open-multi-agent-kit 0.90.8 → 0.90.9

package/dist/guardrails/evidence-receipt.js

@@ -0,0 +1,389 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+import { assertCredentialFreeEvidenceCommand, parseCommandHmacBinding, parseCommandRedactionSummary, parseEvidenceCommandShape, } from "./command-redaction.js";
+import { parseWorkspaceFingerprint } from "./workspace-fingerprint.js";
+const SHA256_HEX = /^[0-9a-f]{64}$/;
+const SAFE_RECEIPT_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const CORE_DIGEST_DOMAIN = "omk:evidence:receipt-v3:core\0";
+const COMMAND_DIGEST_DOMAIN = "omk:evidence:receipt-v3:command\0";
+const EXECUTORS = new Set(["bash-tool", "ci-runner", "mcp", "internal"]);
+const ISO_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+/** Combined stdout/stderr bytes accepted from an already-redacted caller. */
+export const MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES = 64 * 1024;
+export function isSha256Hex(value) {
+    return typeof value === "string" && SHA256_HEX.test(value);
+}
+export function parseSha256Hex(value, label = "digest") {
+    if (!isSha256Hex(value)) {
+        throw new Error(`${label} must be exactly 64 lowercase SHA-256 hexadecimal characters`);
+    }
+    return value;
+}
+/** Decode validated hex before comparing, avoiding string timing and malformed-buffer pitfalls. */
+export function constantTimeSha256Equal(left, right) {
+    if (!isSha256Hex(left) || !isSha256Hex(right))
+        return false;
+    return timingSafeEqual(Buffer.from(left, "hex"), Buffer.from(right, "hex"));
+}
+export function isSafeEvidenceReceiptId(value) {
+    return typeof value === "string" && SAFE_RECEIPT_ID.test(value);
+}
+function exactObject(value, label, requiredKeys, optionalKeys = []) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new Error(`${label} must be an object`);
+    }
+    const record = value;
+    const descriptors = Object.getOwnPropertyDescriptors(record);
+    const actual = Object.entries(descriptors)
+        .filter(([, descriptor]) => descriptor.enumerable)
+        .map(([key]) => key)
+        .sort();
+    const allowed = new Set([...requiredKeys, ...optionalKeys]);
+    const isOwnEnumerableDataProperty = (key) => {
+        const descriptor = descriptors[key];
+        return descriptor !== undefined && descriptor.enumerable === true && "value" in descriptor;
+    };
+    if (actual.some((key) => !allowed.has(key)) ||
+        requiredKeys.some((key) => !isOwnEnumerableDataProperty(key)) ||
+        optionalKeys.some((key) => key in record && !isOwnEnumerableDataProperty(key))) {
+        throw new Error(`${label} has an invalid key set`);
+    }
+    const snapshot = {};
+    for (const key of actual) {
+        const descriptor = descriptors[key];
+        if (descriptor === undefined || !("value" in descriptor)) {
+            throw new Error(`${label} has an invalid key set`);
+        }
+        snapshot[key] = descriptor.value;
+    }
+    return snapshot;
+}
+function nonEmptyString(value, label) {
+    if (typeof value !== "string" || value.length === 0 || value.includes("\0")) {
+        throw new Error(`${label} must be a non-empty string without NUL bytes`);
+    }
+    return value;
+}
+function optionalNonEmptyString(value, label) {
+    return value === undefined ? undefined : nonEmptyString(value, label);
+}
+function safeNonNegativeInteger(value, label) {
+    if (!Number.isSafeInteger(value) || value < 0) {
+        throw new Error(`${label} must be a non-negative safe integer`);
+    }
+    return value;
+}
+function positiveInteger(value, label) {
+    if (!Number.isSafeInteger(value) || value <= 0) {
+        throw new Error(`${label} must be a positive safe integer`);
+    }
+    return value;
+}
+function timestamp(value, label) {
+    const parsed = nonEmptyString(value, label);
+    if (!ISO_TIMESTAMP.test(parsed) || Number.isNaN(Date.parse(parsed))) {
+        throw new Error(`${label} must be a canonical ISO-8601 timestamp`);
+    }
+    return parsed;
+}
+/** Strict structural parse plus the credential-free policy for persisted commands. */
+function parseCommand(value) {
+    const command = parseEvidenceCommandShape(value);
+    assertCredentialFreeEvidenceCommand(command);
+    return command;
+}
+function parseOutputDigest(value, label) {
+    const raw = exactObject(value, label, ["sha256", "byteCount"]);
+    return Object.freeze({
+        sha256: parseSha256Hex(raw.sha256, `${label}.sha256`),
+        byteCount: safeNonNegativeInteger(raw.byteCount, `${label}.byteCount`),
+    });
+}
+function parseOutput(value) {
+    const raw = exactObject(value, "receipt output", ["redactionPolicyId", "stdout", "stderr"]);
+    const redactionPolicyId = nonEmptyString(raw.redactionPolicyId, "receipt output redactionPolicyId");
+    if (redactionPolicyId.length > 256) {
+        throw new Error("receipt output redactionPolicyId is too long");
+    }
+    const stdout = parseOutputDigest(raw.stdout, "receipt stdout");
+    const stderr = parseOutputDigest(raw.stderr, "receipt stderr");
+    if (stdout.byteCount + stderr.byteCount > MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES) {
+        throw new Error(`receipt output exceeds ${MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES} bytes`);
+    }
+    return Object.freeze({ redactionPolicyId, stdout, stderr });
+}
+function parseDisposition(status, exitCode) {
+    if (status === "passed") {
+        if (exitCode !== 0)
+            throw new Error("passed receipt status requires exitCode 0");
+        return Object.freeze({ status, exitCode: 0 });
+    }
+    if (status === "failed") {
+        if (!Number.isSafeInteger(exitCode) || exitCode === 0) {
+            throw new Error("failed receipt status requires a non-zero integer exitCode");
+        }
+        return Object.freeze({ status, exitCode: exitCode });
+    }
+    if (status === "timeout" || status === "aborted") {
+        if (exitCode !== null)
+            throw new Error(`${status} receipt status requires a null exitCode`);
+        return Object.freeze({ status, exitCode: null });
+    }
+    throw new Error("receipt status must be passed, failed, timeout, or aborted");
+}
+/** Strict shape parser for immutable receipt core data. */
+export function parseEvidenceReceiptCore(value) {
+    const raw = exactObject(value, "receipt core", [
+        "schemaVersion",
+        "receiptId",
+        "goalId",
+        "claim",
+        "command",
+        "cwd",
+        "timeoutMs",
+        "startedAt",
+        "finishedAt",
+        "durationMs",
+        "status",
+        "exitCode",
+        "workspaceBefore",
+        "workspaceAfter",
+        "output",
+        "executor",
+    ], ["laneId", "toolCallId", "commandRedaction", "commandBinding"]);
+    if (raw.schemaVersion !== 3)
