@vorionsys/security 1.0.0

package/dist/trust-engine/car-integration.d.ts

@@ -0,0 +1,244 @@
+/**
+ * CAR Integration for Trust Engine
+ *
+ * Bridges CAR identity layer with Vorion runtime trust enforcement.
+ *
+ * **CRITICAL DESIGN PRINCIPLE:**
+ * The CAR is an IMMUTABLE identifier. Trust is NOT embedded in the CAR.
+ * Trust is computed at RUNTIME from:
+ * 1. Attestations (external certifications linked to the CAR identity)
+ * 2. Behavioral signals (runtime observations)
+ * 3. Deployment context policies
+ *
+ * This separation ensures:
+ * - CAR remains stable (like a passport number)
+ * - Trust can evolve independently
+ * - Same agent can have different trust in different deployments
+ *
+ * @packageDocumentation
+ */
+import { ParsedCAR, CertificationTier, RuntimeTier, CapabilityLevel, type CARIdentity } from '@vorionsys/contracts/car';
+import type { TrustScore, ID } from '../common/types.js';
+import { z } from 'zod';
+/**
+ * Attestation record from CAR certification
+ */
+export interface Attestation {
+    /** Unique attestation identifier */
+    id: string;
+    /** Subject entity (agent) this attestation is for */
+    subject: ID;
+    /** Issuing authority (e.g., auditor, certifier) */
+    issuer: string;
+    /** Certified trust tier (T0-T5) */
+    trustTier: CertificationTier;
+    /** Scope of the attestation (domains, capabilities) */
+    scope: string[];
+    /** When the attestation was issued */
+    issuedAt: Date;
+    /** When the attestation expires */
+    expiresAt: Date;
+    /** Supporting evidence references */
+    evidence: string[];
+}
+/**
+ * CAR Trust Context
+ *
+ * Combines identity (from CAR) with trust (from attestations + runtime).
+ *
+ * IMPORTANT: The certificationTier comes from ATTESTATIONS, not the CAR itself.
+ * The CAR is just an identifier; trust is computed at runtime.
+ */
+export interface CARTrustContext {
+    /** Parsed CAR string (identifier only, no trust info) */
+    car: ParsedCAR;
+    /** Unique identity portion: registry.organization.agentClass */
+    identity: CARIdentity;
+    /** Competence/capability level from CAR */
+    competenceLevel: CapabilityLevel;
+    /** Domains the agent operates in (from CAR) */
+    operationalDomains: string[];
+    /** Certification tier from attestations (T0-T5) - defaults to T0 if no attestation */
+    certificationTier: CertificationTier;
+    /** Whether a valid attestation exists for this agent */
+    hasValidAttestation: boolean;
+    /** Attestation expiry (if any) */
+    attestationExpiresAt?: Date;
+    /** Current runtime trust tier based on behavioral signals */
+    runtimeTier: RuntimeTier;
+    /** Current runtime trust score (0-1000) */
+    runtimeScore: TrustScore;
+    /** Max tier based on observability class */
+    observabilityCeiling: RuntimeTier;
+    /** Max tier based on deployment context policy */
+    contextPolicyCeiling: RuntimeTier;
+    /** Effective tier after applying all ceilings */
+    effectiveTier: RuntimeTier;
+    /** Effective score after applying all ceilings */
+    effectiveScore: TrustScore;
+}
+/** @deprecated Use CARTrustContext instead */
+export type ACITrustContext = CARTrustContext;
+/**
+ * Result of effective permission calculation
+ */
+export interface EffectivePermission {
+    /** Effective trust tier */
+    tier: RuntimeTier;
+    /** Effective trust score */
+    score: TrustScore;
+    /** Certified domains */
+    domains: string[];
+    /** Capability level */
+    level: CapabilityLevel;
+    /** Reason why the ceiling was applied (if any) */
+    ceilingReason?: string;
+}
+/**
+ * Trust signal derived from an attestation
+ */
+export interface TrustSignal {
+    /** Unique signal identifier */
+    id: string;
+    /** Entity this signal is for */
+    entityId: ID;
+    /** Signal type */
+    type: string;
+    /** Signal value (impact on trust) */
+    value: number;
+    /** Weight multiplier */
+    weight: number;
+    /** Source of the signal */
+    source: string;
+    /** When this signal was created */
+    timestamp: string;
+    /** Additional metadata */
+    metadata: Record<string, unknown>;
+}
+/**
+ * Result of a permission check
+ */
+export interface PermissionCheckResult {
+    /** Whether the action is allowed */
+    allowed: boolean;
+    /** Effective trust tier */
+    effectiveTier: RuntimeTier;
+    /** Effective trust score */
+    effectiveScore: TrustScore;
+    /** Reason for denial (if not allowed) */
