attenu-guard 0.1.0

package/dist/cjs/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../src/guard.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;;;AAGH,iDAA2D;AAC3D,yCAAmE;AACnE,yCAA0E;AAC1E,+CAAkF;AAClF,6CAAuF;AAGvF;;;GAGG;AACH,MAAa,eAAgB,SAAQ,KAAK;IACnB;IAArB,YAAqB,QAAkB;QACrC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QADP,aAAQ,GAAR,QAAQ,CAAU;QAErC,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AALD,0CAKC;AAED;;;;GAIG;AACH,MAAM,QAAQ;IACJ,CAAC,GAAG,CAAC,CAAC;IACd,GAAG;QACD,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QACZ,OAAO,IAAI,CAAC,CAAC,CAAC;IAChB,CAAC;CACF;AAiCD,MAAa,KAAK;IAEG;IACA;IACA;IACA;IACA;IACA;IANnB,YACmB,IAAU,EACV,KAAY,EACZ,KAAe,EACf,GAAa,EACb,MAAe,EACf,OAA4B;QAL5B,SAAI,GAAJ,IAAI,CAAM;QACV,UAAK,GAAL,KAAK,CAAO;QACZ,UAAK,GAAL,KAAK,CAAU;QACf,QAAG,GAAH,GAAG,CAAU;QACb,WAAM,GAAN,MAAM,CAAS;QACf,YAAO,GAAP,OAAO,CAAqB;IAC5C,CAAC;IAEJ,0EAA0E;IAE1E,2DAA2D;IAC3D,MAAM,CAAC,KAAK,CAAC,OAAe,EAAE,SAAoB,EAAE,UAAwB,EAAE;QAC5E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,gBAAK,CAAC,OAAO,EAAE;YAC/B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,CAAC;YAC/B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI,yBAAc,EAAE;SAC7C,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,mBAAQ,CAAC;YACzB,IAAI,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;YAC/B,KAAK,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE;SAChC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC;QACvE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE;YAC9B,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,IAAI,CAAC,MAAM;YACjB,KAAK,EAAE,OAAO;YACd,SAAS,EAAE,SAAS,CAAC,MAAM,EAAqB;SACjD,CAAC,CAAC;QACH,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,cAAc,IAAI,KAAK,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;IACtG,CAAC;IAED,0EAA0E;IAE1E,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;IAC1B,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;IAC5B,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;IAC7B,CAAC;IAED,2DAA2D;IAC3D,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;IAC3B,CAAC;IAED,qDAAqD;IACrD,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,mCAAmC;IACnC,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,qDAAqD;IACrD,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC5B,CAAC;IAED,8DAA8D;IAC9D,cAAc,CAAC,KAAY;QACzB,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAC7C,IAAI,IAAI,GAAqB,IAAI,CAAC,IAAI,CAAC;QACvC,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACrD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,QAAQ;QACN,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;YAClB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;YACtB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;SACzB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0EAA0E;IAE1E;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAe,EAAE,OAAkB,EAAE,IAAY;QACxD,IAAI,KAAW,CAAC;QAChB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,6BAAc,EAAE,CAAC;gBAChC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE;oBAC1B,QAAQ,EAAE,IAAI,CAAC,OAAO;oBACtB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;oBACxB,KAAK,EAAE,OAAO;oBACd,IAAI;oBACJ,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,MAAM,EAAE,CAAC,CAAC,MAAM;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CAAC,CAAC;QACV,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE;YACnB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;YACxB,IAAI,EAAE,KAAK,CAAC,MAAM;YAClB,KAAK,EAAE,OAAO;YACd,IAAI;YACJ,SAAS,EAAE,OAAO,CAAC,MAAM,EAAqB;YAC9C,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,EAAqB;SACrD,CAAC,CAAC;QACH,OAAO,IAAI,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACvF,CAAC;IAED;;;;;OAKG;IACH,aAAa,CAAC,OAAe,EAAE,QAAoB;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClE,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,qBAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1D,OAAO,qBAAQ,CAAC,IAAI,CAAC,IAAI,mBAAM,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3F,CAAC;IAEO,MAAM,CAAC,KAAa,EAAE,MAAmB;QAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;IAED,0EAA0E;IAE1E;;;;OAIG;IACK,QAAQ,CAAC,KAAa,EAAE,OAAgB,EAAE,OAAgB;QAChE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;QAExB,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,qBAAQ,CAAC,IAAI,CAClB,IAAI,mBAAM,CAAC,uBAAU,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,EAC1F,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,qBAAQ,CAAC,IAAI,CAClB,IAAI,mBAAM,CAAC,uBAAU,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,EACpE,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;YAC9C,OAAO,qBAAQ,CAAC,IAAI,CAClB,IAAI,mBAAM,CAAC,uBAAU,CAAC,OAAO,EAAE;gBAC7B,KAAK,EAAE,IAAI,CAAC,GAAG;gBACf,SAAS,EAAE,GAAG;gBACd,OAAO,EAAE,2BAA2B;aACrC,CAAC,EACF,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,uEAAuE;QACvE,qEAAqE;QACrE,yEAAyE;QACzE,iEAAiE;QACjE,0EAA0E;QAC1E,IAAI,IAAI,CAAC,MAAM,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ;iBAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,uBAAS,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAA,wBAAU,EAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC;iBAC1D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACrB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,uBAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC/D,OAAO,qBAAQ,CAAC,IAAI,CAClB,IAAI,mBAAM,CAAC,uBAAU,CAAC,SAAS,EAAE;oBAC/B,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;oBAC7B,OAAO,EACL,mCAAmC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;wBAC/E,2BAA2B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;iBACrE,CAAC,EACF,GAAG,CACJ,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,QAAQ,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YACtC,OAAO,IAAI,qBAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,MAAM,CAAC,gBAAgB,CAAC,WAAsC;QACpE,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,yBAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,KAAK,CACb,uBAAuB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,oBAAoB;gBACpE,GAAG,KAAK,CAAC,IAAI,CAAC,yBAAY,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClD,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,WAAW,CACjB,QAAkB,EAClB,KAAa,EACb,IAAmB,EACnB,OAAgB,EAChB,WAA0B;QAE1B,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QAClD,MAAM,MAAM,GAAgB;YAC1B,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;YACtB,KAAK;YACL,IAAI;YACJ,OAAO,EAAE,EAAE,GAAG,OAAO,EAAqB;SAC3C,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,mEAAmE;YACnE,qEAAqE;YACrE,8DAA8D;YAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9E,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;YAC1B,MAAM,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAoB,CAAC;YAC/E,wEAAwE;YACxE,0EAA0E;YAC1E,6DAA6D;YAC7D,MAAM,CAAC,GACL,WAAW;gBACX,CAAC,MAAM,KAAK,uBAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,wBAAW,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAClF,IAAI,CAAC,KAAK,IAAI;gBAAE,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,0EAA0E;IAElE,UAAU;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED;;;;OAIG;IACK,SAAS,CAAC,KAAa,EAAE,GAAY;QAC3C,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC;YACpC,IAAI,KAAK,IAAI,GAAG;gBAAE,SAAS,CAAC,yBAAyB;YACrD,MAAM,OAAO,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAClE,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5F,IAAI,OAAO;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,KAAa,EAAE,UAAwB,EAAE;QAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC;QAChD,KAAK,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,4CAA4C;QACjF,MAAM,GAAG,GAAY,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC;QACrE,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QAC1E,IACE,CAAC,QAAQ,CAAC,OAAO;YACjB,IAAI,CAAC,OAAO,KAAK,IAAI;YACrB,IAAI,CAAC,OAAO,CAAC,OAAO;YACpB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EACvC,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;YACjF,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;oBAClB,QAAQ,EAAE,IAAI,CAAC,OAAO;oBACtB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;oBACxB,MAAM,EAAE,eAAe;oBACvB,KAAK;oBACL,OAAO,EAAE,KAAK;oBACd,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;oBACvB,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,KAAa,EAAE,UAAwB,EAAE;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC7D,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,KAAa,EAAE,UAAwB,EAAE;QAClD,MAAM,GAAG,GAAY,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,sCAAsC;QAClE,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;;;;OASG;IACH,YAAY,CACV,MAAuB,EACvB,OAAO,GAAG,EAAE,EACZ,UAA+B,EAAE;QAEjC,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,MAAM,YAAY,mBAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,mBAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACtF,MAAM,QAAQ,GAAG,qBAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC;QAClC,IAAI,CAAC,WAAW,CACd,QAAQ,EACR,OAAO,CAAC,KAAK,IAAI,IAAI,IAAI,GAAG,EAC5B,IAAI,EACJ,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,EAC9B,OAAO,CAAC,WAAW,IAAI,IAAI,CAC5B,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,0EAA0E;IAE1E,2EAA2E;IAC3E,MAAM,CAAC,MAAsB;QAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACjE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,OAAe;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;YAClB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;YACxB,KAAK,EAAE,OAAO;YACd,OAAO;SACR,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,0EAA0E;IAE1E;;;OAGG;IACH,cAAc,CAAC,MAAa;QAC1B,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC;IAED,0EAA0E;IAE1E,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;CACF;AAtaD,sBAsaC"}

