@sourcey/catalog-verifier 1.0.0 → 1.1.0

package/dist/modules/release/src/evidence-admission.js

@@ -0,0 +1,539 @@
+import { readdir, readFile } from "node:fs/promises";
+import { join, relative, sep } from "node:path";
+import { agentReadinessDeclarationRevisionSchema, agentReadinessRevisionSchema, } from "../../../contracts/agent-readiness/src/index.js";
+import { catalogEventSchema } from "../../../contracts/events/src/index.js";
+import { captureReceiptSchema, evidenceAuthorityBundleCoreSchema, evidenceAuthorityBundleManifestSchema, evidenceAuthoritySetCoreSchema, evidenceAuthoritySetManifestSchema, evidenceReviewDecisionSchema, } from "../../../contracts/evidence/src/index.js";
+import { observationSchema } from "../../../contracts/observations/src/index.js";
+import { RELEASE_RESOURCES, releaseResourceDigest } from "../../../contracts/release/src/index.js";
+import { entityRevisionSchema, offerRevisionSchema, programRevisionSchema, } from "../../../contracts/revisions/src/index.js";
+import { compileAgentReadinessRevision } from "../../agent-readiness-policy/src/revision.js";
+import { validateProtectedCaptureReceipt, validateProtectedEvent, } from "../../authority/src/index.js";
+import { capturePolicyDefinitionSchema } from "../../evidence-operations/src/configuration.js";
+import { evidenceCatalogProposalSchema, validateEvidenceCatalogProposal, } from "../../evidence-operations/src/evidence-authority.js";
+import { verifyEvidenceObjectGraph } from "../../evidence-operations/src/proof-graph.js";
+import { canonicalJson, compareCanonicalStrings, digest, digestPathSegment, sha256Bytes, } from "../../primitives/src/index.js";
+import { assertOnlyObjectPaths, assertSafeObjectPath, filesUnder, verifyBundleTree, } from "./evidence-bundle-tree.js";
+export async function loadEvidenceAuthorityProposals(input) {
+    const proposals = new Map();
+    for (const root of [...input.roots].sort(compareCanonicalStrings)) {
+        const authoritySet = await loadAuthoritySetReaders({
+            root,
+            targetRegistry: input.targetRegistry,
+        });
+        const readers = authoritySet ? authoritySet.readers : await loadDirectoryBundleReaders(root);
+        for (const reader of readers) {
+            const { proposal } = await readEvidenceAuthorityProposal(reader);
+            const existing = proposals.get(proposal.proposal_digest);
+            if (existing && canonicalJson(existing) !== canonicalJson(proposal)) {
+                throw new Error(`Evidence proposal ${proposal.proposal_digest} has conflicting bytes.`);
+            }
+            proposals.set(proposal.proposal_digest, proposal);
+        }
+    }
+    return [...proposals.values()].sort((left, right) => compareCanonicalStrings(left.proposal_digest, right.proposal_digest));
+}
+export function createEvidenceAdmissionBase(parent) {
+    if (!parent) {
+        throw new Error("Evidence authority bundles require an exact verified parent release.");
+    }
+    const currentRevisionDigests = new Set(parent.artifact.entities
+        .flatMap((entity) => [
+        entity.revision_digest,
+        ...entity.programs.map((program) => program.revision_digest),
+        ...entity.offers.map((offer) => offer.revision_digest),
+    ])
+        .concat(parent.agentReadinessProfiles.map((profile) => profile.revision_digest)));
+    return {
+        releaseId: parent.descriptor.release_id,
+        releaseSequence: parent.descriptor.release_core.release_sequence,
+        coveragePolicyDigest: releaseResourceDigest(parent.bundle.resource_digests, RELEASE_RESOURCES.coveragePolicy),
+        agentReadinessPolicyDigest: releaseResourceDigest(parent.bundle.resource_digests, RELEASE_RESOURCES.agentReadinessPolicy),
+        currentRevisionDigests,
+        currentAgentReadinessHeads: new Map(parent.agentReadinessProfiles.map((profile) => [
+            profile.agent_readiness_profile_id,
+            {
+                entityId: profile.entity_id,
+                revisionDigest: profile.revision_digest,
+            },
+        ])),
+        revisions: new Map([...parent.revisions.entries()].filter((entry) => entry[1].revision_contract === "sourcey.entity-revision/v1alpha1" ||
+            entry[1].revision_contract === "sourcey.program-revision/v1alpha1" ||
+            entry[1].revision_contract === "sourcey.offer-revision/v1alpha1" ||
+            entry[1].revision_contract === "sourcey.agent-readiness-declaration-revision/v1alpha1")),
+        events: parent.events,
+        observations: parent.observations,
+        captureReceipts: parent.captureReceipts,
+    };
+}
+export function emptyAdmittedEvidence() {
+    return {
+        authoritySetDigest: null,
+        bundleDigests: [],
+        revisionDigests: [],
+        revisions: [],
+        events: [],
+        observations: [],
+        captureReceipts: [],
+        captures: new Map(),
+        normalizedObjects: new Map(),
+    };
+}
+export function mergeCanonicalById(left, right, label, id) {
+    const values = new Map();
+    for (const value of [...left, ...right]) {
+        const key = id(value);
+        const prior = values.get(key);
+        if (prior && digest(prior) !== digest(value)) {
+            throw new Error(`Release ${label} ${key} has conflicting input bytes.`);
+        }
+        values.set(key, value);
+    }
+    return [...values.values()].sort((first, second) => compareCanonicalStrings(id(first), id(second)));
+}
+export function mergeBytesByDigest(left, right, label) {
+    const values = new Map(left);
+    for (const [objectDigest, bytes] of right) {
+        const prior = values.get(objectDigest);
+        if (prior && !prior.equals(bytes)) {
+            throw new Error(`Release ${label} ${objectDigest} has conflicting input bytes.`);
+        }
+        values.set(objectDigest, bytes);
+    }
+    return values;
+}
+/**
+ * Release construction is the admission boundary for pending evidence bundles.
+ * Every byte is re-read and re-verified here; the materializer's verdict is not
+ * trusted and this function performs no mutation.
