safeseed 0.2.0

package/dist/net.js

@@ -0,0 +1,95 @@
+/**
+ * IP address membership helpers, so the catalog can say "this value is inside a
+ * standards-reserved block" precisely rather than by string prefix.
+ */
+/** Parse a dotted-quad IPv4 string to an unsigned 32-bit int, or null if invalid. */
+export function ipv4ToInt(ip) {
+    const parts = ip.split(".");
+    if (parts.length !== 4)
+        return null;
+    let n = 0;
+    for (const p of parts) {
+        if (!/^\d{1,3}$/.test(p))
+            return null;
+        const octet = Number(p);
+        if (octet > 255)
+            return null;
+        n = n * 256 + octet;
+    }
+    return n >>> 0;
+}
+/** True if `ip` falls inside the given IPv4 CIDR block (e.g. "192.0.2.0/24"). */
+export function ipv4InCidr(ip, cidr) {
+    const [base, bitsStr] = cidr.split("/");
+    const bits = Number(bitsStr);
+    const ipInt = ipv4ToInt(ip);
+    const baseInt = base === undefined ? null : ipv4ToInt(base);
+    if (ipInt === null || baseInt === null || Number.isNaN(bits))
+        return false;
+    if (bits <= 0)
+        return true;
+    const mask = (0xffffffff << (32 - bits)) >>> 0;
+    return (ipInt & mask) === (baseInt & mask);
+}
+/**
+ * Expand an IPv6 string to its 8 hextets (numbers), handling a single "::"
+ * abbreviation and an optional zone id. Returns null if malformed.
+ */
+export function expandIpv6(ip) {
+    let addr = ip.trim().toLowerCase();
+    const zone = addr.indexOf("%");
+    if (zone >= 0)
+        addr = addr.slice(0, zone);
+    if (addr === "")
+        return null;
+    const parseGroups = (s) => {
+        if (s === "")
+            return [];
+        const groups = s.split(":");
+        const out = [];
+        for (const g of groups) {
+            if (!/^[0-9a-f]{1,4}$/.test(g))
+                return null;
+            out.push(parseInt(g, 16));
+        }
+        return out;
+    };
+    const halves = addr.split("::");
+    if (halves.length > 2)
+        return null;
+    if (halves.length === 2) {
+        const head = parseGroups(halves[0]);
+        const tail = parseGroups(halves[1]);
+        if (head === null || tail === null)
+            return null;
+        const missing = 8 - head.length - tail.length;
+        if (missing < 0)
+            return null;
+        return [...head, ...new Array(missing).fill(0), ...tail];
+    }
+    const groups = parseGroups(addr);
+    if (groups === null || groups.length !== 8)
+        return null;
+    return groups;
+}
+/** True if `ip` falls inside the given IPv6 prefix (e.g. "2001:db8::/32"). */
+export function ipv6InPrefix(ip, prefixCidr) {
+    const [base, bitsStr] = prefixCidr.split("/");
+    const bits = Number(bitsStr);
+    const a = expandIpv6(ip);
+    const b = base === undefined ? null : expandIpv6(base);
+    if (a === null || b === null || Number.isNaN(bits))
+        return false;
+    let remaining = bits;
+    for (let h = 0; h < 8; h++) {
+        if (remaining <= 0)
+            break;
+        const take = Math.min(16, remaining);
+        const mask = take === 16 ? 0xffff : (0xffff << (16 - take)) & 0xffff;
+        if ((a[h] & mask) !== (b[h] & mask))
+            return false;
+        remaining -= 16;
+    }
+    return true;
+}
+//# sourceMappingURL=net.js.map

package/dist/net.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"net.js","sourceRoot":"","sources":["../src/net.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,qFAAqF;AACrF,MAAM,UAAU,SAAS,CAAC,EAAU;IAClC,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,KAAK,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QAC7B,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,UAAU,CAAC,EAAU,EAAE,IAAY;IACjD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3E,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,EAAU;IACnC,IAAI,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,IAAI,IAAI,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAE7B,MAAM,WAAW,GAAG,CAAC,CAAS,EAAmB,EAAE;QACjD,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;QACrC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC9C,IAAI,OAAO,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7B,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,KAAK,CAAS,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,EAAU,EAAE,UAAkB;IACzD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,SAAS,IAAI,CAAC;YAAE,MAAM;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC;QACrE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACpD,SAAS,IAAI,EAAE,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/record.d.ts

