@catp-protocol/cli 0.7.2 → 0.7.4

package/dist/audit/durable.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Narrow filesystem seam used by the durable primitives. Production code binds
+ * this to node:fs; unit tests inject a fake to assert operation order and to
+ * inject failures without touching a real disk.
+ */
+export interface DurableFs {
+    existsSync(path: string): boolean;
+    mkdirSync(path: string, opts: {
+        recursive: boolean;
+        mode: number;
+    }): void;
+    openSync(path: string, flags: string, mode: number): number;
+    writeSync(fd: number, buffer: Uint8Array, offset: number, length: number, position: number | null): number;
+    fsyncSync(fd: number): void;
+    closeSync(fd: number): void;
+    readFileSync(path: string): Buffer;
+    renameSync(oldPath: string, newPath: string): void;
+    unlinkSync(path: string): void;
+}
+/** Production binding of {@link DurableFs} to node:fs. */
+export declare const nodeFs: DurableFs;
+/**
+ * Create `path` (and any missing ancestors) and make the new directory entries
+ * durable. Missing components are collected before creation, created with
+ * 0o700, then fsynced from the deepest component upward followed by the
+ * deepest pre-existing ancestor. If `path` already exists this is a no-op.
+ */
+export declare function ensureDirectoryDurable(path: string, fs?: DurableFs): void;
+/**
+ * Durably append one line to a JSONL-style log file. Sequence: create parent
+ * directories, open append/create with 0o600, write the complete UTF-8 line
+ * plus exactly one newline, fsync the file, close it, and fsync the parent
+ * directory when the file was newly created.
+ */
+export declare function durableAppendLine(path: string, line: string, fs?: DurableFs): void;
+/**
+ * Durably create an empty file (and its parent directories) if it does not
+ * already exist: open append/create with 0o600, fsync the new file, close it,
+ * then fsync the parent directory. An existing file is left untouched. This is
+ * used to materialize the audit log so a lock manager that resolves the target
+ * realpath never bypasses the new-file durability path.
+ */
+export declare function durableCreateEmptyFile(path: string, fs?: DurableFs): void;
+/**
+ * Durably write content-addressed `bytes` to `path` via a same-directory temp
+ * file: create parents, write the temp with 0o600, fsync it, close, atomically
+ * rename onto the target, then fsync the parent directory.
+ *
+ * If the target already exists its bytes are compared: identical bytes are an
+ * idempotent success, differing bytes are reported as corruption. Descriptors
+ * are closed and the temp file removed on any failure while preserving the
+ * original exception.
+ */
+export declare function durableWriteContentAddressed(path: string, bytes: Uint8Array, fs?: DurableFs): void;
+/**
+ * Storage seam threaded through the audit logger and hook options. It exists
+ * solely so tests can inject failures; CLI execution always uses
+ * {@link nodeAuditStorage}.
+ */
+export interface AuditStorage {
+    ensureDirectoryDurable(path: string): void;
+    createEmptyFile(path: string): void;
+    appendLine(path: string, line: string): void;
+    writeContentAddressed(path: string, bytes: Uint8Array): void;
+}
+/** Production {@link AuditStorage} backed by the fsync durable primitives. */
+export declare const nodeAuditStorage: AuditStorage;
+//# sourceMappingURL=durable.d.ts.map

package/dist/audit/durable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"durable.d.ts","sourceRoot":"","sources":["../../src/audit/durable.ts"],"names":[],"mappings":"AAaA;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAClC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC1E,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5D,SAAS,CACP,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAAC;IACV,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACnD,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,0DAA0D;AAC1D,eAAO,MAAM,MAAM,EAAE,SAqBpB,CAAC;AA+BF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAE,SAAkB,GAAG,IAAI,CAsBjF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAE,SAAkB,GAAG,IAAI,CA2B1F;AASD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAE,SAAkB,GAAG,IAAI,CAqBjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,UAAU,EACjB,EAAE,GAAE,SAAkB,GACrB,IAAI,CAuCN;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7C,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;CAC9D;AAED,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,EAAE,YAK9B,CAAC"}

package/dist/audit/durable.js

@@ -0,0 +1,214 @@
+import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeSync, } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+/** Production binding of {@link DurableFs} to node:fs. */
+export const nodeFs = {
+    existsSync: (p) => existsSync(p),
+    mkdirSync: (p, opts) => {
+        mkdirSync(p, opts);
+    },
+    openSync: (p, flags, mode) => openSync(p, flags, mode),
+    writeSync: (fd, buffer, offset, length, position) => writeSync(fd, buffer, offset, length, position),
+    fsyncSync: (fd) => {
+        fsyncSync(fd);
+    },
+    closeSync: (fd) => {
+        closeSync(fd);
+    },
+    readFileSync: (p) => readFileSync(p),
+    renameSync: (o, n) => {
+        renameSync(o, n);
+    },
+    unlinkSync: (p) => {
+        unlinkSync(p);
+    },
+};
+const FILE_MODE = 0o600;
+const DIR_MODE = 0o700;
+/**
+ * Write every byte of `buffer`, looping until the whole buffer is consumed. A
+ * single writeSync call is not guaranteed to consume the entire buffer, so the
+ * returned count is advanced explicitly.