+ */
+export async function loadEvidenceAuthorityBundles(input) {
+    if (input.targetReleaseSequence !== input.base.releaseSequence + 1) {
+        throw new Error("Evidence authority admission must target the release after its exact base.");
+    }
+    const authoritySet = await loadAuthoritySetReaders(input);
+    const readers = authoritySet
+        ? authoritySet.readers
+        : await loadDirectoryBundleReaders(input.root);
+    if (readers.length === 0) {
+        throw new Error("Configured evidence authority root contains no pending bundles.");
+    }
+    const reviewed = await Promise.all(readers.map(async (reader) => ({
+        reader,
+        ...(await readEvidenceAuthorityProposal(reader)),
+    })));
+    const prospectiveRevisionDigests = new Set(reviewed.map(({ proposal }) => proposal.subject_revision.revision_digest));
+    const bundles = [];
+    for (const { reader, proposal, bundleDigest } of reviewed) {
+        bundles.push(await loadBundle({
+            reader,
+            proposal,
+            bundleDigest,
+            prospectiveRevisionDigests,
+            base: input.base,
+            targetReleaseSequence: input.targetReleaseSequence,
+            targetCoveragePolicyDigest: input.targetCoveragePolicyDigest,
+            targetAgentReadinessPolicyDigest: input.targetAgentReadinessPolicyDigest,
+            targetRegistry: input.targetRegistry,
+        }));
+    }
+    const bundleDigests = new Set();
+    const revisionDigests = new Set();
+    const revisionObjects = new Map();
+    const events = new Map();
+    const eventOperations = new Map();
+    const observations = new Map();
+    const captureReceipts = new Map();
+    const captureOperations = new Map();
+    const captures = new Map();
+    const normalizedObjects = new Map();
+    for (const bundle of bundles) {
+        if (bundleDigests.has(bundle.bundleDigest)) {
+            throw new Error(`Duplicate evidence authority bundle ${bundle.bundleDigest}.`);
+        }
+        bundleDigests.add(bundle.bundleDigest);
+        for (const revisionDigest of bundle.revisionDigests)
+            revisionDigests.add(revisionDigest);
+        for (const event of bundle.events) {
+            if (events.has(event.event_id)) {
+                throw new Error(`Evidence authority bundles repeat event ${event.event_id}.`);
+            }
+            const priorOperation = eventOperations.get(event.operation_id);
+            if (priorOperation) {
+                throw new Error(`Evidence operation ${event.operation_id} is already bound to ${priorOperation}.`);
+            }
+            events.set(event.event_id, event);
+            eventOperations.set(event.operation_id, event.event_id);
+        }
+        for (const receipt of bundle.captureReceipts) {
+            if (captureReceipts.has(receipt.receipt_digest)) {
+                throw new Error(`Evidence authority bundles repeat capture receipt ${receipt.receipt_digest}.`);
+            }
+            const priorOperation = captureOperations.get(receipt.operation_id);
+            if (priorOperation) {
+                throw new Error(`Capture operation ${receipt.operation_id} is already bound to ${priorOperation}.`);
+            }
+            captureReceipts.set(receipt.receipt_digest, receipt);
+            captureOperations.set(receipt.operation_id, receipt.receipt_digest);
+        }
+        mergeCanonicalObjects(observations, bundle.observations, "observation", (value) => value.observation_id);
+        mergeBytes(captures, bundle.captures, "capture");
+        mergeBytes(normalizedObjects, bundle.normalizedObjects, "normalized object");
+        for (const revision of bundle.revisions) {
+            revisionObjects.set(revision.revision_digest, revision);
+        }
+    }
+    return {
+        authoritySetDigest: authoritySet?.digest ?? null,
+        bundleDigests: [...bundleDigests].sort(compareCanonicalStrings),
+        revisionDigests: [...revisionDigests].sort(compareCanonicalStrings),
+        revisions: [...revisionObjects.values()].sort((left, right) => compareCanonicalStrings(left.revision_digest, right.revision_digest)),
+        events: [...events.values()].sort((left, right) => compareCanonicalStrings(left.event_id, right.event_id)),
+        observations: [...observations.values()].sort((left, right) => compareCanonicalStrings(left.observation_id, right.observation_id)),
+        captureReceipts: [...captureReceipts.values()].sort((left, right) => compareCanonicalStrings(left.receipt_digest, right.receipt_digest)),
+        captures,
+        normalizedObjects,
+    };
+}
+async function loadBundle(input) {
+    const manifest = input.reader.manifest;
+    const { bundleDigest, proposal } = input;
+    const decision = evidenceReviewDecisionSchema.parse(JSON.parse((await input.reader.read("authority/review-decision.json")).toString("utf8")));
+    const capturePolicy = capturePolicyDefinitionSchema.parse(JSON.parse((await input.reader.read("authority/capture-policy.json")).toString("utf8")));
+    if (proposal.proposal_digest !== manifest.proposal_digest ||
+        proposal.review_decision.decision_digest !== manifest.review_decision_digest ||
+        canonicalJson(proposal.review_decision) !== canonicalJson(decision)) {
+        throw new Error(`Evidence authority bundle ${bundleDigest} has a mismatched authority record.`);
+    }
+    if (input.reader.address !== digestPathSegment(proposal.proposal_digest)) {
+        throw new Error(`Evidence authority bundle ${bundleDigest} is stored under the wrong address.`);
+    }
+    const targetCoveragePolicyDigest = proposal.subject_revision.revision_contract === "sourcey.agent-readiness-revision/v1alpha1"
+        ? input.targetAgentReadinessPolicyDigest
+        : input.targetCoveragePolicyDigest;
+    if (proposal.review_proposal.coverage_policy_digest !== targetCoveragePolicyDigest) {
+        throw new Error(`Evidence authority bundle ${bundleDigest} uses a stale target coverage policy.`);
+    }
+    if (digest(capturePolicy) !== proposal.review_proposal.capture_policy_digest) {
+        throw new Error(`Evidence authority bundle ${bundleDigest} has the wrong capture policy bytes.`);
+    }
+    const revisions = await readAddressedJsonObjects(input.reader, manifest.objects, "revisions/", (value) => {
+        const revisionContract = value
+            .revision_contract;
+        return revisionContract === "sourcey.entity-revision/v1alpha1"
+            ? entityRevisionSchema.parse(value)
+            : revisionContract === "sourcey.program-revision/v1alpha1"
+                ? programRevisionSchema.parse(value)
