@mcpose/audit 2.0.2 → 3.0.0

package/dist/middleware.js

@@ -0,0 +1,488 @@
+import { createCipheriv, randomBytes, createHmac } from 'node:crypto';
+import { canonicalJson, chainPreimageFields, computeChainHash, computeMerkleRootAndProofs, sha256hex, stableStringify, } from './chain.js';
+import { hasToolContent, markPassThroughObserver } from 'mcpose';
+// Domain-separation labels for subkey derivation. The version segment lets the
+// derivation scheme rotate without colliding with chains written under an old
+// scheme. v1 → v2: canonical-JSON preimages, signed full manifest,
+// domain-separated Merkle, per-position event keys, AEAD-bound ciphertexts.
+// See ADR-0003 and ADR-0004.
+const DOMAIN_CHAIN = Buffer.from('mcpose/v2/chain');
+const DOMAIN_ENC = Buffer.from('mcpose/v2/enc');
+const DOMAIN_MANIFEST = 'mcpose/v2/manifest';
+const DOMAIN_EVENT_KEY = 'mcpose/v2/eventkey\0';
+const DOMAIN_AAD = 'mcpose/v2/aad\0';
+// Erasable mode only (ADR-0018): keys the payload hashes so that destroying a
+// subject key destroys confirmability along with decryptability. A new label
+// for a new mechanism is additive within v2 — no existing label changes, and
+// no default-mode event is derived under it.
+const DOMAIN_HASH_KEY = 'mcpose/v2/hashkey';
+function aesEncrypt(plaintext, key, aad) {
+    if (key.length !== 32) {
+        throw new RangeError(`aesEncrypt: expected a 32-byte key, got ${key.length}`);
+    }
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', key, iv);
+    cipher.setAAD(Buffer.from(aad));
+    const encrypted = Buffer.concat([
+        cipher.update(plaintext, 'utf8'),
+        cipher.final(),
+    ]);
+    const tag = cipher.getAuthTag();
+    return Buffer.concat([iv, tag, encrypted]).toString('base64');
+}
+/**
+ * Per-event AES key. Bound to session + position + event id so no two
+ * events can share a key even if a host reuses a ProxyContext (and with it
+ * a requestId) across calls.
+ */
+function deriveEventKey(encRoot, sessionId, position, eventId) {
+    return createHmac('sha256', encRoot)
+        .update(`${DOMAIN_EVENT_KEY}${sessionId ?? ''}\0${position}\0${eventId}`)
+        .digest();
+}
+/**
+ * Payload hash for one event.
+ *
+ * Default mode: plain `sha256`, unchanged and unkeyed, so a replay verifier
+ * needs no key custody. Erasable mode: `HMAC-SHA256` under a subkey of the
+ * subject key, so an adversary holding a candidate payload cannot confirm it
+ * against an erased event's hash (ADR-0018). Both hash the same
+ * `stableStringify` bytes, so only the key changes.
+ */
+function payloadHash(value, hashSubkey) {
+    const serialized = stableStringify(value);
+    return hashSubkey === undefined
+        ? sha256hex(serialized)
+        : createHmac('sha256', hashSubkey).update(serialized).digest('hex');
+}
+function anonymousIdentity() {
+    return {
+        sub: 'anonymous',
+        type: 'service',
+        roles: [],
+        claims: {},
+        resolvedAt: new Date().toISOString(),
+        source: 'custom',
+    };
+}
+function getRejectionReason(err) {
+    const data = err?.data;
+    return typeof data?.rejectionReason === 'string'
+        ? data.rejectionReason
+        : undefined;
+}
+export function createAuditMiddleware(options) {
+    const sessions = new Map();
+    // Drained sessions awaiting signature or delivery, retried by closeSession.
+    const sealed = new Map();
+    const includeRejections = options.includeRejections ?? true;
+    const closeDrainTimeoutMs = options.closeDrainTimeoutMs ?? 30_000;
+    const reportAuditError = options.onAuditError ?? ((err) => console.error(err));
+    // A throwing reporter is outside the audited call path too (#172): it must
+    // not replace a tool result, mask an upstream error, or abort a drain.
+    const onAuditError = (err, info) => {
+        try {
+            reportAuditError(err, info);
+        }
+        catch {
+            // Nothing left to report it to.
+        }
+    };
+    // Private subkeys, derived once from the signing secret THROUGH the oracle with
+    // domain separation. The provider never exposes raw key bytes, and keyId must
+    // NOT be used as key material — keyId is a public identifier, published in
+    // ReplayManifest.signedBy. sign() is HMAC-SHA256 per the SigningKeyProvider
+    // contract, hence a PRF suitable for key derivation.
+    //   chainKey — keys the per-entry HMAC chain (forgery resistance)
+    //   encRoot  — root for per-event AES-256 keys (high-tier confidentiality)
+    // Cache the promise so concurrent first calls share one derivation; a failed
+    // derivation clears the cache so a transient provider error is retryable.
+    let subkeys;
+    const deriveSubkeys = () => {
+        subkeys ??= (async () => {
+            const [chainKey, encRoot] = await Promise.all([
+                options.signingKey.sign(DOMAIN_CHAIN),
+                options.signingKey.sign(DOMAIN_ENC),
+            ]);
+            return { chainKey, encRoot };
+        })();
+        subkeys.catch(() => {
+            subkeys = undefined;
+        });
+        return subkeys;
+    };
+    // One implementation for both audited surfaces. A tool call and a prompt
+    // fetch differ only in the event's `kind`: both requests carry a name and