+ */
+function writeFull(fs, fd, buffer) {
+    let offset = 0;
+    while (offset < buffer.byteLength) {
+        const written = fs.writeSync(fd, buffer, offset, buffer.byteLength - offset, null);
+        if (written <= 0) {
+            throw new Error("durable write failed to make progress");
+        }
+        offset += written;
+    }
+}
+/** fsync a directory so a newly created directory entry becomes durable. */
+function fsyncDirectory(fs, dir) {
+    const fd = fs.openSync(dir, "r", DIR_MODE);
+    try {
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+/**
+ * Create `path` (and any missing ancestors) and make the new directory entries
+ * durable. Missing components are collected before creation, created with
+ * 0o700, then fsynced from the deepest component upward followed by the
+ * deepest pre-existing ancestor. If `path` already exists this is a no-op.
+ */
+export function ensureDirectoryDurable(path, fs = nodeFs) {
+    const target = resolve(path);
+    const missing = [];
+    let probe = target;
+    while (!fs.existsSync(probe)) {
+        missing.unshift(probe);
+        const parent = dirname(probe);
+        if (parent === probe)
+            break; // reached the filesystem root
+        probe = parent;
+    }
+    if (missing.length === 0)
+        return; // nothing created, nothing to flush
+    fs.mkdirSync(target, { recursive: true, mode: DIR_MODE });
+    for (let i = missing.length - 1; i >= 0; i--) {
+        fsyncDirectory(fs, missing[i]);
+    }
+    // Flush the pre-existing parent that now holds the shallowest new entry.
+    // Skip when the walk terminated at the filesystem root, in which case probe
+    // is itself one of the newly created components and was already flushed.
+    if (!missing.includes(probe)) {
+        fsyncDirectory(fs, probe);
+    }
+}
+/**
+ * Durably append one line to a JSONL-style log file. Sequence: create parent
+ * directories, open append/create with 0o600, write the complete UTF-8 line
+ * plus exactly one newline, fsync the file, close it, and fsync the parent
+ * directory when the file was newly created.
+ */
+export function durableAppendLine(path, line, fs = nodeFs) {
+    const dir = dirname(path);
+    ensureDirectoryDurable(dir, fs);
+    const existed = fs.existsSync(path);
+    const fd = fs.openSync(path, "a", FILE_MODE);
+    let closed = false;
+    try {
+        writeFull(fs, fd, Buffer.from(line + "\n", "utf8"));
+        fs.fsyncSync(fd);
+        fs.closeSync(fd);
+        closed = true;
+    }
+    catch (err) {
+        // Close the descriptor without letting a secondary close error (POSIX can
+        // report a pending EIO on close after a failed fsync) mask the original
+        // write/fsync failure the caller must observe to fail closed.
+        if (!closed) {
+            try {
+                fs.closeSync(fd);
+            }
+            catch {
+                // preserve the original exception
+            }
+        }
+        throw err;
+    }
+    if (!existed) {
+        fsyncDirectory(fs, dir);
+    }
+}
+let tempCounter = 0;
+function uniqueTempPath(dir, base) {
+    tempCounter = (tempCounter + 1) % Number.MAX_SAFE_INTEGER;
+    return join(dir, `.${base}.${process.pid}.${Date.now()}.${tempCounter}.tmp`);
+}
+/**
+ * Durably create an empty file (and its parent directories) if it does not
+ * already exist: open append/create with 0o600, fsync the new file, close it,
+ * then fsync the parent directory. An existing file is left untouched. This is
+ * used to materialize the audit log so a lock manager that resolves the target
+ * realpath never bypasses the new-file durability path.
