@openauditmodel/cli 0.2.1 → 0.4.0

package/dist/conformance/src/integrity/verify-event.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify-event.js","sourceRoot":"","sources":["../../../../conformance/src/integrity/verify-event.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,GAI1B,MAAM,YAAY,CAAC;AAwBpB;;;iFAGiF;AACjF,SAAS,aAAa,CAAC,SAAkB;IACvC,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,SAAoC,CAAC;IACpD,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,OAAO,CACd,KAAa,EACb,OAAgB,EAChB,SAAiC,EAAE;IAEnC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAI,KAAiC,CAAC,WAAW,CAAC,CAAC;IAClE,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAA4B,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAc,EACd,KAAa,EACb,SAAyB,EACzB,UAA8B,EAAE;IAEhC,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACnF,MAAM,MAAM,GACV,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;gBAC1B,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,OAAO,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,wBAAwB,CAAC;gBACzE,CAAC,CAAC,KAAK,CAAC;YACZ,OAAO,OAAO,CAAC,KAAK,EAAE;gBACpB,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,gDAAgD;gBACzD,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,kEAAkE;YAC3E,MAAM,EAAE,CAAC,mEAAmE,CAAC;SAC9E,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC;IAE5D,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,mCAAmC;SAC7C,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QACzC,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,0DAA0D;SACpE,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACnD,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,qBAAqB,gBAAgB,uCAAuC;YACrF,MAAM,EAAE,CAAC,gBAAgB,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SACnE,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,qBAAqB,gBAAgB,EAAE,EAAE,CAAC,CAAC;IAElE,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,wDAAwD;SAClE,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7C,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,mBAAmB,aAAa,uCAAuC;YAChF,MAAM,EAAE;gBACN,gBAAgB,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACtD,gFAAgF;aACjF;SACF,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,mBAAmB,aAAa,EAAE,EAAE,CAAC,CAAC;IAE7D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,4CAA4C;YACrD,MAAM,EAAE,CAAC,iFAAiF,CAAC;SAC5F,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,gBAAgB,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACnC,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,oBAAoB,IAAI,CAAC,MAAM,oBAAoB,aAAa,aAAa,cAAc,EAAE;SACvG,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,eAAe,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GACX,KAAK,YAAY,qBAAqB;YACpC,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,mCAAoC,KAAe,CAAC,OAAO,EAAE,CAAC;QACpE,OAAO,OAAO,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,KAAK;YACL,QAAQ,EAAE,KAAK;YACf,MAAM;YACN,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,eAAe;oBACrB,KAAK;oBACL,OAAO,EAAE,yBAAyB;oBAClC,MAAM,EAAE,CAAC,eAAe,IAAI,EAAE,EAAE,eAAe,UAAU,EAAE,CAAC;iBAC7D;aACF;YACD,gBAAgB;YAChB,aAAa;YACb,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,UAAU;SAC3B,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;IAEjD,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACtF,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,eAAe,CAAC,EAAE,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,KAAK;gBACf,MAAM;gBACN,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,EAAE,CAAC;gBACnF,gBAAgB;gBAChB,aAAa;gBACb,YAAY,EAAE,IAAI;gBAClB,cAAc,EAAE,UAAU;aAC3B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK;QACL,QAAQ,EAAE,IAAI;QACd,MAAM;QACN,QAAQ,EAAE,EAAE;QACZ,gBAAgB;QAChB,aAAa;QACb,YAAY,EAAE,IAAI;QAClB,cAAc,EAAE,UAAU;KAC3B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CACrB,KAAc,EACd,SAAkB,EAClB,SAAgC;IAKhC,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QACtD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,oBAAoB,QAAQ,CAAC,SAAS,GAAG,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;AACnE,CAAC"}
