attenu-guard 0.1.0

package/dist/cjs/ceilings.js

@@ -0,0 +1,476 @@
+"use strict";
+/**
+ * ceilings.ts — typed, self-narrowing, self-enforcing bounds on an Authority.
+ *
+ * A `Ceiling` is a small typed object that knows how to (a) check itself against
+ * a request context, (b) narrow itself against a sibling ceiling of the same
+ * kind, (c) state whether it admits a superset of what another ceiling of its
+ * kind admits, and (d) read and write its own wire form. `Authority` never needs
+ * to know the semantics of any particular ceiling — it just calls these methods.
+ *
+ * The property the Internet-Draft's constraint vocabulary demands: "a verifier
+ * that encounters an unknown constraint type MUST treat the action as denied
+ * (fail-closed), never as unconstrained." That is `ceilingFromWire`: an
+ * unrecognised wire constraint becomes an `UnknownCeiling`, whose `permits`
+ * always denies. There is no code path by which an unrecognised bound is
+ * silently dropped.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UnknownCeiling = exports.Prefix = exports.Deny = exports.Allow = exports.EgressRank = exports.CallLimit = exports.SpendCap = exports.RowLimit = void 0;
+exports.ctxFieldOf = ctxFieldOf;
+exports.describe = describe;
+exports.isMetered = isMetered;
+exports.registerCeiling = registerCeiling;
+exports.ceilingFromWire = ceilingFromWire;
+const canonical_js_1 = require("./canonical.js");
+const reasons_js_1 = require("./reasons.js");
+// Ordered enum for egress: index 0 is the strictest. A value outside this
+// vocabulary is treated as maximally permissive-requested (worst case), so a
+// garbage or unknown egress value fails closed rather than silently passing.
+const EGRESS_ORDER = ["none", "internal", "any"];
+function egressRankOf(value) {
+    const i = EGRESS_ORDER.indexOf(value);
+    return i === -1 ? EGRESS_ORDER.length : i;
+}
+/**
+ * The request-context field a ceiling reads. Prefers an explicit `ctxField`,
+ * then the caller-keyed `field`, then the ceiling's own `key`.
+ */
+function ctxFieldOf(ceiling) {
+    if (ceiling.ctxField)
+        return ceiling.ctxField;
+    if (ceiling.field)
+        return ceiling.field;
+    return ceiling.key;
+}
+/** Uniform human-readable rendering of any ceiling. Never parsed back. */
+function describe(ceiling) {
+    if (typeof ceiling.describe === "function")
+        return ceiling.describe();
+    return `${ceiling.key}=${JSON.stringify(ceiling.toWire())}`;
+}
+/**
+ * A METERED ceiling bounds a consumed quantity the caller must declare (rows
+ * read, spend, calls) — by convention its key starts with "max_". Rank and
+ * membership ceilings are not metered: omitting them from a context means "not
+ * asserting anything here", not "consuming an undeclared amount".
+ */
+function isMetered(ceiling) {
+    return Boolean(ceiling.metered) || String(ceiling.key).startsWith("max_");
+}
+function sortByStr(values) {
+    return Array.from(values).sort((a, b) => (0, canonical_js_1.compareCodePoints)(strOf(a), strOf(b)));
+}
+function strOf(value) {
+    if (typeof value === "number")
+        return (0, canonical_js_1.pyNumber)(value);
+    if (value === null)
+        return "None";
+    if (typeof value === "boolean")
+        return value ? "True" : "False";
+    if (typeof value === "string")
+        return value;
+    return JSON.stringify(value);
+}
+// =========================================================================
+// Built-in ceilings — fixed-key numeric and enum caps. For these four the wire
+// "key" IS the type discriminator, so the registry can route on "key" alone.
+// =========================================================================
+/** Per-call cap on rows read or returned. Context field: "rows". */
+class RowLimit {
+    maxRows;
+    key = "max_rows";
+    ctxField = "rows";
+    constructor(maxRows) {
+        this.maxRows = maxRows;
+    }
+    permits(ctx) {
+        const n = ctx["rows"];
+        if (n === undefined || n === null || n <= this.maxRows)
+            return reasons_js_1.Decision.allow();
+        return reasons_js_1.Decision.deny(new reasons_js_1.Reason(reasons_js_1.ReasonCode.CEILING_EXCEEDED, {
+            constraint: this.key,
+            limit: this.maxRows,
+            requested: n,
+        }));
+    }
+    describe() {
+        return `${this.key}<=${(0, canonical_js_1.pyNumber)(this.maxRows)}`;
+    }
+    narrow(other) {
+        return new RowLimit(Math.min(this.maxRows, other.maxRows));
+    }
+    subsumes(other) {
+        return this.maxRows >= other.maxRows;
+    }
+    toWire() {
+        return { key: this.key, max: this.maxRows };
+    }
+    static fromWire(d) {
+        return new RowLimit(d["max"]);
+    }
+}
+exports.RowLimit = RowLimit;
+/** Per-call cap on spend, currency-agnostic. Context field: "spend". */
+class SpendCap {
+    maxSpend;
+    key = "max_spend";
+    ctxField = "spend";
+    constructor(maxSpend) {
+        this.maxSpend = maxSpend;
+    }
+    permits(ctx) {
+        const n = ctx["spend"];
+        if (n === undefined || n === null || n <= this.maxSpend)
+            return reasons_js_1.Decision.allow();
+        return reasons_js_1.Decision.deny(new reasons_js_1.Reason(reasons_js_1.ReasonCode.CEILING_EXCEEDED, {
+            constraint: this.key,
+            limit: this.maxSpend,
+            requested: n,
+        }));
+    }
+    describe() {
+        return `${this.key}<=${(0, canonical_js_1.pyNumber)(this.maxSpend)}`;
+    }
+    narrow(other) {
+        return new SpendCap(Math.min(this.maxSpend, other.maxSpend));
+    }
+    subsumes(other) {
+        return this.maxSpend >= other.maxSpend;
+    }
+    toWire() {
+        return { key: this.key, max: this.maxSpend };
+    }
+    static fromWire(d) {
+        return new SpendCap(d["max"]);
+    }
+}
+exports.SpendCap = SpendCap;
+/**
+ * Cap on a call COUNT. Context field: "calls" — the running count including
+ * this call.
