@zanii/sentinel 0.1.0 → 0.3.0

package/dist/index.d.ts

@@ -134,6 +134,23 @@ export interface Watcher {
  * `scan` from `receipt.recorded` webhooks (`@zanii/webhooks`) instead of polling.
  */
 export declare function createWatcher(opts: WatcherOptions): Watcher;
+export interface BlastRadius {
+    /** What the delegation allows — the could-reach surface. */
+    declared_scopes: string[];
+    /** Target prefixes actually observed in history — the did-reach surface. */
+    used_prefixes: string[];
+    /** Declared scopes with NO observed activity underneath — standing, unused authority. */
+    unused_scopes: string[];
+    /** Observed prefixes not covered by any declared scope (should be impossible on-ledger). */
+    undeclared_prefixes: string[];
+}
+/**
+ * Could-reach vs did-reach. Standing authority an agent never uses is pure risk —
+ * the first thing to cut after an incident, and the first thing an underwriter asks
+ * about (`insurance` flags WILDCARD_AUTHORITY; this shows the whole surface). Facts,
+ * not a score — a `*` scope is reported as one unused scope, not silently expanded.
+ */
+export declare function blastRadius(baseline: Baseline): BlastRadius;
 /**
  * The default response: a `@zanii/policy` rule turning the flagged prefixes into a
  * `require_approval` speed bump.

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAqC,KAAK,cAAc,EAAE,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AAEnG,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAMjF,MAAM,WAAW,QAAQ;IACvB,CAAC,EAAE,CAAC,CAAC;IACL,QAAQ,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,wFAAwF;IACxF,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;OAIG;IACH,IAAI,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD,wFAAwF;IACxF,YAAY,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEnD;AAMD,iGAAiG;AACjG,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IAAC,UAAU,CAAC,EAAE,cAAc,EAAE,CAAA;CAAO,GACjE,QAAQ,CA+BV;AAED,yFAAyF;AACzF,wBAAgB,YAAY,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,CAEhD;AAMD,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEjD,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,8DAA8D;IAC9D,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,sDAAsD;IACtD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,0EAA0E;AAC1E,eAAO,MAAM,cAAc,EAAE,YAI5B,CAAC;AAEF,MAAM,WAAW,WAAW;IAC1B,uFAAuF;IACvF,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvE,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;IAC3B,uEAAuE;IACvE,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,MAAM,GAAG,SAAS,CAAC;IACnE,oFAAoF;IACpF,YAAY,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,KAAK,MAAM,EAAE,CAAC;IAC7D,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,KAAK,OAAO,GAAG,OAAO,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAe3C,gFAAgF;AAChF,wBAAgB,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,EAAE,CA4G/F;AAMD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpC,SAAS,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,OAAO;IACtB,sFAAsF;IACtF,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3B,mFAAmF;IACnF,MAAM,IAAI,MAAM,CAAC;CAClB;AAOD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAuC3D;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAQ/G;AAMD,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAgBlI;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,wDAAwD;AACxD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,UAAU,CAUpF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAkD,KAAK,cAAc,EAAE,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AAEhH,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAMjF,MAAM,WAAW,QAAQ;IACvB,CAAC,EAAE,CAAC,CAAC;IACL,QAAQ,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,wFAAwF;IACxF,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;OAIG;IACH,IAAI,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD,wFAAwF;IACxF,YAAY,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEnD;AAaD,iGAAiG;AACjG,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IAAC,UAAU,CAAC,EAAE,cAAc,EAAE,CAAA;CAAO,GACjE,QAAQ,CAsCV;AAED,yFAAyF;AACzF,wBAAgB,YAAY,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,CAEhD;AAMD,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEjD,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,8DAA8D;IAC9D,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,sDAAsD;IACtD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,0EAA0E;AAC1E,eAAO,MAAM,cAAc,EAAE,YAI5B,CAAC;AAEF,MAAM,WAAW,WAAW;IAC1B,uFAAuF;IACvF,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvE,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;IAC3B,uEAAuE;IACvE,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,MAAM,GAAG,SAAS,CAAC;IACnE,oFAAoF;IACpF,YAAY,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,KAAK,MAAM,EAAE,CAAC;IAC7D,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,KAAK,OAAO,GAAG,OAAO,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAe3C,gFAAgF;AAChF,wBAAgB,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,EAAE,CA+I/F;AAMD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpC,SAAS,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,OAAO;IACtB,sFAAsF;IACtF,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3B,mFAAmF;IACnF,MAAM,IAAI,MAAM,CAAC;CAClB;AAOD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAkE3D;AAED,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,4EAA4E;IAC5E,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,yFAAyF;IACzF,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,4FAA4F;IAC5F,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG,WAAW,CAgB3D;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAQ/G;AAMD,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAgBlI;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,wDAAwD;AACxD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,UAAU,CAUpF"}