+ */
+export function durableCreateEmptyFile(path, fs = nodeFs) {
+    const dir = dirname(path);
+    ensureDirectoryDurable(dir, fs);
+    if (fs.existsSync(path))
+        return;
+    const fd = fs.openSync(path, "a", FILE_MODE);
+    let closed = false;
+    try {
+        fs.fsyncSync(fd);
+        fs.closeSync(fd);
+        closed = true;
+    }
+    catch (err) {
+        if (!closed) {
+            try {
+                fs.closeSync(fd);
+            }
+            catch {
+                // preserve the original exception
+            }
+        }
+        throw err;
+    }
+    fsyncDirectory(fs, dir);
+}
+/**
+ * Durably write content-addressed `bytes` to `path` via a same-directory temp
+ * file: create parents, write the temp with 0o600, fsync it, close, atomically
+ * rename onto the target, then fsync the parent directory.
+ *
+ * If the target already exists its bytes are compared: identical bytes are an
+ * idempotent success, differing bytes are reported as corruption. Descriptors
+ * are closed and the temp file removed on any failure while preserving the
+ * original exception.
+ */
+export function durableWriteContentAddressed(path, bytes, fs = nodeFs) {
+    const dir = dirname(path);
+    ensureDirectoryDurable(dir, fs);
+    if (fs.existsSync(path)) {
+        const existing = fs.readFileSync(path);
+        if (Buffer.compare(Buffer.from(bytes), existing) === 0)
+            return;
+        throw new Error(`content-addressed file already exists with different bytes: ${path}`);
+    }
+    const temp = uniqueTempPath(dir, basename(path));
+    const fd = fs.openSync(temp, "w", FILE_MODE);
+    let closed = false;
+    let renamed = false;
+    try {
+        writeFull(fs, fd, bytes);
+        fs.fsyncSync(fd);
+        fs.closeSync(fd);
+        closed = true;
+        fs.renameSync(temp, path);
+        renamed = true;
+        fsyncDirectory(fs, dir);
+    }
+    catch (err) {
+        if (!closed) {
+            try {
+                fs.closeSync(fd);
+            }
+            catch {
+                // ignore close failure; preserve the original error
+            }
+        }
+        if (!renamed) {
+            try {
+                fs.unlinkSync(temp);
+            }
+            catch {
+                // best-effort temp cleanup; preserve the original error
+            }
+        }
+        throw err;
+    }
+}
+/** Production {@link AuditStorage} backed by the fsync durable primitives. */
+export const nodeAuditStorage = {
+    ensureDirectoryDurable: (path) => ensureDirectoryDurable(path),
+    createEmptyFile: (path) => durableCreateEmptyFile(path),
+    appendLine: (path, line) => durableAppendLine(path, line),
+    writeContentAddressed: (path, bytes) => durableWriteContentAddressed(path, bytes),
+};
+//# sourceMappingURL=durable.js.map

package/dist/audit/durable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"durable.js","sourceRoot":"","sources":["../../src/audit/durable.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,UAAU,EACV,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAyB7D,0DAA0D;AAC1D,MAAM,CAAC,MAAM,MAAM,GAAc;IAC/B,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAChC,SAAS,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE;QACrB,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACrB,CAAC;IACD,QAAQ,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC;IACtD,SAAS,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAClD,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;IACjD,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE;QAChB,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IACD,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE;QAChB,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IACD,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACnB,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE;QAChB,UAAU,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC;CACF,CAAC;AAEF,MAAM,SAAS,GAAG,KAAK,CAAC;AACxB,MAAM,QAAQ,GAAG,KAAK,CAAC;AAEvB;;;;GAIG;AACH,SAAS,SAAS,CAAC,EAAa,EAAE,EAAU,EAAE,MAAkB;IAC9D,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC;QACnF,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,IAAI,OAAO,CAAC;IACpB,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,SAAS,cAAc,CAAC,EAAa,EAAE,GAAW;IAChD,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,KAAgB,MAAM;IACzE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,KAAK,GAAG,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACvB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAM,KAAK,KAAK;YAAE,MAAM,CAAC,8BAA8B;QAC3D,KAAK,GAAG,MAAM,CAAC;IACjB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,oCAAoC;IAEtE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1D,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,IAAY,EAAE,KAAgB,MAAM;IAClF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,sBAAsB