open-multi-agent-kit 0.90.7 → 0.90.9

package/dist/guardrails/evidence-receipt-store.js

@@ -0,0 +1,446 @@
+import { randomUUID } from "node:crypto";
+import { chmodSync, closeSync, constants as fsConstants, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, rmdirSync, unlinkSync, writeSync, } from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { isSafeEvidenceReceiptId, parseEvidenceReceipt, serializeEvidenceReceipt, validateEvidenceReceipt, } from "./evidence-receipt.js";
+function errorCode(error) {
+    return typeof error === "object" && error !== null && "code" in error
+        ? String(error.code)
+        : undefined;
+}
+const UNSUPPORTED_DIRECTORY_FSYNC_CODES = new Set([
+    "EBADF",
+    "EINVAL",
+    "EISDIR",
+    "ENOSYS",
+    "ENOTSUP",
+]);
+function classifiedDirectoryFsyncError(path, error) {
+    const code = errorCode(error);
+    if (code === undefined || !UNSUPPORTED_DIRECTORY_FSYNC_CODES.has(code))
+        return error;
+    return new Error(`receipt store strict durability unavailable: directory fsync unsupported for ${path} (${code})`, {
+        cause: error,
+    });
+}
+function fsyncDirectory(path) {
+    let fd;
+    let failure;
+    try {
+        fd = openSync(path, fsConstants.O_RDONLY | (fsConstants.O_DIRECTORY ?? 0) | (fsConstants.O_NOFOLLOW ?? 0));
+        fsyncSync(fd);
+    }
+    catch (error) {
+        failure = classifiedDirectoryFsyncError(path, error);
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                closeSync(fd);
+            }
+            catch (error) {
+                if (failure === undefined)
+                    failure = error;
+            }
+        }
+    }
+    if (failure !== undefined)
+        throw failure;
+}
+function writeAll(fd, bytes) {
+    let offset = 0;
+    while (offset < bytes.byteLength) {
+        const written = writeSync(fd, bytes, offset, bytes.byteLength - offset);
+        if (written <= 0)
+            throw new Error("receipt store could not complete the file write");
+        offset += written;
+    }
+}
+function identityFrom(stat) {
+    return { dev: stat.dev, ino: stat.ino };
+}
+function hasFileIdentity(identity) {
+    return identity.dev !== 0 || identity.ino !== 0;
+}
+function matchesFileIdentity(expected, actual) {
+    const actualIdentity = identityFrom(actual);
+    const expectedHasIdentity = hasFileIdentity(expected);
+    const actualHasIdentity = hasFileIdentity(actualIdentity);
+    return ((!expectedHasIdentity && !actualHasIdentity) ||
+        (expectedHasIdentity &&
+            actualHasIdentity &&
+            expected.dev === actualIdentity.dev &&
+            expected.ino === actualIdentity.ino));
+}
+function missingDirectoryPaths(path) {
+    const missing = [];
+    let current = path;
+    while (true) {
+        try {
+            lstatSync(current);
+            return missing;
+        }
+        catch (error) {
+            if (errorCode(error) !== "ENOENT")
+                throw error;
+            missing.push(current);
+            const parent = dirname(current);
+            if (parent === current)
+                throw new Error("receipt store root has no existing ancestor");
+            current = parent;
+        }
+    }
+}
+function captureDirectoryIdentity(path, label) {
+    const stat = lstatSync(path);
+    const canonicalPath = realpathSync(path);
+    const canonicalStat = lstatSync(canonicalPath);
+    if (stat.isSymbolicLink() ||
+        !stat.isDirectory() ||
+        canonicalStat.isSymbolicLink() ||
+        !canonicalStat.isDirectory() ||
+        realpathSync(canonicalPath) !== canonicalPath ||
+        !matchesFileIdentity(identityFrom(stat), canonicalStat)) {
+        throw new Error(`${label} is not a trusted directory`);
+    }
+    return { path: canonicalPath, identity: identityFrom(canonicalStat) };
+}
+function assertDirectoryIdentity(directory, label) {
+    const stat = lstatSync(directory.path);
+    if (stat.isSymbolicLink() ||
+        !stat.isDirectory() ||
+        realpathSync(directory.path) !== directory.path ||
+        !matchesFileIdentity(directory.identity, stat)) {
+        throw new Error(`${label} changed during root durability setup`);
+    }
+}
+function cleanupCreatedDirectories(directories) {
+    let failure;
+    for (const directory of directories) {
+        let removed = false;
+        try {
+            assertDirectoryIdentity(directory, "new receipt store directory");
+            rmdirSync(directory.path);
+            removed = true;
+        }
+        catch (error) {
+            if (failure === undefined)
+                failure = error;
+        }
+        if (!removed)
+            continue;
+        try {
+            // Persist each successful removal in its still-existing parent before moving outward.
+            fsyncDirectory(dirname(directory.path));
+        }
+        catch (error) {
+            if (failure === undefined)
+                failure = error;
+        }
+    }
+    return failure;
+}
+function isStrictlyUnder(root, path) {
+    const relativePath = relative(root, path);
+    return (relativePath !== "" && relativePath !== ".." && !relativePath.startsWith(`..${sep}`) && !isAbsolute(relativePath));
+}
+function atomicNoOverwritePublish(tempPath, finalPath) {
+    try {
+        linkSync(tempPath, finalPath);
+    }
+    catch (error) {
+        throw new Error(`receipt store atomic no-overwrite publish failed (${errorCode(error) ?? "unknown"}); destination was not replaced`, { cause: error });
+    }
+}
+/**
+ * Owner-only, no-overwrite receipt persistence rooted at one trusted directory.
+ * Phase A assumes same-UID path mutation is quiescent; identity checks detect observed
+ * replacement but are not filesystem isolation, and persistence alone must not activate EvidenceGate.
+ */
+export class EvidenceReceiptStore {
+    root;
+    rootIdentity;
+    faultInjector;
+    constructor(root, options = {}) {
+        if (typeof root !== "string" || root.length === 0)
+            throw new Error("receipt store root must be non-empty");
+        const resolvedRoot = resolve(root);
+        const missingPaths = missingDirectoryPaths(resolvedRoot);
+        let canonicalRoot;
+        if (missingPaths.length === 0) {
+            const stat = lstatSync(resolvedRoot);
+            if (stat.isSymbolicLink())
+                throw new Error("receipt store root must not be a symlink");
+            if (!stat.isDirectory())
+                throw new Error("receipt store root must be a directory");
+            chmodSync(resolvedRoot, 0o700);
+            canonicalRoot = realpathSync(resolvedRoot);
+        }
+        else {
+            mkdirSync(resolvedRoot, { recursive: true, mode: 0o700 });
+            chmodSync(resolvedRoot, 0o700);
+            canonicalRoot = realpathSync(resolvedRoot);
+            const createdDirectories = missingPaths.map((path) => captureDirectoryIdentity(path, "new receipt store directory"));
+            const outermostCreated = createdDirectories.at(-1);
+            if (outermostCreated === undefined)
+                throw new Error("receipt store root creation was not observed");
+            try {
+                // Persist each new directory before its parent, walking from the root outward.
+                for (const directory of createdDirectories) {
+                    assertDirectoryIdentity(directory, "new receipt store directory");
+                    fsyncDirectory(directory.path);
+                    assertDirectoryIdentity(directory, "new receipt store directory");
+                }
+                const parent = captureDirectoryIdentity(dirname(outermostCreated.path), "receipt store root parent");
+                options.faultInjector?.("before-root-parent-directory-fsync");
+                assertDirectoryIdentity(parent, "receipt store root parent");
+                fsyncDirectory(parent.path);
+                assertDirectoryIdentity(parent, "receipt store root parent");
+            }
+            catch (error) {
+                const failure = classifiedDirectoryFsyncError(dirname(outermostCreated.path), error);
+                const cleanupFailure = cleanupCreatedDirectories(createdDirectories);
+                if (cleanupFailure !== undefined) {
+                    const message = failure instanceof Error ? failure.message : String(failure);
+                    const cleanupMessage = cleanupFailure instanceof Error ? cleanupFailure.message : String(cleanupFailure);
+                    throw new Error(`receipt store root durability failed and cleanup was incomplete: ${message}; cleanup failure: ${cleanupMessage}`, { cause: new AggregateError([failure, cleanupFailure], "receipt store root rollback failed") });
+                }
+                throw failure;
+            }
+        }
+        this.root = canonicalRoot;
+        this.rootIdentity = identityFrom(lstatSync(this.root));
+        this.faultInjector = options.faultInjector;
+        this.assertRoot();
+    }
+    getRoot() {
+        return this.root;
+    }
+    getReceiptPath(receiptId) {
+        this.assertReceiptId(receiptId);
+        return join(this.root, receiptId, "receipt.json");
+    }
+    assertReceiptId(receiptId) {
+        if (!isSafeEvidenceReceiptId(receiptId))
+            throw new Error("receiptId is not safe for storage");
+    }
+    assertRoot() {
+        const stat = lstatSync(this.root);
+        if (stat.isSymbolicLink() ||
+            !stat.isDirectory() ||
+            realpathSync(this.root) !== this.root ||
+            !matchesFileIdentity(this.rootIdentity, stat)) {
+            throw new Error("receipt store root is no longer the trusted directory");
+        }
+    }
+    captureReceiptDirectory(receiptDirectory) {
+        this.assertRoot();
+        const stat = lstatSync(receiptDirectory);
+        const livePath = realpathSync(receiptDirectory);
+        if (stat.isSymbolicLink() ||
+            !stat.isDirectory() ||
+            livePath !== receiptDirectory ||
+            !isStrictlyUnder(this.root, livePath)) {
+            throw new Error("receipt directory is not a trusted directory");
+        }
+        this.assertRoot();
+        return identityFrom(stat);
+    }
+    assertReceiptDirectory(receiptDirectory, expected) {
+        this.assertRoot();
+        const stat = lstatSync(receiptDirectory);
+        const livePath = realpathSync(receiptDirectory);
+        if (stat.isSymbolicLink() ||
+            !stat.isDirectory() ||
+            livePath !== receiptDirectory ||
+            !isStrictlyUnder(this.root, livePath) ||
+            !matchesFileIdentity(expected, stat)) {
+            throw new Error("receipt directory changed during persistence");
+        }
+        this.assertRoot();
+    }
+    assertReceiptFile(path, receiptDirectory, directoryIdentity, expectedFileIdentity, label) {
+        this.assertReceiptDirectory(receiptDirectory, directoryIdentity);
+        const stat = lstatSync(path);
+        const livePath = realpathSync(path);
+        if (stat.isSymbolicLink() ||
+            !stat.isFile() ||
+            livePath !== path ||
+            dirname(livePath) !== receiptDirectory ||
+            !isStrictlyUnder(this.root, livePath) ||
+            !matchesFileIdentity(expectedFileIdentity, stat)) {
+            throw new Error(`${label} path changed during persistence`);
+        }
+        this.assertReceiptDirectory(receiptDirectory, directoryIdentity);
+        return stat;
+    }
+    assertFinalAbsent(finalPath, receiptDirectory, directoryIdentity) {
+        this.assertReceiptDirectory(receiptDirectory, directoryIdentity);
+        try {
+            lstatSync(finalPath);
+        }
+        catch (error) {
+            if (errorCode(error) === "ENOENT") {
+                this.assertReceiptDirectory(receiptDirectory, directoryIdentity);
+                return;
+            }
+            throw error;
+        }
+        throw new Error("receipt destination already exists");
+    }
+    inject(stage) {
+        this.faultInjector?.(stage);
+    }
+    cleanupTemp(tempPath, receiptDirectory, directoryIdentity, tempIdentity) {
+        this.assertReceiptFile(tempPath, receiptDirectory, directoryIdentity, tempIdentity, "receipt temp file");
+        unlinkSync(tempPath);
+        this.inject("before-temp-cleanup-directory-fsync");
+        this.assertReceiptDirectory(receiptDirectory, directoryIdentity);
+        fsyncDirectory(receiptDirectory);
+        this.assertReceiptDirectory(receiptDirectory, directoryIdentity);
+    }
+    cleanupReceiptDirectory(receiptDirectory, directoryIdentity) {
+        this.assertReceiptDirectory(receiptDirectory, directoryIdentity);
+        rmdirSync(receiptDirectory);
+        this.inject("before-receipt-directory-cleanup-root-fsync");
+        this.assertRoot();
+        fsyncDirectory(this.root);
+        this.assertRoot();
+    }
+    /** Persist once using hard-link publication, which cannot replace an existing destination. */
+    write(receipt) {
+        const validated = validateEvidenceReceipt(receipt);
+        const receiptId = validated.core.receiptId;
+        this.assertReceiptId(receiptId);
+        this.assertRoot();
+        const receiptDirectory = join(this.root, receiptId);
+        const finalPath = join(receiptDirectory, "receipt.json");
+        const tempPath = join(receiptDirectory, `.receipt-${randomUUID()}.tmp`);
+        const bytes = Buffer.from(`${serializeEvidenceReceipt(validated)}\n`, "utf8");
+        let fd;
+        let directoryIdentity;
+        let tempIdentity;
+        let tempExists = false;
+        let published = false;
+        let failure;
+        const cleanupFailures = [];
+        try {
+            // mkdir without recursive atomically reserves this receipt ID.
