@vorionsys/platform-core 0.1.0

package/dist/common/provenance/tracker.js

@@ -0,0 +1,209 @@
+/**
+ * Provenance Tracker
+ *
+ * Core tracking functionality for entity provenance.
+ * Tracks who created what, when, and how it changed.
+ *
+ * @packageDocumentation
+ */
+import { randomUUID } from 'node:crypto';
+import { trace, SpanStatusCode } from '@opentelemetry/api';
+import { createLogger } from '../logger.js';
+import { sha256 } from '../crypto.js';
+import { recordAudit } from '../../intent/audit.js';
+const logger = createLogger({ component: 'provenance-tracker' });
+const tracer = trace.getTracer('provenance-tracker');
+/**
+ * ProvenanceTracker class for tracking entity changes
+ */
+export class ProvenanceTracker {
+    storage;
+    constructor(storage) {
+        this.storage = storage;
+    }
+    /**
+     * Track a provenance event for an entity
+     *
+     * @param entity - Entity type being tracked
+     * @param action - Action performed
+     * @param data - Data snapshot at time of action
+     * @param actor - Actor who performed the action
+     * @param tenantId - Tenant identifier
+     * @param metadata - Optional additional metadata
+     * @returns Created provenance record
+     */
+    async track(entity, action, data, actor, tenantId, metadata) {
+        return tracer.startActiveSpan('provenance.track', async (span) => {
+            try {
+                span.setAttribute('entity.type', entity);
+                span.setAttribute('action', action);
+                span.setAttribute('actor.id', actor.id);
+                span.setAttribute('actor.type', actor.type);
+                span.setAttribute('tenant.id', tenantId);
+                // Extract entity ID from data or generate one
+                const entityId = data['id'] || data['entityId'] || randomUUID();
+                // Get the last record for this entity to build the chain
+                const history = await this.storage.getByEntityId(entityId, tenantId, { limit: 1 });
+                const lastRecord = history.items[0];
+                const previousHash = lastRecord?.hash || '';
+                const chainPosition = lastRecord ? lastRecord.chainPosition + 1 : 1;
+                // Use the same timestamp for both hashing and record creation
+                const createdAt = new Date().toISOString();
+                // Create the record content for hashing
+                const recordContent = {
+                    entityId,
+                    entityType: entity,
+                    action,
+                    data,
+                    actor,
+                    tenantId,
+                    previousHash,
+                    chainPosition,
+                    timestamp: createdAt,
+                };
+                // Calculate hash of record content
+                const hash = await sha256(JSON.stringify(recordContent));
+                const record = {
+                    id: randomUUID(),
+                    entityId,
+                    entityType: entity,
+                    action,
+                    data,
+                    actor,
+                    hash,
+                    previousHash,
+                    chainPosition,
+                    tenantId,
+                    metadata,
+                    createdAt,
+                };
+                // Store the record
+                const storedRecord = await this.storage.save(record);
+                logger.debug({
+                    recordId: storedRecord.id,
+                    entityId,
+                    entityType: entity,
+                    action,
+                    actorId: actor.id,
+                    chainPosition,
+                }, 'Provenance record created');
+                // Record audit entry asynchronously
+                recordAudit({
+                    tenantId,
+                    userId: actor.type === 'user' ? actor.id : 'system',
+                    action: 'intent.create',
+                    resourceType: 'intent',
+                    resourceId: entityId,
+                    metadata: {
+                        provenanceRecordId: storedRecord.id,
+                        entityType: entity,
+                        provenanceAction: action,
+                    },
+                });