+        throw new Error("receipt core schemaVersion must be 3");
+    if (!isSafeEvidenceReceiptId(raw.receiptId))
+        throw new Error("receiptId is not safe");
+    const goalId = nonEmptyString(raw.goalId, "receipt core goalId");
+    const laneId = optionalNonEmptyString(raw.laneId, "receipt core laneId");
+    const claim = nonEmptyString(raw.claim, "receipt core claim");
+    const command = parseCommand(raw.command);
+    const cwd = nonEmptyString(raw.cwd, "receipt core cwd");
+    const timeoutMs = raw.timeoutMs === null ? null : positiveInteger(raw.timeoutMs, "receipt core timeoutMs");
+    const startedAt = timestamp(raw.startedAt, "receipt core startedAt");
+    const finishedAt = timestamp(raw.finishedAt, "receipt core finishedAt");
+    if (Date.parse(finishedAt) < Date.parse(startedAt)) {
+        throw new Error("receipt core finishedAt must not precede startedAt");
+    }
+    const durationMs = safeNonNegativeInteger(raw.durationMs, "receipt core durationMs");
+    if (durationMs !== Date.parse(finishedAt) - Date.parse(startedAt)) {
+        throw new Error("receipt core durationMs must match the timestamp interval");
+    }
+    const workspaceBefore = parseWorkspaceFingerprint(raw.workspaceBefore);
+    const workspaceAfter = parseWorkspaceFingerprint(raw.workspaceAfter);
+    const output = parseOutput(raw.output);
+    if (typeof raw.executor !== "string" || !EXECUTORS.has(raw.executor)) {
+        throw new Error("receipt core executor is invalid");
+    }
+    const executor = raw.executor;
+    const toolCallId = optionalNonEmptyString(raw.toolCallId, "receipt core toolCallId");
+    const commandRedaction = raw.commandRedaction === undefined ? undefined : parseCommandRedactionSummary(raw.commandRedaction);
+    const commandBinding = raw.commandBinding === undefined ? undefined : parseCommandHmacBinding(raw.commandBinding);
+    if (commandBinding !== undefined && commandRedaction === undefined) {
+        throw new Error("receipt core commandBinding requires commandRedaction");
+    }
+    if (commandRedaction !== undefined && commandRedaction.placeholders.length > 0 && commandBinding === undefined) {
+        throw new Error("receipt core commandRedaction with applied placeholders requires commandBinding");
+    }
+    const disposition = parseDisposition(raw.status, raw.exitCode);
+    const fields = {
+        schemaVersion: 3,
+        receiptId: raw.receiptId,
+        goalId,
+        ...(laneId !== undefined ? { laneId } : {}),
+        claim,
+        command,
+        cwd,
+        timeoutMs,
+        startedAt,
+        finishedAt,
+        durationMs,
+        workspaceBefore,
+        workspaceAfter,
+        output,
+        executor,
+        ...(toolCallId !== undefined ? { toolCallId } : {}),
+        ...(commandRedaction !== undefined ? { commandRedaction } : {}),
+        ...(commandBinding !== undefined ? { commandBinding } : {}),
+    };
+    return Object.freeze({ ...fields, ...disposition });
+}
+function canonicalJson(value) {
+    if (value === null || typeof value === "boolean" || typeof value === "string")
+        return JSON.stringify(value);
+    if (typeof value === "number") {
+        if (!Number.isFinite(value) || Object.is(value, -0))
+            throw new Error("canonical JSON requires finite non-negative-zero numbers");
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value))
+        return `[${value.map((item) => canonicalJson(item)).join(",")}]`;
+    if (typeof value !== "object" || value === null)
+        throw new Error("value is not canonical JSON data");
+    const record = value;
+    const keys = Object.keys(record).sort();
+    return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(",")}}`;
+}
+export function serializeEvidenceReceiptCore(core) {
+    return canonicalJson(parseEvidenceReceiptCore(core));
+}
+/** Domain-separated SHA-256 of one exact, credential-free structured command descriptor. */
+export function computeEvidenceCommandSha256(command) {
+    return createHash("sha256")
+        .update(COMMAND_DIGEST_DOMAIN, "utf8")
+        .update(canonicalJson(parseCommand(command)), "utf8")
+        .digest("hex");
+}
+/** Domain-separated SHA-256 of the immutable canonical core only. */
+export function computeEvidenceReceiptCoreSha256(core) {
+    return createHash("sha256")
+        .update(CORE_DIGEST_DOMAIN, "utf8")
+        .update(serializeEvidenceReceiptCore(core), "utf8")
+        .digest("hex");
+}
+function parseLedgerBinding(value) {
+    const raw = exactObject(value, "receipt ledger binding", ["seq", "eventHash"]);
+    return Object.freeze({
+        seq: positiveInteger(raw.seq, "receipt ledger seq"),
+        eventHash: parseSha256Hex(raw.eventHash, "receipt ledger eventHash"),
+    });
+}
+function parseTrustedAttestation(value) {
+    const raw = exactObject(value, "trusted attestation", ["attesterId", "keyId", "algorithm", "signature", "issuedAt"]);
+    if (raw.algorithm !== "ed25519")
+        throw new Error("trusted attestation algorithm must be ed25519");
+    return Object.freeze({
+        attesterId: nonEmptyString(raw.attesterId, "trusted attestation attesterId"),
+        keyId: nonEmptyString(raw.keyId, "trusted attestation keyId"),
+        algorithm: "ed25519",
+        signature: nonEmptyString(raw.signature, "trusted attestation signature"),
+        issuedAt: timestamp(raw.issuedAt, "trusted attestation issuedAt"),
+    });
+}
+function parseEnvelope(value) {
+    const raw = exactObject(value, "receipt envelope", ["coreSha256"], ["ledgerBinding", "trustedAttestation"]);
+    const coreSha256 = parseSha256Hex(raw.coreSha256, "receipt envelope coreSha256");
+    const ledgerBinding = raw.ledgerBinding === undefined ? undefined : parseLedgerBinding(raw.ledgerBinding);
+    const trustedAttestation = raw.trustedAttestation === undefined ? undefined : parseTrustedAttestation(raw.trustedAttestation);
+    return Object.freeze({
+        coreSha256,
+        ...(ledgerBinding !== undefined ? { ledgerBinding } : {}),
+        ...(trustedAttestation !== undefined ? { trustedAttestation } : {}),
+    });
+}
+/** Strict shape and digest validation for an already-decoded receipt value. */
+export function validateEvidenceReceipt(value) {
+    const raw = exactObject(value, "evidence receipt", ["core", "envelope"]);
+    const core = parseEvidenceReceiptCore(raw.core);
+    const envelope = parseEnvelope(raw.envelope);
+    const expected = computeEvidenceReceiptCoreSha256(core);
+    if (!constantTimeSha256Equal(expected, envelope.coreSha256)) {
+        throw new Error("evidence receipt core digest mismatch");
+    }
+    return Object.freeze({ core, envelope });
+}
+export function parseEvidenceReceipt(serialized) {
+    if (typeof serialized !== "string")
