@zhin.js/agent 1.1.13 → 1.1.14

package/lib/data-governance/disclosure-manifest.js

@@ -0,0 +1,264 @@
+import { createHash } from 'node:crypto';
+import { assertDataGovernancePolicySnapshot, assertDisclosureRecipientSetSnapshot, assertProcessingDestinationContract, assertRegisteredDataDescriptor, decideDisclosure, } from './data-governance.js';
+import { canonicalWorkroomJson, deepFreezeWorkroomValue as deepFreeze, digestCanonicalWorkroomValue, } from '../workroom/canonical-value.js';
+export async function materializeDisclosureManifest(input) {
+    input.signal.throwIfAborted();
+    const request = {
+        ...input,
+        decisionInput: deepFreeze(structuredClone(input.decisionInput)),
+        categoryRegistry: deepFreeze(structuredClone(input.categoryRegistry)),
+        source: copyHandle(input.source),
+    };
+    assertProcessingDestinationContract(request.decisionInput.context.destination);
+    assertDataGovernancePolicySnapshot(request.decisionInput.policy);
+    assertDisclosureRecipientSetSnapshot(request.decisionInput.context.recipients);
+    assertRegisteredDataDescriptor(request.decisionInput.descriptor, request.categoryRegistry);
+    nonNegativeInteger(request.decisionInput.evaluatedAt, 'disclosure evaluatedAt');
+    const decision = decideDisclosure(request.decisionInput);
+    if (decision.disposition === 'deny' || decision.disposition === 'approval_required') {
+        throw new Error(`Disclosure decision ${decision.disposition} is not materializable`);
+    }
+    assertSourceHandle(request.source, request.decisionInput.descriptor);
+    const materialized = await materializeOutput(request, decision);
+    const effectiveDecision = materialized.decision;
+    const approved = exactApprovals(request.decisionInput.approvals, effectiveDecision.approvalIds, effectiveDecision.requestDigest, request.decisionInput.policy.revision, request.decisionInput.evaluatedAt);
+    const expiresAt = Math.min(request.decisionInput.descriptor.retention.deleteAfter, request.decisionInput.evaluatedAt
+        + positiveInteger(request.decisionInput.context.destination.maximumRetentionSeconds, 'destination maximum retention seconds'), ...approved.map(({ expiresAt: value }) => value));
+    const projection = deepFreeze({
+        version: 1,
+        requestDigest: effectiveDecision.requestDigest,
+        source: {
+            objectId: request.decisionInput.descriptor.objectId,
+            payloadHash: request.decisionInput.descriptor.payloadHash,
+            descriptorDigest: digestCanonicalWorkroomValue(request.decisionInput.descriptor),
+            lineageDigest: digestCanonicalWorkroomValue(request.decisionInput.descriptor.lineage),
+            handle: copyHandle(request.source),
+        },
+        output: materialized.output,
+        channel: request.decisionInput.context.channel,
+        purpose: request.decisionInput.context.purpose,
+        principal: {
+            principalId: request.decisionInput.context.principal.principalId,
+            ...(request.decisionInput.context.principal.assignmentId === undefined
+                ? {}
+                : { assignmentId: request.decisionInput.context.principal.assignmentId }),
+        },
+        destination: {
+            id: request.decisionInput.context.destination.id,
+            contractDigest: request.decisionInput.context.destination.contractDigest,
+            recipientRevision: request.decisionInput.context.recipients.revision,
+            recipientDigest: request.decisionInput.context.recipients.digest,
+            loggingMode: request.decisionInput.context.destination.loggingMode,
+            allowsRedisclosure: request.decisionInput.context.destination.allowsRedisclosure,
+            supportsDeletion: request.decisionInput.context.destination.supportsDeletion,
+        },
+        policy: { revision: effectiveDecision.policy.revision, digest: effectiveDecision.policy.digest },
+        approvalIds: Object.freeze(approved.map(({ id }) => id).sort()),
+        expiresAt,
+    });
+    const digest = digestCanonicalWorkroomValue(projection);
+    return deepFreeze({ ...projection, id: `disclosure-manifest:${digest}`, digest });
+}
+async function materializeOutput(input, decision) {
+    if (decision.disposition === 'metadata_only') {
+        const payload = new TextEncoder().encode(canonicalWorkroomJson({
+            objectId: input.decisionInput.descriptor.objectId,
+            payloadHash: input.decisionInput.descriptor.payloadHash,
+            kind: input.decisionInput.descriptor.kind,
+            confidentiality: input.decisionInput.descriptor.confidentiality,
+            categories: input.decisionInput.descriptor.categories,
+        }));
+        const payloadHash = hashBytes(payload);
+        const objectId = `disclosure-output:${decision.requestDigest}:metadata`;
+        const outputDescriptor = derivedDescriptor(input.decisionInput.descriptor, objectId, payloadHash, input.decisionInput.descriptor.confidentiality, input.decisionInput.descriptor.categories);
+        assertRegisteredDataDescriptor(outputDescriptor, input.categoryRegistry);
+        const descriptorDigest = digestCanonicalWorkroomValue(outputDescriptor);
+        const handle = await abortable(input.vault.putDerived({
+            descriptor: outputDescriptor,
+            descriptorDigest,
+            payload,
+        }, input.signal), input.signal);
+        if (hashBytes(payload) !== payloadHash)
+            throw new Error('Payload Vault mutated materialized metadata');
+        assertDerivedHandle(handle, objectId, payloadHash, descriptorDigest, input.decisionInput.descriptor);
+        return deepFreeze({
+            output: {
+                handle: copyHandle(handle),
+                payloadHash,
+                mode: 'metadata_only',
+                subjectLinked: input.decisionInput.descriptor.subjectRefs.length > 0,
+            },
+            decision,
+        });
+    }
+    const body = await readSource(input, decision.requestDigest);
+    if (decision.disposition === 'full') {
+        return deepFreeze({
+            output: {
+                handle: copyHandle(input.source),
+                payloadHash: input.source.payloadHash,
+                mode: 'full',
+                subjectLinked: input.decisionInput.descriptor.subjectRefs.length > 0,
+            },
+            decision,
+        });
+    }
+    if (decision.disposition !== 'transform_required') {
+        throw new Error(`Disclosure decision ${decision.disposition} is not materializable`);
+    }
+    const transformId = decision.requiredTransformId;
+    if (!transformId || !input.transforms)
+        throw new Error('Trusted disclosure transform is not installed');
+    const trusted = input.decisionInput.policy.transforms[transformId];
+    if (!trusted)
+        throw new Error(`Trusted disclosure transform ${transformId} is unavailable`);
+    const transformInput = new Uint8Array(body);
+    // Typed arrays cannot be frozen by ECMAScript. The container and authority
+    // are immutable; the byte copy is hash-verified again after the transform.