+                span.setStatus({ code: SpanStatusCode.OK });
+                return storedRecord;
+            }
+            catch (error) {
+                const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+                span.setStatus({ code: SpanStatusCode.ERROR, message: errorMessage });
+                logger.error({ error }, 'Failed to track provenance');
+                throw error;
+            }
+            finally {
+                span.end();
+            }
+        });
+    }
+    /**
+     * Get provenance history for an entity
+     *
+     * @param entityId - Entity identifier
+     * @param tenantId - Tenant identifier
+     * @returns Array of provenance records ordered by chain position
+     */
+    async getHistory(entityId, tenantId) {
+        return tracer.startActiveSpan('provenance.getHistory', async (span) => {
+            try {
+                span.setAttribute('entity.id', entityId);
+                span.setAttribute('tenant.id', tenantId);
+                const result = await this.storage.getByEntityId(entityId, tenantId);
+                logger.debug({ entityId, recordCount: result.items.length }, 'Retrieved provenance history');
+                span.setStatus({ code: SpanStatusCode.OK });
+                return result.items;
+            }
+            catch (error) {
+                const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+                span.setStatus({ code: SpanStatusCode.ERROR, message: errorMessage });
+                logger.error({ error, entityId }, 'Failed to get provenance history');
+                throw error;
+            }
+            finally {
+                span.end();
+            }
+        });
+    }
+    /**
+     * Get a single provenance record by ID
+     *
+     * @param recordId - Record identifier
+     * @param tenantId - Tenant identifier
+     * @returns Provenance record or null if not found
+     */
+    async getRecord(recordId, tenantId) {
+        return tracer.startActiveSpan('provenance.getRecord', async (span) => {
+            try {
+                span.setAttribute('record.id', recordId);
+                span.setAttribute('tenant.id', tenantId);
+                const record = await this.storage.getById(recordId, tenantId);
+                span.setStatus({ code: SpanStatusCode.OK });
+                return record;
+            }
+            catch (error) {
+                const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+                span.setStatus({ code: SpanStatusCode.ERROR, message: errorMessage });
+                logger.error({ error, recordId }, 'Failed to get provenance record');
+                throw error;
+            }
+            finally {
+                span.end();
+            }
+        });
+    }
+    /**
+     * Track a batch of provenance events
+     *
+     * @param records - Array of records to create
+     * @returns Array of created provenance records
+     */
+    async trackBatch(records) {
+        return tracer.startActiveSpan('provenance.trackBatch', async (span) => {
+            try {
+                span.setAttribute('batch.size', records.length);
+                const results = [];
+                for (const record of records) {
+                    const result = await this.track(record.entityType, record.action, record.data, record.actor, record.tenantId, record.metadata);
+                    results.push(result);
+                }
+                logger.debug({ batchSize: records.length }, 'Batch provenance tracking complete');
+                span.setStatus({ code: SpanStatusCode.OK });
+                return results;
+            }
+            catch (error) {
+                const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+                span.setStatus({ code: SpanStatusCode.ERROR, message: errorMessage });
+                logger.error({ error, batchSize: records.length }, 'Failed to track batch provenance');
+                throw error;
+            }
+            finally {
+                span.end();
+            }
+        });
+    }
+}
+/**
+ * Create a new ProvenanceTracker instance
+ */
+export function createProvenanceTracker(storage) {
+    return new ProvenanceTracker(storage);
+}
+//# sourceMappingURL=tracker.js.map