+ *
+ * `appliesTo` makes the ceiling SCOPED: it only bites requests for that scope
+ * (wildcards as in scopes: "fs.write", "web.*"). A scoped limit is its own
+ * dimension — `key` becomes `max_calls[<appliesTo>]` — so an unscoped and a
+ * scoped limit coexist in one Authority and pair independently.
+ *
+ * `Guard.check` supplies `calls` itself, per (node, pattern), when the caller
+ * does not; an explicit `calls` in the context still wins.
+ */
+class CallLimit {
+    maxCalls;
+    appliesTo;
+    key;
+    ctxField;
+    constructor(maxCalls, appliesTo = null) {
+        this.maxCalls = maxCalls;
+        this.appliesTo = appliesTo;
+        this.key = appliesTo ? `max_calls[${appliesTo}]` : "max_calls";
+        this.ctxField = appliesTo ? `calls[${appliesTo}]` : "calls";
+    }
+    /** What this ceiling counts: the pattern it applies to, or every call. */
+    get meterKey() {
+        return this.appliesTo ?? "*";
+    }
+    appliesToScope(scope) {
+        if (!this.appliesTo || scope === null || scope === undefined)
+            return true;
+        const held = this.appliesTo;
+        return held === scope || (held.endsWith(".*") && String(scope).startsWith(held.slice(0, -1)));
+    }
+    permits(ctx) {
+        if (!this.appliesToScope(ctx["_scope"]))
+            return reasons_js_1.Decision.allow();
+        const n = ctx[this.ctxField];
+        if (n === undefined || n === null || n <= this.maxCalls)
+            return reasons_js_1.Decision.allow();
+        return reasons_js_1.Decision.deny(new reasons_js_1.Reason(reasons_js_1.ReasonCode.CEILING_EXCEEDED, {
+            constraint: this.key,
+            limit: this.maxCalls,
+            requested: n,
+        }));
+    }
+    describe() {
+        return `${this.key}<=${(0, canonical_js_1.pyNumber)(this.maxCalls)}`;
+    }
+    narrow(other) {
+        return new CallLimit(Math.min(this.maxCalls, other.maxCalls), this.appliesTo);
+    }
+    subsumes(other) {
+        return this.maxCalls >= other.maxCalls;
+    }
+    toWire() {
+        if (!this.appliesTo)
+            return { key: this.key, max: this.maxCalls };
+        return { key: this.key, type: "max_calls", max: this.maxCalls, applies_to: this.appliesTo };
+    }
+    static fromWire(d) {
+        return new CallLimit(d["max"], d["applies_to"] ?? null);
+    }
+}
+exports.CallLimit = CallLimit;
+/** Ordered-enum egress ceiling: none < internal < any. Context field: "egress". */
+class EgressRank {
+    level;
+    key = "egress";
+    ctxField = "egress";
+    constructor(level) {
+        this.level = level;
+    }
+    permits(ctx) {
+        const val = ctx["egress"];
+        if (val === undefined || val === null || egressRankOf(val) <= egressRankOf(this.level)) {
+            return reasons_js_1.Decision.allow();
+        }
+        return reasons_js_1.Decision.deny(new reasons_js_1.Reason(reasons_js_1.ReasonCode.CEILING_EXCEEDED, {
+            constraint: this.key,
+            limit: this.level,
+            requested: val,
+        }));
+    }
+    describe() {
+        return `${this.key}<=${this.level}`;
+    }
+    narrow(other) {
+        const o = other;
+        return new EgressRank(egressRankOf(this.level) <= egressRankOf(o.level) ? this.level : o.level);
+    }
+    subsumes(other) {
+        return egressRankOf(this.level) >= egressRankOf(other.level);
+    }
+    toWire() {
+        return { key: this.key, rank: this.level };
+    }
+    static fromWire(d) {
+        return new EgressRank(d["rank"]);
+    }
+}
+exports.EgressRank = EgressRank;
+// =========================================================================
+// Built-in ceilings — generic, caller-keyed set membership and prefix bounds.
+// `key` here IS a caller choice, so it cannot double as the wire discriminator;
+// these carry an explicit "type" on the wire.