+{"version":3,"file":"verify-event.js","sourceRoot":"","sources":["../../../../conformance/src/integrity/verify-event.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,6BAA6B,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACrF,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,GAI1B,MAAM,YAAY,CAAC;AAyBpB;;;iFAGiF;AACjF,SAAS,aAAa,CAAC,SAAkB;IACvC,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,SAAoC,CAAC;IACpD,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,OAAO,CACd,KAAa,EACb,OAAgB,EAChB,SAAiC,EAAE;IAEnC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAI,KAAiC,CAAC,WAAW,CAAC,CAAC;IAClE,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAA4B,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAc,EACd,KAAa,EACb,SAAyB,EACzB,UAA8B,EAAE;IAEhC,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACnF,MAAM,MAAM,GACV,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;gBAC1B,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,OAAO,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,wBAAwB,CAAC;gBACzE,CAAC,CAAC,KAAK,CAAC;YACZ,OAAO,OAAO,CAAC,KAAK,EAAE;gBACpB,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,gDAAgD;gBACzD,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,kEAAkE;YAC3E,MAAM,EAAE,CAAC,mEAAmE,CAAC;SAC9E,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC;IAE5D,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,mCAAmC;SAC7C,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QACzC,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,0DAA0D;SACpE,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACnD,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,qBAAqB,gBAAgB,uCAAuC;YACrF,MAAM,EAAE,CAAC,gBAAgB,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SACnE,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,qBAAqB,gBAAgB,EAAE,EAAE,CAAC,CAAC;IAElE,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,wDAAwD;SAClE,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7C,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,mBAAmB,aAAa,uCAAuC;YAChF,MAAM,EAAE;gBACN,gBAAgB,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACtD,gFAAgF;aACjF;SACF,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,mBAAmB,aAAa,EAAE,EAAE,CAAC,CAAC;IAE7D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,4CAA4C;YACrD,MAAM,EAAE,CAAC,iFAAiF,CAAC;SAC5F,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,gBAAgB,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACnC,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,oBAAoB,IAAI,CAAC,MAAM,oBAAoB,aAAa,aAAa,cAAc,EAAE;SACvG,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,eAAe,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GACX,KAAK,YAAY,qBAAqB;YACpC,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,mCAAoC,KAAe,CAAC,OAAO,EAAE,CAAC;QACpE,OAAO,OAAO,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,KAAK;YACL,QAAQ,EAAE,KAAK;YACf,MAAM;YACN,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,eAAe;oBACrB,KAAK;oBACL,OAAO,EAAE,yBAAyB;oBAClC,MAAM,EAAE,CAAC,eAAe,IAAI,EAAE,EAAE,eAAe,UAAU,EAAE,CAAC;iBAC7D;aACF;YACD,gBAAgB;YAChB,aAAa;YACb,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,UAAU;SAC3B,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;IAEjD,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACtF,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,eAAe,CAAC,EAAE,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,KAAK;gBACf,MAAM;gBACN,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,EAAE,CAAC;gBACnF,gBAAgB;gBAChB,aAAa;gBACb,YAAY,EAAE,IAAI;gBAClB,cAAc,EAAE,UAAU;aAC3B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK;QACL,QAAQ,EAAE,IAAI;QACd,MAAM;QACN,QAAQ,EAAE,EAAE;QACZ,gBAAgB;QAChB,aAAa;QACb,YAAY,EAAE,IAAI;QAClB,cAAc,EAAE,UAAU;KAC3B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,cAAc,CACrB,KAAc,EACd,SAAkB,EAClB,SAAgC;IAKhC,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,6BAA6B,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACvD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,iCAAiC;YACvC,OAAO,EAAE,wBAAwB,QAAQ,CAAC,SAAS,uCAAuC;SAC3F,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,uBAAuB,QAAQ,CAAC,SAAS,4CAA4C;SAC/F,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,oBAAoB,QAAQ,CAAC,SAAS,GAAG,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;AACnE,CAAC"}