package/dist/common/provenance/tracker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracker.js","sourceRoot":"","sources":["../../../src/common/provenance/tracker.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAOtC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC,CAAC;AACjE,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;AAErD;;GAEG;AACH,MAAM,OAAO,iBAAiB;IACpB,OAAO,CAAoB;IAEnC,YAAY,OAA0B;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,KAAK,CACT,MAAc,EACd,MAAc,EACd,IAA6B,EAC7B,KAAY,EACZ,QAAgB,EAChB,QAAkC;QAElC,OAAO,MAAM,CAAC,eAAe,CAAC,kBAAkB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC/D,IAAI,CAAC;gBACH,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;gBACzC,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACpC,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;gBACxC,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC5C,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;gBAEzC,8CAA8C;gBAC9C,MAAM,QAAQ,GAAI,IAAI,CAAC,IAAI,CAAY,IAAK,IAAI,CAAC,UAAU,CAAY,IAAI,UAAU,EAAE,CAAC;gBAExF,yDAAyD;gBACzD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;gBACnF,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAEpC,MAAM,YAAY,GAAG,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC;gBAC5C,MAAM,aAAa,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAEpE,8DAA8D;gBAC9D,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBAE3C,wCAAwC;gBACxC,MAAM,aAAa,GAAG;oBACpB,QAAQ;oBACR,UAAU,EAAE,MAAM;oBAClB,MAAM;oBACN,IAAI;oBACJ,KAAK;oBACL,QAAQ;oBACR,YAAY;oBACZ,aAAa;oBACb,SAAS,EAAE,SAAS;iBACrB,CAAC;gBAEF,mCAAmC;gBACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;gBAEzD,MAAM,MAAM,GAAqB;oBAC/B,EAAE,EAAE,UAAU,EAAE;oBAChB,QAAQ;oBACR,UAAU,EAAE,MAAM;oBAClB,MAAM;oBACN,IAAI;oBACJ,KAAK;oBACL,IAAI;oBACJ,YAAY;oBACZ,aAAa;oBACb,QAAQ;oBACR,QAAQ;oBACR,SAAS;iBACV,CAAC;gBAEF,mBAAmB;gBACnB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAErD,MAAM,CAAC,KAAK,CACV;oBACE,QAAQ,EAAE,YAAY,CAAC,EAAE;oBACzB,QAAQ;oBACR,UAAU,EAAE,MAAM;oBAClB,MAAM;oBACN,OAAO,EAAE,KAAK,CAAC,EAAE;oBACjB,aAAa;iBACd,EACD,2BAA2B,CAC5B,CAAC;gBAEF,oCAAoC;gBACpC,WAAW,CAAC;oBACV,QAAQ;oBACR,MAAM,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ;oBACnD,MAAM,EAAE,eAAwB;oBAChC,YAAY,EAAE,QAAQ;oBACtB,UAAU,EAAE,QAAQ;oBACpB,QAAQ,EAAE;wBACR,kBAAkB,EAAE,YAAY,CAAC,EAAE;wBACnC,UAAU,EAAE,MAAM;wBAClB,gBAAgB,EAAE,MAAM;qBACzB;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC5C,OAAO,YAAY,CAAC;YACtB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBAC9E,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;gBACtE,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,4BAA4B,CAAC,CAAC;gBACtD,MAAM,KAAK,CAAC;YACd,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,QAAgB;QACjD,OAAO,MAAM,CAAC,eAAe,CAAC,uBAAuB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACpE,IAAI,CAAC;gBACH,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;gBACzC,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;gBAEzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAEpE,MAAM,CAAC,KAAK,CACV,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAC9C,8BAA8B,CAC/B,CAAC;gBAEF,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC5C,OAAO,MAAM,CAAC,KAAK,CAAC;YACtB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBAC9E,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;gBACtE,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,kCAAkC,CAAC,CAAC;gBACtE,MAAM,KAAK,CAAC;YACd,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,CAAC,QAAgB,EAAE,QAAgB;QAChD,OAAO,MAAM,CAAC,eAAe,CAAC,sBAAsB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACnE,IAAI,CAAC;gBACH,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;gBACzC,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;gBAEzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAE9D,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC5C,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBAC9E,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;gBACtE,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,iCAAiC,CAAC,CAAC;gBACrE,MAAM,KAAK,CAAC;YACd,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,OAAiC;QAChD,OAAO,MAAM,CAAC,eAAe,CAAC,uBAAuB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACpE,IAAI,CAAC;gBACH,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBAEhD,MAAM,OAAO,GAAuB,EAAE,CAAC;gBACvC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;oBAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,QAAQ,CAChB,CAAC;oBACF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACvB,CAAC;gBAED,MAAM,CAAC,KAAK,CACV,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,EAC7B,oCAAoC,CACrC,CAAC;gBAEF,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC5C,OAAO,OAAO,CAAC;YACjB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBAC9E,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;gBACtE,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,kCAAkC,CAAC,CAAC;gBACvF,MAAM,KAAK,CAAC;YACd,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAA0B;IAChE,OAAO,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC"}