package/dist/index.js

@@ -20,28 +20,44 @@
  * bump, never auto-revoke; in-scope compromise is the hard case — sequences and rates
  * narrow the window, never to zero.
  */
-import { jcsHash, scopesAllow, verifyChain } from '@zanii/core';
+import { jcsHash, receiptHash, scopesAllow, verifyChain } from '@zanii/core';
 export function targetPrefix(target) {
     return target.split('.').slice(0, 2).join('.');
 }
-function hourOf(ts) {
-    return new Date(ts).getUTCHours();
+/** Epoch ms; a naive ts (no offset) is treated as UTC — never local. `null` = unparseable. */
+function tsMs(ts) {
+    if (typeof ts !== 'string' || !/^\d{4}-\d{2}-\d{2}T/.test(ts))
+        return null;
+    const ms = Date.parse(/[zZ]$|[+-]\d{2}:?\d{2}$/.test(ts) ? ts : `${ts}Z`);
+    return Number.isNaN(ms) ? null : ms;
 }
+const hourOfMs = (ms) => new Date(ms).getUTCHours();
+/** Hour bucket as `YYYY-MM-DDTHH` in UTC — offset timestamps land in the right bucket. */
+const hourBucket = (ms) => new Date(Math.floor(ms / 3_600_000) * 3_600_000).toISOString().slice(0, 13);
 /** Build the drift baseline for one agent from its delegation (declared) + history (learned). */
 export function buildBaseline(agentId, opts = {}) {
     const history = (opts.receipts ?? []).filter((r) => r.agent_id === agentId);
-    const scopes = opts.delegation
-        ? verifyChain(opts.delegation, { agentId }).effectiveScopes ?? []
-        : [];
+    let scopes = [];
+    if (opts.delegation) {
+        const chain = verifyChain(opts.delegation, { agentId });
+        // A failed chain must NOT silently degrade to scopes:[] — scan treats empty scopes as
+        // "everything in scope", so detection severity would quietly drop.
+        if (!chain.ok)
+            throw new Error(`delegation chain failed verification (${chain.error}) — refusing to build a baseline on it`);
+        scopes = chain.effectiveScopes ?? [];
+    }
     const prefixes = new Set();
     const hours = new Array(24).fill(0);
     const perHourCounts = new Map();
     let intents = 0;
     let actions = 0;
     for (const r of history) {
+        const ms = tsMs(r.ts);
+        if (ms === null)
+            throw new Error(`receipt has an unparseable ts: ${String(r.ts)}`);
         prefixes.add(targetPrefix(r.target));
-        hours[hourOf(r.ts)] = (hours[hourOf(r.ts)] ?? 0) + 1;
-        const bucket = r.ts.slice(0, 13); // YYYY-MM-DDTHH
+        hours[hourOfMs(ms)] = (hours[hourOfMs(ms)] ?? 0) + 1;
+        const bucket = hourBucket(ms);
         perHourCounts.set(bucket, (perHourCounts.get(bucket) ?? 0) + 1);
         if (r.action === 'action_intent')
             intents += 1;
@@ -81,17 +97,39 @@ function finding(rule, severity, agentId, evidence, observed, expected) {
         targets: [...new Set(evidence.map((r) => r.target))],
         observed,
         expected,
-        ts: evidence[evidence.length - 1]?.ts ?? new Date(0).toISOString(),
+        ts: evidence[evidence.length - 1]?.ts ?? '1970-01-01T00:00:00.000Z',
     };
 }
 /** Scan a window of an agent's receipts against its baseline. Pure — no I/O. */
 export function scan(receipts, baseline, opts = {}) {
     const findings = [];
-    const mine = receipts
-        .filter((r) => r.agent_id === baseline.agent_id)
-        .sort((a, b) => a.ts.localeCompare(b.ts));
+    const mine = [];
+    const malformed = [];
+    for (const r of receipts) {
+        if (r.agent_id !== baseline.agent_id)
+            continue;
+        (tsMs(r.ts) === null ? malformed : mine).push(r);
+    }
+    mine.sort((a, b) => tsMs(a.ts) - tsMs(b.ts));
+    // A receipt we cannot place in time is excluded from every windowed detector — that
+    // exclusion must never be silent.
+    if (malformed.length > 0) {
+        findings.push(finding('malformed-timestamp', 'medium', baseline.agent_id, malformed, `${malformed.length} receipt(s) with unparseable ts — excluded from windowed detectors`, 'parseable ISO timestamps'));
+    }
     const minSample = opts.minSample ?? 20;
     const known = new Set(baseline.target_prefixes);
+    // 0. chain-gap — receipts carry `prev`; a broken link inside the window means a receipt
+    // between the two is missing or was suppressed. A gap is NEVER clean.
+    for (let i = 1; i < mine.length; i++) {
+        const before = mine[i - 1];
+        const cur = mine[i];
+        if (typeof cur.prev !== 'string')
+            continue; // chain start / foreign data — unverifiable, not a gap
+        const { hash: _h, ...bare } = before;
+        if (cur.prev !== receiptHash(bare)) {
+            findings.push(finding('chain-gap', 'high', baseline.agent_id, [before, cur], `receipt chain broken between ${before.ts} and ${cur.ts} — a receipt in between is missing or was suppressed`, 'contiguous prev linkage — a gap is UNKNOWN, not clean'));
+        }
+    }
     // 1. novel-target — prefix outside the learned set; high severity if also outside declared scopes
     const novel = new Map();
     for (const r of mine) {
@@ -111,14 +149,16 @@ export function scan(receipts, baseline, opts = {}) {
             rule: 'scope-edge', severity: probes.length > 2 ? 'high' : 'medium', agent_id: baseline.agent_id,
             receipt_hashes: [], targets: [],
             observed: `${probes.length} rejected write(s): ${probes.map((p) => p.error).filter(Boolean).slice(0, 3).join('; ')}`,
-            expected: 'no rejected writes', ts: probes[probes.length - 1]?.ts ?? new Date(0).toISOString(),
+            expected: 'no rejected writes', ts: probes[probes.length - 1]?.ts ?? '1970-01-01T00:00:00.000Z',
         });
     }
     // 3. rate-spike — actions per hour vs baseline (milli-units; +1000 keeps std=0 from firing on +1)
     if (baseline.sample_size >= minSample) {
         const buckets = new Map();
-        for (const r of mine)
-            buckets.set(r.ts.slice(0, 13), [...(buckets.get(r.ts.slice(0, 13)) ?? []), r]);
+        for (const r of mine) {
+            const b = hourBucket(tsMs(r.ts));
+            buckets.set(b, [...(buckets.get(b) ?? []), r]);
+        }
         const z = opts.rateZ ?? 3;
         for (const [hour, rs] of buckets) {
             if (rs.length * 1000 > baseline.rate.mean_milli + z * (baseline.rate.std_milli + 1000)) {
@@ -139,32 +179,39 @@ export function scan(receipts, baseline, opts = {}) {
     for (const rule of opts.sequences ?? [EXFIL_SEQUENCE]) {
         let step = 0;
         let startMs = 0;
-        const evidence = [];
+        let evidence = [];
         for (const r of mine) {
+            const ms = tsMs(r.ts);
+            // stale window: reset FIRST, then re-test this receipt — it may open a new sequence
+            if (step > 0 && ms - startMs > rule.windowMs) {
+                step = 0;
+                evidence = [];
+            }
             if (rule.steps[step].test(r.target)) {
                 if (step === 0)
-                    startMs = Date.parse(r.ts);
-                if (Date.parse(r.ts) - startMs <= rule.windowMs) {
-                    evidence.push(r);
-                    step += 1;
-                    if (step === rule.steps.length) {
-                        findings.push(finding(`sequence:${rule.name}`, 'high', baseline.agent_id, [...evidence], evidence.map((e) => e.target).join(' → '), `no ${rule.name} sequence`));
-                        step = 0;
-                        evidence.length = 0;
-                    }
-                }
-                else {
+                    startMs = ms;
+                evidence.push(r);
+                step += 1;
+                if (step === rule.steps.length) {
+                    findings.push(finding(`sequence:${rule.name}`, 'high', baseline.agent_id, [...evidence], evidence.map((e) => e.target).join(' → '), `no ${rule.name} sequence`));
                     step = 0;
-                    evidence.length = 0;
+                    evidence = [];
                 }
             }
+            else if (step > 0 && rule.steps[0].test(r.target)) {
+                // a fresh step-0 match mid-sequence restarts the window from HERE — otherwise an
+                // early step-0 pins a stale start and a later, real sequence is never seen