package/dist/cjs/index.d.ts

@@ -0,0 +1,52 @@
+/**
+ * attenu-guard — enforced authority attenuation for multi-agent AI systems.
+ *
+ * A sub-agent's authority can never exceed its parent's, chains have hard
+ * ceilings, and any subtree can be revoked in one call — enforced in code, with
+ * a hash-chained audit log anyone can verify offline.
+ *
+ *     import { Authority, Guard, RowLimit, EgressRank } from "attenu-guard";
+ *
+ *     const orchestrator = Guard.issue("orchestrator", new Authority({
+ *       scopes: ["crm.*", "mail.send"],
+ *       ceilings: [new RowLimit(100_000), new EgressRank("any")],
+ *       ttl: 3600,
+ *     }));
+ *
+ *     const summarizer = orchestrator.delegate("summarizer", new Authority({
+ *       scopes: ["crm.read"],
+ *       ceilings: [new RowLimit(5_000), new EgressRank("none")],
+ *       ttl: 900,
+ *     }), "summarise the Q3 pipeline");
+ *
+ *     const decision = summarizer.check("crm.read", { context: { rows: 4200 } });
+ *     if (!decision.allowed) console.log(decision.explain());
+ *
+ *     summarizer.enforce("crm.export", { context: { egress: "any" } }); // throws
+ *
+ * The ledger and the evidence bundle use the same wire format as the Python
+ * library, verified by cross-language fixtures — a bundle exported by either
+ * one verifies with the other.
+ */
+export { Authority, AuthorityError } from "./authority.js";
+export type { AuthorityInit, AuthorityWire } from "./authority.js";
+export { Guard, AuthorityDenied } from "./guard.js";
+export type { CheckOptions, IssueOptions, RecordDenialOptions } from "./guard.js";
+export { Decision, Reason, ReasonCode, Disposition, DISPOSITIONS } from "./reasons.js";
+export type { DispositionValue, ReasonCodeValue, ReasonInit } from "./reasons.js";
+export { Allow, CallLimit, Deny, EgressRank, Prefix, RowLimit, SpendCap, UnknownCeiling, ceilingFromWire, ctxFieldOf, describe, isMetered, registerCeiling, } from "./ceilings.js";
+export type { Ceiling, CeilingClass, Context } from "./ceilings.js";
+export { AuditLog, GENESIS, SCHEMA_VERSION, chainIdOf, hashEntry } from "./audit.js";
+export type { Anchor, AuditLogInit, LedgerEntry, Sink } from "./audit.js";
+export { Chain, ManualClock, MonotonicClock } from "./chain.js";
+export type { Clock, ChainInit, Node } from "./chain.js";
+export { StrikePolicy } from "./strikes.js";
+export type { StrikeMode, StrikePolicyInit } from "./strikes.js";
+export { EvidenceLeakError, LEDGER_FIELDS, anchorFor, delegationGraph, denials, exportBundle, parseBundle, redactionReport, verifyBundle, } from "./evidence.js";
+export type { Bundle, DelegationGraph, DenialRow, ExportOptions, GraphNode, RedactionReport, RedactionViolation, VerifyChecks, VerifyReport, } from "./evidence.js";
+export { Ed25519Signer, Ed25519Verifier, HS256TestSigner } from "./wire.js";
+export type { Signer } from "./wire.js";
+export { RawNumber, canonicalBytes, canonicalJson, compareCodePoints, parseJson, pyJsonDumps, pyNumber, pyString, sortedStrings, toPlain, } from "./canonical.js";
+export type { CJson, Json } from "./canonical.js";
+export declare const VERSION = "0.1.0";
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC3D,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEnE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACpD,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAElF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACvF,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAElF,OAAO,EACL,KAAK,EACL,SAAS,EACT,IAAI,EACJ,UAAU,EACV,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,cAAc,EACd,eAAe,EACf,UAAU,EACV,QAAQ,EACR,SAAS,EACT,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAEpE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACrF,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAE1E,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAChE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEzD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEjE,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,SAAS,EACT,eAAe,EACf,OAAO,EACP,YAAY,EACZ,WAAW,EACX,eAAe,EACf,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,MAAM,EACN,eAAe,EACf,SAAS,EACT,aAAa,EACb,SAAS,EACT,eAAe,EACf,kBAAkB,EAClB,YAAY,EACZ,YAAY,GACb,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5E,YAAY,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EACL,SAAS,EACT,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,SAAS,EACT,WAAW,EACX,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,OAAO,GACR,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAElD,eAAO,MAAM,OAAO,UAAU,CAAC"}

