@talosprotocol/contracts 1.1.5

package/dist/index.cjs

@@ -0,0 +1,332 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  Base64UrlError: () => Base64UrlError,
+  assertCursorInvariant: () => assertCursorInvariant,
+  base64urlDecodeToBytes: () => base64urlDecodeToBytes,
+  base64urlDecodeToUtf8: () => base64urlDecodeToUtf8,
+  base64urlEncodeBytes: () => base64urlEncodeBytes,
+  base64urlEncodeUtf8: () => base64urlEncodeUtf8,
+  checkCursorContinuity: () => checkCursorContinuity,
+  compareCursor: () => compareCursor,
+  createEvidenceBundle: () => createEvidenceBundle,
+  decodeCursor: () => decodeCursor,
+  deriveCursor: () => deriveCursor,
+  isCanonicalLowerUuid: () => isCanonicalLowerUuid,
+  isUuidV7: () => isUuidV7,
+  orderingCompare: () => orderingCompare,
+  redactEvent: () => redactEvent,
+  redactGatewaySnapshot: () => redactGatewaySnapshot
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/infrastructure/base64url.ts
+var Base64UrlError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "Base64UrlError";
+  }
+};
+var ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+var RE_VALID = /^[A-Za-z0-9\-_]*$/;
+function toUtf8Bytes(s) {
+  return new TextEncoder().encode(s);
+}
+function fromUtf8Bytes(b) {
+  return new TextDecoder("utf-8", { fatal: true }).decode(b);
+}
+function base64urlEncodeBytes(bytes) {
+  if (bytes.length === 0) return "";
+  let out = "";
+  let i = 0;
+  while (i + 3 <= bytes.length) {
+    const n = bytes[i] << 16 | bytes[i + 1] << 8 | bytes[i + 2];
+    out += ALPHABET[n >>> 18 & 63];
+    out += ALPHABET[n >>> 12 & 63];
+    out += ALPHABET[n >>> 6 & 63];
+    out += ALPHABET[n & 63];
+    i += 3;
+  }
+  const rem = bytes.length - i;
+  if (rem === 1) {
+    const n = bytes[i];
+    out += ALPHABET[n >>> 2 & 63];
+    out += ALPHABET[n << 4 & 63];
+  } else if (rem === 2) {
+    const n = bytes[i] << 8 | bytes[i + 1];
+    out += ALPHABET[n >>> 10 & 63];
+    out += ALPHABET[n >>> 4 & 63];
+    out += ALPHABET[n << 2 & 63];
+  }
+  return out;
+}
+function decodeChar(c) {
+  const idx = ALPHABET.indexOf(c);
+  if (idx === -1) throw new Base64UrlError(`Invalid base64url character: ${c}`);
+  return idx;
+}
+function base64urlDecodeToBytes(s) {
+  if (s.length === 0) return new Uint8Array(0);
+  if (s.includes("=")) throw new Base64UrlError("Padding is not allowed");
+  if (!RE_VALID.test(s))
+    throw new Base64UrlError("Non-base64url characters present");
+  if (s.length % 4 === 1) throw new Base64UrlError("Invalid base64url length");
+  const out = [];
+  let i = 0;
+  while (i < s.length) {
+    const remain = s.length - i;
+    if (remain >= 4) {
+      const a = decodeChar(s[i]), b = decodeChar(s[i + 1]), c = decodeChar(s[i + 2]), d = decodeChar(s[i + 3]);
+      const n = a << 18 | b << 12 | c << 6 | d;
+      out.push(n >>> 16 & 255, n >>> 8 & 255, n & 255);
+      i += 4;
+      continue;
+    }
+    if (remain === 2) {
+      const a = decodeChar(s[i]), b = decodeChar(s[i + 1]);
+      const n = a << 18 | b << 12;
+      out.push(n >>> 16 & 255);
+      i += 2;
+      continue;
+    }
+    if (remain === 3) {
+      const a = decodeChar(s[i]), b = decodeChar(s[i + 1]), c = decodeChar(s[i + 2]);
+      const n = a << 18 | b << 12 | c << 6;
+      out.push(n >>> 16 & 255, n >>> 8 & 255);
+      i += 3;
+      continue;
+    }
+    throw new Base64UrlError("Invalid base64url length");
+  }
+  const decoded = new Uint8Array(out);
+  const recoded = base64urlEncodeBytes(decoded);
+  if (recoded !== s) throw new Base64UrlError("Non-canonical base64url form");
+  return decoded;
+}
+function base64urlEncodeUtf8(s) {
+  return base64urlEncodeBytes(toUtf8Bytes(s));
+}
+function base64urlDecodeToUtf8(s) {
+  return fromUtf8Bytes(base64urlDecodeToBytes(s));
+}
+
+// src/infrastructure/uuidv7.ts
+var RE_UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+function isUuidV7(id) {
+  if (!RE_UUID.test(id)) return false;
+  const version = id[14];
+  if (version !== "7") return false;
+  const variant = id[19].toLowerCase();
+  return variant === "8" || variant === "9" || variant === "a" || variant === "b";
+}
+function isCanonicalLowerUuid(id) {
+  return id === id.toLowerCase();
+}
+
+// src/domain/logic/cursor.ts
+function isValidUnixSecondsInt(n) {
+  return typeof n === "number" && Number.isInteger(n) && n >= 0 && Number.isSafeInteger(n);
+}
+function isCanonicalTimestampString(s) {
+  if (!/^\d+$/.test(s)) return false;
+  if (s.length > 1 && s.startsWith("0")) return false;
+  return true;
+}
+function deriveCursor(timestamp, eventId) {
+  if (!isValidUnixSecondsInt(timestamp)) {
+    throw new Error("timestamp must be unix seconds integer");
+  }
+  const plain = `${String(timestamp)}:${eventId}`;
+  return base64urlEncodeUtf8(plain);
+}
+function decodeCursor(cursor) {
+  const raw = base64urlDecodeToUtf8(cursor);
+  const colonIndex = raw.indexOf(":");
+  if (colonIndex === -1)
+    throw new Error("cursor frame must be '{timestamp}:{event_id}'");
+  const tsStr = raw.slice(0, colonIndex);
+  const eventId = raw.slice(colonIndex + 1);
+  if (!isCanonicalTimestampString(tsStr))
+    throw new Error("timestamp is not canonical base-10");
+  const tsNum = Number(tsStr);
+  if (!isValidUnixSecondsInt(tsNum))
+    throw new Error("timestamp is out of range");
+  if (!isUuidV7(eventId)) throw new Error("event_id is not uuidv7");
+  if (!isCanonicalLowerUuid(eventId))
+    throw new Error("event_id must be lowercase canonical uuid");
+  return { timestamp: tsNum, event_id: eventId };
+}
+function compareCursor(a, b) {
+  const da = decodeCursor(a);
+  const db = decodeCursor(b);
+  if (da.timestamp < db.timestamp) return -1;
+  if (da.timestamp > db.timestamp) return 1;
+  if (da.event_id < db.event_id) return -1;
+  if (da.event_id > db.event_id) return 1;
+  return 0;
+}
+function assertCursorInvariant(event) {
+  if (!isValidUnixSecondsInt(event.timestamp) || typeof event.event_id !== "string" || typeof event.cursor !== "string") {
+    return { ok: false, derived: "", reason: "INVALID_FRAME" };
+  }
+  try {
+    decodeCursor(event.cursor);
+  } catch {
+    const derived2 = deriveCursor(event.timestamp, event.event_id);
+    return { ok: false, derived: derived2, reason: "INVALID_FRAME" };
+  }
+  const derived = deriveCursor(event.timestamp, event.event_id);
+  if (event.cursor !== derived)
+    return { ok: false, derived, reason: "CURSOR_MISMATCH" };
+  if (!isUuidV7(event.event_id) || !isCanonicalLowerUuid(event.event_id)) {
+    return { ok: false, derived, reason: "INVALID_FRAME" };
+  }
+  return { ok: true, derived };
+}
+
+// src/domain/logic/continuity.ts
+function checkCursorContinuity(events, _expectedPredecessor) {
+  if (events.length <= 1) {
+    return { status: "CONTINUOUS", gaps: [] };
+  }
+  const gaps = [];
+  for (let i = 0; i < events.length - 1; i++) {
+    const current = events[i];
+    const next = events[i + 1];
+    const cmp = compareCursor(current.cursor, next.cursor);
+    if (cmp === 1) {
+      gaps.push({
+        from_cursor: current.cursor,
+        to_cursor: next.cursor,
+        detected_at: Date.now()
+      });
+    }
+  }
+  if (gaps.length > 0) {
+    return { status: "GAP_DETECTED", gaps };
+  }
+  return { status: "CONTINUOUS", gaps: [] };
+}
+
+// src/domain/logic/ordering.ts
+function orderingCompare(a, b) {
+  if (a.timestamp > b.timestamp) return -1;
+  if (a.timestamp < b.timestamp) return 1;
+  if (a.event_id > b.event_id) return -1;
+  if (a.event_id < b.event_id) return 1;
+  return 0;
+}
+
+// src/domain/logic/redaction.ts
+function redactEvent(event, level) {
+  if (level === "none") return event;
+  const copy = structuredClone(event);
+  if (level === "safe_default" || level === "strict") {
+    if (copy.request && typeof copy.request === "object") {
+      const req = copy.request;
+      if (req.headers) {
+        delete req.headers["authorization"];
+        delete req.headers["cookie"];
+        delete req.headers["x-api-key"];
+      }
+    }
+  }
+  if (level === "strict") {
+    if (copy.input) {
+      copy.input = "[REDACTED]";
+    }
+    if (copy.request && typeof copy.request === "object") {
+      const req = copy.request;
+      req.headers = void 0;
+    }
+  }
+  return copy;
+}
+function redactGatewaySnapshot(snapshot) {
+  const copy = { ...snapshot };
+  delete copy.internal_endpoints;
+  delete copy.keys;
+  delete copy.tokens;
+  return copy;
+}
+
+// src/domain/logic/evidence-bundle.ts
+function createEvidenceBundle(params) {
+  const level = params.redactionLevel ?? "safe_default";
+  const sortedEvents = [...params.events].sort(
+    (a, b) => compareCursor(a.cursor, b.cursor)
+  );
+  const redactedEvents = sortedEvents.map((e) => redactEvent(e, level));
+  const by_outcome = { OK: 0, DENY: 0, ERROR: 0 };
+  const by_denial_reason = {};
+  redactedEvents.forEach((e) => {
+    const outcome = e.outcome || "OK";
+    by_outcome[outcome] = (by_outcome[outcome] || 0) + 1;
+    if (typeof e.reason === "string") {
+      by_denial_reason[e.reason] = (by_denial_reason[e.reason] || 0) + 1;
+    }
+  });
+  const summary = {
+    total_events: redactedEvents.length,
+    by_outcome,
+    by_denial_reason,
+    cursor_continuity: "UNKNOWN"
+    // Continuity check is computationally expensive for large bundles
+  };
+  const redactedSnapshot = params.gatewaySnapshot ? redactGatewaySnapshot(params.gatewaySnapshot) : void 0;
+  return {
+    metadata: {