@@ -0,0 +1,36 @@
+import type { GeneratedDataset } from "./generate.js";
+import type { FieldType, Tier } from "./types.js";
+export declare const SAFESEED_VERSION = "0.2.0";
+export interface FieldRecord {
+    name: string;
+    type: FieldType;
+    tier: Tier;
+    citation: string;
+    claim: string;
+    /**
+     * SHA-256 over a canonical serialization of this column's values (see
+     * `canonicalColumn`). Lets column-scoped verify re-check one declared column
+     * independently of the rest of the file. Optional only for backward compat with
+     * 0.1.0 records that predate it; `makeRunRecord` always emits it.
+     */
+    sha256?: string;
+}
+export interface RunRecord {
+    safeseedVersion: string;
+    catalogVersion: string;
+    seed: number;
+    rowCount: number;
+    columns: string[];
+    fields: FieldRecord[];
+    /** SHA-256 of the exact emitted file content. */
+    contentSha256: string;
+    /** Honest statement of what this record attests and what it does NOT. */
+    attestation: string;
+    /** Optional caller-supplied timestamp; omitted by default to keep records deterministic. */
+    generatedAt?: string;
+}
+export declare const ATTESTATION: string;
+export declare function makeRunRecord(dataset: GeneratedDataset, csv: string, opts?: {
+    generatedAt?: string;
+}): Promise<RunRecord>;
+//# sourceMappingURL=record.d.ts.map

package/dist/record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"record.d.ts","sourceRoot":"","sources":["../src/record.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAKlD,eAAO,MAAM,gBAAgB,UAAU,CAAC;AAExC,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,SAAS;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,iDAAiD;IACjD,aAAa,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB,4FAA4F;IAC5F,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,eAAO,MAAM,WAAW,QASb,CAAC;AAEZ,wBAAsB,aAAa,CACjC,OAAO,EAAE,gBAAgB,EACzB,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9B,OAAO,CAAC,SAAS,CAAC,CA2BpB"}

package/dist/record.js

@@ -0,0 +1,53 @@
+/**
+ * The tamper-evident run record.
+ *
+ * A run record binds to the exact bytes of the file SafeSeed emitted (a SHA-256
+ * content hash) and states, per field, the reserved range and honesty tier used.
+ * It is deliberately a *tamper-evident record*, not "cryptographic proof that the
+ * file contains no PII" — the battle-test panel killed the stronger claim, because
+ * a signature proves the tool ran, not that the file is free of personal data.
+ */
+import { CATALOG_VERSION, getEntry } from "./catalog.js";
+import { sha256Hex } from "./hash.js";
+import { canonicalColumn } from "./csv.js";
+// 0.2.0 adds a per-column `sha256` to every FieldRecord (the basis for opt-in
+// column-scoped verify). It is purely additive — strict whole-file verify is
+// unchanged, and a 0.1.0 record without per-column hashes still verifies strictly.
+export const SAFESEED_VERSION = "0.2.0";
+export const ATTESTATION = [
+    "This run record attests that the named dataset was generated by SafeSeed from",
+    "standards-reserved ranges, with no real input data. It is a tamper-evident",
+    "record, not a cryptographic proof that the file contains no personal data. It",
+    "attests the generator and binds to this file's content hash; it says nothing",
+    "about edits made after generation.",
+    '"Not derived from production data" is not the same claim as "not personal data."',
+    "Re-verify against the actual artifact in your pipeline (GDPR Art. 25/32 control",
+    "for non-production environments; not a scope-out from privacy law).",
+].join(" ");
+export async function makeRunRecord(dataset, csv, opts) {
+    const contentSha256 = await sha256Hex(csv);
+    const fields = await Promise.all(dataset.schema.map(async (f, c) => {
+        const entry = getEntry(f.type);
+        const column = dataset.rows.map((row) => row[c] ?? "");
+        return {
+            name: f.name,
+            type: f.type,
+            tier: entry.tier,
+            citation: entry.citation,
+            claim: entry.claim,
+            sha256: await sha256Hex(canonicalColumn(column)),
+        };
+    }));
+    return {
+        safeseedVersion: SAFESEED_VERSION,
+        catalogVersion: dataset.catalogVersion ?? CATALOG_VERSION,
+        seed: dataset.seed,
+        rowCount: dataset.rows.length,
+        columns: dataset.columns,
+        fields,
+        contentSha256,
+        attestation: ATTESTATION,
+        ...(opts?.generatedAt !== undefined ? { generatedAt: opts.generatedAt } : {}),
+    };
+}
+//# sourceMappingURL=record.js.map