+    const observation = await abortable(input.transforms.transform(Object.freeze({
+        transformId,
+        requestDigest: decision.requestDigest,
+        descriptor: input.decisionInput.descriptor,
+        input: transformInput,
+    }), input.signal), input.signal);
+    if (observation.transformId !== transformId
+        || observation.inputHash !== input.source.payloadHash
+        || hashBytes(transformInput) !== input.source.payloadHash
+        || observation.outputHash !== hashBytes(observation.output)
+        || observation.outputConfidentiality !== trusted.outputConfidentiality
+        || canonicalWorkroomJson([...observation.outputCategories].sort())
+            !== canonicalWorkroomJson([...trusted.outputCategories].sort())) {
+        throw new Error('Trusted disclosure transform observation does not match the pinned transform');
+    }
+    if (input.decisionInput.descriptor.subjectRefs.length > 0 && !observation.subjectLinked) {
+        throw new Error('Trusted disclosure transform cannot remove existing subject linkage');
+    }
+    const objectId = `disclosure-output:${decision.requestDigest}:transform:`
+        + observation.outputHash.slice('sha256:'.length);
+    const output = new Uint8Array(observation.output);
+    const outputDescriptor = derivedDescriptor(input.decisionInput.descriptor, objectId, observation.outputHash, observation.outputConfidentiality, observation.outputCategories, transformId);
+    const descriptorDigest = digestCanonicalWorkroomValue(outputDescriptor);
+    assertRegisteredDataDescriptor(outputDescriptor, input.categoryRegistry);
+    const outputDecision = decideDisclosure({
+        ...input.decisionInput,
+        descriptor: outputDescriptor,
+    });
+    if (outputDecision.disposition === 'approval_required') {
+        throw new Error(`Transformed disclosure approval required: ${outputDecision.requestDigest}`);
+    }
+    if (outputDecision.disposition !== 'full') {
+        throw new Error(`Transformed disclosure decision ${outputDecision.disposition} is not materializable`);
+    }
+    exactApprovals(input.decisionInput.approvals, outputDecision.approvalIds, outputDecision.requestDigest, input.decisionInput.policy.revision, input.decisionInput.evaluatedAt);
+    const handle = await abortable(input.vault.putDerived({
+        descriptor: outputDescriptor,
+        descriptorDigest,
+        payload: output,
+    }, input.signal), input.signal);
+    if (hashBytes(output) !== observation.outputHash)
+        throw new Error('Payload Vault mutated transformed output');
+    assertDerivedHandle(handle, objectId, observation.outputHash, descriptorDigest, input.decisionInput.descriptor);
+    return deepFreeze({
+        output: {
+            handle: copyHandle(handle), payloadHash: observation.outputHash, mode: 'transformed',
+            transformId, subjectLinked: observation.subjectLinked,
+        },
+        decision: outputDecision,
+    });
+}
+async function readSource(input, requestDigest) {
+    const body = await abortable(input.vault.readExact(deepFreeze({
+        handle: copyHandle(input.source),
+        requestDigest,
+        purpose: input.decisionInput.context.purpose,
+        principalId: input.decisionInput.context.principal.principalId,
+        destinationId: input.decisionInput.context.destination.id,
+    }), input.signal), input.signal);
+    if (hashBytes(body) !== input.source.payloadHash)
+        throw new Error('Payload Vault body hash mismatch');
+    return body;
+}
+function exactApprovals(approvals, approvalIds, requestDigest, policyRevision, evaluatedAt) {
+    if (new Set(approvalIds).size !== approvalIds.length) {
+        throw new Error('Disclosure decision contains duplicate approval ids');
+    }
+    return approvalIds.map((id) => {
+        const approval = approvals.find((candidate) => candidate.id === id
+            && candidate.requestDigest === requestDigest
+            && candidate.policyRevision === policyRevision
+            && candidate.decision === 'approved'
+            && candidate.expiresAt > evaluatedAt);
+        if (!approval)
+            throw new Error(`Disclosure approval ${id} is stale or unavailable`);
+        return approval;
+    });
+}
+function assertSourceHandle(handle, descriptor) {
+    assertHandle(handle);
+    if (handle.objectId !== descriptor.objectId || handle.payloadHash !== descriptor.payloadHash
+        || handle.descriptorDigest !== digestCanonicalWorkroomValue(descriptor)
+        || handle.tenantId !== descriptor.tenantId || handle.projectId !== descriptor.projectId) {
+        throw new Error('Payload Vault source handle does not match the Data Descriptor');
+    }
+}
+function assertDerivedHandle(handle, objectId, payloadHash, descriptorDigest, descriptor) {
+    assertHandle(handle);
+    if (handle.objectId !== objectId || handle.payloadHash !== payloadHash
+        || handle.descriptorDigest !== descriptorDigest || handle.tenantId !== descriptor.tenantId
+        || handle.projectId !== descriptor.projectId) {
+        throw new Error('Payload Vault derived handle does not match materialized output');
+    }
+}
+function assertHandle(handle) {
+    if (handle.version !== 1 || !canonicalText(handle.vaultObjectId) || !canonicalText(handle.objectId)
+        || !canonicalText(handle.tenantId) || !canonicalText(handle.projectId)
+        || !isDigest(handle.payloadHash) || !isDigest(handle.descriptorDigest)
+        || !isDigest(handle.locationManifestDigest)) {
+        throw new Error('Invalid Payload Vault object handle');
+    }
+}
+function copyHandle(handle) {
+    return deepFreeze({ ...handle });
+}
+function positiveInteger(value, name) {
+    if (!Number.isSafeInteger(value) || value < 1)
+        throw new Error(`Invalid ${name}`);
+    return value;
+}
+function nonNegativeInteger(value, name) {
+    if (!Number.isSafeInteger(value) || value < 0)
+        throw new Error(`Invalid ${name}`);
+    return value;
+}
+function derivedDescriptor(source, objectId, payloadHash, confidentiality, categories, transformRef) {
+    return deepFreeze({
+        ...source,
+        objectId,
+        payloadHash,
+        kind: 'projection_payload',
+        confidentiality,
+        categories: [...categories].sort(),
+        lineage: {
+            sourceObjectIds: [source.objectId],