+// =========================================================================
+/** Membership allow-list: the context value MUST be one of `oneOf`. */
+class Allow {
+    key;
+    field;
+    oneOf;
+    constructor(key, oneOf, field = null) {
+        this.key = key;
+        this.field = field;
+        this.oneOf = new Set(oneOf);
+    }
+    ctxKey() {
+        return this.field ?? this.key;
+    }
+    permits(ctx) {
+        const val = ctx[this.ctxKey()];
+        if (val === undefined || val === null || this.oneOf.has(val))
+            return reasons_js_1.Decision.allow();
+        return reasons_js_1.Decision.deny(new reasons_js_1.Reason(reasons_js_1.ReasonCode.CEILING_EXCEEDED, {
+            constraint: this.key,
+            limit: sortByStr(this.oneOf),
+            requested: val,
+        }));
+    }
+    describe() {
+        return `${this.key} in [${sortByStr(this.oneOf).map(strOf).join(", ")}]`;
+    }
+    narrow(other) {
+        const o = other;
+        return new Allow(this.key, Array.from(this.oneOf).filter((v) => o.oneOf.has(v)), this.field);
+    }
+    subsumes(other) {
+        return Array.from(other.oneOf).every((v) => this.oneOf.has(v));
+    }
+    toWire() {
+        const d = { key: this.key, type: "allow", one_of: sortByStr(this.oneOf) };
+        if (this.field !== null && this.field !== this.key)
+            d["field"] = this.field;
+        return d;
+    }
+    static fromWire(d) {
+        return new Allow(d["key"], d["one_of"] ?? [], d["field"] ?? null);
+    }
+}
+exports.Allow = Allow;
+/** Membership deny-list: the context value MUST NOT be one of `notOneOf`. */
+class Deny {
+    key;
+    field;
+    notOneOf;
+    constructor(key, notOneOf, field = null) {
+        this.key = key;
+        this.field = field;
+        this.notOneOf = new Set(notOneOf);
+    }
+    ctxKey() {
+        return this.field ?? this.key;
+    }
+    permits(ctx) {
+        const val = ctx[this.ctxKey()];
+        if (val === undefined || val === null || !this.notOneOf.has(val))
+            return reasons_js_1.Decision.allow();
+        return reasons_js_1.Decision.deny(new reasons_js_1.Reason(reasons_js_1.ReasonCode.CEILING_EXCEEDED, {
+            constraint: this.key,
+            limit: sortByStr(this.notOneOf),
+            requested: val,
+        }));
+    }
+    describe() {
+        return `${this.key} not in [${sortByStr(this.notOneOf).map(strOf).join(", ")}]`;
+    }
+    narrow(other) {
+        const o = other;
+        return new Deny(this.key, [...this.notOneOf, ...o.notOneOf], this.field);
+    }
+    subsumes(other) {
+        // `this` admits a superset of `other`'s admitted set iff it forbids a
+        // subset of what `other` forbids.
+        return Array.from(this.notOneOf).every((v) => other.notOneOf.has(v));
+    }
+    toWire() {
+        const d = {
+            key: this.key,
+            type: "deny",
+            not_one_of: sortByStr(this.notOneOf),
+        };
+        if (this.field !== null && this.field !== this.key)
+            d["field"] = this.field;
+        return d;
+    }
+    static fromWire(d) {
+        return new Deny(d["key"], d["not_one_of"] ?? [], d["field"] ?? null);
+    }
+}
+exports.Deny = Deny;
+/** String-prefix bound: the context value MUST start with `prefix`. */
+class Prefix {
+    key;
+    prefix;
+    field;
+    constructor(key, prefix, field = null) {
+        this.key = key;
+        this.prefix = prefix;
+        this.field = field;
+    }
+    ctxKey() {
+        return this.field ?? this.key;
+    }
+    permits(ctx) {
+        const val = ctx[this.ctxKey()];
+        if (val === undefined || val === null || String(val).startsWith(this.prefix)) {
+            return reasons_js_1.Decision.allow();
+        }
+        return reasons_js_1.Decision.deny(new reasons_js_1.Reason(reasons_js_1.ReasonCode.CEILING_EXCEEDED, {
+            constraint: this.key,
+            limit: this.prefix,
+            requested: val,
+        }));
+    }
+    describe() {
+        return `${this.key} startswith ${this.prefix}`;
+    }
+    narrow(other) {
+        const o = other;
+        // If one prefix is a prefix of the other, the longer (more specific) one
+        // admits the subset and is the sound meet.
+        if (this.prefix.startsWith(o.prefix))
+            return this;
+        if (o.prefix.startsWith(this.prefix))
+            return o;
+        // Incomparable prefixes (e.g. "eu-" and "us-"): no real value can start
+        // with both, so the sound meet admits nothing. That is encoded as a prefix
+        // containing a NUL byte, which cannot be a genuine prefix of any realistic
+        // context string — so `permits` soundly denies every real request rather
+        // than picking one side and silently admitting values the other rejected.
+        return new Prefix(this.key, `${this.prefix}\u0000${o.prefix}`, this.field);
+    }
+    subsumes(other) {
+        return other.prefix.startsWith(this.prefix);
+    }
+    toWire() {
+        const d = { key: this.key, type: "prefix", prefix: this.prefix };
+        if (this.field !== null && this.field !== this.key)
+            d["field"] = this.field;
+        return d;
+    }
+    static fromWire(d) {
+        return new Prefix(d["key"], d["prefix"], d["field"] ?? null);
+    }
+}
+exports.Prefix = Prefix;
+const REGISTRY = new Map();
+/**
+ * Register a ceiling class's `fromWire` under a wire discriminator.
+ * Re-registering replaces the previous mapping — callers may shadow a built-in
+ * deliberately, but should do so knowingly.
+ */
+function registerCeiling(key, cls) {
+    REGISTRY.set(key, cls);
+}
+/**
+ * Fail-closed placeholder for a wire constraint this build does not recognise.
+ *
+ * `permits` always denies. `narrow` stays an unknown ceiling, so it can never
+ * resolve to something more permissive than "deny everything". `subsumes` is
+ * true only against an identical unknown ceiling — just enough reflexivity for
+ * `isNarrowerThan(self)`. `toWire` preserves the original bytes losslessly, so
+ * a chain that merely forwards constraints can still do so.
+ */
+class UnknownCeiling {
+    raw;
+    key;
+    constructor(key, raw = {}) {
+        this.raw = raw;
+        this.key = key === null || key === undefined ? "" : String(key);
+    }
+    permits(_ctx) {
+        return reasons_js_1.Decision.deny(new reasons_js_1.Reason(reasons_js_1.ReasonCode.UNKNOWN_CONSTRAINT, {
+            constraint: this.key,
+            message: `unrecognised constraint type for key=${JSON.stringify(this.key)}; fail-closed`,
+        }));
+    }
+    narrow(_other) {
+        return this;
+    }
+    subsumes(other) {
+        return (other instanceof UnknownCeiling &&
+            JSON.stringify(canonicalPairs(other.raw)) === JSON.stringify(canonicalPairs(this.raw)));
+    }
+    toWire() {
+        return { ...this.raw };
+    }
+    static fromWire(d) {
+        return new UnknownCeiling(d["key"] ?? null, { ...d });
+    }
+}
+exports.UnknownCeiling = UnknownCeiling;
+function canonicalPairs(d) {
+    return Object.keys(d)
+        .sort(canonical_js_1.compareCodePoints)
+        .map((k) => [k, d[k]]);
+}
+/**
+ * Reconstruct a Ceiling from its wire form. Routes on "type" when present (it
+ * disambiguates the generic ceilings), else on "key". An unrecognised
+ * discriminator fails closed via `UnknownCeiling`.