+                : revisionContract === "sourcey.offer-revision/v1alpha1"
+                    ? offerRevisionSchema.parse(value)
+                    : revisionContract === "sourcey.agent-readiness-revision/v1alpha1"
+                        ? agentReadinessRevisionSchema.parse(value)
+                        : agentReadinessDeclarationRevisionSchema.parse(value);
+    }, (value) => value.revision_digest, (value) => digest(withoutKey(value, "revision_digest")));
+    assertSameSet("revision", manifest.revision_digests, revisions.map((revision) => revision.revision_digest));
+    const events = await readAddressedJsonObjects(input.reader, manifest.objects, "events/", (value) => catalogEventSchema.parse(value), (value) => value.event_id, (value) => digest(withoutKeys(value, ["event_id", "protected"])));
+    assertSameSet("event", manifest.event_ids, events.map((event) => event.event_id));
+    for (const event of events) {
+        validateProtectedEvent(event, input.targetRegistry, input.targetReleaseSequence);
+    }
+    const observations = await readAddressedJsonObjects(input.reader, manifest.objects, "observations/", (value) => observationSchema.parse(value), (value) => value.observation_id, (value) => digest(withoutKey(value, "observation_id")));
+    assertSameSet("observation", manifest.observation_ids, observations.map((observation) => observation.observation_id));
+    const captureReceipts = await readAddressedJsonObjects(input.reader, manifest.objects, "capture-receipts/", (value) => captureReceiptSchema.parse(value), (value) => value.receipt_digest, (value) => digest(withoutKeys(value, ["receipt_digest", "protected"])));
+    if (captureReceipts.length !== 1 ||
+        captureReceipts[0]?.receipt_digest !== manifest.capture_receipt_digest) {
+        throw new Error(`Evidence authority bundle ${bundleDigest} has the wrong capture receipt.`);
+    }
+    const receipt = captureReceipts[0];
+    if (!receipt)
+        throw new Error(`Evidence authority bundle ${bundleDigest} lacks a receipt.`);
+    validateProtectedCaptureReceipt(receipt, input.targetRegistry, input.targetReleaseSequence);
+    const capturePath = `captures/${digestPathSegment(receipt.capture.digest)}`;
+    const normalizedDigest = proposal.review_proposal.submission.normalization
+        .object_digest;
+    const normalizedPath = `evidence/normalized/${digestPathSegment(normalizedDigest)}`;
+    assertOnlyObjectPaths(manifest.objects, "captures/", [capturePath]);
+    assertOnlyObjectPaths(manifest.objects, "evidence/normalized/", [normalizedPath]);
+    assertOnlyObjectPaths(manifest.objects, "", [
+        "authority/proposal.json",
+        "authority/review-decision.json",
+        "authority/capture-policy.json",
+        capturePath,
+        normalizedPath,
+        ...revisions.map((revision) => `revisions/${digestPathSegment(revision.revision_digest)}.json`),
+        ...events.map((event) => `events/${digestPathSegment(event.event_id)}.json`),
+        ...observations.map((observation) => `observations/${digestPathSegment(observation.observation_id)}.json`),
+        `capture-receipts/${digestPathSegment(receipt.receipt_digest)}.json`,
+    ]);
+    const captureBytes = await input.reader.read(capturePath);
+    const normalizedBytes = await input.reader.read(normalizedPath);
+    const validated = validateEvidenceCatalogProposal({
+        proposal,
+        captureBytes,
+        normalizedBytes,
+        catalog: {
+            releaseId: input.base.releaseId,
+            coveragePolicyDigest: input.targetCoveragePolicyDigest,
+            agentReadinessPolicyDigest: input.targetAgentReadinessPolicyDigest,
+            currentRevisionDigests: input.base.currentRevisionDigests,
+            currentAgentReadinessHeads: input.base.currentAgentReadinessHeads,
+            revisions: input.base.revisions,
+            existingEvents: input.base.events,
+            existingObservations: input.base.observations,
+            existingCaptureReceipts: input.base.captureReceipts,
+        },
+        prospectiveRevisionDigests: input.prospectiveRevisionDigests,
+        policy: {
+            captureReceiptIssuerId: receipt.issuer_id,
+            evidenceEventIssuerId: events[0]?.issuer_id ?? "",
+        },
+        agentReadinessRevisionCompiler: compileAgentReadinessRevision,
+    });
+    if (validated.newCaptureReceiptIntent === null && validated.newEventIntents.length === 0) {
+        throw new Error(`Evidence authority bundle ${bundleDigest} does not contain new authority.`);
+    }
+    const { protected: _receiptProtection, receipt_digest: _receiptDigest, ...receiptCore } = receipt;
+    if (canonicalJson(receiptCore) !== canonicalJson(proposal.capture_receipt_intent.core) ||
+        receipt.receipt_digest !== proposal.capture_receipt_intent.receipt_digest) {
+        throw new Error(`Evidence authority bundle ${bundleDigest} receipt differs from its intent.`);
+    }
+    assertMaterializedEvents(proposal.event_intents, events, bundleDigest);
+    if (canonicalJson(proposal.observations) !== canonicalJson(observations)) {
+        throw new Error(`Evidence authority bundle ${bundleDigest} observations differ from its proposal.`);
+    }
+    const captures = new Map([[receipt.capture.digest, captureBytes]]);
+    const normalizedObjects = new Map([[normalizedDigest, normalizedBytes]]);
+    verifyEvidenceObjectGraph({
+        revisions,
+        events,
+        observations,
+        captureReceipts,
+        captures,
+        normalizedObjects,
+    });
+    return {
+        authoritySetDigest: null,
+        bundleDigest: bundleDigest,
+        bundleDigests: [bundleDigest],
+        revisionDigests: manifest.revision_digests,
+        revisions,
+        events,
+        observations,
+        captureReceipts,
+        captures,
+        normalizedObjects,
+    };
+}
+async function readEvidenceAuthorityProposal(reader) {
+    const { bundle_digest: bundleDigest, ...manifestCore } = reader.manifest;
+    if (digest(evidenceAuthorityBundleCoreSchema.parse(manifestCore)) !== bundleDigest) {
+        throw new Error(`Evidence authority bundle ${bundleDigest} is not content-addressed.`);
+    }
+    await reader.verifyTree(reader.manifest.objects);
+    const proposal = evidenceCatalogProposalSchema.parse(JSON.parse((await reader.read("authority/proposal.json")).toString("utf8")));
+    if (proposal.proposal_digest !== reader.manifest.proposal_digest ||
+        reader.address !== digestPathSegment(proposal.proposal_digest)) {
+        throw new Error(`Evidence authority bundle ${bundleDigest} has the wrong proposal.`);
+    }
+    return { proposal, bundleDigest: bundleDigest };