package/dist/cjs/index.js

@@ -0,0 +1,99 @@
+"use strict";
+/**
+ * attenu-guard — enforced authority attenuation for multi-agent AI systems.
+ *
+ * A sub-agent's authority can never exceed its parent's, chains have hard
+ * ceilings, and any subtree can be revoked in one call — enforced in code, with
+ * a hash-chained audit log anyone can verify offline.
+ *
+ *     import { Authority, Guard, RowLimit, EgressRank } from "attenu-guard";
+ *
+ *     const orchestrator = Guard.issue("orchestrator", new Authority({
+ *       scopes: ["crm.*", "mail.send"],
+ *       ceilings: [new RowLimit(100_000), new EgressRank("any")],
+ *       ttl: 3600,
+ *     }));
+ *
+ *     const summarizer = orchestrator.delegate("summarizer", new Authority({
+ *       scopes: ["crm.read"],
+ *       ceilings: [new RowLimit(5_000), new EgressRank("none")],
+ *       ttl: 900,
+ *     }), "summarise the Q3 pipeline");
+ *
+ *     const decision = summarizer.check("crm.read", { context: { rows: 4200 } });
+ *     if (!decision.allowed) console.log(decision.explain());
+ *
+ *     summarizer.enforce("crm.export", { context: { egress: "any" } }); // throws
+ *
+ * The ledger and the evidence bundle use the same wire format as the Python
+ * library, verified by cross-language fixtures — a bundle exported by either
+ * one verifies with the other.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pyNumber = exports.pyJsonDumps = exports.parseJson = exports.compareCodePoints = exports.canonicalJson = exports.canonicalBytes = exports.RawNumber = exports.HS256TestSigner = exports.Ed25519Verifier = exports.Ed25519Signer = exports.verifyBundle = exports.redactionReport = exports.parseBundle = exports.exportBundle = exports.denials = exports.delegationGraph = exports.anchorFor = exports.LEDGER_FIELDS = exports.EvidenceLeakError = exports.StrikePolicy = exports.MonotonicClock = exports.ManualClock = exports.Chain = exports.hashEntry = exports.chainIdOf = exports.SCHEMA_VERSION = exports.GENESIS = exports.AuditLog = exports.registerCeiling = exports.isMetered = exports.describe = exports.ctxFieldOf = exports.ceilingFromWire = exports.UnknownCeiling = exports.SpendCap = exports.RowLimit = exports.Prefix = exports.EgressRank = exports.Deny = exports.CallLimit = exports.Allow = exports.DISPOSITIONS = exports.Disposition = exports.ReasonCode = exports.Reason = exports.Decision = exports.AuthorityDenied = exports.Guard = exports.AuthorityError = exports.Authority = void 0;
+exports.VERSION = exports.toPlain = exports.sortedStrings = exports.pyString = void 0;
+var authority_js_1 = require("./authority.js");
+Object.defineProperty(exports, "Authority", { enumerable: true, get: function () { return authority_js_1.Authority; } });
+Object.defineProperty(exports, "AuthorityError", { enumerable: true, get: function () { return authority_js_1.AuthorityError; } });
+var guard_js_1 = require("./guard.js");
+Object.defineProperty(exports, "Guard", { enumerable: true, get: function () { return guard_js_1.Guard; } });
+Object.defineProperty(exports, "AuthorityDenied", { enumerable: true, get: function () { return guard_js_1.AuthorityDenied; } });
+var reasons_js_1 = require("./reasons.js");
+Object.defineProperty(exports, "Decision", { enumerable: true, get: function () { return reasons_js_1.Decision; } });
+Object.defineProperty(exports, "Reason", { enumerable: true, get: function () { return reasons_js_1.Reason; } });
+Object.defineProperty(exports, "ReasonCode", { enumerable: true, get: function () { return reasons_js_1.ReasonCode; } });
+Object.defineProperty(exports, "Disposition", { enumerable: true, get: function () { return reasons_js_1.Disposition; } });
+Object.defineProperty(exports, "DISPOSITIONS", { enumerable: true, get: function () { return reasons_js_1.DISPOSITIONS; } });
+var ceilings_js_1 = require("./ceilings.js");
+Object.defineProperty(exports, "Allow", { enumerable: true, get: function () { return ceilings_js_1.Allow; } });
+Object.defineProperty(exports, "CallLimit", { enumerable: true, get: function () { return ceilings_js_1.CallLimit; } });
+Object.defineProperty(exports, "Deny", { enumerable: true, get: function () { return ceilings_js_1.Deny; } });
+Object.defineProperty(exports, "EgressRank", { enumerable: true, get: function () { return ceilings_js_1.EgressRank; } });
+Object.defineProperty(exports, "Prefix", { enumerable: true, get: function () { return ceilings_js_1.Prefix; } });
+Object.defineProperty(exports, "RowLimit", { enumerable: true, get: function () { return ceilings_js_1.RowLimit; } });
+Object.defineProperty(exports, "SpendCap", { enumerable: true, get: function () { return ceilings_js_1.SpendCap; } });
+Object.defineProperty(exports, "UnknownCeiling", { enumerable: true, get: function () { return ceilings_js_1.UnknownCeiling; } });
+Object.defineProperty(exports, "ceilingFromWire", { enumerable: true, get: function () { return ceilings_js_1.ceilingFromWire; } });
+Object.defineProperty(exports, "ctxFieldOf", { enumerable: true, get: function () { return ceilings_js_1.ctxFieldOf; } });
+Object.defineProperty(exports, "describe", { enumerable: true, get: function () { return ceilings_js_1.describe; } });
+Object.defineProperty(exports, "isMetered", { enumerable: true, get: function () { return ceilings_js_1.isMetered; } });
+Object.defineProperty(exports, "registerCeiling", { enumerable: true, get: function () { return ceilings_js_1.registerCeiling; } });
+var audit_js_1 = require("./audit.js");