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IAC7C,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACjB,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACjB,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,wEAAwE;QACxE,8DAA8D;QAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,kCAAkC;YACpC,CAAC;QACH,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,cAAc,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,IAAI,WAAW,GAAG,CAAC,CAAC;AAEpB,SAAS,cAAc,CAAC,GAAW,EAAE,IAAY;IAC/C,WAAW,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,gBAAgB,CAAC;IAC1D,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,MAAM,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,KAAgB,MAAM;IACzE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,sBAAsB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAChC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO;IAChC,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IAC7C,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACjB,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACjB,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,kCAAkC;YACpC,CAAC;QACH,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,cAAc,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAC1C,IAAY,EACZ,KAAiB,EACjB,KAAgB,MAAM;IAEtB,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,sBAAsB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAEhC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO;QAC/D,MAAM,IAAI,KAAK,CAAC,+DAA+D,IAAI,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IAC7C,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QACzB,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACjB,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACjB,MAAM,GAAG,IAAI,CAAC;QACd,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1B,OAAO,GAAG,IAAI,CAAC;QACf,cAAc,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,oDAAoD;YACtD,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,wDAAwD;YAC1D,CAAC;QACH,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAcD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAiB;IAC5C,sBAAsB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC;IAC9D,eAAe,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC;IACvD,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC;IACzD,qBAAqB,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,4BAA4B,CAAC,IAAI,EAAE,KAAK,CAAC;CAClF,CAAC"}

package/dist/audit/logger.d.ts

@@ -1,14 +1,60 @@
-import type { AuditEntry, AuthorizationAction } from "../policy/types.js";
+import { type CanonicalToolActionV1 } from "../evidence/commitments.js";
+import { type AuditStorage } from "./durable.js";
+import type { AuditEntry, AuditEntryV4, AuthorizationAction } from "../policy/types.js";
 import type { ToolAction } from "../runtime/types.js";
 import type { RuntimePhase } from "../runtime/types.js";
 export declare function computeCommitment(tool: string, decision: "allow" | "deny", ts: string, prev?: string, ruleMatched?: string | null, inputSummary?: string, authorization?: AuthorizationAction, commitmentVersion?: 1 | 2 | 3, phase?: RuntimePhase): string;
 export declare function summarizeInput(input: ToolAction): string;
+export interface AuditEntryV4Fields {
+    phase: RuntimePhase;
+    tool: string;
+    decision: "allow" | "deny";
+    ts: string;
+    ruleMatched: string | null;
+    reason: string;
+    inputSummary: string;
+    policyCommitment: string;
+    actionCommitment: string;
+    authorization?: AuthorizationAction;
+    prev: string;
+}
+/**
+ * Version-4 entry commitment. Covers every security-relevant field with a
+ * domain separator: prev_commitment, phase, tool, decision, ts, rule, reason,
+ * the enforcement-time policy commitment, and the complete-action commitment.
+ * `inputSummary` is chained for display tamper-evidence only; the authoritative
+ * action binding is `actionCommitment`.
+ */
+export declare function computeCommitmentV4(fields: AuditEntryV4Fields): string;
 export declare function auditDir(agentId: string): string;
 export declare function getLastCommitment(agentId: string): string;
-export declare function appendAuditEntry(agentId: string, entry: AuditEntry): void;
+export declare function appendAuditEntry(agentId: string, entry: AuditEntry, storage?: AuditStorage): void;
+/**
+ * Append a v4 entry produced by `build`, persisting the complete canonical
+ * action as a content-addressed sidecar BEFORE the entry that references it.
+ *
+ * The sidecar write and the entry append both happen while holding the same
+ * per-log lock used to choose `prev_commitment`, so the ordering is atomic with
+ * respect to concurrent appends. A crash may leave an unreferenced sidecar, but
+ * never a committed entry whose action evidence was not flushed first. Any
+ * storage/fsync error propagates so the caller (pre-hook) can fail closed.