+    reason?: string;
+    /** Explanation of which ceiling limited the permission */
+    ceilingReason?: string;
+}
+/**
+ * Schema for Attestation validation
+ */
+export declare const AttestationSchema: z.ZodObject<{
+    id: z.ZodString;
+    subject: z.ZodString;
+    issuer: z.ZodString;
+    trustTier: z.ZodType<CertificationTier>;
+    scope: z.ZodArray<z.ZodString, "many">;
+    issuedAt: z.ZodDate;
+    expiresAt: z.ZodDate;
+    evidence: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    id?: string;
+    expiresAt?: Date;
+    issuer?: string;
+    scope?: string[];
+    subject?: string;
+    issuedAt?: Date;
+    evidence?: string[];
+    trustTier?: CertificationTier;
+}, {
+    id?: string;
+    expiresAt?: Date;
+    issuer?: string;
+    scope?: string[];
+    subject?: string;
+    issuedAt?: Date;
+    evidence?: string[];
+    trustTier?: CertificationTier;
+}>;
+/**
+ * Convert certification tier to minimum trust score
+ */
+export declare function certificationTierToMinScore(tier: CertificationTier): TrustScore;
+/**
+ * Convert certification tier to maximum trust score
+ */
+export declare function certificationTierToMaxScore(tier: CertificationTier): TrustScore;
+/**
+ * Convert certification tier to a representative trust score
+ */
+export declare function certificationTierToScore(tier: CertificationTier): number;
+/**
+ * Convert trust score to runtime tier
+ */
+export declare function scoreToTier(score: TrustScore): RuntimeTier;
+/**
+ * Get minimum score for a given tier
+ */
+export declare function tierToMinScore(tier: RuntimeTier): TrustScore;
+/**
+ * Convert competence level to ceiling tier
+ */
+export declare function competenceLevelToCeiling(level: CapabilityLevel): RuntimeTier;
+/**
+ * Determine which factor is limiting the effective tier
+ */
+export declare function determineCeilingReason(ctx: CARTrustContext, effectiveTier: RuntimeTier): string | undefined;
+/**
+ * Calculate effective permission from CAR context
+ *
+ * The effective tier is the minimum of:
+ * 1. Certification tier (from attestations, NOT the CAR itself)
+ * 2. Competence ceiling (what the agent's capability allows)
+ * 3. Runtime tier (what behavioral signals indicate)
+ * 4. Observability ceiling (what we can verify)
+ * 5. Context policy ceiling (what the deployment allows)
+ */
+export declare function calculateEffectiveFromCAR(ctx: CARTrustContext): EffectivePermission;
+/** @deprecated Use calculateEffectiveFromCAR instead */
+export declare const calculateEffectiveFromACI: typeof calculateEffectiveFromCAR;
+/**
+ * Create a CAR Trust Context from a parsed CAR and attestation lookup.
+ */
+export declare function createCARTrustContext(parsedCAR: ParsedCAR, attestation: Attestation | null, runtimeScore: TrustScore, observabilityCeiling: RuntimeTier, contextCeiling: RuntimeTier): CARTrustContext;
+/** @deprecated Use createCARTrustContext instead */
+export declare const createACITrustContext: typeof createCARTrustContext;
+/**
+ * Convert attestation to Vorion trust signal
+ */
+export declare function attestationToTrustSignal(attestation: Attestation): TrustSignal;
+/**
+ * Apply CAR floor to runtime trust
+ *
+ * An agent with T3 certification starts at minimum T3 score.
+ * The certification tier provides a "floor".
+ */
+export declare function applyCARFloor(runtimeScore: TrustScore, certificationTier: CertificationTier): TrustScore;
+/** @deprecated Use applyCARFloor instead */
+export declare const applyACIFloor: typeof applyCARFloor;
+/**
+ * Enforce CAR ceiling on runtime trust
+ *
+ * Runtime cannot exceed what the agent is certified for.
+ */
+export declare function enforceCARCeiling(runtimeScore: TrustScore, certificationTier: CertificationTier): TrustScore;
+/** @deprecated Use enforceCARCeiling instead */
+export declare const enforceACICeiling: typeof enforceCARCeiling;
+/**
+ * Calculate effective tier combining multiple factors
+ */
+export declare function calculateEffectiveTier(certificationTier: CertificationTier, competenceLevel: CapabilityLevel, runtimeTier: RuntimeTier, observabilityCeiling: RuntimeTier, contextCeiling: RuntimeTier): RuntimeTier;
+/**
+ * Calculate effective score combining multiple factors
+ */
+export declare function calculateEffectiveScore(certificationTier: CertificationTier, runtimeScore: TrustScore, observabilityCeiling: RuntimeTier, contextCeiling: RuntimeTier): TrustScore;
+/**
+ * Look up the certification tier for a CAR identity from attestations.