+            ...(transformRef === undefined ? {} : { transformRef }),
+        },
+    });
+}
+function hashBytes(value) {
+    return `sha256:${createHash('sha256').update(value).digest('hex')}`;
+}
+function isDigest(value) {
+    return /^sha256:[a-f0-9]{64}$/u.test(value);
+}
+function canonicalText(value) {
+    return typeof value === 'string' && value.trim().length > 0 && value === value.trim();
+}
+async function abortable(promise, signal) {
+    signal.throwIfAborted();
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(signal.reason ?? new DOMException('Disclosure cancelled', 'AbortError'));
+        signal.addEventListener('abort', onAbort, { once: true });
+        promise.then(resolve, reject).finally(() => signal.removeEventListener('abort', onAbort));
+    });
+}
+//# sourceMappingURL=disclosure-manifest.js.map

package/lib/data-governance/disclosure-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"disclosure-manifest.js","sourceRoot":"","sources":["../../src/data-governance/disclosure-manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,kCAAkC,EAClC,oCAAoC,EACpC,mCAAmC,EACnC,8BAA8B,EAC9B,gBAAgB,GASjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,EACrB,uBAAuB,IAAI,UAAU,EACrC,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AA4GxC,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAOlD;IACA,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG;QACd,GAAG,KAAK;QACR,aAAa,EAAE,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC/D,gBAAgB,EAAE,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACrE,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;KACjC,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/E,kCAAkC,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACjE,oCAAoC,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/E,8BAA8B,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3F,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,WAAW,KAAK,MAAM,IAAI,QAAQ,CAAC,WAAW,KAAK,mBAAmB,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,CAAC,WAAW,wBAAwB,CAAC,CAAC;IACvF,CAAC;IACD,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAChE,MAAM,iBAAiB,GAAG,YAAY,CAAC,QAAQ,CAAC;IAChD,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,iBAAiB,CAAC,WAAW,EAC5F,iBAAiB,CAAC,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;IAC7G,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CACxB,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,WAAW,EACtD,OAAO,CAAC,aAAa,CAAC,WAAW;UAC7B,eAAe,CACf,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,uBAAuB,EACjE,uCAAuC,CACxC,EACH,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CACjD,CAAC;IACF,MAAM,UAAU,GAAG,UAAU,CAAC;QAC5B,OAAO,EAAE,CAAU;QACnB,aAAa,EAAE,iBAAiB,CAAC,aAAa;QAC9C,MAAM,EAAE;YACN,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,QAAQ;YACnD,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW;YACzD,gBAAgB,EAAE,4BAA4B,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC;YAChF,aAAa,EAAE,4BAA4B,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC;YACrF,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC;SACnC;QACD,MAAM,EAAE,YAAY,CAAC,MAAM;QAC3B,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO;QAC9C,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO;QAC9C,SAAS,EAAE;YACT,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW;YAChE,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,KAAK,SAAS;gBACpE,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;SAC5E;QACD,WAAW,EAAE;YACX,EAAE,EAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE;YAChD,cAAc,EAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc;YACxE,iBAAiB,EAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ;YACpE,eAAe,EAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM;YAChE,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW;YAClE,kBAAkB,EAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,kBAAkB;YAChF,gBAAgB,EAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,gBAAgB;SAC7E;QACD,MAAM,EAAE,EAAE,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE;QAChG,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/D,SAAS;KACV,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,4BAA4B,CAAC,UAAU,CAAC,CAAC;IACxD,OAAO,UAAU,CAAC,EAAE,GAAG,UAAU,EAAE,EAAE,EAAE,uBAAuB,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAOE,EACF,QAA4B;IAK5B,IAAI,QAAQ,CAAC,WAAW,KAAK,eAAe,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC;YAC7D,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,QAAQ;YACjD,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW;YACvD,IAAI,EAAE,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI;YACzC,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,eAAe;YAC/D,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU;SACtD,CAAC,CAAC,CAAC;QACJ,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,qBAAqB,QAAQ,CAAC,aAAa,WAAW,CAAC;QACxE,MAAM,gBAAgB,GAAG,iBAAiB,CACxC,KAAK,CAAC,aAAa,CAAC,UAAU,EAC9B,QAAQ,EACR,WAAW,EACX,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,eAAe,EAC9C,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,CAC1C,CAAC;QACF,8BAA8B,CAAC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACzE,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;YACpD,UAAU,EAAE,gBAAgB;YAC5B,gBAAgB;YAChB,OAAO;SACR,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACvG,mBAAmB,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACrG,OAAO,UAAU,CAAC;YAChB,MAAM,EAAE;gBACN,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC;gBAC1B,WAAW;gBACX,IAAI,EAAE,eAAe;gBACrB,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;aACrE;YACD,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC7D,IAAI,QAAQ,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;QACpC,OAAO,UAAU,CAAC;YAChB,MAAM,EAAE;gBACN,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;gBAChC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW;gBACrC,IAAI,EAAE,MAAM;gBACZ,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;aACrE;YACD,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW,KAAK,oBAAoB,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,CAAC,WAAW,wBAAwB,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,mBAAmB,CAAC;IACjD,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACxG,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,WAAW,iBAAiB,CAAC,CAAC;IAC5F,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IAC5C,