+ */
 export declare function appendChainedAuditEntry<T extends {
-    auditEntry: AuditEntry;
-}>(agentId: string, build: (prevCommitment: string) => T): T;
-export declare function buildEntry(input: ToolAction, decision: "allow" | "deny", ruleMatched: string | null, prevCommitment?: string): AuditEntry;
+    auditEntry: AuditEntryV4;
+    action: CanonicalToolActionV1;
+}>(agentId: string, build: (prevCommitment: string) => T, storage?: AuditStorage): T;
+export interface AuditEntryBindings {
+    reason: string;
+    policyCommitment: string;
+    actionCommitment: string;
+}
+/**
+ * Build a version-4 audit entry that binds the decision to the exact
+ * enforcement-time policy commitment and complete-action commitment. The caller
+ * (enforcement core) computes both commitments from the normalized policy and
+ * canonical action used for the decision; this function never recomputes them
+ * from mutable files.
+ */
+export declare function buildEntry(input: ToolAction, decision: "allow" | "deny", ruleMatched: string | null, prevCommitment: string, bindings: AuditEntryBindings): AuditEntryV4;
 export declare function extractAuthorizationAction(input: ToolAction): AuthorizationAction | undefined;
 //# sourceMappingURL=logger.d.ts.map

package/dist/audit/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/audit/logger.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAexD,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,GAAG,MAAM,EAC1B,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAY,EAClB,WAAW,GAAE,MAAM,GAAG,IAAW,EACjC,YAAY,GAAE,MAAW,EACzB,aAAa,CAAC,EAAE,mBAAmB,EACnC,iBAAiB,GAAE,CAAC,GAAG,CAAC,GAAG,CAAK,EAChC,KAAK,CAAC,EAAE,YAAY,GACnB,MAAM,CASR;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAGxD;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGhD;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAIzD;AAsCD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAKzE;AAED,wBAAgB,uBAAuB,CAAC,CAAC,SAAS;IAAE,UAAU,EAAE,UAAU,CAAA;CAAE,EAC1E,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,CAAC,GACnC,CAAC,CAUH;AAkCD,wBAAgB,UAAU,CACxB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,OAAO,GAAG,MAAM,EAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,cAAc,GAAE,MAAY,GAC3B,UAAU,CA4BZ;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,UAAU,GAAG,mBAAmB,GAAG,SAAS,CAsB7F"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/audit/logger.ts"],"names":[],"mappings":"AAMA,OAAO,EAA2B,KAAK,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACjG,OAAO,EAAoB,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAexD,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,GAAG,MAAM,EAC1B,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAY,EAClB,WAAW,GAAE,MAAM,GAAG,IAAW,EACjC,YAAY,GAAE,MAAW,EACzB,aAAa,CAAC,EAAE,mBAAmB,EACnC,iBAAiB,GAAE,CAAC,GAAG,CAAC,GAAG,CAAK,EAChC,KAAK,CAAC,EAAE,YAAY,GACnB,MAAM,CASR;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAGxD;AAQD,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,YAAY,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAetE;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGhD;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAIzD;AAsCD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,UAAU,EACjB,OAAO,GAAE,YAA+B,GACvC,IAAI,CAGN;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CACrC,CAAC,SAAS;IAAE,UAAU,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,qBAAqB,CAAA;CAAE,EAErE,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,CAAC,EACpC,OAAO,GAAE,YAA+B,GACvC,CAAC,CAoBH;AAwCD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,OAAO,GAAG,MAAM,EAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,kBAAkB,GAC3B,YAAY,CAmCd;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,UAAU,GAAG,mBAAmB,GAAG,SAAS,CAsB7F"}

package/dist/audit/logger.js

@@ -1,8 +1,11 @@
 import { createHash } from "node:crypto";
-import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readSync, statSync } from "node:fs";
+import { closeSync, existsSync, openSync, readSync, statSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { lockSync } from "proper-lockfile";
-import { auditDirForDate } from "./paths.js";
+import { actionSidecarPath, auditDirForDate } from "./paths.js";
+import { sha256Hex, stableStringify } from "../evidence/canonical.js";
+import { computeActionCommitment } from "../evidence/commitments.js";
+import { nodeAuditStorage } from "./durable.js";
 const AUDIT_LOCK_STALE_MS = 5_000;
 const AUDIT_LOCK_WAIT_MS = 2_000;
 const AUDIT_LOCK_RETRY_MS = 10;
@@ -29,6 +32,34 @@ export function summarizeInput(input) {
     const raw = JSON.stringify(input.toolInput);
     return raw.length > 200 ? raw.slice(0, 200) + "…" : raw;
 }
+// Domain separator for version-4 audit-entry commitments. v4 is a NEW format
+// with no backward-compatibility constraint, so it uses the shared canonical
+// serializer and an explicit domain string. Legacy v1--v3 commitments above are
+// left byte-for-byte unchanged.