+                startMs = ms;
+                evidence = [r];
+                step = 1;
+            }
         }
     }
     // 6. off-hours — activity in hours the baseline says are silent
     if (baseline.sample_size >= minSample) {
-        const silent = mine.filter((r) => (baseline.active_hours[hourOf(r.ts)] ?? 0) === 0);
+        const silent = mine.filter((r) => (baseline.active_hours[hourOfMs(tsMs(r.ts))] ?? 0) === 0);
         if (silent.length > 0) {
-            findings.push(finding('off-hours', 'medium', baseline.agent_id, silent, `${silent.length} action(s) at UTC hour(s) [${[...new Set(silent.map((r) => hourOf(r.ts)))].join(',')}]`, 'activity only in learned active hours'));
+            findings.push(finding('off-hours', 'medium', baseline.agent_id, silent, `${silent.length} action(s) at UTC hour(s) [${[...new Set(silent.map((r) => hourOfMs(tsMs(r.ts))))].join(',')}]`, 'activity only in learned active hours'));
         }
     }
     // 7. wall-crossing — operator mode only (raw payloads pre-hash)
@@ -210,17 +257,44 @@ export function createWatcher(opts) {
                 throw new Error(`recent fetch failed: HTTP ${res.status}`);
             const body = (await res.json());
             const fresh = body.receipts.filter((r) => r.index > cursor);
+            const all = [];
+            // "We were not looking" must NEVER render as "nothing happened": /v1/recent is a
+            // capped global feed, so if the oldest fresh index doesn't connect to the cursor,
+            // receipts were missed between polls. Report the blind spot as a finding — a
+            // confident silence is the most dangerous output a monitor can produce.
+            if (cursor >= 0 && fresh.length > 0) {
+                const oldest = Math.min(...fresh.map((r) => r.index));
+                if (oldest > cursor + 1) {
+                    const gap = {
+                        rule: 'unknown-window',
+                        severity: 'medium',
+                        agent_id: '*',
+                        receipt_hashes: [],
+                        targets: [],
+                        observed: `ledger indices ${cursor + 1}..${oldest - 1} were never scanned (feed outpaced the poll)`,
+                        expected: 'contiguous coverage — treat the gap as UNKNOWN, not clean; backfill via /v1/recent?offset=',
+                        ts: fresh.find((r) => r.index === oldest).receipt.ts,
+                    };
+                    const fp = fingerprint(gap);
+                    if (!seen.has(fp)) {
+                        seen.add(fp);
+                        all.push(gap);
+                        await opts.onFinding(gap);
+                    }
+                }
+            }
             for (const r of fresh)
                 cursor = Math.max(cursor, r.index);
-            const all = [];
             for (const [did, baseline] of Object.entries(opts.baselines)) {
                 const mine = fresh.filter((r) => r.receipt.agent_id === did).map((r) => ({ ...r.receipt, hash: r.hash }));
                 if (mine.length === 0)
                     continue;
                 // Rolling window: append, then trim to `windowMs` behind the newest receipt.
-                const buf = [...(buffers[did] ?? []), ...mine].sort((a, b) => a.ts.localeCompare(b.ts));
-                const newest = Date.parse(buf[buf.length - 1].ts);
-                buffers[did] = buf.filter((r) => newest - Date.parse(r.ts) <= windowMs);
+                // Parsed-UTC ordering (offset timestamps sort correctly); unparseable ts are kept
+                // so scan() can report them rather than silently dropping them here.
+                const buf = [...(buffers[did] ?? []), ...mine].sort((a, b) => (tsMs(a.ts) ?? 0) - (tsMs(b.ts) ?? 0));
+                const newest = tsMs(buf[buf.length - 1].ts) ?? 0;
+                buffers[did] = buf.filter((r) => newest - (tsMs(r.ts) ?? newest) <= windowMs);
                 for (const f of scan(buffers[did], baseline, opts.scan)) {
                     const fp = fingerprint(f);
                     if (seen.has(fp))
@@ -236,6 +310,28 @@ export function createWatcher(opts) {
         },
     };
 }
+/**
+ * Could-reach vs did-reach. Standing authority an agent never uses is pure risk —
+ * the first thing to cut after an incident, and the first thing an underwriter asks
+ * about (`insurance` flags WILDCARD_AUTHORITY; this shows the whole surface). Facts,
+ * not a score — a `*` scope is reported as one unused scope, not silently expanded.
+ */
+export function blastRadius(baseline) {
+    // used_prefixes are TRUNCATED to two segments, so a concrete deeper scope like
+    // `crm.contacts.read` must relate to the prefix `crm.contacts` in EITHER direction —
+    // otherwise a fully compliant agent reads as both unused-authority and undeclared.
+    const related = (scope, p) => {
+        if (scope === '*')
+            return true;
+        const s = scope.endsWith('.*') ? scope.slice(0, -2) : scope;
+        return s === p || s.startsWith(`${p}.`) || p.startsWith(`${s}.`);
+    };
+    const declared = [...baseline.scopes].sort();
+    const used = [...baseline.target_prefixes].sort();
+    const unused = declared.filter((s) => !used.some((p) => related(s, p)));
+    const undeclared = used.filter((p) => !declared.some((s) => related(s, p)));
+    return { declared_scopes: declared, used_prefixes: used, unused_scopes: unused, undeclared_prefixes: undeclared };
+}
 /**
  * The default response: a `@zanii/policy` rule turning the flagged prefixes into a
  * `require_approval` speed bump.
@@ -245,7 +341,7 @@ export function createWatcher(opts) {
  * gates the agent's entire surface. That call belongs to a human.
  */
 export function escalationRule(f) {
-    const prefixes = [...new Set(f.targets.map((t) => `${targetPrefix(t)}.*`))];
+    const prefixes = [...new Set(f.targets.map((t) => `${targetPrefix(t)}.*`))].sort();
     if (prefixes.length === 0)
         return null;
     return {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAqC,MAAM,aAAa,CAAC;AA4BnG,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,MAAM,CAAC,EAAU;IACxB,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,OAAgE,EAAE;IAElE,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU;QAC5B,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,eAAe,IAAI,EAAE;QACjE,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAChD,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACrC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB;QAClD,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe;YAAE,OAAO,IAAI,CAAC,CAAC;;YAC1C,OAAO,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACrG,OAAO;QACL,CAAC,EAAE,CAAC;QACJ,QAAQ,EAAE,OAAO;QACjB,MAAM;QACN,eAAe,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE;QACrC,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,EAAE;QAChG,YAAY,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,YAAY,EAAE,KAAK;QACnB,WAAW,EAAE,OAAO,CAAC,MAAM;KAC5B,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,YAAY,CAAC,CAAW;IACtC,OAAO,OAAO,CAAC,CAAuC,CAAC,CAAC;AAC1D,CAAC;AA4BD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAiB;IAC1C,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,CAAC,wCAAwC,EAAE,yCAAyC,EAAE,sCAAsC,CAAC;IACpI,QAAQ,EAAE,EAAE,GAAG,MAAM;CACtB,CAAC;AAmBF,SAAS,OAAO,CAAC,IAAY,EAAE,QAAkB,EAAE,OAAe,EAAE,QAAmB,EAAE,QAAgB,EAAE,QAAgB;IACzH,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,QAAQ,EAAE,OAAO;QACjB,cAAc,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;QACzD,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,QAAQ;QACR,QAAQ;QACR,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;KACnE,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,IAAI,CAAC,QAAmB,EAAE,QAAkB,EAAE,OAAoB,EAAE;IAClF,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,QAAQ;SAClB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CAAC;SAC/C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IAEhD,kGAAkG;IAClG,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,QAAQ,CAAC,WAAW,IAAI,SAAS,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC;QAClG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAC5F,iBAAiB,MAAM,yBAAyB,EAAE,WAAW,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1G,CAAC;IAED,0FAA0F;IAC1F,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtG,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAChG,cAAc,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;YAC/B,QAAQ,EAAE,GAAG,MAAM,CAAC,MAAM,uBAAuB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACpH,QAAQ,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;SAC/F,CAAC,CAAC;IACL,CAAC;IAED,kGAAkG;IAClG,IAAI,QAAQ,CAAC,WAAW,IAAI,SAAS,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;QAC7C,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrG,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,OAAO,EAAE,CAAC;YACjC,IAAI,EAAE,CAAC,MAAM,GAAG,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC;gBACvF,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAC/D,GAAG,EAAE,CAAC,MAAM,oBAAoB,IAAI,EAAE,EACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9G,CAAC;QACH,CAAC;IACH,CAAC;IAED,wFAAwF;IACxF,IAAI,QAAQ,CAAC,YAAY,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,MAAM,CAAC;QACxE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;QACtC,MAAM,UAAU,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/E,IAAI,UAAU,GAAG,QAAQ,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe,CAAC,EAC7G,gBAAgB,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAC5D,IAAI,CAAC,QAAQ,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED,mFAAmF;IACnF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QACtD,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrC,IAAI,IAAI,KAAK,CAAC;oBAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC3C,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAChD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACjB,IAAI,IAAI,CAAC,CAAC;oBACV,IAAI,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;wBAC/B,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,EACrF,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC;wBAC1E,IAAI,GAAG,CAAC,CAAC;wBACT,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;oBACtB,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,IAAI,GAAG,CAAC,CAAC;oBACT,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,IAAI,QAAQ,CAAC,WAAW,IAAI,SAAS,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACpF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EACpE,GAAG,MAAM,CAAC,MAAM,8BAA8B,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EACxG,uCAAuC,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,IAAI,KAAK,SAAS;gBAAE,SAAS;YACjC,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC9C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EACnE,uBAAuB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,8BAA8B,CAAC,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAiCD,oFAAoF;AACpF,SAAS,WAAW,CAAC,CAAU;IAC7B,OAAO,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;AACvE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,IAAoB;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAS,EAAE,CAAe,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IAClD,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IAC/B,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,OAAO;QACL,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM;QACpB,KAAK,CAAC,IAAI;YACR,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,oBAAoB,IAAI,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;YAC9E,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACxE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2E,CAAC;YAC1G,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC;YAC5D,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAE1D,MAAM,GAAG,GAAc,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC1G,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBAEhC,6EAA6E;gBAC7E,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACxF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,EAAE,CAAC,CAAC;gBACnD,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,CAAC;gBAExE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzD,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;oBAC1B,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;wBAAE,SAAS,CAAC,6CAA6C;oBACzE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACb,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACZ,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI;gBAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,oDAAoD;YACxF,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,CAAU;IACvC,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO;QACL,EAAE,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;QAC7E,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,QAAQ;KAClB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,2DAA2D;AAC3D,8EAA8E;AAE9E,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,CAAU,EAAE,IAA8B;IAC1E,OAAO;QACL,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE;YACP,QAAQ,EAAE,UAAU;YACpB,CAAC,EAAE,CAAC;YACJ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,aAAa,EAAE,CAAC,CAAC,QAAQ;YACzB,QAAQ,EAAE,CAAC,CAAC,cAAc;YAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,EAAE,EAAE,CAAC,CAAC,EAAE;SACT;KACF,CAAC;AACJ,CAAC;AAOD,wDAAwD;AACxD,MAAM,UAAU,WAAW,CAAC,OAA4C;IACtE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,CAAC,GAAG,OAAO,IAAI,EAAE,CAAC;IACxB,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACtF,IAAI,CAAC,CAAC,CAAC,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAkB,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACxG,IAAI,CAAC,CAAC,CAAC,aAAa;QAAE,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACjI,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAqC,MAAM,aAAa,CAAC;AA4BhH,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjD,CAAC;AAED,8FAA8F;AAC9F,SAAS,IAAI,CAAC,EAAW;IACvB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACpE,0FAA0F;AAC1F,MAAM,UAAU,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAEvH,iGAAiG;AACjG,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,OAAgE,EAAE;IAElE,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAC5E,IAAI,MAAM,GAAa,EAAE,CAAC;IAC1B,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACxD,sFAAsF;QACtF,mEAAmE;QACnE,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,CAAC,KAAK,wCAAwC,CAAC,CAAC;QAC7H,MAAM,GAAG,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAChD,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtB,IAAI,EAAE,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACnF,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACrC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QAC9B,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe;YAAE,OAAO,IAAI,CAAC,CAAC;;YAC1C,OAAO,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACrG,OAAO;QACL,CAAC,EAAE,CAAC;QACJ,QAAQ,EAAE,OAAO;QACjB,MAAM;QACN,eAAe,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE;QACrC,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,EAAE;QAChG,YAAY,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,YAAY,EAAE,KAAK;QACnB,WAAW,EAAE,OAAO,CAAC,MAAM;KAC5B,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,YAAY,CAAC,CAAW;IACtC,OAAO,OAAO,CAAC,CAAuC,CAAC,CAAC;AAC1D,CAAC;AA4BD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAiB;IAC1C,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,CAAC,wCAAwC,EAAE,yCAAyC,EAAE,sCAAsC,CAAC;IACpI,QAAQ,EAAE,EAAE,GAAG,MAAM;CACtB,CAAC;AAmBF,SAAS,OAAO,CAAC,IAAY,EAAE,QAAkB,EAAE,OAAe,EAAE,QAAmB,EAAE,QAAgB,EAAE,QAAgB;IACzH,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,QAAQ,EAAE,OAAO;QACjB,cAAc,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;QACzD,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,QAAQ;QACR,QAAQ;QACR,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,0BAA0B;KACpE,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,IAAI,CAAC,QAAmB,EAAE,QAAkB,EAAE,OAAoB,EAAE;IAClF,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAc,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAc,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;YAAE,SAAS;QAC/C,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAE,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC,CAAC;IAC/C,oFAAoF;IACpF,kCAAkC;IAClC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,EACjF,GAAG,SAAS,CAAC,MAAM,oEAAoE,EACvF,0BAA0B,