+        throw new Error("serialized evidence receipt must be a string");
+    let value;
+    try {
+        value = JSON.parse(serialized);
+    }
+    catch {
+        throw new Error("evidence receipt contains invalid JSON");
+    }
+    return validateEvidenceReceipt(value);
+}
+export function serializeEvidenceReceipt(receipt) {
+    return canonicalJson(validateEvidenceReceipt(receipt));
+}
+export function verifyEvidenceReceiptCoreDigest(receipt) {
+    try {
+        const validated = validateEvidenceReceipt(receipt);
+        return constantTimeSha256Equal(computeEvidenceReceiptCoreSha256(validated.core), validated.envelope.coreSha256);
+    }
+    catch {
+        return false;
+    }
+}
+function assertByteArray(value, label) {
+    if (!(value instanceof Uint8Array))
+        throw new Error(`${label} must be a Uint8Array of already-redacted bytes`);
+}
+function outputCapture(output) {
+    if (typeof output !== "object" || output === null || Array.isArray(output)) {
+        throw new Error("alreadyRedactedOutput must be an object");
+    }
+    const redactionPolicyId = nonEmptyString(output.redactionPolicyId, "redaction policy id");
+    if (redactionPolicyId.length > 256)
+        throw new Error("redaction policy id is too long");
+    assertByteArray(output.stdout, "already-redacted stdout");
+    assertByteArray(output.stderr, "already-redacted stderr");
+    const byteCount = output.stdout.byteLength + output.stderr.byteLength;
+    if (!Number.isSafeInteger(byteCount) || byteCount > MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES) {
+        throw new Error(`receipt output exceeds ${MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES} bytes`);
+    }
+    return Object.freeze({
+        redactionPolicyId,
+        stdout: Object.freeze({
+            sha256: createHash("sha256").update(output.stdout).digest("hex"),
+            byteCount: output.stdout.byteLength,
+        }),
+        stderr: Object.freeze({
+            sha256: createHash("sha256").update(output.stderr).digest("hex"),
+            byteCount: output.stderr.byteLength,
+        }),
+    });
+}
+/** Build a receipt from caller-supplied execution facts without executing a command or activating a gate. */
+export function createEvidenceReceipt(input) {
+    const output = outputCapture(input.alreadyRedactedOutput);
+    const core = parseEvidenceReceiptCore({
+        schemaVersion: 3,
+        receiptId: input.receiptId,
+        goalId: input.goalId,
+        ...(input.laneId !== undefined ? { laneId: input.laneId } : {}),
+        claim: input.claim,
+        command: input.command,
+        cwd: input.cwd,
+        timeoutMs: input.timeoutMs,
+        startedAt: input.startedAt,
+        finishedAt: input.finishedAt,
+        durationMs: input.durationMs,
+        status: input.status,
+        exitCode: input.exitCode,
+        workspaceBefore: input.workspaceBefore,
+        workspaceAfter: input.workspaceAfter,
+        output,
+        executor: input.executor,
+        ...(input.toolCallId !== undefined ? { toolCallId: input.toolCallId } : {}),
+        ...(input.commandRedaction !== undefined ? { commandRedaction: input.commandRedaction } : {}),
+        ...(input.commandBinding !== undefined ? { commandBinding: input.commandBinding } : {}),
+    });
+    const envelope = {
+        coreSha256: computeEvidenceReceiptCoreSha256(core),
+        ...(input.ledgerBinding !== undefined ? { ledgerBinding: input.ledgerBinding } : {}),
+        ...(input.trustedAttestation !== undefined ? { trustedAttestation: input.trustedAttestation } : {}),
+    };
+    return validateEvidenceReceipt({ core, envelope });
+}
+/** Attach non-core metadata after a ledger commits {receiptId, coreSha256}. */
+export function withEvidenceReceiptEnvelope(receipt, metadata) {
+    const validated = validateEvidenceReceipt(receipt);
+    return validateEvidenceReceipt({
+        core: validated.core,
+        envelope: {
+            coreSha256: validated.envelope.coreSha256,
+            ...(metadata.ledgerBinding !== undefined ? { ledgerBinding: metadata.ledgerBinding } : {}),
+            ...(metadata.trustedAttestation !== undefined ? { trustedAttestation: metadata.trustedAttestation } : {}),
+        },
+    });
+}
+export function evidenceReceiptReplayPayload(receipt) {
+    const validated = validateEvidenceReceipt(receipt);
+    return Object.freeze({
+        receiptId: validated.core.receiptId,
+        coreSha256: validated.envelope.coreSha256,
+    });
+}
+//# sourceMappingURL=evidence-receipt.js.map

package/dist/guardrails/evidence-receipt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence-receipt.js","sourceRoot":"","sources":["../../src/guardrails/evidence-receipt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAkB1D,OAAO,EACN,mCAAmC,EACnC,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,MAAM,UAAU,GAAG,gBAAgB,CAAC;AACpC,MAAM,eAAe,GAAG,oCAAoC,CAAC;AAC7D,MAAM,kBAAkB,GAAG,gCAAgC,CAAC;AAC5D,MAAM,qBAAqB,GAAG,mCAAmC,CAAC;AAClE,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;AAC9F,MAAM,aAAa,GAAG,+CAA+C,CAAC;AAEtE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,iCAAiC,GAAG,EAAE,GAAG,IAAI,CAAC;AAuC3D,MAAM,UAAU,WAAW,CAAC,KAAc,EAAsB;IAC/D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAAA,CAC3D;AAED,MAAM,UAAU,cAAc,CAAC,KAAc,EAAE,KAAK,GAAG,QAAQ,EAAa;IAC3E,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8DAA8D,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,mGAAmG;AACnG,MAAM,UAAU,uBAAuB,CAAC,IAAa,EAAE,KAAc,EAAW;IAC/E,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAAA,CAC5E;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAc,EAAmB;IACxE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAAA,CAChE;AAED,SAAS,WAAW,CACnB,KAAc,EACd,KAAa,EACb,YAA+B,EAC/B,YAAY,GAAsB,EAAE,EACV;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,WAAW,GAAG,MAAM,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;SACxC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;SACjD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;SACnB,IAAI,EAAE,CAAC;IACT,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC;IAC5D,MAAM,2BAA2B,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC;QAC7D,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACpC,OAAO,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,IAAI,UAAU,CAAC;IAAA,CAC3F,CAAC;IACF,IACC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;QAC7D,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,MAAM,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC,EAC7E,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yBAAyB,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yBAAyB,CAAC,CAAC;QACpD,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC;IAClC,CAAC;IACD,OAAO,QAAQ,CAAC;AAAA,CAChB;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa,EAAU;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