+            mkdirSync(receiptDirectory, { mode: 0o700 });
+            directoryIdentity = this.captureReceiptDirectory(receiptDirectory);
+            this.inject("after-receipt-directory");
+            this.assertReceiptDirectory(receiptDirectory, directoryIdentity);
+            fd = openSync(tempPath, fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_WRONLY | (fsConstants.O_NOFOLLOW ?? 0), 0o600);
+            tempExists = true;
+            tempIdentity = identityFrom(fstatSync(fd));
+            this.inject("after-temp-open");
+            this.assertReceiptFile(tempPath, receiptDirectory, directoryIdentity, tempIdentity, "receipt temp file");
+            writeAll(fd, bytes);
+            this.inject("after-temp-write");
+            this.assertReceiptFile(tempPath, receiptDirectory, directoryIdentity, tempIdentity, "receipt temp file");
+            fsyncSync(fd);
+            this.inject("after-temp-fsync");
+            this.assertReceiptFile(tempPath, receiptDirectory, directoryIdentity, tempIdentity, "receipt temp file");
+            closeSync(fd);
+            fd = undefined;
+            this.inject("after-temp-close");
+            this.assertReceiptFile(tempPath, receiptDirectory, directoryIdentity, tempIdentity, "receipt temp file");
+            this.assertFinalAbsent(finalPath, receiptDirectory, directoryIdentity);
+            this.inject("before-link");
+            this.assertReceiptFile(tempPath, receiptDirectory, directoryIdentity, tempIdentity, "receipt temp file");
+            atomicNoOverwritePublish(tempPath, finalPath);
+            published = true;
+            this.inject("after-link");
+            this.assertReceiptFile(tempPath, receiptDirectory, directoryIdentity, tempIdentity, "receipt temp file");
+            this.assertReceiptFile(finalPath, receiptDirectory, directoryIdentity, tempIdentity, "stored receipt");
+            unlinkSync(tempPath);
+            tempExists = false;
+            this.inject("after-temp-unlink");
+            this.assertReceiptFile(finalPath, receiptDirectory, directoryIdentity, tempIdentity, "stored receipt");
+            fsyncDirectory(receiptDirectory);
+            this.inject("after-receipt-directory-fsync");
+            this.assertReceiptFile(finalPath, receiptDirectory, directoryIdentity, tempIdentity, "stored receipt");
+            this.assertRoot();
+            fsyncDirectory(this.root);
+            this.inject("after-root-directory-fsync");
+            this.assertReceiptFile(finalPath, receiptDirectory, directoryIdentity, tempIdentity, "stored receipt");
+        }
+        catch (error) {
+            failure = error;
+        }
+        finally {
+            if (fd !== undefined) {
+                try {
+                    closeSync(fd);
+                }
+                catch (error) {
+                    cleanupFailures.push(error);
+                }
+            }
+        }
+        if (failure !== undefined) {
+            if (tempExists && directoryIdentity !== undefined && tempIdentity !== undefined) {
+                try {
+                    this.cleanupTemp(tempPath, receiptDirectory, directoryIdentity, tempIdentity);
+                }
+                catch (error) {
+                    cleanupFailures.push(error);
+                }
+            }
+            if (!published && directoryIdentity !== undefined) {
+                try {
+                    this.cleanupReceiptDirectory(receiptDirectory, directoryIdentity);
+                }
+                catch (error) {
+                    cleanupFailures.push(error);
+                }
+            }
+            if (cleanupFailures.length > 0) {
+                const message = failure instanceof Error ? failure.message : String(failure);
+                const cleanupMessage = cleanupFailures
+                    .map((cleanupFailure) => cleanupFailure instanceof Error ? cleanupFailure.message : String(cleanupFailure))
+                    .join("; ");
+                throw new Error(`receipt store persistence failed and cleanup was incomplete: ${message}; cleanup failure: ${cleanupMessage}`, {
+                    cause: new AggregateError([failure, ...cleanupFailures], "receipt store write rollback failed"),
+                });
+            }
+            throw failure;
+        }
+        return finalPath;
+    }
+    /** Read only bytes whose live path remains bound to the opened owner-controlled file. */
+    read(receiptId) {
+        this.assertReceiptId(receiptId);
+        this.assertRoot();
+        const receiptDirectory = join(this.root, receiptId);
+        const directoryIdentity = this.captureReceiptDirectory(receiptDirectory);
+        const path = this.getReceiptPath(receiptId);
+        const fd = openSync(path, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0));
+        try {
+            const before = fstatSync(fd);
+            if (!before.isFile())
+                throw new Error("stored receipt is not a regular file");
+            const fileIdentity = identityFrom(before);
+            this.assertReceiptFile(path, receiptDirectory, directoryIdentity, fileIdentity, "stored receipt");
+            const bytes = readFileSync(fd);
+            const after = fstatSync(fd);
+            this.assertReceiptFile(path, receiptDirectory, directoryIdentity, fileIdentity, "stored receipt");
+            if (!after.isFile() ||
+                !matchesFileIdentity(fileIdentity, after) ||
+                before.size !== after.size ||
+                before.mtimeMs !== after.mtimeMs ||
+                before.ctimeMs !== after.ctimeMs ||
+                after.size !== bytes.byteLength) {
+                throw new Error("stored receipt changed while it was read");
+            }
+            const receipt = parseEvidenceReceipt(bytes.toString("utf8"));
+            if (receipt.core.receiptId !== receiptId) {
+                throw new Error("stored receiptId does not match its storage key");
+            }
+            return receipt;
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+}
+//# sourceMappingURL=evidence-receipt-store.js.map

package/dist/guardrails/evidence-receipt-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence-receipt-store.js","sourceRoot":"","sources":["../../src/guardrails/evidence-receipt-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACN,SAAS,EACT,SAAS,EACT,SAAS,IAAI,WAAW,EACxB,SAAS,EACT,SAAS,EACT,QAAQ,EACR,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,UAAU,EACV,SAAS,GACT,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAE9E,OAAO,EACN,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,EACxB,uBAAuB,GACvB,MAAM,uBAAuB,CAAC;AAkC/B,SAAS,SAAS,CAAC,KAAc,EAAsB;IACtD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK;QACpE,CAAC,CAAC,MAAM,CAAE,KAA4B,CAAC,IAAI,CAAC;QAC5C,CAAC,CAAC,SAAS,CAAC;AAAA,CACb;AAED,MAAM,iCAAiC,GAAwB,IAAI,GAAG,CAAC;IACtE,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,SAAS;CACT,CAAC,CAAC;AAEH,SAAS,6BAA6B,CAAC,IAAY,EAAE,KAAc,EAAW;IAC7E,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,iCAAiC,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,OAAO,IAAI,KAAK,CAAC,gFAAgF,IAAI,KAAK,IAAI,GAAG,EAAE;QAClH,KAAK,EAAE,KAAK;KACZ,CAAC,CAAC;AAAA,CACH;AAED,SAAS,cAAc,CAAC,IAAY,EAAQ;IAC3C,IAAI,EAAsB,CAAC;IAC3B,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACJ,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,QAAQ,GAAG,CAAC,WAAW,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3G,SAAS,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,GAAG,6BAA6B,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACtD,CAAC;YAAS,CAAC;QACV,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACtB,IAAI,CAAC;gBACJ,SAAS,CAAC,EAAE,CAAC,CAAC;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,OAAO,KAAK,SAAS;oBAAE,OAAO,GAAG,KAAK,CAAC;YAC5C,CAAC;QACF,CAAC;IACF,CAAC;IACD,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,OAAO,CAAC;AAAA,CACzC;AAED,SAAS,QAAQ,CAAC,EAAU,EAAE,KAAiB,EAAQ;IACtD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC;QACxE,IAAI,OAAO,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrF,MAAM,IAAI,OAAO,CAAC;IACnB,CAAC;AAAA,CACD;AAED,SAAS,YAAY,CAAC,IAAc,EAAgB;IACnD,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;AAAA,CACxC;AAED,SAAS,eAAe,CAAC,QAAsB,EAAW;IACzD,OAAO,QAAQ,CAAC,GAAG,KAAK,CAAC,IAAI,QAAQ,CAAC,GAAG,KAAK,CAAC,CAAC;AAAA,CAChD;AAED,SAAS,mBAAmB,CAAC,QAAsB,EAAE,MAAgB,EAAW;IAC/E,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,mBAAmB,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,iBAAiB,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;IAC1D,OAAO,CACN,CAAC,CAAC,mBAAmB,IAAI,CAAC,iBAAiB,CAAC;QAC5C,CAAC,mBAAmB;YACnB,iBAAiB;YACjB,QAAQ,CAAC,GAAG,KAAK,cAAc,CAAC,GAAG;YACnC,QAAQ,CAAC,GAAG,KAAK,cAAc,CAAC,GAAG,CAAC,CACrC,CAAC;AAAA,CACF;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAY;IACtD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,OAAO,IAAI,EAAE,CAAC;QACb,IAAI,CAAC;YACJ,SAAS,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,OAAO,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YAC/C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,MAAM,KAAK,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACvF,OAAO,GAAG,MAAM,CAAC;QAClB,CAAC;IACF,CAAC;AAAA,CACD;AAED,SAAS,wBAAwB,CAAC,IAAY,EAAE,KAAa,EAAqB;IACjF,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,aAAa,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,aAAa,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;IAC/C,IACC,IAAI,CAAC,cAAc,EAAE;QACrB,CAAC,IAAI,CAAC,WAAW,EAAE;QACnB,aAAa,CAAC,cAAc,EAAE;QAC9B,CAAC,aAAa,CAAC,WAAW,EAAE;QAC5B,YAAY,CAAC,aAAa,CAAC,KAAK,aAAa;QAC7C,CAAC,mBAAmB,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,EACtD,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,CAAC,aAAa,CAAC,EAAE,CAAC;AAAA,CACtE;AAED,SAAS,uBAAuB,CAAC,SAA4B,EAAE,KAAa,EAAQ;IACnF,