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;QAC3E,WAAW;QACX,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,UAAU;QAC1C,KAAK,EAAE,cAAc;KACtB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,WAAW,CAAC,WAAW,KAAK,WAAW;WACtC,WAAW,CAAC,SAAS,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW;WAClD,SAAS,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW;WACtD,WAAW,CAAC,UAAU,KAAK,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC;WACxD,WAAW,CAAC,qBAAqB,KAAK,OAAO,CAAC,qBAAqB;WACnE,qBAAqB,CAAC,CAAC,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC5D,qBAAqB,CAAC,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,QAAQ,CAAC,aAAa,aAAa;UACrE,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,gBAAgB,GAAG,iBAAiB,CACxC,KAAK,CAAC,aAAa,CAAC,UAAU,EAC9B,QAAQ,EACR,WAAW,CAAC,UAAU,EACtB,WAAW,CAAC,qBAAqB,EACjC,WAAW,CAAC,gBAAgB,EAC5B,WAAW,CACZ,CAAC;IACF,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;IACxE,8BAA8B,CAAC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACzE,MAAM,cAAc,GAAG,gBAAgB,CAAC;QACtC,GAAG,KAAK,CAAC,aAAa;QACtB,UAAU,EAAE,gBAAgB;KAC7B,CAAC,CAAC;IACH,IAAI,cAAc,CAAC,WAAW,KAAK,mBAAmB,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,6CAA6C,cAAc,CAAC,aAAa,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,cAAc,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,mCAAmC,cAAc,CAAC,WAAW,wBAAwB,CAAC,CAAC;IACzG,CAAC;IACD,cAAc,CACZ,KAAK,CAAC,aAAa,CAAC,SAAS,EAC7B,cAAc,CAAC,WAAW,EAC1B,cAAc,CAAC,aAAa,EAC5B,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,EACnC,KAAK,CAAC,aAAa,CAAC,WAAW,CAChC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;QACpD,UAAU,EAAE,gBAAgB;QAC5B,gBAAgB;QAChB,OAAO,EAAE,MAAM;KAChB,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,WAAW,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9G,mBAAmB,CACjB,MAAM,EACN,QAAQ,EACR,WAAW,CAAC,UAAU,EACtB,gBAAgB,EAChB,KAAK,CAAC,aAAa,CAAC,UAAU,CAC/B,CAAC;IACF,OAAO,UAAU,CAAC;QAChB,MAAM,EAAE;YACN,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,UAAU,EAAE,IAAI,EAAE,aAAa;YACpF,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa;SACtD;QACD,QAAQ,EAAE,cAAc;KACzB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,KAKE,EACF,aAAqB;IAErB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC;QAC5D,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;QAChC,aAAa;QACb,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO;QAC5C,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW;QAC9D,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE;KAC1D,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CACrB,SAAgD,EAChD,WAA8B,EAC9B,aAAqB,EACrB,cAAsB,EACtB,WAAmB;IAEnB,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QAC5B,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE;eAC7D,SAAS,CAAC,aAAa,KAAK,aAAa;eACzC,SAAS,CAAC,cAAc,KAAK,cAAc;eAC3C,SAAS,CAAC,QAAQ,KAAK,UAAU;eACjC,SAAS,CAAC,SAAS,GAAG,WAAW,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,EAAE,0BAA0B,CAAC,CAAC;QACpF,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAgC,EAAE,UAA0B;IACtF,YAAY,CAAC,MAAM,CAAC,CAAC;IACrB,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,WAAW;WACvF,MAAM,CAAC,gBAAgB,KAAK,4BAA4B,CAAC,UAAU,CAAC;WACpE,MAAM,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,IAAI,MAAM,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS,EAAE,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAgC,EAChC,QAAgB,EAChB,WAAmB,EACnB,gBAAwB,EACxB,UAA0B;IAE1B,YAAY,CAAC,MAAM,CAAC,CAAC;IACrB,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW;WACjE,MAAM,CAAC,gBAAgB,KAAK,gBAAgB,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ;WACvF,MAAM,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAgC;IACpD,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC;WAC9F,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC;WACnE,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC;WACnE,CAAC,QAAQ,CAAC,MAAM,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAgC;IAClD,OAAO,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,IAAY;IAClD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAClF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAE,IAAY;IACrD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAClF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAsB,EACtB,QAAgB,EAChB,WAAmB,EACnB,eAAyD,EACzD,UAA6B,EAC7B,YAAqB;IAErB,OAAO,UAAU,CAAC;QAChB,GAAG,MAAM;QACT,QAAQ;QACR,WAAW;QACX,IAAI,EAAE,oBAAoB;QAC1B,eAAe;QACf,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE;QAClC,OAAO,EAAE;YACP,eAAe,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;YAClC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;SACxD;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;AACxF,CAAC;AAED,KAAK,UAAU,SAAS,CAAI,OAAmB,EAAE,MAAmB;IAClE,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,sBAAsB,EAAE,YAAY,CAAC,CAAC,CAAC;QAC5G,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;AACL,CAAC"}

package/lib/data-governance/encrypted-database-payload-vault.d.ts

@@ -0,0 +1,107 @@
+import type { PayloadVaultDerivedWriteInput, PayloadVaultObjectHandle, PayloadVaultPort, PayloadVaultReadInput } from './disclosure-manifest.js';
+import { type PayloadVaultCryptographyPort, type PayloadVaultSourceWriteInput } from './encrypted-file-payload-vault.js';
+import type { PayloadLifecycleObjectAuthority } from './payload-lifecycle.js';
+export interface EncryptedPayloadVaultDatabaseModel {
+    select(...fields: string[]): {
+        where(query: Record<string, unknown>): Promise<Record<string, unknown>[]>;
+    };
+}
+export interface EncryptedPayloadVaultDatabaseTransaction {
+    select(table: string): {
+        where(query: Record<string, unknown>): Promise<Record<string, unknown>[]>;
+    };
+    insertMany(table: string, rows: Record<string, unknown>[]): Promise<unknown>;
+}
+export interface EncryptedPayloadVaultDatabase {
+    transaction<T>(operation: (transaction: EncryptedPayloadVaultDatabaseTransaction) => Promise<T>, options: {
+        isolationLevel: 'SERIALIZABLE';
+    }): Promise<T>;
+}
+export interface EncryptedDatabasePayloadVaultOptions {
+    readonly database: EncryptedPayloadVaultDatabase;
+    readonly objectModel: EncryptedPayloadVaultDatabaseModel;
+    readonly auditModel: EncryptedPayloadVaultDatabaseModel;
+    readonly generation: number;
+    readonly cryptography: PayloadVaultCryptographyPort;
+    /** Stable Root-owned database identity, never a connection string or credential. */