+    // optional arguments, and both share the session chain, so duplicating the
+    // body would duplicate every invariant below with it (ADR-0014).
+    const observe = async (kind, req, next, ctx, isInBandError) => {
+        // The proxy identity is a required covered field (ADR-0019), so a context
+        // without one cannot produce a verifiable event. That is a configuration
+        // error rather than a runtime condition: core has stamped `ctx.proxy` on
+        // every ProxyContext since 3.0.0, so reaching here without it means a host
+        // invoked this middleware with a hand-built context.
+        //
+        // Handled here, at the pre-call stage alongside subkey derivation, which is
+        // the one failure point allowed to fail the call. Throwing after the call
+        // would mask the tool result, and substituting a sentinel identity would
+        // write a trail that looks attributed and is not, which is the failure
+        // #85 and #122 exist to prevent.
+        const proxy = ctx.proxy;
+        if (proxy === undefined) {
+            throw new Error('mcpose/audit: ctx.proxy is required, because the proxy identity is a covered field of every audit event. mcpose core stamps it on every ProxyContext; a host invoking this middleware with its own context must supply it.');
+        }
+        const identity = ctx.identity ?? anonymousIdentity();
+        const sessionId = ctx.sessionId;
+        const tool = req.params.name;
+        const args = req.params.arguments ?? {};
+        if (sessionId && !sessions.has(sessionId)) {
+            // First-seen wins: the manifest records the proxy identity of the
+            // request that opened the session, and each event still records its own.
+            // No backfill branch is needed now that `proxy` is always present.
+            sessions.set(sessionId, {
+                events: [],
+                prevChainHash: '',
+                startedAt: new Date().toISOString(),
+                identity,
+                proxy,
+                inflight: new Map(),
+            });
+        }
+        // Admission (#168): registered synchronously, before the first await of
+        // this function, and captured once. From here until the `finally` below
+        // the call counts as in flight: `closeSession` drains that set before it
+        // seals, so the session cannot vanish under a call that is still deriving
+        // keys, awaiting the upstream, or persisting its event. Re-resolving the
+        // id after an await is what produced position-0 orphans with no manifest.
+        const session = sessionId ? sessions.get(sessionId) : undefined;
+        const admission = Symbol(tool);
+        session?.inflight.set(admission, { tool, requestId: ctx.requestId });
+        try {
+            // Subkey derivation runs BEFORE the upstream call: if the signing
+            // provider is unavailable the call fails fast rather than running
+            // unaudited.
+            const { chainKey, encRoot } = await deriveSubkeys();
+            // Erasable mode (ADR-0018). Fetched at the pre-call stage alongside subkey
+            // derivation, for the same reason: without the subject key there is no way
+            // to record this event, so the call fails fast rather than running
+            // unaudited. Nothing is cached across calls — `destroy` must take effect
+            // immediately, and a subject that calls again after erasure gets a fresh
+            // key from the store rather than a stale one from here. A rejected fetch
+            // therefore leaves no poisoned state and the next call retries.
+            //
+            // The subject is the RESOLVED identity's `sub`, so anonymous events all
+            // land in the `anonymousIdentity()` bucket, which is the designated
+            // single bucket the ADR calls for.
+            // Written as a ternary rather than `await options.keyStore?.…` so default
+            // mode does not even take the extra microtask tick an `await undefined`
+            // would cost it.
+            const subjectKey = options.keyStore
+                ? await options.keyStore.getOrCreate(identity.sub)
+                : undefined;
+            const startedAt = new Date().toISOString();
+            const start = performance.now();
+            let result;
+            let thrown;
+            let threw = false;
+            try {
+                result = await next(req);
+            }
+            catch (err) {
+                thrown = err;
+                threw = true;
+            }
+            // Post-call audit section. Two invariants:
+            // 1. Atomic append — no `await` between reading the position and
+            //    pushing the event, so concurrent calls in one session cannot
+            //    allocate duplicate positions (buildEvent is fully synchronous).
+            // 2. Never throws — an audit failure is reported via onAuditError and
+            //    must not fail (or mask the failure of) the audited call itself.
+            try {
+                const rejectionReason = threw ? getRejectionReason(thrown) : undefined;
+                // A call can fail without throwing: an MCP tool reports failure