+}
+async function loadDirectoryBundleReaders(root) {
+    const entries = await readdir(root, { withFileTypes: true });
+    const directories = entries
+        .filter((entry) => entry.isDirectory())
+        .sort((left, right) => compareCanonicalStrings(left.name, right.name));
+    if (entries.some((entry) => entry.isSymbolicLink())) {
+        throw new Error(`Evidence authority root ${root} cannot contain symlinks.`);
+    }
+    if (entries.some((entry) => !entry.isDirectory())) {
+        throw new Error(`Evidence authority root ${root} must contain only addressed bundles.`);
+    }
+    return Promise.all(directories.map(async (entry) => {
+        const directory = join(root, entry.name);
+        const manifest = evidenceAuthorityBundleManifestSchema.parse(JSON.parse(await readFile(join(directory, "manifest.json"), "utf8")));
+        return {
+            address: entry.name,
+            label: directory,
+            manifest,
+            read: (path) => readFile(join(directory, path)),
+            verifyTree: (declarations) => verifyBundleTree(directory, declarations),
+        };
+    }));
+}
+async function loadAuthoritySetReaders(input) {
+    let manifestBytes;
+    try {
+        manifestBytes = await readFile(join(input.root, "authority-set.json"));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+    const manifest = evidenceAuthoritySetManifestSchema.parse(JSON.parse(manifestBytes.toString("utf8")));
+    const { authority_set_digest: authoritySetDigest, ...core } = manifest;
+    if (digest(evidenceAuthoritySetCoreSchema.parse(core)) !== authoritySetDigest) {
+        throw new Error("Evidence authority set is not content-addressed.");
+    }
+    if (manifest.target_signer_registry_digest !== input.targetRegistry.registry_digest) {
+        throw new Error(`Evidence authority set ${authoritySetDigest} targets the wrong signer registry.`);
+    }
+    assertSortedUnique("bundle proposal", manifest.bundles.map((bundle) => bundle.proposal_digest));
+    assertUnique("bundle", manifest.bundles.map((bundle) => bundle.bundle_digest));
+    assertSortedUnique("object", manifest.objects.map((object) => object.digest));
+    const objectBytes = new Map();
+    for (const declaration of manifest.objects) {
+        const objectDigest = declaration.digest;
+        const bytes = await readFile(join(input.root, "objects", digestPathSegment(objectDigest)));
+        if (bytes.byteLength !== declaration.bytes || sha256Bytes(bytes) !== objectDigest) {
+            throw new Error(`Evidence authority set object ${objectDigest} differs from its declaration.`);
+        }
+        objectBytes.set(objectDigest, bytes);
+    }
+    const readers = [];
+    const referencedObjects = new Set();
+    for (const declaration of manifest.bundles) {
+        const proposalDigest = declaration.proposal_digest;
+        const address = digestPathSegment(proposalDigest);
+        const bytes = await readFile(join(input.root, "bundles", `${address}.json`));
+        if (bytes.byteLength !== declaration.manifest.bytes ||
+            sha256Bytes(bytes) !== declaration.manifest.digest) {
+            throw new Error(`Evidence authority set bundle ${declaration.bundle_digest} differs from its declaration.`);
+        }
+        const bundle = evidenceAuthorityBundleManifestSchema.parse(JSON.parse(bytes.toString("utf8")));
+        const { bundle_digest: bundleDigest, ...bundleCore } = bundle;
+        if (bundle.proposal_digest !== proposalDigest ||
+            bundleDigest !== declaration.bundle_digest ||
+            digest(evidenceAuthorityBundleCoreSchema.parse(bundleCore)) !== bundleDigest) {
+            throw new Error(`Evidence authority set bundle ${declaration.bundle_digest} is not content-addressed.`);
+        }
+        for (const [path, object] of Object.entries(bundle.objects)) {
+            assertSafeObjectPath(path);
+            referencedObjects.add(object.sha256);
+            const value = objectBytes.get(object.sha256);
+            if (!value || value.byteLength !== object.bytes || sha256Bytes(value) !== object.sha256) {
+                throw new Error(`Evidence authority bundle object ${path} differs from its declaration.`);
+            }
+        }
+        readers.push({
+            address,
+            label: `${input.root}/bundles/${address}.json`,
+            manifest: bundle,
+            read: async (path) => {
+                const object = bundle.objects[path];
+                if (!object) {
+                    throw new Error(`Evidence authority bundle ${bundleDigest} does not declare ${path}.`);
+                }
+                const value = objectBytes.get(object.sha256);
+                if (!value || value.byteLength !== object.bytes || sha256Bytes(value) !== object.sha256) {
+                    throw new Error(`Evidence authority bundle object ${path} differs from its declaration.`);
+                }
+                return value;
+            },
+            verifyTree: async (declarations) => {
+                if (canonicalJson(declarations) !== canonicalJson(bundle.objects)) {
+                    throw new Error(`Evidence authority bundle ${bundleDigest} was read with different declarations.`);
+                }
+            },
+        });
+    }
+    const declaredObjects = new Set(manifest.objects.map((object) => object.digest));
+    if (referencedObjects.size !== declaredObjects.size ||
+        [...referencedObjects].some((objectDigest) => !declaredObjects.has(objectDigest))) {
+        throw new Error("Evidence authority set does not close its exact shared object set.");
+    }
+    const expectedPaths = [
+        "authority-set.json",
+        ...manifest.bundles.map((bundle) => `bundles/${digestPathSegment(bundle.proposal_digest)}.json`),
+        ...manifest.objects.map((object) => `objects/${digestPathSegment(object.digest)}`),
+    ].sort(compareCanonicalStrings);
+    const actualPaths = (await filesUnder(input.root))
+        .map((path) => relative(input.root, path).split(sep).join("/"))
+        .sort(compareCanonicalStrings);
+    if (canonicalJson(actualPaths) !== canonicalJson(expectedPaths)) {
+        throw new Error(`Evidence authority set ${authoritySetDigest} has an undeclared file set.`);
+    }
+    return {
+        digest: authoritySetDigest,
+        readers,
+    };
+}
+async function readAddressedJsonObjects(reader, declarations, prefix, parse, address, coreDigest) {
+    const paths = Object.keys(declarations)
+        .filter((path) => path.startsWith(prefix) && path.endsWith(".json"))
+        .sort(compareCanonicalStrings);
+    if (paths.length === 0)
