@sourcey/catalog-verifier 1.0.0

package/dist/modules/artifact/src/trust-history.js

@@ -0,0 +1,134 @@
+import { basename } from "node:path";
+import { rootSetSchema, rootSetTransitionSchema, signerRegistrySchema, } from "../../../contracts/authority/src/index.js";
+import { validateRootSetTransition, validateSignerRegistry } from "../../authority/src/index.js";
+import { digest, digestFromPathSegment } from "../../primitives/src/index.js";
+export function validateTrustHistory(files, currentRootSet, currentRegistry) {
+    const rootSets = new Map();
+    const transitions = new Map();
+    const registries = new Map();
+    for (const [path, bytes] of files) {
+        if (path.startsWith("trust/roots/") && path.endsWith(".json")) {
+            const rootSet = rootSetSchema.parse(JSON.parse(bytes.toString("utf8")));
+            const rootDigest = digest(rootSet);
+            if (addressFromJsonPath(path) !== rootDigest || rootSets.has(rootDigest)) {
+                throw new Error(`Trust root ${path} is duplicate or misaddressed.`);
+            }
+            rootSets.set(rootDigest, rootSet);
+        }
+        else if (path.startsWith("trust/transitions/") && path.endsWith(".json")) {
+            const transition = rootSetTransitionSchema.parse(JSON.parse(bytes.toString("utf8")));
+            if (addressFromJsonPath(path) !== transition.transition_digest ||
+                digest(withoutKeys(transition, [
+                    "transition_digest",
+                    "previous_root_signatures",
+                    "next_root_signatures",
+                ])) !== transition.transition_digest ||
+                transitions.has(transition.next_root_set_digest)) {
+                throw new Error(`Trust transition ${path} is duplicate or misaddressed.`);
+            }
+            transitions.set(transition.next_root_set_digest, transition);
+        }
+        else if (path.startsWith("trust/registries/") && path.endsWith(".json")) {
+            const signerRegistry = signerRegistrySchema.parse(JSON.parse(bytes.toString("utf8")));
+            if (addressFromJsonPath(path) !== signerRegistry.registry_digest ||
+                registries.has(signerRegistry.registry_digest)) {
+                throw new Error(`Signer registry ${path} is duplicate or misaddressed.`);
+            }
+            registries.set(signerRegistry.registry_digest, signerRegistry);
+        }
+    }
+    const currentRootDigest = digest(currentRootSet);
+    if (!rootSets.has(currentRootDigest)) {
+        throw new Error("Current trust root is absent from trust history.");
+    }
+    const trustedRoots = new Map();
+    const usedTransitions = new Set();
+    let rootDigest = currentRootDigest;
+    while (true) {
+        const rootSet = rootSets.get(rootDigest);
+        if (!rootSet || trustedRoots.has(rootDigest)) {
+            throw new Error("Trust-root history is missing or cyclic.");
+        }
+        trustedRoots.set(rootDigest, rootSet);
+        const transition = transitions.get(rootDigest);
+        if (!transition)
+            break;
+        const previousRoot = rootSets.get(transition.previous_root_set_digest);
+        if (!previousRoot)
+            throw new Error("Trust-root history lacks a transition predecessor.");
+        validateRootSetTransition({
+            previousRootSet: previousRoot,
+            nextRootSet: rootSet,
+            transition,
+            releaseSequence: transition.effective_release_sequence,
+        });
+        usedTransitions.add(transition.transition_digest);
+        rootDigest = transition.previous_root_set_digest;
+    }
+    if (trustedRoots.size !== rootSets.size || usedTransitions.size !== transitions.size) {
+        throw new Error("Release contains trust roots or transitions outside the current trust lineage.");
+    }
+    const currentRegistryDigest = currentRegistry.registry_digest;
+    if (!registries.has(currentRegistryDigest)) {
+        throw new Error("Current signer registry is absent from trust history.");
+    }
+    const trustedRegistries = new Map();
+    let registry = currentRegistry;
+    while (registry) {
+        if (trustedRegistries.has(registry.registry_digest)) {
+            throw new Error("Signer-registry history is cyclic.");
+        }
+        const validated = validateRegistryUnderTrustedRoot(registry, trustedRoots);
+        trustedRegistries.set(validated.registry_digest, validated);
+        if (registry.parent_registry_digest === null) {
+            if (registry.generation !== 1) {
+                throw new Error("Signer-registry history does not terminate at generation one.");
+            }
+            break;
+        }
+        const parent = registries.get(registry.parent_registry_digest);
+        if (!parent || parent.generation !== registry.generation - 1) {
+            throw new Error("Signer-registry history is not adjacent and predecessor-bound.");
+        }
+        registry = parent;
+    }
+    for (const candidate of registries.values()) {
+        if (trustedRegistries.has(candidate.registry_digest))
+            continue;
+        if (candidate.parent_registry_digest === null) {
+            if (candidate.generation !== 1) {
+                throw new Error("Historical signer-registry branches must terminate at generation one.");
+            }
+        }
+        else {
+            const parent = registries.get(candidate.parent_registry_digest);
+            if (!parent || parent.generation !== candidate.generation - 1) {
+                throw new Error("Historical signer-registry branches must be adjacent and complete.");
+            }
+        }
+        const validated = validateRegistryUnderTrustedRoot(candidate, trustedRoots);
+        trustedRegistries.set(validated.registry_digest, validated);
+    }
+    return trustedRegistries;
+}
+function validateRegistryUnderTrustedRoot(registry, trustedRoots) {
+    for (const rootSet of trustedRoots.values()) {
+        try {
+            return validateSignerRegistry(rootSet, registry);
+        }
+        catch {
+            // A historical registry needs to validate under only one root in the trusted lineage.
