usertrust 1.5.0 → 2.0.0

package/dist/audit/sigv4.d.ts

@@ -0,0 +1,44 @@
+export interface SigV4Credentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+}
+export interface SigV4Request {
+    method: string;
+    /** Virtual-host or path-style host, no scheme. Signed as the `host` header. */
+    host: string;
+    /** Already URI-encoded absolute path, e.g. `/bucket/key`. */
+    path: string;
+    /** Canonical (sorted, encoded) query string; empty when absent. */
+    query?: string;
+    /** Lowercase-normalized on the way in; `host` is supplied by `host` above. */
+    headers: Record<string, string>;
+    payload: Buffer;
+    region: string;
+    service: string;
+    /** `YYYYMMDDTHHMMSSZ` — injected rather than read from the clock. */
+    amzDate: string;
+}
+/** sha256 hex of the request payload — S3 requires it as `x-amz-content-sha256`. */
+export declare function hashPayload(payload: Buffer): string;
+/**
+ * `METHOD\n<path>\n<query>\n<canonicalHeaders>\n<signedHeaders>\n<payloadHash>`
+ * — canonicalHeaders is a sorted `name:value\n` block, hence the blank line
+ * before the signed-header list.
+ */
+export declare function canonicalRequest(req: SigV4Request, payloadHash: string): string;
+/** `AWS4-HMAC-SHA256\n<amzDate>\n<scope>\n<sha256hex(canonicalRequest)>`. */
+export declare function stringToSign(req: SigV4Request, canonicalReqSha256: string): string;
+/**
+ * The date/region/service-scoped derived key. Scoping is what keeps a leaked
+ * signature from being replayable outside its day, region and service.
+ */
+export declare function signingKey(secret: string, date8: string, region: string, service: string): Buffer;
+/**
+ * Headers to add to the outbound request: `host`, `x-amz-date`,
+ * `x-amz-content-sha256`, `authorization`, and `x-amz-security-token` when the
+ * credentials are temporary. Caller-supplied headers are signed but not
+ * returned — the caller already has them and must send them verbatim.
+ */
+export declare function sigV4Headers(req: SigV4Request, creds: SigV4Credentials): Record<string, string>;
+//# sourceMappingURL=sigv4.d.ts.map

package/dist/audit/sigv4.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4.d.ts","sourceRoot":"","sources":["../../src/audit/sigv4.ts"],"names":[],"mappings":"AA6BA,MAAM,WAAW,gBAAgB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAC;CAChB;AAwBD,oFAAoF;AACpF,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEnD;AAqCD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAE/E;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,GAAG,MAAM,CAQlF;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAKjG;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA0B/F"}