package/dist/record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record.js","sourceRoot":"","sources":["../src/record.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAI3C,8EAA8E;AAC9E,6EAA6E;AAC7E,mFAAmF;AACnF,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAgCxC,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,+EAA+E;IAC/E,4EAA4E;IAC5E,+EAA+E;IAC/E,8EAA8E;IAC9E,oCAAoC;IACpC,kFAAkF;IAClF,iFAAiF;IACjF,qEAAqE;CACtE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAyB,EACzB,GAAW,EACX,IAA+B;IAE/B,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAkB,MAAM,OAAO,CAAC,GAAG,CAC7C,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACvD,OAAO;YACL,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,MAAM,SAAS,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;SACjD,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IACF,OAAO;QACL,eAAe,EAAE,gBAAgB;QACjC,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,eAAe;QACzD,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;QAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM;QACN,aAAa;QACb,WAAW,EAAE,WAAW;QACxB,GAAG,CAAC,IAAI,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC;AACJ,CAAC"}

package/dist/rng.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Tiny seeded PRNG so generation is deterministic: the same seed always produces
+ * the same dataset, which makes output a committable, reviewable fixture.
+ *
+ * mulberry32 — a well-known, public-domain 32-bit generator. Not cryptographic;
+ * it never needs to be. Determinism, not unpredictability, is the requirement.
+ */
+export declare function mulberry32(seed: number): () => number;
+/** Deterministically pick one element from a non-empty array. */
+export declare function pick<T>(rng: () => number, arr: readonly T[]): T;
+/** Deterministic integer in [min, max] inclusive. */
+export declare function intBetween(rng: () => number, min: number, max: number): number;
+//# sourceMappingURL=rng.d.ts.map

package/dist/rng.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rng.d.ts","sourceRoot":"","sources":["../src/rng.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,MAAM,CASrD;AAED,iEAAiE;AACjE,wBAAgB,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAE/D;AAED,qDAAqD;AACrD,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9E"}

package/dist/rng.js

@@ -0,0 +1,26 @@
+/**
+ * Tiny seeded PRNG so generation is deterministic: the same seed always produces
+ * the same dataset, which makes output a committable, reviewable fixture.
+ *
+ * mulberry32 — a well-known, public-domain 32-bit generator. Not cryptographic;
+ * it never needs to be. Determinism, not unpredictability, is the requirement.
+ */
+export function mulberry32(seed) {
+    let a = seed >>> 0;
+    return function next() {
+        a |= 0;
+        a = (a + 0x6d2b79f5) | 0;
+        let t = Math.imul(a ^ (a >>> 15), 1 | a);
+        t = (t + Math.imul(t ^ (t >>> 7), 61 | t)) ^ t;
+        return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
+    };
+}
+/** Deterministically pick one element from a non-empty array. */
+export function pick(rng, arr) {
+    return arr[Math.floor(rng() * arr.length)];
+}
+/** Deterministic integer in [min, max] inclusive. */
+export function intBetween(rng, min, max) {
+    return min + Math.floor(rng() * (max - min + 1));
+}
+//# sourceMappingURL=rng.js.map