package/dist/common/provenance/types.d.ts

@@ -0,0 +1,146 @@
+/**
+ * Provenance Tracking Types
+ *
+ * Core types for tracking entity provenance - who created what, when, and how it changed.
+ * Supports SOC2 compliance and audit requirements.
+ *
+ * @packageDocumentation
+ */
+import type { ID, Timestamp } from '../types.js';
+/**
+ * Actor types for provenance tracking
+ */
+export type ActorType = 'user' | 'system' | 'agent';
+/**
+ * Actor who performed an action
+ */
+export interface Actor {
+    /** Unique actor identifier */
+    id: ID;
+    /** Type of actor */
+    type: ActorType;
+    /** Additional actor metadata */
+    metadata: Record<string, unknown>;
+}
+/**
+ * Provenance record for tracking entity changes
+ */
+export interface ProvenanceRecord {
+    /** Unique record identifier */
+    id: ID;
+    /** Entity identifier being tracked */
+    entityId: ID;
+    /** Entity type (e.g., 'intent', 'policy', 'agent') */
+    entityType: string;
+    /** Action performed (e.g., 'create', 'update', 'delete') */
+    action: string;
+    /** Data snapshot at time of action */
+    data: Record<string, unknown>;
+    /** Actor who performed the action */
+    actor: Actor;
+    /** Hash of this record's content */
+    hash: string;
+    /** Hash of previous record in chain (empty for first record) */
+    previousHash: string;
+    /** Chain position (1-indexed) */
+    chainPosition: number;
+    /** Tenant identifier for multi-tenancy */
+    tenantId: ID;
+    /** Additional metadata */
+    metadata?: Record<string, unknown>;
+    /** Record creation timestamp */
+    createdAt: Timestamp;
+}
+/**
+ * Input for creating a provenance record
+ */
+export interface CreateProvenanceRecord {
+    entityId: ID;
+    entityType: string;
+    action: string;
+    data: Record<string, unknown>;
+    actor: Actor;
+    tenantId: ID;
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Query filters for provenance records
+ */
+export interface ProvenanceQueryFilters {
+    /** Filter by entity ID */
+    entityId?: ID;
+    /** Filter by entity type */
+    entityType?: string;
+    /** Filter by actor ID */
+    actorId?: ID;
+    /** Filter by actor type */
+    actorType?: ActorType;
+    /** Filter by action */
+    action?: string;
+    /** Filter by tenant */
+    tenantId?: ID;
+    /** Filter by time range start */
+    from?: Date;
+    /** Filter by time range end */
+    to?: Date;
+}
+/**
+ * Pagination options
+ */
+export interface PaginationOptions {
+    /** Number of records to return */
+    limit?: number;
+    /** Number of records to skip */
+    offset?: number;
+}
+/**
+ * Paginated query result
+ */
+export interface PaginatedResult<T> {
+    /** Result items */
+    items: T[];
+    /** Total count of matching records */
+    total: number;
+    /** Whether more records exist */
+    hasMore: boolean;
+    /** Current offset */
+    offset: number;
+    /** Current limit */
+    limit: number;
+}
+/**
+ * Export format options
+ */
+export type ExportFormat = 'json' | 'csv';
+/**
+ * Chain verification result
+ */
+export interface ChainVerificationResult {
+    /** Whether the chain is valid */
+    valid: boolean;
+    /** Number of records verified */
+    recordsVerified: number;
+    /** Position of first invalid record (if any) */
+    invalidAtPosition?: number;
+    /** Error message if verification failed */
+    error?: string;
+    /** Verification timestamp */
+    verifiedAt: Timestamp;
+}
+/**
+ * Tamper detection result
+ */
+export interface TamperDetectionResult {
+    /** Whether tampering was detected */
+    tampered: boolean;
+    /** Details about detected tampering */
+    details?: {
+        position: number;
+        expectedHash: string;
+        actualHash: string;
+        reason: string;
+    }[];
+    /** Detection timestamp */
+    detectedAt: Timestamp;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/common/provenance/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/common/provenance/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEjD;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEpD;;GAEG;AACH,MAAM,WAAW,KAAK;IACpB,8BAA8B;IAC9B,EAAE,EAAE,EAAE,CAAC;IACP,oBAAoB;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,gCAAgC;IAChC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+BAA+B;IAC/B,EAAE,EAAE,EAAE,CAAC;IACP,sCAAsC;IACtC,QAAQ,EAAE,EAAE,CAAC;IACb,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,qCAAqC;IACrC,KAAK,EAAE,KAAK,CAAC;IACb,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,0CAA0C;IAC1C,QAAQ,EAAE,EAAE,CAAC;IACb,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,gCAAgC;IAChC,SAAS,EAAE,SAAS,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,EAAE,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,EAAE,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,EAAE,CAAC;IACd,4BAA4B;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yBAAyB;IACzB,OAAO,CAAC,EAAE,EAAE,CAAC;IACb,2BAA2B;IAC3B,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,uBAAuB;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uBAAuB;IACvB,QAAQ,CAAC,EAAE,EAAE,CAAC;IACd,iCAAiC;IACjC,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,+BAA+B;IAC/B,EAAE,CAAC,EAAE,IAAI,CAAC;CACX;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,kCAAkC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe,CAAC,CAAC;IAChC,mBAAmB;IACnB,KAAK,EAAE,CAAC,EAAE,CAAC;IACX,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,qBAAqB;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,KAAK,CAAC;AAE1C;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,iCAAiC;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,iCAAiC;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6BAA6B;IAC7B,UAAU,EAAE,SAAS,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,qCAAqC;IACrC,QAAQ,EAAE,OAAO,CAAC;IAClB,uCAAuC;IACvC,OAAO,CAAC,EAAE;QACR,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KAChB,EAAE,CAAC;IACJ,0BAA0B;IAC1B,UAAU,EAAE,SAAS,CAAC;CACvB"}