+Object.defineProperty(exports, "AuditLog", { enumerable: true, get: function () { return audit_js_1.AuditLog; } });
+Object.defineProperty(exports, "GENESIS", { enumerable: true, get: function () { return audit_js_1.GENESIS; } });
+Object.defineProperty(exports, "SCHEMA_VERSION", { enumerable: true, get: function () { return audit_js_1.SCHEMA_VERSION; } });
+Object.defineProperty(exports, "chainIdOf", { enumerable: true, get: function () { return audit_js_1.chainIdOf; } });
+Object.defineProperty(exports, "hashEntry", { enumerable: true, get: function () { return audit_js_1.hashEntry; } });
+var chain_js_1 = require("./chain.js");
+Object.defineProperty(exports, "Chain", { enumerable: true, get: function () { return chain_js_1.Chain; } });
+Object.defineProperty(exports, "ManualClock", { enumerable: true, get: function () { return chain_js_1.ManualClock; } });
+Object.defineProperty(exports, "MonotonicClock", { enumerable: true, get: function () { return chain_js_1.MonotonicClock; } });
+var strikes_js_1 = require("./strikes.js");
+Object.defineProperty(exports, "StrikePolicy", { enumerable: true, get: function () { return strikes_js_1.StrikePolicy; } });
+var evidence_js_1 = require("./evidence.js");
+Object.defineProperty(exports, "EvidenceLeakError", { enumerable: true, get: function () { return evidence_js_1.EvidenceLeakError; } });
+Object.defineProperty(exports, "LEDGER_FIELDS", { enumerable: true, get: function () { return evidence_js_1.LEDGER_FIELDS; } });
+Object.defineProperty(exports, "anchorFor", { enumerable: true, get: function () { return evidence_js_1.anchorFor; } });
+Object.defineProperty(exports, "delegationGraph", { enumerable: true, get: function () { return evidence_js_1.delegationGraph; } });
+Object.defineProperty(exports, "denials", { enumerable: true, get: function () { return evidence_js_1.denials; } });
+Object.defineProperty(exports, "exportBundle", { enumerable: true, get: function () { return evidence_js_1.exportBundle; } });
+Object.defineProperty(exports, "parseBundle", { enumerable: true, get: function () { return evidence_js_1.parseBundle; } });
+Object.defineProperty(exports, "redactionReport", { enumerable: true, get: function () { return evidence_js_1.redactionReport; } });
+Object.defineProperty(exports, "verifyBundle", { enumerable: true, get: function () { return evidence_js_1.verifyBundle; } });
+var wire_js_1 = require("./wire.js");
+Object.defineProperty(exports, "Ed25519Signer", { enumerable: true, get: function () { return wire_js_1.Ed25519Signer; } });
+Object.defineProperty(exports, "Ed25519Verifier", { enumerable: true, get: function () { return wire_js_1.Ed25519Verifier; } });
+Object.defineProperty(exports, "HS256TestSigner", { enumerable: true, get: function () { return wire_js_1.HS256TestSigner; } });
+var canonical_js_1 = require("./canonical.js");
+Object.defineProperty(exports, "RawNumber", { enumerable: true, get: function () { return canonical_js_1.RawNumber; } });
+Object.defineProperty(exports, "canonicalBytes", { enumerable: true, get: function () { return canonical_js_1.canonicalBytes; } });
+Object.defineProperty(exports, "canonicalJson", { enumerable: true, get: function () { return canonical_js_1.canonicalJson; } });
+Object.defineProperty(exports, "compareCodePoints", { enumerable: true, get: function () { return canonical_js_1.compareCodePoints; } });
+Object.defineProperty(exports, "parseJson", { enumerable: true, get: function () { return canonical_js_1.parseJson; } });
+Object.defineProperty(exports, "pyJsonDumps", { enumerable: true, get: function () { return canonical_js_1.pyJsonDumps; } });
+Object.defineProperty(exports, "pyNumber", { enumerable: true, get: function () { return canonical_js_1.pyNumber; } });
+Object.defineProperty(exports, "pyString", { enumerable: true, get: function () { return canonical_js_1.pyString; } });
+Object.defineProperty(exports, "sortedStrings", { enumerable: true, get: function () { return canonical_js_1.sortedStrings; } });
+Object.defineProperty(exports, "toPlain", { enumerable: true, get: function () { return canonical_js_1.toPlain; } });
+exports.VERSION = "0.1.0";
+//# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;;;;AAEH,+CAA2D;AAAlD,yGAAA,SAAS,OAAA;AAAE,8GAAA,cAAc,OAAA;AAGlC,uCAAoD;AAA3C,iGAAA,KAAK,OAAA;AAAE,2GAAA,eAAe,OAAA;AAG/B,2CAAuF;AAA9E,sGAAA,QAAQ,OAAA;AAAE,oGAAA,MAAM,OAAA;AAAE,wGAAA,UAAU,OAAA;AAAE,yGAAA,WAAW,OAAA;AAAE,0GAAA,YAAY,OAAA;AAGhE,6CAcuB;AAbrB,oGAAA,KAAK,OAAA;AACL,wGAAA,SAAS,OAAA;AACT,mGAAA,IAAI,OAAA;AACJ,yGAAA,UAAU,OAAA;AACV,qGAAA,MAAM,OAAA;AACN,uGAAA,QAAQ,OAAA;AACR,uGAAA,QAAQ,OAAA;AACR,6GAAA,cAAc,OAAA;AACd,8GAAA,eAAe,OAAA;AACf,yGAAA,UAAU,OAAA;AACV,uGAAA,QAAQ,OAAA;AACR,wGAAA,SAAS,OAAA;AACT,8GAAA,eAAe,OAAA;AAIjB,uCAAqF;AAA5E,oGAAA,QAAQ,OAAA;AAAE,mGAAA,OAAO,OAAA;AAAE,0GAAA,cAAc,OAAA;AAAE,qGAAA,SAAS,OAAA;AAAE,qGAAA,SAAS,OAAA;AAGhE,uCAAgE;AAAvD,iGAAA,KAAK,OAAA;AAAE,uGAAA,WAAW,OAAA;AAAE,0GAAA,cAAc,OAAA;AAG3C,2CAA4C;AAAnC,0GAAA,YAAY,OAAA;AAGrB,6CAUuB;AATrB,gHAAA,iBAAiB,OAAA;AACjB,4GAAA,aAAa,OAAA;AACb,wGAAA,SAAS,OAAA;AACT,8GAAA,eAAe,OAAA;AACf,sGAAA,OAAO,OAAA;AACP,2GAAA,YAAY,OAAA;AACZ,0GAAA,WAAW,OAAA;AACX,8GAAA,eAAe,OAAA;AACf,2GAAA,YAAY,OAAA;AAcd,qCAA4E;AAAnE,wGAAA,aAAa,OAAA;AAAE,0GAAA,eAAe,OAAA;AAAE,0GAAA,eAAe,OAAA;AAGxD,+CAWwB;AAVtB,yGAAA,SAAS,OAAA;AACT,8GAAA,cAAc,OAAA;AACd,6GAAA,aAAa,OAAA;AACb,iHAAA,iBAAiB,OAAA;AACjB,yGAAA,SAAS,OAAA;AACT,2GAAA,WAAW,OAAA;AACX,wGAAA,QAAQ,OAAA;AACR,wGAAA,QAAQ,OAAA;AACR,6GAAA,aAAa,OAAA;AACb,uGAAA,OAAO,OAAA;AAII,QAAA,OAAO,GAAG,OAAO,CAAC"}