+    readonly repositoryIdentity: string;
+}
+/** Root-private Database adapter. Only governed materializers receive its narrow ports. */
+export declare class EncryptedDatabasePayloadVault implements PayloadVaultPort {
+    #private;
+    constructor(options: EncryptedDatabasePayloadVaultOptions);
+    putSource(input: PayloadVaultSourceWriteInput, signal: AbortSignal): Promise<PayloadVaultObjectHandle>;
+    putDerived(input: PayloadVaultDerivedWriteInput, signal: AbortSignal): Promise<PayloadVaultObjectHandle>;
+    readExact(input: PayloadVaultReadInput, signal: AbortSignal): Promise<Uint8Array>;
+    resolveLifecycleObject(handle: PayloadVaultObjectHandle, signal: AbortSignal): Promise<PayloadLifecycleObjectAuthority | undefined>;
+}
+export declare const ENCRYPTED_PAYLOAD_VAULT_OBJECT_MODEL: {
+    id: {
+        type: "text";
+        primary: boolean;
+        nullable: boolean;
+    };
+    vault_object_id: {
+        type: "text";
+        nullable: boolean;
+    };
+    tenant_id: {
+        type: "text";
+        nullable: boolean;
+    };
+    project_id: {
+        type: "text";
+        nullable: boolean;
+    };
+    object_id: {
+        type: "text";
+        nullable: boolean;
+    };
+    payload_hash: {
+        type: "text";
+        nullable: boolean;
+    };
+    descriptor_digest: {
+        type: "text";
+        nullable: boolean;
+    };
+    location_manifest_digest: {
+        type: "text";
+        nullable: boolean;
+    };
+    envelope_digest: {
+        type: "text";
+        nullable: boolean;
+    };
+    envelope_json: {
+        type: "text";
+        nullable: boolean;
+    };
+};
+export declare const ENCRYPTED_PAYLOAD_VAULT_AUDIT_MODEL: {
+    id: {
+        type: "text";
+        primary: boolean;
+        nullable: boolean;
+    };
+    vault_object_id: {
+        type: "text";
+        nullable: boolean;
+    };
+    operation: {
+        type: "text";
+        nullable: boolean;
+    };
+    audit_digest: {
+        type: "text";
+        nullable: boolean;
+    };
+    audit_json: {
+        type: "text";
+        nullable: boolean;
+    };
+};
+export declare function defineEncryptedPayloadVaultDatabaseModels(database: Readonly<{
+    define(name: string, definition: unknown): void;
+}>): void;
+//# sourceMappingURL=encrypted-database-payload-vault.d.ts.map

package/lib/data-governance/encrypted-database-payload-vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-database-payload-vault.d.ts","sourceRoot":"","sources":["../../src/data-governance/encrypted-database-payload-vault.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,6BAA6B,EAC7B,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAML,KAAK,4BAA4B,EACjC,KAAK,4BAA4B,EAGlC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAE9E,MAAM,WAAW,kCAAkC;IACjD,MAAM,CAAC,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG;QAC3B,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;KAC3E,CAAC;CACH;AAED,MAAM,WAAW,wCAAwC;IACvD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG;QACrB,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;KAC3E,CAAC;IACF,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9E;AAED,MAAM,WAAW,6BAA6B;IAC5C,WAAW,CAAC,CAAC,EACX,SAAS,EAAE,CAAC,WAAW,EAAE,wCAAwC,KAAK,OAAO,CAAC,CAAC,CAAC,EAChF,OAAO,EAAE;QAAE,cAAc,EAAE,cAAc,CAAA;KAAE,GAC1C,OAAO,CAAC,CAAC,CAAC,CAAC;CACf;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,QAAQ,EAAE,6BAA6B,CAAC;IACjD,QAAQ,CAAC,WAAW,EAAE,kCAAkC,CAAC;IACzD,QAAQ,CAAC,UAAU,EAAE,kCAAkC,CAAC;IACxD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,4BAA4B,CAAC;IACpD,oFAAoF;IACpF,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED,2FAA2F;AAC3F,qBAAa,6BAA8B,YAAW,gBAAgB;;gBAWxD,OAAO,EAAE,oCAAoC;IAiBzD,SAAS,CACP,KAAK,EAAE,4BAA4B,EACnC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,wBAAwB,CAAC;IAIpC,UAAU,CACR,KAAK,EAAE,6BAA6B,EACpC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,wBAAwB,CAAC;IAI9B,SAAS,CAAC,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAcjF,sBAAsB,CAC1B,MAAM,EAAE,wBAAwB,EAChC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,+BAA+B,GAAG,SAAS,CAAC;CAiExD;AAED,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWhD,CAAC;AAEF,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;CAM/C,CAAC;AAEF,wBAAgB,yCAAyC,CACvD,QAAQ,EAAE,QAAQ,CAAC;IAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAG,IAAI,CAAA;CAAE,CAAC,GACtE,IAAI,CAGN"}

package/lib/data-governance/encrypted-database-payload-vault.js

@@ -0,0 +1,236 @@
+import { canonicalWorkroomJson, deepFreezeWorkroomValue as deepFreeze, digestCanonicalWorkroomValue as digest, } from '../workroom/canonical-value.js';
+import { PayloadVaultIntegrityError, openEncryptedPayloadVaultEnvelope, readEncryptedPayloadVaultAudit, resolveEncryptedPayloadVaultLifecycleObject, sealEncryptedPayloadVaultEnvelope, } from './encrypted-file-payload-vault.js';
+/** Root-private Database adapter. Only governed materializers receive its narrow ports. */
+export class EncryptedDatabasePayloadVault {
+    #database;
+    #objectModel;
+    #auditModel;
+    #generation;
+    #cryptography;
+    #storage = {
+        locationIdPrefix: 'vault-database',
+        authorityDigest: '',
+    };
+    constructor(options) {
+        this.#database = options.database;
+        this.#objectModel = options.objectModel;
+        this.#auditModel = options.auditModel;
+        this.#generation = positiveInteger(options.generation, 'generation');
+        this.#cryptography = options.cryptography;
+        const repositoryIdentity = required(options.repositoryIdentity, 'repositoryIdentity');
+        this.#storage = deepFreeze({
+            locationIdPrefix: 'vault-database',
+            authorityDigest: digest({
+                version: 1,
+                adapter: 'encrypted-database-payload-vault',
+                repositoryIdentityDigest: digest({ repositoryIdentity }),
+            }),
+        });
+    }
+    putSource(input, signal) {
+        return this.#put(input, signal);
+    }
+    putDerived(input, signal) {
+        return this.#put(input, signal);
+    }
+    async readExact(input, signal) {
+        signal.throwIfAborted();
+        const envelope = await this.#readEnvelope(input.handle);
+        const plaintext = await openEncryptedPayloadVaultEnvelope({
+            generation: this.#generation,
+            cryptography: this.#cryptography,