package/dist/common/provenance/types.js

@@ -0,0 +1,10 @@
+/**
+ * Provenance Tracking Types
+ *
+ * Core types for tracking entity provenance - who created what, when, and how it changed.
+ * Supports SOC2 compliance and audit requirements.
+ *
+ * @packageDocumentation
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/common/provenance/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/common/provenance/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/common/random.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Secure Random Utilities
+ *
+ * Cryptographically secure random number generation utilities
+ * to replace Math.random() throughout the codebase.
+ *
+ * Uses Node.js crypto module for all randomness to ensure
+ * unpredictable values suitable for security-sensitive operations.
+ *
+ * @packageDocumentation
+ */
+/**
+ * Generate a cryptographically secure random integer between min (inclusive) and max (exclusive)
+ *
+ * @param min - Minimum value (inclusive)
+ * @param max - Maximum value (exclusive)
+ * @returns A secure random integer in the range [min, max)
+ */
+export declare function secureRandomInt(min: number, max: number): number;
+/**
+ * Generate a cryptographically secure random float between 0 (inclusive) and 1 (exclusive)
+ *
+ * Uses 32 bits of randomness for good precision while maintaining performance.
+ *
+ * @returns A secure random float in the range [0, 1)
+ */
+export declare function secureRandomFloat(): number;
+/**
+ * Generate a cryptographically secure random element from an array
+ *
+ * @param array - The array to choose from
+ * @returns A randomly selected element from the array
+ * @throws Error if the array is empty
+ */
+export declare function secureRandomChoice<T>(array: readonly T[]): T;
+/**
+ * Cryptographically secure Fisher-Yates shuffle
+ *
+ * Creates a new shuffled array without modifying the original.
+ *
+ * @param array - The array to shuffle
+ * @returns A new array with elements in random order
+ */
+export declare function secureRandomShuffle<T>(array: readonly T[]): T[];
+/**
+ * Generate cryptographically secure random bytes
+ *
+ * @param length - Number of bytes to generate
+ * @returns Buffer containing random bytes
+ */
+export declare function secureRandomBytes(length: number): Buffer;
+/**
+ * Generate a secure unique identifier
+ *
+ * Uses crypto.randomUUID() for RFC 4122 v4 UUID generation.
+ *
+ * @returns A cryptographically secure UUID string
+ */
+export declare function secureRandomId(): string;
+/**
+ * Generate a secure random string suitable for IDs
+ *
+ * Creates a URL-safe base64 string from random bytes.
+ *
+ * @param length - Approximate length of the resulting string (actual length may vary slightly)
+ * @returns A random URL-safe string
+ */
+export declare function secureRandomString(length?: number): string;
+/**
+ * Generate jitter for delays using secure randomness
+ *
+ * @param baseDelay - The base delay value
+ * @param jitterFactor - Jitter factor (e.g., 0.25 for 25% jitter). Range: [-jitterFactor, +jitterFactor]
+ * @returns Base delay with random jitter applied
+ */
+export declare function secureJitter(baseDelay: number, jitterFactor: number): number;
+/**
+ * Determine if an event should occur based on probability using secure randomness
+ *
+ * @param probability - Probability of returning true (0 to 1)
+ * @returns true with the given probability
+ */
+export declare function secureRandomBoolean(probability: number): boolean;
+//# sourceMappingURL=random.d.ts.map