+        throw new Error(`Evidence authority bundle lacks ${prefix} objects.`);
+    const values = [];
+    for (const path of paths) {
+        const value = parse(JSON.parse((await reader.read(path)).toString("utf8")));
+        const objectAddress = address(value);
+        if (path !== `${prefix}${digestPathSegment(objectAddress)}.json` ||
+            coreDigest(value) !== objectAddress) {
+            throw new Error(`Evidence authority bundle object ${path} is misaddressed.`);
+        }
+        values.push(value);
+    }
+    assertOnlyObjectPaths(declarations, prefix, paths);
+    return values;
+}
+function assertSortedUnique(label, values) {
+    const sorted = [...new Set(values)].sort(compareCanonicalStrings);
+    if (canonicalJson(values) !== canonicalJson(sorted)) {
+        throw new Error(`Evidence authority set ${label} declarations are not sorted and unique.`);
+    }
+}
+function assertUnique(label, values) {
+    if (new Set(values).size !== values.length) {
+        throw new Error(`Evidence authority set repeats a ${label} digest.`);
+    }
+}
+function assertMaterializedEvents(intents, events, bundleDigest) {
+    const byId = new Map(events.map((event) => [event.event_id, event]));
+    if (byId.size !== intents.length) {
+        throw new Error(`Evidence authority bundle ${bundleDigest} has the wrong event count.`);
+    }
+    for (const intent of intents) {
+        const event = byId.get(intent.event_id);
+        if (!event)
+            throw new Error(`Evidence authority bundle ${bundleDigest} lacks an intended event.`);
+        const { event_id: eventId, protected: _protection, ...core } = event;
+        if (eventId !== intent.event_id || canonicalJson(core) !== canonicalJson(intent.core)) {
+            throw new Error(`Evidence authority bundle ${bundleDigest} event differs from its intent.`);
+        }
+    }
+}
+function assertSameSet(label, expected, actual) {
+    if (canonicalJson([...expected].sort(compareCanonicalStrings)) !==
+        canonicalJson([...actual].sort(compareCanonicalStrings))) {
+        throw new Error(`Evidence authority bundle ${label} declarations disagree.`);
+    }
+}
+function mergeCanonicalObjects(target, values, label, id) {
+    for (const value of values) {
+        const key = id(value);
+        const prior = target.get(key);
+        if (prior && canonicalJson(prior) !== canonicalJson(value)) {
+            throw new Error(`Evidence authority ${label} ${key} has conflicting bytes.`);
+        }
+        target.set(key, value);
+    }
+}
+function mergeBytes(target, values, label) {
+    for (const [objectDigest, bytes] of values) {
+        const prior = target.get(objectDigest);
+        if (prior && !prior.equals(bytes)) {
+            throw new Error(`Evidence authority ${label} ${objectDigest} has conflicting bytes.`);
+        }
+        target.set(objectDigest, bytes);
+    }
+}
+function withoutKey(value, key) {
+    const { [key]: _, ...rest } = value;
+    return rest;
+}
+function withoutKeys(value, keys) {
+    const result = { ...value };
+    for (const key of keys)
+        delete result[key];
+    return result;
+}
+//# sourceMappingURL=evidence-admission.js.map

package/dist/modules/release/src/evidence-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence-admission.js","sourceRoot":"","sources":["../../../../modules/release/src/evidence-admission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAGL,uCAAuC,EACvC,4BAA4B,GAC7B,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAqB,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC/F,OAAO,EAEL,oBAAoB,EACpB,iCAAiC,EACjC,qCAAqC,EACrC,8BAA8B,EAC9B,kCAAkC,EAClC,4BAA4B,GAC7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAoB,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAEL,oBAAoB,EAEpB,mBAAmB,EAEnB,qBAAqB,GACtB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,6BAA6B,EAAE,MAAM,8CAA8C,CAAC;AAE7F,OAAO,EAEL,+BAA+B,EAC/B,sBAAsB,GAEvB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,6BAA6B,EAAE,MAAM,gDAAgD,CAAC;AAC/F,OAAO,EAEL,6BAA6B,EAC7B,+BAA+B,GAChC,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAC;AACzF,OAAO,EACL,aAAa,EACb,uBAAuB,EAEvB,MAAM,EACN,iBAAiB,EACjB,WAAW,GACZ,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,UAAU,EACV,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAyCnC,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAGpD;IACC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkE,CAAC;IAC5F,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAClE,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC;YACjD,IAAI;YACJ,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,0BAA0B,CAAC,IAAI,CAAC,CAAC;QAC7F,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,6BAA6B,CAAC,MAAM,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;YACzD,IAAI,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,eAAe,yBAAyB,CAAC,CAAC;YAC1F,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAClD,uBAAuB,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,eAAe,CAAC,CACrE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,MAAqC;IAErC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,sBAAsB,GAAG,IAAI,GAAG,CACpC,MAAM,CAAC,QAAQ,CAAC,QAAQ;SACrB,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QACnB,MAAM,CAAC,eAAe;QACtB,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;QAC5D,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC;KACvD,CAAC;SACD,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CACnF,CAAC;IACF,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,UAAoB;QACjD,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,gBAAgB;QAChE,oBAAoB,EAAE,qBAAqB,CACzC,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAC9B,iBAAiB,CAAC,cAAc,CACvB;QACX,0BAA0B,EAAE,qBAAqB,CAC/C,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAC9B,iBAAiB,CAAC,oBAAoB,CAC7B;QACX,sBAAsB;QACtB,0BAA0B,EAAE,IAAI,GAAG,CACjC,MAAM,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAC7C,OAAO,CAAC,0BAA0B;YAClC;gBACE,QAAQ,EAAE,OAAO,CAAC,SAAS;gBAC3B,cAAc,EAAE,OAAO,CAAC,eAAyB;aAClD;SACF,CAAC,CACH;QACD,SAAS,EAAE,IAAI,GAAG,CAChB,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CACpC,CAAC,KAAK,EAAsC,EAAE,CAC5C,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,KAAK,kCAAkC;YACjE,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,KAAK,mCAAmC;YAClE,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,KAAK,iCAAiC;YAChE,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,KAAK,uDAAuD,CACzF,CACF;QACD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,eAAe,EAAE,MAAM,CAAC,eAAe;KACxC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO;QACL,kBAAkB,EAAE,IAAI;QACxB,aAAa,EAAE,EAAE;QACjB,eAAe,EAAE,EAAE;QACnB,