+ */
+function ceilingFromWire(wire) {
+    const d = (0, canonical_js_1.toPlain)(wire);
+    const discriminator = d["type"] ?? d["key"];
+    const cls = typeof discriminator === "string" ? REGISTRY.get(discriminator) : undefined;
+    if (cls === undefined)
+        return UnknownCeiling.fromWire(d);
+    return cls.fromWire(d);
+}
+registerCeiling("max_rows", RowLimit);
+registerCeiling("max_spend", SpendCap);
+registerCeiling("max_calls", CallLimit);
+registerCeiling("egress", EgressRank);
+registerCeiling("allow", Allow);
+registerCeiling("deny", Deny);
+registerCeiling("prefix", Prefix);
+//# sourceMappingURL=ceilings.js.map

package/dist/cjs/ceilings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ceilings.js","sourceRoot":"","sources":["../../src/ceilings.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AA+DH,gCAIC;AAGD,4BAGC;AAQD,8BAEC;AA2ZD,0CAEC;AA4DD,0CAMC;AAhjBD,iDAA6F;AAC7F,6CAA4D;AA8C5D,0EAA0E;AAC1E,6EAA6E;AAC7E,6EAA6E;AAC7E,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAU,CAAC;AAE1D,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,CAAC,GAAI,YAAmC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9D,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,SAAgB,UAAU,CAAC,OAAgB;IACzC,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC;IAC9C,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IACxC,OAAO,OAAO,CAAC,GAAG,CAAC;AACrB,CAAC;AAED,0EAA0E;AAC1E,SAAgB,QAAQ,CAAC,OAAgB;IACvC,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,UAAU;QAAE,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC;IACtE,OAAO,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,SAAgB,SAAS,CAAC,OAAgB;IACxC,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,SAAS,CAAC,MAAsB;IACvC,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,gCAAiB,EAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,KAAK,CAAC,KAAW;IACxB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAA,uBAAQ,EAAC,KAAK,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,4EAA4E;AAC5E,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAE5E,oEAAoE;AACpE,MAAa,QAAQ;IAGE;IAFZ,GAAG,GAAG,UAAU,CAAC;IACjB,QAAQ,GAAG,MAAM,CAAC;IAC3B,YAAqB,OAAe;QAAf,YAAO,GAAP,OAAO,CAAQ;IAAG,CAAC;IAExC,OAAO,CAAC,GAAY;QAClB,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QACtB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAK,CAAY,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,qBAAQ,CAAC,KAAK,EAAE,CAAC;QAC5F,OAAO,qBAAQ,CAAC,IAAI,CAClB,IAAI,mBAAM,CAAC,uBAAU,CAAC,gBAAgB,EAAE;YACtC,UAAU,EAAE,IAAI,CAAC,GAAG;YACpB,KAAK,EAAE,IAAI,CAAC,OAAO;YACnB,SAAS,EAAE,CAAC;SACb,CAAC,CACH,CAAC;IACJ,CAAC;IAED,QAAQ;QACN,OAAO,GAAG,IAAI,CAAC,GAAG,KAAK,IAAA,uBAAQ,EAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,CAAC,KAAc;QACnB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAG,KAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,QAAQ,CAAC,KAAc;QACrB,OAAO,IAAI,CAAC,OAAO,IAAK,KAAkB,CAAC,OAAO,CAAC;IACrD,CAAC;IAED,MAAM;QACJ,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,CAAuB;QACrC,OAAO,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAW,CAAC,CAAC;IAC1C,CAAC;CACF;AApCD,4BAoCC;AAED,wEAAwE;AACxE,MAAa,QAAQ;IAGE;IAFZ,GAAG,GAAG,WAAW,CAAC;IAClB,QAAQ,GAAG,OAAO,CAAC;IAC5B,YAAqB,QAAgB;QAAhB,aAAQ,GAAR,QAAQ,CAAQ;IAAG,CAAC;IAEzC,OAAO,CAAC,GAAY;QAClB,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAK,CAAY,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,qBAAQ,CAAC,KAAK,EAAE,CAAC;QAC7F,OAAO,qBAAQ,CAAC,IAAI,CAClB,IAAI,mBAAM,CAAC,uBAAU,CAAC,gBAAgB,EAAE;YACtC,UAAU,EAAE,IAAI,CAAC,GAAG;YACpB,KAAK,EAAE,IAAI,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC;SACb,CAAC,CACH,CAAC;IACJ,CAAC;IAED,QAAQ;QACN,OAAO,GAAG,IAAI,CAAC,GAAG,KAAK,IAAA,uBAAQ,EAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,CAAC,KAAc;QACnB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAG,KAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,QAAQ,CAAC,KAAc;QACrB,OAAO,IAAI,CAAC,QAAQ,IAAK,KAAkB,CAAC,QAAQ,CAAC;IACvD,CAAC;IAED,MAAM;QACJ,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,CAAuB;QACrC,OAAO,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAW,CAAC,CAAC;IAC1C,CAAC;CACF;AApCD,4BAoCC;AAED;;;;;;;;;;;GAWG;AACH,MAAa,SAAS;IAKT;IACA;IALF,GAAG,CAAS;IACZ,QAAQ,CAAS;IAE1B,YACW,QAAgB,EAChB,YAA2B,IAAI;QAD/B,aAAQ,GAAR,QAAQ,CAAQ;QAChB,cAAS,GAAT,SAAS,CAAsB;QAExC,IAAI,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,aAAa,SAAS,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC;QAC/D,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,SAAS,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9D,CAAC;IAED,0EAA0E;IAC1E,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC;IAC/B,CAAC;IAED,cAAc,CAAC,KAAgC;QAC7C,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC5B,OAAO