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IAEhD,wFAAwF;IACxF,sEAAsE;IACtE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACrB,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;YAAE,SAAS,CAAC,uDAAuD;QACnG,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;QACrC,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC,IAAe,CAAC,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,EACzE,gCAAgC,MAAM,CAAC,EAAE,QAAQ,GAAG,CAAC,EAAE,sDAAsD,EAC7G,uDAAuD,CAAC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,kGAAkG;IAClG,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,QAAQ,CAAC,WAAW,IAAI,SAAS,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC;QAClG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAC5F,iBAAiB,MAAM,yBAAyB,EAAE,WAAW,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1G,CAAC;IAED,0FAA0F;IAC1F,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtG,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAChG,cAAc,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;YAC/B,QAAQ,EAAE,GAAG,MAAM,CAAC,MAAM,uBAAuB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACpH,QAAQ,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,0BAA0B;SAChG,CAAC,CAAC;IACL,CAAC;IAED,kGAAkG;IAClG,IAAI,QAAQ,CAAC,WAAW,IAAI,SAAS,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;QAC7C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,OAAO,EAAE,CAAC;YACjC,IAAI,EAAE,CAAC,MAAM,GAAG,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC;gBACvF,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAC/D,GAAG,EAAE,CAAC,MAAM,oBAAoB,IAAI,EAAE,EACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9G,CAAC;QACH,CAAC;IACH,CAAC;IAED,wFAAwF;IACxF,IAAI,QAAQ,CAAC,YAAY,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,MAAM,CAAC;QACxE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;QACtC,MAAM,UAAU,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/E,IAAI,UAAU,GAAG,QAAQ,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe,CAAC,EAC7G,gBAAgB,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAC5D,IAAI,CAAC,QAAQ,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED,mFAAmF;IACnF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QACtD,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,QAAQ,GAAc,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC;YACvB,oFAAoF;YACpF,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC7C,IAAI,GAAG,CAAC,CAAC;gBACT,QAAQ,GAAG,EAAE,CAAC;YAChB,CAAC;YACD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrC,IAAI,IAAI,KAAK,CAAC;oBAAE,OAAO,GAAG,EAAE,CAAC;gBAC7B,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACjB,IAAI,IAAI,CAAC,CAAC;gBACV,IAAI,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;oBAC/B,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,EACrF,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC;oBAC1E,IAAI,GAAG,CAAC,CAAC;oBACT,QAAQ,GAAG,EAAE,CAAC;gBAChB,CAAC;YACH,CAAC;iBAAM,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrD,iFAAiF;gBACjF,2EAA2E;gBAC3E,OAAO,GAAG,EAAE,CAAC;gBACb,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC;gBACf,IAAI,GAAG,CAAC,CAAC;YACX,CAAC;QACH,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,IAAI,QAAQ,CAAC,WAAW,IAAI,SAAS,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7F,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EACpE,GAAG,MAAM,CAAC,MAAM,8BAA8B,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EACjH,uCAAuC,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,IAAI,KAAK,SAAS;gBAAE,SAAS;YACjC,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC9C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EACnE,uBAAuB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,8BAA8B,CAAC,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAiCD,oFAAoF;AACpF,SAAS,WAAW,CAAC,CAAU;IAC7B,OAAO,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;AACvE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,IAAoB;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAS,EAAE,CAAe,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IAClD,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IAC/B,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,OAAO;QACL,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM;QACpB,KAAK,CAAC,IAAI;YACR,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,oBAAoB,IAAI,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;YAC9E,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACxE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2E,CAAC;YAC1G,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC;YAE5D,MAAM,GAAG,GAAc,EAAE,CAAC;YAC1B,iFAAiF;YACjF,kFAAkF;YAClF,6EAA6E;YAC7E,wEAAwE;YACxE,IAAI,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtD,IAAI,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxB,MAAM,GAAG,GAAY;wBACnB,IAAI,EAAE,gBAAgB;wBACtB,QAAQ,EAAE,QAAQ;wBAClB,QAAQ,EAAE,GAAG;wBACb,cAAc,EAAE,EAAE;wBAClB,OAAO,EAAE,EAAE;wBACX,QAAQ,EAAE,kBAAkB,MAAM,GAAG,CAAC,KAAK,MAAM,GAAG,CAAC,8CAA8C;wBACnG,QAAQ,EAAE,4FAA4F;wBACtG,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAE,CAAC,OAAO,CAAC,EAAE;qBACtD,CAAC;oBACF,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;oBAC5B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;wBAClB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBACb,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBACd,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBAC5B,CAAC;gBACH,CAAC;YACH,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC1G,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBAEhC,6EAA6E;gBAC7E,kFAAkF;gBAClF,qEAAqE;gBACrE,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACrG,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBAClD,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAC;gBAE9E,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzD,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;oBAC1B,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;wBAAE,SAAS,CAAC,6CAA6C;oBACzE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACb,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACZ,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI;gBAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,oDAAoD;YACxF,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAaD;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,QAAkB;IAC5C,+EAA+E;IAC/E,qFAAqF;IACrF,mFAAmF;IACnF,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,CAAS,EAAW,EAAE;QACpD,IAAI,KAAK,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5D,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnE,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAC5C,CAAC;IACF,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,mBAAmB,EAAE,UAAU,EAAE,CAAC;AACpH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,CAAU;IACvC,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO;QACL,EAAE,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;QAC7E,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,QAAQ;KAClB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,2DAA2D;AAC3D,8EAA8E;AAE9E,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,CAAU,EAAE,IAA8B;IAC1E,OAAO;QACL,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE;YACP,QAAQ,EAAE,UAAU;YACpB,CAAC,EAAE,CAAC;YACJ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,aAAa,EAAE,CAAC,CAAC,QAAQ;YACzB,QAAQ,EAAE,CAAC,CAAC,cAAc;YAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,EAAE,EAAE,CAAC,CAAC,EAAE;SACT;KACF,CAAC;AACJ,CAAC;AAOD,wDAAwD;AACxD,MAAM,UAAU,WAAW,CAAC,OAA4C;IACtE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,CAAC,GAAG,OAAO,IAAI,EAAE,CAAC;IACxB,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACtF,IAAI,CAAC,CAAC,CAAC,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAkB,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACxG,IAAI,CAAC,CAAC,CAAC,aAAa;QAAE,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACjI,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zanii/sentinel",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Runtime behavioral monitoring for agents ('antivirus for agents'): score drift between what an agent actually does and what it was made to do, from the receipt stream — and the alerts themselves are tamper-evident receipts.",
   "license": "Apache-2.0",
   "homepage": "https://ledger.zanii.agency",