+            envelope,
+            input,
+            signal,
+        });
+        await this.#appendAudit(readEncryptedPayloadVaultAudit(this.#generation, input), signal);
+        return plaintext;
+    }
+    async resolveLifecycleObject(handle, signal) {
+        signal.throwIfAborted();
+        const rows = await this.#objectModel.select().where({ vault_object_id: handle.vaultObjectId });
+        if (rows.length === 0)
+            return undefined;
+        return resolveEncryptedPayloadVaultLifecycleObject(parseObjectRow(rows, handle), handle);
+    }
+    async #put(input, signal) {
+        signal.throwIfAborted();
+        const sealed = await sealEncryptedPayloadVaultEnvelope({
+            generation: this.#generation,
+            cryptography: this.#cryptography,
+            storage: this.#storage,
+            input,
+            signal,
+        });
+        try {
+            return await this.#database.transaction(async (transaction) => {
+                signal.throwIfAborted();
+                const rows = await transaction.select('payload_vault_objects').where({
+                    vault_object_id: sealed.handle.vaultObjectId,
+                });
+                if (rows.length > 0) {
+                    const winner = parseObjectRow(rows, sealed.handle);
+                    await insertAudit(transaction, sealed.audit);
+                    return winner.handle;
+                }
+                await transaction.insertMany('payload_vault_objects', [objectRow(sealed)]);
+                await insertAudit(transaction, sealed.audit);
+                return sealed.handle;
+            }, { isolationLevel: 'SERIALIZABLE' });
+        }
+        catch (error) {
+            if (!isDatabaseCasLoser(error))
+                throw error;
+            const winner = await this.#readEnvelope(sealed.handle);
+            await this.#appendAudit(sealed.audit, signal);
+            return winner.handle;
+        }
+    }
+    async #readEnvelope(handle) {
+        const rows = await this.#objectModel.select().where({ vault_object_id: handle.vaultObjectId });
+        return parseObjectRow(rows, handle);
+    }
+    async #appendAudit(value, signal) {
+        signal.throwIfAborted();
+        const candidate = auditRow(value);
+        try {
+            await this.#database.transaction(async (transaction) => {
+                signal.throwIfAborted();
+                const rows = await transaction.select('payload_vault_audit').where({ id: candidate.id });
+                if (rows.length > 0) {
+                    assertAuditRows(rows, candidate);
+                    return;
+                }
+                await transaction.insertMany('payload_vault_audit', [candidate]);
+            }, { isolationLevel: 'SERIALIZABLE' });
+        }
+        catch (error) {
+            if (!isDatabaseCasLoser(error))
+                throw error;
+            assertAuditRows(await this.#auditModel.select().where({ id: candidate.id }), candidate);
+        }
+    }
+}
+export const ENCRYPTED_PAYLOAD_VAULT_OBJECT_MODEL = {
+    id: { type: 'text', primary: true, nullable: false },
+    vault_object_id: { type: 'text', nullable: false },
+    tenant_id: { type: 'text', nullable: false },
+    project_id: { type: 'text', nullable: false },
+    object_id: { type: 'text', nullable: false },
+    payload_hash: { type: 'text', nullable: false },
+    descriptor_digest: { type: 'text', nullable: false },
+    location_manifest_digest: { type: 'text', nullable: false },
+    envelope_digest: { type: 'text', nullable: false },
+    envelope_json: { type: 'text', nullable: false },
+};
+export const ENCRYPTED_PAYLOAD_VAULT_AUDIT_MODEL = {
+    id: { type: 'text', primary: true, nullable: false },
+    vault_object_id: { type: 'text', nullable: false },
+    operation: { type: 'text', nullable: false },
+    audit_digest: { type: 'text', nullable: false },
+    audit_json: { type: 'text', nullable: false },
+};
+export function defineEncryptedPayloadVaultDatabaseModels(database) {
+    database.define('payload_vault_objects', ENCRYPTED_PAYLOAD_VAULT_OBJECT_MODEL);
+    database.define('payload_vault_audit', ENCRYPTED_PAYLOAD_VAULT_AUDIT_MODEL);
+}
+function objectRow(sealed) {
+    return {
+        id: sealed.handle.vaultObjectId,
+        vault_object_id: sealed.handle.vaultObjectId,
+        tenant_id: sealed.handle.tenantId,
+        project_id: sealed.handle.projectId,
+        object_id: sealed.handle.objectId,
+        payload_hash: sealed.handle.payloadHash,
+        descriptor_digest: sealed.handle.descriptorDigest,
+        location_manifest_digest: sealed.handle.locationManifestDigest,
+        envelope_digest: sealed.envelope.digest,
+        envelope_json: canonicalWorkroomJson(sealed.envelope),
+    };
+}
+function parseObjectRow(rows, handle) {
+    if (rows.length !== 1) {
+        throw new PayloadVaultIntegrityError('Payload Vault Database object is absent or duplicated');
+    }
+    const row = rows[0];
+    exactKeys(row, [
+        'id', 'vault_object_id', 'tenant_id', 'project_id', 'object_id', 'payload_hash',
+        'descriptor_digest', 'location_manifest_digest', 'envelope_digest', 'envelope_json',
+    ], 'object');
+    if (row.id !== handle.vaultObjectId || row.vault_object_id !== handle.vaultObjectId
+        || row.tenant_id !== handle.tenantId || row.project_id !== handle.projectId
+        || row.object_id !== handle.objectId || row.payload_hash !== handle.payloadHash
+        || row.descriptor_digest !== handle.descriptorDigest
+        || row.location_manifest_digest !== handle.locationManifestDigest
+        || typeof row.envelope_json !== 'string') {
+        throw new PayloadVaultIntegrityError('Payload Vault Database row authority binding mismatch');
+    }
+    let envelope;
+    try {
+        envelope = JSON.parse(row.envelope_json);
+    }
+    catch (error) {
+        throw new PayloadVaultIntegrityError('Payload Vault Database envelope is malformed', { cause: error });
+    }
+    if (canonicalWorkroomJson(envelope) !== row.envelope_json
+        || row.envelope_digest !== envelope.digest) {
+        throw new PayloadVaultIntegrityError('Payload Vault Database envelope row digest mismatch');
+    }
+    // The shared assertion binds full handle, AAD, manifest and envelope digest.