+        }
+    }
+    throw new Error(`Signer registry ${registry.registry_digest} has no valid root in the trusted lineage.`);
+}
+function addressFromJsonPath(path) {
+    return digestFromPathSegment(basename(path, ".json"));
+}
+function withoutKeys(value, keys) {
+    const copy = { ...value };
+    for (const key of keys)
+        delete copy[key];
+    return copy;
+}
+//# sourceMappingURL=trust-history.js.map

package/dist/modules/artifact/src/trust-history.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-history.js","sourceRoot":"","sources":["../../../../modules/artifact/src/trust-history.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAEL,aAAa,EACb,uBAAuB,EAEvB,oBAAoB,GACrB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACjG,OAAO,EAAe,MAAM,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3F,MAAM,UAAU,oBAAoB,CAClC,KAAkC,EAClC,cAAuB,EACvB,eAA+B;IAE/B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC5C,MAAM,WAAW,GAAG,IAAI,GAAG,EAA4D,CAAC;IACxF,MAAM,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAC;IAErD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9D,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACxE,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,UAAU,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzE,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,gCAAgC,CAAC,CAAC;YACtE,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3E,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACrF,IACE,mBAAmB,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,iBAAiB;gBAC1D,MAAM,CACJ,WAAW,CAAC,UAAU,EAAE;oBACtB,mBAAmB;oBACnB,0BAA0B;oBAC1B,sBAAsB;iBACvB,CAAC,CACH,KAAK,UAAU,CAAC,iBAAiB;gBAClC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,oBAA8B,CAAC,EAC1D,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,gCAAgC,CAAC,CAAC;YAC5E,CAAC;YACD,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,oBAA8B,EAAE,UAAU,CAAC,CAAC;QACzE,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1E,MAAM,cAAc,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACtF,IACE,mBAAmB,CAAC,IAAI,CAAC,KAAK,cAAc,CAAC,eAAe;gBAC5D,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,eAAyB,CAAC,EACxD,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,gCAAgC,CAAC,CAAC;YAC3E,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,eAAyB,EAAE,cAAc,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAmB,CAAC;IAChD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,IAAI,UAAU,GAAG,iBAAiB,CAAC;IACnC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,IAAI,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACtC,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU;YAAE,MAAM;QACvB,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,wBAAkC,CAAC,CAAC;QACjF,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACzF,yBAAyB,CAAC;YACxB,eAAe,EAAE,YAAY;YAC7B,WAAW,EAAE,OAAO;YACpB,UAAU;YACV,eAAe,EAAE,UAAU,CAAC,0BAA0B;SACvD,CAAC,CAAC;QACH,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,iBAA2B,CAAC,CAAC;QAC5D,UAAU,GAAG,UAAU,CAAC,wBAAkC,CAAC;IAC7D,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,IAAI,eAAe,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI,EAAE,CAAC;QACrF,MAAM,IAAI,KAAK,CACb,gFAAgF,CACjF,CAAC;IACJ,CAAC;IAED,MAAM,qBAAqB,GAAG,eAAe,CAAC,eAAyB,CAAC;IACxE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC5D,IAAI,QAAQ,GAA+B,eAAe,CAAC;IAC3D,OAAO,QAAQ,EAAE,CAAC;QAChB,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,SAAS,GAAG,gCAAgC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC3E,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;QAC5D,IAAI,QAAQ,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;YAC7C,IAAI,QAAQ,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;YACnF,CAAC;YACD,MAAM;QACR,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,sBAAgC,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;QACD,QAAQ,GAAG,MAAM,CAAC;IACpB,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5C,IAAI,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC;YAAE,SAAS;QAC/D,IAAI,SAAS,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;YAC9C,IAAI,SAAS,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;YAC3F,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,sBAAgC,CAAC,CAAC;YAC1E,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;YACxF,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GAAG,gCAAgC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAC5E,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,gCAAgC,CACvC,QAAwB,EACxB,YAA0C;IAE1C,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5C,IAAI,CAAC;YACH,OAAO,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,sFAAsF;QACxF,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,CAAC,eAAe,4CAA4C,CACxF,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,OAAO,qBAAqB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,WAAW,CAClB,KAAQ,EACR,IAAkB;IAElB,MAAM,IAAI,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/modules/assets/src/authority-bundle.d.ts

@@ -0,0 +1,36 @@
+import { type AssetAuthorityBundleManifest, type EntityAssetProposal, type EntityAssetReviewArtifact } from "../../../contracts/assets/src/index.js";
+import type { SignerRegistry } from "../../../contracts/authority/src/index.js";
+import { type CatalogEvent, type CatalogEventCore } from "../../../contracts/events/src/index.js";
+import type { CatalogPublicationProposal } from "../../../contracts/publication/src/index.js";
+import { type Digest } from "../../primitives/src/index.js";
+export interface ReadAssetAuthorityBundle {
+    readonly manifest: AssetAuthorityBundleManifest;
+    readonly proposals: readonly EntityAssetProposal[];
+    readonly reviews: readonly EntityAssetReviewArtifact[];
+    readonly events: readonly CatalogEvent[];
+    readonly safeBytes: ReadonlyMap<Digest, Buffer>;
+}
+export declare function createAssetBindingEventIntent(input: {
+    readonly proposal: EntityAssetProposal;
+    readonly issuerId: string;
+}): {
+    readonly event_id: Digest;
+    readonly core: CatalogEventCore;
+};
+export declare function readAssetAuthorityBundle(root: string): Promise<ReadAssetAuthorityBundle>;
+export declare function admitAssetAuthorityBundle(input: {
+    readonly bundle: ReadAssetAuthorityBundle;
+    readonly publicationProposal: CatalogPublicationProposal;
+    readonly targetRegistry: SignerRegistry;
+    readonly targetReleaseSequence: number;
+}): {
+    readonly authoritySetDigest: Digest;
+    readonly proposals: readonly EntityAssetProposal[];