+CAA+C,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,sBAAsB,CAAC,KAAc,EAAE,KAAa,EAAsB;IAClF,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAAA,CACtE;AAED,SAAS,sBAAsB,CAAC,KAAc,EAAE,KAAa,EAAU;IACtE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,KAAe,CAAC;AAAA,CACvB;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,KAAa,EAAU;IAC/D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kCAAkC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,KAAe,CAAC;AAAA,CACvB;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,KAAa,EAAU;IACzD,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yCAAyC,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd;AAED,sFAAsF;AACtF,SAAS,YAAY,CAAC,KAAc,EAA6B;IAChE,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACjD,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,OAAO,CAAC;AAAA,CACf;AAED,SAAS,iBAAiB,CAAC,KAAc,EAAE,KAAa,EAAmC;IAC1F,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,KAAK,SAAS,CAAC;QACrD,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,KAAK,YAAY,CAAC;KACtE,CAAC,CAAC;AAAA,CACH;AAED,SAAS,WAAW,CAAC,KAAc,EAAyB;IAC3D,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,CAAC,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5F,MAAM,iBAAiB,GAAG,cAAc,CAAC,GAAG,CAAC,iBAAiB,EAAE,kCAAkC,CAAC,CAAC;IACpG,IAAI,iBAAiB,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,GAAG,iCAAiC,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,0BAA0B,iCAAiC,QAAQ,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AAAA,CAC5D;AAED,SAAS,gBAAgB,CAAC,MAAe,EAAE,QAAiB,EAA8B;IACzF,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzB,IAAI,QAAQ,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QACjF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAkB,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAClD,IAAI,QAAQ,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,0CAA0C,CAAC,CAAC;QAC5F,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;AAAA,CAC9E;AAED,2DAA2D;AAC3D,MAAM,UAAU,wBAAwB,CAAC,KAAc,EAAuB;IAC7E,MAAM,GAAG,GAAG,WAAW,CACtB,KAAK,EACL,cAAc,EACd;QACC,eAAe;QACf,WAAW;QACX,QAAQ;QACR,OAAO;QACP,SAAS;QACT,KAAK;QACL,WAAW;QACX,WAAW;QACX,YAAY;QACZ,YAAY;QACZ,QAAQ;QACR,UAAU;QACV,iBAAiB;QACjB,gBAAgB;QAChB,QAAQ;QACR,UAAU;KACV,EACD,CAAC,QAAQ,EAAE,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,CAC9D,CAAC;IACF,IAAI,GAAG,CAAC,aAAa,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACrF,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IAC3G,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC;IACxE,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC;IACrF,IAAI,UAAU,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,eAAe,GAAG,yBAAyB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACvE,MAAM,cAAc,GAAG,yBAAyB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAA4B,CAAC;IAClD,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC;IACrF,MAAM,gBAAgB,GACrB,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,4BAA4B,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACrG,MAAM,cAAc,GAAG,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAClH,IAAI,cAAc,KAAK,SAAS,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAChH,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,MAAM,GAA8B;QACzC,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,MAAM;QACN,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,KAAK;QACL,OAAO;QACP,GAAG;QACH,SAAS;QACT,SAAS;QACT,UAAU;QACV,UAAU;QACV,eAAe;QACf,cAAc;QACd,MAAM;QACN,QAAQ;QACR,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC,CAAC;AAAA,CACpD;AAED,SAAS,aAAa,CAAC,KAAc,EAAU;IAC9C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5G,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3F,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACrG,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAAA,CAClG;AAED,MAAM,UAAU,4BAA4B,CAAC,IAAyB,EAAU;IAC/E,OAAO,aAAa,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC;AAAA,CACrD;AAED,4FAA4F;AAC5F,MAAM,UAAU,4BAA4B,CAAC,OAAkC,EAAa;IAC3F,OAAO,UAAU,CAAC,QAAQ,CAAC;SACzB,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAAC;SACrC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC;SACpD,MAAM,CAAC,KAAK,CAAc,CAAC;AAAA,CAC7B;AAED,qEAAqE;AACrE,MAAM,UAAU,gCAAgC,CAAC,IAAyB,EAAa;IACtF,OAAO,UAAU,CAAC,QAAQ,CAAC;SACzB,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC;SAClC,MAAM,CAAC,4BAA4B,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;SAClD,MAAM,CAAC,KAAK,CAAc,CAAC;AAAA,CAC7B;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAgC;IACzE,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,EAAE,wBAAwB,EAAE,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;IAC/E,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,GAAG,EAAE,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,oBAAoB,CAAC;QACnD,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,0BAA0B,CAAC;KACpE,CAAC,CAAC;AAAA,CACH;AAED,SAAS,uBAAuB,CAAC,KAAc,EAA8B;IAC5E,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,EAAE,qBAAqB,EAAE,CAAC,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;IACrH,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAClG,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,UAAU,EAAE,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,gCAAgC,CAAC;QAC5E,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,2BAA2B,CAAC;QAC7D,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,+BAA+B,CAAC;QACzE,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,8BAA8B,CAAC;KACjE,CAAC,CAAC;AAAA,CACH;AAED,SAAS,aAAa,CAAC,KAAc,EAA2B;IAC/D,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,EAAE,kBAAkB,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC5G,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,6BAA6B,CAAC,CAAC;IACjF,MAAM,aAAa,GAAG,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC1G,MAAM,kBAAkB,GACvB,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACpG,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,UAAU;QACV,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAC,CAAC;AAAA,CACH;AAED,+EAA+E;AAC/E,MAAM,UAAU,uBAAuB,CAAC,KAAc,EAAmB;IACxE,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,EAAE,kBAAkB,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,gCAAgC,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;AAAA,CACzC;AAED,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAmB;IACzE,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACpG,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACJ,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC;AAAA,CACtC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAwB,EAAU;IAC1E,OAAO,aAAa,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;AAAA,CACvD;AAED,MAAM,UAAU,+BAA+B,CAAC,OAAwB,EAAW;IAClF,IAAI,CAAC;QACJ,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACnD,OAAO,uBAAuB,CAAC,gCAAgC,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACjH,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AAAA,CACD;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,KAAa,EAA+B;IACpF,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iDAAiD,CAAC,CAAC;AAAA,CAC/G;AAED,SAAS,aAAa,CAAC,MAAkC,EAAyB;IACjF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,iBAAiB,GAAG,cAAc,CAAC,MAAM,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;IAC1F,IAAI,iBAAiB,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACvF,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;IAC1D,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;IACtE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,iCAAiC,EAAE,CAAC;QACvF,MAAM,IAAI,KAAK,CAAC,0BAA0B,iCAAiC,QAAQ,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,iBAAiB;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAc;YAC7E,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;SACnC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAc;YAC7E,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;SACnC,CAAC;KACF,CAAC,CAAC;AAAA,CACH;AAED,6GAA6G;AAC7G,MAAM,UAAU,qBAAqB,CAAC,KAAiC,EAAmB;IACzF,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,wBAAwB,CAAC;QACrC,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM;QACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvF,CAAC,CAAC;IACH,MAAM,QAAQ,GAA4B;QACzC,UAAU,EAAE,gCAAgC,CAAC,IAAI,CAAC;QAClD,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnG,CAAC;IACF,OAAO,uBAAuB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;AAAA,CACnD;AAED,+EAA+E;AAC/E,MAAM,UAAU,2BAA2B,CAC1C,OAAwB,EACxB,QAAyC,EACvB;IAClB,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACnD,OAAO,uBAAuB,CAAC;QAC9B,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,QAAQ,EAAE;YACT,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,UAAU;YACzC,GAAG,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1F,GAAG,CAAC,QAAQ,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzG;KACD,CAAC,CAAC;AAAA,CACH;AAED,MAAM,UAAU,4BAA4B,CAAC,OAAwB,EAAgC;IACpG,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS;QACnC,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,UAAU;KACzC,CAAC,CAAC;AAAA,CACH","sourcesContent":["import { createHash, timingSafeEqual } from \"node:crypto\";\nimport type {\n\tCommandHmacBinding,\n\tCommandRedactionSummary,\n\tEvidenceCommandDescriptor,\n\tEvidenceExecutor,\n\tEvidenceOutputCapture,\n\tEvidenceReceipt,\n\tEvidenceReceiptCore,\n\tEvidenceReceiptCoreFields,\n\tEvidenceReceiptDisposition,\n\tEvidenceReceiptEnvelope,\n\tEvidenceReceiptLedgerBinding,\n\tEvidenceReceiptReplayPayload,\n\tSha256Hex,\n\tTrustedEvidenceAttestation,\n\tWorkspaceFingerprint,\n} from \"../types/evidence.ts\";\nimport {\n\tassertCredentialFreeEvidenceCommand,\n\tparseCommandHmacBinding,\n\tparseCommandRedactionSummary,\n\tparseEvidenceCommandShape,\n} from \"./command-redaction.ts\";\nimport { parseWorkspaceFingerprint } from \"./workspace-fingerprint.ts\";\n\nconst SHA256_HEX = /^[0-9a-f]{64}$/;\nconst SAFE_RECEIPT_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;\nconst CORE_DIGEST_DOMAIN = \"omk:evidence:receipt-v3:core\\0\";\nconst COMMAND_DIGEST_DOMAIN = \"omk:evidence:receipt-v3:command\\0\";\nconst EXECUTORS: ReadonlySet<string> = new Set([\"bash-tool\", \"ci-runner\", \"mcp\", \"internal\"]);\nconst ISO_TIMESTAMP = /^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$/;\n\n/** Combined stdout/stderr bytes accepted from an already-redacted caller. */\nexport const MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES = 64 * 1024;\n\nexport interface AlreadyRedactedOutputBytes {\n\treadonly redactionPolicyId: string;\n\treadonly stdout: Uint8Array;\n\treadonly stderr: Uint8Array;\n}\n\nexport interface EvidenceReceiptCoreInputFields {\n\treadonly receiptId: string;\n\treadonly goalId: string;\n\treadonly laneId?: string;\n\treadonly claim: string;\n\treadonly command: EvidenceCommandDescriptor;\n\treadonly cwd: string;\n\treadonly timeoutMs: number | null;\n\treadonly startedAt: string;\n\treadonly finishedAt: string;\n\treadonly durationMs: number;\n\treadonly workspaceBefore: WorkspaceFingerprint;\n\treadonly workspaceAfter: WorkspaceFingerprint;\n\treadonly alreadyRedactedOutput: AlreadyRedactedOutputBytes;\n\treadonly executor: EvidenceExecutor;\n\treadonly toolCallId?: string;\n\treadonly commandRedaction?: CommandRedactionSummary;\n\treadonly commandBinding?: CommandHmacBinding;\n}\n\nexport type CreateEvidenceReceiptInput = EvidenceReceiptCoreInputFields &\n\tEvidenceReceiptDisposition & {\n\t\treadonly ledgerBinding?: EvidenceReceiptLedgerBinding;\n\t\treadonly trustedAttestation?: TrustedEvidenceAttestation;\n\t};\n\nexport interface EvidenceReceiptEnvelopeMetadata {\n\treadonly ledgerBinding?: EvidenceReceiptLedgerBinding;\n\treadonly trustedAttestation?: TrustedEvidenceAttestation;\n}\n\nexport function isSha256Hex(value: unknown): value is Sha256Hex {\n\treturn typeof value === \"string\" && SHA256_HEX.test(value);\n}\n\nexport function parseSha256Hex(value: unknown, label = \"digest\"): Sha256Hex {\n\tif (!isSha256Hex(value)) {\n\t\tthrow new Error(`${label} must be exactly 64 lowercase SHA-256 hexadecimal characters`);\n\t}\n\treturn value;\n}\n\n/** Decode validated hex before comparing, avoiding string timing and malformed-buffer pitfalls. */\nexport function constantTimeSha256Equal(left: unknown, right: unknown): boolean {\n\tif (!isSha256Hex(left) || !isSha256Hex(right)) return false;\n\treturn timingSafeEqual(Buffer.from(left, \"hex\"), Buffer.from(right, \"hex\"));\n}\n\nexport function isSafeEvidenceReceiptId(value: unknown): value is string {\n\treturn typeof value === \"string\" && SAFE_RECEIPT_ID.test(value);\n}\n\nfunction exactObject(\n\tvalue: unknown,\n\tlabel: string,\n\trequiredKeys: readonly string[],\n\toptionalKeys: readonly string[] = [],\n): Record<string, unknown> {\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n\t\tthrow new Error(`${label} must be an object`);\n\t}\n\tconst record = value as Record<string, unknown>;\n\tconst descriptors = Object.getOwnPropertyDescriptors(record);\n\tconst actual = Object.entries(descriptors)\n\t\t.filter(([, descriptor]) => descriptor.enumerable)\n\t\t.map(([key]) => key)\n\t\t.sort();\n\tconst allowed = new Set([...requiredKeys, ...optionalKeys]);\n\tconst isOwnEnumerableDataProperty = (key: string): boolean => {\n\t\tconst descriptor = descriptors[key];\n\t\treturn descriptor !== undefined && descriptor.enumerable === true && \"value\" in descriptor;\n\t};\n\tif (\n\t\tactual.some((key) => !allowed.has(key)) ||\n\t\trequiredKeys.some((key) => !isOwnEnumerableDataProperty(key)) ||\n\t\toptionalKeys.some((key) => key in record && !isOwnEnumerableDataProperty(key))\n\t) {\n\t\tthrow new Error(`${label} has an invalid key set`);\n\t}\n\tconst snapshot: Record<string, unknown> = {};\n\tfor (const key of actual) {\n\t\tconst descriptor = descriptors[key];\n\t\tif (descriptor === undefined || !