package/dist/rng.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rng.js","sourceRoot":"","sources":["../src/rng.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC;IACnB,OAAO,SAAS,IAAI;QAClB,CAAC,IAAI,CAAC,CAAC;QACP,CAAC,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/C,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,UAAU,CAAC;IAC/C,CAAC,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,IAAI,CAAI,GAAiB,EAAE,GAAiB;IAC1D,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAAE,CAAC;AAC9C,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,UAAU,CAAC,GAAiB,EAAE,GAAW,EAAE,GAAW;IACpE,OAAO,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC"}

package/dist/scan.d.ts

@@ -0,0 +1,24 @@
+import type { FieldType } from "./types.js";
+export interface ScanColumn {
+    name: string;
+    type: FieldType;
+}
+export interface ScanOptions {
+    csv: string;
+    columns: ScanColumn[];
+}
+export interface ScanFinding {
+    field: string;
+    type: FieldType;
+    row: number;
+    value: string;
+    reason: string;
+}
+export interface ScanResult {
+    ok: boolean;
+    findings: ScanFinding[];
+    perField: Record<string, number>;
+    scannedRows: number;
+}
+export declare function scan(opts: ScanOptions): ScanResult;
+//# sourceMappingURL=scan.d.ts.map

package/dist/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,UAAU,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,SAAS,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,UAAU,CAmClD"}

package/dist/scan.js

@@ -0,0 +1,49 @@
+/**
+ * `scan` — reverse mode. Point it at an *existing* CSV / seed file and tell it the
+ * expected type of each column; it flags every value that is NOT in the reserved
+ * range as a candidate piece of real PII.
+ *
+ * The panel called this the thing they'd deploy first: it addresses the prod dump
+ * already sitting in staging, not just freshly generated data. It is a detector of
+ * candidates, not a classifier — a finding means "this is not provably safe, look
+ * at it", not "this is definitely a real person".
+ */
+import { getEntry, isReserved } from "./catalog.js";
+import { parseCsv } from "./csv.js";
+export function scan(opts) {
+    const { columns: dataColumns, rows } = parseCsv(opts.csv);
+    const findings = [];
+    const perField = {};
+    for (const col of opts.columns)
+        perField[col.name] = 0;
+    const indexByName = new Map();
+    dataColumns.forEach((name, i) => indexByName.set(name, i));
+    rows.forEach((row, r) => {
+        for (const col of opts.columns) {
+            const idx = indexByName.get(col.name);
+            if (idx === undefined)
+                continue;
+            const value = row[idx];
+            if (value === undefined || value === "")
+                continue;
+            const entry = getEntry(col.type);
+            if (!isReserved(entry, value)) {
+                findings.push({
+                    field: col.name,
+                    type: col.type,
+                    row: r,
+                    value,
+                    reason: `not in reserved range for ${col.type}`,
+                });
+                perField[col.name] = (perField[col.name] ?? 0) + 1;
+            }
+        }
+    });
+    return {
+        ok: findings.length === 0,
+        findings,
+        perField,
+        scannedRows: rows.length,
+    };
+}
+//# sourceMappingURL=scan.js.map