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACvC,IACC,IAAI,CAAC,cAAc,EAAE;QACrB,CAAC,IAAI,CAAC,WAAW,EAAE;QACnB,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,IAAI;QAC/C,CAAC,mBAAmB,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,EAC7C,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uCAAuC,CAAC,CAAC;IAClE,CAAC;AAAA,CACD;AAED,SAAS,yBAAyB,CAAC,WAAyC,EAAuB;IAClG,IAAI,OAAgB,CAAC;IACrB,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACJ,uBAAuB,CAAC,SAAS,EAAE,6BAA6B,CAAC,CAAC;YAClE,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC1B,OAAO,GAAG,IAAI,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,GAAG,KAAK,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,CAAC;YACJ,sFAAsF;YACtF,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,GAAG,KAAK,CAAC;QAC5C,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAAA,CACf;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,IAAY,EAAW;IAC7D,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1C,OAAO,CACN,YAAY,KAAK,EAAE,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CACjH,CAAC;AAAA,CACF;AAED,SAAS,wBAAwB,CAAC,QAAgB,EAAE,SAAiB,EAAQ;IAC5E,IAAI,CAAC;QACJ,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACd,qDAAqD,SAAS,CAAC,KAAK,CAAC,IAAI,SAAS,iCAAiC,EACnH,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;IACH,CAAC;AAAA,CACD;AAED;;;;GAIG;AACH,MAAM,OAAO,oBAAoB;IACf,IAAI,CAAS;IACb,YAAY,CAAe;IAC3B,aAAa,CAAgE;IAE9F,YAAY,IAAY,EAAE,OAAO,GAAgC,EAAE,EAAE;QACpE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC3G,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,YAAY,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;QACzD,IAAI,aAAqB,CAAC;QAC1B,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;YACrC,IAAI,IAAI,CAAC,cAAc,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YACvF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YACnF,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YAC/B,aAAa,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACP,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YAC/B,aAAa,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;YAC3C,MAAM,kBAAkB,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACpD,wBAAwB,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAC7D,CAAC;YACF,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,IAAI,gBAAgB,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YACpG,IAAI,CAAC;gBACJ,+EAA+E;gBAC/E,KAAK,MAAM,SAAS,IAAI,kBAAkB,EAAE,CAAC;oBAC5C,uBAAuB,CAAC,SAAS,EAAE,6BAA6B,CAAC,CAAC;oBAClE,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;oBAC/B,uBAAuB,CAAC,SAAS,EAAE,6BAA6B,CAAC,CAAC;gBACnE,CAAC;gBACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,2BAA2B,CAAC,CAAC;gBACrG,OAAO,CAAC,aAAa,EAAE,CAAC,oCAAoC,CAAC,CAAC;gBAC9D,uBAAuB,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;gBAC7D,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC5B,uBAAuB,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;YAC9D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,OAAO,GAAG,6BAA6B,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;gBACrF,MAAM,cAAc,GAAG,yBAAyB,CAAC,kBAAkB,CAAC,CAAC;gBACrE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;oBAClC,MAAM,OAAO,GAAG,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;oBAC7E,MAAM,cAAc,GAAG,cAAc,YAAY,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;oBACzG,MAAM,IAAI,KAAK,CACd,oEAAoE,OAAO,sBAAsB,cAAc,EAAE,EACjH,EAAE,KAAK,EAAE,IAAI,cAAc,CAAC,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,oCAAoC,CAAC,EAAE,CAC9F,CAAC;gBACH,CAAC;gBACD,MAAM,OAAO,CAAC;YACf,CAAC;QACF,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;IAAA,CAClB;IAED,OAAO,GAAW;QACjB,OAAO,IAAI,CAAC,IAAI,CAAC;IAAA,CACjB;IAED,cAAc,CAAC,SAAiB,EAAU;QACzC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;IAAA,CAClD;IAEO,eAAe,CAAC,SAAkB,EAA+B;QACxE,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAAA,CAC9F;IAEO,UAAU,GAAS;QAC1B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,IACC,IAAI,CAAC,cAAc,EAAE;YACrB,CAAC,IAAI,CAAC,WAAW,EAAE;YACnB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI;YACrC,CAAC,mBAAmB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,EAC5C,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC1E,CAAC;IAAA,CACD;IAEO,uBAAuB,CAAC,gBAAwB,EAAgB;QACvE,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;QAChD,IACC,IAAI,CAAC,cAAc,EAAE;YACrB,CAAC,IAAI,CAAC,WAAW,EAAE;YACnB,QAAQ,KAAK,gBAAgB;YAC7B,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EACpC,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAAA,CAC1B;IAEO,sBAAsB,CAAC,gBAAwB,EAAE,QAAsB,EAAQ;QACtF,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;QAChD,IACC,IAAI,CAAC,cAAc,EAAE;YACrB,CAAC,IAAI,CAAC,WAAW,EAAE;YACnB,QAAQ,KAAK,gBAAgB;YAC7B,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;YACrC,CAAC,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,EACnC,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;IAAA,CAClB;IAEO,iBAAiB,CACxB,IAAY,EACZ,gBAAwB,EACxB,iBAA+B,EAC/B,oBAAkC,EAClC,KAAa,EACF;QACX,IAAI,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACpC,IACC,IAAI,CAAC,cAAc,EAAE;YACrB,CAAC,IAAI,CAAC,MAAM,EAAE;YACd,QAAQ,KAAK,IAAI;YACjB,OAAO,CAAC,QAAQ,CAAC,KAAK,gBAAgB;YACtC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;YACrC,CAAC,mBAAmB,CAAC,oBAAoB,EAAE,IAAI,CAAC,EAC/C,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kCAAkC,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC;IAAA,CACZ;IAEO,iBAAiB,CAAC,SAAiB,EAAE,gBAAwB,EAAE,iBAA+B,EAAQ;QAC7G,IAAI,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;QACjE,IAAI,CAAC;YACJ,SAAS,CAAC,SAAS,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACnC,IAAI,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;gBACjE,OAAO;YACR,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAAA,CACtD;IAEO,MAAM,CAAC,KAAqC,EAAQ;QAC3D,IAAI,CAAC,aAAa,EAAE,CAAC,KAAK,CAAC,CAAC;IAAA,CAC5B;IAEO,WAAW,CAClB,QAAgB,EAChB,gBAAwB,EACxB,iBAA+B,EAC/B,YAA0B,EACnB;QACP,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,YAAY,EAAE,mBAAmB,CAAC,CAAC;QACzG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,qCAAqC,CAAC,CAAC;QACnD,IAAI,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;QACjE,cAAc,CAAC,gBAAgB,CAAC,CAAC;QACjC,IAAI,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;IAAA,CACjE;IAEO,uBAAuB,CAAC,gBAAwB,EAAE,iBAA+B,EAAQ;QAChG,IAAI,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;QACjE,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,6CAA6C,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,UAAU,EAAE,CAAC;IAAA,CAClB;IAED,8FAA8F;IAC9F,KAAK,CAAC,OAAwB,EAAU;QACvC,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;QAC3C,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,EAAE,YAAY,UAAU,EAAE,MAAM,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9E,IAAI,EAAsB,CAAC;QAC3B,IAAI,iBAA2C,CAAC;QAChD,IAAI,YAAsC,CAAC;QAC3C,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,OAAgB,CAAC;QACrB,MAAM,eAAe,GAAc,EAAE,CAAC;QAEtC,IAAI,CAAC;YACJ,+DAA+D;YAC/D,SAAS,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7C,iBAAiB,GAAG,IAAI,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;YACnE,IAAI,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;YACvC,IAAI,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;YAEjE,EAAE,GAAG,QAAQ,CACZ,QAAQ,EACR,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,MAAM,GAAG,WAAW,CAAC,QAAQ,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,EAC/F,KAAK,CACL,CAAC;YACF,UAAU,GAAG,IAAI,CAAC;YAClB,YAAY,GAAG,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC/B,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,YAAY,EAAE,mBAAmB,CAAC,CAAC;YAEzG,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAChC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,YAAY,EAAE,mBAAmB,CAAC,CAAC;YACzG,SAAS,CAAC,EAAE,CAAC,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAChC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,YAAY,EAAE,mBAAmB,CAAC,CAAC;YACzG,SAAS,CAAC,EAAE,CAAC,CAAC;YACd,EAAE,GAAG,SAAS,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAChC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,YAAY,EAAE,mBAAmB,CAAC,CAAC;YACzG,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;YACvE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAC3B,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,YAAY,EAAE,mBAAmB,CAAC,CAAC;YAEzG,wBAAwB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC9C,SAAS,GAAG,IAAI,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC1B,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,YAAY,EAAE,mBAAmB,CAAC,CAAC;YACzG,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;YACvG,UAAU,CAAC,QAAQ,CAAC,CAAC;YACrB,UAAU,GAAG,KAAK,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACjC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;YAEvG,cAAc,CAAC,gBAAgB,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC;YAC7C,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;YACvG,IAAI,CAAC,UAAU,EAAE,CAAC;YAClB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;YAC1C,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;QACxG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,GAAG,KAAK,CAAC;QACjB,CAAC;gBAAS,CAAC;YACV,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;gBACtB,IAAI,CAAC;oBACJ,SAAS,CAAC,EAAE,CAAC,CAAC;gBACf,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC7B,CAAC;YACF,CAAC;QACF,CAAC;QAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,UAAU,IAAI,iBAAiB,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBACjF,IAAI,CAAC;oBACJ,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAC/E,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC7B,CAAC;YACF,CAAC;YACD,IAAI,CAAC,SAAS,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACnD,IAAI,CAAC;oBACJ,IAAI,CAAC,uBAAuB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;gBACnE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC7B,CAAC;YACF,CAAC;YACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChC,MAAM,OAAO,GAAG,