+ */
+export declare function lookupCertificationTier(identity: CARIdentity, attestations: Attestation[]): CertificationTier;
+//# sourceMappingURL=car-integration.d.ts.map

package/dist/trust-engine/car-integration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"car-integration.d.ts","sourceRoot":"","sources":["../../src/trust-engine/car-integration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EACL,SAAS,EAET,iBAAiB,EACjB,WAAW,EACX,eAAe,EAGf,KAAK,WAAW,EAEjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAc,UAAU,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AAErE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAyBxB;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,oCAAoC;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,qDAAqD;IACrD,OAAO,EAAE,EAAE,CAAC;IACZ,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,SAAS,EAAE,iBAAiB,CAAC;IAC7B,uDAAuD;IACvD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,sCAAsC;IACtC,QAAQ,EAAE,IAAI,CAAC;IACf,mCAAmC;IACnC,SAAS,EAAE,IAAI,CAAC;IAChB,qCAAqC;IACrC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAE9B,yDAAyD;IACzD,GAAG,EAAE,SAAS,CAAC;IACf,gEAAgE;IAChE,QAAQ,EAAE,WAAW,CAAC;IACtB,2CAA2C;IAC3C,eAAe,EAAE,eAAe,CAAC;IACjC,+CAA+C;IAC/C,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAG7B,sFAAsF;IACtF,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,wDAAwD;IACxD,mBAAmB,EAAE,OAAO,CAAC;IAC7B,kCAAkC;IAClC,oBAAoB,CAAC,EAAE,IAAI,CAAC;IAG5B,6DAA6D;IAC7D,WAAW,EAAE,WAAW,CAAC;IACzB,2CAA2C;IAC3C,YAAY,EAAE,UAAU,CAAC;IAGzB,4CAA4C;IAC5C,oBAAoB,EAAE,WAAW,CAAC;IAClC,kDAAkD;IAClD,oBAAoB,EAAE,WAAW,CAAC;IAGlC,iDAAiD;IACjD,aAAa,EAAE,WAAW,CAAC;IAC3B,kDAAkD;IAClD,cAAc,EAAE,UAAU,CAAC;CAC5B;AAED,8CAA8C;AAC9C,MAAM,MAAM,eAAe,GAAG,eAAe,CAAC;AAE9C;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,2BAA2B;IAC3B,IAAI,EAAE,WAAW,CAAC;IAClB,4BAA4B;IAC5B,KAAK,EAAE,UAAU,CAAC;IAClB,wBAAwB;IACxB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,uBAAuB;IACvB,KAAK,EAAE,eAAe,CAAC;IACvB,kDAAkD;IAClD,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,+BAA+B;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,gCAAgC;IAChC,QAAQ,EAAE,EAAE,CAAC;IACb,kBAAkB;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,oCAAoC;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,2BAA2B;IAC3B,aAAa,EAAE,WAAW,CAAC;IAC3B,4BAA4B;IAC5B,cAAc,EAAE,UAAU,CAAC;IAC3B,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAMD;;GAEG;AACH,eAAO,MAAM,iBAAiB;;;;eAIiB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;;;;;;;;;;;;;;;;;;;;;;;EAKzE,CAAC;AAkCH;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,iBAAiB,GAAG,UAAU,CAE/E;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,iBAAiB,GAAG,UAAU,CAE/E;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAKxE;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,CAS1D;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,WAAW,GAAG,UAAU,CAE5D;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,eAAe,GAAG,WAAW,CAe5E;AAMD;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,eAAe,EACpB,aAAa,EAAE,WAAW,GACzB,MAAM,GAAG,SAAS,CAsBpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,eAAe,GAAG,mBAAmB,CA8BnF;AAED,wDAAwD;AACxD,eAAO,MAAM,yBAAyB,kCAA4B,CAAC;AAEnE;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,WAAW,GAAG,IAAI,EAC/B,YAAY,EAAE,UAAU,EACxB,oBAAoB,EAAE,WAAW,EACjC,cAAc,EAAE,WAAW,GAC1B,eAAe,CAsCjB;AAED,oDAAoD;AACpD,eAAO,MAAM,qBAAqB,8BAAwB,CAAC;AAuB3D;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,WAAW,GAAG,WAAW,CAgB9E;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,YAAY,EAAE,UAAU,EACxB,iBAAiB,EAAE,iBAAiB,GACnC,UAAU,CAYZ;AAED,4CAA4C;AAC5C,eAAO,MAAM,aAAa,sBAAgB,CAAC;AAE3C;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,UAAU,EACxB,iBAAiB,EAAE,iBAAiB,GACnC,UAAU,CAYZ;AAED,gDAAgD;AAChD,eAAO,MAAM,iBAAiB,0BAAoB,CAAC;AAEnD;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,iBAAiB,EAAE,iBAAiB,EACpC,eAAe,EAAE,eAAe,EAChC,WAAW,EAAE,WAAW,EACxB,oBAAoB,EAAE,WAAW,EACjC,cAAc,EAAE,WAAW,GAC1B,WAAW,CAQb;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,iBAAiB,EAAE,iBAAiB,EACpC,YAAY,EAAE,UAAU,EACxB,oBAAoB,EAAE,WAAW,EACjC,cAAc,EAAE,WAAW,GAC1B,UAAU,CAWZ;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,WAAW,EACrB,YAAY,EAAE,WAAW,EAAE,GAC1B,iBAAiB,CAoBnB"}

package/dist/trust-engine/car-integration.js

@@ -0,0 +1,332 @@
+/**
+ * CAR Integration for Trust Engine
+ *
+ * Bridges CAR identity layer with Vorion runtime trust enforcement.