+    readonly events: readonly CatalogEvent[];
+    readonly safeBytes: ReadonlyMap<Digest, Buffer>;
+};
+export declare function assetAuthorityObjectPaths(input: {
+    readonly proposals: readonly EntityAssetProposal[];
+    readonly events: readonly CatalogEvent[];
+}): readonly string[];
+//# sourceMappingURL=authority-bundle.d.ts.map

package/dist/modules/assets/src/authority-bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-bundle.d.ts","sourceRoot":"","sources":["../../../../modules/assets/src/authority-bundle.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,KAAK,4BAA4B,EAGjC,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAG/B,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAChF,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,gBAAgB,EAGtB,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAE9F,OAAO,EAGL,KAAK,MAAM,EAMZ,MAAM,+BAA+B,CAAC;AAGvC,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC;IAChD,QAAQ,CAAC,SAAS,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACnD,QAAQ,CAAC,OAAO,EAAE,SAAS,yBAAyB,EAAE,CAAC;IACvD,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjD;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,CAgCjE;AAED,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAiH9F;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,mBAAmB,EAAE,0BAA0B,CAAC;IACzD,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;CACxC,GAAG;IACF,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjD,CA0DA;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,SAAS,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC;CAC1C,GAAG,SAAS,MAAM,EAAE,CAcpB"}

package/dist/modules/assets/src/authority-bundle.js

@@ -0,0 +1,206 @@
+import { readdir, readFile } from "node:fs/promises";
+import { basename, join, relative, sep } from "node:path";
+import { assetAuthorityBundleCoreSchema, assetAuthorityBundleManifestSchema, entityAssetReviewArtifactCoreSchema, entityAssetReviewArtifactSchema, } from "../../../contracts/assets/src/index.js";
+import { catalogEventCoreSchema, catalogEventSchema, } from "../../../contracts/events/src/index.js";
+import { validateProtectedEvent } from "../../authority/src/index.js";
+import { canonicalJson, compareCanonicalStrings, deriveOperationId, digest, digestFromPathSegment, digestPathSegment, sha256Bytes, } from "../../primitives/src/index.js";
+import { verifyEntityAssetProposal } from "./index.js";
+export function createAssetBindingEventIntent(input) {
+    const proposal = verifyEntityAssetProposal(input.proposal);
+    const core = catalogEventCoreSchema.parse({
+        event_contract: "sourcey.catalog-event/v1alpha1",
+        kind: "asset.bound",
+        issuer_id: input.issuerId,
+        operation_id: deriveOperationId("sourcey.asset-binding/v1alpha1", {
+            proposal_digest: proposal.proposal_digest,
+            issuer_id: input.issuerId,
+        }),
+        subject: {
+            subject_type: "entity",
+            entity_id: proposal.entity_id,
+        },
+        occurred_at: proposal.effective_from,
+        payload: {
+            role: proposal.role,
+            asset_object_digest: proposal.asset.asset_object_digest,
+            served_derivative_digest: proposal.served_digest,
+            authority_basis: proposal.authority_basis,
+            ...(proposal.authority_claim_id ? { authority_claim_id: proposal.authority_claim_id } : {}),
+            approval_receipt_digest: proposal.review.review_artifact_digest,
+            approval_scope: proposal.approval_scope,
+            source_basis: proposal.source_basis,
+            license_basis: proposal.asset.redistribution.basis,
+            effective_from: proposal.effective_from,
+            ...(proposal.expected_current_binding_event_id
+                ? { superseded_binding_event_id: proposal.expected_current_binding_event_id }
+                : {}),
+        },
+    });
+    return { event_id: digest(core), core };
+}
+export async function readAssetAuthorityBundle(root) {
+    const manifestBytes = await readFile(join(root, "manifest.json"));
+    const manifest = assetAuthorityBundleManifestSchema.parse(JSON.parse(manifestBytes.toString("utf8")));
+    const { bundle_digest: bundleDigest, ...core } = manifest;
+    if (digest(assetAuthorityBundleCoreSchema.parse(core)) !== bundleDigest) {
+        throw new Error("Asset authority bundle is not content addressed.");
+    }
+    const expectedPaths = ["manifest.json", ...Object.keys(manifest.objects)].sort(compareCanonicalStrings);
+    const actualPaths = (await filesUnder(root))
+        .map((path) => relative(root, path).split(sep).join("/"))
+        .sort(compareCanonicalStrings);
+    if (canonicalJson(actualPaths) !== canonicalJson(expectedPaths)) {
+        throw new Error("Asset authority bundle has an unexpected file set.");
+    }
+    const objects = new Map();
+    for (const [path, declaration] of Object.entries(manifest.objects)) {
+        assertSafeRelativePath(path);
+        const bytes = await readFile(join(root, path));
+        if (bytes.byteLength !== declaration.bytes || sha256Bytes(bytes) !== declaration.sha256) {
+            throw new Error(`Asset authority bundle object ${path} differs.`);
+        }
+        objects.set(path, bytes);
+    }
+    const proposals = [...objects.entries()]
+        .filter(([path]) => path.startsWith("proposals/"))
+        .map(([path, bytes]) => {
+        const proposal = verifyEntityAssetProposal(JSON.parse(bytes.toString("utf8")));
+        if (proposal.proposal_digest !== digestFromPathSegment(basename(path, ".json"))) {
+            throw new Error(`Asset proposal ${path} is stored under the wrong address.`);
+        }
+        return proposal;
+    })
+        .sort((left, right) => compareCanonicalStrings(left.proposal_digest, right.proposal_digest));
+    const events = [...objects.entries()]
+        .filter(([path]) => path.startsWith("events/"))
+        .map(([path, bytes]) => {
+        const event = catalogEventSchema.parse(JSON.parse(bytes.toString("utf8")));
+        if (event.event_id !== digestFromPathSegment(basename(path, ".json"))) {
+            throw new Error(`Asset event ${path} is stored under the wrong address.`);
+        }
+        return event;
+    })
+        .sort((left, right) => compareCanonicalStrings(left.event_id, right.event_id));
+    const reviews = [...objects.entries()]
+        .filter(([path]) => path.startsWith("reviews/"))