package/src/index.ts

@@ -20,7 +20,7 @@
  * bump, never auto-revoke; in-scope compromise is the hard case — sequences and rates
  * narrow the window, never to zero.
  */
-import { jcsHash, scopesAllow, verifyChain, type DelegationCert, type Receipt } from '@zanii/core';
+import { jcsHash, receiptHash, scopesAllow, verifyChain, type DelegationCert, type Receipt } from '@zanii/core';
 
 export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
 
@@ -52,28 +52,42 @@ export function targetPrefix(target: string): string {
   return target.split('.').slice(0, 2).join('.');
 }
 
-function hourOf(ts: string): number {
-  return new Date(ts).getUTCHours();
+/** Epoch ms; a naive ts (no offset) is treated as UTC — never local. `null` = unparseable. */
+function tsMs(ts: unknown): number | null {
+  if (typeof ts !== 'string' || !/^\d{4}-\d{2}-\d{2}T/.test(ts)) return null;
+  const ms = Date.parse(/[zZ]$|[+-]\d{2}:?\d{2}$/.test(ts) ? ts : `${ts}Z`);
+  return Number.isNaN(ms) ? null : ms;
 }
 
+const hourOfMs = (ms: number): number => new Date(ms).getUTCHours();
+/** Hour bucket as `YYYY-MM-DDTHH` in UTC — offset timestamps land in the right bucket. */
+const hourBucket = (ms: number): string => new Date(Math.floor(ms / 3_600_000) * 3_600_000).toISOString().slice(0, 13);
+
 /** Build the drift baseline for one agent from its delegation (declared) + history (learned). */
 export function buildBaseline(
   agentId: string,
   opts: { receipts?: Receipt[]; delegation?: DelegationCert[] } = {},
 ): Baseline {
   const history = (opts.receipts ?? []).filter((r) => r.agent_id === agentId);
-  const scopes = opts.delegation
-    ? verifyChain(opts.delegation, { agentId }).effectiveScopes ?? []
-    : [];
+  let scopes: string[] = [];
+  if (opts.delegation) {
+    const chain = verifyChain(opts.delegation, { agentId });
+    // A failed chain must NOT silently degrade to scopes:[] — scan treats empty scopes as
+    // "everything in scope", so detection severity would quietly drop.
+    if (!chain.ok) throw new Error(`delegation chain failed verification (${chain.error}) — refusing to build a baseline on it`);
+    scopes = chain.effectiveScopes ?? [];
+  }
   const prefixes = new Set<string>();
   const hours = new Array<number>(24).fill(0);
   const perHourCounts = new Map<string, number>();
   let intents = 0;
   let actions = 0;
   for (const r of history) {
+    const ms = tsMs(r.ts);
+    if (ms === null) throw new Error(`receipt has an unparseable ts: ${String(r.ts)}`);
     prefixes.add(targetPrefix(r.target));
-    hours[hourOf(r.ts)] = (hours[hourOf(r.ts)] ?? 0) + 1;
-    const bucket = r.ts.slice(0, 13); // YYYY-MM-DDTHH
+    hours[hourOfMs(ms)] = (hours[hourOfMs(ms)] ?? 0) + 1;
+    const bucket = hourBucket(ms);
     perHourCounts.set(bucket, (perHourCounts.get(bucket) ?? 0) + 1);
     if (r.action === 'action_intent') intents += 1;
     else actions += 1;
@@ -157,19 +171,44 @@ function finding(rule: string, severity: Severity, agentId: string, evidence: Sc
     targets: [...new Set(evidence.map((r) => r.target))],
     observed,
     expected,
-    ts: evidence[evidence.length - 1]?.ts ?? new Date(0).toISOString(),
+    ts: evidence[evidence.length - 1]?.ts ?? '1970-01-01T00:00:00.000Z',
   };
 }
 