+ *
+ * **CRITICAL DESIGN PRINCIPLE:**
+ * The CAR is an IMMUTABLE identifier. Trust is NOT embedded in the CAR.
+ * Trust is computed at RUNTIME from:
+ * 1. Attestations (external certifications linked to the CAR identity)
+ * 2. Behavioral signals (runtime observations)
+ * 3. Deployment context policies
+ *
+ * This separation ensures:
+ * - CAR remains stable (like a passport number)
+ * - Trust can evolve independently
+ * - Same agent can have different trust in different deployments
+ *
+ * @packageDocumentation
+ */
+import { getCARIdentity, } from '@vorionsys/contracts/car';
+import { createLogger } from '../common/logger.js';
+import { z } from 'zod';
+const logger = createLogger({ component: 'car-integration' });
+// ============================================================================
+// Helper Functions
+// ============================================================================
+/**
+ * Convert CertificationTier to RuntimeTier
+ * Both use 0-5 values, so we can safely convert via unknown
+ */
+function certificationToRuntimeTier(certTier) {
+    return certTier;
+}
+/**
+ * Default certification tier when no attestation exists
+ */
+const DEFAULT_CERTIFICATION_TIER = 0; // T0: Unverified
+// ============================================================================
+// Zod Schemas for Validation
+// ============================================================================
+/**
+ * Schema for Attestation validation
+ */
+export const AttestationSchema = z.object({
+    id: z.string().uuid(),
+    subject: z.string(),
+    issuer: z.string(),
+    trustTier: z.number().int().min(0).max(7),
+    scope: z.array(z.string()),
+    issuedAt: z.date(),
+    expiresAt: z.date(),
+    evidence: z.array(z.string()),
+});
+// ============================================================================
+// Tier/Score Conversion Utilities
+// ============================================================================
+/**
+ * Tier to minimum score mapping (aligned with TRUST_THRESHOLDS)
+ */
+const TIER_TO_MIN_SCORE = {
+    0: 0, // T0_SANDBOX
+    1: 200, // T1_OBSERVED
+    2: 350, // T2_PROVISIONAL
+    3: 500, // T3_MONITORED
+    4: 650, // T4_STANDARD
+    5: 800, // T5_TRUSTED
+    6: 876, // T6_CERTIFIED
+    7: 951, // T7_AUTONOMOUS
+};
+/**
+ * Tier to maximum score mapping (aligned with TIER_TO_MIN_SCORE)
+ */
+const TIER_TO_MAX_SCORE = {
+    0: 199, // T0_SANDBOX: 0-199
+    1: 349, // T1_OBSERVED: 200-349
+    2: 499, // T2_PROVISIONAL: 350-499
+    3: 649, // T3_MONITORED: 500-649
+    4: 799, // T4_STANDARD: 650-799
+    5: 875, // T5_TRUSTED: 800-875
+    6: 950, // T6_CERTIFIED: 876-950
+    7: 1000, // T7_AUTONOMOUS: 951-1000
+};
+/**
+ * Convert certification tier to minimum trust score
+ */
+export function certificationTierToMinScore(tier) {
+    return TIER_TO_MIN_SCORE[certificationToRuntimeTier(tier)] ?? 0;
+}
+/**
+ * Convert certification tier to maximum trust score
+ */
+export function certificationTierToMaxScore(tier) {
+    return TIER_TO_MAX_SCORE[certificationToRuntimeTier(tier)] ?? 1000;
+}
+/**
+ * Convert certification tier to a representative trust score
+ */
+export function certificationTierToScore(tier) {
+    const runtimeTier = certificationToRuntimeTier(tier);
+    const min = TIER_TO_MIN_SCORE[runtimeTier] ?? 0;
+    const max = TIER_TO_MAX_SCORE[runtimeTier] ?? 199;
+    return Math.floor((min + max) / 2);
+}
+/**
+ * Convert trust score to runtime tier
+ */
+export function scoreToTier(score) {
+    if (score >= 951)
+        return 7; // T7_AUTONOMOUS
+    if (score >= 876)
+        return 6; // T6_CERTIFIED
+    if (score >= 800)
+        return 5; // T5_TRUSTED
+    if (score >= 650)
+        return 4; // T4_STANDARD
+    if (score >= 500)
+        return 3; // T3_MONITORED
+    if (score >= 350)
+        return 2; // T2_PROVISIONAL
+    if (score >= 200)
+        return 1; // T1_OBSERVED
+    return 0; // T0_SANDBOX
+}
+/**
+ * Get minimum score for a given tier
+ */
+export function tierToMinScore(tier) {
+    return TIER_TO_MIN_SCORE[tier] ?? 0;
+}
+/**
+ * Convert competence level to ceiling tier
+ */
+export function competenceLevelToCeiling(level) {
+    if (typeof level === 'number') {
+        return Math.min(7, level);
+    }
+    const levelMap = {