,IAAI,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChG,CAAC;IAED,OAAO,CAAC,GAAY;QAClB,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAuB,CAAC;YAAE,OAAO,qBAAQ,CAAC,KAAK,EAAE,CAAC;QACvF,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAK,CAAY,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,qBAAQ,CAAC,KAAK,EAAE,CAAC;QAC7F,OAAO,qBAAQ,CAAC,IAAI,CAClB,IAAI,mBAAM,CAAC,uBAAU,CAAC,gBAAgB,EAAE;YACtC,UAAU,EAAE,IAAI,CAAC,GAAG;YACpB,KAAK,EAAE,IAAI,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC;SACb,CAAC,CACH,CAAC;IACJ,CAAC;IAED,QAAQ;QACN,OAAO,GAAG,IAAI,CAAC,GAAG,KAAK,IAAA,uBAAQ,EAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,CAAC,KAAc;QACnB,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAG,KAAmB,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/F,CAAC;IAED,QAAQ,CAAC,KAAc;QACrB,OAAO,IAAI,CAAC,QAAQ,IAAK,KAAmB,CAAC,QAAQ,CAAC;IACxD,CAAC;IAED,MAAM;QACJ,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC9F,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,CAAuB;QACrC,OAAO,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,CAAW,EAAG,CAAC,CAAC,YAAY,CAAwB,IAAI,IAAI,CAAC,CAAC;IAC5F,CAAC;CACF;AAxDD,8BAwDC;AAED,mFAAmF;AACnF,MAAa,UAAU;IAGA;IAFZ,GAAG,GAAG,QAAQ,CAAC;IACf,QAAQ,GAAG,QAAQ,CAAC;IAC7B,YAAqB,KAAa;QAAb,UAAK,GAAL,KAAK,CAAQ;IAAG,CAAC;IAEtC,OAAO,CAAC,GAAY;QAClB,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACvF,OAAO,qBAAQ,CAAC,KAAK,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,qBAAQ,CAAC,IAAI,CAClB,IAAI,mBAAM,CAAC,uBAAU,CAAC,gBAAgB,EAAE;YACtC,UAAU,EAAE,IAAI,CAAC,GAAG;YACpB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,GAAG;SACf,CAAC,CACH,CAAC;IACJ,CAAC;IAED,QAAQ;QACN,OAAO,GAAG,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,CAAC,KAAc;QACnB,MAAM,CAAC,GAAG,KAAmB,CAAC;QAC9B,OAAO,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAClG,CAAC;IAED,QAAQ,CAAC,KAAc;QACrB,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,YAAY,CAAE,KAAoB,CAAC,KAAK,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM;QACJ,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAC7C,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,CAAuB;QACrC,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAW,CAAC,CAAC;IAC7C,CAAC;CACF;AAvCD,gCAuCC;AAED,4EAA4E;AAC5E,8EAA8E;AAC9E,gFAAgF;AAChF,8CAA8C;AAC9C,4EAA4E;AAE5E,uEAAuE;AACvE,MAAa,KAAK;IAGL;IAEA;IAJF,KAAK,CAAoB;IAClC,YACW,GAAW,EACpB,KAAqB,EACZ,QAAuB,IAAI;QAF3B,QAAG,GAAH,GAAG,CAAQ;QAEX,UAAK,GAAL,KAAK,CAAsB;QAEpC,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAEO,MAAM;QACZ,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;IAChC,CAAC;IAED,OAAO,CAAC,GAAY;QAClB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,qBAAQ,CAAC,KAAK,EAAE,CAAC;QACtF,OAAO,qBAAQ,CAAC,IAAI,CAClB,IAAI,mBAAM,CAAC,uBAAU,CAAC,gBAAgB,EAAE;YACtC,UAAU,EAAE,IAAI,CAAC,GAAG;YACpB,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;YAC5B,SAAS,EAAE,GAAG;SACf,CAAC,CACH,CAAC;IACJ,CAAC;IAED,QAAQ;QACN,OAAO,GAAG,IAAI,CAAC,GAAG,QAAQ,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IAC3E,CAAC;IAED,MAAM,CAAC,KAAc;QACnB,MAAM,CAAC,GAAG,KAAc,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/F,CAAC;IAED,QAAQ,CAAC,KAAc;QACrB,OAAO,KAAK,CAAC,IAAI,CAAE,KAAe,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM;QACJ,MAAM,CAAC,GAAyB,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChG,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,GAAG;YAAE,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;QAC5E,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,CAAuB;QACrC,OAAO,IAAI,KAAK,CACd,CAAC,CAAC,KAAK,CAAW,EACjB,CAAC,CAAC,QAAQ,CAAY,IAAI,EAAE,EAC5B,CAAC,CAAC,OAAO,CAAwB,IAAI,IAAI,CAC3C,CAAC;IACJ,CAAC;CACF;AApDD,sBAoDC;AAED,6EAA6E;AAC7E,MAAa,IAAI;IAGJ;IAEA;IAJF,QAAQ,CAAoB;IACrC,YACW,GAAW,EACpB,QAAwB,EACf,QAAuB,IAAI;QAF3B,QAAG,GAAH,GAAG,CAAQ;QAEX,UAAK,GAAL,KAAK,CAAsB;QAEpC,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAEO,MAAM;QACZ,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;IAChC,CAAC;IAED,OAAO,CAAC,GAAY;QAClB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,qBAAQ,CAAC,KAAK,EAAE,CAAC;QAC1F,OAAO,qBAAQ,CAAC,IAAI,CAClB,IAAI,mBAAM,CAAC,uBAAU,CAAC,gBAAgB,EAAE;YACtC,UAAU,EAAE,IAAI,CAAC,GAAG;YACpB,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC/B,SAAS,EAAE,GAAG;SACf,CAAC,CACH,CAAC;IACJ,CAAC;IAED,QAAQ;QACN,OAAO,GAAG,IAAI,CAAC,GAAG,YAAY,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IAClF,CAAC;IAED,MAAM,CAAC,KAAc;QACnB,MAAM,CAAC,GAAG,KAAa,CAAC;QACxB,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3E,CAAC;IAED,QAAQ,CAAC,KAAc;QACrB,sEAAsE;QACtE,kCAAkC;QAClC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,KAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,MAAM;QACJ,MAAM,CAAC,GAAyB;YAC9B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