+                // in-band with `isError: true` (#171). The caller supplies the
+                // predicate, so only tool calls pass one and prompts never match.
+                const inBandError = !threw && isInBandError?.(result) === true;
+                const outcome = rejectionReason !== undefined
+                    ? 'rejected'
+                    : threw || inBandError
+                        ? 'error'
+                        : 'success';
+                if (outcome !== 'rejected' || includeRejections) {
+                    let tier;
+                    try {
+                        tier = options.sensitivityResolver(tool, identity, args);
+                    }
+                    catch (err) {
+                        onAuditError(err, {
+                            tool,
+                            requestId: ctx.requestId,
+                            ...(sessionId === undefined ? {} : { sessionId }),
+                        });
+                        tier = 'high';
+                    }
+                    const position = session?.events.length ?? 0;
+                    const event = buildEvent({
+                        ctx,
+                        identity,
+                        proxy,
+                        kind,
+                        tool,
+                        args,
+                        result: threw ? undefined : result,
+                        startedAt,
+                        endedAt: new Date().toISOString(),
+                        duration_ms: Math.round(performance.now() - start),
+                        outcome,
+                        rejectionReason,
+                        error: outcome !== 'error'
+                            ? undefined
+                            : threw
+                                ? {
+                                    name: thrown instanceof Error ? thrown.name : 'Error',
+                                    message: thrown instanceof Error
+                                        ? thrown.message
+                                        : String(thrown),
+                                }
+                                : // A fixed message: `error` is never encrypted, so copying the
+                                    // tool's own text here would leak a high-tier payload.
+                                    {
+                                        name: 'ToolError',
+                                        message: 'Tool result returned isError: true',
+                                    },
+                        position,
+                        prevChainHash: session?.prevChainHash ?? '',
+                        tier,
+                        chainKey,
+                        encRoot,
+                        subjectKey,
+                    });
+                    if (session) {
+                        session.events.push(event);
+                        session.prevChainHash = event.chainHash;
+                    }
+                    await options.onEvent(event);
+                }
+            }
+            catch (err) {
+                onAuditError(err, {
+                    tool,
+                    requestId: ctx.requestId,
+                    ...(sessionId === undefined ? {} : { sessionId }),
+                });
+            }
+            if (threw)
+                throw thrown;
+            return result;
+        }
+        finally {
+            // Settle after the event is appended and `onEvent` has settled, so a
+            // draining close also waits for pending persistence. A pre-call failure
+            // lands here too, so a rejected key fetch never leaves the session
+            // looking busy.
+            if (session) {
+                session.inflight.delete(admission);
+                if (session.inflight.size === 0)
+                    session.onDrained?.();
+            }
+        }
+    };
+    // Tool calls: wrapped so `passThroughTools` stay audited. Prompts have no
+    // pass-through concept, so the prompt middleware needs no wrapper.
+    const inner = (req, next, ctx) => observe(undefined, req, next, ctx, (result) => hasToolContent(result) && result.isError === true);
+    const middleware = markPassThroughObserver(inner);
+    const promptMiddleware = (req, next, ctx) => observe('prompt', req, next, ctx);
+    const closeSession = (sessionId) => {
+        const session = sessions.get(sessionId);
+        if (session) {
+            // A close already in progress is the close: joining it is what keeps a
+            // DELETE that races a TTL expiry from signing two manifests.
+            session.closing ??= sealSession(sessionId, session);
+            return session.closing;
+        }
+        // Sealed but undelivered: a signer or sink failed on an earlier close.
+        // Retry from where it stopped instead of reporting the session unknown.
+        const pending = sealed.get(sessionId);
+        if (pending)
+            return finalize(sessionId, pending);
+        return Promise.resolve(undefined);
+    };
+    const sealSession = async (sessionId, session) => {
+        // Drain: every admitted call appends its event before it settles, so the
+        // manifest sealed below covers them all with continuous positions. The