package/dist/cjs/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

package/dist/cjs/reasons.d.ts

@@ -0,0 +1,93 @@
+/**
+ * reasons.ts — the machine-readable outcome vocabulary for authorization decisions.
+ *
+ * Every policy evaluation produces a `Decision` carrying zero or more `Reason`s.
+ * A denial without a reason is a bug, so every deny path attaches at least one
+ * `Reason` with a stable code from `ReasonCode`.
+ *
+ * The code strings — not the classes — are the contract. They are what the audit
+ * ledger stores and what survives a process or language boundary, so they match
+ * the Python library's `attenu_guard.reasons` value for value.
+ */
+import type { Json } from "./canonical.js";
+/**
+ * Stable string constants for machine-readable denial reasons. Never rename an
+ * existing value; add new ones instead.
+ */
+export declare const ReasonCode: {
+    readonly SCOPE_NOT_GRANTED: "scope_not_granted";
+    readonly CEILING_EXCEEDED: "ceiling_exceeded";
+    readonly EXPIRED: "expired";
+    readonly REVOKED: "revoked";
+    readonly INTEGRITY: "integrity";
+    readonly DEPTH_EXCEEDED: "depth_exceeded";
+    readonly FANOUT_EXCEEDED: "fanout_exceeded";
+    readonly UNMETERED: "unmetered";
+    /** Fail-closed outcome for a ceiling type this build does not recognise. */
+    readonly UNKNOWN_CONSTRAINT: "unknown_constraint";
+    readonly CHAIN_REVOKED: "chain_revoked";
+    readonly AGENT_BANNED: "agent_banned";
+    readonly TTL_EXPIRED: "ttl_expired";
+    readonly MAX_DEPTH: "max_depth";
+    readonly MAX_FANOUT: "max_fanout";
+    readonly CHAIN_CEILING: "chain_ceiling";
+    /** The principal holds no authority at all in this chain. */
+    readonly NO_AUTHORITY: "no_authority";
+};
+export type ReasonCodeValue = (typeof ReasonCode)[keyof typeof ReasonCode];
+/**
+ * WHY a denied scope was not in the node's authority — the ledger's answer to
+ * "held, or over-reach?". The library records what its caller states; it never
+ * derives. Never rename a value.
+ */
+export declare const Disposition: {
+    /** Known, curated, waiting on a human decision. */
+    readonly HELD_PENDING_GRANT: "held_pending_grant";
+    /** Resolvable only to a tier-2 heuristic that is never granted. */
+    readonly WITHHELD_TIER2: "withheld_tier2";
+    /** No authority known for this tool at all. */
+    readonly UNRESOLVED: "unresolved";
+    /** Resolved and grantable, but not held by THIS node — real over-reach. */
+    readonly OUT_OF_AUTHORITY: "out_of_authority";
+};
+export type DispositionValue = (typeof Disposition)[keyof typeof Disposition];
+export declare const DISPOSITIONS: ReadonlySet<string>;
+export interface ReasonInit {
+    /** Which ceiling or dimension, e.g. "max_rows". */
+    constraint?: string | null;
+    /** The bound that applied. */
+    limit?: Json;
+    /** The value or action that violated it. */
+    requested?: Json;
+    /** Free-text, human-readable detail. */
+    message?: string;
+}
+/** One specific cause of a denial. */
+export declare class Reason {
+    readonly code: string;
+    readonly constraint: string | null;
+    readonly limit: Json;
+    readonly requested: Json;
+    readonly message: string;
+    constructor(code: string, init?: ReasonInit);
+    toDict(): Record<string, Json>;
+    toString(): string;
+}
+/**
+ * The result of a policy evaluation. Truthiness lives on `.allowed` — JavaScript
+ * has no `__bool__`, so call sites read `if (decision.allowed)`.
+ *
+ * `determiningNode` names the chain node whose state was decisive.
+ */
+export declare class Decision {
+    readonly allowed: boolean;
+    readonly reasons: readonly Reason[];
+    readonly determiningNode: string | null;
+    constructor(allowed: boolean, reasons?: readonly Reason[], determiningNode?: string | null);
+    /** A single human-readable line — for logs, CLIs and error messages. */
+    explain(): string;
+    toDict(): Record<string, Json>;
+    static allow(node?: string | null): Decision;
+    static deny(reasons: Reason | readonly Reason[], node?: string | null): Decision;
+}
+//# sourceMappingURL=reasons.d.ts.map