+      schema_version: "1.1.0",
+      generated_at: (/* @__PURE__ */ new Date()).toISOString(),
+      source: {
+        dashboard_version: params.dashboardVersion,
+        gateway_version: params.gatewaySnapshot?.version
+      },
+      filters_applied: params.filters,
+      cursor_range: params.cursorRange,
+      redaction_level: level
+    },
+    events: redactedEvents,
+    integrity_summary: summary,
+    gateway_snapshot: redactedSnapshot
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  Base64UrlError,
+  assertCursorInvariant,
+  base64urlDecodeToBytes,
+  base64urlDecodeToUtf8,
+  base64urlEncodeBytes,
+  base64urlEncodeUtf8,
+  checkCursorContinuity,
+  compareCursor,
+  createEvidenceBundle,
+  decodeCursor,
+  deriveCursor,
+  isCanonicalLowerUuid,
+  isUuidV7,
+  orderingCompare,
+  redactEvent,
+  redactGatewaySnapshot
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/infrastructure/base64url.ts","../src/infrastructure/uuidv7.ts","../src/domain/logic/cursor.ts","../src/domain/logic/continuity.ts","../src/domain/logic/ordering.ts","../src/domain/logic/redaction.ts","../src/domain/logic/evidence-bundle.ts"],"sourcesContent":["// typescript/src/index.ts\n// Public API exports for @talosprotocol/contracts\n//\n// This file is the ONLY supported import path for this package.\n// All exports are stable and backward-compatible.\n\n// ============================================================================\n// Infrastructure: Encoding & Validation Utilities\n// ============================================================================\n\nexport {\n  Base64UrlError,\n  base64urlEncodeBytes,\n  base64urlDecodeToBytes,\n  base64urlEncodeUtf8,\n  base64urlDecodeToUtf8,\n} from \"./infrastructure/base64url.js\";\n\nexport { isUuidV7, isCanonicalLowerUuid } from \"./infrastructure/uuidv7.js\";\n\n// ============================================================================\n// Domain Types\n// ============================================================================\n\n// Cursor types\nexport type {\n  CursorValidationReason,\n  CursorValidationResult,\n  DecodedCursor,\n} from \"./domain/types/cursor.types.js\";\n\n// Event types\nexport type {\n  AuditEvent,\n  GatewayStatus,\n  Outcome,\n  RedactionLevel,\n  AuditFilters,\n  Comparator,\n} from \"./domain/types/event.types.js\";\n\n// Bundle types\nexport type {\n  EvidenceBundleMetadata,\n  IntegritySummary,\n  EvidenceBundle,\n  CursorGap,\n  ContinuityCheckResult,\n} from \"./domain/types/bundle.types.js\";\n\n// ============================================================================\n// Domain Logic\n// ============================================================================\n\n// Cursor operations\nexport {\n  deriveCursor,\n  decodeCursor,\n  compareCursor,\n  assertCursorInvariant,\n} from \"./domain/logic/cursor.js\";\n\n// Continuity checking\nexport { checkCursorContinuity } from \"./domain/logic/continuity.js\";\n\n// Event ordering\nexport { orderingCompare } from \"./domain/logic/ordering.js\";\n\n// Redaction\nexport {\n  redactEvent,\n  redactGatewaySnapshot,\n} from \"./domain/logic/redaction.js\";\n\n// Evidence bundle creation\nexport { createEvidenceBundle } from \"./domain/logic/evidence-bundle.js\";\n","// src/infrastructure/base64url.ts\n// Strict base64url encoding/decoding - NO btoa/atob, NO padding\n// Uses TextEncoder/TextDecoder for universal runtime support (Node, Browser, Edge)\n\nexport class Base64UrlError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"Base64UrlError\";\n  }\n}\n\nconst ALPHABET =\n  \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\nconst RE_VALID = /^[A-Za-z0-9\\-_]*$/;\n\nfunction toUtf8Bytes(s: string): Uint8Array {\n  return new TextEncoder().encode(s);\n}\n\nfunction fromUtf8Bytes(b: Uint8Array): string {\n  return new TextDecoder(\"utf-8\", { fatal: true }).decode(b);\n}\n\nexport function base64urlEncodeBytes(bytes: Uint8Array): string {\n  if (bytes.length === 0) return \"\";\n\n  let out = \"\";\n  let i = 0;\n\n  while (i + 3 <= bytes.length) {\n    const n = (bytes[i]! << 16) | (bytes[i + 1]! << 8) | bytes[i + 2]!;\n    out += ALPHABET[(n >>> 18) & 63]!;\n    out += ALPHABET[(n >>> 12) & 63]!;\n    out += ALPHABET[(n >>> 6) & 63]!;\n    out += ALPHABET[n & 63]!;\n    i += 3;\n  }\n\n  const rem = bytes.length - i;\n  if (rem === 1) {\n    const n = bytes[i]!;\n    out += ALPHABET[(n >>> 2) & 63]!;\n    out += ALPHABET[(n << 4) & 63]!;\n    // no padding\n  } else if (rem === 2) {\n    const n = (bytes[i]! << 8) | bytes[i + 1]!;\n    out += ALPHABET[(n >>> 10) & 63]!;\n    out += ALPHABET[(n >>> 4) & 63]!;\n    out += ALPHABET[(n << 2) & 63]!;\n    // no padding\n  }\n\n  return out;\n}\n\nfunction decodeChar(c: string): number {\n  const idx = ALPHABET.indexOf(c);\n  if (idx === -1) throw new Base64UrlError(`Invalid base64url character: ${c}`);\n  return idx;\n}\n\nexport function base64urlDecodeToBytes(s: string): Uint8Array {\n  if (s.length === 0) return new Uint8Array(0);\n\n  // Reject padding and non-url alphabet\n  if (s.includes(\"=\")) throw new Base64UrlError(\"Padding is not allowed\");\n  if (!RE_VALID.test(s))\n    throw new Base64UrlError(\"Non-base64url characters present\");\n  // length mod 4 == 1 is impossible for canonical base64url\n  if (s.length % 4 === 1) throw new Base64UrlError(\"Invalid base64url length\");\n\n  const out: number[] = [];\n  let i = 0;\n\n  while (i < s.length) {\n    const remain = s.length - i;\n\n    if (remain >= 4) {\n      const a = decodeChar(s[i]!),\n        b = decodeChar(s[i + 1]!),\n        c = decodeChar(s[i + 2]!),\n        d = decodeChar(s[i + 3]!);\n      const n = (a << 18) | (b << 12) | (c << 6) | d;\n      out.push((n >>> 16) & 255, (n >>> 8) & 255, n & 255);\n      i += 4;\n      continue;\n    }\n\n    if (remain === 2) {\n      const a = decodeChar(s[i]!),\n        b = decodeChar(s[i + 1]!);\n      const n = (a << 18) | (b << 12);\n      out.push((n >>> 16) & 255);\n      i += 2;\n      continue;\n    }\n\n    if (remain === 3) {\n      const a = decodeChar(s[i]!),\n        b = decodeChar(s[i + 1]!),\n        c = decodeChar(s[i + 2]!);\n      const n = (a << 18) | (b << 12) | (c << 6);\n      out.push((n >>> 16) & 255, (n >>> 8) & 255);\n      i += 3;\n      continue;\n    }\n\n    throw new Base64UrlError(\"Invalid base64url length\");\n  }\n\n  const decoded = new Uint8Array(out);\n  // Strict canonical check: re-encode must match exactly\n  const recoded = base64urlEncodeBytes(decoded);\n  if (recoded !== s) throw new Base64UrlError(\"Non-canonical base64url form\");\n  return decoded;\n}\n\nexport function base64urlEncodeUtf8(s: string): string {\n  return base64urlEncodeBytes(toUtf8Bytes(s));\n}\n\nexport function base64urlDecodeToUtf8(s: string): string {\n  return fromUtf8Bytes(base64urlDecodeToBytes(s));\n}\n","// src/infrastructure/uuidv7.ts\n// Strict UUIDv7 validation - pure regex, no external dependencies\n\nconst RE_UUID =\n  /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;\n\nexport function isUuidV7(id: string): boolean {\n  if (!RE_UUID.test(id)) return false;\n  // version nibble is first nibble of 3rd group (position 14)\n  const version = id[14]!;\n  if (version !== \"7\") return false;\n\n  // variant is first nibble of 4th group (position 19): 8, 9, a, b\n  const variant = id[19]!.toLowerCase();\n  return (\n    variant === \"8\" || variant === \"9\" || variant === \"a\" || variant === \"b\"\n  );\n}\n\nexport function isCanonicalLowerUuid(id: string): boolean {\n  return id === id.toLowerCase();\n}\n","// src/domain/logic/cursor.ts\n// Cursor derivation, validation, and comparison\n// D4=B: invalid frames do not throw from validation, return INVALID_FRAME\n\nimport {\n  base64urlDecodeToUtf8,\n  base64urlEncodeUtf8,\n} from \"../../infrastructure/base64url.js\";\nimport { isUuidV7, isCanonicalLowerUuid } from \"../../infrastructure/uuidv7.js\";\nimport type {\n  CursorValidationResult,\n  DecodedCursor,\n} from \"../types/cursor.types.js\";\n\nfunction isValidUnixSecondsInt(n: unknown): n is number {\n  return (\n    typeof n === \"number\" &&\n    Number.isInteger(n) &&\n    n >= 0 &&\n    Number.isSafeInteger(n)\n  );\n}\n\nfunction isCanonicalTimestampString(s: string): boolean {\n  if (!/^\\d+$/.test(s)) return false;\n  if (s.length > 1 && s.startsWith(\"0\")) return false;\n  return true;\n}\n\n/**\n * Derive a cursor from timestamp and event_id.\n * cursor = base64url(utf8(\"{timestamp}:{event_id}\"))\n */\nexport function deriveCursor(timestamp: number, eventId: string): string {\n  if (!isValidUnixSecondsInt(timestamp)) {\n    throw new Error(\"timestamp must be unix seconds integer\");\n  }\n  const plain = `${String(timestamp)}:${eventId}`;\n  return base64urlEncodeUtf8(plain);\n}\n\n/**\n * Decode a cursor to {timestamp, event_id}.\n * Throws on invalid cursor format.\n */\nexport function decodeCursor(cursor: string): DecodedCursor {\n  const raw = base64urlDecodeToUtf8(cursor);\n  const colonIndex = raw.indexOf(\":\");\n  if (colonIndex === -1)\n    throw new Error(\"cursor frame must be '{timestamp}:{event_id}'\");\n\n  const tsStr = raw.slice(0, colonIndex);\n  const eventId = raw.slice(colonIndex + 1);\n\n  if (!isCanonicalTimestampString(tsStr))\n    throw new Error(\"timestamp is not canonical base-10\");\n  const tsNum = Number(tsStr);\n  if (!isValidUnixSecondsInt(tsNum))\n    throw new Error(\"timestamp is out of range\");\n\n  if (!isUuidV7(eventId)) throw new Error(\"event_id is not uuidv7\");\n  if (!isCanonicalLowerUuid(eventId))\n    throw new Error(\"event_id must be lowercase canonical uuid\");\n\n  return { timestamp: tsNum, event_id: eventId };\n}\n\n/**\n * Compare two cursors.