+        // loop re-checks because a call can be admitted while one drain waits.
+        // Bounded, because a handler or sink that never settles must not hold
+        // the session's already-recorded events unsigned forever: past the
+        // deadline the manifest seals what it has and each straggler is reported.
+        const deadline = performance.now() + closeDrainTimeoutMs;
+        while (session.inflight.size > 0) {
+            const remaining = deadline - performance.now();
+            if (remaining <= 0) {
+                for (const { tool, requestId } of session.inflight.values()) {
+                    onAuditError(new Error(`mcpose/audit: closeSession(${sessionId}) sealed after ${closeDrainTimeoutMs} ms with this call still in flight; its event is not in the manifest`), { tool, requestId, sessionId });
+                }
+                break;
+            }
+            await new Promise((resolve) => {
+                const timer = Number.isFinite(remaining)
+                    ? setTimeout(resolve, remaining)
+                    : undefined;
+                session.onDrained = () => {
+                    if (timer !== undefined)
+                        clearTimeout(timer);
+                    resolve();
+                };
+            });
+        }
+        delete session.onDrained;
+        // Sealed: the session leaves the admission map here, so no later call can
+        // append to a manifest that is already being signed. What follows can
+        // still fail, so the sealed state is kept until delivery succeeds (#169).
+        sessions.delete(sessionId);
+        if (session.events.length === 0)
+            return undefined;
+        const hashes = session.events.map((e) => e.chainHash);
+        const { merkleRoot, merkleProofs } = computeMerkleRootAndProofs(hashes);
+        // The signature covers the ENTIRE manifest (domain-separated, canonical
+        // serialization) — signing only the Merkle root would leave sessionId,
+        // identity, eventCount, and the proofs swappable after the fact.
+        const unsigned = {
+            sessionId,
+            identity: session.identity,
+            proxy: session.proxy,
+            startedAt: session.startedAt,
+            closedAt: new Date().toISOString(),
+            eventCount: session.events.length,
+            merkleRoot,
+            merkleProofs,
+            signedBy: options.signingKey.keyId,
+        };
+        const previous = sealed.get(sessionId);
+        if (previous) {
+            // The id was reused before the earlier session's manifest was delivered.
+            // The host had every chance to retry; keeping the newer one is the only
+            // choice that does not lose the session that is closing now.
+            onAuditError(new Error(`mcpose/audit: closeSession(${sessionId}) replaced an undelivered manifest for an earlier session with the same id`), { tool: '', requestId: '', sessionId });
+        }
+        const pending = { unsigned };
+        sealed.set(sessionId, pending);
+        return finalize(sessionId, pending);
+    };
+    /**
+     * Signs and delivers a sealed manifest. Each step is memoized on the sealed
+     * state, so a retry after a transient signer failure signs the same payload
+     * (same `closedAt`, so the same bytes) and a retry after a sink failure
+     * re-delivers the identical signed manifest rather than minting a second
+     * one. Concurrent retries share one attempt.
+     */
+    const finalize = (sessionId, pending) => {
+        pending.attempt ??= (async () => {
+            try {
+                if (pending.signature === undefined) {
+                    const payload = canonicalJson({
+                        domain: DOMAIN_MANIFEST,
+                        manifest: pending.unsigned,
+                    });
+                    pending.signature = (await options.signingKey.sign(Buffer.from(payload))).toString('hex');
+                }
+                const manifest = {
+                    ...pending.unsigned,
+                    signature: pending.signature,
+                };
+                await options.onManifest?.(manifest);
+                sealed.delete(sessionId);
+                return manifest;
+            }
+            finally {
+                delete pending.attempt;
+            }
+        })();
+        return pending.attempt;
+    };
+    return { middleware, promptMiddleware, closeSession };
+}
+/** Rebuilds the exact signed payload for a manifest (used by verifiers). */
+export function manifestSigningPayload(manifest) {
+    const { sessionId, identity, proxy, startedAt, closedAt, eventCount, merkleRoot, merkleProofs, signedBy, } = manifest;
+    return canonicalJson({
+        domain: DOMAIN_MANIFEST,
+        manifest: {
+            sessionId,
+            identity,
+            // Required covered field, included unconditionally (ADR-0019). Under
+            // the omission pattern a manifest with `proxy` stripped rebuilt the
+            // same payload as one that never had it, so the signature could not
+            // detect the removal.
+            proxy,
+            startedAt,
+            closedAt,
+            eventCount,
+            merkleRoot,