package/dist/audit/sigv4.js

@@ -0,0 +1,134 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 Usertools, Inc.
+/**
+ * AWS Signature Version 4 — pure signer for the S3 anchor sink.
+ *
+ * Node built-ins only: pulling an AWS SDK in for four HMACs would put a
+ * multi-megabyte transitive dependency tree behind the audit trail, which is
+ * exactly what the anchoring design refuses to do.
+ *
+ * Every function here is pure — `amzDate` is supplied by the caller rather than
+ * read from the clock, so signatures are reproducible in tests and validated
+ * against AWS's published test vector (see tests/audit/sigv4.test.ts).
+ *
+ * Scope: SigV4 for requests whose payload is fully in memory (anchor records
+ * are a few hundred bytes). No streaming/chunked signing, no multipart.
+ *
+ * Credentials are never logged, echoed into errors, or returned — only the
+ * derived `authorization` header leaves this module.
+ */
+import { createHash, createHmac } from "node:crypto";
+const ALGORITHM = "AWS4-HMAC-SHA256";
+const TERMINATOR = "aws4_request";
+const AMZ_DATE = /^\d{8}T\d{6}Z$/;
+// ── Primitives ──
+function hmac(key, data) {
+    return createHmac("sha256", key).update(data, "utf8").digest();
+}
+/**
+ * The `YYYYMMDD` half of an amz date. A malformed date would otherwise be
+ * signed into a credential scope AWS cannot resolve, surfacing as an opaque
+ * 403 at publish time; fail here instead, where the cause is visible.
+ */
+function date8Of(amzDate) {
+    if (!AMZ_DATE.test(amzDate)) {
+        throw new Error(`sigv4: amzDate must be YYYYMMDDTHHMMSSZ, got "${amzDate.slice(0, 32)}"`);
+    }
+    return amzDate.slice(0, 8);
+}
+function credentialScope(date8, region, service) {
+    return `${date8}/${region}/${service}/${TERMINATOR}`;
+}
+/** sha256 hex of the request payload — S3 requires it as `x-amz-content-sha256`. */
+export function hashPayload(payload) {
+    return createHash("sha256").update(payload).digest("hex");
+}
+/**
+ * Canonical request plus the `;`-joined list of header names it signs.
+ *
+ * Header values are normalized the way AWS re-normalizes them server-side
+ * (trimmed, inner runs of spaces collapsed) so a value carrying incidental
+ * whitespace still verifies.
+ */
+function canonicalParts(req, payloadHash) {
+    const merged = new Map();
+    for (const [name, value] of Object.entries(req.headers)) {
+        merged.set(name.trim().toLowerCase(), value.trim().replace(/ {2,}/g, " "));
+    }
+    // These three are ours: a caller-supplied `host` header must never decide
+    // what the signature covers, and the digest must match the bytes we send.
+    merged.set("host", req.host);
+    merged.set("x-amz-date", req.amzDate);
+    merged.set("x-amz-content-sha256", payloadHash);
+    // Map keys are unique, so a comparator that never returns 0 is still total.
+    const entries = [...merged].sort((a, b) => (a[0] < b[0] ? -1 : 1));
+    const signedHeaders = entries.map(([name]) => name).join(";");
+    const canonical = [
+        req.method.toUpperCase(),
+        req.path,
+        req.query ?? "",
+        entries.map(([name, value]) => `${name}:${value}\n`).join(""),
+        signedHeaders,
+        payloadHash,
+    ].join("\n");
+    return { canonical, signedHeaders };
+}
+/**
+ * `METHOD\n<path>\n<query>\n<canonicalHeaders>\n<signedHeaders>\n<payloadHash>`
+ * — canonicalHeaders is a sorted `name:value\n` block, hence the blank line
+ * before the signed-header list.
+ */
+export function canonicalRequest(req, payloadHash) {
+    return canonicalParts(req, payloadHash).canonical;
+}
+/** `AWS4-HMAC-SHA256\n<amzDate>\n<scope>\n<sha256hex(canonicalRequest)>`. */
+export function stringToSign(req, canonicalReqSha256) {
+    const date8 = date8Of(req.amzDate);
+    return [
+        ALGORITHM,
+        req.amzDate,
+        credentialScope(date8, req.region, req.service),
+        canonicalReqSha256,
+    ].join("\n");
+}
+/**
+ * The date/region/service-scoped derived key. Scoping is what keeps a leaked
+ * signature from being replayable outside its day, region and service.
+ */
+export function signingKey(secret, date8, region, service) {
+    const kDate = hmac(`AWS4${secret}`, date8);
+    const kRegion = hmac(kDate, region);
+    const kService = hmac(kRegion, service);
+    return hmac(kService, TERMINATOR);
+}
+/**
+ * Headers to add to the outbound request: `host`, `x-amz-date`,
+ * `x-amz-content-sha256`, `authorization`, and `x-amz-security-token` when the
+ * credentials are temporary. Caller-supplied headers are signed but not
+ * returned — the caller already has them and must send them verbatim.
+ */
+export function sigV4Headers(req, creds) {
+    const date8 = date8Of(req.amzDate);
+    const payloadHash = hashPayload(req.payload);
+    // The session token is part of the signature, not just a header alongside it.
+    const signReq = creds.sessionToken
+        ? { ...req, headers: { ...req.headers, "x-amz-security-token": creds.sessionToken } }
+        : req;
+    const { canonical, signedHeaders } = canonicalParts(signReq, payloadHash);
+    const canonicalHash = createHash("sha256").update(canonical, "utf8").digest("hex");
+    const key = signingKey(creds.secretAccessKey, date8, req.region, req.service);
+    const signature = hmac(key, stringToSign(signReq, canonicalHash)).toString("hex");
+    const scope = credentialScope(date8, req.region, req.service);
+    const out = {
+        host: req.host,
+        "x-amz-date": req.amzDate,
+        "x-amz-content-sha256": payloadHash,
+        authorization: `${ALGORITHM} Credential=${creds.accessKeyId}/${scope}, ` +
+            `SignedHeaders=${signedHeaders}, Signature=${signature}`,
+    };
+    if (creds.sessionToken) {
+        out["x-amz-security-token"] = creds.sessionToken;
+    }
+    return out;
+}
+//# sourceMappingURL=sigv4.js.map

package/dist/audit/sigv4.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4.js","sourceRoot":"","sources":["../../src/audit/sigv4.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,SAAS,GAAG,kBAAkB,CAAC;AACrC,MAAM,UAAU,GAAG,cAAc,CAAC;AAClC,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AA2BlC,mBAAmB;AAEnB,SAAS,IAAI,CAAC,GAAoB,EAAE,IAAY;IAC/C,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,SAAS,OAAO,CAAC,OAAe;IAC/B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,iDAAiD,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,MAAc,EAAE,OAAe;IACtE,OAAO,GAAG,KAAK,IAAI,MAAM,IAAI,OAAO,IAAI,UAAU,EAAE,CAAC;AACtD,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,WAAW,CAAC,OAAe;IAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CACtB,GAAiB,EACjB,WAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACzD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,WAAW,CAAC,CAAC;IAEhD,4EAA4E;IAC5E,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG;QACjB,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE;QACxB,GAAG,CAAC,IAAI;QACR,GAAG,CAAC,KAAK,IAAI,EAAE;QACf,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,aAAa;QACb,WAAW;KACX,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAiB,EAAE,WAAmB;IACtE,OAAO,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,SAAS,CAAC;AACnD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,GAAiB,EAAE,kBAA0B;IACzE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO;QACN,SAAS;QACT,GAAG,CAAC,OAAO;QACX,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC;QAC/C,kBAAkB;KAClB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,KAAa,EAAE,MAAc,EAAE,OAAe;IACxF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxC,OAAO,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,GAAiB,EAAE,KAAuB;IACtE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7C,8EAA8E;IAC9E,MAAM,OAAO,GAAiB,KAAK,CAAC,YAAY;QAC/C,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,sBAAsB,EAAE,KAAK,CAAC,YAAY,EAAE,EAAE;QACrF,CAAC,CAAC,GAAG,CAAC;IAEP,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC1E,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnF,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAElF,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,GAAG,GAA2B;QACnC,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,YAAY,EAAE,GAAG,CAAC,OAAO;QACzB,sBAAsB,EAAE,WAAW;QACnC,aAAa,EACZ,GAAG,SAAS,eAAe,KAAK,CAAC,WAAW,IAAI,KAAK,IAAI;YACzD,iBAAiB,aAAa,eAAe,SAAS,EAAE;KACzD,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACxB,GAAG,CAAC,sBAAsB,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC"}