+        none: 0,
+        basic: 1,
+        intermediate: 2,
+        advanced: 3,
+        expert: 4,
+        master: 5,
+        certified: 6,
+        autonomous: 7,
+    };
+    return levelMap[String(level).toLowerCase()] ?? 2;
+}
+// ============================================================================
+// Core CAR Integration Functions
+// ============================================================================
+/**
+ * Determine which factor is limiting the effective tier
+ */
+export function determineCeilingReason(ctx, effectiveTier) {
+    const certTierAsRuntime = certificationToRuntimeTier(ctx.certificationTier);
+    if (effectiveTier === certTierAsRuntime) {
+        if (!ctx.hasValidAttestation) {
+            return 'Limited by lack of attestation (default T0)';
+        }
+        return 'Limited by attestation certification tier';
+    }
+    if (effectiveTier === competenceLevelToCeiling(ctx.competenceLevel)) {
+        return 'Limited by competence level';
+    }
+    if (effectiveTier === ctx.runtimeTier) {
+        return 'Limited by runtime behavioral trust';
+    }
+    if (effectiveTier === ctx.observabilityCeiling) {
+        return 'Limited by observability class';
+    }
+    if (effectiveTier === ctx.contextPolicyCeiling) {
+        return 'Limited by deployment context policy';
+    }
+    return undefined;
+}
+/**
+ * Calculate effective permission from CAR context
+ *
+ * The effective tier is the minimum of:
+ * 1. Certification tier (from attestations, NOT the CAR itself)
+ * 2. Competence ceiling (what the agent's capability allows)
+ * 3. Runtime tier (what behavioral signals indicate)
+ * 4. Observability ceiling (what we can verify)
+ * 5. Context policy ceiling (what the deployment allows)
+ */
+export function calculateEffectiveFromCAR(ctx) {
+    const effectiveTier = Math.min(certificationToRuntimeTier(ctx.certificationTier), competenceLevelToCeiling(ctx.competenceLevel), ctx.runtimeTier, ctx.observabilityCeiling, ctx.contextPolicyCeiling);
+    logger.debug({
+        identity: ctx.identity,
+        certificationTier: ctx.certificationTier,
+        hasValidAttestation: ctx.hasValidAttestation,
+        competenceCeiling: competenceLevelToCeiling(ctx.competenceLevel),
+        runtimeTier: ctx.runtimeTier,
+        observabilityCeiling: ctx.observabilityCeiling,
+        contextPolicyCeiling: ctx.contextPolicyCeiling,
+        effectiveTier,
+    }, 'Calculated effective tier from CAR context');
+    return {
+        tier: effectiveTier,
+        score: tierToMinScore(effectiveTier),
+        domains: [...ctx.operationalDomains],
+        level: ctx.competenceLevel,
+        ceilingReason: determineCeilingReason(ctx, effectiveTier),
+    };
+}
+/** @deprecated Use calculateEffectiveFromCAR instead */
+export const calculateEffectiveFromACI = calculateEffectiveFromCAR;
+/**
+ * Create a CAR Trust Context from a parsed CAR and attestation lookup.
+ */
+export function createCARTrustContext(parsedCAR, attestation, runtimeScore, observabilityCeiling, contextCeiling) {
+    const identity = getCARIdentity(parsedCAR);
+    const certificationTier = attestation?.trustTier ?? DEFAULT_CERTIFICATION_TIER;
+    const hasValidAttestation = attestation !== null && attestation.expiresAt > new Date();
+    const runtimeTier = scoreToTier(runtimeScore);
+    const effectiveTier = Math.min(certificationToRuntimeTier(certificationTier), competenceLevelToCeiling(parsedCAR.level), runtimeTier, observabilityCeiling, contextCeiling);
+    const effectiveScore = calculateEffectiveScoreFromFactors(runtimeScore, certificationTier, observabilityCeiling, contextCeiling);
+    return {
+        car: parsedCAR,
+        identity,
+        competenceLevel: parsedCAR.level,
+        operationalDomains: [...parsedCAR.domains],
+        certificationTier,
+        hasValidAttestation,
+        attestationExpiresAt: attestation?.expiresAt,
+        runtimeTier,
+        runtimeScore,
+        observabilityCeiling,
+        contextPolicyCeiling: contextCeiling,
+        effectiveTier,
+        effectiveScore,
+    };
+}
+/** @deprecated Use createCARTrustContext instead */
+export const createACITrustContext = createCARTrustContext;
+/**
+ * Calculate effective score from multiple factors.