package/dist/common/random.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"random.d.ts","sourceRoot":"","sources":["../../src/common/random.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAKhE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAM1C;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAM5D;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,EAAE,CAO/D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,GAAE,MAAW,GAAG,MAAM,CAM9D;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAK5E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAIhE"}

package/dist/common/random.js

@@ -0,0 +1,130 @@
+/**
+ * Secure Random Utilities
+ *
+ * Cryptographically secure random number generation utilities
+ * to replace Math.random() throughout the codebase.
+ *
+ * Uses Node.js crypto module for all randomness to ensure
+ * unpredictable values suitable for security-sensitive operations.
+ *
+ * @packageDocumentation
+ */
+import { randomBytes, randomInt, randomUUID } from 'node:crypto';
+/**
+ * Generate a cryptographically secure random integer between min (inclusive) and max (exclusive)
+ *
+ * @param min - Minimum value (inclusive)
+ * @param max - Maximum value (exclusive)
+ * @returns A secure random integer in the range [min, max)
+ */
+export function secureRandomInt(min, max) {
+    if (min >= max) {
+        throw new Error('min must be less than max');
+    }
+    return randomInt(min, max);
+}
+/**
+ * Generate a cryptographically secure random float between 0 (inclusive) and 1 (exclusive)
+ *
+ * Uses 32 bits of randomness for good precision while maintaining performance.
+ *
+ * @returns A secure random float in the range [0, 1)
+ */
+export function secureRandomFloat() {
+    // Generate 4 random bytes (32 bits) and convert to a number between 0 and 1
+    const buffer = randomBytes(4);
+    const uint32 = buffer.readUInt32BE(0);
+    // Divide by 2^32 to get a float in [0, 1)
+    return uint32 / 0x100000000;
+}
+/**
+ * Generate a cryptographically secure random element from an array
+ *
+ * @param array - The array to choose from
+ * @returns A randomly selected element from the array
+ * @throws Error if the array is empty
+ */
+export function secureRandomChoice(array) {
+    if (array.length === 0) {
+        throw new Error('Cannot choose from an empty array');
+    }
+    const index = randomInt(0, array.length);
+    return array[index];
+}
+/**
+ * Cryptographically secure Fisher-Yates shuffle
+ *
+ * Creates a new shuffled array without modifying the original.
+ *
+ * @param array - The array to shuffle
+ * @returns A new array with elements in random order
+ */
+export function secureRandomShuffle(array) {
+    const result = [...array];
+    for (let i = result.length - 1; i > 0; i--) {
+        const j = randomInt(0, i + 1);
+        [result[i], result[j]] = [result[j], result[i]];
+    }
+    return result;
+}
+/**
+ * Generate cryptographically secure random bytes
+ *
+ * @param length - Number of bytes to generate
+ * @returns Buffer containing random bytes
+ */
+export function secureRandomBytes(length) {
+    return randomBytes(length);
+}
+/**
+ * Generate a secure unique identifier
+ *
+ * Uses crypto.randomUUID() for RFC 4122 v4 UUID generation.
+ *
+ * @returns A cryptographically secure UUID string
+ */
+export function secureRandomId() {
+    return randomUUID();
+}
+/**
+ * Generate a secure random string suitable for IDs
+ *
+ * Creates a URL-safe base64 string from random bytes.
+ *
+ * @param length - Approximate length of the resulting string (actual length may vary slightly)
+ * @returns A random URL-safe string
+ */
+export function secureRandomString(length = 11) {
+    // Base64 encodes 3 bytes into 4 characters, so we need ceil(length * 3/4) bytes
+    const byteLength = Math.ceil((length * 3) / 4);
+    const bytes = randomBytes(byteLength);
+    // Use base64url encoding (URL-safe base64 without padding)
+    return bytes.toString('base64url').slice(0, length);
+}
+/**
+ * Generate jitter for delays using secure randomness
+ *
+ * @param baseDelay - The base delay value
+ * @param jitterFactor - Jitter factor (e.g., 0.25 for 25% jitter). Range: [-jitterFactor, +jitterFactor]
+ * @returns Base delay with random jitter applied
+ */
+export function secureJitter(baseDelay, jitterFactor) {
+    // Generate a random value in [-1, 1] range
+    const randomValue = secureRandomFloat() * 2 - 1;
+    const jitter = baseDelay * jitterFactor * randomValue;
+    return baseDelay + jitter;
+}
+/**
+ * Determine if an event should occur based on probability using secure randomness
+ *
+ * @param probability - Probability of returning true (0 to 1)
+ * @returns true with the given probability
+ */
+export function secureRandomBoolean(probability) {
+    if (probability <= 0)
+        return false;
+    if (probability >= 1)
+        return true;
+    return secureRandomFloat() < probability;
+}
+//# sourceMappingURL=random.js.map