\n * Returns -1 if a < b, 0 if equal, 1 if a > b.\n * Compares by (timestamp, event_id) lexicographically.\n */\nexport function compareCursor(a: string, b: string): -1 | 0 | 1 {\n  const da = decodeCursor(a);\n  const db = decodeCursor(b);\n\n  if (da.timestamp < db.timestamp) return -1;\n  if (da.timestamp > db.timestamp) return 1;\n\n  if (da.event_id < db.event_id) return -1;\n  if (da.event_id > db.event_id) return 1;\n  return 0;\n}\n\n/**\n * Validate that an event's cursor matches the derived cursor.\n * D4=B: Does not throw on invalid frames, returns { ok: false, reason: \"INVALID_FRAME\" }\n */\nexport function assertCursorInvariant(event: {\n  timestamp: unknown;\n  event_id: unknown;\n  cursor: unknown;\n}): CursorValidationResult {\n  // Frame checks first (D4=B: do not throw)\n  if (\n    !isValidUnixSecondsInt(event.timestamp) ||\n    typeof event.event_id !== \"string\" ||\n    typeof event.cursor !== \"string\"\n  ) {\n    return { ok: false, derived: \"\", reason: \"INVALID_FRAME\" };\n  }\n\n  // Decode cursor must be strict base64url + canonical frame. If it fails, INVALID_FRAME.\n  try {\n    decodeCursor(event.cursor);\n  } catch {\n    const derived = deriveCursor(event.timestamp, event.event_id);\n    return { ok: false, derived, reason: \"INVALID_FRAME\" };\n  }\n\n  // Derived cursor must match exactly (CURSOR_MISMATCH)\n  const derived = deriveCursor(event.timestamp, event.event_id);\n  if (event.cursor !== derived)\n    return { ok: false, derived, reason: \"CURSOR_MISMATCH\" };\n\n  // Also enforce event_id canonical uuidv7 for the event frame\n  if (!isUuidV7(event.event_id) || !isCanonicalLowerUuid(event.event_id)) {\n    return { ok: false, derived, reason: \"INVALID_FRAME\" };\n  }\n\n  return { ok: true, derived };\n}\n","// src/domain/logic/continuity.ts\n// Cursor continuity checking\n\nimport { compareCursor } from \"./cursor.js\";\nimport type {\n  CursorGap,\n  ContinuityCheckResult,\n} from \"../types/bundle.types.js\";\n\n/**\n * Check cursor continuity based on contract-defined rules.\n * Gap detection requires cursor predecessor relation, not heuristics.\n * For v1.1, we verify strict ordering.\n */\nexport function checkCursorContinuity(\n  events: Array<{ cursor: string; timestamp: number }>,\n  _expectedPredecessor?: (cursor: string) => string | null,\n): ContinuityCheckResult {\n  if (events.length <= 1) {\n    return { status: \"CONTINUOUS\", gaps: [] };\n  }\n\n  const gaps: CursorGap[] = [];\n\n  // Verify ordering\n  for (let i = 0; i < events.length - 1; i++) {\n    const current = events[i];\n    const next = events[i + 1];\n\n    // If next cursor is Lexicographically smaller than current, strict ordering violation\n    const cmp = compareCursor(current.cursor, next.cursor);\n    if (cmp === 1) {\n      // Order violation isn't exactly a \"gap\" but a \"discontinuity\"\n      // For v1.1, we treat this as a Gap for the sake of the interface\n      gaps.push({\n        from_cursor: current.cursor,\n        to_cursor: next.cursor,\n        detected_at: Date.now(),\n      });\n    }\n  }\n\n  // FUTURE(v1.2): Implement actual rigorous predecessor check using Merkle links if available\n  // For now, we only check monotonic ordering.\n\n  if (gaps.length > 0) {\n    return { status: \"GAP_DETECTED\", gaps };\n  }\n\n  return { status: \"CONTINUOUS\", gaps: [] };\n}\n","// src/domain/logic/ordering.ts\n// Event ordering comparison: (timestamp DESC, event_id DESC)\n\n/**\n * Compare two events for ordering.\n * Returns -1 if a should come before b (a is \"greater\" in DESC order)\n * Returns 0 if equal\n * Returns 1 if a should come after b\n *\n * Ordering: timestamp DESC, then event_id DESC\n */\nexport function orderingCompare(\n  a: { timestamp: number; event_id: string },\n  b: { timestamp: number; event_id: string },\n): -1 | 0 | 1 {\n  // DESC timestamp: higher timestamp comes first\n  if (a.timestamp > b.timestamp) return -1;\n  if (a.timestamp < b.timestamp) return 1;\n\n  // DESC event_id: higher event_id comes first (lexicographic)\n  if (a.event_id > b.event_id) return -1;\n  if (a.event_id < b.event_id) return 1;\n  return 0;\n}\n","// src/domain/logic/redaction.ts\n// Event and gateway snapshot redaction\n\nimport type {\n  AuditEvent,\n  GatewayStatus,\n  RedactionLevel,\n} from \"../types/event.types.js\";\n\nexport function redactEvent(\n  event: AuditEvent,\n  level: RedactionLevel,\n): AuditEvent {\n  if (level === \"none\") return event;\n\n  const copy = structuredClone(event); // Deep copy\n\n  // Common redactions for safe_default\n  if (level === \"safe_default\" || level === \"strict\") {\n    if (copy.request && typeof copy.request === \"object\") {\n      const req = copy.request as {\n        headers?: Record<string, string>;\n        [key: string]: unknown;\n      };\n      if (req.headers) {\n        // Strip auth headers\n        delete req.headers[\"authorization\"];\n        delete req.headers[\"cookie\"];\n        delete req.headers[\"x-api-key\"];\n      }\n    }\n  }\n\n  if (level === \"strict\") {\n    // Strict redaction - strip inputs and all headers\n    if (copy.input) {\n      copy.input = \"[REDACTED]\";\n    }\n    if (copy.request && typeof copy.request === \"object\") {\n      const req = copy.request as {\n        headers?: Record<string, string>;\n        [key: string]: unknown;\n      };\n      req.headers = undefined; // Remove all headers\n    }\n  }\n\n  return copy;\n}\n\nexport function redactGatewaySnapshot(\n  snapshot: GatewayStatus,\n): Partial<GatewayStatus> {\n  const copy = { ...snapshot };\n\n  // Always strip these\n  delete copy.internal_endpoints;\n  delete copy.keys;\n  delete copy.tokens;\n\n  return copy;\n}\n","// src/domain/logic/evidence-bundle.ts\n// Evidence bundle creation - pure deterministic transformation\n\nimport { compareCursor } from \"./cursor.js\";\nimport { redactEvent, redactGatewaySnapshot } from \"./redaction.js\";\nimport type {\n  AuditEvent,\n  GatewayStatus,\n  RedactionLevel,\n  AuditFilters,\n  Outcome,\n} from \"../types/event.types.js\";\nimport type {\n  EvidenceBundle,\n  IntegritySummary,\n} from \"../types/bundle.types.js\";\n\nexport interface CreateEvidenceBundleParams {\n  events: AuditEvent[];\n  redactionLevel?: RedactionLevel;\n  gatewaySnapshot?: GatewayStatus;\n  filters?: AuditFilters;\n  cursorRange?: { start?: string; end?: string };\n  dashboardVersion: string;\n}\n\nexport function createEvidenceBundle(\n  params: CreateEvidenceBundleParams,\n): EvidenceBundle {\n  const level = params.redactionLevel ?? \"safe_default\";\n\n  // 1. Sort events by cursor (canonical order)\n  const sortedEvents = [...params.events].sort((a, b) =>\n    compareCursor(a.cursor, b.cursor),\n  );\n\n  // 2. Apply redaction based on level\n  const redactedEvents = sortedEvents.map((e) => redactEvent(e, level));\n\n  // 3. Compute integrity summary\n  const by_outcome: Record<Outcome, number> = { OK: 0, DENY: 0, ERROR: 0 };\n  const by_denial_reason: Record<string, number> = {};\n\n  redactedEvents.forEach((e) => {\n    const outcome = (e.outcome as Outcome) || \"OK\";\n    by_outcome[outcome] = (by_outcome[outcome] || 0) + 1;\n\n    if (typeof e.reason === \"string\") {\n      by_denial_reason[e.reason] = (by_denial_reason[e.reason] || 0) + 1;\n    }\n  });\n\n  const summary: IntegritySummary = {\n    total_events: redactedEvents.length,\n    by_outcome,\n    by_denial_reason,\n    cursor_continuity: \"UNKNOWN\", // Continuity check is computationally expensive for large bundles\n  };\n\n  // 4. Strip secrets from gateway snapshot\n  const redactedSnapshot = params.gatewaySnapshot\n    ? redactGatewaySnapshot(params.gatewaySnapshot)\n    : undefined;\n\n  return {\n    metadata: {\n      schema_version: \"1.1.0\",\n      generated_at: new Date().toISOString(),\n      source: {\n        dashboard_version: params.dashboardVersion,\n        gateway_version: params.gatewaySnapshot?.version,\n      },\n      filters_applied: params.filters,\n      cursor_range: params.cursorRange,\n      redaction_level: level,\n    },\n    events: redactedEvents,\n    integrity_summary: summary,\n    gateway_snapshot: redactedSnapshot,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACIO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,IAAM,WACJ;AACF,IAAM,WAAW;AAEjB,SAAS,YAAY,GAAuB;AAC1C,SAAO,IAAI,YAAY,EAAE,OAAO,CAAC;AACnC;AAEA,SAAS,cAAc,GAAuB;AAC5C,SAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,CAAC;AAC3D;AAEO,SAAS,qBAAqB,OAA2B;AAC9D,MAAI,MAAM,WAAW,EAAG,QAAO;AAE/B,MAAI,MAAM;AACV,MAAI,IAAI;AAER,SAAO,IAAI,KAAK,MAAM,QAAQ;AAC5B,UAAM,IAAK,MAAM,CAAC,KAAM,KAAO,MAAM,IAAI,CAAC,KAAM,IAAK,MAAM,IAAI,CAAC;AAChE,WAAO,SAAU,MAAM,KAAM,EAAE;AAC/B,WAAO,SAAU,MAAM,KAAM,EAAE;AAC/B,WAAO,SAAU,MAAM,IAAK,EAAE;AAC9B,WAAO,SAAS,IAAI,EAAE;AACtB,SAAK;AAAA,EACP;AAEA,QAAM,MAAM,MAAM,SAAS;AAC3B,MAAI,QAAQ,GAAG;AACb,UAAM,IAAI,MAAM,CAAC;AACjB,WAAO,SAAU,MAAM,IAAK,EAAE;AAC9B,WAAO,SAAU,KAAK,IAAK,EAAE;AAAA,EAE/B,WAAW,QAAQ,GAAG;AACpB,UAAM,IAAK,MAAM,CAAC,KAAM,IAAK,MAAM,IAAI,CAAC;AACxC,WAAO,SAAU,MAAM,KAAM,EAAE;AAC/B,WAAO,SAAU,MAAM,IAAK,EAAE;AAC9B,WAAO,SAAU,KAAK,IAAK,EAAE;AAAA,EAE/B;AAEA,SAAO;AACT;AAEA,SAAS,WAAW,GAAmB;AACrC,QAAM,MAAM,SAAS,QAAQ,CAAC;AAC9B,MAAI,QAAQ,GAAI,OAAM,IAAI,eAAe,gCAAgC,CAAC,EAAE;AAC5E,SAAO;AACT;AAEO,SAAS,uBAAuB,GAAuB;AAC5D,MAAI,EAAE,WAAW,EAAG,QAAO,IAAI,WAAW,CAAC;AAG3C,MAAI,EAAE,SAAS,GAAG,EAAG,OAAM,IAAI,eAAe,wBAAwB;AACtE,MAAI,CAAC,SAAS,KAAK,CAAC;AAClB,UAAM,IAAI,eAAe,kCAAkC;AAE7D,MAAI,EAAE,SAAS,MAAM,EAAG,OAAM,IAAI,eAAe,0BAA0B;AAE3E,QAAM,MAAgB,CAAC;AACvB,MAAI,IAAI;AAER,SAAO,IAAI,EAAE,QAAQ;AACnB,UAAM,SAAS,EAAE,SAAS;AAE1B,QAAI,UAAU,GAAG;AACf,YAAM,IAAI,WAAW,EAAE,CAAC,CAAE,GACxB,IAAI,WAAW,EAAE,IAAI,CAAC,CAAE,GACxB,IAAI,WAAW,EAAE,IAAI,CAAC,CAAE,GACxB,IAAI,WAAW,EAAE,IAAI,CAAC,CAAE;AAC1B,YAAM,IAAK,KAAK,KAAO,KAAK,KAAO,KAAK,IAAK;AAC7C,UAAI,KAAM,MAAM,KAAM,KAAM,MAAM,IAAK,KAAK,IAAI,GAAG;AACnD,WAAK;AACL;AAAA,IACF;AAEA,QAAI,WAAW,GAAG;AAChB,YAAM,IAAI,WAAW,EAAE,CAAC,CAAE,GACxB,IAAI,WAAW,EAAE,IAAI,CAAC,CAAE;AAC1B,YAAM,IAAK,KAAK,KAAO,KAAK;AAC5B,UAAI,KAAM,MAAM,KAAM,GAAG;AACzB,WAAK;AACL;AAAA,IACF;AAEA,QAAI,WAAW,GAAG;AAChB,YAAM,IAAI,WAAW,EAAE,CAAC,CAAE,GACxB,IAAI,WAAW,EAAE,IAAI,CAAC,CAAE,GACxB,IAAI,WAAW,EAAE,IAAI,CAAC,CAAE;AAC1B,YAAM,IAAK,KAAK,KAAO,KAAK,KAAO,KAAK;AACxC,UAAI,KAAM,MAAM,KAAM,KAAM,MAAM,IAAK,GAAG;AAC1C,WAAK;AACL;AAAA,IACF;AAEA,UAAM,IAAI,eAAe,0BAA0B;AAAA,EACrD;AAEA,QAAM,UAAU,IAAI,WAAW,GAAG;AAElC,QAAM,UAAU,qBAAqB,OAAO;AAC5C,MAAI,YAAY,EAAG,OAAM,IAAI,eAAe,8BAA8B;AAC1E,SAAO;AACT;AAEO,SAAS,oBAAoB,GAAmB;AACrD,SAAO,qBAAqB,YAAY,CAAC,CAAC;AAC5C;AAEO,SAAS,sBAAsB,GAAmB;AACvD,SAAO,cAAc,uBAAuB,CAAC,CAAC;AAChD;;;ACxHA,IAAM,UACJ;AAEK,SAAS,SAAS,IAAqB;AAC5C,MAAI,CAAC,QAAQ,KAAK,EAAE,EAAG,QAAO;AAE9B,QAAM,UAAU,GAAG,EAAE;AACrB,MAAI,YAAY,IAAK,QAAO;AAG5B,QAAM,UAAU,GAAG,EAAE,EAAG,YAAY;AACpC,SACE,YAAY,OAAO,YAAY,OAAO,YAAY,OAAO,YAAY;AAEzE;AAEO,SAAS,qBAAqB,IAAqB;AACxD,SAAO,OAAO,GAAG,YAAY;AAC/B;;;ACPA,SAAS,sBAAsB,GAAyB;AACtD,SACE,OAAO,MAAM,YACb,OAAO,UAAU,CAAC,KAClB,KAAK,KACL,OAAO,cAAc,CAAC;AAE1B;AAEA,SAAS,2BAA2B,GAAoB;AACtD,MAAI,CAAC,QAAQ,KAAK,CAAC,EAAG,QAAO;AAC7B,MAAI,EAAE,SAAS,KAAK,EAAE,WAAW,GAAG,EAAG,QAAO;AAC9C,SAAO;AACT;AAMO,SAAS,aAAa,WAAmB,SAAyB;AACvE,MAAI,CAAC,sBAAsB,SAAS,GAAG;AACrC,UAAM,IAAI,MAAM,wCAAwC;AAAA,EAC1D;AACA,QAAM,QAAQ,GAAG,OAAO,SAAS,CAAC,IAAI,OAAO;AAC7C,SAAO,oBAAoB,KAAK;AAClC;AAMO,SAAS,aAAa,QAA+B;AAC1D,QAAM,MAAM,sBAAsB,MAAM;AACxC,QAAM,aAAa,IAAI,QAAQ,GAAG;AAClC,MAAI,eAAe;AACjB,UAAM,IAAI,MAAM,+CAA+C;AAEjE,QAAM,QAAQ,IAAI,MAAM,GAAG,UAAU;AACrC,QAAM,UAAU,IAAI,MAAM,aAAa,CAAC;AAExC,MAAI,CAAC,2BAA2B,KAAK;AACnC,UAAM,IAAI,MAAM,oCAAoC;AACtD,QAAM,QAAQ,OAAO,KAAK;AAC1B,MAAI,CAAC,sBAAsB,KAAK;AAC9B,UAAM,IAAI,MAAM,2BAA2B;AAE7C,MAAI,CAAC,SAAS,OAAO,EAAG,OAAM,IAAI,MAAM,wBAAwB;AAChE,MAAI,CAAC,qBAAqB,OAAO;AAC/B,UAAM,IAAI,MAAM,2CAA2C;AAE7D,SAAO,EAAE,WAAW,OAAO,UAAU,QAAQ;AAC/C;AAOO,SAAS,cAAc,GAAW,GAAuB;AAC9D,QAAM,KAAK,aAAa,CAAC;AACzB,QAAM,KAAK,aAAa,CAAC;AAEzB,MAAI,GAAG,YAAY,GAAG,UAAW,QAAO;AACxC,MAAI,GAAG,YAAY,GAAG,UAAW,QAAO;AAExC,MAAI,GAAG,WAAW,GAAG,SAAU,QAAO;AACtC,MAAI,GAAG,WAAW,GAAG,SAAU,QAAO;AACtC,SAAO;AACT;AAMO,SAAS,sBAAsB,OAIX;AAEzB,MACE,CAAC,sBAAsB,MAAM,SAAS,KACtC,OAAO,MAAM,aAAa,YAC1B,OAAO,MAAM,WAAW,UACxB;AACA,WAAO,EAAE,IAAI,OAAO,SAAS,IAAI,QAAQ,gBAAgB;AAAA,EAC3D;AAGA,MAAI;AACF,iBAAa,MAAM,MAAM;AAAA,EAC3B,QAAQ;AACN,UAAMA,WAAU,aAAa,MAAM,WAAW,MAAM,QAAQ;AAC5D,WAAO,EAAE,IAAI,OAAO,SAAAA,UAAS,QAAQ,gBAAgB;AAAA,EACvD;AAGA,QAAM,UAAU,aAAa,MAAM,WAAW,MAAM,QAAQ;AAC5D,MAAI,MAAM,WAAW;AACnB,WAAO,EAAE,IAAI,OAAO,SAAS,QAAQ,kBAAkB;AAGzD,MAAI,CAAC,SAAS,MAAM,QAAQ,KAAK,CAAC,qBAAqB,MAAM,QAAQ,GAAG;AACtE,WAAO,EAAE,IAAI,OAAO,SAAS,QAAQ,gBAAgB;AAAA,EACvD;AAEA,SAAO,EAAE,IAAI,MAAM,QAAQ;AAC7B;;;AC3GO,SAAS,sBACd,QACA,sBACuB;AACvB,MAAI,OAAO,UAAU,GAAG;AACtB,WAAO,EAAE,QAAQ,cAAc,MAAM,CAAC,EAAE;AAAA,EAC1C;AAEA,QAAM,OAAoB,CAAC;AAG3B,WAAS,IAAI,GAAG,IAAI,OAAO,SAAS,GAAG,KAAK;AAC1C,UAAM,UAAU,OAAO,CAAC;AACxB,UAAM,OAAO,OAAO,IAAI,CAAC;AAGzB,UAAM,MAAM,cAAc,QAAQ,QAAQ,KAAK,MAAM;AACrD,QAAI,QAAQ,GAAG;AAGb,WAAK,KAAK;AAAA,QACR,aAAa,QAAQ;AAAA,QACrB,WAAW,KAAK;AAAA,QAChB,aAAa,KAAK,IAAI;AAAA,MACxB,CAAC;AAAA,IACH;AAAA,EACF;AAKA,MAAI,KAAK,SAAS,GAAG;AACnB,WAAO,EAAE,QAAQ,gBAAgB,KAAK;AAAA,EACxC;AAEA,SAAO,EAAE,QAAQ,cAAc,MAAM,CAAC,EAAE;AAC1C;;;ACvCO,SAAS,gBACd,GACA,GACY;AAEZ,MAAI,EAAE,YAAY,EAAE,UAAW,QAAO;AACtC,MAAI,EAAE,YAAY,EAAE,UAAW,QAAO;AAGtC,MAAI,EAAE,WAAW,EAAE,SAAU,QAAO;AACpC,MAAI,EAAE,WAAW,EAAE,SAAU,QAAO;AACpC,SAAO;AACT;;;ACdO,SAAS,YACd,OACA,OACY;AACZ,MAAI,UAAU,OAAQ,QAAO;AAE7B,QAAM,OAAO,gBAAgB,KAAK;AAGlC,MAAI,UAAU,kBAAkB,UAAU,UAAU;AAClD,QAAI,KAAK,WAAW,OAAO,KAAK,YAAY,UAAU;AACpD,YAAM,MAAM,KAAK;AAIjB,UAAI,IAAI,SAAS;AAEf,eAAO,IAAI,QAAQ,eAAe;AAClC,eAAO,IAAI,QAAQ,QAAQ;AAC3B,eAAO,IAAI,QAAQ,WAAW;AAAA,MAChC;AAAA,IACF;AAAA,EACF;AAEA,MAAI,UAAU,UAAU;AAEtB,QAAI,KAAK,OAAO;AACd,WAAK,QAAQ;AAAA,IACf;AACA,QAAI,KAAK,WAAW,OAAO,KAAK,YAAY,UAAU;AACpD,YAAM,MAAM,KAAK;AAIjB,UAAI,UAAU;AAAA,IAChB;AAAA,EACF;AAEA,SAAO;AACT;AAEO,SAAS,sBACd,UACwB;AACxB,QAAM,OAAO,EAAE,GAAG,SAAS;AAG3B,SAAO,KAAK;AACZ,SAAO,KAAK;AACZ,SAAO,KAAK;AAEZ,SAAO;AACT;;;ACnCO,SAAS,qBACd,QACgB;AAChB,QAAM,QAAQ,OAAO,kBAAkB;AAGvC,QAAM,eAAe,CAAC,GAAG,OAAO,MAAM,EAAE;AAAA,IAAK,CAAC,GAAG,MAC/C,cAAc,EAAE,QAAQ,EAAE,MAAM;AAAA,EAClC;AAGA,QAAM,iBAAiB,aAAa,IAAI,CAAC,MAAM,YAAY,GAAG,KAAK,CAAC;AAGpE,QAAM,aAAsC,EAAE,IAAI,GAAG,MAAM,GAAG,OAAO,EAAE;AACvE,QAAM,mBAA2C,CAAC;AAElD,iBAAe,QAAQ,CAAC,MAAM;AAC5B,UAAM,UAAW,EAAE,WAAuB;AAC1C,eAAW,OAAO,KAAK,WAAW,OAAO,KAAK,KAAK;AAEnD,QAAI,OAAO,EAAE,WAAW,UAAU;AAChC,uBAAiB,EAAE,MAAM,KAAK,iBAAiB,EAAE,MAAM,KAAK,KAAK;AAAA,IACnE;AAAA,EACF,CAAC;AAED,QAAM,UAA4B;AAAA,IAChC,cAAc,eAAe;AAAA,IAC7B;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA;AAAA,EACrB;AAGA,QAAM,mBAAmB,OAAO,kBAC5B,sBAAsB,OAAO,eAAe,IAC5C;AAEJ,SAAO;AAAA,IACL,UAAU;AAAA,MACR,gBAAgB;AAAA,MAChB,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,MACrC,QAAQ;AAAA,QACN,mBAAmB,OAAO;AAAA,QAC1B,iBAAiB,OAAO,iBAAiB;AAAA,MAC3C;AAAA,MACA,iBAAiB,OAAO;AAAA,MACxB,cAAc,OAAO;AAAA,MACrB,iBAAiB;AAAA,IACnB;AAAA,IACA,QAAQ;AAAA,IACR,mBAAmB;AAAA,IACnB,kBAAkB;AAAA,EACpB;AACF;","names":["derived"]}

package/dist/index.d.cts

@@ -0,0 +1,158 @@
+declare class Base64UrlError extends Error {
+    constructor(message: string);
+}
+declare function base64urlEncodeBytes(bytes: Uint8Array): string;
+declare function base64urlDecodeToBytes(s: string): Uint8Array;
+declare function base64urlEncodeUtf8(s: string): string;
+declare function base64urlDecodeToUtf8(s: string): string;
+
+declare function isUuidV7(id: string): boolean;
+declare function isCanonicalLowerUuid(id: string): boolean;
+
+type CursorValidationReason = "CURSOR_MISMATCH" | "INVALID_FRAME";
+type CursorValidationResult = {
+    ok: true;
+    derived: string;
+} | {
+    ok: false;
+    derived: string;
+    reason: CursorValidationReason;
+};
+type DecodedCursor = {
+    timestamp: number;
+    event_id: string;
+};
+
+interface AuditEvent {
+    event_id: string;
+    timestamp: number;
+    cursor: string;
+    outcome?: Outcome;
+    reason?: string;
+    input?: unknown;
+    request?: {
+        headers?: Record<string, string>;
+        [key: string]: unknown;
+    };
+    [key: string]: unknown;
+}
+interface GatewayStatus {
+    version: string;
+    internal_endpoints?: string[];
+    keys?: Record<string, string>;
+    tokens?: Record<string, string>;
+    [key: string]: unknown;
+}
+type Outcome = "OK" | "DENY" | "ERROR";
+type RedactionLevel = "none" | "safe_default" | "strict";
+interface AuditFilters {
+    [key: string]: unknown;
+}
+type Comparator<T> = (a: T, b: T) => -1 | 0 | 1;
+
+interface EvidenceBundleMetadata {
+    schema_version: string;
+    generated_at: string;
+    source: {
+        dashboard_version: string;
+        gateway_version?: string;
+    };
+    filters_applied?: AuditFilters;
+    cursor_range?: {
+        start?: string;
+        end?: string;
+    };
+    redaction_level: RedactionLevel;
+}
+interface IntegritySummary {
+    total_events: number;
+    by_outcome: Record<Outcome, number>;
+    by_denial_reason: Record<string, number>;
+    cursor_continuity: "VERIFIED" | "GAPS_DETECTED" | "UNKNOWN";
+}
+interface EvidenceBundle {
+    metadata: EvidenceBundleMetadata;
+    events: AuditEvent[];
+    integrity_summary: IntegritySummary;
+    gateway_snapshot?: Partial<GatewayStatus>;
+}
+interface CursorGap {
+    from_cursor: string;
+    to_cursor: string;
+    expected_events?: number;
+    detected_at: number;
+}
+interface ContinuityCheckResult {
+    status: "CONTINUOUS" | "GAP_DETECTED" | "UNKNOWN";
+    gaps: CursorGap[];
+}
+
+/**
+ * Derive a cursor from timestamp and event_id.
+ * cursor = base64url(utf8("{timestamp}:{event_id}"))
+ */
+declare function deriveCursor(timestamp: number, eventId: string): string;
+/**
+ * Decode a cursor to {timestamp, event_id}.
+ * Throws on invalid cursor format.
+ */
+declare function decodeCursor(cursor: string): DecodedCursor;
+/**
+ * Compare two cursors.
+ * Returns -1 if a < b, 0 if equal, 1 if a > b.
+ * Compares by (timestamp, event_id) lexicographically.
+ */
+declare function compareCursor(a: string, b: string): -1 | 0 | 1;
+/**
+ * Validate that an event's cursor matches the derived cursor.
+ * D4=B: Does not throw on invalid frames, returns { ok: false, reason: "INVALID_FRAME" }
+ */
+declare function assertCursorInvariant(event: {
+    timestamp: unknown;
+    event_id: unknown;
+    cursor: unknown;
+}): CursorValidationResult;
+
+/**
+ * Check cursor continuity based on contract-defined rules.
+ * Gap detection requires cursor predecessor relation, not heuristics.
+ * For v1.1, we verify strict ordering.
+ */
+declare function checkCursorContinuity(events: Array<{
+    cursor: string;
+    timestamp: number;
+}>, _expectedPredecessor?: (cursor: string) => string | null): ContinuityCheckResult;
+
+/**
+ * Compare two events for ordering.