 /** Scan a window of an agent's receipts against its baseline. Pure — no I/O. */
 export function scan(receipts: Scanned[], baseline: Baseline, opts: ScanOptions = {}): Finding[] {
   const findings: Finding[] = [];
-  const mine = receipts
-    .filter((r) => r.agent_id === baseline.agent_id)
-    .sort((a, b) => a.ts.localeCompare(b.ts));
+  const mine: Scanned[] = [];
+  const malformed: Scanned[] = [];
+  for (const r of receipts) {
+    if (r.agent_id !== baseline.agent_id) continue;
+    (tsMs(r.ts) === null ? malformed : mine).push(r);
+  }
+  mine.sort((a, b) => tsMs(a.ts)! - tsMs(b.ts)!);
+  // A receipt we cannot place in time is excluded from every windowed detector — that
+  // exclusion must never be silent.
+  if (malformed.length > 0) {
+    findings.push(finding('malformed-timestamp', 'medium', baseline.agent_id, malformed,
+      `${malformed.length} receipt(s) with unparseable ts — excluded from windowed detectors`,
+      'parseable ISO timestamps'));
+  }
   const minSample = opts.minSample ?? 20;
   const known = new Set(baseline.target_prefixes);
 
+  // 0. chain-gap — receipts carry `prev`; a broken link inside the window means a receipt
+  // between the two is missing or was suppressed. A gap is NEVER clean.
+  for (let i = 1; i < mine.length; i++) {
+    const before = mine[i - 1]!;
+    const cur = mine[i]!;
+    if (typeof cur.prev !== 'string') continue; // chain start / foreign data — unverifiable, not a gap
+    const { hash: _h, ...bare } = before;
+    if (cur.prev !== receiptHash(bare as Receipt)) {
+      findings.push(finding('chain-gap', 'high', baseline.agent_id, [before, cur],
+        `receipt chain broken between ${before.ts} and ${cur.ts} — a receipt in between is missing or was suppressed`,
+        'contiguous prev linkage — a gap is UNKNOWN, not clean'));
+    }
+  }
+
   // 1. novel-target — prefix outside the learned set; high severity if also outside declared scopes
   const novel = new Map<string, Scanned[]>();
   for (const r of mine) {
@@ -191,14 +230,17 @@ export function scan(receipts: Scanned[], baseline: Baseline, opts: ScanOptions
       rule: 'scope-edge', severity: probes.length > 2 ? 'high' : 'medium', agent_id: baseline.agent_id,
       receipt_hashes: [], targets: [],
       observed: `${probes.length} rejected write(s): ${probes.map((p) => p.error).filter(Boolean).slice(0, 3).join('; ')}`,
-      expected: 'no rejected writes', ts: probes[probes.length - 1]?.ts ?? new Date(0).toISOString(),
+      expected: 'no rejected writes', ts: probes[probes.length - 1]?.ts ?? '1970-01-01T00:00:00.000Z',
     });
   }
 
   // 3. rate-spike — actions per hour vs baseline (milli-units; +1000 keeps std=0 from firing on +1)
   if (baseline.sample_size >= minSample) {
     const buckets = new Map<string, Scanned[]>();
-    for (const r of mine) buckets.set(r.ts.slice(0, 13), [...(buckets.get(r.ts.slice(0, 13)) ?? []), r]);
+    for (const r of mine) {
+      const b = hourBucket(tsMs(r.ts)!);
+      buckets.set(b, [...(buckets.get(b) ?? []), r]);
+    }
     const z = opts.rateZ ?? 3;
     for (const [hour, rs] of buckets) {
       if (rs.length * 1000 > baseline.rate.mean_milli + z * (baseline.rate.std_milli + 1000)) {
@@ -225,33 +267,40 @@ export function scan(receipts: Scanned[], baseline: Baseline, opts: ScanOptions
   for (const rule of opts.sequences ?? [EXFIL_SEQUENCE]) {
     let step = 0;
     let startMs = 0;
-    const evidence: Scanned[] = [];
+    let evidence: Scanned[] = [];
     for (const r of mine) {
+      const ms = tsMs(r.ts)!;
+      // stale window: reset FIRST, then re-test this receipt — it may open a new sequence
+      if (step > 0 && ms - startMs > rule.windowMs) {
+        step = 0;
+        evidence = [];
+      }
       if (rule.steps[step]!.test(r.target)) {
-        if (step === 0) startMs = Date.parse(r.ts);
-        if (Date.parse(r.ts) - startMs <= rule.windowMs) {
-          evidence.push(r);
-          step += 1;
-          if (step === rule.steps.length) {
-            findings.push(finding(`sequence:${rule.name}`, 'high', baseline.agent_id, [...evidence],
-              evidence.map((e) => e.target).join(' → '), `no ${rule.name} sequence`));
-            step = 0;
-            evidence.length = 0;
-          }
-        } else {
+        if (step === 0) startMs = ms;
+        evidence.push(r);
+        step += 1;
+        if (step === rule.steps.length) {
+          findings.push(finding(`sequence:${rule.name}`, 'high', baseline.agent_id, [...evidence],
+            evidence.map((e) => e.target).join(' → '), `no ${rule.name} sequence`));
           step = 0;
-          evidence.length = 0;
+          evidence = [];
         }
+      } else if (step > 0 && rule.steps[0]!.test(r.target)) {
+        // a fresh step-0 match mid-sequence restarts the window from HERE — otherwise an
+        // early step-0 pins a stale start and a later, real sequence is never seen
+        startMs = ms;
+        evidence = [r];
+        step = 1;
       }
     }
   }
 