package/dist/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AA4BpC,MAAM,UAAU,IAAI,CAAC,IAAiB;IACpC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO;QAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEvD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAE3D,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACtB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,GAAG,KAAK,SAAS;gBAAE,SAAS;YAChC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;gBAAE,SAAS;YAClD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC9B,QAAQ,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,GAAG,CAAC,IAAI;oBACf,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,GAAG,EAAE,CAAC;oBACN,KAAK;oBACL,MAAM,EAAE,6BAA6B,GAAG,CAAC,IAAI,EAAE;iBAChD,CAAC,CAAC;gBACH,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QACzB,QAAQ;QACR,QAAQ;QACR,WAAW,EAAE,IAAI,CAAC,MAAM;KACzB,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Core type vocabulary for SafeSeed.
+ *
+ * The honesty tier is the load-bearing concept: every value SafeSeed touches is
+ * classified by *how* it is known to be non-real, and the language allowed about
+ * it follows from the tier (see `record.ts`).
+ */
+/**
+ * How a value is known to be non-real. Ordered from strongest to weakest claim.
+ *
+ * - `provably-non-real`     reserved by a published *standard / protocol*; cannot
+ *                           belong to a real person or system (RFC 2606 domains,
+ *                           RFC 5737 / 3849 documentation IPs). The standard itself
+ *                           makes them non-routable / non-registrable.
+ * - `reserved-not-issued`   reserved by the *issuing authority* and never assigned,
+ *                           so no real holder has one (NANPA 555-01xx fictitious
+ *                           phones, SSA never-issued SSN ranges). Strong, but it
+ *                           rests on administrative policy, NOT protocol — so it is
+ *                           held apart from the protocol-provable tier above.
+ * - `designated-test-only`  a valid-looking value that networks/sandboxes have
+ *                           *designated* for testing (e.g. card test PANs). It
+ *                           passes validation, so it is non-real by designation,
+ *                           NOT by impossibility.
+ * - `structurally-fake`     no standard reserves it (names, addresses, free text),
+ *                           so it is made self-evidently fake instead of plausible.
+ */
+export type Tier = "provably-non-real" | "reserved-not-issued" | "designated-test-only" | "structurally-fake";
+/** The PII-shaped field types SafeSeed knows how to generate, verify, and scan. */
+export type FieldType = "email" | "domain" | "ipv4" | "ipv6" | "phone" | "ssn" | "creditCard" | "firstName" | "lastName" | "fullName" | "streetAddress" | "freeText";
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,IAAI,GACZ,mBAAmB,GACnB,qBAAqB,GACrB,sBAAsB,GACtB,mBAAmB,CAAC;AAExB,mFAAmF;AACnF,MAAM,MAAM,SAAS,GACjB,OAAO,GACP,QAAQ,GACR,MAAM,GACN,MAAM,GACN,OAAO,GACP,KAAK,GACL,YAAY,GACZ,WAAW,GACX,UAAU,GACV,UAAU,GACV,eAAe,GACf,UAAU,CAAC"}

package/dist/types.js

@@ -0,0 +1,9 @@
+/**
+ * Core type vocabulary for SafeSeed.
+ *
+ * The honesty tier is the load-bearing concept: every value SafeSeed touches is
+ * classified by *how* it is known to be non-real, and the language allowed about
+ * it follows from the tier (see `record.ts`).
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/verify.d.ts

@@ -0,0 +1,33 @@
+import type { RunRecord } from "./record.js";
+export type VerifyFailureKind = "content-hash-mismatch" | "out-of-range-value" | "schema-mismatch" | "row-arity-mismatch" | "missing-column" | "column-hash-mismatch";
+export interface VerifyFailure {
+    kind: VerifyFailureKind;
+    message: string;
+    field?: string;
+    row?: number;
+    value?: string;
+}
+export interface VerifyResult {
+    ok: boolean;
+    failures: VerifyFailure[];
+    checked: {
+        rows: number;
+        fields: number;
+    };
+    /** Columns present in the file but not declared in the record (column-scoped mode). */
+    unattestedColumns: string[];
+    /** Non-fatal notes, e.g. a 0.1.0 record with no per-column hash → range-only fallback. */
+    warnings: string[];
+}
+export interface VerifyOptions {
+    /**
+     * Opt-in column-scoped mode. Attest only the declared synthetic columns (by name)
+     * and report — rather than fail on — columns the team added. Off by default, so
+     * the strict whole-file guarantee is the one you get unless you ask otherwise.
+     */
+    allowAddedColumns?: boolean;
+}
+export declare function verify(csv: string, record: RunRecord, opts?: VerifyOptions): Promise<VerifyResult>;
+/** CI helper: 0 when clean, 1 on any drift. */
+export declare function exitCode(result: VerifyResult): number;
+//# sourceMappingURL=verify.d.ts.map