(\"value\" in descriptor)) {\n\t\t\tthrow new Error(`${label} has an invalid key set`);\n\t\t}\n\t\tsnapshot[key] = descriptor.value;\n\t}\n\treturn snapshot;\n}\n\nfunction nonEmptyString(value: unknown, label: string): string {\n\tif (typeof value !== \"string\" || value.length === 0 || value.includes(\"\\0\")) {\n\t\tthrow new Error(`${label} must be a non-empty string without NUL bytes`);\n\t}\n\treturn value;\n}\n\nfunction optionalNonEmptyString(value: unknown, label: string): string | undefined {\n\treturn value === undefined ? undefined : nonEmptyString(value, label);\n}\n\nfunction safeNonNegativeInteger(value: unknown, label: string): number {\n\tif (!Number.isSafeInteger(value) || (value as number) < 0) {\n\t\tthrow new Error(`${label} must be a non-negative safe integer`);\n\t}\n\treturn value as number;\n}\n\nfunction positiveInteger(value: unknown, label: string): number {\n\tif (!Number.isSafeInteger(value) || (value as number) <= 0) {\n\t\tthrow new Error(`${label} must be a positive safe integer`);\n\t}\n\treturn value as number;\n}\n\nfunction timestamp(value: unknown, label: string): string {\n\tconst parsed = nonEmptyString(value, label);\n\tif (!ISO_TIMESTAMP.test(parsed) || Number.isNaN(Date.parse(parsed))) {\n\t\tthrow new Error(`${label} must be a canonical ISO-8601 timestamp`);\n\t}\n\treturn parsed;\n}\n\n/** Strict structural parse plus the credential-free policy for persisted commands. */\nfunction parseCommand(value: unknown): EvidenceCommandDescriptor {\n\tconst command = parseEvidenceCommandShape(value);\n\tassertCredentialFreeEvidenceCommand(command);\n\treturn command;\n}\n\nfunction parseOutputDigest(value: unknown, label: string): EvidenceOutputCapture[\"stdout\"] {\n\tconst raw = exactObject(value, label, [\"sha256\", \"byteCount\"]);\n\treturn Object.freeze({\n\t\tsha256: parseSha256Hex(raw.sha256, `${label}.sha256`),\n\t\tbyteCount: safeNonNegativeInteger(raw.byteCount, `${label}.byteCount`),\n\t});\n}\n\nfunction parseOutput(value: unknown): EvidenceOutputCapture {\n\tconst raw = exactObject(value, \"receipt output\", [\"redactionPolicyId\", \"stdout\", \"stderr\"]);\n\tconst redactionPolicyId = nonEmptyString(raw.redactionPolicyId, \"receipt output redactionPolicyId\");\n\tif (redactionPolicyId.length > 256) {\n\t\tthrow new Error(\"receipt output redactionPolicyId is too long\");\n\t}\n\tconst stdout = parseOutputDigest(raw.stdout, \"receipt stdout\");\n\tconst stderr = parseOutputDigest(raw.stderr, \"receipt stderr\");\n\tif (stdout.byteCount + stderr.byteCount > MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES) {\n\t\tthrow new Error(`receipt output exceeds ${MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES} bytes`);\n\t}\n\treturn Object.freeze({ redactionPolicyId, stdout, stderr });\n}\n\nfunction parseDisposition(status: unknown, exitCode: unknown): EvidenceReceiptDisposition {\n\tif (status === \"passed\") {\n\t\tif (exitCode !== 0) throw new Error(\"passed receipt status requires exitCode 0\");\n\t\treturn Object.freeze({ status, exitCode: 0 });\n\t}\n\tif (status === \"failed\") {\n\t\tif (!Number.isSafeInteger(exitCode) || exitCode === 0) {\n\t\t\tthrow new Error(\"failed receipt status requires a non-zero integer exitCode\");\n\t\t}\n\t\treturn Object.freeze({ status, exitCode: exitCode as number });\n\t}\n\tif (status === \"timeout\" || status === \"aborted\") {\n\t\tif (exitCode !== null) throw new Error(`${status} receipt status requires a null exitCode`);\n\t\treturn Object.freeze({ status, exitCode: null });\n\t}\n\tthrow new Error(\"receipt status must be passed, failed, timeout, or aborted\");\n}\n\n/** Strict shape parser for immutable receipt core data. */\nexport function parseEvidenceReceiptCore(value: unknown): EvidenceReceiptCore {\n\tconst raw = exactObject(\n\t\tvalue,\n\t\t\"receipt core\",\n\t\t[\n\t\t\t\"schemaVersion\",\n\t\t\t\"receiptId\",\n\t\t\t\"goalId\",\n\t\t\t\"claim\",\n\t\t\t\"command\",\n\t\t\t\"cwd\",\n\t\t\t\"timeoutMs\",\n\t\t\t\"startedAt\",\n\t\t\t\"finishedAt\",\n\t\t\t\"durationMs\",\n\t\t\t\"status\",\n\t\t\t\"exitCode\",\n\t\t\t\"workspaceBefore\",\n\t\t\t\"workspaceAfter\",\n\t\t\t\"output\",\n\t\t\t\"executor\",\n\t\t],\n\t\t[\"laneId\", \"toolCallId\", \"commandRedaction\", \"commandBinding\"],\n\t);\n\tif (raw.schemaVersion !== 3) throw new Error(\"receipt core schemaVersion must be 3\");\n\tif (!isSafeEvidenceReceiptId(raw.receiptId)) throw new Error(\"receiptId is not safe\");\n\tconst goalId = nonEmptyString(raw.goalId, \"receipt core goalId\");\n\tconst laneId = optionalNonEmptyString(raw.laneId, \"receipt core laneId\");\n\tconst claim = nonEmptyString(raw.claim, \"receipt core claim\");\n\tconst command = parseCommand(raw.command);\n\tconst cwd = nonEmptyString(raw.cwd, \"receipt core cwd\");\n\tconst timeoutMs = raw.timeoutMs === null ? null : positiveInteger(raw.timeoutMs, \"receipt core timeoutMs\");\n\tconst startedAt = timestamp(raw.startedAt, \"receipt core startedAt\");\n\tconst finishedAt = timestamp(raw.finishedAt, \"receipt core finishedAt\");\n\tif (Date.parse(finishedAt) < Date.parse(startedAt)) {\n\t\tthrow new Error(\"receipt core finishedAt must not precede startedAt\");\n\t}\n\tconst durationMs = safeNonNegativeInteger(raw.durationMs, \"receipt core durationMs\");\n\tif (durationMs !== Date.parse(finishedAt) - Date.parse(startedAt)) {\n\t\tthrow new Error(\"receipt core durationMs must match the timestamp interval\");\n\t}\n\tconst workspaceBefore = parseWorkspaceFingerprint(raw.workspaceBefore);\n\tconst workspaceAfter = parseWorkspaceFingerprint(raw.workspaceAfter);\n\tconst output = parseOutput(raw.output);\n\tif (typeof raw.executor !== \"string\" || !EXECUTORS.has(raw.executor)) {\n\t\tthrow new Error(\"receipt core executor is invalid\");\n\t}\n\tconst executor = raw.executor as EvidenceExecutor;\n\tconst toolCallId = optionalNonEmptyString(raw.toolCallId, \"receipt core toolCallId\");\n\tconst commandRedaction =\n\t\traw.commandRedaction === undefined ? undefined : parseCommandRedactionSummary(raw.commandRedaction);\n\tconst commandBinding = raw.commandBinding === undefined ? undefined : parseCommandHmacBinding(raw.commandBinding);\n\tif (commandBinding !== undefined && commandRedaction === undefined) {\n\t\tthrow new Error(\"receipt core commandBinding requires commandRedaction\");\n\t}\n\tif (commandRedaction !== undefined && commandRedaction.placeholders.length > 0 && commandBinding === undefined) {\n\t\tthrow new Error(\"receipt core commandRedaction with applied placeholders requires commandBinding\");\n\t}\n\tconst disposition = parseDisposition(raw.status, raw.exitCode);\n\tconst fields: EvidenceReceiptCoreFields = {\n\t\tschemaVersion: 3,\n\t\treceiptId: raw.receiptId,\n\t\tgoalId,\n\t\t...(laneId !