package/dist/cjs/reasons.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reasons.d.ts","sourceRoot":"","sources":["../../src/reasons.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAE3C;;;GAGG;AACH,eAAO,MAAM,UAAU;;;;;;;;;IASrB,4EAA4E;;;;;;;;IAU5E,6DAA6D;;CAErD,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,WAAW;IACtB,mDAAmD;;IAEnD,mEAAmE;;IAEnE,+CAA+C;;IAE/C,2EAA2E;;CAEnE,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC;AAE9E,eAAO,MAAM,YAAY,EAAE,WAAW,CAAC,MAAM,CAAuC,CAAC;AAErF,MAAM,WAAW,UAAU;IACzB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,8BAA8B;IAC9B,KAAK,CAAC,EAAE,IAAI,CAAC;IACb,4CAA4C;IAC5C,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,sCAAsC;AACtC,qBAAa,MAAM;IACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEb,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,UAAe;IAQ/C,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;IAU9B,QAAQ,IAAI,MAAM;CAQnB;AAQD;;;;;GAKG;AACH,qBAAa,QAAQ;IAEjB,QAAQ,CAAC,OAAO,EAAE,OAAO;IACzB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE;IACnC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI;gBAF9B,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,SAAS,MAAM,EAAO,EAC/B,eAAe,GAAE,MAAM,GAAG,IAAW;IAGhD,wEAAwE;IACxE,OAAO,IAAI,MAAM;IAMjB,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;IAQ9B,MAAM,CAAC,KAAK,CAAC,IAAI,GAAE,MAAM,GAAG,IAAW,GAAG,QAAQ;IAIlD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EAAE,IAAI,GAAE,MAAM,GAAG,IAAW,GAAG,QAAQ;CAIvF"}

package/dist/cjs/reasons.js

@@ -0,0 +1,139 @@
+"use strict";
+/**
+ * reasons.ts — the machine-readable outcome vocabulary for authorization decisions.
+ *
+ * Every policy evaluation produces a `Decision` carrying zero or more `Reason`s.
+ * A denial without a reason is a bug, so every deny path attaches at least one
+ * `Reason` with a stable code from `ReasonCode`.
+ *
+ * The code strings — not the classes — are the contract. They are what the audit
+ * ledger stores and what survives a process or language boundary, so they match
+ * the Python library's `attenu_guard.reasons` value for value.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Decision = exports.Reason = exports.DISPOSITIONS = exports.Disposition = exports.ReasonCode = void 0;
+/**
+ * Stable string constants for machine-readable denial reasons. Never rename an
+ * existing value; add new ones instead.
+ */
+exports.ReasonCode = {
+    SCOPE_NOT_GRANTED: "scope_not_granted",
+    CEILING_EXCEEDED: "ceiling_exceeded",
+    EXPIRED: "expired",
+    REVOKED: "revoked",
+    INTEGRITY: "integrity",
+    DEPTH_EXCEEDED: "depth_exceeded",
+    FANOUT_EXCEEDED: "fanout_exceeded",
+    UNMETERED: "unmetered",
+    /** Fail-closed outcome for a ceiling type this build does not recognise. */
+    UNKNOWN_CONSTRAINT: "unknown_constraint",
+    // Structural failures — the reason strings an `AuthorityError` carries when a
+    // DELEGATION is refused. These are the published v0.1 audit vocabulary.
+    CHAIN_REVOKED: "chain_revoked",
+    AGENT_BANNED: "agent_banned",
+    TTL_EXPIRED: "ttl_expired",
+    MAX_DEPTH: "max_depth",
+    MAX_FANOUT: "max_fanout",
+    CHAIN_CEILING: "chain_ceiling",
+    /** The principal holds no authority at all in this chain. */
+    NO_AUTHORITY: "no_authority",
+};
+/**
+ * WHY a denied scope was not in the node's authority — the ledger's answer to
+ * "held, or over-reach?". The library records what its caller states; it never
+ * derives. Never rename a value.
+ */
+exports.Disposition = {
+    /** Known, curated, waiting on a human decision. */
+    HELD_PENDING_GRANT: "held_pending_grant",
+    /** Resolvable only to a tier-2 heuristic that is never granted. */
+    WITHHELD_TIER2: "withheld_tier2",
+    /** No authority known for this tool at all. */
+    UNRESOLVED: "unresolved",
+    /** Resolved and grantable, but not held by THIS node — real over-reach. */
+    OUT_OF_AUTHORITY: "out_of_authority",
+};
+exports.DISPOSITIONS = new Set(Object.values(exports.Disposition));
+/** One specific cause of a denial. */
+class Reason {
+    code;
+    constraint;
+    limit;
+    requested;
+    message;
+    constructor(code, init = {}) {
+        this.code = code;
+        this.constraint = init.constraint ?? null;
+        this.limit = init.limit ?? null;
+        this.requested = init.requested ?? null;
+        this.message = init.message ?? "";
+    }
+    toDict() {
+        return {
+            code: this.code,
+            constraint: this.constraint,
+            limit: this.limit,
+            requested: this.requested,
+            message: this.message,
+        };
+    }
+    toString() {
+        const bits = [this.code];
+        if (this.constraint !== null)
+            bits.push(`constraint=${this.constraint}`);
+        if (this.limit !== null)
+            bits.push(`limit=${renderValue(this.limit)}`);
+        if (this.requested !== null)
+            bits.push(`requested=${renderValue(this.requested)}`);
+        const line = bits.join(" ");
+        return this.message ? `${line}: ${this.message}` : line;
+    }
+}
+exports.Reason = Reason;
+function renderValue(value) {
+    if (Array.isArray(value))
+        return `[${value.map(renderValue).join(", ")}]`;
+    if (value !== null && typeof value === "object")
+        return JSON.stringify(value);
+    return String(value);
+}
+/**
+ * The result of a policy evaluation. Truthiness lives on `.allowed` — JavaScript
+ * has no `__bool__`, so call sites read `if (decision.allowed)`.
+ *
+ * `determiningNode` names the chain node whose state was decisive.
+ */
+class Decision {
+    allowed;
+    reasons;
+    determiningNode;
+    constructor(allowed, reasons = [], determiningNode = null) {
+        this.allowed = allowed;
+        this.reasons = reasons;
+        this.determiningNode = determiningNode;
+    }
+    /** A single human-readable line — for logs, CLIs and error messages. */
+    explain() {
+        if (this.allowed)
+            return "allowed";
+        if (this.reasons.length === 0)
+            return "denied";
+        return "denied: " + this.reasons.map((r) => r.toString()).join("; ");
+    }
+    toDict() {
+        return {
+            allowed: this.allowed,
+            reasons: this.reasons.map((r) => r.toDict()),
+            determining_node: this.determiningNode,
+        };
+    }
+    static allow(node = null) {
+        return new Decision(true, [], node);
+    }
+    static deny(reasons, node = null) {
+        const list = reasons instanceof Reason ? [reasons] : Array.from(reasons);
+        return new Decision(false, list, node);
+    }
+}
+exports.Decision = Decision;
+//# sourceMappingURL=reasons.js.map