+            merkleProofs,
+            signedBy,
+        },
+    });
+}
+/** Fully synchronous — position allocation relies on that (no await between read and append). */
+function buildEvent(p) {
+    // Fail CLOSED: only explicit low/medium get plaintext; any other tier
+    // value — including garbage from a user-supplied resolver — encrypts.
+    // Decided before the preimage is built, because the tier is a covered
+    // field and must be the one the event actually ships with (ADR-0015).
+    const sensitivityTier = p.tier === 'low' || p.tier === 'medium' ? p.tier : 'high';
+    // Erasable mode: one subkey off the subject key keys both payload hashes.
+    // Derived per event rather than held anywhere, so it dies with the subject
+    // key it came from (ADR-0018).
+    const hashSubkey = p.subjectKey === undefined
+        ? undefined
+        : createHmac('sha256', p.subjectKey).update(DOMAIN_HASH_KEY).digest();
+    const withoutChainHash = {
+        id: p.ctx.requestId,
+        startedAt: p.startedAt,
+        endedAt: p.endedAt,
+        ...(p.ctx.sessionId !== undefined ? { sessionId: p.ctx.sessionId } : {}),
+        ...(p.ctx.delegatedFrom !== undefined
+            ? { delegatedFrom: p.ctx.delegatedFrom }
+            : {}),
+        proxy: p.proxy,
+        ...(p.kind !== undefined ? { kind: p.kind } : {}),
+        // Optional covered field under the ADR-0012 omission rule, exactly as
+        // `kind` is: default-mode events do not carry the key at all, so their
+        // preimage is unchanged (ADR-0018).
+        ...(p.subjectKey !== undefined ? { erasable: true } : {}),
+        identity: p.identity,
+        tool: p.tool,
+        duration_ms: p.duration_ms,
+        outcome: p.outcome,
+        sensitivityTier,
+        ...(p.rejectionReason !== undefined
+            ? { rejectionReason: p.rejectionReason }
+            : {}),
+        ...(p.error !== undefined ? { error: p.error } : {}),
+        inputHash: payloadHash(p.args, hashSubkey),
+        outputHash: payloadHash(p.result ?? null, hashSubkey),
+        replayManifestPosition: p.position,
+    };
+    const chainHash = computeChainHash(chainPreimageFields(withoutChainHash), p.prevChainHash, p.chainKey);
+    const base = { ...withoutChainHash, chainHash };
+    if (sensitivityTier !== 'high') {
+        return {
+            ...base,
+            sensitivityTier,
+            inputRaw: p.args,
+            outputRaw: p.result,
+        };
+    }
+    // Erasable mode swaps the ROOT and nothing else: same label, same session,
+    // position and event-id inputs, same AES-256-GCM layout and AAD. Only the
+    // key's provenance changes, from the pure-derived `encRoot` to the stored,
+    // destroyable subject key (ADR-0018).
+    const eventKey = deriveEventKey(p.subjectKey ?? p.encRoot, p.ctx.sessionId, p.position, base.id);
+    return {
+        ...base,
+        sensitivityTier: 'high',
+        inputEncrypted: aesEncrypt(stableStringify(p.args), eventKey, `${DOMAIN_AAD}${base.id}\0input`),
+        outputEncrypted: aesEncrypt(stableStringify(p.result ?? null), eventKey, `${DOMAIN_AAD}${base.id}\0output`),
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAQtE,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,0BAA0B,EAC1B,SAAS,EACT,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,QAAQ,CAAC;AAiBjE,+EAA+E;AAC/E,8EAA8E;AAC9E,mEAAmE;AACnE,4EAA4E;AAC5E,6BAA6B;AAC7B,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;AACpD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AAChD,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAC7C,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAChD,MAAM,UAAU,GAAG,iBAAiB,CAAC;AACrC,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,6CAA6C;AAC7C,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAuC5C,SAAS,UAAU,CAAC,SAAiB,EAAE,GAAW,EAAE,GAAW;IAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,UAAU,CAClB,2CAA2C,GAAG,CAAC,MAAM,EAAE,CACxD,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;QAChC,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CACrB,OAAe,EACf,SAA6B,EAC7B,QAAgB,EAChB,OAAe;IAEf,OAAO,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC;SACjC,MAAM,CAAC,GAAG,gBAAgB,GAAG,SAAS,IAAI,EAAE,KAAK,QAAQ,KAAK,OAAO,EAAE,CAAC;SACxE,MAAM,EAAE,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,KAAc,EAAE,UAA8B;IACjE,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAC1C,OAAO,UAAU,KAAK,SAAS;QAC7B,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC;QACvB,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO;QACL,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,EAAE;QACV,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,MAAM,EAAE,QAAQ;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY;IACtC,MAAM,IAAI,GAAI,GAAuD,EAAE,IAAI,CAAC;IAC5E,OAAO,OAAO,IAAI,EAAE,eAAe,KAAK,QAAQ;QAC9C,CAAC,CAAE,IAAI,CAAC,eAAmC;QAC3C,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAqB;IAErB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IACjD,4EAA4E;IAC5E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAChD,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC;IAC5D,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,MAAM,CAAC;IAClE,MAAM,gBAAgB,GACpB,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,YAAY,GAA8C,CAC