+const AUDIT_ENTRY_V4_DOMAIN = "catp:audit-entry:v4\n";
+/**
+ * Version-4 entry commitment. Covers every security-relevant field with a
+ * domain separator: prev_commitment, phase, tool, decision, ts, rule, reason,
+ * the enforcement-time policy commitment, and the complete-action commitment.
+ * `inputSummary` is chained for display tamper-evidence only; the authoritative
+ * action binding is `actionCommitment`.
+ */
+export function computeCommitmentV4(fields) {
+    const payload = {
+        phase: fields.phase,
+        tool: fields.tool,
+        decision: fields.decision,
+        ts: fields.ts,
+        ruleMatched: fields.ruleMatched,
+        reason: fields.reason,
+        inputSummary: fields.inputSummary,
+        policyCommitment: fields.policyCommitment,
+        actionCommitment: fields.actionCommitment,
+        authorization: fields.authorization ?? null,
+        prev: fields.prev,
+    };
+    return sha256Hex(AUDIT_ENTRY_V4_DOMAIN + stableStringify(payload));
+}
 export function auditDir(agentId) {
     const date = new Date().toISOString().slice(0, 10);
     return auditDirForDate(agentId, date);
@@ -75,27 +106,51 @@ function readLastAuditLine(file) {
         closeSync(fd);
     }
 }
-export function appendAuditEntry(agentId, entry) {
-    const dir = auditDir(agentId);
-    mkdirSync(dir, { recursive: true });
-    const file = join(dir, "actions.jsonl");
-    withAuditLock(file, () => appendEntryToFile(file, entry));
+export function appendAuditEntry(agentId, entry, storage = nodeAuditStorage) {
+    const file = join(auditDir(agentId), "actions.jsonl");
+    withAuditLock(file, storage, () => appendEntryToFile(file, entry, storage));
 }
-export function appendChainedAuditEntry(agentId, build) {
-    const dir = auditDir(agentId);
-    mkdirSync(dir, { recursive: true });
+/**
+ * Append a v4 entry produced by `build`, persisting the complete canonical
+ * action as a content-addressed sidecar BEFORE the entry that references it.
+ *
+ * The sidecar write and the entry append both happen while holding the same
+ * per-log lock used to choose `prev_commitment`, so the ordering is atomic with
+ * respect to concurrent appends. A crash may leave an unreferenced sidecar, but
+ * never a committed entry whose action evidence was not flushed first. Any
+ * storage/fsync error propagates so the caller (pre-hook) can fail closed.
+ */
+export function appendChainedAuditEntry(agentId, build, storage = nodeAuditStorage) {
+    // Compute the date once so the log file and its action sidecars always land
+    // in the same daily directory even across a midnight boundary.
+    const date = new Date().toISOString().slice(0, 10);
+    const dir = auditDirForDate(agentId, date);
     const file = join(dir, "actions.jsonl");
-    return withAuditLock(file, () => {
+    return withAuditLock(file, storage, () => {
         const result = build(getLastCommitmentFromFile(file));
-        appendEntryToFile(file, result.auditEntry);
+        const entry = result.auditEntry;
+        // Re-check the binding at the persistence boundary so a mismatched
+        // entry/action pair can never be durably recorded.
+        if (computeActionCommitment(result.action) !== entry.action_commitment) {
+            throw new Error("internal error: action evidence does not match audit entry binding");
+        }
+        const sidecar = actionSidecarPath(agentId, date, entry.action_commitment);
+        storage.writeContentAddressed(sidecar, Buffer.from(stableStringify(result.action), "utf8"));
+        appendEntryToFile(file, entry, storage);
         return result;
     });
 }
-function appendEntryToFile(file, entry) {
-    appendFileSync(file, JSON.stringify(entry) + "\n", "utf8");
+// `input_summary` is capped for operator readability and is NON-AUTHORITATIVE:
+// the security binding is the content-addressed action sidecar plus the entry's
+// action_commitment, never this display string.