package/dist/cjs/reasons.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reasons.js","sourceRoot":"","sources":["../../src/reasons.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAIH;;;GAGG;AACU,QAAA,UAAU,GAAG;IACxB,iBAAiB,EAAE,mBAAmB;IACtC,gBAAgB,EAAE,kBAAkB;IACpC,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,WAAW;IACtB,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,iBAAiB;IAClC,SAAS,EAAE,WAAW;IACtB,4EAA4E;IAC5E,kBAAkB,EAAE,oBAAoB;IACxC,8EAA8E;IAC9E,wEAAwE;IACxE,aAAa,EAAE,eAAe;IAC9B,YAAY,EAAE,cAAc;IAC5B,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE,WAAW;IACtB,UAAU,EAAE,YAAY;IACxB,aAAa,EAAE,eAAe;IAC9B,6DAA6D;IAC7D,YAAY,EAAE,cAAc;CACpB,CAAC;AAIX;;;;GAIG;AACU,QAAA,WAAW,GAAG;IACzB,mDAAmD;IACnD,kBAAkB,EAAE,oBAAoB;IACxC,mEAAmE;IACnE,cAAc,EAAE,gBAAgB;IAChC,+CAA+C;IAC/C,UAAU,EAAE,YAAY;IACxB,2EAA2E;IAC3E,gBAAgB,EAAE,kBAAkB;CAC5B,CAAC;AAIE,QAAA,YAAY,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAW,CAAC,CAAC,CAAC;AAarF,sCAAsC;AACtC,MAAa,MAAM;IACR,IAAI,CAAS;IACb,UAAU,CAAgB;IAC1B,KAAK,CAAO;IACZ,SAAS,CAAO;IAChB,OAAO,CAAS;IAEzB,YAAY,IAAY,EAAE,OAAmB,EAAE;QAC7C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;QAChC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IACpC,CAAC;IAED,MAAM;QACJ,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;IACJ,CAAC;IAED,QAAQ;QACN,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACzE,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvE,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,aAAa,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,CAAC;CACF;AAjCD,wBAiCC;AAED,SAAS,WAAW,CAAC,KAAW;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IAC1E,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAa,QAAQ;IAER;IACA;IACA;IAHX,YACW,OAAgB,EAChB,UAA6B,EAAE,EAC/B,kBAAiC,IAAI;QAFrC,YAAO,GAAP,OAAO,CAAS;QAChB,YAAO,GAAP,OAAO,CAAwB;QAC/B,oBAAe,GAAf,eAAe,CAAsB;IAC7C,CAAC;IAEJ,wEAAwE;IACxE,OAAO;QACL,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QACnC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC/C,OAAO,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;IAED,MAAM;QACJ,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YAC5C,gBAAgB,EAAE,IAAI,CAAC,eAAe;SACvC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,OAAsB,IAAI;QACrC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,OAAmC,EAAE,OAAsB,IAAI;QACzE,MAAM,IAAI,GAAG,OAAO,YAAY,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzE,OAAO,IAAI,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;CACF;AA9BD,4BA8BC"}

package/dist/cjs/strikes.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Strike policy — revoke a node after repeated denials.
+ *
+ * A denied agent that keeps probing the same wall is either broken or hostile.
+ * After N strikes the node is cascade-revoked and the parent can see why on the
+ * ledger. Off unless a policy is attached.
+ */
+export type StrikeMode = "same_scope" | "total";
+export interface StrikePolicyInit {
+    /** A policy is only attached when wanted; `false` disarms without detaching. */
+    enabled?: boolean;
+    /** Strikes before revocation. */
+    n?: number;
+    /** `same_scope`: N denials of ONE scope. `total`: N denials across any scope. */
+    mode?: StrikeMode;
+}
+export declare class StrikePolicy {
+    readonly enabled: boolean;
+    readonly n: number;
+    readonly mode: StrikeMode;
+    constructor(init?: StrikePolicyInit);
+    key(nodeId: string, scope: string): string;
+}
+//# sourceMappingURL=strikes.d.ts.map

package/dist/cjs/strikes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strikes.d.ts","sourceRoot":"","sources":["../../src/strikes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,OAAO,CAAC;AAEhD,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iCAAiC;IACjC,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,iFAAiF;IACjF,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,qBAAa,YAAY;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;gBAEd,IAAI,GAAE,gBAAqB;IAUvC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;CAG3C"}

package/dist/cjs/strikes.js

@@ -0,0 +1,30 @@
+"use strict";
+/**
+ * Strike policy — revoke a node after repeated denials.
+ *
+ * A denied agent that keeps probing the same wall is either broken or hostile.
+ * After N strikes the node is cascade-revoked and the parent can see why on the
+ * ledger. Off unless a policy is attached.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StrikePolicy = void 0;
+class StrikePolicy {
+    enabled;
+    n;
+    mode;
+    constructor(init = {}) {
+        this.enabled = init.enabled ?? true;
+        this.n = init.n ?? 3;
+        this.mode = init.mode ?? "same_scope";
+        if (this.mode !== "same_scope" && this.mode !== "total") {
+            throw new Error("mode must be 'same_scope' or 'total'");
+        }
+        if (this.n < 1)
+            throw new Error("n must be >= 1");
+    }
+    key(nodeId, scope) {
+        return this.mode === "same_scope" ? `${nodeId} ${scope}` : `${nodeId} *`;
+    }
+}
+exports.StrikePolicy = StrikePolicy;
+//# sourceMappingURL=strikes.js.map