+ * Returns -1 if a should come before b (a is "greater" in DESC order)
+ * Returns 0 if equal
+ * Returns 1 if a should come after b
+ *
+ * Ordering: timestamp DESC, then event_id DESC
+ */
+declare function orderingCompare(a: {
+    timestamp: number;
+    event_id: string;
+}, b: {
+    timestamp: number;
+    event_id: string;
+}): -1 | 0 | 1;
+
+declare function redactEvent(event: AuditEvent, level: RedactionLevel): AuditEvent;
+declare function redactGatewaySnapshot(snapshot: GatewayStatus): Partial<GatewayStatus>;
+
+interface CreateEvidenceBundleParams {
+    events: AuditEvent[];
+    redactionLevel?: RedactionLevel;
+    gatewaySnapshot?: GatewayStatus;
+    filters?: AuditFilters;
+    cursorRange?: {
+        start?: string;
+        end?: string;
+    };
+    dashboardVersion: string;
+}
+declare function createEvidenceBundle(params: CreateEvidenceBundleParams): EvidenceBundle;
+
+export { type AuditEvent, type AuditFilters, Base64UrlError, type Comparator, type ContinuityCheckResult, type CursorGap, type CursorValidationReason, type CursorValidationResult, type DecodedCursor, type EvidenceBundle, type EvidenceBundleMetadata, type GatewayStatus, type IntegritySummary, type Outcome, type RedactionLevel, assertCursorInvariant, base64urlDecodeToBytes, base64urlDecodeToUtf8, base64urlEncodeBytes, base64urlEncodeUtf8, checkCursorContinuity, compareCursor, createEvidenceBundle, decodeCursor, deriveCursor, isCanonicalLowerUuid, isUuidV7, orderingCompare, redactEvent, redactGatewaySnapshot };

package/dist/index.d.ts

@@ -0,0 +1,158 @@
+declare class Base64UrlError extends Error {
+    constructor(message: string);
+}
+declare function base64urlEncodeBytes(bytes: Uint8Array): string;
+declare function base64urlDecodeToBytes(s: string): Uint8Array;
+declare function base64urlEncodeUtf8(s: string): string;
+declare function base64urlDecodeToUtf8(s: string): string;
+
+declare function isUuidV7(id: string): boolean;
+declare function isCanonicalLowerUuid(id: string): boolean;
+
+type CursorValidationReason = "CURSOR_MISMATCH" | "INVALID_FRAME";
+type CursorValidationResult = {
+    ok: true;
+    derived: string;
+} | {
+    ok: false;
+    derived: string;
+    reason: CursorValidationReason;
+};
+type DecodedCursor = {
+    timestamp: number;
+    event_id: string;
+};
+
+interface AuditEvent {
+    event_id: string;
+    timestamp: number;
+    cursor: string;
+    outcome?: Outcome;
+    reason?: string;
+    input?: unknown;
+    request?: {
+        headers?: Record<string, string>;
+        [key: string]: unknown;
+    };
+    [key: string]: unknown;
+}
+interface GatewayStatus {
+    version: string;
+    internal_endpoints?: string[];
+    keys?: Record<string, string>;
+    tokens?: Record<string, string>;
+    [key: string]: unknown;
+}
+type Outcome = "OK" | "DENY" | "ERROR";
+type RedactionLevel = "none" | "safe_default" | "strict";
+interface AuditFilters {
+    [key: string]: unknown;
+}
+type Comparator<T> = (a: T, b: T) => -1 | 0 | 1;
+
+interface EvidenceBundleMetadata {
+    schema_version: string;
+    generated_at: string;
+    source: {
+        dashboard_version: string;
+        gateway_version?: string;
+    };
+    filters_applied?: AuditFilters;
+    cursor_range?: {
+        start?: string;
+        end?: string;
+    };
+    redaction_level: RedactionLevel;
+}
+interface IntegritySummary {
+    total_events: number;
+    by_outcome: Record<Outcome, number>;
+    by_denial_reason: Record<string, number>;
+    cursor_continuity: "VERIFIED" | "GAPS_DETECTED" | "UNKNOWN";
+}
+interface EvidenceBundle {
+    metadata: EvidenceBundleMetadata;
+    events: AuditEvent[];
+    integrity_summary: IntegritySummary;
+    gateway_snapshot?: Partial<GatewayStatus>;
+}
+interface CursorGap {
+    from_cursor: string;
+    to_cursor: string;
+    expected_events?: number;
+    detected_at: number;
+}
+interface ContinuityCheckResult {
+    status: "CONTINUOUS" | "GAP_DETECTED" | "UNKNOWN";
+    gaps: CursorGap[];
+}
+
+/**
+ * Derive a cursor from timestamp and event_id.
+ * cursor = base64url(utf8("{timestamp}:{event_id}"))
+ */
+declare function deriveCursor(timestamp: number, eventId: string): string;
+/**
+ * Decode a cursor to {timestamp, event_id}.
+ * Throws on invalid cursor format.
+ */
+declare function decodeCursor(cursor: string): DecodedCursor;
+/**
+ * Compare two cursors.
+ * Returns -1 if a < b, 0 if equal, 1 if a > b.
+ * Compares by (timestamp, event_id) lexicographically.
+ */
+declare function compareCursor(a: string, b: string): -1 | 0 | 1;
+/**
+ * Validate that an event's cursor matches the derived cursor.
+ * D4=B: Does not throw on invalid frames, returns { ok: false, reason: "INVALID_FRAME" }
+ */
+declare function assertCursorInvariant(event: {
+    timestamp: unknown;
+    event_id: unknown;
+    cursor: unknown;
+}): CursorValidationResult;
+
+/**
+ * Check cursor continuity based on contract-defined rules.
+ * Gap detection requires cursor predecessor relation, not heuristics.
+ * For v1.1, we verify strict ordering.
+ */
+declare function checkCursorContinuity(events: Array<{
+    cursor: string;
+    timestamp: number;
+}>, _expectedPredecessor?: (cursor: string) => string | null): ContinuityCheckResult;
+
+/**
+ * Compare two events for ordering.
+ * Returns -1 if a should come before b (a is "greater" in DESC order)
+ * Returns 0 if equal
+ * Returns 1 if a should come after b
+ *
+ * Ordering: timestamp DESC, then event_id DESC
+ */
+declare function orderingCompare(a: {
+    timestamp: number;
+    event_id: string;
+}, b: {
+    timestamp: number;
+    event_id: string;
+}): -1 | 0 | 1;
+
+declare function redactEvent(event: AuditEvent, level: RedactionLevel): AuditEvent;
+declare function redactGatewaySnapshot(snapshot: GatewayStatus): Partial<GatewayStatus>;
+
+interface CreateEvidenceBundleParams {
+    events: AuditEvent[];
+    redactionLevel?: RedactionLevel;
+    gatewaySnapshot?: GatewayStatus;
+    filters?: AuditFilters;
+    cursorRange?: {
+        start?: string;
+        end?: string;
+    };
+    dashboardVersion: string;
+}
+declare function createEvidenceBundle(params: CreateEvidenceBundleParams): EvidenceBundle;
+
+export { type AuditEvent, type AuditFilters, Base64UrlError, type Comparator, type ContinuityCheckResult, type CursorGap, type CursorValidationReason, type CursorValidationResult, type DecodedCursor, type EvidenceBundle, type EvidenceBundleMetadata, type GatewayStatus, type IntegritySummary, type Outcome, type RedactionLevel, assertCursorInvariant, base64urlDecodeToBytes, base64urlDecodeToUtf8, base64urlEncodeBytes, base64urlEncodeUtf8, checkCursorContinuity, compareCursor, createEvidenceBundle, decodeCursor, deriveCursor, isCanonicalLowerUuid, isUuidV7, orderingCompare, redactEvent, redactGatewaySnapshot };

package/dist/index.js

@@ -0,0 +1,290 @@
+// src/infrastructure/base64url.ts
+var Base64UrlError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "Base64UrlError";
+  }
+};
+var ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+var RE_VALID = /^[A-Za-z0-9\-_]*$/;
+function toUtf8Bytes(s) {
+  return new TextEncoder().encode(s);
+}
+function fromUtf8Bytes(b) {
+  return new TextDecoder("utf-8", { fatal: true }).decode(b);
+}
+function base64urlEncodeBytes(bytes) {
+  if (bytes.length === 0) return "";
+  let out = "";
+  let i = 0;
+  while (i + 3 <= bytes.length) {
+    const n = bytes[i] << 16 | bytes[i + 1] << 8 | bytes[i + 2];
+    out += ALPHABET[n >>> 18 & 63];
+    out += ALPHABET[n >>> 12 & 63];
+    out += ALPHABET[n >>> 6 & 63];
+    out += ALPHABET[n & 63];
+    i += 3;
+  }
+  const rem = bytes.length - i;
+  if (rem === 1) {
+    const n = bytes[i];
+    out += ALPHABET[n >>> 2 & 63];
+    out += ALPHABET[n << 4 & 63];
+  } else if (rem === 2) {
+    const n = bytes[i] << 8 | bytes[i + 1];
+    out += ALPHABET[n >>> 10 & 63];
+    out += ALPHABET[n >>> 4 & 63];
+    out += ALPHABET[n << 2 & 63];
+  }
+  return out;
+}
+function decodeChar(c) {
+  const idx = ALPHABET.indexOf(c);
+  if (idx === -1) throw new Base64UrlError(`Invalid base64url character: ${c}`);
+  return idx;
+}
+function base64urlDecodeToBytes(s) {
+  if (s.length === 0) return new Uint8Array(0);
+  if (s.includes("=")) throw new Base64UrlError("Padding is not allowed");
+  if (!RE_VALID.test(s))
+    throw new Base64UrlError("Non-base64url characters present");
+  if (s.length % 4 === 1) throw new Base64UrlError("Invalid base64url length");
+  const out = [];
+  let i = 0;
+  while (i < s.length) {
+    const remain = s.length - i;
+    if (remain >= 4) {
+      const a = decodeChar(s[i]), b = decodeChar(s[i + 1]), c = decodeChar(s[i + 2]), d = decodeChar(s[i + 3]);
+      const n = a << 18 | b << 12 | c << 6 | d;
+      out.push(n >>> 16 & 255, n >>> 8 & 255, n & 255);
+      i += 4;
+      continue;
+    }
+    if (remain === 2) {
+      const a = decodeChar(s[i]), b = decodeChar(s[i + 1]);
+      const n = a << 18 | b << 12;
+      out.push(n >>> 16 & 255);
+      i += 2;
+      continue;
+    }
+    if (remain === 3) {
+      const a = decodeChar(s[i]), b = decodeChar(s[i + 1]), c = decodeChar(s[i + 2]);
+      const n = a << 18 | b << 12 | c << 6;
+      out.push(n >>> 16 & 255, n >>> 8 & 255);
+      i += 3;
+      continue;
+    }
+    throw new Base64UrlError("Invalid base64url length");
+  }
+  const decoded = new Uint8Array(out);
+  const recoded = base64urlEncodeBytes(decoded);
+  if (recoded !== s) throw new Base64UrlError("Non-canonical base64url form");
+  return decoded;
+}
+function base64urlEncodeUtf8(s) {
+  return base64urlEncodeBytes(toUtf8Bytes(s));
+}
+function base64urlDecodeToUtf8(s) {
+  return fromUtf8Bytes(base64urlDecodeToBytes(s));
+}
+
+// src/infrastructure/uuidv7.ts
+var RE_UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+function isUuidV7(id) {
+  if (!RE_UUID.test(id)) return false;
+  const version = id[14];