package/dist/conformance/src/privacy/size-analysis.js

@@ -53,7 +53,9 @@ export function profileValue(value) {
     walk(value, 0);
     let serializedBytes;
     try {
-        serializedBytes = Buffer.byteLength(JSON.stringify(value) ?? "", "utf8");
+        // TextEncoder rather than Node's Buffer, so the module runs identically in
+        // a browser bundle. Both measure UTF-8 bytes.
+        serializedBytes = new TextEncoder().encode(JSON.stringify(value) ?? "").length;
     }
     catch {
         // A value that cannot be serialized cannot be measured; it is not reported.

package/dist/conformance/src/privacy/size-analysis.js.map

@@ -1 +1 @@
-{"version":3,"file":"size-analysis.js","sourceRoot":"","sources":["../../../../conformance/src/privacy/size-analysis.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAUH,MAAM,CAAC,MAAM,eAAe,GAAmB;IAC7C,eAAe,EAAE,IAAI;IACrB,eAAe,EAAE,EAAE;IACnB,QAAQ,EAAE,CAAC;IACX,cAAc,EAAE,GAAG;IACnB,aAAa,EAAE,IAAI;CACpB,CAAC;AAEF,sGAAsG;AACtG,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAUpC,yDAAyD;AACzD,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,KAAa,EAAQ,EAAE;QAClD,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACrB,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;QACD,IAAI,KAAK,IAAI,iBAAiB,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACvD,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACxB,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;gBACzE,eAAe,IAAI,CAAC,CAAC;gBACrB,IAAI,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAEf,IAAI,eAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,eAAe,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,eAAe,GAAG,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC;AACvF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAoB,EACpB,aAA6B,eAAe;IAE5C,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,OAAO,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,EAAE,CAAC;QACzD,OAAO,CAAC,IAAI,CACV,mBAAmB,OAAO,CAAC,eAAe,kBAAkB,UAAU,CAAC,eAAe,EAAE,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,EAAE,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,eAAe,uBAAuB,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,iBAAiB,OAAO,CAAC,QAAQ,YAAY,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,EAAE,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,cAAc,kBAAkB,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,EAAE,CAAC;QACrD,OAAO,CAAC,IAAI,CACV,aAAa,OAAO,CAAC,aAAa,uBAAuB,UAAU,CAAC,aAAa,EAAE,CACpF,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"size-analysis.js","sourceRoot":"","sources":["../../../../conformance/src/privacy/size-analysis.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAUH,MAAM,CAAC,MAAM,eAAe,GAAmB;IAC7C,eAAe,EAAE,IAAI;IACrB,eAAe,EAAE,EAAE;IACnB,QAAQ,EAAE,CAAC;IACX,cAAc,EAAE,GAAG;IACnB,aAAa,EAAE,IAAI;CACpB,CAAC;AAEF,sGAAsG;AACtG,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAUpC,yDAAyD;AACzD,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,KAAa,EAAQ,EAAE;QAClD,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACrB,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;QACD,IAAI,KAAK,IAAI,iBAAiB,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACvD,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACxB,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;gBACzE,eAAe,IAAI,CAAC,CAAC;gBACrB,IAAI,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAEf,IAAI,eAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,2EAA2E;QAC3E,8CAA8C;QAC9C,eAAe,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,eAAe,GAAG,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC;AACvF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAoB,EACpB,aAA6B,eAAe;IAE5C,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,OAAO,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,EAAE,CAAC;QACzD,OAAO,CAAC,IAAI,CACV,mBAAmB,OAAO,CAAC,eAAe,kBAAkB,UAAU,CAAC,eAAe,EAAE,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,EAAE,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,eAAe,uBAAuB,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,iBAAiB,OAAO,CAAC,QAAQ,YAAY,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,EAAE,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,cAAc,kBAAkB,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,EAAE,CAAC;QACrD,OAAO,CAAC,IAAI,CACV,aAAa,OAAO,CAAC,aAAa,uBAAuB,UAAU,CAAC,aAAa,EAAE,CACpF,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/conformance/src/privacy/token-patterns.js

@@ -87,11 +87,26 @@ export function isJwtStructured(value) {
     }
     return decodeJsonObject(payload) !== undefined;
 }
-/** Decodes a base64url segment to a JSON object, or `undefined`. Never returns content to a report. */
+/** Decodes a base64url segment to a JSON object, or `undefined`. Never returns content to a report.
+ *
+ * Decodes via `atob` + `TextDecoder` rather than Node's `Buffer` so the module
+ * runs identically in a browser bundle. The two places `atob`/`TextDecoder`
+ * are stricter than `Buffer.from(segment, "base64url")` are compensated for:
+ * a segment of length ≡ 1 (mod 4) has its dangling character discarded
+ * (Buffer drops it silently; padded, `atob` would throw), and invalid UTF-8
+ * decodes with U+FFFD replacement instead of throwing. Being stricter would
+ * mean a JWT this linter flags in Node passes silently in a browser. */
 function decodeJsonObject(segment) {
     let text;
     try {
-        text = Buffer.from(segment, "base64url").toString("utf8");
+        let base64 = segment.replaceAll("-", "+").replaceAll("_", "/");
+        if (base64.length % 4 === 1) {
+            base64 = base64.slice(0, -1);
+        }
+        const padded = base64 + "=".repeat((4 - (base64.length % 4)) % 4);
+        const binary = atob(padded);
+        const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+        text = new TextDecoder("utf-8").decode(bytes);
     }
     catch {
         return undefined;