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,EAAE;QACV,YAAY,EAAE,EAAE;QAChB,eAAe,EAAE,EAAE;QACnB,QAAQ,EAAE,IAAI,GAAG,EAAE;QACnB,iBAAiB,EAAE,IAAI,GAAG,EAAE;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,IAAkB,EAClB,KAAmB,EACnB,KAAa,EACb,EAAwB;IAExB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAa,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,GAAG,+BAA+B,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CACjD,uBAAuB,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,IAAiC,EACjC,KAAkC,EAClC,KAAa;IAEb,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,KAAK,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACvC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,YAAY,+BAA+B,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAOlD;IACC,IAAI,KAAK,CAAC,qBAAqB,KAAK,KAAK,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,YAAY;QAC1B,CAAC,CAAC,YAAY,CAAC,OAAO;QACtB,CAAC,CAAC,MAAM,0BAA0B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7B,MAAM;QACN,GAAG,CAAC,MAAM,6BAA6B,CAAC,MAAM,CAAC,CAAC;KACjD,CAAC,CAAC,CACJ,CAAC;IACF,MAAM,0BAA0B,GAAG,IAAI,GAAG,CACxC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAC1E,CAAC;IACF,MAAM,OAAO,GAAG,EAAE,CAAC;IACnB,KAAK,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1D,OAAO,CAAC,IAAI,CACV,MAAM,UAAU,CAAC;YACf,MAAM;YACN,QAAQ;YACR,YAAY;YACZ,0BAA0B;YAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC5D,gCAAgC,EAAE,KAAK,CAAC,gCAAgC;YACxE,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,MAAM,eAAe,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IACpD,MAAM,eAAe,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC1D,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEpD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC;QACjF,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACvC,KAAK,MAAM,cAAc,IAAI,MAAM,CAAC,eAAe;YAAE,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACzF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,2CAA2C,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,cAAc,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC/D,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CACb,sBAAsB,KAAK,CAAC,YAAY,wBAAwB,cAAc,GAAG,CAClF,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAClC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1D,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC7C,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,KAAK,CACb,qDAAqD,OAAO,CAAC,cAAc,GAAG,CAC/E,CAAC;YACJ,CAAC;YACD,MAAM,cAAc,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACnE,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CACb,qBAAqB,OAAO,CAAC,YAAY,wBAAwB,cAAc,GAAG,CACnF,CAAC;YACJ,CAAC;YACD,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;YACrD,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QACtE,CAAC;QACD,qBAAqB,CACnB,YAAY,EACZ,MAAM,CAAC,YAAY,EACnB,aAAa,EACb,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAChC,CAAC;QACF,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACjD,UAAU,CAAC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QAC7E,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACxC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAyB,EAAE,QAAQ,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,OAAO;QACL,kBAAkB,EAAE,YAAY,EAAE,MAAM,IAAI,IAAI;QAChD,aAAa,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAa;QAC3E,eAAe,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;QACnE,SAAS,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC5D,uBAAuB,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,eAAe,CAAC,CACrE;QACD,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAChD,uBAAuB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CACvD;QACD,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC5D,uBAAuB,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CACnE;QACD,eAAe,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAClE,uBAAuB,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CACnE;QACD,QAAQ;QACR,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,KAUzB;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;IACvC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IACzC,MAAM,QAAQ,GAAG,4BAA4B,CAAC,KAAK,CACjD,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CACzF,CAAC;IACF,MAAM,aAAa,GAAG,6BAA6B,CAAC,KAAK,CACvD,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CACxF,CAAC;IACF,IACE,QAAQ,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;QACrD,QAAQ,CAAC,eAAe,CAAC,eAAe,KAAK,QAAQ,CAAC,sBAAsB;QAC5E,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,aAAa,CAAC,QAAQ,CAAC,EACnE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,YAAY,qCAAqC,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,iBAAiB,CAAC,QAAQ,CAAC,eAAyB,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,6BAA6B,YAAY,qCAAqC,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,0BAA0B,GAC9B,QAAQ,CAAC,gBAAgB,CAAC,iBAAiB,KAAK,2CAA2C;QACzF,CAAC,CAAC,KAAK,CAAC,gCAAgC;QACxC,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC;IACvC,IAAI,QAAQ,CAAC,eAAe,CAAC,sBAAsB,KAAK,0BAA0B,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CACb,6BAA6B,YAAY,uCAAuC,CACjF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,eAAe,CAAC,qBAAqB,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CACb,6BAA6B,YAAY,sCAAsC,CAChF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAC9C,KAAK,CAAC,MAAM,EACZ,QAAQ,CAAC,OAAO,EAChB,YAAY,EACZ,CAAC,KAAK,EAAE,EAAE;QACR,MAAM,gBAAgB,GAAI,KAAkD;aACzE,iBAAiB,CAAC;QACrB,OAAO,gBAAgB,KAAK,kCAAkC;YAC5D,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC;YACnC,CAAC,CAAC,gBAAgB,KAAK,mCAAmC;gBACxD,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC;gBACpC,CAAC,CAAC,gBAAgB,KAAK,iCAAiC;oBACtD,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC;oBAClC,CAAC,CAAC,gBAAgB,KAAK,2CAA2C;wBAChE,CAAC,CAAC,4BAA4B,CAAC,KAAK,CAAC,KAAK,CAAC;wBAC3C,CAAC,CAAC,uCAAuC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAyB,EAC1C,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC,CACxD,CAAC;IACF,aAAa,CACX,UAAU,EACV,QAAQ,CAAC,gBAAgB,EACzB,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CACtD,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAC3C,KAAK,CAAC,MAAM,EACZ,QAAQ,CAAC,OAAO,EAChB,SAAS,EACT,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,EAC1C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAkB,EACnC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,CACjE,CAAC;IACF,aAAa,CACX,OAAO,EACP,QAAQ,CAAC,SAAS,EAClB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CACtC,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,wBAAwB,CACjD,KAAK,CAAC,MAAM,EACZ,QAAQ,CAAC,OAAO,EAChB,eAAe,EACf,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,EACzC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAwB,EACzC