+  if (version !== "7") return false;
+  const variant = id[19].toLowerCase();
+  return variant === "8" || variant === "9" || variant === "a" || variant === "b";
+}
+function isCanonicalLowerUuid(id) {
+  return id === id.toLowerCase();
+}
+
+// src/domain/logic/cursor.ts
+function isValidUnixSecondsInt(n) {
+  return typeof n === "number" && Number.isInteger(n) && n >= 0 && Number.isSafeInteger(n);
+}
+function isCanonicalTimestampString(s) {
+  if (!/^\d+$/.test(s)) return false;
+  if (s.length > 1 && s.startsWith("0")) return false;
+  return true;
+}
+function deriveCursor(timestamp, eventId) {
+  if (!isValidUnixSecondsInt(timestamp)) {
+    throw new Error("timestamp must be unix seconds integer");
+  }
+  const plain = `${String(timestamp)}:${eventId}`;
+  return base64urlEncodeUtf8(plain);
+}
+function decodeCursor(cursor) {
+  const raw = base64urlDecodeToUtf8(cursor);
+  const colonIndex = raw.indexOf(":");
+  if (colonIndex === -1)
+    throw new Error("cursor frame must be '{timestamp}:{event_id}'");
+  const tsStr = raw.slice(0, colonIndex);
+  const eventId = raw.slice(colonIndex + 1);
+  if (!isCanonicalTimestampString(tsStr))
+    throw new Error("timestamp is not canonical base-10");
+  const tsNum = Number(tsStr);
+  if (!isValidUnixSecondsInt(tsNum))
+    throw new Error("timestamp is out of range");
+  if (!isUuidV7(eventId)) throw new Error("event_id is not uuidv7");
+  if (!isCanonicalLowerUuid(eventId))
+    throw new Error("event_id must be lowercase canonical uuid");
+  return { timestamp: tsNum, event_id: eventId };
+}
+function compareCursor(a, b) {
+  const da = decodeCursor(a);
+  const db = decodeCursor(b);
+  if (da.timestamp < db.timestamp) return -1;
+  if (da.timestamp > db.timestamp) return 1;
+  if (da.event_id < db.event_id) return -1;
+  if (da.event_id > db.event_id) return 1;
+  return 0;
+}
+function assertCursorInvariant(event) {
+  if (!isValidUnixSecondsInt(event.timestamp) || typeof event.event_id !== "string" || typeof event.cursor !== "string") {
+    return { ok: false, derived: "", reason: "INVALID_FRAME" };
+  }
+  try {
+    decodeCursor(event.cursor);
+  } catch {
+    const derived2 = deriveCursor(event.timestamp, event.event_id);
+    return { ok: false, derived: derived2, reason: "INVALID_FRAME" };
+  }
+  const derived = deriveCursor(event.timestamp, event.event_id);
+  if (event.cursor !== derived)
+    return { ok: false, derived, reason: "CURSOR_MISMATCH" };
+  if (!isUuidV7(event.event_id) || !isCanonicalLowerUuid(event.event_id)) {
+    return { ok: false, derived, reason: "INVALID_FRAME" };
+  }
+  return { ok: true, derived };
+}
+
+// src/domain/logic/continuity.ts
+function checkCursorContinuity(events, _expectedPredecessor) {
+  if (events.length <= 1) {
+    return { status: "CONTINUOUS", gaps: [] };
+  }
+  const gaps = [];
+  for (let i = 0; i < events.length - 1; i++) {
+    const current = events[i];
+    const next = events[i + 1];
+    const cmp = compareCursor(current.cursor, next.cursor);
+    if (cmp === 1) {
+      gaps.push({
+        from_cursor: current.cursor,
+        to_cursor: next.cursor,
+        detected_at: Date.now()
+      });
+    }
+  }
+  if (gaps.length > 0) {
+    return { status: "GAP_DETECTED", gaps };
+  }
+  return { status: "CONTINUOUS", gaps: [] };
+}
+
+// src/domain/logic/ordering.ts
+function orderingCompare(a, b) {
+  if (a.timestamp > b.timestamp) return -1;
+  if (a.timestamp < b.timestamp) return 1;
+  if (a.event_id > b.event_id) return -1;
+  if (a.event_id < b.event_id) return 1;
+  return 0;
+}
+
+// src/domain/logic/redaction.ts
+function redactEvent(event, level) {
+  if (level === "none") return event;
+  const copy = structuredClone(event);
+  if (level === "safe_default" || level === "strict") {
+    if (copy.request && typeof copy.request === "object") {
+      const req = copy.request;
+      if (req.headers) {
+        delete req.headers["authorization"];
+        delete req.headers["cookie"];
+        delete req.headers["x-api-key"];
+      }
+    }
+  }
+  if (level === "strict") {
+    if (copy.input) {
+      copy.input = "[REDACTED]";
+    }
+    if (copy.request && typeof copy.request === "object") {
+      const req = copy.request;
+      req.headers = void 0;
+    }
+  }
+  return copy;
+}
+function redactGatewaySnapshot(snapshot) {
+  const copy = { ...snapshot };
+  delete copy.internal_endpoints;
+  delete copy.keys;
+  delete copy.tokens;
+  return copy;
+}
+
+// src/domain/logic/evidence-bundle.ts
+function createEvidenceBundle(params) {
+  const level = params.redactionLevel ?? "safe_default";
+  const sortedEvents = [...params.events].sort(
+    (a, b) => compareCursor(a.cursor, b.cursor)
+  );
+  const redactedEvents = sortedEvents.map((e) => redactEvent(e, level));
+  const by_outcome = { OK: 0, DENY: 0, ERROR: 0 };
+  const by_denial_reason = {};
+  redactedEvents.forEach((e) => {
+    const outcome = e.outcome || "OK";
+    by_outcome[outcome] = (by_outcome[outcome] || 0) + 1;
+    if (typeof e.reason === "string") {
+      by_denial_reason[e.reason] = (by_denial_reason[e.reason] || 0) + 1;
+    }
+  });
+  const summary = {
+    total_events: redactedEvents.length,
+    by_outcome,
+    by_denial_reason,
+    cursor_continuity: "UNKNOWN"
+    // Continuity check is computationally expensive for large bundles
+  };
+  const redactedSnapshot = params.gatewaySnapshot ? redactGatewaySnapshot(params.gatewaySnapshot) : void 0;
+  return {
+    metadata: {
+      schema_version: "1.1.0",
+      generated_at: (/* @__PURE__ */ new Date()).toISOString(),
+      source: {
+        dashboard_version: params.dashboardVersion,
+        gateway_version: params.gatewaySnapshot?.version
+      },
+      filters_applied: params.filters,
+      cursor_range: params.cursorRange,
+      redaction_level: level
+    },
+    events: redactedEvents,
+    integrity_summary: summary,
+    gateway_snapshot: redactedSnapshot
+  };
+}
+export {
+  Base64UrlError,
+  assertCursorInvariant,
+  base64urlDecodeToBytes,
+  base64urlDecodeToUtf8,
+  base64urlEncodeBytes,
+  base64urlEncodeUtf8,
+  checkCursorContinuity,
+  compareCursor,
+  createEvidenceBundle,
+  decodeCursor,
+  deriveCursor,
+  isCanonicalLowerUuid,
+  isUuidV7,
+  orderingCompare,
+  redactEvent,
+  redactGatewaySnapshot
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/infrastructure/base64url.ts","../src/infrastructure/uuidv7.ts","../src/domain/logic/cursor.ts","../src/domain/logic/continuity.ts","../src/domain/logic/ordering.ts","../src/domain/logic/redaction.ts","../src/domain/logic/evidence-bundle.ts"],"sourcesContent":["// src/infrastructure/base64url.ts\n// Strict base64url encoding/decoding - NO btoa/atob, NO padding\n// Uses TextEncoder/TextDecoder for universal runtime support (Node, Browser, Edge)\n\nexport class Base64UrlError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"Base64UrlError\";\n  }\n}\n\nconst ALPHABET =\n  \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\nconst RE_VALID = /^[A-Za-z0-9\\-_]*$/;\n\nfunction toUtf8Bytes(s: string): Uint8Array {\n  return new TextEncoder().encode(s);\n}\n\nfunction fromUtf8Bytes(b: Uint8Array): string {\n  return new TextDecoder(\"utf-8\", { fatal: true }).decode(b);\n}\n\nexport function base64urlEncodeBytes(bytes: Uint8Array): string {\n  if (bytes.length === 0) return \"\";\n\n  let out = \"\";\n  let i = 0;\n\n  while (i + 3 <= bytes.length) {\n    const n = (bytes[i]! << 16) | (bytes[i + 1]! << 8) | bytes[i + 2]!;\n    out += ALPHABET[(n >>> 18) & 63]!;\n    out += ALPHABET[(n >>> 12) & 63]!;\n    out += ALPHABET[(n >>> 6) & 63]!;\n    out += ALPHABET[n & 63]!;\n    i += 3;\n  }\n\n  const rem = bytes.length - i;\n  if (rem === 1) {\n    const n = bytes[i]!;\n    out += ALPHABET[(n >>> 2) & 63]!;\n    out += ALPHABET[(n << 4) & 63]!;\n    // no padding\n  } else if (rem === 2) {\n    const n = (bytes[i]! << 8) | bytes[i + 1]!;\n    out += ALPHABET[(n >>> 10) & 63]!;\n    out += ALPHABET[(n >>> 4) & 63]!;\n    out += ALPHABET[(n << 2) & 63]!;\n    // no padding\n  }\n\n  return out;\n}\n\nfunction decodeChar(c: string): number {\n  const idx = ALPHABET.indexOf(c);\n  if (idx === -1) throw new Base64UrlError(`Invalid base64url character: ${c}`);\n  return idx;\n}\n\nexport function base64urlDecodeToBytes(s: string): Uint8Array {\n  if (s.length === 0) return new Uint8Array(0);\n\n  // Reject padding and non-url alphabet\n  if (s.includes(\"=\")) throw new Base64UrlError(\"Padding is not allowed\");\n  if (!RE_VALID.test(s))\n    throw new Base64UrlError(\"Non-base64url characters present\");\n  // length mod 4 == 1 is impossible for canonical base64url\n  if (s.length % 4 === 1) throw new Base64UrlError(\"Invalid base64url length\");\n\n  const out: number[] = [];\n  let i = 0;\n\n  while (i < s.length) {\n    const remain = s.length - i;\n\n    if (remain >= 4) {\n      const a = decodeChar(s[i]!),\n        b = decodeChar(s[i + 1]!),\n        c = decodeChar(s[i + 2]!),\n        d = decodeChar(s[i + 3]!);\n      const n = (a << 18) | (b << 12) | (c << 6) | d;\n      out.push((n >>> 16) & 255, (n >>> 8) & 255, n & 255);\n      i += 4;\n      continue;\n    }\n\n    if (remain === 2) {\n      const a = decodeChar(s[i]!),\n        b = decodeChar(s[i + 1]!);\n      const n = (a << 18) | (b << 12);\n      out.push((n >>> 16) & 255);\n      i += 2;\n      continue;\n    }\n\n    if (remain === 3) {\n      const a = decodeChar(s[i]!),\n        b = decodeChar(s[i + 1]!),\n        c = decodeChar(s[i + 2]!);\n      const n = (a << 18) | (b << 12) | (c << 6);\n      out.push((n >>> 16) & 255, (n >>> 8) & 255);\n      i += 3;\n      continue;\n    }\n\n    throw new Base64UrlError(\"Invalid base64url length\");\n  }\n\n  const decoded = new Uint8Array(out);\n  // Strict canonical check: re-encode must match exactly\n  const recoded = base64urlEncodeBytes(decoded);\n  if (recoded !