUhG,SAAS,UAAU,CAAC,SAAiB,EAAE,GAAW;IAChD,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB,EAAE,OAAe;IACvD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO;QACL,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,EAAE;QACV,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,MAAM,EAAE,QAAQ;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAqB;IACzD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEjD,qFAAqF;IACrF,6EAA6E;IAC7E,kFAAkF;IAClF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAE9D,MAAM,UAAU,GAAwC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,iBAAiB,EAAE,CAAC;QACrD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;QAEhC,IAAI,SAAS,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE;gBACtB,MAAM,EAAE,EAAE;gBACV,aAAa,EAAE,EAAE;gBACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,MAAM,QAAQ,GAAG,OAAO,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAC7B,MAAM,IAAI,GAAI,GAAG,CAAC,MAAM,CAAC,SAAqC,IAAI,EAAE,CAAC;QACrE,MAAM,IAAI,GAAG,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAE/D,IAAI,OAAO,GAA0B,SAAS,CAAC;QAC/C,IAAI,MAAe,CAAC;QACpB,IAAI,KAAK,GAAG,KAAK,CAAC;QAElB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,OAAO,CAAC;YAClB,KAAK,GAAG,IAAI,CAAC;YACb,MAAM,GAAG,SAAS,CAAC;YACnB,MAAM,KAAK,GAAG,UAAU,CAAC;gBACvB,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS;gBAC5C,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,QAAQ;gBAClD,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,EAAE;gBAC3C,IAAI,EAAE,QAAQ;aACf,CAAC,CAAC;YACH,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC/B,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,UAAU,CAAC;gBACvB,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM;gBACjC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,QAAQ;gBAClD,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,EAAE;gBAC3C,IAAI,EAAE,QAAQ;aACf,CAAC,CAAC;YACH,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC/B,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,MAA0C,CAAC;IACpD,CAAC,CAAC;IAEF,MAAM,YAAY,GAA0C,KAAK,EAAE,SAAS,EAAE,EAAE;QAC9E,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAE9D,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAE3B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE3F,MAAM,QAAQ,GAAmB;YAC/B,SAAS;YACT,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;YACjC,UAAU;YACV,YAAY;YACZ,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK;YAClC,SAAS;SACV,CAAC;QAEF,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC;QACrC,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;AACtC,CAAC;AAED,kFAAkF;AAElF,SAAS,cAAc,CAAC,OAAiC,EAAE,KAAiB;IAC1E,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC,SAAS,CAAC;AAC1C,CAAC;AAgBD,SAAS,UAAU,CAAC,CAAc;IAChC,MAAM,YAAY,GAAG;QACnB,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS;QACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5C,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;QACvD,sBAAsB,EAAE,CAAC,CAAC,QAAQ;KACnC,CAAC;IAEF,MAAM,SAAS,GAAG,gBAAgB,CAAC,YAAY,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IAE9E,MAAM,IAAI,GAAG,EAAE,GAAG,YAAY,EAAE,SAAS,EAAE,CAAC;IAE5C,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACrD,OAAO;YACL,GAAG,IAAI;YACP,eAAe,EAAE,MAAM;YACvB,cAAc,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;YAC5D,eAAe,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,QAAQ,CAAC;SACtD,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAsB,CAAC;IAC3G,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAmB,CAAC;AACrG,CAAC"}

package/dist/sensitivity.d.ts

@@ -1,3 +0,0 @@
-import type { SensitivityTier, SensitivityResolverFn } from './types.js';
-export declare function createSensitivityResolver(map: Record<string, SensitivityTier>, override?: SensitivityResolverFn): SensitivityResolverFn;
-//# sourceMappingURL=sensitivity.d.ts.map

package/dist/sensitivity.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sensitivity.d.ts","sourceRoot":"","sources":["../src/sensitivity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEzE,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,EACpC,QAAQ,CAAC,EAAE,qBAAqB,GAC/B,qBAAqB,CAKvB"}

package/dist/sensitivity.js

@@ -1,8 +0,0 @@
-export function createSensitivityResolver(map, override) {
-    return (tool, identity, args) => {
-        if (override)
-            return override(tool, identity, args);
-        return map[tool] ?? 'high';
-    };
-}
-//# sourceMappingURL=sensitivity.js.map

package/dist/sensitivity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sensitivity.js","sourceRoot":"","sources":["../src/sensitivity.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,yBAAyB,CACvC,GAAoC,EACpC,QAAgC;IAEhC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QAC9B,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC;IAC7B,CAAC,CAAC;AACJ,CAAC"}

package/dist/signingKey.d.ts

@@ -1,3 +0,0 @@
-import type { SigningKeyProvider } from './types.js';
-export declare function createDefaultSigningKeyProvider(secret: Buffer | string): SigningKeyProvider;
-//# sourceMappingURL=signingKey.d.ts.map

package/dist/signingKey.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"signingKey.d.ts","sourceRoot":"","sources":["../src/signingKey.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,MAAM,GAAG,MAAM,GACtB,kBAAkB,CAWpB"}

package/dist/signingKey.js

@@ -1,13 +0,0 @@
-import { createHmac, createHash } from 'node:crypto';
-export function createDefaultSigningKeyProvider(secret) {
-    const secretBuf = typeof secret === 'string' ? Buffer.from(secret) : secret;
-    const keyId = createHash('sha256').update(secretBuf).digest('hex');
-    return {
-        algorithm: 'HMAC-SHA256',
-        keyId,
-        async sign(data) {
-            return createHmac('sha256', secretBuf).update(data).digest();
-        },
-    };
-}
-//# sourceMappingURL=signingKey.js.map