9D,GAAG,EACH,IAAI,EACJ,EAAE;QACF,IAAI,CAAC;YACH,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;IACH,CAAC,CAAC;IAEF,gFAAgF;IAChF,8EAA8E;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,qDAAqD;IACrD,kEAAkE;IAClE,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,IAAI,OAAmE,CAAC;IACxE,MAAM,aAAa,GAAG,GAAG,EAAE;QACzB,OAAO,KAAK,CAAC,KAAK,IAAI,EAAE;YACtB,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC5C,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;gBACrC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;aACpC,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAC/B,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;YACjB,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,OAAO,GAAG,KAAK,EACnB,IAA0B,EAC1B,GAAQ,EACR,IAAgC,EAChC,GAAiB,EACjB,aAAwC,EAC1B,EAAE;QAChB,0EAA0E;QAC1E,yEAAyE;QACzE,yEAAyE;QACzE,2EAA2E;QAC3E,qDAAqD;QACrD,EAAE;QACF,4EAA4E;QAC5E,0EAA0E;QAC1E,yEAAyE;QACzE,uEAAuE;QACvE,iCAAiC;QACjC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,4NAA4N,CAC7N,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,iBAAiB,EAAE,CAAC;QACrD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;QAChC,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAC7B,MAAM,IAAI,GAAI,GAAG,CAAC,MAAM,CAAC,SAAqC,IAAI,EAAE,CAAC;QAErE,IAAI,SAAS,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,kEAAkE;YAClE,yEAAyE;YACzE,mEAAmE;YACnE,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE;gBACtB,MAAM,EAAE,EAAE;gBACV,aAAa,EAAE,EAAE;gBACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,QAAQ;gBACR,KAAK;gBACL,QAAQ,EAAE,IAAI,GAAG,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QACD,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;QAErE,IAAI,CAAC;YACH,kEAAkE;YAClE,kEAAkE;YAClE,aAAa;YACb,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,EAAE,CAAC;YACpD,2EAA2E;YAC3E,2EAA2E;YAC3E,mEAAmE;YACnE,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,gEAAgE;YAChE,EAAE;YACF,wEAAwE;YACxE,oEAAoE;YACpE,mCAAmC;YACnC,0EAA0E;YAC1E,wEAAwE;YACxE,iBAAiB;YACjB,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ;gBACjC,CAAC,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAClD,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAEhC,IAAI,MAAe,CAAC;YACpB,IAAI,MAAe,CAAC;YACpB,IAAI,KAAK,GAAG,KAAK,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,CAAC;gBACb,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;YAED,2CAA2C;YAC3C,iEAAiE;YACjE,kEAAkE;YAClE,qEAAqE;YACrE,sEAAsE;YACtE,qEAAqE;YACrE,IAAI,CAAC;gBACH,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACvE,gEAAgE;gBAChE,+DAA+D;gBAC/D,kEAAkE;gBAClE,MAAM,WAAW,GAAG,CAAC,KAAK,IAAI,aAAa,EAAE,CAAC,MAAa,CAAC,KAAK,IAAI,CAAC;gBACtE,MAAM,OAAO,GACX,eAAe,KAAK,SAAS;oBAC3B,CAAC,CAAC,UAAU;oBACZ,CAAC,CAAC,KAAK,IAAI,WAAW;wBACpB,CAAC,CAAC,OAAO;wBACT,CAAC,CAAC,SAAS,CAAC;gBAElB,IAAI,OAAO,KAAK,UAAU,IAAI,iBAAiB,EAAE,CAAC;oBAChD,IAAI,IAAqB,CAAC;oBAC1B,IAAI,CAAC;wBACH,IAAI,GAAG,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;oBAC3D,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,YAAY,CAAC,GAAG,EAAE;4BAChB,IAAI;4BACJ,SAAS,EAAE,GAAG,CAAC,SAAS;4BACxB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;yBAClD,CAAC,CAAC;wBACH,IAAI,GAAG,MAAM,CAAC;oBAChB,CAAC;oBAED,MAAM,QAAQ,GAAG,OAAO,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;oBAC7C,MAAM,KAAK,GAAG,UAAU,CAAC;wBACvB,GAAG;wBACH,QAAQ;wBACR,KAAK;wBACL,IAAI;wBACJ,IAAI;wBACJ,IAAI;wBACJ,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;wBAClC,SAAS;wBACT,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACjC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;wBAClD,OAAO;wBACP,eAAe;wBACf,KAAK,EACH,OAAO,KAAK,OAAO;4BACjB,CAAC,CAAC,SAAS;4BACX,CAAC,CAAC,KAAK;gCACL,CAAC,CAAC;oCACE,IAAI,EAAE,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;oCACrD,OAAO,EACL,MAAM,YAAY,KAAK;wCACrB,CAAC,CAAC,MAAM,CAAC,OAAO;wCAChB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;iCACrB;gCACH,CAAC,CAAC,8DAA8D;oCAC9D,uDAAuD;oCACvD;wCACE,IAAI,EAAE,WAAW;wCACjB,OAAO,EAAE,oCAAoC;qCAC9C;wBACT,QAAQ;wBACR,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,EAAE;wBAC3C,IAAI;wBACJ,QAAQ;wBACR,OAAO;wBACP,UAAU;qBACX,CAAC,CAAC;oBACH,IAAI,OAAO,EAAE,CAAC;wBACZ,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBAC3B,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC,SAAS,CAAC;oBAC1C,CAAC;oBACD,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,YAAY,CAAC,GAAG,EAAE;oBAChB,IAAI;oBACJ,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;iBAClD,CAAC,CAAC;YACL,CAAC;YAED,IAAI,KAAK;gBAAE,MAAM,MAAM,CAAC;YACxB,OAAO,MAA0C,CAAC;QACpD,CAAC;gBAAS,CAAC;YACT,qEAAqE;YACrE,wEAAwE;YACxE,mEAAmE;YACnE,gBAAgB;YAChB,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACnC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;oBAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,0EAA0E;IAC1E,mEAAmE;IACnE,MAAM,KAAK,GAAwC,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CACpE,OAAO,CACL,SAAS,EACT,GAAG,EACH,IAAI,EACJ,GAAG,EACH,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAC9D,CAAC;IACJ,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,gBAAgB,GAA8C,CAClE,GAAG,EACH,IAAI,EACJ,GAAG,EACH,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAEvC,MAAM,YAAY,GAA0C,CAAC,SAAS,EAAE,EAAE;QACxE,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,OAAO,EAAE,CAAC;YACZ,uEAAuE;YACvE,6DAA6D;YAC7D,OAAO,CAAC,OAAO,KAAK,