+function appendEntryToFile(file, entry, storage) {
+    storage.appendLine(file, JSON.stringify(entry));
 }
-function withAuditLock(file, operation) {
-    closeSync(openSync(file, "a"));
+function withAuditLock(file, storage, operation) {
+    // Durably materialize the log file (fsync new file + parent) before
+    // proper-lockfile resolves its realpath, so lock setup cannot bypass the
+    // new-file durability path.
+    storage.createEmptyFile(file);
     const release = acquireAuditLock(file);
     try {
         return operation();
@@ -122,18 +177,42 @@ function acquireAuditLock(file) {
         }
     }
 }
-export function buildEntry(input, decision, ruleMatched, prevCommitment = "0") {
+/**
+ * Build a version-4 audit entry that binds the decision to the exact
+ * enforcement-time policy commitment and complete-action commitment. The caller
+ * (enforcement core) computes both commitments from the normalized policy and
+ * canonical action used for the decision; this function never recomputes them
+ * from mutable files.
+ */
+export function buildEntry(input, decision, ruleMatched, prevCommitment, bindings) {
     const ts = new Date().toISOString();
     const inputSummary = summarizeInput(input);
     const authorization = extractAuthorizationAction(input);
+    const phase = input.phase;
+    const commitment = computeCommitmentV4({
+        phase,
+        tool: input.toolName,
+        decision,
+        ts,
+        ruleMatched,
+        reason: bindings.reason,
+        inputSummary,
+        policyCommitment: bindings.policyCommitment,
+        actionCommitment: bindings.actionCommitment,
+        authorization,
+        prev: prevCommitment,
+    });
     const entry = {
-        commitment_version: 3,
-        phase: input.phase,
+        commitment_version: 4,
+        phase,
         ts,
         tool: input.toolName,
         decision,
         rule_matched: ruleMatched,
-        commitment: computeCommitment(input.toolName, decision, ts, prevCommitment, ruleMatched, inputSummary, authorization, 3, input.phase),
+        reason: bindings.reason,
+        policy_commitment: bindings.policyCommitment,
+        action_commitment: bindings.actionCommitment,
+        commitment,
         input_summary: inputSummary,
     };
     if (authorization) {

package/dist/audit/logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/audit/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACzG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAK7C,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,4EAA4E;AAC5E,0EAA0E;AAC1E,qDAAqD;AACrD,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhE,qCAAqC;AACrC,6EAA6E;AAC7E,wEAAwE;AACxE,mFAAmF;AACnF,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,QAA0B,EAC1B,EAAU,EACV,OAAe,GAAG,EAClB,cAA6B,IAAI,EACjC,eAAuB,EAAE,EACzB,aAAmC,EACnC,oBAA+B,CAAC,EAChC,KAAoB;IAEpB,MAAM,OAAO,GAAG,iBAAiB,KAAK,CAAC;QACrC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,IAAI,IAAI,EAAE,IAAI,EAAE;QACzH,CAAC,CAAC,iBAAiB,KAAK,CAAC;YACzB,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,IAAI,IAAI,EAAE,IAAI,EAAE;YAClH,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC5D,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;SAC/B,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5C,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACxC,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAY;IAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IAElC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAe,CAAC;IACjD,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC,UAAU,CAAC;AAC1B,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IACjC,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,GAAG,SAAS,CAAC,CAAC;QACrD,IAAI,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnC,mEAAmE;QACnE,gEAAgE;QAChE,IAAI,IAAI,GAAG,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,KAAiB;IACjE,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACxC,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,KAAoC;IAEpC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAExC,OAAO,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE;QAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAAiB;IACxD,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,aAAa,CAAI,IAAY,EAAE,SAAkB;IACxD,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,SAAS,EAAE,CAAC;IACrB,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC;IACjD,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,QAAQ,CAAC,IAAI,EAAE;gBACpB,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC;gBAClD,KAAK,EAAE,mBAAmB;gBAC1B,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAChF,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,KAAiB,EACjB,QAA0B,EAC1B,WAA0B,EAC1B,iBAAyB,GAAG;IAE5B,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