== undefined ? { laneId } : {}),\n\t\tclaim,\n\t\tcommand,\n\t\tcwd,\n\t\ttimeoutMs,\n\t\tstartedAt,\n\t\tfinishedAt,\n\t\tdurationMs,\n\t\tworkspaceBefore,\n\t\tworkspaceAfter,\n\t\toutput,\n\t\texecutor,\n\t\t...(toolCallId !== undefined ? { toolCallId } : {}),\n\t\t...(commandRedaction !== undefined ? { commandRedaction } : {}),\n\t\t...(commandBinding !== undefined ? { commandBinding } : {}),\n\t};\n\treturn Object.freeze({ ...fields, ...disposition });\n}\n\nfunction canonicalJson(value: unknown): string {\n\tif (value === null || typeof value === \"boolean\" || typeof value === \"string\") return JSON.stringify(value);\n\tif (typeof value === \"number\") {\n\t\tif (!Number.isFinite(value) || Object.is(value, -0))\n\t\t\tthrow new Error(\"canonical JSON requires finite non-negative-zero numbers\");\n\t\treturn JSON.stringify(value);\n\t}\n\tif (Array.isArray(value)) return `[${value.map((item) => canonicalJson(item)).join(\",\")}]`;\n\tif (typeof value !== \"object\" || value === null) throw new Error(\"value is not canonical JSON data\");\n\tconst record = value as Record<string, unknown>;\n\tconst keys = Object.keys(record).sort();\n\treturn `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(\",\")}}`;\n}\n\nexport function serializeEvidenceReceiptCore(core: EvidenceReceiptCore): string {\n\treturn canonicalJson(parseEvidenceReceiptCore(core));\n}\n\n/** Domain-separated SHA-256 of one exact, credential-free structured command descriptor. */\nexport function computeEvidenceCommandSha256(command: EvidenceCommandDescriptor): Sha256Hex {\n\treturn createHash(\"sha256\")\n\t\t.update(COMMAND_DIGEST_DOMAIN, \"utf8\")\n\t\t.update(canonicalJson(parseCommand(command)), \"utf8\")\n\t\t.digest(\"hex\") as Sha256Hex;\n}\n\n/** Domain-separated SHA-256 of the immutable canonical core only. */\nexport function computeEvidenceReceiptCoreSha256(core: EvidenceReceiptCore): Sha256Hex {\n\treturn createHash(\"sha256\")\n\t\t.update(CORE_DIGEST_DOMAIN, \"utf8\")\n\t\t.update(serializeEvidenceReceiptCore(core), \"utf8\")\n\t\t.digest(\"hex\") as Sha256Hex;\n}\n\nfunction parseLedgerBinding(value: unknown): EvidenceReceiptLedgerBinding {\n\tconst raw = exactObject(value, \"receipt ledger binding\", [\"seq\", \"eventHash\"]);\n\treturn Object.freeze({\n\t\tseq: positiveInteger(raw.seq, \"receipt ledger seq\"),\n\t\teventHash: parseSha256Hex(raw.eventHash, \"receipt ledger eventHash\"),\n\t});\n}\n\nfunction parseTrustedAttestation(value: unknown): TrustedEvidenceAttestation {\n\tconst raw = exactObject(value, \"trusted attestation\", [\"attesterId\", \"keyId\", \"algorithm\", \"signature\", \"issuedAt\"]);\n\tif (raw.algorithm !== \"ed25519\") throw new Error(\"trusted attestation algorithm must be ed25519\");\n\treturn Object.freeze({\n\t\tattesterId: nonEmptyString(raw.attesterId, \"trusted attestation attesterId\"),\n\t\tkeyId: nonEmptyString(raw.keyId, \"trusted attestation keyId\"),\n\t\talgorithm: \"ed25519\",\n\t\tsignature: nonEmptyString(raw.signature, \"trusted attestation signature\"),\n\t\tissuedAt: timestamp(raw.issuedAt, \"trusted attestation issuedAt\"),\n\t});\n}\n\nfunction parseEnvelope(value: unknown): EvidenceReceiptEnvelope {\n\tconst raw = exactObject(value, \"receipt envelope\", [\"coreSha256\"], [\"ledgerBinding\", \"trustedAttestation\"]);\n\tconst coreSha256 = parseSha256Hex(raw.coreSha256, \"receipt envelope coreSha256\");\n\tconst ledgerBinding = raw.ledgerBinding === undefined ? undefined : parseLedgerBinding(raw.ledgerBinding);\n\tconst trustedAttestation =\n\t\traw.trustedAttestation === undefined ? undefined : parseTrustedAttestation(raw.trustedAttestation);\n\treturn Object.freeze({\n\t\tcoreSha256,\n\t\t...(ledgerBinding !== undefined ? { ledgerBinding } : {}),\n\t\t...(trustedAttestation !== undefined ? { trustedAttestation } : {}),\n\t});\n}\n\n/** Strict shape and digest validation for an already-decoded receipt value. */\nexport function validateEvidenceReceipt(value: unknown): EvidenceReceipt {\n\tconst raw = exactObject(value, \"evidence receipt\", [\"core\", \"envelope\"]);\n\tconst core = parseEvidenceReceiptCore(raw.core);\n\tconst envelope = parseEnvelope(raw.envelope);\n\tconst expected = computeEvidenceReceiptCoreSha256(core);\n\tif (!constantTimeSha256Equal(expected, envelope.coreSha256)) {\n\t\tthrow new Error(\"evidence receipt core digest mismatch\");\n\t}\n\treturn Object.freeze({ core, envelope });\n}\n\nexport function parseEvidenceReceipt(serialized: string): EvidenceReceipt {\n\tif (typeof serialized !== \"string\") throw new Error(\"serialized evidence receipt must be a string\");\n\tlet value: unknown;\n\ttry {\n\t\tvalue = JSON.parse(serialized);\n\t} catch {\n\t\tthrow new Error(\"evidence receipt contains invalid JSON\");\n\t}\n\treturn validateEvidenceReceipt(value);\n}\n\nexport function serializeEvidenceReceipt(receipt: EvidenceReceipt): string {\n\treturn canonicalJson(validateEvidenceReceipt(receipt));\n}\n\nexport function verifyEvidenceReceiptCoreDigest(receipt: EvidenceReceipt): boolean {\n\ttry {\n\t\tconst validated = validateEvidenceReceipt(receipt);\n\t\treturn constantTimeSha256Equal(computeEvidenceReceiptCoreSha256(validated.core), validated.envelope.coreSha256);\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nfunction assertByteArray(value: unknown, label: string): asserts value is Uint8Array {\n\tif (!(value instanceof Uint8Array)) throw new Error(`${label} must be a Uint8Array of already-redacted bytes`);\n}\n\nfunction outputCapture(output: AlreadyRedactedOutputBytes): EvidenceOutputCapture {\n\tif (typeof output !== \"object\" || output === null || Array.isArray(output)) {\n\t\tthrow new Error(\"alreadyRedactedOutput must be an object\");\n\t}\n\tconst redactionPolicyId = nonEmptyString(output.redactionPolicyId, \"redaction policy id\");\n\tif (redactionPolicyId.length > 256) throw new Error(\"redaction policy id is too long\");\n\tassertByteArray(output.stdout, \"already-redacted stdout\");\n\tassertByteArray(output.stderr, \"already-redacted stderr\");\n\tconst byteCount = output.stdout.byteLength + output.stderr.byteLength;\n\tif (!Number.isSafeInteger(byteCount) || byteCount > MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES) {\n\t\tthrow new Error(`receipt output exceeds ${MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES} bytes`);\n\t}\n\treturn Object.freeze({\n\t\tredactionPolicyId,\n\t\tstdout: Object.freeze({\n\t\t\tsha256: createHash(\"sha256\").update(output.stdout).digest(\"hex\") as Sha256Hex,\n\t\t\tbyteCount: output.stdout.byteLength,\n\t\t}),\n\t\tstderr: Object.freeze({\n\t\t\tsha256: createHash(\"sha256\").update(output.stderr).digest(\"hex\") as Sha256Hex,\n\t\t\tbyteCount: output.stderr.byteLength,\n\t\t}),\n\t});\n}\n\n/** Build a receipt from caller-supplied execution facts without executing a command or activating a gate. */\nexport function createEvidenceReceipt(input: CreateEvidenceReceiptInput): EvidenceReceipt {\n\tconst output = outputCapture(input.alreadyRedactedOutput);\n\tconst core = parseEvidenceReceiptCore({\n\t\tschemaVersion: 3,\n\t\treceiptId: input.receiptId,\n\t\tgoalId: input.goalId,\n\t\t...