+ */
+function calculateEffectiveScoreFromFactors(runtimeScore, certificationTier, observabilityCeiling, contextCeiling) {
+    let score = applyCARFloor(runtimeScore, certificationTier);
+    score = enforceCARCeiling(score, certificationTier);
+    const observabilityMax = TIER_TO_MAX_SCORE[observabilityCeiling];
+    score = Math.min(score, observabilityMax);
+    const contextMax = TIER_TO_MAX_SCORE[contextCeiling];
+    score = Math.min(score, contextMax);
+    return score;
+}
+/**
+ * Convert attestation to Vorion trust signal
+ */
+export function attestationToTrustSignal(attestation) {
+    return {
+        id: crypto.randomUUID(),
+        entityId: attestation.subject,
+        type: 'ATTESTATION',
+        value: certificationTierToScore(attestation.trustTier),
+        weight: 1.0,
+        source: attestation.issuer,
+        timestamp: attestation.issuedAt.toISOString(),
+        metadata: {
+            scope: attestation.scope,
+            expiresAt: attestation.expiresAt.toISOString(),
+            evidence: attestation.evidence,
+            attestationId: attestation.id,
+        },
+    };
+}
+/**
+ * Apply CAR floor to runtime trust
+ *
+ * An agent with T3 certification starts at minimum T3 score.
+ * The certification tier provides a "floor".
+ */
+export function applyCARFloor(runtimeScore, certificationTier) {
+    const floorScore = certificationTierToMinScore(certificationTier);
+    const result = Math.max(runtimeScore, floorScore);
+    if (result > runtimeScore) {
+        logger.debug({ runtimeScore, floorScore, result, certificationTier }, 'Applied CAR floor to runtime score');
+    }
+    return result;
+}
+/** @deprecated Use applyCARFloor instead */
+export const applyACIFloor = applyCARFloor;
+/**
+ * Enforce CAR ceiling on runtime trust
+ *
+ * Runtime cannot exceed what the agent is certified for.
+ */
+export function enforceCARCeiling(runtimeScore, certificationTier) {
+    const ceilingScore = certificationTierToMaxScore(certificationTier);
+    const result = Math.min(runtimeScore, ceilingScore);
+    if (result < runtimeScore) {
+        logger.debug({ runtimeScore, ceilingScore, result, certificationTier }, 'Enforced CAR ceiling on runtime score');
+    }
+    return result;
+}
+/** @deprecated Use enforceCARCeiling instead */
+export const enforceACICeiling = enforceCARCeiling;
+/**
+ * Calculate effective tier combining multiple factors
+ */
+export function calculateEffectiveTier(certificationTier, competenceLevel, runtimeTier, observabilityCeiling, contextCeiling) {
+    return Math.min(certificationToRuntimeTier(certificationTier), competenceLevelToCeiling(competenceLevel), runtimeTier, observabilityCeiling, contextCeiling);
+}
+/**
+ * Calculate effective score combining multiple factors
+ */
+export function calculateEffectiveScore(certificationTier, runtimeScore, observabilityCeiling, contextCeiling) {
+    let score = applyCARFloor(runtimeScore, certificationTier);
+    score = enforceCARCeiling(score, certificationTier);
+    const observabilityMax = TIER_TO_MAX_SCORE[observabilityCeiling];
+    score = Math.min(score, observabilityMax);
+    const contextMax = TIER_TO_MAX_SCORE[contextCeiling];
+    score = Math.min(score, contextMax);
+    return score;
+}
+/**
+ * Look up the certification tier for a CAR identity from attestations.