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC7E,MAAM,cAAc,GAAG,eAAe;qBACpC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,CACvB,cAAc,YAAY,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CACjF;qBACA,IAAI,CAAC,IAAI,CAAC,CAAC;gBACb,MAAM,IAAI,KAAK,CACd,gEAAgE,OAAO,sBAAsB,cAAc,EAAE,EAC7G;oBACC,KAAK,EAAE,IAAI,cAAc,CAAC,CAAC,OAAO,EAAE,GAAG,eAAe,CAAC,EAAE,qCAAqC,CAAC;iBAC/F,CACD,CAAC;YACH,CAAC;YACD,MAAM,OAAO,CAAC;QACf,CAAC;QACD,OAAO,SAAS,CAAC;IAAA,CACjB;IAED,yFAAyF;IACzF,IAAI,CAAC,SAAiB,EAAmB;QACxC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,iBAAiB,GAAG,IAAI,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,QAAQ,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC9E,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;YAClG,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;YAC/B,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;YAC5B,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;YAClG,IACC,CAAC,KAAK,CAAC,MAAM,EAAE;gBACf,CAAC,mBAAmB,CAAC,YAAY,EAAE,KAAK,CAAC;gBACzC,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;gBAC1B,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;gBAChC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;gBAChC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,UAAU,EAC9B,CAAC;gBACF,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7D,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACpE,CAAC;YACD,OAAO,OAAO,CAAC;QAChB,CAAC;gBAAS,CAAC;YACV,SAAS,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;IAAA,CACD;CACD","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport type { Stats } from \"node:fs\";\nimport {\n\tchmodSync,\n\tcloseSync,\n\tconstants as fsConstants,\n\tfstatSync,\n\tfsyncSync,\n\tlinkSync,\n\tlstatSync,\n\tmkdirSync,\n\topenSync,\n\treadFileSync,\n\trealpathSync,\n\trmdirSync,\n\tunlinkSync,\n\twriteSync,\n} from \"node:fs\";\nimport { dirname, isAbsolute, join, relative, resolve, sep } from \"node:path\";\nimport type { EvidenceReceipt } from \"../types/evidence.ts\";\nimport {\n\tisSafeEvidenceReceiptId,\n\tparseEvidenceReceipt,\n\tserializeEvidenceReceipt,\n\tvalidateEvidenceReceipt,\n} from \"./evidence-receipt.ts\";\n\nexport type EvidenceReceiptStoreFaultStage =\n\t| \"before-root-parent-directory-fsync\"\n\t| \"after-receipt-directory\"\n\t| \"after-temp-open\"\n\t| \"after-temp-write\"\n\t| \"after-temp-fsync\"\n\t| \"after-temp-close\"\n\t| \"before-link\"\n\t| \"after-link\"\n\t| \"after-temp-unlink\"\n\t| \"before-temp-cleanup-directory-fsync\"\n\t| \"before-receipt-directory-cleanup-root-fsync\"\n\t| \"after-receipt-directory-fsync\"\n\t| \"after-root-directory-fsync\";\n\nexport interface EvidenceReceiptStoreOptions {\n\t/** Tests only: throw or mutate paths at a selected persistence stage. */\n\treadonly faultInjector?: (stage: EvidenceReceiptStoreFaultStage) => void;\n}\n\ntype FileStat = Stats;\n\ninterface FileIdentity {\n\treadonly dev: number;\n\treadonly ino: number;\n}\n\ninterface DirectoryIdentity {\n\treadonly path: string;\n\treadonly identity: FileIdentity;\n}\n\nfunction errorCode(error: unknown): string | undefined {\n\treturn typeof error === \"object\" && error !== null && \"code\" in error\n\t\t? String((error as { code?: unknown }).code)\n\t\t: undefined;\n}\n\nconst UNSUPPORTED_DIRECTORY_FSYNC_CODES: ReadonlySet<string> = new Set([\n\t\"EBADF\",\n\t\"EINVAL\",\n\t\"EISDIR\",\n\t\"ENOSYS\",\n\t\"ENOTSUP\",\n]);\n\nfunction classifiedDirectoryFsyncError(path: string, error: unknown): unknown {\n\tconst code = errorCode(error);\n\tif (code === undefined || !UNSUPPORTED_DIRECTORY_FSYNC_CODES.has(code)) return error;\n\treturn new Error(`receipt store strict durability unavailable: directory fsync unsupported for ${path} (${code})`, {\n\t\tcause: error,\n\t});\n}\n\nfunction fsyncDirectory(path: string): void {\n\tlet fd: number | undefined;\n\tlet failure: unknown;\n\ttry {\n\t\tfd = openSync(path, fsConstants.O_RDONLY | (fsConstants.O_DIRECTORY ?? 0) | (fsConstants.O_NOFOLLOW ?? 0));\n\t\tfsyncSync(fd);\n\t} catch (error) {\n\t\tfailure = classifiedDirectoryFsyncError(path, error);\n\t} finally {\n\t\tif (fd !== undefined) {\n\t\t\ttry {\n\t\t\t\tcloseSync(fd);\n\t\t\t} catch (error) {\n\t\t\t\tif (failure === undefined) failure = error;\n\t\t\t}\n\t\t}\n\t}\n\tif (failure !== undefined) throw failure;\n}\n\nfunction writeAll(fd: number, bytes: Uint8Array): void {\n\tlet offset = 0;\n\twhile (offset < bytes.byteLength) {\n\t\tconst written = writeSync(fd, bytes, offset, bytes.byteLength - offset);\n\t\tif (written <= 0) throw new Error(\"receipt store could not complete the file write\");\n\t\toffset += written;\n\t}\n}\n\nfunction identityFrom(stat: FileStat): FileIdentity {\n\treturn { dev: stat.dev, ino: stat.ino };\n}\n\nfunction hasFileIdentity(identity: FileIdentity): boolean {\n\treturn identity.dev !== 0 || identity.ino !== 0;\n}\n\nfunction matchesFileIdentity(expected: FileIdentity, actual: FileStat): boolean {\n\tconst actualIdentity = identityFrom(actual);\n\tconst expectedHasIdentity = hasFileIdentity(expected);\n\tconst actualHasIdentity = hasFileIdentity(actualIdentity);\n\treturn (\n\t\t(!expectedHasIdentity && !actualHasIdentity) ||\n\t\t(expectedHasIdentity &&\n\t\t\tactualHasIdentity &&\n\t\t\texpected.dev === actualIdentity.dev &&\n\t\t\texpected.ino === actualIdentity.ino)\n\t);\n}\n\nfunction missingDirectoryPaths(path: string): string[] {\n\tconst missing: string[] = [];\n\tlet current = path;\n\twhile (true) {\n\t\ttry {\n\t\t\tlstatSync(current);\n\t\t\treturn missing;\n\t\t} catch (error) {\n\t\t\tif (errorCode(error) !== \"ENOENT\") throw error;\n\t\t\tmissing.push(current);\n\t\t\tconst parent = dirname(current);\n\t\t\tif (parent === current) throw new Error(\"receipt store root has no existing ancestor\");\n\t\t\tcurrent = parent;\n\t\t}\n\t}\n}\n\nfunction captureDirectoryIdentity(path: string, label: string): DirectoryIdentity {\n\tconst stat = lstatSync(path);\n\tconst canonicalPath = realpathSync(path);\n\tconst canonicalStat = lstatSync(canonicalPath);\n\tif (\n\t\tstat.isSymbolicLink() ||\n\t\t!stat.isDirectory() ||\n\t\tcanonicalStat.isSymbolicLink() ||\n\t\t!canonicalStat.isDirectory() ||\n\t\trealpathSync(canonicalPath) !== canonicalPath ||\n\t\t!matchesFileIdentity(identityFrom(stat), canonicalStat)\n\t) {\n\t\tthrow new Error(`${label} is not a trusted directory`);\n\t}\n\treturn { path: canonicalPath, identity: identityFrom(canonicalStat) };\n}\n\nfunction assertDirectoryIdentity(directory: DirectoryIdentity, label: string): void {\n\tconst stat = lstatSync(directory.path);\n\tif (\n\t\tstat.isSymbolicLink() ||\n\t\t!stat.isDirectory() ||\n\t\trealpathSync(directory.path) !== directory.path ||\n\t\t!matchesFileIdentity(directory.identity, stat)\n\t) {\n\t\tthrow new Error(`${label} changed during root durability setup`);\n\t}\n}\n\nfunction cleanupCreatedDirectories(directories: readonly DirectoryIdentity[]): unknown | undefined {\n\tlet failure: unknown;\n\tfor (const directory of directories) {\n\t\tlet removed = false;\n\t\ttry {\n\t\t\tassertDirectoryIdentity(directory, \"new receipt store directory\");\n\t\t\trmdirSync(directory.path);\n\t\t\tremoved = true;\n\t\t} catch (error) {\n\t\t\tif (failure === undefined) failure = error;\n\t\t}\n\t\tif (!removed) continue;\n\t\ttry {\n\t\t\t// Persist each successful removal in its still-existing parent before moving outward.\n\t\t\tfsyncDirectory(dirname(directory.path));\n\t\t} catch (error) {\n\t\t\tif (failure === undefined) failure = error;\n\t\t}\n\t}\n\treturn failure;\n}\n\nfunction isStrictlyUnder(root: string, path: string): boolean {\n\tconst relativePath = relative(root, path);\n\treturn (\n\t\trelativePath !== \"\" && relativePath !== \"..\" && !relativePath.startsWith(`..${sep}`) && !isAbsolute(relativePath)\n\t);\n}\n\nfunction atomicNoOverwritePublish(tempPath: string, finalPath: string): void {\n\ttry {\n\t\tlinkSync(tempPath, finalPath);\n\t} catch (error) {\n\t\tthrow new Error(\n\t\t\t`receipt store atomic no-overwrite publish failed (${errorCode(error) ?? \"unknown\"}); destination was not replaced`,\n\t\t\t{ cause: error },\n\t\t);\n\t}\n}\n\n/**\n * Owner-only, no-overwrite receipt persistence rooted at one trusted directory.\n * Phase A assumes same-UID path mutation is quiescent; identity checks detect observed\n * replacement but are not filesystem isolation, and persistence alone must not activate EvidenceGate.\n */\nexport class EvidenceReceiptStore {\n\tprivate readonly root: string;\n\tprivate readonly rootIdentity: FileIdentity;\n\tprivate readonly faultInjector: ((stage: EvidenceReceiptStoreFaultStage) => void) | undefined;\n\n\tconstructor(root: string, options: EvidenceReceiptStoreOptions = {}) {\n\t\tif (typeof root !== \"string\" || root.length === 0) throw new Error(\"receipt store root must be non-empty\");\n\t\tconst resolvedRoot = resolve(root);\n\t\tconst missingPaths = missingDirectoryPaths(resolvedRoot);\n\t\tlet canonicalRoot: string;\n\t\tif (missingPaths.length === 0) {\n\t\t\tconst stat = lstatSync(resolvedRoot);\n\t\t\tif (stat.isSymbolicLink()) throw new Error(\"receipt store root must not be a symlink\");\n\t\t\tif (!stat.isDirectory()) throw new Error(\"receipt store root must be a directory\");\n\t\t\tchmodSync(resolvedRoot, 0o700);\n\t\t\tcanonicalRoot = realpathSync(resolvedRoot);\n\t\t} else {\n\t\t\tmkdirSync(resolvedRoot, { recursive: true, mode: 0o700 });\n\t\t\tchmodSync(resolvedRoot, 0o700);\n\t\t\tcanonicalRoot = realpathSync(resolvedRoot);\n\t\t\tconst createdDirectories = missingPaths.map((path) =>\n\t\t\t\tcaptureDirectoryIdentity(path, \"new receipt store directory\"),\n\t\t\t);\n\t\t\tconst outermostCreated = createdDirectories.at(-1);\n\t\t\tif (outermostCreated === undefined) throw new Error(\"receipt store root creation was not observed\");\n\t\t\ttry {\n\t\t\t\t// Persist each new directory before its parent, walking from the root outward.