package/dist/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,MAAM,iBAAiB,GACzB,uBAAuB,GACvB,oBAAoB,GACpB,iBAAiB,GACjB,oBAAoB,GACpB,gBAAgB,GAChB,sBAAsB,CAAC;AAE3B,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,iBAAiB,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,uFAAuF;IACvF,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,0FAA0F;IAC1F,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,wBAAsB,MAAM,CAC1B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,SAAS,EACjB,IAAI,CAAC,EAAE,aAAa,GACnB,OAAO,CAAC,YAAY,CAAC,CAEvB;AA0KD,+CAA+C;AAC/C,wBAAgB,QAAQ,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAErD"}

package/dist/verify.js

@@ -0,0 +1,177 @@
+/**
+ * `verify` — the enforcement gate. Given a file and its run record, it:
+ *   1. re-hashes the file and compares to the recorded content hash (tamper-evidence), and
+ *   2. independently re-checks every value against its declared reserved range.
+ *
+ * Both checks run and all failures are reported. The range check is independent of
+ * the hash on purpose: even if someone edits the file *and* recomputes the hash,
+ * an out-of-range (candidate real) value still fails. Wire `exitCode` into CI to
+ * fail the build on any drift.
+ *
+ * Strict whole-file verify is the DEFAULT. Pass `{ allowAddedColumns: true }` for
+ * column-scoped verify: it attests only the declared synthetic columns (matched by
+ * header name, order-independent) via per-column hash + range, and REPORTS added
+ * business columns as unattested rather than failing on them. The relaxed
+ * guarantee is never silent — it only happens when the caller opts in. Column-scoped
+ * verify vouches for the synthetic columns; the columns a team adds are out of
+ * scope here and must be checked with `scan`.
+ */
+import { getEntry, isReserved } from "./catalog.js";
+import { sha256Hex } from "./hash.js";
+import { parseCsv, canonicalColumn } from "./csv.js";
+export async function verify(csv, record, opts) {
+    return opts?.allowAddedColumns ? verifyColumnScoped(csv, record) : verifyStrict(csv, record);
+}
+async function verifyStrict(csv, record) {
+    const failures = [];
+    const actualHash = await sha256Hex(csv);
+    if (actualHash !== record.contentSha256) {
+        failures.push({
+            kind: "content-hash-mismatch",
+            message: `content hash ${actualHash} does not match recorded ${record.contentSha256}`,
+        });
+    }
+    const { columns, rows } = parseCsv(csv);
+    const columnsMatch = columns.length === record.columns.length &&
+        columns.every((c, i) => c === record.columns[i]);
+    if (!columnsMatch) {
+        failures.push({
+            kind: "schema-mismatch",
+            message: `columns ${JSON.stringify(columns)} do not match recorded ${JSON.stringify(record.columns)}`,
+        });
+    }
+    rows.forEach((row, r) => {
+        // The verifier must be authoritative over the WHOLE row, not just the declared
+        // columns — otherwise a tampered file could append a trailing column of real PII
+        // (and recompute the hash) and pass. Any arity mismatch is a failure.
+        if (row.length !== record.fields.length) {
+            failures.push({
+                kind: "row-arity-mismatch",
+                row: r,
+                message: `row ${r}: expected ${record.fields.length} columns, found ${row.length}`,
+            });
+        }
+        record.fields.forEach((field, c) => {
+            const value = row[c];
+            if (value === undefined) {
+                failures.push({
+                    kind: "out-of-range-value",
+                    field: field.name,
+                    row: r,
+                    message: `${field.name} row ${r}: missing value`,
+                });
+                return;
+            }
+            const entry = getEntry(field.type);
+            if (!isReserved(entry, value)) {
+                failures.push({
+                    kind: "out-of-range-value",
+                    field: field.name,
+                    row: r,
+                    value,
+                    message: `${field.name} row ${r}: "${value}" is not in the reserved range for ${field.type}`,
+                });
+            }
+        });
+    });
+    return {
+        ok: failures.length === 0,
+        failures,