package/dist/audit/verify.d.ts

@@ -1,3 +1,5 @@
+import { type AnchorRecord, type AnchorSource, type AnchorState, type AnchorTrust, type WitnessInput, type WitnessStatus } from "./anchor-verify.js";
+export type { AnchorRecord, AnchorSource, AnchorState, AnchorTrust, WitnessInput };
 export interface ChainVerificationResult {
     valid: boolean;
     eventsVerified: number;
@@ -26,4 +28,80 @@ export declare function verifyChain(logPath: string): ChainVerificationResult;
  * "previousHash mismatch"), and checks the `.meta` tail anchor.
  */
 export declare function verifyVault(vaultPath: string): VaultVerificationResult;
+export interface AnchorVerifyParams {
+    /** Raw contents of caller-fetched anchor artifacts (single JSON or JSONL). */
+    readonly externalAnchorsRaw?: readonly string[] | undefined;
+    /** Raw transparency-log receipts: one receipt JSON, or JSONL of receipts. */
+    readonly rekorReceiptsRaw?: readonly string[] | undefined;
+    /**
+     * Caller-pinned transparency-log keys. Supplying none is only meaningful for
+     * the one log whose key ships with the verifier (rekor.sigstore.dev); any
+     * other log without a pin is refused rather than trusted.
+     */
+    readonly rekorLogPubkeysPem?: readonly string[] | undefined;
+    /** Caller-pinned trust material — NEVER read from the vault under audit. */
+    readonly trust?: AnchorTrust | undefined;
+    readonly witness?: WitnessInput | undefined;
+    readonly maxAnchorAgeMs?: number | undefined;
+    readonly maxUnanchoredEvents?: number | undefined;
+    readonly expectedVaultId?: string | undefined;
+    readonly nowMs?: number | undefined;
+}
+export interface RekorReport {
+    receiptsVerified: number;
+    receiptsFailed: number;
+    /** Max attested time among verified receipts of the NEWEST anchor (ms). */
+    latestAttestedTimeMs: number | null;
+    errors: string[];
+}
+export interface AnchoringReport {
+    anchorSource: AnchorSource;
+    anchorCount: number;
+    latestAnchor: {
+        anchorSeq: number;
+        treeSize: number;
+        lastHash: string;
+        keyId: string;
+        timestamp: string;
+    } | null;
+    unanchoredTail: {
+        events: number;
+        sinceTimestampMs: number | null;
+    };
+    witness: {
+        requested: boolean;
+        status: WitnessStatus;
+        error?: string;
+    };
+    reasons: string[];
+    warnings: string[];
+    /** Present only when transparency-log receipts were supplied. */
+    rekor?: RekorReport;
+}
+export interface AnchoredVaultVerificationResult extends VaultVerificationResult {
+    anchorState: AnchorState;
+    anchoring: AnchoringReport;
+}
+/**
+ * verifyVault + the spec §7.2 anchor state machine. Existing chain semantics
+ * are UNCHANGED (verifyVault runs as-is); anchor evaluation is layered on
+ * top additively. IDENTICAL function body in packages/core/src/audit/verify.ts
+ * — the anchor differential test pins the two.
+ */
+export declare function verifyVaultWithAnchors(vaultPath: string, params?: AnchorVerifyParams): AnchoredVaultVerificationResult;
+/**
+ * Exit-code policy for anchored verification. Exit codes stay 0/1
+ * (constraints §4.3); `--require-anchor` and `--require-external-anchor` are
+ * new INPUTS, not changed defaults.
+ */
+export declare function exitCodeForAnchored(result: {
+    valid: boolean;
+    anchorState: AnchorState;
+    anchoring: {
+        anchorSource: AnchorSource;
+    };
+}, opts?: {
+    requireAnchor?: boolean;
+    requireExternalAnchor?: boolean;
+}): number;
 //# sourceMappingURL=verify.d.ts.map

package/dist/audit/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/audit/verify.ts"],"names":[],"mappings":"AA6BA,MAAM,WAAW,uBAAuB;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AA0BD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,uBAAuB,CAgGpE;AAaD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,uBAAuB,CAuKtE"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/audit/verify.ts"],"names":[],"mappings":"AA0BA,OAAO,EACN,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,WAAW,EAKhB,KAAK,YAAY,EACjB,KAAK,aAAa,EAElB,MAAM,oBAAoB,CAAC;AAK5B,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AAEnF,MAAM,WAAW,uBAAuB;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AA0BD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,uBAAuB,CAgGpE;AAaD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,uBAAuB,CAuKtE;AAID,MAAM,WAAW,kBAAkB;IAClC,8EAA8E;IAC9E,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5D,6EAA6E;IAC7E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC1D;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5D,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED,MAAM,WAAW,WAAW;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,MAAM,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC/B,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;KAClB,GAAG,IAAI,CAAC;IACT,cAAc,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACpE,OAAO,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,aAAa,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,iEAAiE;IACjE,KAAK,CAAC,EAAE,WAAW,CAAC;CACpB;AAED,MAAM,WAAW,+BAAgC,SAAQ,uBAAuB;IAC/E,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,eAAe,CAAC;CAC3B;AAoHD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACrC,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,kBAAuB,GAC7B,+BAA+B,CA2DjC;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAClC,MAAM,EAAE;IACP,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE;QAAE,YAAY,EAAE,YAAY,CAAA;KAAE,CAAC;CAC1C,EACD,IAAI,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAC;IAAC,qBAAqB,CAAC,EAAE,OAAO,CAAA;CAAE,GACjE,MAAM,CAiBR"}