+        .map(([path, bytes]) => {
+        const review = entityAssetReviewArtifactSchema.parse(JSON.parse(bytes.toString("utf8")));
+        const { review_artifact_digest: reviewDigest, ...reviewCore } = review;
+        if (digest(entityAssetReviewArtifactCoreSchema.parse(reviewCore)) !== reviewDigest ||
+            reviewDigest !== digestFromPathSegment(basename(path, ".json"))) {
+            throw new Error(`Asset review ${path} is stored under the wrong address.`);
+        }
+        return review;
+    })
+        .sort((left, right) => compareCanonicalStrings(left.review_artifact_digest, right.review_artifact_digest));
+    const safeBytes = new Map();
+    for (const [path, bytes] of objects) {
+        if (!path.startsWith("assets/sha256/"))
+            continue;
+        const objectDigest = digestFromPathSegment(basename(path));
+        if (sha256Bytes(bytes) !== objectDigest) {
+            throw new Error(`Safe asset ${path} is stored under the wrong address.`);
+        }
+        safeBytes.set(objectDigest, bytes);
+    }
+    if (canonicalJson(proposals.map((proposal) => proposal.proposal_digest)) !==
+        canonicalJson(manifest.asset_proposal_digests) ||
+        canonicalJson(events.map((event) => event.event_id)) !== canonicalJson(manifest.event_ids)) {
+        throw new Error("Asset authority bundle manifest disagrees with its objects.");
+    }
+    for (const proposal of proposals) {
+        const bytes = safeBytes.get(proposal.served_digest);
+        const variant = proposal.asset.safe_variants.find((candidate) => candidate.digest === proposal.served_digest);
+        if (!bytes || !variant || bytes.byteLength !== variant.bytes) {
+            throw new Error(`Asset proposal ${proposal.proposal_digest} lacks its exact safe bytes.`);
+        }
+        const review = reviews.find((candidate) => candidate.review_artifact_digest === proposal.review.review_artifact_digest);
+        if (!review || canonicalJson(review) !== canonicalJson(proposal.review)) {
+            throw new Error(`Asset proposal ${proposal.proposal_digest} lacks its exact review artifact.`);
+        }
+    }
+    const referencedSafeDigests = new Set(proposals.map(({ served_digest: servedDigest }) => servedDigest));
+    if (safeBytes.size !== referencedSafeDigests.size ||
+        [...safeBytes.keys()].some((safeDigest) => !referencedSafeDigests.has(safeDigest))) {
+        throw new Error("Asset authority bundle contains a missing or unreferenced safe object.");
+    }
+    if (reviews.length !== proposals.length ||
+        new Set(reviews.map(({ review_artifact_digest: reviewDigest }) => reviewDigest)).size !==
+            reviews.length) {
+        throw new Error("Asset authority bundle must contain one unique review per proposal.");
+    }
+    return { manifest, proposals, reviews, events, safeBytes };
+}
+export function admitAssetAuthorityBundle(input) {
+    if (input.bundle.manifest.publication_proposal_digest !==
+        input.publicationProposal.proposal_digest ||
+        input.bundle.manifest.base_release_id !== input.publicationProposal.live_parent_release_id ||
+        input.bundle.manifest.target_signer_registry_digest !== input.targetRegistry.registry_digest) {
+        throw new Error("Asset authority bundle targets another publication or trust context.");
+    }
+    const declared = new Map(input.publicationProposal.candidate_assets.map((proposal) => [
+        proposal.proposal_digest,
+        proposal,
+    ]));
+    if (declared.size !== input.bundle.proposals.length ||
+        input.bundle.proposals.some((proposal) => canonicalJson(declared.get(proposal.proposal_digest)) !== canonicalJson(proposal))) {
+        throw new Error("Asset authority bundle differs from the publication asset proposal set.");
+    }
+    const expected = new Map(input.bundle.proposals.map((proposal) => {
+        const intent = createAssetBindingEventIntent({
+            proposal,
+            issuerId: input.bundle.manifest.issuer_id,
+        });
+        return [intent.event_id, intent];
+    }));
+    if (expected.size !== input.bundle.events.length) {
+        throw new Error("Asset authority bundle does not contain one exact event per proposal.");
+    }
+    for (const inputEvent of input.bundle.events) {
+        const event = validateProtectedEvent(inputEvent, input.targetRegistry, input.targetReleaseSequence);
+        if (event.protected.signature_purpose !== "catalog-identity") {
+            throw new Error("Asset authority event uses the wrong signing purpose.");
+        }
+        const intent = expected.get(event.event_id);
+        if (!intent)
+            throw new Error(`Asset authority bundle has unexpected event ${event.event_id}.`);
+        const { event_id: _, protected: __, ...eventCore } = event;
+        if (canonicalJson(eventCore) !== canonicalJson(intent.core)) {
+            throw new Error(`Asset authority event ${event.event_id} differs from its intent.`);
+        }
+    }
+    return {
+        authoritySetDigest: input.bundle.manifest.bundle_digest,
+        proposals: input.bundle.proposals,
+        events: input.bundle.events,
+        safeBytes: input.bundle.safeBytes,
+    };
+}
+export function assetAuthorityObjectPaths(input) {
+    return [
+        ...input.proposals.map((proposal) => `proposals/${digestPathSegment(proposal.proposal_digest)}.json`),
+        ...input.proposals.map((proposal) => `reviews/${digestPathSegment(proposal.review.review_artifact_digest)}.json`),
+        ...input.events.map((event) => `events/${digestPathSegment(event.event_id)}.json`),
+        ...input.proposals.map((proposal) => `assets/sha256/${digestPathSegment(proposal.served_digest)}`),
+    ].sort(compareCanonicalStrings);
+}
+function assertSafeRelativePath(path) {
+    const segments = path.split("/");
+    if (!path ||
+        path.startsWith("/") ||
+        path.includes("\\") ||
+        segments.some((segment) => !segment || segment === "." || segment === "..")) {
+        throw new Error(`Asset authority bundle has unsafe object path ${path}.`);
+    }
+}
+async function filesUnder(directory) {
+    const entries = await readdir(directory, { withFileTypes: true });
+    return (await Promise.all(entries.map((entry) => {
+        const path = join(directory, entry.name);
+        if (entry.isSymbolicLink()) {
+            throw new Error(`Asset authority bundle contains a symlink: ${path}.`);