+        checked: { rows: rows.length, fields: record.fields.length },
+        unattestedColumns: [],
+        warnings: [],
+    };
+}
+async function verifyColumnScoped(csv, record) {
+    const failures = [];
+    const warnings = [];
+    const { columns, rows } = parseCsv(csv);
+    // The file must stay rectangular: every row matches the header width. This closes
+    // the same hole strict mode closes — a trailing unheadered cell can't smuggle in
+    // real PII, because it would make a row wider than the header and fail here.
+    rows.forEach((row, r) => {
+        if (row.length !== columns.length) {
+            failures.push({
+                kind: "row-arity-mismatch",
+                row: r,
+                message: `row ${r}: expected ${columns.length} columns, found ${row.length}`,
+            });
+        }
+    });
+    // Count header occurrences so a duplicated declared name is caught as ambiguous
+    // rather than silently resolving to the first match.
+    const occurrences = new Map();
+    for (const h of columns)
+        occurrences.set(h, (occurrences.get(h) ?? 0) + 1);
+    const declaredNames = new Set(record.fields.map((f) => f.name));
+    for (const field of record.fields) {
+        const count = occurrences.get(field.name) ?? 0;
+        if (count === 0) {
+            failures.push({
+                kind: "missing-column",
+                field: field.name,
+                message: `declared column "${field.name}" is missing from the file`,
+            });
+            continue;
+        }
+        if (count > 1) {
+            failures.push({
+                kind: "schema-mismatch",
+                field: field.name,
+                message: `declared column "${field.name}" is ambiguous: it appears ${count} times`,
+            });
+            continue;
+        }
+        const idx = columns.indexOf(field.name);
+        const values = rows.map((row) => row[idx] ?? "");
+        const entry = getEntry(field.type);
+        // Independent range check: a real value smuggled into a synthetic column fails
+        // even if an attacker recomputes the column hash to match.
+        values.forEach((value, r) => {
+            if (!isReserved(entry, value)) {
+                failures.push({
+                    kind: "out-of-range-value",
+                    field: field.name,
+                    row: r,
+                    value,
+                    message: `${field.name} row ${r}: "${value}" is not in the reserved range for ${field.type}`,
+                });
+            }
+        });
+        // Per-column hash: catches an in-range swap (one reserved value for another)
+        // that the range check alone would wave through. Falls back to range-only with a
+        // warning for 0.1.0 records that predate per-column hashes.
+        if (field.sha256 === undefined) {
+            warnings.push(`column "${field.name}": run record predates per-column hashes; verified by range only`);
+        }
+        else {
+            const actual = await sha256Hex(canonicalColumn(values));
+            if (actual !== field.sha256) {
+                failures.push({
+                    kind: "column-hash-mismatch",
+                    field: field.name,
+                    message: `column "${field.name}" hash ${actual} does not match recorded ${field.sha256}`,
+                });
+            }
+        }
+    }
+    const unattestedColumns = columns.filter((c) => !declaredNames.has(c));
+    // A blank-headed added column is surfaced (it's in unattestedColumns as ""), but a "" in
+    // a long list is easy to miss — and a team told to "scan the columns you added" can't
+    // easily name it. Warn so it can't be overlooked. Not a failure: added columns are scan's job.
+    if (unattestedColumns.some((c) => c.trim() === "")) {
+        warnings.push("an added (unattested) column has a blank header; make sure your scan covers it");
+    }
+    return {
+        ok: failures.length === 0,
+        failures,
+        checked: { rows: rows.length, fields: record.fields.length },
+        unattestedColumns,
+        warnings,
+    };
+}
+/** CI helper: 0 when clean, 1 on any drift. */
+export function exitCode(result) {
+    return result.ok ? 0 : 1;
+}
+//# sourceMappingURL=verify.js.map