== s) throw new Base64UrlError(\"Non-canonical base64url form\");\n  return decoded;\n}\n\nexport function base64urlEncodeUtf8(s: string): string {\n  return base64urlEncodeBytes(toUtf8Bytes(s));\n}\n\nexport function base64urlDecodeToUtf8(s: string): string {\n  return fromUtf8Bytes(base64urlDecodeToBytes(s));\n}\n","// src/infrastructure/uuidv7.ts\n// Strict UUIDv7 validation - pure regex, no external dependencies\n\nconst RE_UUID =\n  /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;\n\nexport function isUuidV7(id: string): boolean {\n  if (!RE_UUID.test(id)) return false;\n  // version nibble is first nibble of 3rd group (position 14)\n  const version = id[14]!;\n  if (version !== \"7\") return false;\n\n  // variant is first nibble of 4th group (position 19): 8, 9, a, b\n  const variant = id[19]!.toLowerCase();\n  return (\n    variant === \"8\" || variant === \"9\" || variant === \"a\" || variant === \"b\"\n  );\n}\n\nexport function isCanonicalLowerUuid(id: string): boolean {\n  return id === id.toLowerCase();\n}\n","// src/domain/logic/cursor.ts\n// Cursor derivation, validation, and comparison\n// D4=B: invalid frames do not throw from validation, return INVALID_FRAME\n\nimport {\n  base64urlDecodeToUtf8,\n  base64urlEncodeUtf8,\n} from \"../../infrastructure/base64url.js\";\nimport { isUuidV7, isCanonicalLowerUuid } from \"../../infrastructure/uuidv7.js\";\nimport type {\n  CursorValidationResult,\n  DecodedCursor,\n} from \"../types/cursor.types.js\";\n\nfunction isValidUnixSecondsInt(n: unknown): n is number {\n  return (\n    typeof n === \"number\" &&\n    Number.isInteger(n) &&\n    n >= 0 &&\n    Number.isSafeInteger(n)\n  );\n}\n\nfunction isCanonicalTimestampString(s: string): boolean {\n  if (!/^\\d+$/.test(s)) return false;\n  if (s.length > 1 && s.startsWith(\"0\")) return false;\n  return true;\n}\n\n/**\n * Derive a cursor from timestamp and event_id.\n * cursor = base64url(utf8(\"{timestamp}:{event_id}\"))\n */\nexport function deriveCursor(timestamp: number, eventId: string): string {\n  if (!isValidUnixSecondsInt(timestamp)) {\n    throw new Error(\"timestamp must be unix seconds integer\");\n  }\n  const plain = `${String(timestamp)}:${eventId}`;\n  return base64urlEncodeUtf8(plain);\n}\n\n/**\n * Decode a cursor to {timestamp, event_id}.\n * Throws on invalid cursor format.\n */\nexport function decodeCursor(cursor: string): DecodedCursor {\n  const raw = base64urlDecodeToUtf8(cursor);\n  const colonIndex = raw.indexOf(\":\");\n  if (colonIndex === -1)\n    throw new Error(\"cursor frame must be '{timestamp}:{event_id}'\");\n\n  const tsStr = raw.slice(0, colonIndex);\n  const eventId = raw.slice(colonIndex + 1);\n\n  if (!isCanonicalTimestampString(tsStr))\n    throw new Error(\"timestamp is not canonical base-10\");\n  const tsNum = Number(tsStr);\n  if (!isValidUnixSecondsInt(tsNum))\n    throw new Error(\"timestamp is out of range\");\n\n  if (!isUuidV7(eventId)) throw new Error(\"event_id is not uuidv7\");\n  if (!isCanonicalLowerUuid(eventId))\n    throw new Error(\"event_id must be lowercase canonical uuid\");\n\n  return { timestamp: tsNum, event_id: eventId };\n}\n\n/**\n * Compare two cursors.\n * Returns -1 if a < b, 0 if equal, 1 if a > b.\n * Compares by (timestamp, event_id) lexicographically.\n */\nexport function compareCursor(a: string, b: string): -1 | 0 | 1 {\n  const da = decodeCursor(a);\n  const db = decodeCursor(b);\n\n  if (da.timestamp < db.timestamp) return -1;\n  if (da.timestamp > db.timestamp) return 1;\n\n  if (da.event_id < db.event_id) return -1;\n  if (da.event_id > db.event_id) return 1;\n  return 0;\n}\n\n/**\n * Validate that an event's cursor matches the derived cursor.\n * D4=B: Does not throw on invalid frames, returns { ok: false, reason: \"INVALID_FRAME\" }\n */\nexport function assertCursorInvariant(event: {\n  timestamp: unknown;\n  event_id: unknown;\n  cursor: unknown;\n}): CursorValidationResult {\n  // Frame checks first (D4=B: do not throw)\n  if (\n    !isValidUnixSecondsInt(event.timestamp) ||\n    typeof event.event_id !== \"string\" ||\n    typeof event.cursor !== \"string\"\n  ) {\n    return { ok: false, derived: \"\", reason: \"INVALID_FRAME\" };\n  }\n\n  // Decode cursor must be strict base64url + canonical frame. If it fails, INVALID_FRAME.\n  try {\n    decodeCursor(event.cursor);\n  } catch {\n    const derived = deriveCursor(event.timestamp, event.event_id);\n    return { ok: false, derived, reason: \"INVALID_FRAME\" };\n  }\n\n  // Derived cursor must match exactly (CURSOR_MISMATCH)\n  const derived = deriveCursor(event.timestamp, event.event_id);\n  if (event.cursor !== derived)\n    return { ok: false, derived, reason: \"CURSOR_MISMATCH\" };\n\n  // Also enforce event_id canonical uuidv7 for the event frame\n  if (!isUuidV7(event.event_id) || !isCanonicalLowerUuid(event.event_id)) {\n    return { ok: false, derived, reason: \"INVALID_FRAME\" };\n  }\n\n  return { ok: true, derived };\n}\n","// src/domain/logic/continuity.ts\n// Cursor continuity checking\n\nimport { compareCursor } from \"./cursor.js\";\nimport type {\n  CursorGap,\n  ContinuityCheckResult,\n} from \"../types/bundle.types.js\";\n\n/**\n * Check cursor continuity based on contract-defined rules.\n * Gap detection requires cursor predecessor relation, not heuristics.\n * For v1.1, we verify strict ordering.\n */\nexport function checkCursorContinuity(\n  events: Array<{ cursor: string; timestamp: number }>,\n  _expectedPredecessor?: (cursor: string) => string | null,\n): ContinuityCheckResult {\n  if (events.length <= 1) {\n    return { status: \"CONTINUOUS\", gaps: [] };\n  }\n\n  const gaps: CursorGap[] = [];\n\n  // Verify ordering\n  for (let i = 0; i < events.length - 1; i++) {\n    const current = events[i];\n    const next = events[i + 1];\n\n    // If next cursor is Lexicographically smaller than current, strict ordering violation\n    const cmp = compareCursor(current.cursor, next.cursor);\n    if (cmp === 1) {\n      // Order violation isn't exactly a \"gap\" but a \"discontinuity\"\n      // For v1.1, we treat this as a Gap for the sake of the interface\n      gaps.push({\n        from_cursor: current.cursor,\n        to_cursor: next.cursor,\n        detected_at: Date.now(),\n      });\n    }\n  }\n\n  // FUTURE(v1.2): Implement actual rigorous predecessor check using Merkle links if available\n  // For now, we only check monotonic ordering.\n\n  if (gaps.length > 0) {\n    return { status: \"GAP_DETECTED\", gaps };\n  }\n\n  return { status: \"CONTINUOUS\", gaps: [] };\n}\n","// src/domain/logic/ordering.ts\n// Event ordering comparison: (timestamp DESC, event_id DESC)\n\n/**\n * Compare two events for ordering.\n * Returns -1 if a should come before b (a is \"greater\" in DESC order)\n * Returns 0 if equal\n * Returns 1 if a should come after b\n *\n * Ordering: timestamp DESC, then event_id DESC\n */\nexport function orderingCompare(\n  a: { timestamp: number; event_id: string },\n  b: { timestamp: number; event_id: string },\n): -1 | 0 | 1 {\n  // DESC timestamp: higher timestamp comes first\n  if (a.timestamp > b.timestamp) return -1;\n  if (a.timestamp < b.timestamp) return 1;\n\n  // DESC event_id: higher event_id comes first (lexicographic)\n  if (a.event_id > b.event_id) return -1;\n  if (a.event_id < b.event_id) return 1;\n  return 0;\n}\n","// src/domain/logic/redaction.ts\n// Event and gateway snapshot redaction\n\nimport type {\n  AuditEvent,\n  GatewayStatus,\n  RedactionLevel,\n} from \"../types/event.types.js\";\n\nexport function redactEvent(\n  event: AuditEvent,\n  level: RedactionLevel,\n): AuditEvent {\n  if (level === \"none\") return event;\n\n  const copy = structuredClone(event); // Deep copy\n\n  // Common redactions for safe_default\n  if (level === \"safe_default\" || level === \"strict\") {\n    if (copy.request && typeof copy.request === \"object\") {\n      const req = copy.request as {\n        headers?: Record<string, string>;\n        [key: string]: unknown;\n      };\n      if (req.headers) {\n        // Strip auth headers\n        delete req.headers[\"authorization\"];\n        delete req.headers[\"cookie\"];\n        delete req.headers[\"x-api-key\"];\n      }\n    }\n  }\n\n  if (level === \"strict\") {\n    // Strict redaction - strip inputs and all headers\n    if (copy.input) {\n      copy.input = \"[REDACTED]\";\n    }\n    if (copy.request && typeof copy.request === \"object\") {\n      const req = copy.request as {\n        headers?: Record<string, string>;\n        [key: string]: unknown;\n      };\n      req.headers = undefined; // Remove all headers\n    }\n  }\n\n  return copy;\n}\n\nexport function redactGatewaySnapshot(\n  snapshot: GatewayStatus,\n): Partial<GatewayStatus> {\n  const copy = { ...snapshot };\n\n  // Always strip these\n  delete copy.internal_endpoints;\n  delete copy.keys;\n  delete copy.tokens;\n\n  return copy;\n}\n","// src/domain/logic/evidence-bundle.ts\n// Evidence bundle creation - pure deterministic transformation\n\nimport { compareCursor } from \"./cursor.js\";\nimport { redactEvent, redactGatewaySnapshot } from \"./redaction.js\";\nimport type {\n  AuditEvent,\n  GatewayStatus,\n  RedactionLevel,\n  AuditFilters,\n  Outcome,\n} from \"../types/event.types.js\";\nimport type {\n  EvidenceBundle,\n  IntegritySummary,\n} from \"../types/bundle.types.js\";\n\nexport interface CreateEvidenceBundleParams {\n  events: AuditEvent[];\n  redactionLevel?: RedactionLevel;\n  gatewaySnapshot?: GatewayStatus;\n  filters?: AuditFilters;\n  cursorRange?: { start?: string; end?: string };\n  dashboardVersion: string;\n}\n\nexport function createEvidenceBundle(\n  params: CreateEvidenceBundleParams,\n): EvidenceBundle {\n  const level = params.redactionLevel ?? \"safe_default\";\n\n  // 1. Sort events by cursor (canonical order)\n  const sortedEvents = [...params.events].sort((a, b) =>\n    