package/dist/signingKey.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"signingKey.js","sourceRoot":"","sources":["../src/signingKey.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGrD,MAAM,UAAU,+BAA+B,CAC7C,MAAuB;IAEvB,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5E,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEnE,OAAO;QACL,SAAS,EAAE,aAAa;QACxB,KAAK;QACL,KAAK,CAAC,IAAI,CAAC,IAAY;YACrB,OAAO,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QAC/D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -1,98 +0,0 @@
-import type { Identity, RejectionReason, ToolMiddleware } from 'mcpose';
-export type { ToolMiddleware };
-export type SensitivityTier = 'low' | 'medium' | 'high';
-export type SensitivityResolverFn = (tool: string, identity: Identity, args: Record<string, unknown>) => SensitivityTier;
-export type HashAlgorithm = 'SHA-256';
-export interface SigningKeyProvider {
-    sign(data: Buffer): Promise<Buffer>;
-    keyId: string;
-    algorithm: 'HMAC-SHA256';
-}
-export interface CostMetadata {
-    inputTokens?: number;
-    outputTokens?: number;
-    totalCostUsd?: number;
-}
-export interface AuditEventBase {
-    /** Equals the ProxyContext requestId. */
-    id: string;
-    timestamp: string;
-    sessionId?: string;
-    identity: Identity;
-    delegatedFrom?: Identity[];
-    tool: string;
-    duration_ms: number;
-    streamedChunkCount?: number;
-    outcome: 'success' | 'rejected' | 'error';
-    rejectionReason?: RejectionReason;
-    cost?: CostMetadata;
-    inputHash: string;
-    outputHash: string;
-    chainHash: string;
-    replayManifestPosition: number;
-}
-export type LowAuditEvent = AuditEventBase & {
-    sensitivityTier: 'low';
-    inputRaw: Record<string, unknown>;
-    outputRaw: unknown;
-};
-export type MediumAuditEvent = AuditEventBase & {
-    sensitivityTier: 'medium';
-    inputRaw: Record<string, unknown>;
-    outputRaw: unknown;
-};
-export type HighAuditEvent = AuditEventBase & {
-    sensitivityTier: 'high';
-    inputEncrypted: string;
-    outputEncrypted: string;
-};
-export type AuditEvent = LowAuditEvent | MediumAuditEvent | HighAuditEvent;
-export interface MerkleProof {
-    index: number;
-    siblings: string[];
-    directions: ('left' | 'right')[];
-}
-export interface ReplayManifest {
-    sessionId: string;
-    identity: Identity;
-    startedAt: string;
-    closedAt: string;
-    eventCount: number;
-    merkleRoot: string;
-    merkleProofs: MerkleProof[];
-    signedBy: string;
-    signature: string;
-}
-export interface AuditOptions {
-    signingKey: SigningKeyProvider;
-    hashAlgorithm?: HashAlgorithm;
-    sensitivityResolver: SensitivityResolverFn;
-    onEvent: (event: AuditEvent) => void | Promise<void>;
-    /**
-     * Called with the finished ReplayManifest when the host calls closeSession().
-     *
-     * Why this exists: ToolMiddleware is a pure per-request function with no
-     * lifecycle hooks. Sessions are owned by the HTTP transport, not by
-     * middleware. There is no in-band way for middleware to observe session close.
-     * This callback gives consumers a push-based way to receive the manifest
-     * exactly when the host signals the session has ended — mirroring how audit
-     * substrates in financial systems work: the host controls the flush boundary;
-     * the audit layer reacts.
-     */
-    onManifest?: (manifest: ReplayManifest) => void | Promise<void>;
-    /** @default true */
-    includeRejections?: boolean;
-    /** @default true */
-    includeCost?: boolean;
-}
-export interface AuditMiddlewareHandle {
-    middleware: ToolMiddleware;
-    /**
-     * Signal that a session has ended. Computes the Merkle tree over all audit
-     * events for the session, signs the root, fires onManifest, and returns the
-     * ReplayManifest. Returns undefined if the session had no events or is
-     * unknown.
-     */
-    closeSession(sessionId: string): Promise<ReplayManifest | undefined>;
-}
-//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AAExE,YAAY,EAAE,cAAc,EAAE,CAAC;AAI/B,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAExD,MAAM,MAAM,qBAAqB,GAAG,CAClC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,eAAe,CAAC;AAIrB,MAAM,MAAM,aAAa,GAAG,SAAS,CAAC;AAEtC,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,aAAa,CAAC;CAC1B;AAID,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAID,MAAM,WAAW,cAAc;IAC7B,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,QAAQ,CAAC;IACnB,aAAa,CAAC,EAAE,QAAQ,EAAE,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,EAAE,SAAS,GAAG,UAAU,GAAG,OAAO,CAAC;IAC1C,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,MAAM,aAAa,GAAG,cAAc,GAAG;IAC3C,eAAe,EAAE,KAAK,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG;IAC9C,eAAe,EAAE,QAAQ,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG;IAC5C,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,aAAa,GAAG,gBAAgB,GAAG,cAAc,CAAC;AAI3E,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,CAAC,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,kBAAkB,CAAC;IAC/B,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,mBAAmB,EAAE,qBAAqB,CAAC;IAC3C,OAAO,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,oBAAoB;IACpB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,oBAAoB;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,cAAc,CAAC;IAC3B;;;;;OAKG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;CACtE"}

package/dist/types.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}