+        }
+        return entry.isDirectory() ? filesUnder(path) : [path];
+    }))).flat();
+}
+//# sourceMappingURL=authority-bundle.js.map

package/dist/modules/assets/src/authority-bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-bundle.js","sourceRoot":"","sources":["../../../../modules/assets/src/authority-bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAEL,8BAA8B,EAC9B,kCAAkC,EAGlC,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,wCAAwC,CAAC;AAEhD,OAAO,EAGL,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,wCAAwC,CAAC;AAEhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EACL,aAAa,EACb,uBAAuB,EAEvB,iBAAiB,EACjB,MAAM,EACN,qBAAqB,EACrB,iBAAiB,EACjB,WAAW,GACZ,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAUvD,MAAM,UAAU,6BAA6B,CAAC,KAG7C;IACC,MAAM,QAAQ,GAAG,yBAAyB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC;QACxC,cAAc,EAAE,gCAAgC;QAChD,IAAI,EAAE,aAAa;QACnB,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,YAAY,EAAE,iBAAiB,CAAC,gCAAgC,EAAE;YAChE,eAAe,EAAE,QAAQ,CAAC,eAAe;YACzC,SAAS,EAAE,KAAK,CAAC,QAAQ;SAC1B,CAAC;QACF,OAAO,EAAE;YACP,YAAY,EAAE,QAAQ;YACtB,SAAS,EAAE,QAAQ,CAAC,SAAS;SAC9B;QACD,WAAW,EAAE,QAAQ,CAAC,cAAc;QACpC,OAAO,EAAE;YACP,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,mBAAmB,EAAE,QAAQ,CAAC,KAAK,CAAC,mBAAmB;YACvD,wBAAwB,EAAE,QAAQ,CAAC,aAAa;YAChD,eAAe,EAAE,QAAQ,CAAC,eAAe;YACzC,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,sBAAsB;YAC/D,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK;YAClD,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,GAAG,CAAC,QAAQ,CAAC,iCAAiC;gBAC5C,CAAC,CAAC,EAAE,2BAA2B,EAAE,QAAQ,CAAC,iCAAiC,EAAE;gBAC7E,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC,CAAC;IACH,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAAY;IACzD,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,kCAAkC,CAAC,KAAK,CACvD,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAC3C,CAAC;IACF,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC;IAC1D,IAAI,MAAM,CAAC,8BAA8B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,eAAe,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAC5E,uBAAuB,CACxB,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;SACzC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SACxD,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACjC,IAAI,aAAa,CAAC,WAAW,CAAC,KAAK,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACnE,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/C,IAAI,KAAK,CAAC,UAAU,KAAK,WAAW,CAAC,KAAK,IAAI,WAAW,CAAC,KAAK,CAAC,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;YACxF,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,WAAW,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;SACrC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;SACjD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;QACrB,MAAM,QAAQ,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/E,IAAI,QAAQ,CAAC,eAAe,KAAK,qBAAqB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,qCAAqC,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAC/F,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;SAC9C,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;QACrB,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3E,IAAI,KAAK,CAAC,QAAQ,KAAK,qBAAqB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,qCAAqC,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;SACnC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;SAC/C,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,+BAA+B,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACzF,MAAM,EAAE,sBAAsB,EAAE,YAAY,EAAE,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC;QACvE,IACE,MAAM,CAAC,mCAAmC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,YAAY;YAC9E,YAAY,KAAK,qBAAqB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAC/D,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,qCAAqC,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,uBAAuB,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB,CAAC,CACnF,CAAC;IACJ,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;YAAE,SAAS;QACjD,MAAM,YAAY,GAAG,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3D,IAAI,WAAW,CAAC,KAAK,CAAC,KAAK,YAAY,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,qCAAqC,CAAC,CAAC;QAC3E,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IACD,IACE,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAClE,aAAa,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAChD,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,EAC1F,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAuB,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAC/C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,aAAa,CAC3D,CAAC;QACF,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,UAAU,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,CAAC,eAAe,8BAA8B,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CACzB,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,sBAAsB,KAAK,QAAQ,CAAC,MAAM,CAAC,sBAAsB,CAC3F,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,KAAK,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,CAAC,eAAe,mCAAmC,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CACnC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,CACjE,CAAC;IACF,IACE,SAAS,CAAC,IAAI,KAAK,qBAAqB,CAAC,IAAI;QAC7C,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAClF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IACD,IACE,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QACnC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;YACnF,OAAO,CAAC,MAAM,EAChB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAKzC;IAMC,IACE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,2BAA2B;QAC/C,KAAK,CAAC,mBAAmB,CAAC,eAAe;QAC3C,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,KAAK,KAAK,CAAC,mBAAmB,CAAC,sBAAsB;QAC1F,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,KAAK,KAAK,CAAC,cAAc,CAAC,eAAe,EAC5F,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,KAAK,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC3D,QAAQ,CAAC,eAAe;QACxB,QAAQ;KACT,CAAC,CACH,CAAC;IACF,IACE,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM;QAC/C,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CACzB,CAAC,QAAQ,EAAE,EAAE,CACX,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,KAAK,aAAa,CAAC,QAAQ,CAAC,CACpF,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,6BAA6B,CAAC;YAC3C,QAAQ;YACR,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS;SAC1C,