package/dist/audit/verify.js

@@ -18,11 +18,13 @@
  * test pins them together.
  */
 import { createHash } from "node:crypto";
-import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { basename, join } from "node:path";
 import { GENESIS_HASH } from "../shared/constants.js";
+import { evaluateAnchoredVault, gatherOrderedEventHashes, parseAnchorsContent, readAnchorMirror, worseAnchorState, } from "./anchor-verify.js";
 import { canonicalize } from "./canonical.js";
 import { buildMerkleTree } from "./merkle.js";
+import { parseRekorReceipt, verifyRekorReceipt } from "./rekor-verify.js";
 /**
  * Read the `.meta` head anchor sidecar. Fail-closed:
  *  - absent → `null` (unanchored / legacy vault; allowed)
@@ -281,4 +283,196 @@ export function verifyVault(vaultPath) {
         lastEvent,
     };
 }
+/**
+ * Split one raw receipt artifact into receipt documents. A file may hold a
+ * single (possibly pretty-printed) receipt or JSONL of many, so the whole-file
+ * parse is tried first and line-splitting is the fallback — the reverse would
+ * shred a pretty-printed receipt into unparseable fragments.
+ *
+ * IDENTICAL in packages/core/src/audit/verify.ts.
+ */
+function splitReceiptDocuments(raw) {
+    const trimmed = raw.trim();
+    if (trimmed.length === 0)
+        return [];
+    try {
+        JSON.parse(trimmed);
+        return [trimmed];
+    }
+    catch {
+        return trimmed
+            .split("\n")
+            .map((line) => line.trim())
+            .filter((line) => line.length > 0);
+    }
+}
+/**
+ * Verify every supplied transparency-log receipt against the anchor record it
+ * names. Receipts are OPTIONAL evidence, but supplied evidence is not
+ * advisory: a receipt is only ever presented to strengthen a claim, so one
+ * that does not verify fails the vault closed rather than being dropped.
+ *
+ * Records are matched by anchorSeq with the external copy governing (the same
+ * precedence the evaluator's merge uses). A receipt may bind to ANY record at
+ * its anchorSeq: committed-equal twins differ in exactly the timestamp and
+ * signature a receipt commits to, so the emitter's published twin must not
+ * depend on which copy the auditor happened to fetch first.
+ *
+ * IDENTICAL in packages/core/src/audit/verify.ts.
+ */
+function verifySuppliedRekorReceipts(receiptsRaw, externalRecords, mirrorRecords, logPubkeysPem) {
+    if (receiptsRaw.length === 0)
+        return null;
+    const bySeq = new Map();
+    for (const record of [...externalRecords, ...mirrorRecords]) {
+        const twins = bySeq.get(record.anchorSeq);
+        if (twins === undefined) {
+            bySeq.set(record.anchorSeq, [record]);
+        }
+        else {
+            twins.push(record);
+        }
+    }
+    // The NEWEST anchor by the evaluator's own rule (largest treeSize, earliest
+    // anchorSeq on a tie) — only its receipts may speak for freshness.
+    const merged = [...bySeq.keys()]
+        .sort((a, b) => a - b)
+        .map((seq) => bySeq.get(seq)[0]);
+    const latestSeq = [...merged].sort((a, b) => b.treeSize - a.treeSize)[0]?.anchorSeq ?? null;
+    const errors = [];
+    let receiptsVerified = 0;
+    let receiptsFailed = 0;
+    let latestAttestedTimeMs = null;
+    for (const raw of receiptsRaw) {
+        const documents = splitReceiptDocuments(raw);
+        if (documents.length === 0) {
+            // A receipts artifact that holds no receipts is a supply failure, not an
+            // absence of evidence: the caller passed --rekor-receipts, so an empty
+            // file means the receipt they meant to present never made it here.
+            receiptsFailed++;
+            errors.push("rekor-receipt-invalid: receipts artifact contained no receipts");
+            continue;
+        }
+        for (const document of documents) {
+            const parsed = parseRekorReceipt(document);
+            if (parsed.receipt === null) {
+                receiptsFailed++;
+                errors.push(parsed.error);
+                continue;
+            }
+            const receipt = parsed.receipt;
+            const candidates = bySeq.get(receipt.anchorSeq) ?? [];
+            if (candidates.length === 0) {
+                receiptsFailed++;
+                errors.push(`rekor-receipt-invalid: receipt for unknown anchorSeq ${receipt.anchorSeq}`);
+                continue;
+            }
+            let verified = null;
+            let firstErrors = [];
+            for (const candidate of candidates) {
+                const result = verifyRekorReceipt(receipt, candidate, logPubkeysPem);