package/dist/conformance/src/privacy/token-patterns.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-patterns.js","sourceRoot":"","sources":["../../../../conformance/src/privacy/token-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC;;;;;;GAMG;AACH,MAAM,oBAAoB,GACxB,uEAAuE,CAAC;AAE1E,oFAAoF;AACpF,MAAM,mBAAmB,GAAsB;IAC7C,mBAAmB;IACnB,uBAAuB;IACvB,uBAAuB;IACvB,sBAAsB;IACtB,2BAA2B;IAC3B,6BAA6B;IAC7B,6BAA6B;CAC9B,CAAC;AAEF,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AAEpD,yEAAyE;AACzE,MAAM,uBAAuB,GAGxB;IACH,6EAA6E;IAC7E,EAAE,OAAO,EAAE,6BAA6B,EAAE,MAAM,EAAE,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE;IAC9E,6EAA6E;IAC7E,EAAE,OAAO,EAAE,iCAAiC,EAAE,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE;IAC7E,EAAE,OAAO,EAAE,mCAAmC,EAAE,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE;IAC/E,EAAE,OAAO,EAAE,+BAA+B,EAAE,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE;IAC3E,EAAE,OAAO,EAAE,mCAAmC,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE;IAC9E,EAAE,OAAO,EAAE,+CAA+C,EAAE,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAAE;IACjG,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE;CACvE,CAAC;AAEF,2EAA2E;AAC3E,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC;IACnC,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,aAAa,KAAK,SAAS,IAAI,OAAO,aAAa,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,gBAAgB,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC;AACjD,CAAC;AAED,uGAAuG;AACvG,SAAS,gBAAgB,CAAC,OAAe;IACvC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;IAC5B,CAAC;IACD,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,uBAAuB,EAAE,CAAC;QAC1D,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"token-patterns.js","sourceRoot":"","sources":["../../../../conformance/src/privacy/token-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC;;;;;;GAMG;AACH,MAAM,oBAAoB,GACxB,uEAAuE,CAAC;AAE1E,oFAAoF;AACpF,MAAM,mBAAmB,GAAsB;IAC7C,mBAAmB;IACnB,uBAAuB;IACvB,uBAAuB;IACvB,sBAAsB;IACtB,2BAA2B;IAC3B,6BAA6B;IAC7B,6BAA6B;CAC9B,CAAC;AAEF,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AAEpD,yEAAyE;AACzE,MAAM,uBAAuB,GAGxB;IACH,6EAA6E;IAC7E,EAAE,OAAO,EAAE,6BAA6B,EAAE,MAAM,EAAE,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE;IAC9E,6EAA6E;IAC7E,EAAE,OAAO,EAAE,iCAAiC,EAAE,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE;IAC7E,EAAE,OAAO,EAAE,mCAAmC,EAAE,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE;IAC/E,EAAE,OAAO,EAAE,+BAA+B,EAAE,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE;IAC3E,EAAE,OAAO,EAAE,mCAAmC,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE;IAC9E,EAAE,OAAO,EAAE,+CAA+C,EAAE,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAAE;IACjG,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE;CACvE,CAAC;AAEF,2EAA2E;AAC3E,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC;IACnC,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,aAAa,KAAK,SAAS,IAAI,OAAO,aAAa,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,gBAAgB,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC;AACjD,CAAC;AAED;;;;;;;;wEAQwE;AACxE,SAAS,gBAAgB,CAAC,OAAe;IACvC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;IAC5B,CAAC;IACD,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,uBAAuB,EAAE,CAAC;QAC1D,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/conformance/src/privacy/types.d.ts

@@ -52,7 +52,26 @@ export interface LintSummary {
     readonly schemaInvalid: number;
     readonly findings: number;
     readonly bySeverity: Readonly<Record<Severity, number>>;
+    /**
+     * Findings per rule category, most findings first.
+     *
+     * Severity says how bad one finding would be; category says what kind of
+     * mistake produced it, which is what an instrumentation fix is organised
+     * around. Fifty findings that are all one category are one afternoon's work;
+     * fifty spread across nine are a different problem.
+     *
+     * A rule that declares no category is counted under `uncategorised` rather
+     * than dropped, so the category counts always sum to `findings`.
+     */
+    readonly byCategory: readonly CategoryCount[];
+}
+/** Findings attributed to one rule category. */
+export interface CategoryCount {
+    readonly category: string;
+    readonly findings: number;
 }
+/** Category recorded for a finding whose rule declares none. */
+export declare const UNCATEGORISED = "uncategorised";
 export declare function emptySeverityCounts(): Record<Severity, number>;
 /** Summarises a set of results. */
 export declare function summarise(results: readonly EventLintResult[]): LintSummary;