package/dist/common/random.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"random.js","sourceRoot":"","sources":["../../src/common/random.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,GAAW;IACtD,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB;IAC/B,4EAA4E;IAC5E,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtC,0CAA0C;IAC1C,OAAO,MAAM,GAAG,WAAW,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAI,KAAmB;IACvD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAI,KAAmB;IACxD,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB,EAAE;IACpD,gFAAgF;IAChF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACtC,2DAA2D;IAC3D,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,YAAoB;IAClE,2CAA2C;IAC3C,MAAM,WAAW,GAAG,iBAAiB,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,SAAS,GAAG,YAAY,GAAG,WAAW,CAAC;IACtD,OAAO,SAAS,GAAG,MAAM,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,IAAI,WAAW,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,WAAW,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,iBAAiB,EAAE,GAAG,WAAW,CAAC;AAC3C,CAAC"}

package/dist/common/redaction.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Sensitive Data Redaction Utilities
+ *
+ * Provides deep redaction of sensitive data in objects and arrays.
+ * Supports configurable sensitive field patterns and custom redaction functions.
+ *
+ * @packageDocumentation
+ */
+/**
+ * Redaction configuration
+ */
+export interface RedactionConfig {
+    /** Custom sensitive field patterns */
+    sensitivePatterns?: RegExp[];
+    /** Replacement value for redacted fields */
+    replacement?: string;
+    /** Maximum depth for nested redaction */
+    maxDepth?: number;
+    /** Whether to preserve field type indicators */
+    preserveType?: boolean;
+    /** Custom redaction function for specific fields */
+    customRedactor?: (key: string, value: unknown) => unknown;
+    /** Fields to explicitly allow (whitelist) */
+    allowedFields?: string[];
+}
+/**
+ * Deep clone and redact sensitive data from an object
+ */
+export declare function redact<T>(data: T, config?: RedactionConfig): T;
+/**
+ * Redact sensitive data from a string (e.g., log message)
+ */
+export declare function redactString(text: string, config?: Partial<RedactionConfig>): string;
+/**
+ * Create a redactor with preset configuration
+ */
+export declare function createRedactor(config?: RedactionConfig): {
+    redact: <T>(data: T) => T;
+    redactString: (text: string) => string;
+};
+/**
+ * Safely stringify an object with redaction
+ */
+export declare function safeStringify(data: unknown, config?: RedactionConfig, space?: number): string;
+/**
+ * Export default patterns for customization
+ */
+export declare const SENSITIVE_PATTERNS: RegExp[];
+//# sourceMappingURL=redaction.d.ts.map

package/dist/common/redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../src/common/redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAkDH;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,sCAAsC;IACtC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,4CAA4C;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,oDAAoD;IACpD,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IAC1D,6CAA6C;IAC7C,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAwDD;;GAEG;AACH,wBAAgB,MAAM,CAAC,CAAC,EACtB,IAAI,EAAE,CAAC,EACP,MAAM,GAAE,eAAoB,GAC3B,CAAC,CASH;AA6DD;;GAEG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,OAAO,CAAC,eAAe,CAAM,GACpC,MAAM,CAmDR;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,GAAE,eAAoB;aAE9C,CAAC,QAAQ,CAAC;yBACE,MAAM;EAE9B;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,OAAO,EACb,MAAM,GAAE,eAAoB,EAC5B,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAOR;AAED;;GAEG;AACH,eAAO,MAAM,kBAAkB,UAA6B,CAAC"}