+                if (result.ok) {
+                    verified = result;
+                    break;
+                }
+                if (firstErrors.length === 0)
+                    firstErrors = result.errors;
+            }
+            if (verified === null) {
+                receiptsFailed++;
+                errors.push(...firstErrors);
+                continue;
+            }
+            receiptsVerified++;
+            if (receipt.anchorSeq === latestSeq && verified.attestedTimeMs !== null) {
+                latestAttestedTimeMs =
+                    latestAttestedTimeMs === null
+                        ? verified.attestedTimeMs
+                        : Math.max(latestAttestedTimeMs, verified.attestedTimeMs);
+            }
+        }
+    }
+    return { receiptsVerified, receiptsFailed, latestAttestedTimeMs, errors };
+}
+/**
+ * verifyVault + the spec §7.2 anchor state machine. Existing chain semantics
+ * are UNCHANGED (verifyVault runs as-is); anchor evaluation is layered on
+ * top additively. IDENTICAL function body in packages/core/src/audit/verify.ts
+ * — the anchor differential test pins the two.
+ */
+export function verifyVaultWithAnchors(vaultPath, params = {}) {
+    const base = verifyVault(vaultPath);
+    const externalRecords = [];
+    const externalErrors = [];
+    for (const raw of params.externalAnchorsRaw ?? []) {
+        const parsed = parseAnchorsContent(raw);
+        externalRecords.push(...parsed.records);
+        externalErrors.push(...parsed.errors);
+    }
+    const mirror = readAnchorMirror(vaultPath);
+    const rekor = verifySuppliedRekorReceipts(params.rekorReceiptsRaw ?? [], externalRecords, mirror.records, params.rekorLogPubkeysPem ?? []);
+    const evaluation = evaluateAnchoredVault({
+        orderedHashes: gatherOrderedEventHashes(vaultPath),
+        externalAnchors: externalRecords,
+        externalErrors,
+        mirrorAnchors: mirror.records,
+        mirrorErrors: mirror.errors,
+        trust: params.trust ?? null,
+        witness: params.witness ?? { requested: false },
+        opts: {
+            ...(params.maxAnchorAgeMs !== undefined ? { maxAnchorAgeMs: params.maxAnchorAgeMs } : {}),
+            ...(params.maxUnanchoredEvents !== undefined
+                ? { maxUnanchoredEvents: params.maxUnanchoredEvents }
+                : {}),
+            ...(params.expectedVaultId !== undefined ? { expectedVaultId: params.expectedVaultId } : {}),
+            ...(params.nowMs !== undefined ? { nowMs: params.nowMs } : {}),
+            ...(rekor !== null && rekor.latestAttestedTimeMs !== null
+                ? { attestedTimeMs: rekor.latestAttestedTimeMs }
+                : {}),
+        },
+    });
+    // A broken receipt is ANCHOR_INVALID (fail-closed), escalated by the state
+    // machine's own severity ordering so MISMATCH still outranks it.
+    const rekorFailed = rekor !== null && rekor.receiptsFailed > 0;
+    return {
+        ...base,
+        valid: base.valid && evaluation.anchorsValid && !rekorFailed,
+        errors: [...base.errors, ...evaluation.errors, ...(rekor?.errors ?? [])],
+        anchorState: rekorFailed
+            ? worseAnchorState(evaluation.anchorState, "ANCHOR_INVALID")
+            : evaluation.anchorState,
+        anchoring: {
+            anchorSource: evaluation.anchorSource,
+            anchorCount: evaluation.anchorCount,
+            latestAnchor: evaluation.latestAnchor,
+            unanchoredTail: evaluation.unanchoredTail,
+            witness: evaluation.witness,
+            reasons: rekorFailed
+                ? [...new Set([...evaluation.reasons, "rekor-receipt-invalid"])]
+                : evaluation.reasons,
+            warnings: evaluation.warnings,
+            ...(rekor !== null ? { rekor } : {}),
+        },
+    };
+}
+/**
+ * Exit-code policy for anchored verification. Exit codes stay 0/1
+ * (constraints §4.3); `--require-anchor` and `--require-external-anchor` are
+ * new INPUTS, not changed defaults.
+ */
+export function exitCodeForAnchored(result, opts) {
+    if (!result.valid)
+        return 1;
+    if (opts?.requireAnchor === true &&
+        (result.anchorState === "UNANCHORED" ||
+            result.anchorState === "ANCHOR_UNVERIFIABLE" ||
+            result.anchorState === "ANCHOR_STALE")) {
+        return 1;
+    }
+    if (opts?.requireExternalAnchor === true &&
+        (result.anchorState !== "ANCHORED_VERIFIED" || result.anchoring.anchorSource !== "external")) {
+        return 1;
+    }
+    return 0;
+}
 //# sourceMappingURL=verify.js.map