,IAAI,EAAE,MAAM;YACZ,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;SACrC,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,GAAG;YAAE,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;QAC5E,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,CAAuB;QACrC,OAAO,IAAI,IAAI,CACb,CAAC,CAAC,KAAK,CAAW,EACjB,CAAC,CAAC,YAAY,CAAY,IAAI,EAAE,EAChC,CAAC,CAAC,OAAO,CAAwB,IAAI,IAAI,CAC3C,CAAC;IACJ,CAAC;CACF;AA1DD,oBA0DC;AAED,uEAAuE;AACvE,MAAa,MAAM;IAEN;IACA;IACA;IAHX,YACW,GAAW,EACX,MAAc,EACd,QAAuB,IAAI;QAF3B,QAAG,GAAH,GAAG,CAAQ;QACX,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAsB;IACnC,CAAC;IAEI,MAAM;QACZ,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;IAChC,CAAC;IAED,OAAO,CAAC,GAAY;QAClB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7E,OAAO,qBAAQ,CAAC,KAAK,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,qBAAQ,CAAC,IAAI,CAClB,IAAI,mBAAM,CAAC,uBAAU,CAAC,gBAAgB,EAAE;YACtC,UAAU,EAAE,IAAI,CAAC,GAAG;YACpB,KAAK,EAAE,IAAI,CAAC,MAAM;YAClB,SAAS,EAAE,GAAG;SACf,CAAC,CACH,CAAC;IACJ,CAAC;IAED,QAAQ;QACN,OAAO,GAAG,IAAI,CAAC,GAAG,eAAe,IAAI,CAAC,MAAM,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,CAAC,KAAc;QACnB,MAAM,CAAC,GAAG,KAAe,CAAC;QAC1B,yEAAyE;QACzE,2CAA2C;QAC3C,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,CAAC;QAC/C,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7E,CAAC;IAED,QAAQ,CAAC,KAAc;QACrB,OAAQ,KAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM;QACJ,MAAM,CAAC,GAAyB,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QACvF,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,GAAG;YAAE,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;QAC5E,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,CAAuB;QACrC,OAAO,IAAI,MAAM,CACf,CAAC,CAAC,KAAK,CAAW,EAClB,CAAC,CAAC,QAAQ,CAAW,EACpB,CAAC,CAAC,OAAO,CAAwB,IAAI,IAAI,CAC3C,CAAC;IACJ,CAAC;CACF;AA5DD,wBA4DC;AAYD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;AAEjD;;;;GAIG;AACH,SAAgB,eAAe,CAAC,GAAW,EAAE,GAAiB;IAC5D,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAa,cAAc;IAId;IAHF,GAAG,CAAS;IACrB,YACE,GAAS,EACA,MAA4B,EAAE;QAA9B,QAAG,GAAH,GAAG,CAA2B;QAEvC,IAAI,CAAC,GAAG,GAAG,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,CAAC,IAAa;QACnB,OAAO,qBAAQ,CAAC,IAAI,CAClB,IAAI,mBAAM,CAAC,uBAAU,CAAC,kBAAkB,EAAE;YACxC,UAAU,EAAE,IAAI,CAAC,GAAG;YACpB,OAAO,EAAE,wCAAwC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe;SACzF,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,MAAe;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,QAAQ,CAAC,KAAc;QACrB,OAAO,CACL,KAAK,YAAY,cAAc;YAC/B,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CACvF,CAAC;IACJ,CAAC;IAED,MAAM;QACJ,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,CAAuB;QACrC,OAAO,IAAI,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC;CACF;AApCD,wCAoCC;AAED,SAAS,cAAc,CAAC,CAAuB;IAC7C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;SAClB,IAAI,CAAC,gCAAiB,CAAC;SACvB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAmB,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,IAAW;IACzC,MAAM,CAAC,GAAG,IAAA,sBAAO,EAAuB,IAAI,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACzD,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED,eAAe,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;AACtC,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;AACvC,eAAe,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AACxC,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;AACtC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAChC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC9B,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC"}

package/dist/cjs/chain.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Chain state — the live delegation graph, TTL, integrity and cascade revocation.
+ *
+ * A Chain tracks the tree of delegations rooted at one top-level task and
+ * enforces the structural invariants no single-agent policy model can express:
+ *
+ *   * monotonic attenuation: every child authority <= its parent's (via `meet`);
+ *   * time bounds: an authority stops authorizing once its TTL elapses;
+ *   * depth and fanout ceilings on the tree;
+ *   * aggregate ceilings summed across the whole chain;
+ *   * cascade revocation: revoking any node revokes its whole subtree;
+ *   * in-process integrity: each node's authority is sealed with a per-chain
+ *     secret, so accidental (or unsophisticated) mutation of node state is
+ *     caught at check time.
+ *
+ * That last one raises the bar against bugs and casual tampering only — code
+ * running in the same process can read the secret. Real tamper-resistance comes
+ * from the signed, offline-verifiable evidence bundle; the in-process library
+ * tier trusts its own process.