+    resolveEncryptedPayloadVaultLifecycleObject(envelope, handle);
+    return deepFreeze(structuredClone(envelope));
+}
+async function insertAudit(transaction, value) {
+    const candidate = auditRow(value);
+    const rows = await transaction.select('payload_vault_audit').where({ id: candidate.id });
+    if (rows.length > 0) {
+        assertAuditRows(rows, candidate);
+        return;
+    }
+    await transaction.insertMany('payload_vault_audit', [candidate]);
+}
+function auditRow(value) {
+    const body = deepFreeze(structuredClone(value));
+    const auditDigest = digest(body);
+    const content = deepFreeze({ ...body, digest: auditDigest });
+    const vaultObjectId = required(body.vaultObjectId, 'audit.vaultObjectId');
+    const operation = required(body.operation, 'audit.operation');
+    return {
+        id: digest(content),
+        vault_object_id: vaultObjectId,
+        operation,
+        audit_digest: auditDigest,
+        audit_json: canonicalWorkroomJson(content),
+    };
+}
+function assertAuditRows(rows, expected) {
+    if (rows.length !== 1)
+        throw new PayloadVaultIntegrityError('Payload Vault Database audit is absent or duplicated');
+    exactKeys(rows[0], ['id', 'vault_object_id', 'operation', 'audit_digest', 'audit_json'], 'audit');
+    if (canonicalWorkroomJson(rows[0]) !== canonicalWorkroomJson(expected)) {
+        throw new PayloadVaultIntegrityError('Payload Vault Database audit replay drift');
+    }
+}
+function exactKeys(value, expected, label) {
+    if (canonicalWorkroomJson(Object.keys(value).sort()) !== canonicalWorkroomJson([...expected].sort())) {
+        throw new PayloadVaultIntegrityError(`Payload Vault Database ${label} row shape drift`);
+    }
+}
+function required(value, label) {
+    if (typeof value !== 'string' || value.trim() !== value || value.length === 0) {
+        throw new PayloadVaultIntegrityError(`Payload Vault Database ${label} is invalid`);
+    }
+    return value;
+}
+function positiveInteger(value, label) {
+    if (!Number.isSafeInteger(value) || value < 1) {
+        throw new PayloadVaultIntegrityError(`Payload Vault Database ${label} must be positive`);
+    }
+    return value;
+}
+function isDatabaseCasLoser(error) {
+    return error instanceof Error
+        && ('code' in error && ['23505', 'SQLITE_CONSTRAINT', 'ER_DUP_ENTRY'].includes(String(error.code))
+            || /unique|duplicate|constraint/iu.test(error.message));
+}
+//# sourceMappingURL=encrypted-database-payload-vault.js.map

package/lib/data-governance/encrypted-database-payload-vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-database-payload-vault.js","sourceRoot":"","sources":["../../src/data-governance/encrypted-database-payload-vault.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,uBAAuB,IAAI,UAAU,EACrC,4BAA4B,IAAI,MAAM,GACvC,MAAM,gCAAgC,CAAC;AAOxC,OAAO,EACL,0BAA0B,EAC1B,iCAAiC,EACjC,8BAA8B,EAC9B,2CAA2C,EAC3C,iCAAiC,GAKlC,MAAM,mCAAmC,CAAC;AAiC3C,2FAA2F;AAC3F,MAAM,OAAO,6BAA6B;IAC/B,SAAS,CAAgC;IACzC,YAAY,CAAqC;IACjD,WAAW,CAAqC;IAChD,WAAW,CAAS;IACpB,aAAa,CAA+B;IAC5C,QAAQ,GAAG;QAClB,gBAAgB,EAAE,gBAAgB;QAClC,eAAe,EAAE,EAAE;KACpB,CAAC;IAEF,YAAY,OAA6C;QACvD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,IAAI,CAAC,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACrE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;QAC1C,MAAM,kBAAkB,GAAG,QAAQ,CAAC,OAAO,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;QACtF,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC;YACzB,gBAAgB,EAAE,gBAAgB;YAClC,eAAe,EAAE,MAAM,CAAC;gBACtB,OAAO,EAAE,CAAC;gBACV,OAAO,EAAE,kCAAkC;gBAC3C,wBAAwB,EAAE,MAAM,CAAC,EAAE,kBAAkB,EAAE,CAAC;aACzD,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CACP,KAAmC,EACnC,MAAmB;QAEnB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,UAAU,CACR,KAAoC,EACpC,MAAmB;QAEnB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAA4B,EAAE,MAAmB;QAC/D,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,MAAM,iCAAiC,CAAC;YACxD,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,QAAQ;YACR,KAAK;YACL,MAAM;SACP,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,YAAY,CAAC,8BAA8B,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;QACzF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,MAAgC,EAChC,MAAmB;QAEnB,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;QAC/F,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,2CAA2C,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3F,CAAC;IAED,KAAK,CAAC,IAAI,CACR,KAAmE,EACnE,MAAmB;QAEnB,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,iCAAiC,CAAC;YACrD,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,KAAK;YACL,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,EAAC,WAAW,EAAC,EAAE;gBAC1D,MAAM,CAAC,cAAc,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,KAAK,CAAC;oBACnE,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa;iBAC7C,CAAC,CAAC;gBACH,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACpB,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;oBACnD,MAAM,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;oBAC7C,OAAO,MAAM,CAAC,MAAM,CAAC;gBACvB,CAAC;gBACD,MAAM,WAAW,CAAC,UAAU,CAAC,uBAAuB,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC3E,MAAM,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC7C,OAAO,MAAM,CAAC,MAAM,CAAC;YACvB,CAAC,EAAE,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvD,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC9C,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAgC;QAClD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;QAC/F,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAwC,EAAE,MAAmB;QAC9E,