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACpD,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;QACD,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,OAAO;YAAE,OAAO,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACjD,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,KAAK,EACvB,SAAiB,EACjB,OAAqB,EACgB,EAAE;QACvC,yEAAyE;QACzE,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,mEAAmE;QACnE,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,mBAAmB,CAAC;QACzD,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAC/C,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;gBACnB,KAAK,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;oBAC5D,YAAY,CACV,IAAI,KAAK,CACP,8BAA8B,SAAS,kBAAkB,mBAAmB,sEAAsE,CACnJ,EACD,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAC/B,CAAC;gBACJ,CAAC;gBACD,MAAM;YACR,CAAC;YACD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAClC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;oBACtC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC;oBAChC,CAAC,CAAC,SAAS,CAAC;gBACd,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE;oBACvB,IAAI,KAAK,KAAK,SAAS;wBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;oBAC7C,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC,SAAS,CAAC;QACzB,0EAA0E;QAC1E,sEAAsE;QACtE,0EAA0E;QAC1E,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3B,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAElD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;QAExE,wEAAwE;QACxE,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,QAAQ,GAAsC;YAClD,SAAS;YACT,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;YACjC,UAAU;YACV,YAAY;YACZ,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK;SACnC,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,yEAAyE;YACzE,wEAAwE;YACxE,6DAA6D;YAC7D,YAAY,CACV,IAAI,KAAK,CACP,8BAA8B,SAAS,4EAA4E,CACpH,EACD,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,CACvC,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAkB,EAAE,QAAQ,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC/B,OAAO,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC,CAAC;IAEF;;;;;;OAMG;IACH,MAAM,QAAQ,GAAG,CACf,SAAiB,EACjB,OAAsB,EACG,EAAE;QAC3B,OAAO,CAAC,OAAO,KAAK,CAAC,KAAK,IAAI,EAAE;YAC9B,IAAI,CAAC;gBACH,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;oBACpC,MAAM,OAAO,GAAG,aAAa,CAAC;wBAC5B,MAAM,EAAE,eAAe;wBACvB,QAAQ,EAAE,OAAO,CAAC,QAAQ;qBAC3B,CAAC,CAAC;oBACH,OAAO,CAAC,SAAS,GAAG,CAClB,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CACpD,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACpB,CAAC;gBACD,MAAM,QAAQ,GAAmB;oBAC/B,GAAG,OAAO,CAAC,QAAQ;oBACnB,SAAS,EAAE,OAAO,CAAC,SAAS;iBAC7B,CAAC;gBACF,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC;gBACrC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACzB,OAAO,QAAQ,CAAC;YAClB,CAAC;oBAAS,CAAC;gBACT,OAAO,OAAO,CAAC,OAAO,CAAC;YACzB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,OAAO,CAAC,OAAO,CAAC;IACzB,CAAC,CAAC;IAEF,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,YAAY,EAAE,CAAC;AACxD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,sBAAsB,CACpC,QAA2C;IAE3C,MAAM,EACJ,SAAS,EACT,QAAQ,EACR,KAAK,EACL,SAAS,EACT,QAAQ,EACR,UAAU,EACV,UAAU,EACV,YAAY,EACZ,QAAQ,GACT,GAAG,QAAQ,CAAC;IACb,OAAO,aAAa,CAAC;QACnB,MAAM,EAAE,eAAe;QACvB,QAAQ,EAAE;YACR,SAAS;YACT,QAAQ;YACR,qEAAqE;YACrE,oEAAoE;YACpE,oEAAoE;YACpE,sBAAsB;YACtB,KAAK;YACL,SAAS;YACT,QAAQ;YACR,UAAU;YACV,UAAU;YACV,YAAY;YACZ,QAAQ;SACT;KACF,CAAC,CAAC;AACL,CAAC;AAoCD,iGAAiG;AACjG,SAAS,UAAU,CAAC,CAAc;IAChC,sEAAsE;IACtE,sEAAsE;IACtE,sEAAsE;IACtE,sEAAsE;IACtE,MAAM,eAAe,GACnB,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IAE5D,0EAA0E;IAC1E,2EAA2E;IAC3E,+BAA+B;IAC/B,MAAM,UAAU,GACd,CAAC,CAAC,UAAU,KAAK,SAAS;QACxB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,EAAE,CAAC;IAE1E,MAAM,gBAAgB,GAAG;QACvB,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS;QACnB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE;YACxC,CAAC,CAAC,EAAE,CAAC;QACP,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,sEAAsE;QACtE,uEAAuE;QACvE,oCAAoC;QACpC,GAAG,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,eAAe;QACf,GAAG,CAAC,CAAC,CAAC,eAAe,KAAK,SAAS;YACjC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE;YACxC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC;QAC1C,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,UAAU,CAAC;QACrD,sBAAsB,EAAE,CAAC,CAAC,QAAQ;KACnC,CAAC;IAEF,MAAM,SAAS,GAAG,gBAAgB,CAChC,mBAAmB,CAAC,gBAAiD,CAAC,EACtE,CAAC,CAAC,aAAa,EACf,CAAC,CAAC,QAAQ,CACX,CAAC;IAEF,MAAM,IAAI,GAAG,EAAE,GAAG,gBAAgB,EAAE,SAAS,EAAE,CAAC;IAEhD,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;QAC/B,OAAO;YACL,GAAG,IAAI;YACP,eAAe;YACf,QAAQ,EAAE,CAAC,CAAC,IAAI;YAChB,SAAS,EAAE,CAAC,CAAC,MAAM;SACpB,CAAC;IACJ,CAAC;IACD,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,sCAAsC;IACtC,MAAM,QAAQ,GAAG,cAAc,CAC7B,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,EACzB,CAAC,CAAC,GAAG,CAAC,SAAS,EACf,CAAC,CAAC,QAAQ,EACV,IAAI,CAAC,EAAE,CACR,CAAC;IACF,OAAO;QACL,GAAG,IAAI;QACP,eAAe,EAAE,MAAM;QACvB,cAAc,EAAE,UAAU,CACxB,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,EACvB,QAAQ,EACR,GAAG,UAAU,GAAG,IAAI,CAAC,EAAE,SAAS,CACjC;QACD,eAAe,EAAE,UAAU,CACzB,eAAe,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,EACjC,QAAQ,EACR,GAAG,UAAU,GAAG,IAAI,CAAC,EAAE,UAAU,CAClC;KACF,CAAC;AACJ,CAAC"}