\n\t\t\t\tfor (const directory of createdDirectories) {\n\t\t\t\t\tassertDirectoryIdentity(directory, \"new receipt store directory\");\n\t\t\t\t\tfsyncDirectory(directory.path);\n\t\t\t\t\tassertDirectoryIdentity(directory, \"new receipt store directory\");\n\t\t\t\t}\n\t\t\t\tconst parent = captureDirectoryIdentity(dirname(outermostCreated.path), \"receipt store root parent\");\n\t\t\t\toptions.faultInjector?.(\"before-root-parent-directory-fsync\");\n\t\t\t\tassertDirectoryIdentity(parent, \"receipt store root parent\");\n\t\t\t\tfsyncDirectory(parent.path);\n\t\t\t\tassertDirectoryIdentity(parent, \"receipt store root parent\");\n\t\t\t} catch (error) {\n\t\t\t\tconst failure = classifiedDirectoryFsyncError(dirname(outermostCreated.path), error);\n\t\t\t\tconst cleanupFailure = cleanupCreatedDirectories(createdDirectories);\n\t\t\t\tif (cleanupFailure !== undefined) {\n\t\t\t\t\tconst message = failure instanceof Error ? failure.message : String(failure);\n\t\t\t\t\tconst cleanupMessage = cleanupFailure instanceof Error ? cleanupFailure.message : String(cleanupFailure);\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`receipt store root durability failed and cleanup was incomplete: ${message}; cleanup failure: ${cleanupMessage}`,\n\t\t\t\t\t\t{ cause: new AggregateError([failure, cleanupFailure], \"receipt store root rollback failed\") },\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tthrow failure;\n\t\t\t}\n\t\t}\n\t\tthis.root = canonicalRoot;\n\t\tthis.rootIdentity = identityFrom(lstatSync(this.root));\n\t\tthis.faultInjector = options.faultInjector;\n\t\tthis.assertRoot();\n\t}\n\n\tgetRoot(): string {\n\t\treturn this.root;\n\t}\n\n\tgetReceiptPath(receiptId: string): string {\n\t\tthis.assertReceiptId(receiptId);\n\t\treturn join(this.root, receiptId, \"receipt.json\");\n\t}\n\n\tprivate assertReceiptId(receiptId: unknown): asserts receiptId is string {\n\t\tif (!isSafeEvidenceReceiptId(receiptId)) throw new Error(\"receiptId is not safe for storage\");\n\t}\n\n\tprivate assertRoot(): void {\n\t\tconst stat = lstatSync(this.root);\n\t\tif (\n\t\t\tstat.isSymbolicLink() ||\n\t\t\t!stat.isDirectory() ||\n\t\t\trealpathSync(this.root) !== this.root ||\n\t\t\t!matchesFileIdentity(this.rootIdentity, stat)\n\t\t) {\n\t\t\tthrow new Error(\"receipt store root is no longer the trusted directory\");\n\t\t}\n\t}\n\n\tprivate captureReceiptDirectory(receiptDirectory: string): FileIdentity {\n\t\tthis.assertRoot();\n\t\tconst stat = lstatSync(receiptDirectory);\n\t\tconst livePath = realpathSync(receiptDirectory);\n\t\tif (\n\t\t\tstat.isSymbolicLink() ||\n\t\t\t!stat.isDirectory() ||\n\t\t\tlivePath !== receiptDirectory ||\n\t\t\t!isStrictlyUnder(this.root, livePath)\n\t\t) {\n\t\t\tthrow new Error(\"receipt directory is not a trusted directory\");\n\t\t}\n\t\tthis.assertRoot();\n\t\treturn identityFrom(stat);\n\t}\n\n\tprivate assertReceiptDirectory(receiptDirectory: string, expected: FileIdentity): void {\n\t\tthis.assertRoot();\n\t\tconst stat = lstatSync(receiptDirectory);\n\t\tconst livePath = realpathSync(receiptDirectory);\n\t\tif (\n\t\t\tstat.isSymbolicLink() ||\n\t\t\t!stat.isDirectory() ||\n\t\t\tlivePath !== receiptDirectory ||\n\t\t\t!isStrictlyUnder(this.root, livePath) ||\n\t\t\t!matchesFileIdentity(expected, stat)\n\t\t) {\n\t\t\tthrow new Error(\"receipt directory changed during persistence\");\n\t\t}\n\t\tthis.assertRoot();\n\t}\n\n\tprivate assertReceiptFile(\n\t\tpath: string,\n\t\treceiptDirectory: string,\n\t\tdirectoryIdentity: FileIdentity,\n\t\texpectedFileIdentity: FileIdentity,\n\t\tlabel: string,\n\t): FileStat {\n\t\tthis.assertReceiptDirectory(receiptDirectory, directoryIdentity);\n\t\tconst stat = lstatSync(path);\n\t\tconst livePath = realpathSync(path);\n\t\tif (\n\t\t\tstat.isSymbolicLink() ||\n\t\t\t!stat.isFile() ||\n\t\t\tlivePath !== path ||\n\t\t\tdirname(livePath) !== receiptDirectory ||\n\t\t\t!isStrictlyUnder(this.root, livePath) ||\n\t\t\t!matchesFileIdentity(expectedFileIdentity, stat)\n\t\t) {\n\t\t\tthrow new Error(`${label} path changed during persistence`);\n\t\t}\n\t\tthis.assertReceiptDirectory(receiptDirectory, directoryIdentity);\n\t\treturn stat;\n\t}\n\n\tprivate assertFinalAbsent(finalPath: string, receiptDirectory: string, directoryIdentity: FileIdentity): void {\n\t\tthis.assertReceiptDirectory(receiptDirectory, directoryIdentity);\n\t\ttry {\n\t\t\tlstatSync(finalPath);\n\t\t} catch (error) {\n\t\t\tif (errorCode(error) === \"ENOENT\") {\n\t\t\t\tthis.assertReceiptDirectory(receiptDirectory, directoryIdentity);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t\tthrow new Error(\"receipt destination already exists\");\n\t}\n\n\tprivate inject(stage: EvidenceReceiptStoreFaultStage): void {\n\t\tthis.faultInjector?.(stage);\n\t}\n\n\tprivate cleanupTemp(\n\t\ttempPath: string,\n\t\treceiptDirectory: string,\n\t\tdirectoryIdentity: FileIdentity,\n\t\ttempIdentity: FileIdentity,\n\t): void {\n\t\tthis.assertReceiptFile(tempPath, receiptDirectory, directoryIdentity, tempIdentity, \"receipt temp file\");\n\t\tunlinkSync(tempPath);\n\t\tthis.inject(\"before-temp-cleanup-directory-fsync\");\n\t\tthis.assertReceiptDirectory(receiptDirectory, directoryIdentity);\n\t\tfsyncDirectory(receiptDirectory);\n\t\tthis.assertReceiptDirectory(receiptDirectory, directoryIdentity);\n\t}\n\n\tprivate cleanupReceiptDirectory(receiptDirectory: string, directoryIdentity: FileIdentity): void {\n\t\tthis.assertReceiptDirectory(receiptDirectory, directoryIdentity);\n\t\trmdirSync(receiptDirectory);\n\t\tthis.inject(\"before-receipt-directory-cleanup-root-fsync\");\n\t\tthis.assertRoot();\n\t\tfsyncDirectory(this.root);\n\t\tthis.assertRoot();\n\t}\n\n\t/** Persist once using hard-link publication, which cannot replace an existing destination. */\n\twrite(receipt: EvidenceReceipt): string {\n\t\tconst validated = validateEvidenceReceipt(receipt);\n\t\tconst receiptId = validated.core.receiptId;\n\t\tthis.assertReceiptId(receiptId);\n\t\tthis.assertRoot();\n\t\tconst receiptDirectory = join(this.root, receiptId);\n\t\tconst finalPath = join(receiptDirectory, \"receipt.json\");\n\t\tconst tempPath = join(receiptDirectory, `.receipt-${randomUUID()}.tmp`);\n\t\tconst bytes = Buffer.from(`${serializeEvidenceReceipt(validated)}\\n`, \"utf8\");\n\t\tlet fd: number | undefined;\n\t\tlet directoryIdentity: FileIdentity | undefined;\n\t\tlet tempIdentity: FileIdentity | undefined;\n\t\tlet tempExists = false;\n\t\tlet published = false;\n\t\tlet failure: unknown;\n\t\tconst cleanupFailures: unknown[] = [];\n\n\t\ttry {\n\t\t\t// mkdir without recursive atomically reserves this receipt ID.\n\t\t\tmkdirSync(receiptDirectory, { mode: 0o700 });\n\t\t\tdirectoryIdentity = this.captureReceiptDirectory(receiptDirectory);\n\t\t\tthis.inject(\"after-receipt-directory\");\n\t\t\tthis.assertReceiptDirectory(receiptDirectory, directoryIdentity);\n\n\t\t\tfd = openSync(\n\t\t\t\ttempPath,\n\t\t\t\tfsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_WRONLY | (fsConstants.O_NOFOLLOW ?? 0),\n\t\t\t\t0o600,\n\t\t\t);\n\t\t\ttempExists = true;\n\t\t\ttempIdentity = identityFrom(fstatSync(fd));\n\t\t\tthis.inject(\"after-temp-open\");\n\t\t\tthis.assertReceiptFile(tempPath, receiptDirectory, directoryIdentity, tempIdentity, \"receipt temp file\");\n\n\t\t\twriteAll(fd, bytes);\n\t\t\tthis.inject(\"after-temp-write\");\n\t\t\tthis.assertReceiptFile(tempPath, receiptDirectory, directoryIdentity, tempIdentity, \"receipt temp file\");\n\t\t\tfsyncSync(fd);\n\t\t\tthis.inject(\"after-temp-fsync\");\n\t\t\tthis.assertReceiptFile(tempPath, receiptDirectory, directoryIdentity, tempIdentity, \"receipt temp file\");\n\t\t\tcloseSync(fd);\n\t\t\tfd = undefined;\n\t\t\tthis.inject(\"after-temp-close\");\n\t\t\tthis.assertReceiptFile(tempPath, receiptDirectory, directoryIdentity, tempIdentity, \"receipt temp file\");\n\t\t\tthis.assertFinalAbsent(finalPath, receiptDirectory, directoryIdentity);\n\t\t\tthis.inject(\"before-link\");\n\t\t\tthis.assertReceiptFile(tempPath, receiptDirectory, directoryIdentity, tempIdentity, \"receipt temp file\");\n\n\t\t\tatomicNoOverwritePublish(tempPath, finalPath);\n\t\t\tpublished = true;\n\t\t\tthis.inject(\"after-link\");\n\t\t\tthis.assertReceiptFile(tempPath, receiptDirectory, directoryIdentity, tempIdentity, \"receipt temp file\");\n\t\t\tthis.assertReceiptFile(finalPath, receiptDirectory, directoryIdentity, tempIdentity, \"stored receipt\");\n\t\t\tunlinkSync(tempPath);\n\t\t\ttempExists = false;\n\t\t\tthis.inject(\"after-temp-unlink\");\n\t\t\tthis.assertReceiptFile(finalPath, receiptDirectory, directoryIdentity, tempIdentity, \"stored receipt\");\n\n\t\t\tfsyncDirectory(receiptDirectory);\n\t\t\tthis.inject(\"after-receipt-directory-fsync\");\n\t\t\tthis.assertReceiptFile(finalPath, receiptDirectory, directoryIdentity, tempIdentity, \"stored receipt\");\n\t\t\tthis.assertRoot();\n\t\t\tfsyncDirectory(this.root);\n\t\t\tthis.inject(\"after-root-directory-fsync\");\n\t\t\tthis.assertReceiptFile(finalPath, receiptDirectory, directoryIdentity, tempIdentity, \"stored receipt\");\n\t\t} catch (error) {\n\t\t\tfailure = error;\n\t\t} finally {\n\t\t\tif (fd !== undefined) {\n\t\t\t\ttry {\n\t\t\t\t\tcloseSync(fd);\n\t\t\t\t} catch (error) {\n\t\t\t\t\tcleanupFailures.push(error);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (failure !== undefined) {\n\t\t\tif (tempExists && directoryIdentity !== undefined && tempIdentity !== undefined) {\n\t\t\t\ttry {\n\t\t\t\t\tthis.cleanupTemp(tempPath, receiptDirectory, directoryIdentity, tempIdentity);\n\t\t\t\t} catch (error) {\n\t\t\t\t\tcleanupFailures.push(error);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (!published && directoryIdentity !