package/dist/conformance/src/privacy/types.js

@@ -7,16 +7,21 @@
  * proof that an event is safe or compliant. See specification/privacy.md §6.
  */
 export const SEVERITY_ORDER = ["critical", "high", "medium", "low", "info"];
+/** Category recorded for a finding whose rule declares none. */
+export const UNCATEGORISED = "uncategorised";
 export function emptySeverityCounts() {
     return { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
 }
 /** Summarises a set of results. */
 export function summarise(results) {
     const bySeverity = emptySeverityCounts();
+    const categories = new Map();
     let findings = 0;
     for (const result of results) {
         for (const finding of result.findings) {
             bySeverity[finding.severity] += 1;
+            const category = finding.category ?? UNCATEGORISED;
+            categories.set(category, (categories.get(category) ?? 0) + 1);
             findings += 1;
         }
     }
@@ -27,6 +32,9 @@ export function summarise(results) {
         schemaInvalid: results.filter((result) => result.status === "schema-invalid").length,
         findings,
         bySeverity,
+        byCategory: [...categories.entries()]
+            .map(([category, count]) => ({ category, findings: count }))
+            .sort((left, right) => right.findings - left.findings || left.category.localeCompare(right.category, "en")),
     };
 }
 //# sourceMappingURL=types.js.map

package/dist/conformance/src/privacy/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../conformance/src/privacy/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,MAAM,CAAC,MAAM,cAAc,GAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAkDjG,MAAM,UAAU,mBAAmB;IACjC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,mCAAmC;AACnC,MAAM,UAAU,SAAS,CAAC,OAAmC;IAC3D,MAAM,UAAU,GAAG,mBAAmB,EAAE,CAAC;IACzC,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAClC,QAAQ,IAAI,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,MAAM;QACnE,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM;QAC7E,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,MAAM;QACpF,QAAQ;QACR,UAAU;KACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../conformance/src/privacy/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,MAAM,CAAC,MAAM,cAAc,GAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAoEjG,gEAAgE;AAChE,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAC;AAE7C,MAAM,UAAU,mBAAmB;IACjC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,mCAAmC;AACnC,MAAM,UAAU,SAAS,CAAC,OAAmC;IAC3D,MAAM,UAAU,GAAG,mBAAmB,EAAE,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,aAAa,CAAC;YACnD,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9D,QAAQ,IAAI,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,MAAM;QACnE,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM;QAC7E,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,MAAM;QACpF,QAAQ;QACR,UAAU;QACV,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;aAClC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;aAC3D,IAAI,CACH,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CACtF;KACJ,CAAC;AACJ,CAAC"}

package/dist/conformance/src/profiles/coverage.d.ts

@@ -0,0 +1,62 @@
+import { type ProfileCheckResult, type ProfileCheckSummary, type ProfileDefinition, type RuleSeverity } from "./types.js";
+/** What one rule did across the event set. */
+export interface RuleCoverage {
+    readonly ruleId: string;
+    readonly severity: RuleSeverity;
+    /** Events whose name this rule's selector matched. */
+    readonly selected: number;
+    /**
+     * Events where the rule contributed requirements. Lower than `selected` when
+     * a `when` condition did not hold; equal when the rule has no condition.
+     */
+    readonly applied: number;
+    /** Events where the rule produced at least one error-severity finding. */
+    readonly failed: number;
+}
+/** What one event name did, and whether the profile governs it at all. */
+export interface EventNameCoverage {
+    readonly name: string;
+    readonly events: number;
+    readonly governed: boolean;
+}
+export interface ProfileCoverage {
+    readonly profile: {
+        readonly name: string;
+        readonly version: string;
+        readonly status: string;
+    };
+    readonly events: ProfileCheckSummary;
+    readonly rules: {
+        readonly total: number;
+        /** Rules whose selector matched at least one event. */
+        readonly selected: number;
+        /** Rules that contributed requirements to at least one event. */
+        readonly applied: number;
+        /** Rule ids no event in this set selected, in definition order. */
+        readonly neverSelected: readonly string[];
+        /**
+         * Rule ids that were selected by an event and applied to none, in
+         * definition order. Every one of these is a requirement that looked
+         * enforced and was not.
+         */
+        readonly selectedButNeverApplied: readonly string[];
+    };
+    readonly perRule: readonly RuleCoverage[];
+    /** Every distinct event name in the set, most frequent first. */
+    readonly names: readonly EventNameCoverage[];
+    readonly nameTotals: {
+        readonly distinct: number;
+        readonly governed: number;
+        readonly ungoverned: number;
+    };
+}
+/**
+ * Summarises what a profile reached across already-checked events.
+ *
+ * The events are re-read here rather than threaded through
+ * {@link ProfileCheckResult}, because selection and condition evaluation are
+ * the two facts coverage is about and a check result records neither. Nothing
+ * is re-validated: the core verdict already in each result is what decides
+ * whether an event's rules were evaluated at all.
+ */
+export declare function summariseCoverage(events: readonly unknown[], results: readonly ProfileCheckResult[], profile: ProfileDefinition): ProfileCoverage;