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAU,CAAC;IAC5C,CAAC,CAAC,CACH,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,sBAAsB,CAClC,UAAU,EACV,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,qBAAqB,CAC5B,CAAC;QACF,IAAI,KAAK,CAAC,SAAS,CAAC,iBAAiB,KAAK,kBAAkB,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAkB,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC/F,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,SAAS,EAAE,GAAG,KAAK,CAAC;QAC3D,IAAI,aAAa,CAAC,SAAS,CAAC,KAAK,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,CAAC,QAAQ,2BAA2B,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,OAAO;QACL,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAuB;QACjE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;QAC3B,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAGzC;IACC,OAAO;QACL,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CACpB,CAAC,QAAQ,EAAE,EAAE,CAAC,aAAa,iBAAiB,CAAC,QAAQ,CAAC,eAAyB,CAAC,OAAO,CACxF;QACD,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CACpB,CAAC,QAAQ,EAAE,EAAE,CACX,WAAW,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,sBAAgC,CAAC,OAAO,CACxF;QACD,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,iBAAiB,CAAC,KAAK,CAAC,QAAkB,CAAC,OAAO,CAAC;QAC5F,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CACpB,CAAC,QAAQ,EAAE,EAAE,CAAC,iBAAiB,iBAAiB,CAAC,QAAQ,CAAC,aAAuB,CAAC,EAAE,CACrF;KACF,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IACE,CAAC,IAAI;QACL,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,EAC3E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,IAAI,GAAG,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,SAAiB;IACzC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,OAAO,CACL,MAAM,OAAO,CAAC,GAAG,CACf,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC,CAAC,CACH,CACF,CAAC,IAAI,EAAE,CAAC;AACX,CAAC"}

package/dist/modules/assets/src/delta.d.ts

@@ -0,0 +1,18 @@
+import type { AssetBindingProjection, AssetDelta, EntityAssetProposal } from "../../../contracts/assets/src/index.js";
+import type { CatalogEvent } from "../../../contracts/events/src/index.js";
+import { type Digest } from "../../primitives/src/index.js";
+export declare function buildAssetDelta(input: {
+    readonly parentAssetIndexDigest: Digest;
+    readonly proposals: readonly EntityAssetProposal[];
+    readonly events: readonly CatalogEvent[];
+    readonly currentBindings: readonly AssetBindingProjection[];
+    readonly removedEntityIds?: readonly string[];
+}): AssetDelta;
+export declare function assetIndexTransitionDigest(delta: AssetDelta): Digest;
+export declare function applyAssetDelta(input: {
+    readonly currentBindings: readonly AssetBindingProjection[];
+    readonly delta: AssetDelta;
+    readonly requiredEntityIds?: ReadonlySet<string>;
+}): readonly AssetBindingProjection[];
+export declare function eventMatchesEntityAssetProposal(event: CatalogEvent, proposal: EntityAssetProposal): boolean;
+//# sourceMappingURL=delta.d.ts.map

package/dist/modules/assets/src/delta.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delta.d.ts","sourceRoot":"","sources":["../../../../modules/assets/src/delta.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,sBAAsB,EACtB,UAAU,EACV,mBAAmB,EACpB,MAAM,wCAAwC,CAAC;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AAE3E,OAAO,EAGL,KAAK,MAAM,EAEZ,MAAM,+BAA+B,CAAC;AAIvC,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC;IACzC,QAAQ,CAAC,eAAe,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAC5D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C,GAAG,UAAU,CAkGb;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAmBpE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,QAAQ,CAAC,eAAe,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAC5D,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAClD,GAAG,SAAS,sBAAsB,EAAE,CA0CpC;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,YAAY,EACnB,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAkBT"}

package/dist/modules/assets/src/delta.js

@@ -0,0 +1,183 @@
+import { assetDeltaCoreSchema, assetIndexSchema } from "../../../contracts/assets/src/index.js";
+import { catalogEventPayloadSchemas } from "../../../contracts/events/src/index.js";
+import { canonicalJson, compareCanonicalStrings, digest, } from "../../primitives/src/index.js";
+import { eventDisposesAssetBinding } from "./disposition.js";
+import { verifyAssetDelta, verifyEntityAssetProposal } from "./index.js";
+export function buildAssetDelta(input) {
+    const current = bindingMap(input.currentBindings);
+    const events = input.events.filter((event) => event.kind === "asset.bound");
+    const upserts = input.proposals
+        .map(verifyEntityAssetProposal)
+        .map((proposal) => {
+        const key = bindingKey(proposal.entity_id, proposal.role);
+        const prior = current.get(key);
+        if ((prior?.binding_event_id ?? null) !== proposal.expected_current_binding_event_id) {
+            throw new Error(`Asset proposal ${proposal.proposal_digest} has a stale live binding.`);
+        }
+        const matching = events.filter((event) => eventMatchesEntityAssetProposal(event, proposal));
+        if (matching.length !== 1) {
+            throw new Error(`Asset proposal ${proposal.proposal_digest} requires one exact protected binding event.`);
+        }
+        const event = matching[0];
+        if (!event)
+            throw new Error("Asset binding event disappeared.");
+        const payload = catalogEventPayloadSchemas["asset.bound"].parse(event.payload);
+        const variant = proposal.asset.safe_variants.find((candidate) => candidate.digest === proposal.served_digest);
+        if (!variant)
+            throw new Error("Asset proposal lost its served safe variant.");
+        const binding = {
+            entity_id: proposal.entity_id,
+            role: proposal.role,
+            asset_object_digest: proposal.asset.asset_object_digest,
+            served_digest: proposal.served_digest,
+            served_path: `assets/${variant.served_path}`,
+            media_type: variant.media_type,
+            bytes: variant.bytes,
+            width: variant.width,
+            height: variant.height,
+            authority_basis: payload.authority_basis,
+            ...(payload.authority_claim_id ? { authority_claim_id: payload.authority_claim_id } : {}),
+            approval_receipt_digest: payload.approval_receipt_digest,
+            source_basis: payload.source_basis,