== undefined) {\n\t\t\t\ttry {\n\t\t\t\t\tthis.cleanupReceiptDirectory(receiptDirectory, directoryIdentity);\n\t\t\t\t} catch (error) {\n\t\t\t\t\tcleanupFailures.push(error);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (cleanupFailures.length > 0) {\n\t\t\t\tconst message = failure instanceof Error ? failure.message : String(failure);\n\t\t\t\tconst cleanupMessage = cleanupFailures\n\t\t\t\t\t.map((cleanupFailure) =>\n\t\t\t\t\t\tcleanupFailure instanceof Error ? cleanupFailure.message : String(cleanupFailure),\n\t\t\t\t\t)\n\t\t\t\t\t.join(\"; \");\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`receipt store persistence failed and cleanup was incomplete: ${message}; cleanup failure: ${cleanupMessage}`,\n\t\t\t\t\t{\n\t\t\t\t\t\tcause: new AggregateError([failure, ...cleanupFailures], \"receipt store write rollback failed\"),\n\t\t\t\t\t},\n\t\t\t\t);\n\t\t\t}\n\t\t\tthrow failure;\n\t\t}\n\t\treturn finalPath;\n\t}\n\n\t/** Read only bytes whose live path remains bound to the opened owner-controlled file. */\n\tread(receiptId: string): EvidenceReceipt {\n\t\tthis.assertReceiptId(receiptId);\n\t\tthis.assertRoot();\n\t\tconst receiptDirectory = join(this.root, receiptId);\n\t\tconst directoryIdentity = this.captureReceiptDirectory(receiptDirectory);\n\t\tconst path = this.getReceiptPath(receiptId);\n\t\tconst fd = openSync(path, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0));\n\t\ttry {\n\t\t\tconst before = fstatSync(fd);\n\t\t\tif (!before.isFile()) throw new Error(\"stored receipt is not a regular file\");\n\t\t\tconst fileIdentity = identityFrom(before);\n\t\t\tthis.assertReceiptFile(path, receiptDirectory, directoryIdentity, fileIdentity, \"stored receipt\");\n\t\t\tconst bytes = readFileSync(fd);\n\t\t\tconst after = fstatSync(fd);\n\t\t\tthis.assertReceiptFile(path, receiptDirectory, directoryIdentity, fileIdentity, \"stored receipt\");\n\t\t\tif (\n\t\t\t\t!after.isFile() ||\n\t\t\t\t!matchesFileIdentity(fileIdentity, after) ||\n\t\t\t\tbefore.size !== after.size ||\n\t\t\t\tbefore.mtimeMs !== after.mtimeMs ||\n\t\t\t\tbefore.ctimeMs !== after.ctimeMs ||\n\t\t\t\tafter.size !== bytes.byteLength\n\t\t\t) {\n\t\t\t\tthrow new Error(\"stored receipt changed while it was read\");\n\t\t\t}\n\t\t\tconst receipt = parseEvidenceReceipt(bytes.toString(\"utf8\"));\n\t\t\tif (receipt.core.receiptId !== receiptId) {\n\t\t\t\tthrow new Error(\"stored receiptId does not match its storage key\");\n\t\t\t}\n\t\t\treturn receipt;\n\t\t} finally {\n\t\t\tcloseSync(fd);\n\t\t}\n\t}\n}\n"]}

package/dist/guardrails/evidence-receipt.d.ts

@@ -0,0 +1,58 @@
+import type { CommandHmacBinding, CommandRedactionSummary, EvidenceCommandDescriptor, EvidenceExecutor, EvidenceReceipt, EvidenceReceiptCore, EvidenceReceiptDisposition, EvidenceReceiptLedgerBinding, EvidenceReceiptReplayPayload, Sha256Hex, TrustedEvidenceAttestation, WorkspaceFingerprint } from "../types/evidence.ts";
+/** Combined stdout/stderr bytes accepted from an already-redacted caller. */
+export declare const MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES: number;
+export interface AlreadyRedactedOutputBytes {
+    readonly redactionPolicyId: string;
+    readonly stdout: Uint8Array;
+    readonly stderr: Uint8Array;
+}
+export interface EvidenceReceiptCoreInputFields {
+    readonly receiptId: string;
+    readonly goalId: string;
+    readonly laneId?: string;
+    readonly claim: string;
+    readonly command: EvidenceCommandDescriptor;
+    readonly cwd: string;
+    readonly timeoutMs: number | null;
+    readonly startedAt: string;
+    readonly finishedAt: string;
+    readonly durationMs: number;
+    readonly workspaceBefore: WorkspaceFingerprint;
+    readonly workspaceAfter: WorkspaceFingerprint;
+    readonly alreadyRedactedOutput: AlreadyRedactedOutputBytes;
+    readonly executor: EvidenceExecutor;
+    readonly toolCallId?: string;
+    readonly commandRedaction?: CommandRedactionSummary;
+    readonly commandBinding?: CommandHmacBinding;
+}
+export type CreateEvidenceReceiptInput = EvidenceReceiptCoreInputFields & EvidenceReceiptDisposition & {
+    readonly ledgerBinding?: EvidenceReceiptLedgerBinding;
+    readonly trustedAttestation?: TrustedEvidenceAttestation;
+};
+export interface EvidenceReceiptEnvelopeMetadata {
+    readonly ledgerBinding?: EvidenceReceiptLedgerBinding;
+    readonly trustedAttestation?: TrustedEvidenceAttestation;
+}
+export declare function isSha256Hex(value: unknown): value is Sha256Hex;
+export declare function parseSha256Hex(value: unknown, label?: string): Sha256Hex;
+/** Decode validated hex before comparing, avoiding string timing and malformed-buffer pitfalls. */
+export declare function constantTimeSha256Equal(left: unknown, right: unknown): boolean;
+export declare function isSafeEvidenceReceiptId(value: unknown): value is string;
+/** Strict shape parser for immutable receipt core data. */
+export declare function parseEvidenceReceiptCore(value: unknown): EvidenceReceiptCore;
+export declare function serializeEvidenceReceiptCore(core: EvidenceReceiptCore): string;
+/** Domain-separated SHA-256 of one exact, credential-free structured command descriptor. */
+export declare function computeEvidenceCommandSha256(command: EvidenceCommandDescriptor): Sha256Hex;
+/** Domain-separated SHA-256 of the immutable canonical core only. */
+export declare function computeEvidenceReceiptCoreSha256(core: EvidenceReceiptCore): Sha256Hex;
+/** Strict shape and digest validation for an already-decoded receipt value. */
+export declare function validateEvidenceReceipt(value: unknown): EvidenceReceipt;
+export declare function parseEvidenceReceipt(serialized: string): EvidenceReceipt;
+export declare function serializeEvidenceReceipt(receipt: EvidenceReceipt): string;
+export declare function verifyEvidenceReceiptCoreDigest(receipt: EvidenceReceipt): boolean;
+/** Build a receipt from caller-supplied execution facts without executing a command or activating a gate. */
+export declare function createEvidenceReceipt(input: CreateEvidenceReceiptInput): EvidenceReceipt;
+/** Attach non-core metadata after a ledger commits {receiptId, coreSha256}. */
+export declare function withEvidenceReceiptEnvelope(receipt: EvidenceReceipt, metadata: EvidenceReceiptEnvelopeMetadata): EvidenceReceipt;
+export declare function evidenceReceiptReplayPayload(receipt: EvidenceReceipt): EvidenceReceiptReplayPayload;
+//# sourceMappingURL=evidence-receipt.d.ts.map

package/dist/guardrails/evidence-receipt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence-receipt.d.ts","sourceRoot":"","sources":["../../src/guardrails/evidence-receipt.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,kBAAkB,EAClB,uBAAuB,EACvB,yBAAyB,EACzB,gBAAgB,EAEhB,eAAe,EACf,mBAAmB,EAEnB,0BAA0B,EAE1B,4BAA4B,EAC5B,4BAA4B,EAC5B,SAAS,EACT,0BAA0B,EAC1B,oBAAoB,EACpB,MAAM,sBAAsB,CAAC;AAgB9B,6EAA6E;AAC7E,eAAO,MAAM,iCAAiC,QAAY,CAAC;AAE3D,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC5B;AAED,MAAM,WAAW,8BAA8B;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAC5C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,eAAe,EAAE,oBAAoB,CAAC;IAC/C,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAC9C,QAAQ,CAAC,qBAAqB,EAAE,0BAA0B,CAAC;IAC3D,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IACpD,QAAQ,CAAC,cAAc,CAAC,EAAE,kBAAkB,CAAC;CAC7C;AAED,MAAM,MAAM,0BAA0B,GAAG,8BAA8B,GACtE,0BAA0B,GAAG;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,4BAA4B,CAAC;IACtD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;CACzD,CAAC;AAEH,MAAM,WAAW,+BAA+B;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,4BAA4B,CAAC;IACtD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;CACzD;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAE9D;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAW,GAAG,SAAS,CAK1E;AAED,mGAAmG;AACnG,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAG9E;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEvE;AAwHD,2DAA2D;AAC3D,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,CAgF5E;AAgBD,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAE9E;AAED,4FAA4F;AAC5F,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,yBAAyB,GAAG,SAAS,CAK1F;AAED,qEAAqE;AACrE,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,mBAAmB,GAAG,SAAS,CAKrF;AAmCD,+EAA+E;AAC/E,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CASvE;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CASxE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,CAEzE;AAED,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAOjF;AA+BD,6GAA6G;AAC7G,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,0BAA0B,GAAG,eAAe,CA8BxF;AAED,+EAA+E;AAC/E,wBAAgB,2BAA2B,CAC1C,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,+BAA+B,GACvC,eAAe,CAUjB;AAED,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,eAAe,GAAG,4BAA4B,CAMnG","sourcesContent":["import { createHash, timingSafeEqual } from \"node:crypto\";\nimport type {\n\tCommandHmacBinding,\n\tCommandRedactionSummary,\n\tEvidenceCommandDescriptor,\n\tEvidenceExecutor,\n\tEvidenceOutputCapture,\n\tEvidenceReceipt,\n\tEvidenceReceiptCore,\n\tEvidenceReceiptCoreFields,\n\tEvidenceReceiptDisposition,\n\tEvidenceReceiptEnvelope,\n\tEvidenceReceiptLedgerBinding,\n\tEvidenceReceiptReplayPayload,\n\tSha256Hex,\n\tTrustedEvidenceAttestation,\n\tWorkspaceFingerprint,\n} from \"../types/evidence.ts\";\nimport {\n\tassertCredentialFreeEvidenceCommand,\n\tparseCommandHmacBinding,\n\tparseCommandRedactionSummary,\n\tparseEvidenceCommandShape,\n} from \"./command-redaction.ts\";\nimport { parseWorkspaceFingerprint } from \"./workspace-fingerprint.ts\";\n\nconst SHA256_HEX = /^[0-9a-f]{64}$/;\nconst SAFE_RECEIPT_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;\nconst CORE_DIGEST_DOMAIN = \"omk:evidence:receipt-v3:core\\0\";\nconst COMMAND_DIGEST_DOMAIN = \"omk:evidence:receipt-v3:command\\0\";\nconst EXECUTORS: ReadonlySet<string> = new