package/dist/cjs/strikes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strikes.js","sourceRoot":"","sources":["../../src/strikes.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAaH,MAAa,YAAY;IACd,OAAO,CAAU;IACjB,CAAC,CAAS;IACV,IAAI,CAAa;IAE1B,YAAY,OAAyB,EAAE;QACrC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;QACpC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,YAAY,CAAC;QACtC,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACpD,CAAC;IAED,GAAG,CAAC,MAAc,EAAE,KAAa;QAC/B,OAAO,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC;IAC3E,CAAC;CACF;AAlBD,oCAkBC"}

package/dist/cjs/wire.d.ts

@@ -0,0 +1,83 @@
+/**
+ * wire.ts — the signing and verification backends.
+ *
+ * Anchors and delegation tokens are signed over canonical JSON bytes. Two
+ * backends ship, matching the Python library's `attenu_guard.wire`:
+ *
+ *   `HS256TestSigner`  stdlib HMAC-SHA256, for tests, examples and local dev;
+ *   `Ed25519Signer`    the production signer the Internet-Draft requires, with
+ *                      `Ed25519Verifier` for anyone holding only the public half.
+ *
+ * Everything here is built on Node's own `node:crypto`, so the package keeps
+ * zero runtime dependencies. Ed25519 keys are wrapped in the fixed DER prefixes
+ * below rather than pulled from a library.
+ */
+import { type KeyObject } from "node:crypto";
+/**
+ * The pluggable signing and verification backend. `alg` is the JOSE algorithm
+ * identifier that goes in a token header.
+ */
+export interface Signer {
+    readonly alg: string;
+    readonly kid?: string | null;
+    sign(signingInput: Buffer): Buffer;
+    verify(signingInput: Buffer, sig: Buffer, keyId?: string | null): boolean;
+}
+/**
+ * stdlib HMAC-SHA256 signer — the default for tests, examples and local dev,
+ * because it needs no key management at all.
+ *
+ * NOT FOR PRODUCTION. HMAC is symmetric: `sign` and `verify` use the identical
+ * secret, so anyone able to verify a bundle is also able to forge one. That
+ * precludes the property the draft is built around — public offline
+ * verification at an untrusted enforcement point — because every verifier would
+ * have to hold the minting secret. Use `Ed25519Signer` in production; this
+ * class exists so the wire format and the interop fixtures can be exercised
+ * with no key distribution.
+ */
+export declare class HS256TestSigner implements Signer {
+    private readonly secret;
+    readonly alg = "HS256";
+    readonly kid: string;
+    constructor(secret: Buffer, kid?: string);
+    sign(signingInput: Buffer): Buffer;
+    verify(signingInput: Buffer, sig: Buffer, _keyId?: string | null): boolean;
+}
+/**
+ * The production signer the draft requires ("Implementations MUST support
+ * Ed25519"); JOSE alg "EdDSA". Public-key, so — unlike `HS256TestSigner` — a
+ * verifier never needs the signing secret, which is exactly what offline
+ * verification at an untrusted edge depends on.
+ */
+export declare class Ed25519Signer implements Signer {
+    readonly alg = "EdDSA";
+    readonly kid: string;
+    private readonly privateKey;
+    private readonly publicKey;
+    constructor(privateKey?: KeyObject, kid?: string);
+    /** A signer wrapping a freshly generated keypair. */
+    static generate(kid?: string): Ed25519Signer;
+    /** Rebuild a signer from the 32 raw bytes `privateBytesRaw` produced. */
+    static fromPrivateBytes(raw: Buffer, kid?: string): Ed25519Signer;
+    sign(signingInput: Buffer): Buffer;
+    verify(signingInput: Buffer, sig: Buffer, _keyId?: string | null): boolean;
+    /** The 32-byte raw public key — a trust anchor to distribute out of band. */
+    publicBytesRaw(): Buffer;
+    /** The 32-byte raw private key — what a key FILE stores, never a repo. */
+    privateBytesRaw(): Buffer;
+}
+/**
+ * The public-key-only counterpart of `Ed25519Signer` — what a console, an
+ * auditor or an ingest server holds. It verifies anchors signed by the matching
+ * private key and can never sign: `sign` throws.
+ */
+export declare class Ed25519Verifier implements Signer {
+    readonly alg = "EdDSA";
+    readonly kid: string;
+    private readonly publicKey;
+    constructor(publicBytesRaw: Buffer, kid?: string);
+    sign(_signingInput: Buffer): Buffer;
+    verify(signingInput: Buffer, sig: Buffer, _keyId?: string | null): boolean;
+    publicBytesRaw(): Buffer;
+}
+//# sourceMappingURL=wire.d.ts.map

package/dist/cjs/wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../../src/wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAQL,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AAErB;;;GAGG;AACH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC;CAC3E;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,eAAgB,YAAW,MAAM;IAK1C,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJzB,QAAQ,CAAC,GAAG,WAAW;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;gBAGF,MAAM,EAAE,MAAM,EAC/B,GAAG,SAAS;IAKd,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAIlC,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO;CAO3E;AAwCD;;;;;GAKG;AACH,qBAAa,aAAc,YAAW,MAAM;IAC1C,QAAQ,CAAC,GAAG,WAAW;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAY;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;gBAE1B,UAAU,CAAC,EAAE,SAAS,EAAE,GAAG,SAAc;IAYrD,qDAAqD;IACrD,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAc,GAAG,aAAa;IAIjD,yEAAyE;IACzE,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,SAAc,GAAG,aAAa;IAItE,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAIlC,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO;IAQ1E,6EAA6E;IAC7E,cAAc,IAAI,MAAM;IAIxB,0EAA0E;IAC1E,eAAe,IAAI,MAAM;CAG1B;AAED;;;;GAIG;AACH,qBAAa,eAAgB,YAAW,MAAM;IAC5C,QAAQ,CAAC,GAAG,WAAW;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;gBAE1B,cAAc,EAAE,MAAM,EAAE,GAAG,SAAc;IAKrD,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM;IAInC,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO;IAQ1E,cAAc,IAAI,MAAM;CAGzB"}