compareCursor(a.cursor, b.cursor),\n  );\n\n  // 2. Apply redaction based on level\n  const redactedEvents = sortedEvents.map((e) => redactEvent(e, level));\n\n  // 3. Compute integrity summary\n  const by_outcome: Record<Outcome, number> = { OK: 0, DENY: 0, ERROR: 0 };\n  const by_denial_reason: Record<string, number> = {};\n\n  redactedEvents.forEach((e) => {\n    const outcome = (e.outcome as Outcome) || \"OK\";\n    by_outcome[outcome] = (by_outcome[outcome] || 0) + 1;\n\n    if (typeof e.reason === \"string\") {\n      by_denial_reason[e.reason] = (by_denial_reason[e.reason] || 0) + 1;\n    }\n  });\n\n  const summary: IntegritySummary = {\n    total_events: redactedEvents.length,\n    by_outcome,\n    by_denial_reason,\n    cursor_continuity: \"UNKNOWN\", // Continuity check is computationally expensive for large bundles\n  };\n\n  // 4. Strip secrets from gateway snapshot\n  const redactedSnapshot = params.gatewaySnapshot\n    ? redactGatewaySnapshot(params.gatewaySnapshot)\n    : undefined;\n\n  return {\n    metadata: {\n      schema_version: \"1.1.0\",\n      generated_at: new Date().toISOString(),\n      source: {\n        dashboard_version: params.dashboardVersion,\n        gateway_version: params.gatewaySnapshot?.version,\n      },\n      filters_applied: params.filters,\n      cursor_range: params.cursorRange,\n      redaction_level: level,\n    },\n    events: redactedEvents,\n    integrity_summary: summary,\n    gateway_snapshot: redactedSnapshot,\n  };\n}\n"],"mappings":";AAIO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,IAAM,WACJ;AACF,IAAM,WAAW;AAEjB,SAAS,YAAY,GAAuB;AAC1C,SAAO,IAAI,YAAY,EAAE,OAAO,CAAC;AACnC;AAEA,SAAS,cAAc,GAAuB;AAC5C,SAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,CAAC;AAC3D;AAEO,SAAS,qBAAqB,OAA2B;AAC9D,MAAI,MAAM,WAAW,EAAG,QAAO;AAE/B,MAAI,MAAM;AACV,MAAI,IAAI;AAER,SAAO,IAAI,KAAK,MAAM,QAAQ;AAC5B,UAAM,IAAK,MAAM,CAAC,KAAM,KAAO,MAAM,IAAI,CAAC,KAAM,IAAK,MAAM,IAAI,CAAC;AAChE,WAAO,SAAU,MAAM,KAAM,EAAE;AAC/B,WAAO,SAAU,MAAM,KAAM,EAAE;AAC/B,WAAO,SAAU,MAAM,IAAK,EAAE;AAC9B,WAAO,SAAS,IAAI,EAAE;AACtB,SAAK;AAAA,EACP;AAEA,QAAM,MAAM,MAAM,SAAS;AAC3B,MAAI,QAAQ,GAAG;AACb,UAAM,IAAI,MAAM,CAAC;AACjB,WAAO,SAAU,MAAM,IAAK,EAAE;AAC9B,WAAO,SAAU,KAAK,IAAK,EAAE;AAAA,EAE/B,WAAW,QAAQ,GAAG;AACpB,UAAM,IAAK,MAAM,CAAC,KAAM,IAAK,MAAM,IAAI,CAAC;AACxC,WAAO,SAAU,MAAM,KAAM,EAAE;AAC/B,WAAO,SAAU,MAAM,IAAK,EAAE;AAC9B,WAAO,SAAU,KAAK,IAAK,EAAE;AAAA,EAE/B;AAEA,SAAO;AACT;AAEA,SAAS,WAAW,GAAmB;AACrC,QAAM,MAAM,SAAS,QAAQ,CAAC;AAC9B,MAAI,QAAQ,GAAI,OAAM,IAAI,eAAe,gCAAgC,CAAC,EAAE;AAC5E,SAAO;AACT;AAEO,SAAS,uBAAuB,GAAuB;AAC5D,MAAI,EAAE,WAAW,EAAG,QAAO,IAAI,WAAW,CAAC;AAG3C,MAAI,EAAE,SAAS,GAAG,EAAG,OAAM,IAAI,eAAe,wBAAwB;AACtE,MAAI,CAAC,SAAS,KAAK,CAAC;AAClB,UAAM,IAAI,eAAe,kCAAkC;AAE7D,MAAI,EAAE,SAAS,MAAM,EAAG,OAAM,IAAI,eAAe,0BAA0B;AAE3E,QAAM,MAAgB,CAAC;AACvB,MAAI,IAAI;AAER,SAAO,IAAI,EAAE,QAAQ;AACnB,UAAM,SAAS,EAAE,SAAS;AAE1B,QAAI,UAAU,GAAG;AACf,YAAM,IAAI,WAAW,EAAE,CAAC,CAAE,GACxB,IAAI,WAAW,EAAE,IAAI,CAAC,CAAE,GACxB,IAAI,WAAW,EAAE,IAAI,CAAC,CAAE,GACxB,IAAI,WAAW,EAAE,IAAI,CAAC,CAAE;AAC1B,YAAM,IAAK,KAAK,KAAO,KAAK,KAAO,KAAK,IAAK;AAC7C,UAAI,KAAM,MAAM,KAAM,KAAM,MAAM,IAAK,KAAK,IAAI,GAAG;AACnD,WAAK;AACL;AAAA,IACF;AAEA,QAAI,WAAW,GAAG;AAChB,YAAM,IAAI,WAAW,EAAE,CAAC,CAAE,GACxB,IAAI,WAAW,EAAE,IAAI,CAAC,CAAE;AAC1B,YAAM,IAAK,KAAK,KAAO,KAAK;AAC5B,UAAI,KAAM,MAAM,KAAM,GAAG;AACzB,WAAK;AACL;AAAA,IACF;AAEA,QAAI,WAAW,GAAG;AAChB,YAAM,IAAI,WAAW,EAAE,CAAC,CAAE,GACxB,IAAI,WAAW,EAAE,IAAI,CAAC,CAAE,GACxB,IAAI,WAAW,EAAE,IAAI,CAAC,CAAE;AAC1B,YAAM,IAAK,KAAK,KAAO,KAAK,KAAO,KAAK;AACxC,UAAI,KAAM,MAAM,KAAM,KAAM,MAAM,IAAK,GAAG;AAC1C,WAAK;AACL;AAAA,IACF;AAEA,UAAM,IAAI,eAAe,0BAA0B;AAAA,EACrD;AAEA,QAAM,UAAU,IAAI,WAAW,GAAG;AAElC,QAAM,UAAU,qBAAqB,OAAO;AAC5C,MAAI,YAAY,EAAG,OAAM,IAAI,eAAe,8BAA8B;AAC1E,SAAO;AACT;AAEO,SAAS,oBAAoB,GAAmB;AACrD,SAAO,qBAAqB,YAAY,CAAC,CAAC;AAC5C;AAEO,SAAS,sBAAsB,GAAmB;AACvD,SAAO,cAAc,uBAAuB,CAAC,CAAC;AAChD;;;ACxHA,IAAM,UACJ;AAEK,SAAS,SAAS,IAAqB;AAC5C,MAAI,CAAC,QAAQ,KAAK,EAAE,EAAG,QAAO;AAE9B,QAAM,UAAU,GAAG,EAAE;AACrB,MAAI,YAAY,IAAK,QAAO;AAG5B,QAAM,UAAU,GAAG,EAAE,EAAG,YAAY;AACpC,SACE,YAAY,OAAO,YAAY,OAAO,YAAY,OAAO,YAAY;AAEzE;AAEO,SAAS,qBAAqB,IAAqB;AACxD,SAAO,OAAO,GAAG,YAAY;AAC/B;;;ACPA,SAAS,sBAAsB,GAAyB;AACtD,SACE,OAAO,MAAM,YACb,OAAO,UAAU,CAAC,KAClB,KAAK,KACL,OAAO,cAAc,CAAC;AAE1B;AAEA,SAAS,2BAA2B,GAAoB;AACtD,MAAI,CAAC,QAAQ,KAAK,CAAC,EAAG,QAAO;AAC7B,MAAI,EAAE,SAAS,KAAK,EAAE,WAAW,GAAG,EAAG,QAAO;AAC9C,SAAO;AACT;AAMO,SAAS,aAAa,WAAmB,SAAyB;AACvE,MAAI,CAAC,sBAAsB,SAAS,GAAG;AACrC,UAAM,IAAI,MAAM,wCAAwC;AAAA,EAC1D;AACA,QAAM,QAAQ,GAAG,OAAO,SAAS,CAAC,IAAI,OAAO;AAC7C,SAAO,oBAAoB,KAAK;AAClC;AAMO,SAAS,aAAa,QAA+B;AAC1D,QAAM,MAAM,sBAAsB,MAAM;AACxC,QAAM,aAAa,IAAI,QAAQ,GAAG;AAClC,MAAI,eAAe;AACjB,UAAM,IAAI,MAAM,+CAA+C;AAEjE,QAAM,QAAQ,IAAI,MAAM,GAAG,UAAU;AACrC,QAAM,UAAU,IAAI,MAAM,aAAa,CAAC;AAExC,MAAI,CAAC,2BAA2B,KAAK;AACnC,UAAM,IAAI,MAAM,oCAAoC;AACtD,QAAM,QAAQ,OAAO,KAAK;AAC1B,MAAI,CAAC,sBAAsB,KAAK;AAC9B,UAAM,IAAI,MAAM,2BAA2B;AAE7C,MAAI,CAAC,SAAS,OAAO,EAAG,OAAM,IAAI,MAAM,wBAAwB;AAChE,MAAI,CAAC,qBAAqB,OAAO;AAC/B,UAAM,IAAI,MAAM,2CAA2C;AAE7D,SAAO,EAAE,WAAW,OAAO,UAAU,QAAQ;AAC/C;AAOO,SAAS,cAAc,GAAW,GAAuB;AAC9D,QAAM,KAAK,aAAa,CAAC;AACzB,QAAM,KAAK,aAAa,CAAC;AAEzB,MAAI,GAAG,YAAY,GAAG,UAAW,QAAO;AACxC,MAAI,GAAG,YAAY,GAAG,UAAW,QAAO;AAExC,MAAI,GAAG,WAAW,GAAG,SAAU,QAAO;AACtC,MAAI,GAAG,WAAW,GAAG,SAAU,QAAO;AACtC,SAAO;AACT;AAMO,SAAS,sBAAsB,OAIX;AAEzB,MACE,CAAC,sBAAsB,MAAM,SAAS,KACtC,OAAO,MAAM,aAAa,YAC1B,OAAO,MAAM,WAAW,UACxB;AACA,WAAO,EAAE,IAAI,OAAO,SAAS,IAAI,QAAQ,gBAAgB;AAAA,EAC3D;AAGA,MAAI;AACF,iBAAa,MAAM,MAAM;AAAA,EAC3B,QAAQ;AACN,UAAMA,WAAU,aAAa,MAAM,WAAW,MAAM,QAAQ;AAC5D,WAAO,EAAE,IAAI,OAAO,SAAAA,UAAS,QAAQ,gBAAgB;AAAA,EACvD;AAGA,QAAM,UAAU,aAAa,MAAM,WAAW,MAAM,QAAQ;AAC5D,MAAI,MAAM,WAAW;AACnB,WAAO,EAAE,IAAI,OAAO,SAAS,QAAQ,kBAAkB;AAGzD,MAAI,CAAC,SAAS,MAAM,QAAQ,KAAK,CAAC,qBAAqB,MAAM,QAAQ,GAAG;AACtE,WAAO,EAAE,IAAI,OAAO,SAAS,QAAQ,gBAAgB;AAAA,EACvD;AAEA,SAAO,EAAE,IAAI,MAAM,QAAQ;AAC7B;;;AC3GO,SAAS,sBACd,QACA,sBACuB;AACvB,MAAI,OAAO,UAAU,GAAG;AACtB,WAAO,EAAE,QAAQ,cAAc,MAAM,CAAC,EAAE;AAAA,EAC1C;AAEA,QAAM,OAAoB,CAAC;AAG3B,WAAS,IAAI,GAAG,IAAI,OAAO,SAAS,GAAG,KAAK;AAC1C,UAAM,UAAU,OAAO,CAAC;AACxB,UAAM,OAAO,OAAO,IAAI,CAAC;AAGzB,UAAM,MAAM,cAAc,QAAQ,QAAQ,KAAK,MAAM;AACrD,QAAI,QAAQ,GAAG;AAGb,WAAK,KAAK;AAAA,QACR,aAAa,QAAQ;AAAA,QACrB,WAAW,KAAK;AAAA,QAChB,aAAa,KAAK,IAAI;AAAA,MACxB,CAAC;AAAA,IACH;AAAA,EACF;AAKA,MAAI,KAAK,SAAS,GAAG;AACnB,WAAO,EAAE,QAAQ,gBAAgB,KAAK;AAAA,EACxC;AAEA,SAAO,EAAE,QAAQ,cAAc,MAAM,CAAC,EAAE;AAC1C;;;ACvCO,SAAS,gBACd,GACA,GACY;AAEZ,MAAI,EAAE,YAAY,EAAE,UAAW,QAAO;AACtC,MAAI,EAAE,YAAY,EAAE,UAAW,QAAO;AAGtC,MAAI,EAAE,WAAW,EAAE,SAAU,QAAO;AACpC,MAAI,EAAE,WAAW,EAAE,SAAU,QAAO;AACpC,SAAO;AACT;;;ACdO,SAAS,YACd,OACA,OACY;AACZ,MAAI,UAAU,OAAQ,QAAO;AAE7B,QAAM,OAAO,gBAAgB,KAAK;AAGlC,MAAI,UAAU,kBAAkB,UAAU,UAAU;AAClD,QAAI,KAAK,WAAW,OAAO,KAAK,YAAY,UAAU;AACpD,YAAM,MAAM,KAAK;AAIjB,UAAI,IAAI,SAAS;AAEf,eAAO,IAAI,QAAQ,eAAe;AAClC,eAAO,IAAI,QAAQ,QAAQ;AAC3B,eAAO,IAAI,QAAQ,WAAW;AAAA,MAChC;AAAA,IACF;AAAA,EACF;AAEA,MAAI,UAAU,UAAU;AAEtB,QAAI,KAAK,OAAO;AACd,WAAK,QAAQ;AAAA,IACf;AACA,QAAI,KAAK,WAAW,OAAO,KAAK,YAAY,UAAU;AACpD,YAAM,MAAM,KAAK;AAIjB,UAAI,UAAU;AAAA,IAChB;AAAA,EACF;AAEA,SAAO;AACT;AAEO,SAAS,sBACd,UACwB;AACxB,QAAM,OAAO,EAAE,GAAG,SAAS;AAG3B,SAAO,KAAK;AACZ,SAAO,KAAK;AACZ,SAAO,KAAK;AAEZ,SAAO;AACT;;;ACnCO,SAAS,qBACd,QACgB;AAChB,QAAM,QAAQ,OAAO,kBAAkB;AAGvC,QAAM,eAAe,CAAC,GAAG,OAAO,MAAM,EAAE;AAAA,IAAK,CAAC,GAAG,MAC/C,cAAc,EAAE,QAAQ,EAAE,MAAM;AAAA,EAClC;AAGA,QAAM,iBAAiB,aAAa,IAAI,CAAC,MAAM,YAAY,GAAG,KAAK,CAAC;AAGpE,QAAM,aAAsC,EAAE,IAAI,GAAG,MAAM,GAAG,OAAO,EAAE;AACvE,QAAM,mBAA2C,CAAC;AAElD,iBAAe,QAAQ,CAAC,MAAM;AAC5B,UAAM,UAAW,EAAE,WAAuB;AAC1C,eAAW,OAAO,KAAK,WAAW,OAAO,KAAK,KAAK;AAEnD,QAAI,OAAO,EAAE,WAAW,UAAU;AAChC,uBAAiB,EAAE,MAAM,KAAK,iBAAiB,EAAE,MAAM,KAAK,KAAK;AAAA,IACnE;AAAA,EACF,CAAC;AAED,QAAM,UAA4B;AAAA,IAChC,cAAc,eAAe;AAAA,IAC7B;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA;AAAA,EACrB;AAGA,QAAM,mBAAmB,OAAO,kBAC5B,sBAAsB,OAAO,eAAe,IAC5C;AAEJ,SAAO;AAAA,IACL,UAAU;AAAA,MACR,gBAAgB;AAAA,MAChB,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,MACrC,QAAQ;AAAA,QACN,mBAAmB,OAAO;AAAA,QAC1B,iBAAiB,OAAO,iBAAiB;AAAA,MAC3C;AAAA,MACA,iBAAiB,OAAO;AAAA,MACxB,cAAc,OAAO;AAAA,MACrB,iBAAiB;AAAA,IACnB;AAAA,IACA,QAAQ;AAAA,IACR,mBAAmB;AAAA,IACnB,kBAAkB;AAAA,EACpB;AACF;","names":["derived"]}

package/package.json

@@ -0,0 +1,74 @@
+{
+  "name": "@talosprotocol/contracts",
+  "version": "1.1.5",
+  "description": "Talos Protocol contracts - schemas, types, and helper functions",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./*": null
+  },
+  "sideEffects": false,
+  "scripts": {
+    "build": "tsup src/index.ts --format esm,cjs --dts --clean",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "lint": "eslint . --ext .ts,.tsx,.js,.jsx",
+    "lint:fix": "eslint . --ext .ts,.tsx,.js,.jsx --fix",
+    "format": "prettier -w .",
+    "typecheck": "tsc --noEmit",
+    "validate": "npm run lint && npm run typecheck && npm run build && npm run test",
+    "version:sync": "node ./scripts/version-sync.mjs",
+    "gates:contracts": "echo 'Skipping gates for contracts repo'",
+    "api:snapshot": "npm run build && cp dist/index.d.ts test/fixtures/api-baseline.d.ts",
+    "smoke:pack": "npm pack --dry-run && node scripts/smoke-test.mjs"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "keywords": [
+    "talos",
+    "protocol",
+    "contracts",
+    "mcp",
+    "security"
+  ],
+  "author": "Talos Protocol",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/talosprotocol/talos-contracts.git"
+  },
+  "lint-staged": {
+    "*.{ts,tsx,js,jsx}": [
+      "eslint --fix",
+      "prettier -w"
+    ],
+    "*.{json,md,yml,yaml}": [
+      "prettier -w"
+    ]
+  },
+  "devDependencies": {
+    "@types/node": "^20.19.27",
+    "@typescript-eslint/eslint-plugin": "^8.51.0",
+    "@typescript-eslint/parser": "^8.51.0",
+    "eslint": "^8.57.1",
+    "eslint-config-prettier": "^10.1.8",
+    "husky": "^9.1.7",
+    "lint-staged": "^15.5.2",
+    "prettier": "^3.7.4",
+    "tsup": "^8.0.1",
+    "typescript": "^5.3.0",
+    "vitest": "^1.0.0"
+  }
+}