package/dist/conformance/src/profiles/coverage.js

@@ -0,0 +1,114 @@
+/**
+ * Coverage: what a profile reached across a set of events.
+ *
+ * `check-profile` answers "does this event conform?". This answers a different
+ * question, and confusing the two is the mistake it exists to prevent: **how
+ * much of this profile is my instrumentation actually exercising?**
+ *
+ * A pipeline that runs `check-profile` over an export and sees no violations
+ * has learned almost nothing if every event was `not-applicable`. That is the
+ * real state of a producer whose event names sit outside the profile's
+ * vocabulary, and it is indistinguishable from success in a summary line that
+ * only counts failures.
+ *
+ * **It counts events, not obligations.** "4 of 15 rules were selected" is a
+ * statement about this event set, never a percentage of conformance, a maturity
+ * score or a grade. A profile is not a checklist to be completed: most rules do
+ * not apply to most events, and a low number is the normal state of a narrow
+ * export rather than a defect.
+ *
+ * Two distinctions carry most of the value here.
+ *
+ * **Selected is not applied.** A rule with a `when` condition is selected by an
+ * event's name and then contributes nothing, because the condition did not
+ * hold. `INC-CLOSE-001` requires an approval when
+ * `/metadata/incident/approvalRequired` is true — against a producer that never
+ * writes that flag it is selected on every closure and applied on none. Nothing
+ * fails, and nothing is checked. Reporting only selection would present that as
+ * coverage.
+ *
+ * **Ungoverned names are the finding.** The event names a profile did not
+ * govern are what tell a producer that its vocabulary and the profile's have
+ * not met, which no per-event verdict shows.
+ */
+import { conditionHolds } from "./evaluate-rule.js";
+import { eventName, selectRules } from "./select-rules.js";
+import { summariseProfileResults, } from "./types.js";
+/**
+ * Summarises what a profile reached across already-checked events.
+ *
+ * The events are re-read here rather than threaded through
+ * {@link ProfileCheckResult}, because selection and condition evaluation are
+ * the two facts coverage is about and a check result records neither. Nothing
+ * is re-validated: the core verdict already in each result is what decides
+ * whether an event's rules were evaluated at all.
+ */
+export function summariseCoverage(events, results, profile) {
+    const selected = new Map();
+    const applied = new Map();
+    const failed = new Map();
+    const nameCounts = new Map();
+    const governedNames = new Set();
+    for (const rule of profile.rules) {
+        selected.set(rule.id, 0);
+        applied.set(rule.id, 0);
+        failed.set(rule.id, 0);
+    }
+    for (const [index, event] of events.entries()) {
+        const result = results[index];
+        const name = eventName(event);
+        if (name !== undefined) {
+            nameCounts.set(name, (nameCounts.get(name) ?? 0) + 1);
+        }
+        // A core-invalid event had no rule evaluated against it, so counting its
+        // name as governed would credit the profile with a check it never made.
+        if (result === undefined || result.status === "core-invalid" || name === undefined) {
+            continue;
+        }
+        const rules = selectRules(profile, name);
+        if (rules.length > 0) {
+            governedNames.add(name);
+        }
+        const failing = new Set(result.errors.map((finding) => finding.ruleId));
+        for (const rule of rules) {
+            selected.set(rule.id, (selected.get(rule.id) ?? 0) + 1);
+            if (rule.when === undefined || conditionHolds(event, rule.when)) {
+                applied.set(rule.id, (applied.get(rule.id) ?? 0) + 1);
+            }
+            if (failing.has(rule.id)) {
+                failed.set(rule.id, (failed.get(rule.id) ?? 0) + 1);
+            }
+        }
+    }
+    const perRule = profile.rules.map((rule) => ({
+        ruleId: rule.id,
+        severity: rule.severity ?? "error",
+        selected: selected.get(rule.id) ?? 0,
+        applied: applied.get(rule.id) ?? 0,
+        failed: failed.get(rule.id) ?? 0,
+    }));
+    const names = [...nameCounts.entries()]
+        .map(([name, count]) => ({ name, events: count, governed: governedNames.has(name) }))
+        .sort((left, right) => right.events - left.events || left.name.localeCompare(right.name, "en"));
+    return {
+        profile: { name: profile.name, version: profile.version, status: profile.status },
+        events: summariseProfileResults(results),
+        rules: {
+            total: profile.rules.length,
+            selected: perRule.filter((rule) => rule.selected > 0).length,
+            applied: perRule.filter((rule) => rule.applied > 0).length,
+            neverSelected: perRule.filter((rule) => rule.selected === 0).map((rule) => rule.ruleId),
+            selectedButNeverApplied: perRule
+                .filter((rule) => rule.selected > 0 && rule.applied === 0)
+                .map((rule) => rule.ruleId),
+        },
+        perRule,
+        names,
+        nameTotals: {
+            distinct: names.length,
+            governed: names.filter((entry) => entry.governed).length,
+            ungoverned: names.filter((entry) => !entry.governed).length,
+        },
+    };
+}
+//# sourceMappingURL=coverage.js.map