+            license_basis: payload.license_basis,
+            effective_from: payload.effective_from,
+            ...(payload.effective_until ? { effective_until: payload.effective_until } : {}),
+            binding_event_id: event.event_id,
+        };
+        return {
+            operation: "upsert",
+            entity_id: proposal.entity_id,
+            role: proposal.role,
+            prior_binding_event_id: prior?.binding_event_id ?? null,
+            binding,
+            asset: proposal.asset,
+            original_path: proposal.asset.original.source_path,
+            safe_variant_path: variant.source_path,
+        };
+    })
+        .sort((left, right) => compareCanonicalStrings(bindingKey(left.entity_id, left.role), bindingKey(right.entity_id, right.role)));
+    const removals = [...new Set(input.removedEntityIds ?? [])]
+        .sort(compareCanonicalStrings)
+        .map((entityId) => {
+        const prior = current.get(bindingKey(entityId, "icon"));
+        if (!prior) {
+            throw new Error(`Removed Entity ${entityId} lacks its exact current icon binding.`);
+        }
+        const dispositions = input.events.filter((event) => eventDisposesAssetBinding(event, entityId, prior.binding_event_id));
+        if (dispositions.length !== 1) {
+            throw new Error(`Removed Entity ${entityId} requires one exact protected icon disposition event.`);
+        }
+        const disposition = dispositions[0];
+        if (!disposition)
+            throw new Error("Asset disposition event disappeared.");
+        return {
+            operation: "remove",
+            entity_id: entityId,
+            role: "icon",
+            prior_binding_event_id: prior.binding_event_id,
+            prior_binding_digest: digest(prior),
+            disposition_event_id: disposition.event_id,
+        };
+    });
+    const changes = [...upserts, ...removals].sort((left, right) => compareCanonicalStrings(bindingKey(left.entity_id, left.role), bindingKey(right.entity_id, right.role)));
+    const core = assetDeltaCoreSchema.parse({
+        delta_contract: "sourcey.asset-delta/v1alpha1",
+        parent_asset_index_digest: input.parentAssetIndexDigest,
+        changes,
+    });
+    return verifyAssetDelta({ ...core, delta_digest: digest(core) });
+}
+export function assetIndexTransitionDigest(delta) {
+    const verified = verifyAssetDelta(delta);
+    return digest({
+        transition_contract: "sourcey.projection-transition/v1alpha1",
+        projection: "asset-index",
+        parent_digest: verified.parent_asset_index_digest,
+        changes: verified.changes.map((change) => ({
+            entity_id: change.entity_id,
+            role: change.role,
+            prior_binding_event_id: change.prior_binding_event_id,
+            operation: change.operation,
+            ...(change.operation === "upsert"
+                ? { binding: change.binding }
+                : {
+                    prior_binding_digest: change.prior_binding_digest,
+                    disposition_event_id: change.disposition_event_id,
+                }),
+        })),
+    });
+}
+export function applyAssetDelta(input) {
+    const delta = verifyAssetDelta(input.delta);
+    const current = bindingMap(input.currentBindings);
+    for (const change of delta.changes) {
+        const key = bindingKey(change.entity_id, change.role);
+        const prior = current.get(key);
+        if ((prior?.binding_event_id ?? null) !== change.prior_binding_event_id) {
+            throw new Error(`Asset delta change ${key} does not match its current base.`);
+        }
+        if (change.operation === "upsert") {
+            current.set(key, change.binding);
+        }
+        else {
+            if (!prior || digest(prior) !== change.prior_binding_digest) {
+                throw new Error(`Asset removal ${key} has a stale prior projection digest.`);
+            }
+            current.delete(key);
+        }
+    }
+    const bindings = [...current.values()].sort((left, right) => compareCanonicalStrings(bindingKey(left.entity_id, left.role), bindingKey(right.entity_id, right.role)));
+    if (input.requiredEntityIds) {
+        const iconEntities = new Set(bindings.filter((binding) => binding.role === "icon").map((binding) => binding.entity_id));
+        const missing = [...input.requiredEntityIds].filter((entityId) => !iconEntities.has(entityId));
+        if (missing.length > 0) {
+            throw new Error(`Published Entities lack an icon binding: ${missing.join(", ")}.`);
+        }
+    }
+    assetIndexSchema.parse({
+        asset_index_contract: "sourcey.asset-index/v1alpha1",
+        bindings,
+        notices_digest: digest({
+            notices_contract: "sourcey.asset-notices-transition/v1alpha1",
+            assets: bindings.map((binding) => binding.asset_object_digest),
+        }),
+    });
+    return bindings;
+}
+export function eventMatchesEntityAssetProposal(event, proposal) {
+    if (event.kind !== "asset.bound" || event.subject.entity_id !== proposal.entity_id)
+        return false;
+    const parsed = catalogEventPayloadSchemas["asset.bound"].safeParse(event.payload);
+    if (!parsed.success)
+        return false;
+    const payload = parsed.data;
+    return (payload.role === proposal.role &&
+        payload.asset_object_digest === proposal.asset.asset_object_digest &&
+        payload.served_derivative_digest === proposal.served_digest &&
+        payload.authority_basis === proposal.authority_basis &&
+        (payload.authority_claim_id ?? null) === (proposal.authority_claim_id ?? null) &&
+        payload.approval_receipt_digest === proposal.review.review_artifact_digest &&
+        payload.approval_scope === proposal.approval_scope &&
+        payload.source_basis === proposal.source_basis &&
+        payload.license_basis === proposal.asset.redistribution.basis &&
+        payload.effective_from === proposal.effective_from &&
+        (payload.superseded_binding_event_id ?? null) === proposal.expected_current_binding_event_id);
+}
+function bindingKey(entityId, role) {
+    return `${entityId}:${role}`;
+}
+function bindingMap(bindings) {
+    const result = new Map();
+    for (const binding of bindings) {
+        const key = bindingKey(binding.entity_id, binding.role);
+        const prior = result.get(key);
+        if (prior && canonicalJson(prior) !== canonicalJson(binding)) {