+ */
+export function lookupCertificationTier(identity, attestations) {
+    const now = new Date();
+    const validAttestations = attestations.filter((a) => a.subject === identity && a.expiresAt > now);
+    if (validAttestations.length === 0) {
+        logger.debug({ identity }, 'No valid attestations found, using default tier');
+        return DEFAULT_CERTIFICATION_TIER;
+    }
+    const maxTier = Math.max(...validAttestations.map((a) => a.trustTier));
+    logger.debug({ identity, attestationCount: validAttestations.length, maxTier }, 'Found valid attestations for identity');
+    return maxTier;
+}
+//# sourceMappingURL=car-integration.js.map

package/dist/trust-engine/car-integration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"car-integration.js","sourceRoot":"","sources":["../../src/trust-engine/car-integration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAOL,cAAc,GAGf,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAE9D,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E;;;GAGG;AACH,SAAS,0BAA0B,CAAC,QAA2B;IAC7D,OAAO,QAAkC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,0BAA0B,GAAsB,CAAC,CAAC,CAAC,iBAAiB;AAmI1E,+EAA+E;AAC/E,6BAA6B;AAC7B,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAiC;IACzE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1B,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC9B,CAAC,CAAC;AAEH,+EAA+E;AAC/E,kCAAkC;AAClC,+EAA+E;AAE/E;;GAEG;AACH,MAAM,iBAAiB,GAAoC;IACzD,CAAC,EAAE,CAAC,EAAK,aAAa;IACtB,CAAC,EAAE,GAAG,EAAG,cAAc;IACvB,CAAC,EAAE,GAAG,EAAG,iBAAiB;IAC1B,CAAC,EAAE,GAAG,EAAG,eAAe;IACxB,CAAC,EAAE,GAAG,EAAG,cAAc;IACvB,CAAC,EAAE,GAAG,EAAG,aAAa;IACtB,CAAC,EAAE,GAAG,EAAG,eAAe;IACxB,CAAC,EAAE,GAAG,EAAG,gBAAgB;CAC1B,CAAC;AAEF;;GAEG;AACH,MAAM,iBAAiB,GAAoC;IACzD,CAAC,EAAE,GAAG,EAAI,oBAAoB;IAC9B,CAAC,EAAE,GAAG,EAAI,uBAAuB;IACjC,CAAC,EAAE,GAAG,EAAI,0BAA0B;IACpC,CAAC,EAAE,GAAG,EAAI,wBAAwB;IAClC,CAAC,EAAE,GAAG,EAAI,uBAAuB;IACjC,CAAC,EAAE,GAAG,EAAI,sBAAsB;IAChC,CAAC,EAAE,GAAG,EAAI,wBAAwB;IAClC,CAAC,EAAE,IAAI,EAAG,0BAA0B;CACrC,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAuB;IACjE,OAAO,iBAAiB,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;AAClE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAuB;IACjE,OAAO,iBAAiB,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC;AACrE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAuB;IAC9D,MAAM,WAAW,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,iBAAiB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,iBAAiB,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC;IAClD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,KAAiB;IAC3C,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,CAAC,CAAC,CAAE,gBAAgB;IAC7C,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,CAAC,CAAC,CAAE,eAAe;IAC5C,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,CAAC,CAAC,CAAE,aAAa;IAC1C,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,CAAC,CAAC,CAAE,cAAc;IAC3C,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,CAAC,CAAC,CAAE,eAAe;IAC5C,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,CAAC,CAAC,CAAE,iBAAiB;IAC9C,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,CAAC,CAAC,CAAE,cAAc;IAC3C,OAAO,CAAC,CAAC,CAAoB,aAAa;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,IAAiB;IAC9C,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAsB;IAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAgB,CAAC;IAC3C,CAAC;IACD,MAAM,QAAQ,GAAgC;QAC5C,IAAI,EAAE,CAAC;QACP,KAAK,EAAE,CAAC;QACR,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,CAAC;QACT,SAAS,EAAE,CAAC;QACZ,UAAU,EAAE,CAAC;KACd,CAAC;IACF,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;AACpD,CAAC;AAED,+EAA+E;AAC/E,iCAAiC;AACjC,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAoB,EACpB,aAA0B;IAE1B,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAE5E,IAAI,aAAa,KAAK,iBAAiB,EAAE,CAAC;QACxC,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;YAC7B,OAAO,6CAA6C,CAAC;QACvD,CAAC;QACD,OAAO,2CAA2C,CAAC;IACrD,CAAC;IACD,IAAI,aAAa,KAAK,wBAAwB,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QACpE,OAAO,6BAA6B,CAAC;IACvC,CAAC;IACD,IAAI,aAAa,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC;QACtC,OAAO,qCAAqC,CAAC;IAC/C,CAAC;IACD,IAAI,aAAa,KAAK,GAAG,CAAC,oBAAoB,EAAE,CAAC;QAC/C,OAAO,gCAAgC,CAAC;IAC1C,CAAC;IACD,IAAI,aAAa,KAAK,GAAG,CAAC,oBAAoB,EAAE,CAAC;QAC/C,OAAO,sCAAsC,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAoB;IAC5D,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,0BAA0B,CAAC,GAAG,CAAC,iBAAiB,CAAC,EACjD,wBAAwB,CAAC,GAAG,CAAC,eAAe,CAAC,EAC7C,GAAG,CAAC,WAAW,EACf,GAAG,CAAC,oBAAoB,EACxB,GAAG,CAAC,oBAAoB,CACV,CAAC;IAEjB,MAAM,CAAC,KAAK,CACV;QACE,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;QAC5C,iBAAiB,EAAE,wBAAwB,CAAC,GAAG,CAAC,eAAe,CAAC;QAChE,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;QAC9C,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;QAC9C,aAAa;KACd,EACD,4CAA4C,CAC7C,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,cAAc,CAAC,aAAa,CAAC;QACpC,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,kBAAkB,CAAC;QACpC,KAAK,EAAE,GAAG,CAAC,eAAe;QAC1B,aAAa,EAAE,sBAAsB,CAAC,GAAG,EAAE,aAAa,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAEnE;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAoB,EACpB,WAA+B,EAC/B,YAAwB,EACxB,oBAAiC,EACjC,cAA2B;IAE3B,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAE3C,MAAM,iBAAiB,GAAG,WAAW,EAAE,SAAS,IAAI,0BAA0B,CAAC;IAC/E,MAAM,mBAAmB,GAAG,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvF,MAAM,WAAW,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IAE9C,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,0BAA0B,CAAC,iBAAiB,CAAC,EAC7C,wBAAwB,CAAC,SAAS,CAAC,KAAK,CAAC,EACzC,WAAW,EACX,oBAAoB,EACpB,cAAc,CACA,CAAC;IAEjB,MAAM,cAAc,GAAG,kCAAkC,CACvD,YAAY,EACZ,iBAAiB,EACjB,oBAAoB,EACpB,cAAc,CACf,CAAC;IAEF,OAAO;QACL,GAAG,EAAE,SAAS;QACd,QAAQ;QACR,eAAe,EAAE,SAAS,CAAC,KAAK;QAChC,kBAAkB,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;QAC1C,iBAAiB;QACjB,mBAAmB;QACnB,oBAAoB,EAAE,WAAW,EAAE,SAAS;QAC5C,WAAW;QACX,YAAY;QACZ,oBAAoB;QACpB,oBAAoB,EAAE,cAAc;QACpC,aAAa;QACb,cAAc;KACf,CAAC;AACJ,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAE3D;;GAEG;AACH,SAAS,kCAAkC,CACzC,YAAwB,EACxB,iBAAoC,EACpC,oBAAiC,EACjC,cAA2B;IAE3B,IAAI,KAAK,GAAG,aAAa,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;IAC3D,KAAK,GAAG,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAEpD,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,oBAAoB,CAAC,CAAC;IACjE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAE1C,MAAM,UAAU,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;IACrD,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAEpC,OAAO,KAAmB,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,WAAwB;IAC/D,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;QACvB,QAAQ,EAAE,WAAW,CAAC,OAAO;QAC7B,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,wBAAwB,CAAC,WAAW,CAAC,SAAS,CAAC;QACtD,MAAM,EAAE,GAAG;QACX,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,SAAS,EAAE,WAAW,CAAC,QAAQ,CAAC,WAAW,EAAE;QAC7C,QAAQ,EAAE;YACR,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,SAAS,EAAE,WAAW,CAAC,SAAS,CAAC,WAAW,EAAE;YAC9C,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,aAAa,EAAE,WAAW,CAAC,EAAE;SAC9B;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,YAAwB,EACxB,iBAAoC;IAEpC,MAAM,UAAU,GAAG,2BAA2B,CAAC,iBAAiB,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAElD,IAAI,MAAM,GAAG,YAAY,EAAE,CAAC;QAC1B,MAAM,CAAC,KAAK,CACV,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAE,EACvD,oCAAoC,CACrC,CAAC;IACJ,CAAC;IAED,OAAO,MAAoB,CAAC;AAC9B,CAAC;AAED,4CAA4C;AAC5C,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC;AAE3C;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,YAAwB,EACxB,iBAAoC;IAEpC,MAAM,YAAY,GAAG,2BAA2B,CAAC,iBAAiB,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAEpD,IAAI,MAAM,GAAG,YAAY,EAAE,CAAC;QAC1B,MAAM,CAAC,KAAK,CACV,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,iBAAiB,EAAE,EACzD,uCAAuC,CACxC,CAAC;IACJ,CAAC;IAED,OAAO,MAAoB,CAAC;AAC9B,CAAC;AAED,gDAAgD;AAChD,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAEnD;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,iBAAoC,EACpC,eAAgC,EAChC,WAAwB,EACxB,oBAAiC,EACjC,cAA2B;IAE3B,OAAO,IAAI,CAAC,GAAG,CACb,0BAA0B,CAAC,iBAAiB,CAAC,EAC7C,wBAAwB,CAAC,eAAe,CAAC,EACzC,WAAW,EACX,oBAAoB,EACpB,cAAc,CACA,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACrC,iBAAoC,EACpC,YAAwB,EACxB,oBAAiC,EACjC,cAA2B;IAE3B,IAAI,KAAK,GAAG,aAAa,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;IAC3D,KAAK,GAAG,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAEpD,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,oBAAoB,CAAC,CAAC;IACjE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAE1C,MAAM,UAAU,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;IACrD,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAEpC,OAAO,KAAmB,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAqB,EACrB,YAA2B;IAE3B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,iBAAiB,GAAG,YAAY,CAAC,MAAM,CAC3C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,CACnD,CAAC;IAEF,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,EAAE,iDAAiD,CAAC,CAAC;QAC9E,OAAO,0BAA0B,CAAC;IACpC,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAsB,CAAC;IAE5F,MAAM,CAAC,KAAK,CACV,EAAE,QAAQ,EAAE,gBAAgB,EAAE,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,EACjE,uCAAuC,CACxC,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC"}