package/dist/conformance/src/profiles/coverage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage.js","sourceRoot":"","sources":["../../../../conformance/src/profiles/coverage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EACL,uBAAuB,GAKxB,MAAM,YAAY,CAAC;AAwDpB;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAA0B,EAC1B,OAAsC,EACtC,OAA0B;IAE1B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAExC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACjC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACnF,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACxE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACxD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAmB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3D,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,OAAO;QAClC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;QACpC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;QAClC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;KACjC,CAAC,CAAC,CAAC;IAEJ,MAAM,KAAK,GAAwB,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;SACzD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SACpF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAElG,OAAO;QACL,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;QACjF,MAAM,EAAE,uBAAuB,CAAC,OAAO,CAAC;QACxC,KAAK,EAAE;YACL,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;YAC3B,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,MAAM;YAC5D,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM;YAC1D,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;YACvF,uBAAuB,EAAE,OAAO;iBAC7B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,CAAC;iBACzD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;SAC9B;QACD,OAAO;QACP,KAAK;QACL,UAAU,EAAE;YACV,QAAQ,EAAE,KAAK,CAAC,MAAM;YACtB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM;YACxD,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM;SAC5D;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openauditmodel/cli",
-  "version": "0.2.1",
+  "version": "0.4.0",
   "description": "Conformance toolchain for OpenAuditModel: validate audit events against the canonical JSON Schema, verify tamper-evidence, lint for leaked secrets and check domain profiles. Offline and deterministic.",
   "keywords": [
     "audit",
@@ -20,6 +20,14 @@
     "auditmodel": "dist/conformance/src/cli.js",
     "openauditmodel": "dist/conformance/src/cli.js"
   },
+  "exports": {
+    "./package.json": "./package.json",
+    "./conformance/*": "./dist/conformance/src/*",
+    "./schemas/*": "./schemas/*",
+    "./profiles/*": "./profiles/*",
+    "./semantic-conventions/*": "./semantic-conventions/*",
+    "./specification/*": "./specification/*"
+  },
   "files": [
     "dist/conformance/src",
     "schemas",
@@ -44,7 +52,12 @@
     "check:profile": "npm run build && node dist/conformance/src/cli.js check-profile examples/profiles/identity-and-access-management/valid --profile identity-and-access-management && node dist/conformance/src/cli.js check-profile examples/profiles/document-management/valid --profile document-management && node dist/conformance/src/cli.js check-profile examples/profiles/incident-management/valid --profile incident-management && node dist/conformance/src/cli.js check-profile examples/profiles/message-broker-management/valid --profile message-broker-management && node dist/conformance/src/cli.js check-profile examples/profiles/deployment-and-change-management/valid --profile deployment-and-change-management && node dist/conformance/src/cli.js check-profile examples/profiles/financial-transaction-management/valid --profile financial-transaction-management && node dist/conformance/src/cli.js check-profile examples/profiles/secrets-and-key-management/valid --profile secrets-and-key-management && node dist/conformance/src/cli.js check-profile examples/profiles/customer-and-account-management/valid --profile customer-and-account-management && node dist/conformance/src/cli.js check-profile examples/profiles/backup-and-recovery/valid --profile backup-and-recovery && node dist/conformance/src/cli.js check-profile examples/profiles/api-and-integration-management/valid --profile api-and-integration-management",
     "fixtures:integrity": "npm run build && node dist/conformance/tools/generate-integrity-fixtures.js && prettier --write examples/integrity",
     "fixtures:check": "npm run build && node dist/conformance/tools/generate-integrity-fixtures.js --check",
-    "verify": "npm run format:check && npm run lint && npm run test && npm run validate:valid && npm run verify:integrity && npm run lint:privacy && npm run check:profile",
+    "kit:build": "npm run build && node dist/conformance/tools/generate-kit.js && prettier --write conformance-kit",
+    "kit:check": "npm run build && node dist/conformance/tools/generate-kit.js --check",
+    "profiles:lint": "npm run build && node dist/conformance/tools/lint-profiles.js",
+    "profiles:archive": "npm run build && node dist/conformance/tools/archive-profile-versions.js",
+    "profiles:check-archive": "npm run build && node dist/conformance/tools/archive-profile-versions.js --check",
+    "verify": "npm run format:check && npm run lint && npm run test && npm run validate:valid && npm run verify:integrity && npm run lint:privacy && npm run check:profile && npm run fixtures:check && npm run profiles:check-archive && npm run profiles:lint && npm run kit:check && npm run mcp:check-generated && npm run package:verify && npm run package:smoke",
     "mcp:generate": "npm run generate --workspace mcp",
     "mcp:check-generated": "npm run generate:check --workspace mcp",
     "mcp:start": "npm run build && node dist/mcp/src/index.js",