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC,CACvD,CAAC;IACF,aAAa,CACX,aAAa,EACb,QAAQ,CAAC,eAAe,EACxB,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,cAAc,CAAC,CAC9D,CAAC;IAEF,MAAM,eAAe,GAAG,MAAM,wBAAwB,CACpD,KAAK,CAAC,MAAM,EACZ,QAAQ,CAAC,OAAO,EAChB,mBAAmB,EACnB,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,EAC5C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAwB,EACzC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAAC,CACvE,CAAC;IACF,IACE,eAAe,CAAC,MAAM,KAAK,CAAC;QAC5B,eAAe,CAAC,CAAC,CAAC,EAAE,cAAc,KAAK,QAAQ,CAAC,sBAAsB,EACtE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,YAAY,iCAAiC,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,YAAY,mBAAmB,CAAC,CAAC;IAC5F,+BAA+B,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAE5F,MAAM,WAAW,GAAG,YAAY,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,MAAgB,CAAC,EAAE,CAAC;IACtF,MAAM,gBAAgB,GAAG,QAAQ,CAAC,eAAe,CAAC,UAAU,CAAC,aAAa;SACvE,aAAuB,CAAC;IAC3B,MAAM,cAAc,GAAG,uBAAuB,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,CAAC;IACpF,qBAAqB,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IACpE,qBAAqB,CAAC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;IAClF,qBAAqB,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,EAAE;QAC1C,yBAAyB;QACzB,gCAAgC;QAChC,+BAA+B;QAC/B,WAAW;QACX,cAAc;QACd,GAAG,SAAS,CAAC,GAAG,CACd,CAAC,QAAQ,EAAE,EAAE,CAAC,aAAa,iBAAiB,CAAC,QAAQ,CAAC,eAAyB,CAAC,OAAO,CACxF;QACD,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,iBAAiB,CAAC,KAAK,CAAC,QAAkB,CAAC,OAAO,CAAC;QACtF,GAAG,YAAY,CAAC,GAAG,CACjB,CAAC,WAAW,EAAE,EAAE,CACd,gBAAgB,iBAAiB,CAAC,WAAW,CAAC,cAAwB,CAAC,OAAO,CACjF;QACD,oBAAoB,iBAAiB,CAAC,OAAO,CAAC,cAAwB,CAAC,OAAO;KAC/E,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAEhE,MAAM,SAAS,GAAG,+BAA+B,CAAC;QAChD,QAAQ;QACR,YAAY;QACZ,eAAe;QACf,OAAO,EAAE;YACP,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;YAC/B,oBAAoB,EAAE,KAAK,CAAC,0BAA0B;YACtD,0BAA0B,EAAE,KAAK,CAAC,gCAAgC;YAClE,sBAAsB,EAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB;YACzD,0BAA0B,EAAE,KAAK,CAAC,IAAI,CAAC,0BAA0B;YACjE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;YAC/B,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM;YACjC,oBAAoB,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY;YAC7C,uBAAuB,EAAE,KAAK,CAAC,IAAI,CAAC,eAAe;SACpD;QACD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,MAAM,EAAE;YACN,sBAAsB,EAAE,OAAO,CAAC,SAAS;YACzC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,IAAI,EAAE;SAClD;QACD,8BAA8B,EAAE,6BAA6B;KAC9D,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,uBAAuB,KAAK,IAAI,IAAI,SAAS,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,6BAA6B,YAAY,kCAAkC,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,kBAAkB,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,CAAC;IAClG,IACE,aAAa,CAAC,WAAW,CAAC,KAAK,aAAa,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,CAAC;QAClF,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,sBAAsB,CAAC,cAAc,EACzE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,YAAY,mCAAmC,CAAC,CAAC;IAChG,CAAC;IACD,wBAAwB,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;IACvE,IAAI,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,aAAa,CAAC,YAAY,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CACb,6BAA6B,YAAY,yCAAyC,CACnF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAiB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAgB,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAiB,CAAC,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;IACzF,yBAAyB,CAAC;QACxB,SAAS;QACT,MAAM;QACN,YAAY;QACZ,eAAe;QACf,QAAQ;QACR,iBAAiB;KAClB,CAAC,CAAC;IAEH,OAAO;QACL,kBAAkB,EAAE,IAAI;QACxB,YAAY,EAAE,YAAsB;QACpC,aAAa,EAAE,CAAC,YAAsB,CAAC;QACvC,eAAe,EAAE,QAAQ,CAAC,gBAA4B;QACtD,SAAS;QACT,MAAM;QACN,YAAY;QACZ,eAAe;QACf,QAAQ;QACR,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,6BAA6B,CAAC,MAAqC;IAIhF,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;IACzE,IAAI,MAAM,CAAC,iCAAiC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,6BAA6B,YAAY,4BAA4B,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,6BAA6B,CAAC,KAAK,CAClD,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAC5E,CAAC;IACF,IACE,QAAQ,CAAC,eAAe,KAAK,MAAM,CAAC,QAAQ,CAAC,eAAe;QAC5D,MAAM,CAAC,OAAO,KAAK,iBAAiB,CAAC,QAAQ,CAAC,eAAyB,CAAC,EACxE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,YAAY,0BAA0B,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAsB,EAAE,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,IAAY;IACpD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,OAAO;SACxB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SACtC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,2BAA2B,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,uCAAuC,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAChB,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,qCAAqC,CAAC,KAAK,CAC1D,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC,CACrE,CAAC;QACF,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,IAAI;YACnB,KAAK,EAAE,SAAS;YAChB,QAAQ;YACR,IAAI,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACvD,UAAU,EAAE,CAAC,YAAuC,EAAE,EAAE,CACtD,gBAAgB,CAAC,SAAS,EAAE,YAAY,CAAC;SAC5C,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,KAGtC;IAIC,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,kCAAkC,CAAC,KAAK,CACvD,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAC3C,CAAC;IACF,MAAM,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC;IACvE,IAAI,MAAM,CAAC,8BAA8B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,kBAAkB,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,QAAQ,CAAC,6BAA6B,KAAK,KAAK,CAAC,cAAc,CAAC,eAAe,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CACb,0BAA0B,kBAAkB,qCAAqC,CAClF,CAAC;IACJ,CAAC;IACD,kBAAkB,CAChB,iBAAiB,EACjB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CACzD,CAAC;IACF,YAAY,CACV,QAAQ,EACR,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CACvD,CAAC;IACF,kBAAkB,CAChB,QAAQ,EACR,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAChD,CAAC;IAEF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,KAAK,MAAM,WAAW,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,WAAW,CAAC,MAAgB,CAAC;QAClD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC3F,IAAI,KAAK,CAAC,UAAU,KAAK,WAAW,CAAC,KAAK,IAAI,WAAW,CAAC,KAAK,CAAC,KAAK,YAAY,EAAE,CAAC;YAClF,MAAM,IAAI,KAAK,CACb,iCAAiC,YAAY,gCAAgC,CAC9E,CAAC;QACJ,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,OAAO,GAAoC,EAAE,CAAC;IACpD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC5C,KAAK,MAAM,WAAW,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC3C,MAAM,cAAc,GAAG,WAAW,CAAC,eAAyB,CAAC;QAC7D,MAAM,OAAO,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,OAAO,OAAO,CAAC,CAAC,CAAC;QAC7E,IACE,KAAK,CAAC,UAAU,KAAK,WAAW,CAAC,QAAQ,CAAC,KAAK;YAC/C,WAAW,CAAC,KAAK,CAAC,KAAK,WAAW,CAAC,QAAQ,CAAC,MAAM,EAClD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,iCAAiC,WAAW,CAAC,aAAa,gCAAgC,CAC3F,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,qCAAqC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/F,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC;QAC9D,IACE,MAAM,CAAC,eAAe,KAAK,cAAc;YACzC,YAAY,KAAK,WAAW,CAAC,aAAa;YAC1C,MAAM,CAAC,iCAAiC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,YAAY,EAC5E,CAAC;YACD,MAAM,IAAI,KAAK,CACb,iCAAiC,WAAW,CAAC,aAAa,4BAA4B,CACvF,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5D,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAC3B,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAgB,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,MAAgB,CAAC,CAAC;YACvD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,KAAK,IAAI,WAAW,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;gBACxF,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,gCAAgC,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC;QACD,OAAO,CAAC,IAAI,CAAC;YACX,OAAO;YACP,KAAK,EAAE,GAAG,KAAK,CAAC,IAAI,YAAY,OAAO,OAAO;YAC9C,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,KAAK,EAAE,IAAY,EAAE,EAAE;gBAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACpC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,YAAY,qBAAqB,IAAI,GAAG,CAAC,CAAC;gBACzF,CAAC;gBACD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,MAAgB,CAAC,CAAC;gBACvD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,KAAK,IAAI,WAAW,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;oBACxF,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,gCAAgC,CAAC,CAAC;gBAC5F,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;gBACjC,IAAI,aAAa,CAAC,YAAY,CAAC,KAAK,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;oBAClE,MAAM,IAAI,KAAK,CACb,6BAA6B,YAAY,wCAAwC,CAClF,CAAC;gBACJ,CAAC;YACH,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAgB,CAAC,CAAC,CAAC;IAC3F,IACE,iBAAiB,CAAC,IAAI,KAAK,eAAe,CAAC,IAAI;QAC/C,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,EACjF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,aAAa,GAAG;QACpB,oBAAoB;QACpB,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CACrB,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,iBAAiB,CAAC,MAAM,CAAC,eAAyB,CAAC,OAAO,CAClF;QACD,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,iBAAiB,CAAC,MAAM,CAAC,MAAgB,CAAC,EAAE,CAAC;KAC7F,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAChC,MAAM,WAAW,GAAG,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SAC/C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SAC9D,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACjC,IAAI,aAAa,CAAC,WAAW,CAAC,KAAK,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,0BAA0B,kBAAkB,8BAA8B,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO;QACL,MAAM,EAAE,kBAA4B;QACpC,OAAO;KACR,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,MAAqC,EACrC,YAAqC,EACrC,MAAc,EACd,KAA4B,EAC5B,OAA6B,EAC7B,UAAgC;IAEhC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;SACpC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;SACnE,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,WAAW,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,EAAE,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5E,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QACrC,IACE,IAAI,KAAK,GAAG,MAAM,GAAG,iBAAiB,CAAC,aAAa,CAAC,OAAO;YAC5D,UAAU,CAAC,KAAK,CAAC,KAAK,aAAa,EACnC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,mBAAmB,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAE,MAAyB;IAClE,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAClE,IAAI,aAAa,CAAC,MAAM,CAAC,KAAK,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,0CAA0C,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,MAAyB;IAC5D,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,oCAAoC,KAAK,UAAU,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAAgF,EAChF,MAA+B,EAC/B,YAAoB;IAEpB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,6BAA6B,YAAY,6BAA6B,CAAC,CAAC;IAC1F,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,KAAK,CAAC,6BAA6B,YAAY,2BAA2B,CAAC,CAAC;QACxF,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QACrE,IAAI,OAAO,KAAK,MAAM,CAAC,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,6BAA6B,YAAY,iCAAiC,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,KAAa,EACb,QAA2B,EAC3B,MAAyB;IAEzB,IACE,aAAa,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAC1D,aAAa,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,EACxD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,yBAAyB,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,MAAsB,EACtB,MAAoB,EACpB,KAAa,EACb,EAAwB;IAExB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,KAAK,IAAI,aAAa,CAAC,KAAK,CAAC,KAAK,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,GAAG,yBAAyB,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CACjB,MAA2B,EAC3B,MAAmC,EACnC,KAAa;IAEb,KAAK,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACvC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,YAAY,yBAAyB,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAsC,KAAQ,EAAE,GAAM;IACvE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IACpC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAClB,KAAQ,EACR,IAAkB;IAElB,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/modules/release/src/evidence-bundle-tree.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Byte-exact verification of an evidence authority bundle's file tree: every
+ * object present, declared, safely pathed, and matching its manifest digest.
+ * Split from evidence-admission so admission keeps its semantic checks and
+ * this module owns the storage shape.
+ */
+export declare function verifyBundleTree(directory: string, declarations: Record<string, {
+    readonly sha256: string;
+    readonly bytes: number;
+}>): Promise<void>;
+export declare function assertOnlyObjectPaths(declarations: Record<string, unknown>, prefix: string, expected: readonly string[]): void;
+export declare function assertSafeObjectPath(path: string): void;
+export declare function filesUnder(path: string): Promise<string[]>;
+//# sourceMappingURL=evidence-bundle-tree.d.ts.map

package/dist/modules/release/src/evidence-bundle-tree.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence-bundle-tree.d.ts","sourceRoot":"","sources":["../../../../modules/release/src/evidence-bundle-tree.ts"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GAChF,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACrC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,IAAI,CAON;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAUvD;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAahE"}