package/dist/audit/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/audit/verify.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AA0B9C;;;;;GAKG;AACH,SAAS,UAAU,CAAC,QAAgB;IACnC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAA4B,CAAC;QACtF,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChF,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;AACF,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAe;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,OAAO,OAAO,CAAC,CAAC;IAChD,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACxB,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QACzD,CAAC;aAAM,CAAC;YACP,MAAM,GAAG,SAAS,CAAC;QACpB,CAAC;IACF,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACpB,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,8CAA8C,MAAM,CAAC,QAAQ,WAAW,CAAC,CAAC;QACvF,CAAC;QACD,OAAO;YACN,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC1B,cAAc,EAAE,CAAC;YACjB,MAAM;YACN,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,YAAY;YACxB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,oBAAoB,GAAG,YAAY,CAAC;IACxC,IAAI,UAAU,GAAG,YAAY,CAAC;IAC9B,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;QAEhC,IAAI,KAAiB,CAAC;QACtB,IAAI,CAAC;YACJ,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;QACxC,CAAC;QAAC,OAAO,SAAS,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CACV,IAAI,CAAC,SAAS,CAAC;gBACd,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,KAAK,EAAE,gBAAgB;gBACvB,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;aAC3B,CAAC,CACF,CAAC;YACF,4DAA4D;YAC5D,iEAAiE;YACjE,OAAO,EAAE,CAAC;YACV,SAAS;QACV,CAAC;QAED,IAAI,KAAK,CAAC,YAAY,KAAK,oBAAoB,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CACV,SAAS,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,EAAE,4BAA4B;gBACtD,YAAY,oBAAoB,SAAS,KAAK,CAAC,YAAY,EAAE,CAC9D,CAAC;QACH,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,gBAAgB,EAAE,GAAG,KAAK,CAAC;QACxD,MAAM,SAAS,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;QACjD,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE1E,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CACV,SAAS,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,EAAE,oBAAoB;gBAC9C,YAAY,YAAY,SAAS,UAAU,EAAE,CAC9C,CAAC;QACH,CAAC;QAED,oBAAoB,GAAG,UAAU,CAAC;QAClC,UAAU,GAAG,UAAU,CAAC;IACzB,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACZ,IAAI,UAAU,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CACV,uCAAuC,MAAM,CAAC,QAAQ,SAAS,UAAU,oBAAoB,CAC7F,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CACV,6BAA6B,MAAM,CAAC,QAAQ,oBAAoB,KAAK,CAAC,MAAM,wBAAwB,CACpG,CAAC;QACH,CAAC;IACF,CAAC;IAED,OAAO;QACN,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,cAAc,EAAE,KAAK,CAAC,MAAM;QAC5B,MAAM;QACN,OAAO;QACP,UAAU;QACV,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;AACH,CAAC;AAaD;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,2EAA2E;IAC3E,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC/C,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC;YACJ,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBAClD,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,cAAc,EAAE,CAAC;oBAC1D,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;gBAC1C,CAAC;YACF,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,qCAAqC;QACtC,CAAC;IACF,CAAC;IAED,wCAAwC;IACxC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,OAAO,OAAO,CAAC,CAAC;IAChD,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACxB,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QACzD,CAAC;aAAM,CAAC;YACP,MAAM,GAAG,SAAS,CAAC;QACpB,CAAC;IACF,CAAC;IAED,uBAAuB;IACvB,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,8BAA8B,QAAQ,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CACV,wCAAwC,MAAM,CAAC,QAAQ,+BAA+B,CACtF,CAAC;QACH,CAAC;QACD,OAAO;YACN,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC1B,MAAM;YACN,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,CAAC;YACd,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;SACf,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACxC,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACJ,OAAO,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACR,mDAAmD;YACnD,SAAS;QACV,CAAC;QACD,IAAI,OAAO,KAAK,EAAE;YAAE,SAAS;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;YAC/B,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;gBAC1D,MAAM,CAAC,IAAI,CAAC;oBACX,EAAE,EAAE,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;oBAClD,IAAI,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;oBACxD,YAAY,EAAE,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;oBAChF,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;oBAC3E,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;oBAC9E,MAAM;oBACN,UAAU,EAAE,WAAW;oBACvB,IAAI,EAAE,CAAC,GAAG,CAAC;iBACX,CAAC,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACR,MAAM,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnE,CAAC;QACF,CAAC;IACF,CAAC;IAED,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,UAAU;QACzB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,QAAmB,GAAI,CAAC,CAAC,QAAmB,CAAC;QAC7E,CAAC,CAAC,MAAM,CAAC;IAEV,qCAAqC;IACrC,IAAI,YAAY,GAAG,YAAY,CAAC;IAChC,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAgB,CAAC;QAEpC,IAAI,CAAC,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CACV,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,sCAAsC,YAAY,SAAS,CAAC,CAAC,YAAY,EAAE,CAClG,CAAC;QACH,CAAC;QAED,IAAI,UAAU,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,QAAQ,uCAAuC,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,UAAU,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,OAAO,GAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAiB,CAAC,QAAkB,CAAC;YACnE,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CACV,uBAAuB,CAAC,CAAC,QAAQ,YAAY,OAAO,2BAA2B,CAC/E,CAAC;YACH,CAAC;QACF,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;QAChD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/E,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,8BAA8B,QAAQ,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;aAAM,CAAC;YACP,WAAW,EAAE,CAAC;QACf,CAAC;QAED,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;YACjB,IAAI,UAAU,KAAK,IAAI;gBAAE,UAAU,GAAG,CAAC,CAAC,SAAS,CAAC;YAClD,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;QACzB,CAAC;QAED,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,oEAAoE;IACpE,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CACV,uCAAuC,MAAM,CAAC,QAAQ,SAAS,IAAI,CAAC,IAAI,oBAAoB,CAC5F,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CACV,6BAA6B,MAAM,CAAC,QAAQ,oBAAoB,OAAO,CAAC,MAAM,wBAAwB,CACtG,CAAC;QACH,CAAC;IACF,CAAC;IAED,gEAAgE;IAChE,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,UAAU,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;IAChC,CAAC;IAED,MAAM;IACN,OAAO;QACN,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM;QACN,WAAW,EAAE,MAAM,CAAC,MAAM;QAC1B,WAAW;QACX,UAAU;QACV,UAAU;QACV,SAAS;KACT,CAAC;AACH,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/audit/verify.