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,EAAC,WAAW,EAAC,EAAE;gBACnD,MAAM,CAAC,cAAc,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;gBACzF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACpB,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBACjC,OAAO;gBACT,CAAC;gBACD,MAAM,WAAW,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;YACnE,CAAC,EAAE,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,eAAe,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;CACF;AAED,MAAM,CAAC,MAAM,oCAAoC,GAAG;IAClD,EAAE,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE;IAC7D,eAAe,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,QAAQ,EAAE,KAAK,EAAE;IAC3D,SAAS,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,QAAQ,EAAE,KAAK,EAAE;IACrD,UAAU,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,QAAQ,EAAE,KAAK,EAAE;IACtD,SAAS,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,QAAQ,EAAE,KAAK,EAAE;IACrD,YAAY,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,QAAQ,EAAE,KAAK,EAAE;IACxD,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,QAAQ,EAAE,KAAK,EAAE;IAC7D,wBAAwB,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,QAAQ,EAAE,KAAK,EAAE;IACpE,eAAe,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,QAAQ,EAAE,KAAK,EAAE;IAC3D,aAAa,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,QAAQ,EAAE,KAAK,EAAE;CAC1D,CAAC;AAEF,MAAM,CAAC,MAAM,mCAAmC,GAAG;IACjD,EAAE,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE;IAC7D,eAAe,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,QAAQ,EAAE,KAAK,EAAE;IAC3D,SAAS,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,QAAQ,EAAE,KAAK,EAAE;IACrD,YAAY,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,QAAQ,EAAE,KAAK,EAAE;IACxD,UAAU,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,QAAQ,EAAE,KAAK,EAAE;CACvD,CAAC;AAEF,MAAM,UAAU,yCAAyC,CACvD,QAAuE;IAEvE,QAAQ,CAAC,MAAM,CAAC,uBAAuB,EAAE,oCAAoC,CAAC,CAAC;IAC/E,QAAQ,CAAC,MAAM,CAAC,qBAAqB,EAAE,mCAAmC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,SAAS,CAAC,MAAgC;IACjD,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa;QAC/B,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa;QAC5C,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ;QACjC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS;QACnC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ;QACjC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW;QACvC,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,gBAAgB;QACjD,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC,sBAAsB;QAC9D,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QACvC,aAAa,EAAE,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,IAAwC,EACxC,MAAgC;IAEhC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,0BAA0B,CAAC,uDAAuD,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;IACrB,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc;QAC/E,mBAAmB,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,eAAe;KACpF,EAAE,QAAQ,CAAC,CAAC;IACb,IAAI,GAAG,CAAC,EAAE,KAAK,MAAM,CAAC,aAAa,IAAI,GAAG,CAAC,eAAe,KAAK,MAAM,CAAC,aAAa;WAC9E,GAAG,CAAC,SAAS,KAAK,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC,UAAU,KAAK,MAAM,CAAC,SAAS;WACxE,GAAG,CAAC,SAAS,KAAK,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY,KAAK,MAAM,CAAC,WAAW;WAC5E,GAAG,CAAC,iBAAiB,KAAK,MAAM,CAAC,gBAAgB;WACjD,GAAG,CAAC,wBAAwB,KAAK,MAAM,CAAC,sBAAsB;WAC9D,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,0BAA0B,CAAC,uDAAuD,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,QAA6B,CAAC;IAClC,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAwB,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,0BAA0B,CAAC,8CAA8C,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,qBAAqB,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,aAAa;WACpD,GAAG,CAAC,eAAe,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC7C,MAAM,IAAI,0BAA0B,CAAC,qDAAqD,CAAC,CAAC;IAC9F,CAAC;IACD,6EAA6E;IAC7E,2CAA2C,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9D,OAAO,UAAU,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,WAAqD,EACrD,KAAwC;IAExC,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;IACzF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IACD,MAAM,WAAW,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAwC;IACxD,MAAM,IAAI,GAAG,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAC7D,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC9D,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC;QACnB,eAAe,EAAE,aAAa;QAC9B,SAAS;QACT,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,qBAAqB,CAAC,OAAO,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,IAAwC,EACxC,QAAiC;IAEjC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,0BAA0B,CAAC,sDAAsD,CAAC,CAAC;IACpH,SAAS,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,CAAC,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC;IACnG,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,0BAA0B,CAAC,2CAA2C,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,QAA2B,EAAE,KAAa;IAC3F,IAAI,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,qBAAqB,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACrG,MAAM,IAAI,0BAA0B,CAAC,0BAA0B,KAAK,kBAAkB,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc,EAAE,KAAa;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,0BAA0B,CAAC,0BAA0B,KAAK,aAAa,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,KAAa;IACnD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,0BAA0B,CAAC,0BAA0B,KAAK,mBAAmB,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,KAAK,YAAY,KAAK;WACxB,CAAC,MAAM,IAAI,KAAK,IAAI,CAAC,OAAO,EAAE,mBAAmB,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;eAC7F,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;AAC9D,CAAC"}