package/profiles/README.md

@@ -75,6 +75,48 @@ documents**; it is not part of the canonical audit event schema and never constr
 `coreVersions` lists the core versions the profile applies to; an event declaring any other
 `specVersion` is **not applicable** rather than in violation.
 
+### Versions are filed, and a filed version never changes
+
+**Changing a profile's rules MUST bump its `version`.** [ADR 0008](../decisions/0008-declarative-profile-conformance.md)
+records why: adding a rule is a breaking change for producers, in the same sense as adding a required
+core field, because events that conformed may stop conforming.
+
+Each version is filed at `profiles/<name>/<version>/profile.json` when it is published, and a filed
+copy is never edited afterwards. The site publishes every filed version, so revising a profile adds
+an address rather than withdrawing the one consumers already have — the site serves these documents
+with a year-long `immutable` cache lifetime, and a URL that answered yesterday must not 404 today.
+
+The archive is what enforces the bump. Change a rule without changing `version` and the working
+document no longer matches the copy filed under that version, which fails `npm run verify`. There are
+two ways to make it pass: bump the version, or revert the change.
+
+```bash
+npm run profiles:archive        # file the current version of every profile
+npm run profiles:check-archive  # compare each profile with its filed copy
+npm run profiles:lint           # report defects the definition schema cannot express
+```
+
+### What the lint checks
+
+The definition schema decides whether a profile document is well formed. It cannot decide whether the
+document says what its author meant, and three of the ways it can fail to are silent:
+
+|                                        |                                                                                                                                         |
+| -------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
+| A rule id declared twice               | Selection deduplicates by id, so the later rule is never evaluated and its requirements vanish. The event is reported **conforming**    |
+| A rule that states no requirement      | An event is `not-applicable` only while no rule selects it. One requirement-free rule makes it governed and satisfied                   |
+| A condition on a path no rule requires | An absent condition path means the condition does not hold, so a producer that never writes the flag escapes the requirement in silence |
+
+The lint also rejects pointers that can never resolve — an empty reference token, and a
+`requiredMetadata` path beginning with `/metadata`, which is concatenated into `/metadata/metadata/…`
+— and requirements that contradict each other. Those are errors. Redundant selectors and unreachable
+prefixes are warnings, and warnings never fail the build.
+
+A version bump is not complete until three things move together: `version` in `profile.json`, a filed
+copy under the new version, and the profile's allowlist entry in
+`mcp/scripts/generate-resource-manifest.mjs`, which carries the version in the resource URI it serves.
+A test holds each of them in place.
+
 ### Rules
 
 Each rule has an `id` and a `description`, and MAY have a `rationale` and a `severity`.