Set([\"bash-tool\", \"ci-runner\", \"mcp\", \"internal\"]);\nconst ISO_TIMESTAMP = /^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$/;\n\n/** Combined stdout/stderr bytes accepted from an already-redacted caller. */\nexport const MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES = 64 * 1024;\n\nexport interface AlreadyRedactedOutputBytes {\n\treadonly redactionPolicyId: string;\n\treadonly stdout: Uint8Array;\n\treadonly stderr: Uint8Array;\n}\n\nexport interface EvidenceReceiptCoreInputFields {\n\treadonly receiptId: string;\n\treadonly goalId: string;\n\treadonly laneId?: string;\n\treadonly claim: string;\n\treadonly command: EvidenceCommandDescriptor;\n\treadonly cwd: string;\n\treadonly timeoutMs: number | null;\n\treadonly startedAt: string;\n\treadonly finishedAt: string;\n\treadonly durationMs: number;\n\treadonly workspaceBefore: WorkspaceFingerprint;\n\treadonly workspaceAfter: WorkspaceFingerprint;\n\treadonly alreadyRedactedOutput: AlreadyRedactedOutputBytes;\n\treadonly executor: EvidenceExecutor;\n\treadonly toolCallId?: string;\n\treadonly commandRedaction?: CommandRedactionSummary;\n\treadonly commandBinding?: CommandHmacBinding;\n}\n\nexport type CreateEvidenceReceiptInput = EvidenceReceiptCoreInputFields &\n\tEvidenceReceiptDisposition & {\n\t\treadonly ledgerBinding?: EvidenceReceiptLedgerBinding;\n\t\treadonly trustedAttestation?: TrustedEvidenceAttestation;\n\t};\n\nexport interface EvidenceReceiptEnvelopeMetadata {\n\treadonly ledgerBinding?: EvidenceReceiptLedgerBinding;\n\treadonly trustedAttestation?: TrustedEvidenceAttestation;\n}\n\nexport function isSha256Hex(value: unknown): value is Sha256Hex {\n\treturn typeof value === \"string\" && SHA256_HEX.test(value);\n}\n\nexport function parseSha256Hex(value: unknown, label = \"digest\"): Sha256Hex {\n\tif (!isSha256Hex(value)) {\n\t\tthrow new Error(`${label} must be exactly 64 lowercase SHA-256 hexadecimal characters`);\n\t}\n\treturn value;\n}\n\n/** Decode validated hex before comparing, avoiding string timing and malformed-buffer pitfalls. */\nexport function constantTimeSha256Equal(left: unknown, right: unknown): boolean {\n\tif (!isSha256Hex(left) || !isSha256Hex(right)) return false;\n\treturn timingSafeEqual(Buffer.from(left, \"hex\"), Buffer.from(right, \"hex\"));\n}\n\nexport function isSafeEvidenceReceiptId(value: unknown): value is string {\n\treturn typeof value === \"string\" && SAFE_RECEIPT_ID.test(value);\n}\n\nfunction exactObject(\n\tvalue: unknown,\n\tlabel: string,\n\trequiredKeys: readonly string[],\n\toptionalKeys: readonly string[] = [],\n): Record<string, unknown> {\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n\t\tthrow new Error(`${label} must be an object`);\n\t}\n\tconst record = value as Record<string, unknown>;\n\tconst descriptors = Object.getOwnPropertyDescriptors(record);\n\tconst actual = Object.entries(descriptors)\n\t\t.filter(([, descriptor]) => descriptor.enumerable)\n\t\t.map(([key]) => key)\n\t\t.sort();\n\tconst allowed = new Set([...requiredKeys, ...optionalKeys]);\n\tconst isOwnEnumerableDataProperty = (key: string): boolean => {\n\t\tconst descriptor = descriptors[key];\n\t\treturn descriptor !== undefined && descriptor.enumerable === true && \"value\" in descriptor;\n\t};\n\tif (\n\t\tactual.some((key) => !allowed.has(key)) ||\n\t\trequiredKeys.some((key) => !isOwnEnumerableDataProperty(key)) ||\n\t\toptionalKeys.some((key) => key in record && !isOwnEnumerableDataProperty(key))\n\t) {\n\t\tthrow new Error(`${label} has an invalid key set`);\n\t}\n\tconst snapshot: Record<string, unknown> = {};\n\tfor (const key of actual) {\n\t\tconst descriptor = descriptors[key];\n\t\tif (descriptor === undefined || !(\"value\" in descriptor)) {\n\t\t\tthrow new Error(`${label} has an invalid key set`);\n\t\t}\n\t\tsnapshot[key] = descriptor.value;\n\t}\n\treturn snapshot;\n}\n\nfunction nonEmptyString(value: unknown, label: string): string {\n\tif (typeof value !== \"string\" || value.length === 0 || value.includes(\"\\0\")) {\n\t\tthrow new Error(`${label} must be a non-empty string without NUL bytes`);\n\t}\n\treturn value;\n}\n\nfunction optionalNonEmptyString(value: unknown, label: string): string | undefined {\n\treturn value === undefined ? undefined : nonEmptyString(value, label);\n}\n\nfunction safeNonNegativeInteger(value: unknown, label: string): number {\n\tif (!Number.isSafeInteger(value) || (value as number) < 0) {\n\t\tthrow new Error(`${label} must be a non-negative safe integer`);\n\t}\n\treturn value as number;\n}\n\nfunction positiveInteger(value: unknown, label: string): number {\n\tif (!Number.isSafeInteger(value) || (value as number) <= 0) {\n\t\tthrow new Error(`${label} must be a positive safe integer`);\n\t}\n\treturn value as number;\n}\n\nfunction timestamp(value: unknown, label: string): string {\n\tconst parsed = nonEmptyString(value, label);\n\tif (!ISO_TIMESTAMP.test(parsed) || Number.isNaN(Date.parse(parsed))) {\n\t\tthrow new Error(`${label} must be a canonical ISO-8601 timestamp`);\n\t}\n\treturn parsed;\n}\n\n/** Strict structural parse plus the credential-free policy for persisted commands. */\nfunction parseCommand(value: unknown): EvidenceCommandDescriptor {\n\tconst command = parseEvidenceCommandShape(value);\n\tassertCredentialFreeEvidenceCommand(command);\n\treturn command;\n}\n\nfunction parseOutputDigest(value: unknown, label: string): EvidenceOutputCapture[\"stdout\"] {\n\tconst raw = exactObject(value, label, [\"sha256\", \"byteCount\"]);\n\treturn Object.freeze({\n\t\tsha256: parseSha256Hex(raw.sha256, `${label}.sha256`),\n\t\tbyteCount: safeNonNegativeInteger(raw.byteCount, `${label}.byteCount`),\n\t});\n}\n\nfunction parseOutput(value: unknown): EvidenceOutputCapture {\n\tconst raw = exactObject(value, \"receipt output\", [\"redactionPolicyId\", \"stdout\", \"stderr\"]);\n\tconst redactionPolicyId = nonEmptyString(raw.redactionPolicyId, \"receipt output redactionPolicyId\");\n\tif (redactionPolicyId.length > 256) {\n\t\tthrow new Error(\"receipt output redactionPolicyId is too long\");\n\t}\n\tconst stdout = parseOutputDigest(raw.stdout, \"receipt stdout\");\n\tconst stderr = parseOutputDigest(raw.stderr, \"receipt stderr\");\n\tif (stdout.byteCount + stderr.byteCount > MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES) {\n\t\tthrow new Error(`receipt output exceeds ${MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES} bytes`);\n\t}\n\treturn Object.freeze({ redactionPolicyId, stdout, stderr });\n}\n\nfunction parseDisposition(status: unknown, exitCode: unknown): EvidenceReceiptDisposition {\n\tif (status === \"passed\") {\n\t\tif (exitCode !== 0) throw new Error(\"passed receipt status requires exitCode 0\");\n\t\treturn Object.freeze({ status, exitCode: 0 });\n\t}\n\tif (status === \"failed\") {\n\t\tif (!Number.isSafeInteger(exitCode) || exitCode === 0) {\n\t\t\tthrow new Error(\"failed receipt status requires a non-zero integer exitCode\");\n\t\t}\n\t\treturn Object.freeze({ status, exitCode: exitCode as number });\n\t}\n\tif (status === \"timeout\" || status === \"aborted\") {\n\t\tif (exitCode !== null) throw new Error(`${status} receipt status requires a null exitCode`);\n\t\treturn Object.freeze({ status, exitCode: null });\n\t}\n\tthrow new Error(\"receipt status must be passed, failed, timeout, or aborted\");\n}\n\n/** Strict shape parser for immutable receipt core data. */\nexport function parseEvidenceReceiptCore(value: unknown): EvidenceReceiptCore {\n\tconst raw = exactObject(\n\t\tvalue,\n\t\t\"receipt core\",\n\t\t[\n\t\t\t\"schemaVersion\",\n\t\t\t\"receiptId\",\n\t\t\t\"goalId\",\n\t\t\t\"claim\",\n\t\t\t\"command\",\n\t\t\t\"cwd\",\n\t\t\t\"timeoutMs\",\n\t\t\t\"startedAt\",\n\t\t\t\"finishedAt\",\n\t\t\t\"durationMs\",\n\t\t\t\"status\",\n\t\t\t\"exitCode\",\n\t\t\t\"workspaceBefore\",\n\t\t\t\"workspaceAfter\",\n\t\t\t\"output\",\n\t\t\t\"executor\",\n\t\t],\n\t\t[\"laneId\", \"toolCallId\", \"commandRedaction\", \"commandBinding\"],\n\t);\n\tif (raw.schemaVersion !== 3) throw new Error(\"receipt core schemaVersion must be 3\");\n\tif (!isSafeEvidenceReceiptId(raw.receiptId)) throw new Error(\"receiptId is not safe\");\n\tconst goalId = nonEmptyString(raw.goalId, \"receipt core goalId\");\n\tconst laneId = optionalNonEmptyString(raw.laneId, \"receipt core laneId\");\n\tconst claim = nonEmptyString(raw.claim, \"receipt core claim\");\n\tconst command = parseCommand(raw.command);\n\tconst cwd = nonEmptyString(raw.cwd, \"receipt core cwd\");\n\tconst timeoutMs = raw.timeoutMs === null ? null : positiveInteger(raw.timeoutMs, \"receipt core timeoutMs\");\n\tconst startedAt = timestamp(raw.startedAt, \"receipt core startedAt\");\n\tconst finishedAt = timestamp(raw.finishedAt, \"receipt core finishedAt\");\n\tif (Date.parse(finishedAt) < Date.parse(startedAt)) {\n\t\tthrow new Error(\"receipt core finishedAt must not precede startedAt\");\n\t}\n\tconst durationMs = safeNonNegativeInteger(raw.durationMs, \"receipt core durationMs\");\n\tif (durationMs !== Date.parse(finishedAt) - Date.parse(startedAt)) {\n\t\tthrow new Error(\"receipt core durationMs must match the timestamp interval\");\n\t}\n\tconst workspaceBefore = parseWorkspaceFingerprint(raw.workspaceBefore);\n\tconst workspaceAfter = parseWorkspaceFingerprint(raw.workspaceAfter);\n\tconst output = parseOutput(raw.output);\n\tif (typeof raw.executor !== \"string\" || !EXECUTORS.has(raw.executor)) {\n\t\tthrow new Error(\"receipt core executor is invalid\");\n\t}\n\tconst executor = raw.executor as EvidenceExecutor;\n\tconst toolCallId = optionalNonEmptyString(raw.toolCallId, \"receipt core toolCallId\");\n\tconst commandRedaction =\n\t\traw.commandRedaction === undefined ? undefined : parseCommandRedactionSummary(raw.commandRedaction);\n\tconst commandBinding = raw.commandBinding === undefined ? undefined : parseCommandHmacBinding(raw.commandBinding);\n\tif (commandBinding !