   // 6. off-hours — activity in hours the baseline says are silent
   if (baseline.sample_size >= minSample) {
-    const silent = mine.filter((r) => (baseline.active_hours[hourOf(r.ts)] ?? 0) === 0);
+    const silent = mine.filter((r) => (baseline.active_hours[hourOfMs(tsMs(r.ts)!)] ?? 0) === 0);
     if (silent.length > 0) {
       findings.push(finding('off-hours', 'medium', baseline.agent_id, silent,
-        `${silent.length} action(s) at UTC hour(s) [${[...new Set(silent.map((r) => hourOf(r.ts)))].join(',')}]`,
+        `${silent.length} action(s) at UTC hour(s) [${[...new Set(silent.map((r) => hourOfMs(tsMs(r.ts)!)))].join(',')}]`,
         'activity only in learned active hours'));
     }
   }
@@ -333,17 +382,44 @@ export function createWatcher(opts: WatcherOptions): Watcher {
       if (!res.ok) throw new Error(`recent fetch failed: HTTP ${res.status}`);
       const body = (await res.json()) as { receipts: Array<{ receipt: Receipt; hash: string; index: number }> };
       const fresh = body.receipts.filter((r) => r.index > cursor);
-      for (const r of fresh) cursor = Math.max(cursor, r.index);
 
       const all: Finding[] = [];
+      // "We were not looking" must NEVER render as "nothing happened": /v1/recent is a
+      // capped global feed, so if the oldest fresh index doesn't connect to the cursor,
+      // receipts were missed between polls. Report the blind spot as a finding — a
+      // confident silence is the most dangerous output a monitor can produce.
+      if (cursor >= 0 && fresh.length > 0) {
+        const oldest = Math.min(...fresh.map((r) => r.index));
+        if (oldest > cursor + 1) {
+          const gap: Finding = {
+            rule: 'unknown-window',
+            severity: 'medium',
+            agent_id: '*',
+            receipt_hashes: [],
+            targets: [],
+            observed: `ledger indices ${cursor + 1}..${oldest - 1} were never scanned (feed outpaced the poll)`,
+            expected: 'contiguous coverage — treat the gap as UNKNOWN, not clean; backfill via /v1/recent?offset=',
+            ts: fresh.find((r) => r.index === oldest)!.receipt.ts,
+          };
+          const fp = fingerprint(gap);
+          if (!seen.has(fp)) {
+            seen.add(fp);
+            all.push(gap);
+            await opts.onFinding(gap);
+          }
+        }
+      }
+      for (const r of fresh) cursor = Math.max(cursor, r.index);
       for (const [did, baseline] of Object.entries(opts.baselines)) {
         const mine = fresh.filter((r) => r.receipt.agent_id === did).map((r) => ({ ...r.receipt, hash: r.hash }));
         if (mine.length === 0) continue;
 
         // Rolling window: append, then trim to `windowMs` behind the newest receipt.
-        const buf = [...(buffers[did] ?? []), ...mine].sort((a, b) => a.ts.localeCompare(b.ts));
-        const newest = Date.parse(buf[buf.length - 1]!.ts);
-        buffers[did] = buf.filter((r) => newest - Date.parse(r.ts) <= windowMs);
+        // Parsed-UTC ordering (offset timestamps sort correctly); unparseable ts are kept
+        // so scan() can report them rather than silently dropping them here.
+        const buf = [...(buffers[did] ?? []), ...mine].sort((a, b) => (tsMs(a.ts) ?? 0) - (tsMs(b.ts) ?? 0));
+        const newest = tsMs(buf[buf.length - 1]!.ts) ?? 0;
+        buffers[did] = buf.filter((r) => newest - (tsMs(r.ts) ?? newest) <= windowMs);
 
         for (const f of scan(buffers[did]!, baseline, opts.scan)) {
           const fp = fingerprint(f);
@@ -359,6 +435,41 @@ export function createWatcher(opts: WatcherOptions): Watcher {
   };
 }
 
+export interface BlastRadius {
+  /** What the delegation allows — the could-reach surface. */
+  declared_scopes: string[];
+  /** Target prefixes actually observed in history — the did-reach surface. */
+  used_prefixes: string[];
+  /** Declared scopes with NO observed activity underneath — standing, unused authority. */
+  unused_scopes: string[];
+  /** Observed prefixes not covered by any declared scope (should be impossible on-ledger). */
+  undeclared_prefixes: string[];
+}
+
+/**
+ * Could-reach vs did-reach. Standing authority an agent never uses is pure risk —
+ * the first thing to cut after an incident, and the first thing an underwriter asks
+ * about (`insurance` flags WILDCARD_AUTHORITY; this shows the whole surface). Facts,
+ * not a score — a `*` scope is reported as one unused scope, not silently expanded.
+ */
+export function blastRadius(baseline: Baseline): BlastRadius {
+  // used_prefixes are TRUNCATED to two segments, so a concrete deeper scope like
+  // `crm.contacts.read` must relate to the prefix `crm.contacts` in EITHER direction —
+  // otherwise a fully compliant agent reads as both unused-authority and undeclared.
+  const related = (scope: string, p: string): boolean => {
+    if (scope === '*') return true;
+    const s = scope.endsWith('.*') ? scope.slice(0, -2) : scope;
+    return s === p || s.startsWith(`${p}.`) || p.startsWith(`${s}.`);
+  };
+  const declared = [...baseline.scopes].sort();
+  const used = [...baseline.target_prefixes].sort();
+  const unused = declared.filter((s) => !used.some((p) => related(s, p)));
+  const undeclared = used.filter(
+    (p) => !declared.some((s) => related(s, p)),
+  );
+  return { declared_scopes: declared, used_prefixes: used, unused_scopes: unused, undeclared_prefixes: undeclared };
+}
+
 /**
  * The default response: a `@zanii/policy` rule turning the flagged prefixes into a
  * `require_approval` speed bump.
@@ -368,7 +479,7 @@ export function createWatcher(opts: WatcherOptions): Watcher {
  * gates the agent's entire surface. That call belongs to a human.
  */
 export function escalationRule(f: Finding): { id: string; effect: 'require_approval'; targets: string[] } | null {
-  const prefixes = [...new Set(f.targets.map((t) => `${targetPrefix(t)}.*`))];
+  const prefixes = [...new Set(f.targets.map((t) => `${targetPrefix(t)}.*`))].sort();
   if (prefixes.length === 0) return null;
   return {
     id: `sentinel-${f.rule.replace(/[^a-z0-9-]/gi, '-')}-${f.agent_id.slice(-8)}`,