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,OAAO,EAKN,qBAAqB,EACrB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAGhB,gBAAgB,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAA0B,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AA4BlG;;;;;GAKG;AACH,SAAS,UAAU,CAAC,QAAgB;IACnC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAA4B,CAAC;QACtF,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChF,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;AACF,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAe;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,OAAO,OAAO,CAAC,CAAC;IAChD,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACxB,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QACzD,CAAC;aAAM,CAAC;YACP,MAAM,GAAG,SAAS,CAAC;QACpB,CAAC;IACF,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACpB,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,8CAA8C,MAAM,CAAC,QAAQ,WAAW,CAAC,CAAC;QACvF,CAAC;QACD,OAAO;YACN,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC1B,cAAc,EAAE,CAAC;YACjB,MAAM;YACN,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,YAAY;YACxB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,oBAAoB,GAAG,YAAY,CAAC;IACxC,IAAI,UAAU,GAAG,YAAY,CAAC;IAC9B,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;QAEhC,IAAI,KAAiB,CAAC;QACtB,IAAI,CAAC;YACJ,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;QACxC,CAAC;QAAC,OAAO,SAAS,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CACV,IAAI,CAAC,SAAS,CAAC;gBACd,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,KAAK,EAAE,gBAAgB;gBACvB,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;aAC3B,CAAC,CACF,CAAC;YACF,4DAA4D;YAC5D,iEAAiE;YACjE,OAAO,EAAE,CAAC;YACV,SAAS;QACV,CAAC;QAED,IAAI,KAAK,CAAC,YAAY,KAAK,oBAAoB,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CACV,SAAS,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,EAAE,4BAA4B;gBACtD,YAAY,oBAAoB,SAAS,KAAK,CAAC,YAAY,EAAE,CAC9D,CAAC;QACH,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,gBAAgB,EAAE,GAAG,KAAK,CAAC;QACxD,MAAM,SAAS,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;QACjD,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE1E,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CACV,SAAS,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,EAAE,oBAAoB;gBAC9C,YAAY,YAAY,SAAS,UAAU,EAAE,CAC9C,CAAC;QACH,CAAC;QAED,oBAAoB,GAAG,UAAU,CAAC;QAClC,UAAU,GAAG,UAAU,CAAC;IACzB,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACZ,IAAI,UAAU,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CACV,uCAAuC,MAAM,CAAC,QAAQ,SAAS,UAAU,oBAAoB,CAC7F,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CACV,6BAA6B,MAAM,CAAC,QAAQ,oBAAoB,KAAK,CAAC,MAAM,wBAAwB,CACpG,CAAC;QACH,CAAC;IACF,CAAC;IAED,OAAO;QACN,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,cAAc,EAAE,KAAK,CAAC,MAAM;QAC5B,MAAM;QACN,OAAO;QACP,UAAU;QACV,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;AACH,CAAC;AAaD;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,2EAA2E;IAC3E,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC/C,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC;YACJ,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBAClD,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,cAAc,EAAE,CAAC;oBAC1D,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;gBAC1C,CAAC;YACF,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,qCAAqC;QACtC,CAAC;IACF,CAAC;IAED,wCAAwC;IACxC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,OAAO,OAAO,CAAC,CAAC;IAChD,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACxB,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QACzD,CAAC;aAAM,CAAC;YACP,MAAM,GAAG,SAAS,CAAC;QACpB,CAAC;IACF,CAAC;IAED,uBAAuB;IACvB,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,8BAA8B,QAAQ,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CACV,wCAAwC,MAAM,CAAC,QAAQ,+BAA+B,CACtF,CAAC;QACH,CAAC;QACD,OAAO;YACN,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC1B,MAAM;YACN,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,CAAC;YACd,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;SACf,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACxC,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACJ,OAAO,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACR,mDAAmD;YACnD,SAAS;QACV,CAAC;QACD,IAAI,OAAO,KAAK,EAAE;YAAE,SAAS;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;YAC/B,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;gBAC1D,MAAM,CAAC,IAAI,CAAC;oBACX,EAAE,EAAE,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;oBAClD,IAAI,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;oBACxD,YAAY,EAAE,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;oBAChF,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;oBAC3E,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;oBAC9E,MAAM;oBACN,UAAU,EAAE,WAAW;oBACvB,IAAI,EAAE,CAAC,GAAG,CAAC;iBACX,CAAC,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACR,MAAM,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnE,CAAC;QACF,CAAC;IACF,CAAC;IAED,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,UAAU;QACzB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,QAAmB,GAAI,CAAC,CAAC,QAAmB,CAAC;QAC7E,CAAC,CAAC,MAAM,CAAC;IAEV,qCAAqC;IACrC,IAAI,YAAY,GAAG,YAAY,CAAC;IAChC,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAgB,CAAC;QAEpC,IAAI,CAAC,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CACV,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,sCAAsC,YAAY,SAAS,CAAC,CAAC,YAAY,EAAE,CAClG,CAAC;QACH,CAAC;QAED,IAAI,UAAU,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,QAAQ,uCAAuC,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,UAAU,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,OAAO,GAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAiB,CAAC,QAAkB,CAAC;YACnE,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CACV,uBAAuB,CAAC,CAAC,QAAQ,YAAY,OAAO,2BAA2B,CAC/E,CAAC;YACH,CAAC;QACF,