== undefined && commandRedaction === undefined) {\n\t\tthrow new Error(\"receipt core commandBinding requires commandRedaction\");\n\t}\n\tif (commandRedaction !== undefined && commandRedaction.placeholders.length > 0 && commandBinding === undefined) {\n\t\tthrow new Error(\"receipt core commandRedaction with applied placeholders requires commandBinding\");\n\t}\n\tconst disposition = parseDisposition(raw.status, raw.exitCode);\n\tconst fields: EvidenceReceiptCoreFields = {\n\t\tschemaVersion: 3,\n\t\treceiptId: raw.receiptId,\n\t\tgoalId,\n\t\t...(laneId !== undefined ? { laneId } : {}),\n\t\tclaim,\n\t\tcommand,\n\t\tcwd,\n\t\ttimeoutMs,\n\t\tstartedAt,\n\t\tfinishedAt,\n\t\tdurationMs,\n\t\tworkspaceBefore,\n\t\tworkspaceAfter,\n\t\toutput,\n\t\texecutor,\n\t\t...(toolCallId !== undefined ? { toolCallId } : {}),\n\t\t...(commandRedaction !== undefined ? { commandRedaction } : {}),\n\t\t...(commandBinding !== undefined ? { commandBinding } : {}),\n\t};\n\treturn Object.freeze({ ...fields, ...disposition });\n}\n\nfunction canonicalJson(value: unknown): string {\n\tif (value === null || typeof value === \"boolean\" || typeof value === \"string\") return JSON.stringify(value);\n\tif (typeof value === \"number\") {\n\t\tif (!Number.isFinite(value) || Object.is(value, -0))\n\t\t\tthrow new Error(\"canonical JSON requires finite non-negative-zero numbers\");\n\t\treturn JSON.stringify(value);\n\t}\n\tif (Array.isArray(value)) return `[${value.map((item) => canonicalJson(item)).join(\",\")}]`;\n\tif (typeof value !== \"object\" || value === null) throw new Error(\"value is not canonical JSON data\");\n\tconst record = value as Record<string, unknown>;\n\tconst keys = Object.keys(record).sort();\n\treturn `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(\",\")}}`;\n}\n\nexport function serializeEvidenceReceiptCore(core: EvidenceReceiptCore): string {\n\treturn canonicalJson(parseEvidenceReceiptCore(core));\n}\n\n/** Domain-separated SHA-256 of one exact, credential-free structured command descriptor. */\nexport function computeEvidenceCommandSha256(command: EvidenceCommandDescriptor): Sha256Hex {\n\treturn createHash(\"sha256\")\n\t\t.update(COMMAND_DIGEST_DOMAIN, \"utf8\")\n\t\t.update(canonicalJson(parseCommand(command)), \"utf8\")\n\t\t.digest(\"hex\") as Sha256Hex;\n}\n\n/** Domain-separated SHA-256 of the immutable canonical core only. */\nexport function computeEvidenceReceiptCoreSha256(core: EvidenceReceiptCore): Sha256Hex {\n\treturn createHash(\"sha256\")\n\t\t.update(CORE_DIGEST_DOMAIN, \"utf8\")\n\t\t.update(serializeEvidenceReceiptCore(core), \"utf8\")\n\t\t.digest(\"hex\") as Sha256Hex;\n}\n\nfunction parseLedgerBinding(value: unknown): EvidenceReceiptLedgerBinding {\n\tconst raw = exactObject(value, \"receipt ledger binding\", [\"seq\", \"eventHash\"]);\n\treturn Object.freeze({\n\t\tseq: positiveInteger(raw.seq, \"receipt ledger seq\"),\n\t\teventHash: parseSha256Hex(raw.eventHash, \"receipt ledger eventHash\"),\n\t});\n}\n\nfunction parseTrustedAttestation(value: unknown): TrustedEvidenceAttestation {\n\tconst raw = exactObject(value, \"trusted attestation\", [\"attesterId\", \"keyId\", \"algorithm\", \"signature\", \"issuedAt\"]);\n\tif (raw.algorithm !== \"ed25519\") throw new Error(\"trusted attestation algorithm must be ed25519\");\n\treturn Object.freeze({\n\t\tattesterId: nonEmptyString(raw.attesterId, \"trusted attestation attesterId\"),\n\t\tkeyId: nonEmptyString(raw.keyId, \"trusted attestation keyId\"),\n\t\talgorithm: \"ed25519\",\n\t\tsignature: nonEmptyString(raw.signature, \"trusted attestation signature\"),\n\t\tissuedAt: timestamp(raw.issuedAt, \"trusted attestation issuedAt\"),\n\t});\n}\n\nfunction parseEnvelope(value: unknown): EvidenceReceiptEnvelope {\n\tconst raw = exactObject(value, \"receipt envelope\", [\"coreSha256\"], [\"ledgerBinding\", \"trustedAttestation\"]);\n\tconst coreSha256 = parseSha256Hex(raw.coreSha256, \"receipt envelope coreSha256\");\n\tconst ledgerBinding = raw.ledgerBinding === undefined ? undefined : parseLedgerBinding(raw.ledgerBinding);\n\tconst trustedAttestation =\n\t\traw.trustedAttestation === undefined ? undefined : parseTrustedAttestation(raw.trustedAttestation);\n\treturn Object.freeze({\n\t\tcoreSha256,\n\t\t...(ledgerBinding !== undefined ? { ledgerBinding } : {}),\n\t\t...(trustedAttestation !== undefined ? { trustedAttestation } : {}),\n\t});\n}\n\n/** Strict shape and digest validation for an already-decoded receipt value. */\nexport function validateEvidenceReceipt(value: unknown): EvidenceReceipt {\n\tconst raw = exactObject(value, \"evidence receipt\", [\"core\", \"envelope\"]);\n\tconst core = parseEvidenceReceiptCore(raw.core);\n\tconst envelope = parseEnvelope(raw.envelope);\n\tconst expected = computeEvidenceReceiptCoreSha256(core);\n\tif (!constantTimeSha256Equal(expected, envelope.coreSha256)) {\n\t\tthrow new Error(\"evidence receipt core digest mismatch\");\n\t}\n\treturn Object.freeze({ core, envelope });\n}\n\nexport function parseEvidenceReceipt(serialized: string): EvidenceReceipt {\n\tif (typeof serialized !== \"string\") throw new Error(\"serialized evidence receipt must be a string\");\n\tlet value: unknown;\n\ttry {\n\t\tvalue = JSON.parse(serialized);\n\t} catch {\n\t\tthrow new Error(\"evidence receipt contains invalid JSON\");\n\t}\n\treturn validateEvidenceReceipt(value);\n}\n\nexport function serializeEvidenceReceipt(receipt: EvidenceReceipt): string {\n\treturn canonicalJson(validateEvidenceReceipt(receipt));\n}\n\nexport function verifyEvidenceReceiptCoreDigest(receipt: EvidenceReceipt): boolean {\n\ttry {\n\t\tconst validated = validateEvidenceReceipt(receipt);\n\t\treturn constantTimeSha256Equal(computeEvidenceReceiptCoreSha256(validated.core), validated.envelope.coreSha256);\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nfunction assertByteArray(value: unknown, label: string): asserts value is Uint8Array {\n\tif (!(value instanceof Uint8Array)) throw new Error(`${label} must be a Uint8Array of already-redacted bytes`);\n}\n\nfunction outputCapture(output: AlreadyRedactedOutputBytes): EvidenceOutputCapture {\n\tif (typeof output !== \"object\" || output === null || Array.isArray(output)) {\n\t\tthrow new Error(\"alreadyRedactedOutput must be an object\");\n\t}\n\tconst redactionPolicyId = nonEmptyString(output.redactionPolicyId, \"redaction policy id\");\n\tif (redactionPolicyId.length > 256) throw new Error(\"redaction policy id is too long\");\n\tassertByteArray(output.stdout, \"already-redacted stdout\");\n\tassertByteArray(output.stderr, \"already-redacted stderr\");\n\tconst byteCount = output.stdout.byteLength + output.stderr.byteLength;\n\tif (!Number.isSafeInteger(byteCount) || byteCount > MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES) {\n\t\tthrow new Error(`receipt output exceeds ${MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES} bytes`);\n\t}\n\treturn Object.freeze({\n\t\tredactionPolicyId,\n\t\tstdout: Object.freeze({\n\t\t\tsha256: createHash(\"sha256\").update(output.stdout).digest(\"hex\") as Sha256Hex,\n\t\t\tbyteCount: output.stdout.byteLength,\n\t\t}),\n\t\tstderr: Object.freeze({\n\t\t\tsha256: createHash(\"sha256\").update(output.stderr).digest(\"hex\") as Sha256Hex,\n\t\t\tbyteCount: output.stderr.byteLength,\n\t\t}),\n\t});\n}\n\n/** Build a receipt from caller-supplied execution facts without executing a command or activating a gate. */\nexport function createEvidenceReceipt(input: CreateEvidenceReceiptInput): EvidenceReceipt {\n\tconst output = outputCapture(input.alreadyRedactedOutput);\n\tconst core = parseEvidenceReceiptCore({\n\t\tschemaVersion: 3,\n\t\treceiptId: input.receiptId,\n\t\tgoalId: input.goalId,\n\t\t...(input.laneId !== undefined ? { laneId: input.laneId } : {}),\n\t\tclaim: input.claim,\n\t\tcommand: input.command,\n\t\tcwd: input.cwd,\n\t\ttimeoutMs: input.timeoutMs,\n\t\tstartedAt: input.startedAt,\n\t\tfinishedAt: input.finishedAt,\n\t\tdurationMs: input.durationMs,\n\t\tstatus: input.status,\n\t\texitCode: input.exitCode,\n\t\tworkspaceBefore: input.workspaceBefore,\n\t\tworkspaceAfter: input.workspaceAfter,\n\t\toutput,\n\t\texecutor: input.executor,\n\t\t...(input.toolCallId !== undefined ? { toolCallId: input.toolCallId } : {}),\n\t\t...(input.commandRedaction !== undefined ? { commandRedaction: input.commandRedaction } : {}),\n\t\t...(input.commandBinding !== undefined ? { commandBinding: input.commandBinding } : {}),\n\t});\n\tconst envelope: EvidenceReceiptEnvelope = {\n\t\tcoreSha256: computeEvidenceReceiptCoreSha256(core),\n\t\t...(input.ledgerBinding !== undefined ? { ledgerBinding: input.ledgerBinding } : {}),\n\t\t...(input.trustedAttestation !== undefined ? { trustedAttestation: input.trustedAttestation } : {}),\n\t};\n\treturn validateEvidenceReceipt({ core, envelope });\n}\n\n/** Attach non-core metadata after a ledger commits {receiptId, coreSha256}. */\nexport function withEvidenceReceiptEnvelope(\n\treceipt: EvidenceReceipt,\n\tmetadata: EvidenceReceiptEnvelopeMetadata,\n): EvidenceReceipt {\n\tconst validated = validateEvidenceReceipt(receipt);\n\treturn validateEvidenceReceipt({\n\t\tcore: validated.core,\n\t\tenvelope: {\n\t\t\tcoreSha256: validated.envelope.coreSha256,\n\t\t\t...(metadata.ledgerBinding !== undefined ? { ledgerBinding: metadata.ledgerBinding } : {}),\n\t\t\t...(metadata.trustedAttestation !== undefined ? { trustedAttestation: metadata.trustedAttestation } : {}),\n\t\t},\n\t});\n}\n\nexport function evidenceReceiptReplayPayload(receipt: EvidenceReceipt): EvidenceReceiptReplayPayload {\n\tconst validated = validateEvidenceReceipt(receipt);\n\treturn Object.freeze({\n\t\treceiptId: validated.core.receiptId,\n\t\tcoreSha256: validated.envelope.coreSha256,\n\t});\n}\n"]}