package/dist/sensitivity.d.ts

@@ -0,0 +1,12 @@
+import type { SensitivityTier, SensitivityResolverFn, SensitivityOverrideFn } from './types.js';
+/**
+ * Builds a resolver from a static tool→tier map, with an optional dynamic
+ * override that receives the map's resolution as its fourth argument.
+ *
+ * Unknown tools resolve to `'high'` (encrypt by default). The lookup uses
+ * `Object.hasOwn`, so prototype-inherited keys (a tool named `toString` or
+ * `constructor` — tool names are attacker-controlled) cannot bypass that
+ * default.
+ */
+export declare function createSensitivityResolver(map: Record<string, SensitivityTier>, override?: SensitivityOverrideFn): SensitivityResolverFn;
+//# sourceMappingURL=sensitivity.d.ts.map

package/dist/sensitivity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitivity.d.ts","sourceRoot":"","sources":["../src/sensitivity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,YAAY,CAAC;AAUpB;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,EACpC,QAAQ,CAAC,EAAE,qBAAqB,GAC/B,qBAAqB,CAMvB"}

package/dist/sensitivity.js

@@ -0,0 +1,24 @@
+const TIERS = new Set(['low', 'medium', 'high']);
+function validTier(value) {
+    // Fail CLOSED: anything that is not a known tier resolves to 'high'
+    // (encrypt). Guards against typos in the map and misbehaving overrides.
+    return TIERS.has(value) ? value : 'high';
+}
+/**
+ * Builds a resolver from a static tool→tier map, with an optional dynamic
+ * override that receives the map's resolution as its fourth argument.
+ *
+ * Unknown tools resolve to `'high'` (encrypt by default). The lookup uses
+ * `Object.hasOwn`, so prototype-inherited keys (a tool named `toString` or
+ * `constructor` — tool names are attacker-controlled) cannot bypass that
+ * default.
+ */
+export function createSensitivityResolver(map, override) {
+    return (tool, identity, args) => {
+        const mapTier = validTier(Object.hasOwn(map, tool) ? map[tool] : undefined);
+        if (override)
+            return validTier(override(tool, identity, args, mapTier));
+        return mapTier;
+    };
+}
+//# sourceMappingURL=sensitivity.js.map

package/dist/sensitivity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitivity.js","sourceRoot":"","sources":["../src/sensitivity.ts"],"names":[],"mappings":"AAMA,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAEtE,SAAS,SAAS,CAAC,KAAc;IAC/B,oEAAoE;IACpE,wEAAwE;IACxE,OAAO,KAAK,CAAC,GAAG,CAAC,KAAe,CAAC,CAAC,CAAC,CAAE,KAAyB,CAAC,CAAC,CAAC,MAAM,CAAC;AAC1E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAoC,EACpC,QAAgC;IAEhC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5E,IAAI,QAAQ;YAAE,OAAO,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACxE,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC"}

package/dist/signingKey.d.ts

@@ -0,0 +1,11 @@
+import type { SigningKeyProvider } from './types.js';
+/**
+ * In-process HMAC-SHA256 signing provider.
+ *
+ * The secret must be high-entropy (>= 32 random bytes). `keyId` is PUBLIC —
+ * it is published in every ReplayManifest — so it must never be used as key
+ * material (ADR-0003), and a guessable secret is offline-attackable from
+ * any published manifest.
+ */
+export declare function createDefaultSigningKeyProvider(secret: Buffer | string): SigningKeyProvider;
+//# sourceMappingURL=signingKey.d.ts.map

package/dist/signingKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signingKey.d.ts","sourceRoot":"","sources":["../src/signingKey.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AASrD;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,MAAM,GAAG,MAAM,GACtB,kBAAkB,CAcpB"}

package/dist/signingKey.js

@@ -0,0 +1,30 @@
+import { createHmac } from 'node:crypto';
+// keyId derivation label. v1 used bare SHA256(secret), which let anyone
+// holding a manifest brute-force a low-entropy secret offline from the
+// published keyId. HMAC with a domain label is not invertible into a
+// dictionary check any faster than attacking the signature itself, and
+// keeps keyId stable per secret. See ADR-0004.
+const DOMAIN_KEYID = 'mcpose/v2/keyid';
+/**
+ * In-process HMAC-SHA256 signing provider.
+ *
+ * The secret must be high-entropy (>= 32 random bytes). `keyId` is PUBLIC —
+ * it is published in every ReplayManifest — so it must never be used as key
+ * material (ADR-0003), and a guessable secret is offline-attackable from
+ * any published manifest.
+ */
+export function createDefaultSigningKeyProvider(secret) {
+    // The secret is handed to createHmac as given. Normalizing a string to a
+    // Buffer first was a no-op: createHmac encodes a string key as utf8, byte
+    // for byte what Buffer.from produces, so no input could tell the two
+    // apart. The equivalence is pinned by a test (#110).
+    const keyId = createHmac('sha256', secret).update(DOMAIN_KEYID).digest('hex');
+    return {
+        algorithm: 'HMAC-SHA256',
+        keyId,
+        async sign(data) {
+            return createHmac('sha256', secret).update(data).digest();
+        },
+    };
+}
+//# sourceMappingURL=signingKey.js.map

package/dist/signingKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signingKey.js","sourceRoot":"","sources":["../src/signingKey.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,wEAAwE;AACxE,uEAAuE;AACvE,qEAAqE;AACrE,uEAAuE;AACvE,+CAA+C;AAC/C,MAAM,YAAY,GAAG,iBAAiB,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,UAAU,+BAA+B,CAC7C,MAAuB;IAEvB,yEAAyE;IACzE,0EAA0E;IAC1E,qEAAqE;IACrE,qDAAqD;IACrD,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE9E,OAAO;QACL,SAAS,EAAE,aAAa;QACxB,KAAK;QACL,KAAK,CAAC,IAAI,CAAC,IAAY;YACrB,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QAC5D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/subjectKeyStore.d.ts

@@ -0,0 +1,17 @@
+import type { SubjectKeyStore } from './types.js';
+/**
+ * Reference {@link SubjectKeyStore}, backed by a `Map` in this process.
+ *
+ * NOT DURABLE, and not for production. The keys live only in this process's
+ * heap, so a restart erases every subject at once and a second proxy instance
+ * cannot decrypt what the first recorded. Both are silent failures: the chain
+ * still verifies, and the loss shows up only when someone tries to read a
+ * payload back.
+ *
+ * A real deployment needs a durable, access-controlled store — a KMS, an HSM,
+ * or an encrypted table whose read path is audited — because in erasable mode
+ * this store IS the confidentiality of every high-tier payload it holds a key
+ * for (ADR-0018).
+ */
+export declare function createInMemorySubjectKeyStore(): SubjectKeyStore;
+//# sourceMappingURL=subjectKeyStore.d.ts.map

package/dist/subjectKeyStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subjectKeyStore.d.ts","sourceRoot":"","sources":["../src/subjectKeyStore.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,IAAI,eAAe,CAoB/D"}