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;QAChD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/E,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,8BAA8B,QAAQ,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;aAAM,CAAC;YACP,WAAW,EAAE,CAAC;QACf,CAAC;QAED,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;YACjB,IAAI,UAAU,KAAK,IAAI;gBAAE,UAAU,GAAG,CAAC,CAAC,SAAS,CAAC;YAClD,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;QACzB,CAAC;QAED,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,oEAAoE;IACpE,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CACV,uCAAuC,MAAM,CAAC,QAAQ,SAAS,IAAI,CAAC,IAAI,oBAAoB,CAC5F,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CACV,6BAA6B,MAAM,CAAC,QAAQ,oBAAoB,OAAO,CAAC,MAAM,wBAAwB,CACtG,CAAC;QACH,CAAC;IACF,CAAC;IAED,gEAAgE;IAChE,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,UAAU,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;IAChC,CAAC;IAED,MAAM;IACN,OAAO;QACN,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM;QACN,WAAW,EAAE,MAAM,CAAC,MAAM;QAC1B,WAAW;QACX,UAAU;QACV,UAAU;QACV,SAAS;KACT,CAAC;AACH,CAAC;AAuDD;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,GAAW;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACJ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpB,OAAO,CAAC,OAAO,CAAC,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,OAAO;aACZ,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC;AACF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,2BAA2B,CACnC,WAA8B,EAC9B,eAAwC,EACxC,aAAsC,EACtC,aAAgC;IAEhC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAChD,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,eAAe,EAAE,GAAG,aAAa,CAAC,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACP,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC;IACF,CAAC;IACD,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;SAC9B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;SACrB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAoB,CAAC,CAAC,CAAiB,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,IAAI,IAAI,CAAC;IAE5F,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,oBAAoB,GAAkB,IAAI,CAAC;IAC/C,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,yEAAyE;YACzE,uEAAuE;YACvE,mEAAmE;YACnE,cAAc,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;YAC9E,SAAS;QACV,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC3C,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC7B,cAAc,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAe,CAAC,CAAC;gBACpC,SAAS;YACV,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAC/B,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YACtD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,cAAc,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,wDAAwD,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;gBACzF,SAAS;YACV,CAAC;YACD,IAAI,QAAQ,GAA6B,IAAI,CAAC;YAC9C,IAAI,WAAW,GAAa,EAAE,CAAC;YAC/B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACpC,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;gBACrE,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,QAAQ,GAAG,MAAM,CAAC;oBAClB,MAAM;gBACP,CAAC;gBACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;oBAAE,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;YAC3D,CAAC;YACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACvB,cAAc,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;gBAC5B,SAAS;YACV,CAAC;YACD,gBAAgB,EAAE,CAAC;YACnB,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;gBACzE,oBAAoB;oBACnB,oBAAoB,KAAK,IAAI;wBAC5B,CAAC,CAAC,QAAQ,CAAC,cAAc;wBACzB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;YAC7D,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACrC,SAAiB,EACjB,SAA6B,EAAE;IAE/B,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,eAAe,GAAmB,EAAE,CAAC;IAC3C,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACxC,eAAe,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QACxC,cAAc,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,2BAA2B,CACxC,MAAM,CAAC,gBAAgB,IAAI,EAAE,EAC7B,eAAe,EACf,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAC/B,CAAC;IACF,MAAM,UAAU,GAAG,qBAAqB,CAAC;QACxC,aAAa,EAAE,wBAAwB,CAAC,SAAS,CAAC;QAClD,eAAe,EAAE,eAAe;QAChC,cAAc;QACd,aAAa,EAAE,MAAM,CAAC,OAAO;QAC7B,YAAY,EAAE,MAAM,CAAC,MAAM;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QAC3B,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE;QAC/C,IAAI,EAAE;YACL,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzF,GAAG,CAAC,MAAM,CAAC,mBAAmB,KAAK,SAAS;gBAC3C,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,EAAE;gBACrD,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,oBAAoB,KAAK,IAAI;gBACxD,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,oBAAoB,EAAE;gBAChD,CAAC,CAAC,EAAE,CAAC;SACN;KACD,CAAC,CAAC;IACH,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,WAAW,GAAG,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC;IAC/D,OAAO;QACN,GAAG,IAAI;QACP,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,YAAY,IAAI,CAAC,WAAW;QAC5D,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;QACxE,WAAW,EAAE,WAAW;YACvB,CAAC,CAAC,gBAAgB,CAAC,UAAU,CAAC,WAAW,EAAE,gBAAgB,CAAC;YAC5D,CAAC,CAAC,UAAU,CAAC,WAAW;QACzB,SAAS,EAAE;YACV,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,OAAO,EAAE,WAAW;gBACnB,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC,CAAC;gBAChE,CAAC,CAAC,UAAU,CAAC,OAAO;YACrB,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpC;KACD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAClC,MAIC,EACD,IAAmE;IAEnE,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC;IAC5B,IACC,IAAI,EAAE,aAAa,KAAK,IAAI;QAC5B,CAAC,MAAM,CAAC,WAAW,KAAK,YAAY;YACnC,MAAM,CAAC,WAAW,KAAK,qBAAqB;YAC5C,MAAM,CAAC,WAAW,KAAK,cAAc,CAAC,EACtC,CAAC;QACF,OAAO,CAAC,CAAC;IACV,CAAC;IACD,IACC,IAAI,EAAE,qBAAqB,KAAK,IAAI;QACpC,CAAC,MAAM,CAAC,WAAW,KAAK,mBAAmB,IAAI,MAAM,CAAC,SAAS,CAAC,YAAY,KAAK,UAAU,CAAC,EAC3F,CAAC;QACF,OAAO,CAAC,CAAC;IACV,CAAC;IACD,OAAO,CAAC,CAAC;AACV,CAAC"}

package/dist/cli/anchor.d.ts

@@ -0,0 +1,3 @@
+import type { CliOptions } from "./init.js";
+export declare function run(args?: string[], opts?: CliOptions): Promise<void>;
+//# sourceMappingURL=anchor.d.ts.map

package/dist/cli/anchor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anchor.d.ts","sourceRoot":"","sources":["../../src/cli/anchor.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAyT5C,wBAAsB,GAAG,CAAC,IAAI,GAAE,MAAM,EAAO,EAAE,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAwW/E"}