+ */
+import { type Json } from "./canonical.js";
+import { Authority, AuthorityError } from "./authority.js";
+/** A source of seconds for TTL expiry. Injectable so tests are deterministic. */
+export interface Clock {
+    now(): number;
+}
+/** The default wall clock: monotonic seconds. */
+export declare class MonotonicClock implements Clock {
+    now(): number;
+}
+/** A test clock the caller advances by hand. */
+export declare class ManualClock implements Clock {
+    private t;
+    constructor(t?: number);
+    now(): number;
+    advance(seconds: number): void;
+    set(seconds: number): void;
+}
+export interface Node {
+    nodeId: string;
+    parentId: string | null;
+    agentId: string;
+    authority: Authority;
+    task: string;
+    depth: number;
+    issuedAt: number;
+    revoked: boolean;
+    /** Lifecycle end marker: informational, never widens or narrows authority. */
+    complete: boolean;
+    children: string[];
+    /** HMAC of the authority under the chain secret. */
+    seal: string;
+}
+export interface ChainInit {
+    maxDepth?: number;
+    maxFanout?: number;
+    clock?: Clock;
+}
+export declare class Chain {
+    readonly chainId: string;
+    readonly maxDepth: number;
+    readonly maxFanout: number;
+    readonly clock: Clock;
+    readonly nodes: Map<string, Node>;
+    private readonly revokedNodes;
+    private readonly bannedAgents;
+    private nextId;
+    private readonly consumed;
+    private readonly calls;
+    private readonly strikes;
+    private readonly secret;
+    constructor(chainId: string, init?: ChainInit);
+    private seal;
+    verifyIntegrity(node: Node): boolean;
+    newNodeId(): string;
+    addRoot(agentId: string, authority: Authority, task: string): Node;
+    isExpired(node: Node): boolean;
+    /**
+     * The structural preconditions for `addChild`, WITHOUT mutating anything:
+     * the `AuthorityError` that `addChild` would throw, or `null` if the
+     * delegation is currently permitted.
+     */
+    delegationError(parentId: string, agentId: string): AuthorityError | null;
+    addChild(parentId: string, agentId: string, requested: Authority, task: string): Node;
+    /** Revoke `nodeId` and its whole subtree. Returns the ids revoked by this call. */
+    revoke(nodeId: string): string[];
+    isRevoked(nodeId: string): boolean;
+    /**
+     * PRINCIPAL-scoped revocation: cascade-revoke every node held by `agentId`
+     * and ban the agent, so no node in this chain can delegate to it again.
+     * Closes the re-delegation bypass where a framework hands off again to a
+     * revoked agent and would otherwise mint it a fresh child from a still-valid
+     * parent.
+     */
+    revokeAgent(agentId: string): string[];
+    isBanned(agentId: string): boolean;
+    /** Add to a chain-wide running total, throwing if it passes the ceiling. */
+    consume(key: string, amount: number, chainCeiling: number | null): void;
+    private static meterKey;
+    callsSoFar(nodeId: string, pattern: string): number;
+    countCall(nodeId: string, pattern: string): number;
+    /** Count a denial for the strike policy; returns the running total. */
+    recordStrike(key: string): number;
+    graph(): Record<string, Json>;
+}
+//# sourceMappingURL=chain.d.ts.map

package/dist/cjs/chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../../src/chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,EAAkB,KAAK,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAE3D,iFAAiF;AACjF,MAAM,WAAW,KAAK;IACpB,GAAG,IAAI,MAAM,CAAC;CACf;AAED,iDAAiD;AACjD,qBAAa,cAAe,YAAW,KAAK;IAC1C,GAAG,IAAI,MAAM;CAGd;AAED,gDAAgD;AAChD,qBAAa,WAAY,YAAW,KAAK;IAC3B,OAAO,CAAC,CAAC;gBAAD,CAAC,SAAI;IACzB,GAAG,IAAI,MAAM;IAGb,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAG9B,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;CAG3B;AAED,MAAM,WAAW,IAAI;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,SAAS,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,8EAA8E;IAC9E,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED,qBAAa,KAAK;IAChB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,KAAK,oBAA2B;IAEzC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IACtD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;IACnD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;gBAE9B,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,SAAc;IASjD,OAAO,CAAC,IAAI;IAMZ,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO;IAMpC,SAAS,IAAI,MAAM;IAInB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAqBlE,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO;IAM9B;;;;OAIG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IA0CzE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAmCrF,mFAAmF;IACnF,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE;IAgBhC,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAIlC;;;;;;OAMG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE;IAWtC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAMlC,4EAA4E;IAC5E,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAYvE,OAAO,CAAC,MAAM,CAAC,QAAQ;IAIvB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM;IAInD,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM;IAOlD,uEAAuE;IACvE,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAMjC,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;CAc9B"}