+            throw new Error(`Current asset bindings disagree at ${key}.`);
+        }
+        if (prior)
+            throw new Error(`Current asset binding ${key} is repeated.`);
+        result.set(key, binding);
+    }
+    return result;
+}
+//# sourceMappingURL=delta.js.map

package/dist/modules/assets/src/delta.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delta.js","sourceRoot":"","sources":["../../../../modules/assets/src/delta.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAEhG,OAAO,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EACL,aAAa,EACb,uBAAuB,EAEvB,MAAM,GACP,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAEzE,MAAM,UAAU,eAAe,CAAC,KAM/B;IACC,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS;SAC5B,GAAG,CAAC,yBAAyB,CAAC;SAC9B,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAChB,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,EAAE,gBAAgB,IAAI,IAAI,CAAC,KAAK,QAAQ,CAAC,iCAAiC,EAAE,CAAC;YACrF,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,CAAC,eAAe,4BAA4B,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,+BAA+B,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC5F,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,CAAC,eAAe,8CAA8C,CACzF,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,0BAA0B,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/E,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAC/C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,aAAa,CAC3D,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAC9E,MAAM,OAAO,GAA2B;YACtC,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,mBAAmB,EAAE,QAAQ,CAAC,KAAK,CAAC,mBAAmB;YACvD,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,WAAW,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE;YAC5C,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzF,uBAAuB,EAAE,OAAO,CAAC,uBAAuB;YACxD,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,gBAAgB,EAAE,KAAK,CAAC,QAAQ;SACjC,CAAC;QACF,OAAO;YACL,SAAS,EAAE,QAAiB;YAC5B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,sBAAsB,EAAE,KAAK,EAAE,gBAAgB,IAAI,IAAI;YACvD,OAAO;YACP,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW;YAClD,iBAAiB,EAAE,OAAO,CAAC,WAAW;SACvC,CAAC;IACJ,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,uBAAuB,CACrB,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EACrC,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CACxC,CACF,CAAC;IACJ,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;SACxD,IAAI,CAAC,uBAAuB,CAAC;SAC7B,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAChB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,wCAAwC,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CACjD,yBAAyB,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,gBAAgB,CAAC,CACnE,CAAC;QACF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,uDAAuD,CAClF,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1E,OAAO;YACL,SAAS,EAAE,QAAiB;YAC5B,SAAS,EAAE,QAAQ;YACnB,IAAI,EAAE,MAAe;YACrB,sBAAsB,EAAE,KAAK,CAAC,gBAAgB;YAC9C,oBAAoB,EAAE,MAAM,CAAC,KAAK,CAAC;YACnC,oBAAoB,EAAE,WAAW,CAAC,QAAQ;SAC3C,CAAC;IACJ,CAAC,CAAC,CAAC;IACL,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC7D,uBAAuB,CACrB,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EACrC,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CACxC,CACF,CAAC;IACF,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC;QACtC,cAAc,EAAE,8BAA8B;QAC9C,yBAAyB,EAAE,KAAK,CAAC,sBAAsB;QACvD,OAAO;KACR,CAAC,CAAC;IACH,OAAO,gBAAgB,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAiB;IAC1D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC;QACZ,mBAAmB,EAAE,wCAAwC;QAC7D,UAAU,EAAE,aAAa;QACzB,aAAa,EAAE,QAAQ,CAAC,yBAAyB;QACjD,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACzC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;YACrD,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ;gBAC/B,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;gBAC7B,CAAC,CAAC;oBACE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;oBACjD,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;iBAClD,CAAC;SACP,CAAC,CAAC;KACJ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAI/B;IACC,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAClD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,EAAE,gBAAgB,IAAI,IAAI,CAAC,KAAK,MAAM,CAAC,sBAAsB,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,mCAAmC,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,oBAAoB,EAAE,CAAC;gBAC5D,MAAM,IAAI,KAAK,CAAC,iBAAiB,GAAG,uCAAuC,CAAC,CAAC;YAC/E,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC1D,uBAAuB,CACrB,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EACrC,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CACxC,CACF,CAAC;IACF,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1F,CAAC;QACF,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/F,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,4CAA4C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IACD,gBAAgB,CAAC,KAAK,CAAC;QACrB,oBAAoB,EAAE,8BAA8B;QACpD,QAAQ;QACR,cAAc,EAAE,MAAM,CAAC;YACrB,gBAAgB,EAAE,2CAA2C;YAC7D,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC;SAC/D,CAAC;KACH,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,KAAmB,EACnB,QAA6B;IAE7B,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACjG,MAAM,MAAM,GAAG,0BAA0B,CAAC,aAAa,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClF,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;IAC5B,OAAO,CACL,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;QAC9B,OAAO,CAAC,mBAAmB,KAAK,QAAQ,CAAC,KAAK,CAAC,mBAAmB;QAClE,OAAO,CAAC,wBAAwB,KAAK,QAAQ,CAAC,aAAa;QAC3D,OAAO,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;QACpD,CAAC,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,IAAI,IAAI,CAAC;QAC9E,OAAO,CAAC,uBAAuB,KAAK,QAAQ,CAAC,MAAM,CAAC,sBAAsB;QAC1E,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;QAClD,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY;QAC9C,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK;QAC7D,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;QAClD,CAAC,OAAO,CAAC,2BAA2B,IAAI,IAAI,CAAC,KAAK,QAAQ,CAAC,iCAAiC,CAC7F,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB,EAAE,IAAY;IAChD,OAAO,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,UAAU,CACjB,QAA2C;IAE3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkC,CAAC;IACzD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,KAAK,IAAI,aAAa,CAAC,KAAK,CAAC,KAAK,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,eAAe,CAAC,CAAC;QACxE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}