package/dist/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAsCrD,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,GAAW,EACX,MAAiB,EACjB,IAAoB;IAEpB,OAAO,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAC/F,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,MAAiB;IACxD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,UAAU,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;QACxC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,gBAAgB,UAAU,4BAA4B,MAAM,CAAC,aAAa,EAAE;SACtF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAExC,MAAM,YAAY,GAChB,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM;QACxC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,WAAW,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;SACtG,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACtB,+EAA+E;QAC/E,iFAAiF;QACjF,sEAAsE;QACtE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,GAAG,EAAE,CAAC;gBACN,OAAO,EAAE,OAAO,CAAC,cAAc,MAAM,CAAC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE;aACnF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YACjC,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,oBAAoB;oBAC1B,KAAK,EAAE,KAAK,CAAC,IAAI;oBACjB,GAAG,EAAE,CAAC;oBACN,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,QAAQ,CAAC,iBAAiB;iBACjD,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC9B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,oBAAoB;oBAC1B,KAAK,EAAE,KAAK,CAAC,IAAI;oBACjB,GAAG,EAAE,CAAC;oBACN,KAAK;oBACL,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,sCAAsC,KAAK,CAAC,IAAI,EAAE;iBAC7F,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QACzB,QAAQ;QACR,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE;QAC5D,iBAAiB,EAAE,EAAE;QACrB,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,GAAW,EAAE,MAAiB;IAC9D,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAExC,kFAAkF;IAClF,iFAAiF;IACjF,6EAA6E;IAC7E,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACtB,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YAClC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,GAAG,EAAE,CAAC;gBACN,OAAO,EAAE,OAAO,CAAC,cAAc,OAAO,CAAC,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE;aAC7E,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,qDAAqD;IACrD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEhE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,OAAO,EAAE,oBAAoB,KAAK,CAAC,IAAI,4BAA4B;aACpE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,iBAAiB;gBACvB,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,OAAO,EAAE,oBAAoB,KAAK,CAAC,IAAI,8BAA8B,KAAK,QAAQ;aACnF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEnC,+EAA+E;QAC/E,2DAA2D;QAC3D,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YAC1B,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC9B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,oBAAoB;oBAC1B,KAAK,EAAE,KAAK,CAAC,IAAI;oBACjB,GAAG,EAAE,CAAC;oBACN,KAAK;oBACL,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,sCAAsC,KAAK,CAAC,IAAI,EAAE;iBAC7F,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,6EAA6E;QAC7E,iFAAiF;QACjF,4DAA4D;QAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CACX,WAAW,KAAK,CAAC,IAAI,kEAAkE,CACxF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;YACxD,IAAI,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,sBAAsB;oBAC5B,KAAK,EAAE,KAAK,CAAC,IAAI;oBACjB,OAAO,EAAE,WAAW,KAAK,CAAC,IAAI,UAAU,MAAM,4BAA4B,KAAK,CAAC,MAAM,EAAE;iBACzF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvE,yFAAyF;IACzF,sFAAsF;IACtF,+FAA+F;IAC/F,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACnD,QAAQ,CAAC,IAAI,CACX,gFAAgF,CACjF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QACzB,QAAQ;QACR,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE;QAC5D,iBAAiB;QACjB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,QAAQ,CAAC,MAAoB;IAC3C,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC"}