package/dist/cjs/chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.js","sourceRoot":"","sources":["../../src/chain.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;;AAEH,6CAAuE;AAEvE,iDAA2D;AAC3D,iDAA2D;AAO3D,iDAAiD;AACjD,MAAa,cAAc;IACzB,GAAG;QACD,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAClC,CAAC;CACF;AAJD,wCAIC;AAED,gDAAgD;AAChD,MAAa,WAAW;IACF;IAApB,YAAoB,IAAI,CAAC;QAAL,MAAC,GAAD,CAAC,CAAI;IAAG,CAAC;IAC7B,GAAG;QACD,OAAO,IAAI,CAAC,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,CAAC,OAAe;QACrB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC;IACpB,CAAC;IACD,GAAG,CAAC,OAAe;QACjB,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC;IACnB,CAAC;CACF;AAXD,kCAWC;AAwBD,MAAa,KAAK;IACP,OAAO,CAAS;IAChB,QAAQ,CAAS;IACjB,SAAS,CAAS;IAClB,KAAK,CAAQ;IACb,KAAK,GAAG,IAAI,GAAG,EAAgB,CAAC;IAExB,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC,CAAC,YAAY;IAC9C,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC,CAAC,YAAY;IACvD,MAAM,GAAG,CAAC,CAAC;IACF,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IACrC,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,0BAA0B;IAC7D,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpC,MAAM,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,CAAC,0BAA0B;IAErE,YAAY,OAAe,EAAE,OAAkB,EAAE;QAC/C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,cAAc,EAAE,CAAC;IAClD,CAAC;IAED,0EAA0E;IAElE,IAAI,CAAC,SAAoB;QAC/B,OAAO,IAAA,wBAAU,EAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC;aACrC,MAAM,CAAC,IAAA,6BAAc,EAAC,SAAS,CAAC,MAAM,EAAqB,CAAC,CAAC;aAC7D,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED,eAAe,CAAC,IAAU;QACxB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,OAAO,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChF,CAAC;IAED,SAAS;QACP,OAAO,GAAG,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;IAC7C,CAAC;IAED,OAAO,CAAC,OAAe,EAAE,SAAoB,EAAE,IAAY;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,GAAS;YACjB,MAAM;YACN,QAAQ,EAAE,IAAI;YACd,OAAO;YACP,SAAS;YACT,IAAI;YACJ,KAAK,EAAE,CAAC;YACR,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC1B,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,EAAE;YACZ,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;SAC3B,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0EAA0E;IAE1E,SAAS,CAAC,IAAU;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;QAC/B,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;IAChD,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,QAAgB,EAAE,OAAe;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,IAAI,6BAAc,CAAC,gBAAgB,QAAQ,EAAE,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,6BAAc,CAAC,qCAAqC,EAAE,eAAe,EAAE;gBAChF,MAAM,EAAE,QAAQ;aACjB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,6BAAc,CACvB,UAAU,OAAO,kCAAkC,EACnD,cAAc,EACd,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,6BAAc,CAAC,yCAAyC,EAAE,WAAW,EAAE;gBAChF,MAAM,EAAE,QAAQ;aACjB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,6BAAc,CAAC,2CAA2C,EAAE,aAAa,EAAE;gBACpF,MAAM,EAAE,QAAQ;aACjB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrC,OAAO,IAAI,6BAAc,CACvB,oBAAoB,MAAM,CAAC,KAAK,GAAG,CAAC,sBAAsB,IAAI,CAAC,QAAQ,EAAE,EACzE,WAAW,EACX,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,CAC7B,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAChD,OAAO,IAAI,6BAAc,CAAC,6BAA6B,IAAI,CAAC,SAAS,EAAE,EAAE,YAAY,EAAE;gBACrF,UAAU,EAAE,IAAI,CAAC,SAAS;aAC3B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,QAAQ,CAAC,QAAgB,EAAE,OAAe,EAAE,SAAoB,EAAE,IAAY;QAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,GAAG,KAAK,IAAI;YAAE,MAAM,GAAG,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC;QAEzC,yEAAyE;QACzE,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnD,qEAAqE;QACrE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,6BAAc,CAAC,gCAAgC,EAAE,WAAW,EAAE;gBACtE,MAAM,EAAE,QAAQ;aACjB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,GAAS;YACjB,MAAM;YACN,QAAQ;YACR,OAAO;YACP,SAAS,EAAE,SAAS;YACpB,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,KAAK,GAAG,CAAC;YACvB,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC1B,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,EAAE;YACZ,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;SAC3B,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0EAA0E;IAE1E,mFAAmF;IACnF,MAAM,CAAC,MAAc;QACnB,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC;QACvB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;YACzB,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,IAAI,KAAK,SAAS;gBAAE,SAAS;YACjC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,SAAS,CAAC,MAAc;QACtB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,OAAe;QACzB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAC3D,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5D,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,QAAQ,CAAC,OAAe;QACtB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED,0EAA0E;IAE1E,4EAA4E;IAC5E,OAAO,CAAC,GAAW,EAAE,MAAc,EAAE,YAA2B;QAC9D,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC;QACrD,IAAI,YAAY,KAAK,IAAI,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC;YAClD,MAAM,IAAI,6BAAc,CACtB,mBAAmB,GAAG,IAAI,KAAK,0BAA0B,YAAY,EAAE,EACvE,eAAe,EACf,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CACtC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IAEO,MAAM,CAAC,QAAQ,CAAC,MAAc,EAAE,OAAe;QACrD,OAAO,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,UAAU,CAAC,MAAc,EAAE,OAAe;QACxC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED,SAAS,CAAC,MAAc,EAAE,OAAe;QACvC,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,uEAAuE;IACvE,YAAY,CAAC,GAAW;QACtB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,KAAK;QACH,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACjD,EAAE,EAAE,CAAC,CAAC,MAAM;gBACZ,MAAM,EAAE,CAAC,CAAC,QAAQ;gBAClB,KAAK,EAAE,CAAC,CAAC,OAAO;gBAChB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,EAAqB;aACnD,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;CACF;AAnPD,sBAmPC"}

package/dist/cjs/cli.d.ts

@@ -0,0 +1,16 @@
+/**
+ * attenu-guard — command-line tool.
+ *
+ *   attenu-guard verify <log.jsonl | bundle.json> [--hs256-key HEX | --pubkey HEX] [--kid KID]
+ *
+ * A `.jsonl` audit log is checked for hash-chain integrity. A bundle (the
+ * output of `exportBundle`, or of the Python library's `export_bundle`) is
+ * checked for integrity, monotonicity (child ⊆ parent) and containment from the
+ * bundle alone; the signed anchor is verified when a key is given and reported
+ * as "not checked" otherwise.
+ *
+ * Exit codes: 0 = ok, 2 = a check failed, 1 = usage. The output lines match the
+ * Python CLI's, so either implementation can stand in for the other in a script.
+ */
+export declare function main(argv?: string[]): number;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cjs/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AA6EH,wBAAgB,IAAI,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,MAAM,CASnE"}