(input.laneId !== undefined ? { laneId: input.laneId } : {}),\n\t\tclaim: input.claim,\n\t\tcommand: input.command,\n\t\tcwd: input.cwd,\n\t\ttimeoutMs: input.timeoutMs,\n\t\tstartedAt: input.startedAt,\n\t\tfinishedAt: input.finishedAt,\n\t\tdurationMs: input.durationMs,\n\t\tstatus: input.status,\n\t\texitCode: input.exitCode,\n\t\tworkspaceBefore: input.workspaceBefore,\n\t\tworkspaceAfter: input.workspaceAfter,\n\t\toutput,\n\t\texecutor: input.executor,\n\t\t...(input.toolCallId !== undefined ? { toolCallId: input.toolCallId } : {}),\n\t\t...(input.commandRedaction !== undefined ? { commandRedaction: input.commandRedaction } : {}),\n\t\t...(input.commandBinding !== undefined ? { commandBinding: input.commandBinding } : {}),\n\t});\n\tconst envelope: EvidenceReceiptEnvelope = {\n\t\tcoreSha256: computeEvidenceReceiptCoreSha256(core),\n\t\t...(input.ledgerBinding !== undefined ? { ledgerBinding: input.ledgerBinding } : {}),\n\t\t...(input.trustedAttestation !== undefined ? { trustedAttestation: input.trustedAttestation } : {}),\n\t};\n\treturn validateEvidenceReceipt({ core, envelope });\n}\n\n/** Attach non-core metadata after a ledger commits {receiptId, coreSha256}. */\nexport function withEvidenceReceiptEnvelope(\n\treceipt: EvidenceReceipt,\n\tmetadata: EvidenceReceiptEnvelopeMetadata,\n): EvidenceReceipt {\n\tconst validated = validateEvidenceReceipt(receipt);\n\treturn validateEvidenceReceipt({\n\t\tcore: validated.core,\n\t\tenvelope: {\n\t\t\tcoreSha256: validated.envelope.coreSha256,\n\t\t\t...(metadata.ledgerBinding !== undefined ? { ledgerBinding: metadata.ledgerBinding } : {}),\n\t\t\t...(metadata.trustedAttestation !== undefined ? { trustedAttestation: metadata.trustedAttestation } : {}),\n\t\t},\n\t});\n}\n\nexport function evidenceReceiptReplayPayload(receipt: EvidenceReceipt): EvidenceReceiptReplayPayload {\n\tconst validated = validateEvidenceReceipt(receipt);\n\treturn Object.freeze({\n\t\treceiptId: validated.core.receiptId,\n\t\tcoreSha256: validated.envelope.coreSha256,\n\t});\n}\n"]}

package/dist/guardrails/evidence-system.d.ts

@@ -1,4 +1,6 @@
-import type { EvidenceItem, EvidenceStatus, MergeGateResult, ReplayEvent, ReplayLedger, TaskContract } from "../types/evidence.ts";
+import type { EvidenceCommandDescriptor, EvidenceItem, EvidenceReceiptMode, EvidenceStatus, MergeGateResult, ReplayEvent, ReplayLedger, ReplayLedgerHead, TaskContract, VerifiedReplayLedgerSnapshot, WorkspaceScope } from "../types/evidence.ts";
+import { type CommandHmacBinder } from "./evidence-attestation.ts";
+export { latestRelevantWorkspaceMutationSeq } from "./evidence-attestation.ts";
 export declare class TaskContractBuilder {
     private goalId;
     private completionClaim;
@@ -20,18 +22,19 @@ export declare class TaskContractBuilder {
     static toJSON(contract: TaskContract): string;
 }
 export declare class ReplayLedgerManager {
-    private ledger;
-    private nextSeq;
-    constructor(goalId: string, ledgerPath: string);
-    append(event: Omit<ReplayEvent, "seq" | "timestamp" | "payloadHash" | "prevHash" | "eventHash">): ReplayEvent;
-    persist(): void;
-    /**
-     * Load and verify the persisted ledger. Fails closed: any schema violation,
-     * sequence gap, payload-hash mismatch, or broken event-hash chain throws, so
-     * a tampered ledger (edited, deleted, inserted, or reordered lines) is never
-     * loaded silently.
-     */
-    load(): void;
+    private readonly goalId;
+    private readonly ledgerPath;
+    private readonly store;
+    private events;
+    private committedHead;
+    constructor(goalId: string, ledgerPath: string, expectedHead?: ReplayLedgerHead);
+    private refresh;
+    append(event: Omit<ReplayEvent, "seq" | "timestamp" | "payloadHash" | "prevHash" | "eventHash">, expectedHead?: ReplayLedgerHead): ReplayEvent;
+    /** Compatibility no-op that still verifies the caller's expected committed head. */
+    persist(expectedHead?: ReplayLedgerHead): void;
+    load(expectedHead?: ReplayLedgerHead): void;
+    getCommittedHead(): ReplayLedgerHead;
+    getVerifiedSnapshot(expectedHead?: ReplayLedgerHead): VerifiedReplayLedgerSnapshot;
     getEvents(): ReadonlyArray<ReplayEvent>;
     getLedger(): Readonly<ReplayLedger>;
     replay<T>(handler: (event: ReplayEvent) => T | undefined): T[];
@@ -40,10 +43,31 @@ export declare class ReplayLedgerManager {
 export interface EvidenceGateOptions {
     /** Minimum number of satisfied evidence items required. */
     minEvidenceCount?: number;
-    /** Require at least one artifact with a SHA-256 hash. */
+    /** Require at least one artifact with a SHA-256 hash in explicit legacy mode. */
     requireHash?: boolean;
-    /** Require at least one verification command. */
+    /** Require at least one verification command in explicit legacy mode. */
     requireVerificationCommand?: boolean;
+    /** Receipt policy. Defaults to prefer; legacy must be selected explicitly. */
+    receiptMode?: EvidenceReceiptMode;
+    /** Resolve a serialized or decoded receipt by ID. The gate validates the returned value. */
+    resolveReceipt?: (receiptId: string) => unknown;
+    /** Strict source: one expected-head, file-identity, suffix, and chain-verified snapshot. */
+    resolveVerifiedLedgerSnapshot?: () => VerifiedReplayLedgerSnapshot;
+    /** Prefer-mode migration source; strict mode requires resolveVerifiedLedgerSnapshot. */
+    resolveLedgerEvent?: (seq: number) => ReplayEvent | undefined;
+    /** Recapture the receipt's workspace scope (same kind and scope) for freshness comparison. */
+    captureWorkspaceFingerprint?: (scope: WorkspaceScope) => unknown;
+    /**
+     * Optional freshness source: the latest replay-ledger sequence of a workspace mutation
+     * relevant to the given scope, or null/undefined when none is known. When configured,
+     * the receipt's verified ledger seq must strictly exceed this value; a throwing or
+     * out-of-contract source is a hard block (positive safe integers only).
+     */
+    resolveLatestWorkspaceMutationSeq?: (scope: WorkspaceScope) => number | null | undefined;
+    /** Ephemeral trust anchor used to verify the original command's keyed attestation. */
+    commandAttestationBinder?: Pick<CommandHmacBinder, "verify">;
+    /** Resolve the original command inside the same trust boundary as the binder. */
+    resolveAttestedCommand?: (receiptId: string) => EvidenceCommandDescriptor | undefined;
 }
 export declare class EvidenceGate {
     private options;