,KAAK,GAAe;QACxB,kBAAkB,EAAE,CAAC;QACrB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,EAAE;QACF,IAAI,EAAE,KAAK,CAAC,QAAQ;QACpB,QAAQ;QACR,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,iBAAiB,CAC3B,KAAK,CAAC,QAAQ,EACd,QAAQ,EACR,EAAE,EACF,cAAc,EACd,WAAW,EACX,YAAY,EACZ,aAAa,EACb,CAAC,EACD,KAAK,CAAC,KAAK,CACZ;QACD,aAAa,EAAE,YAAY;KAC5B,CAAC;IACF,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAiB;IAC1D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,kBAAkB,IAAI,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC;IACtF,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,SAAoC,CAAC;IACnD,IACE,CAAC,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC;QACnC,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,EAC9B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjG,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/F,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;AAChE,CAAC"}
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/audit/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAA8B,MAAM,4BAA4B,CAAC;AACjG,OAAO,EAAE,gBAAgB,EAAqB,MAAM,cAAc,CAAC;AAKnE,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,4EAA4E;AAC5E,0EAA0E;AAC1E,qDAAqD;AACrD,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhE,qCAAqC;AACrC,6EAA6E;AAC7E,wEAAwE;AACxE,mFAAmF;AACnF,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,QAA0B,EAC1B,EAAU,EACV,OAAe,GAAG,EAClB,cAA6B,IAAI,EACjC,eAAuB,EAAE,EACzB,aAAmC,EACnC,oBAA+B,CAAC,EAChC,KAAoB;IAEpB,MAAM,OAAO,GAAG,iBAAiB,KAAK,CAAC;QACrC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,IAAI,IAAI,EAAE,IAAI,EAAE;QACzH,CAAC,CAAC,iBAAiB,KAAK,CAAC;YACzB,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,IAAI,IAAI,EAAE,IAAI,EAAE;YAClH,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC5D,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;SAC/B,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5C,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAC1D,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,gFAAgF;AAChF,gCAAgC;AAChC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAgBtD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA0B;IAC5D,MAAM,OAAO,GAAG;QACd,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;QAC3C,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC;IACF,OAAO,SAAS,CAAC,qBAAqB,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACxC,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAY;IAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IAElC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAe,CAAC;IACjD,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC,UAAU,CAAC;AAC1B,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IACjC,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,GAAG,SAAS,CAAC,CAAC;QACrD,IAAI,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnC,mEAAmE;QACnE,gEAAgE;QAChE,IAAI,IAAI,GAAG,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAAe,EACf,KAAiB,EACjB,UAAwB,gBAAgB;IAExC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC,CAAC;IACtD,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAGrC,OAAe,EACf,KAAoC,EACpC,UAAwB,gBAAgB;IAExC,4EAA4E;IAC5E,+DAA+D;IAC/D,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAExC,OAAO,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE;QACvC,MAAM,MAAM,GAAG,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC;QAChC,mEAAmE;QACnE,mDAAmD;QACnD,IAAI,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC1E,OAAO,CAAC,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5F,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACxC,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,gFAAgF;AAChF,gDAAgD;AAChD,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAAiB,EAAE,OAAqB;IAC/E,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,aAAa,CAAI,IAAY,EAAE,OAAqB,EAAE,SAAkB;IAC/E,oEAAoE;IACpE,yEAAyE;IACzE,4BAA4B;IAC5B,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,SAAS,EAAE,CAAC;IACrB,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC;IACjD,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,QAAQ,CAAC,IAAI,EAAE;gBACpB,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC;gBAClD,KAAK,EAAE,mBAAmB;gBAC1B,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAChF,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;AACH,CAAC;AAQD;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,KAAiB,EACjB,QAA0B,EAC1B,WAA0B,EAC1B,cAAsB,EACtB,QAA4B;IAE5B,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,MAAM,UAAU,GAAG,mBAAmB,CAAC;QACrC,KAAK;QACL,IAAI,EAAE,KAAK,CAAC,QAAQ;QACpB,QAAQ;QACR,EAAE;QACF,WAAW;QACX,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,YAAY;QACZ,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,aAAa;QACb,IAAI,EAAE,cAAc;KACrB,CAAC,CAAC;IACH,MAAM,KAAK,GAAiB;QAC1B,kBAAkB,EAAE,CAAC;QACrB,KAAK;QACL,EAAE;QACF,IAAI,EAAE,KAAK,CAAC,QAAQ;QACpB,QAAQ;QACR,YAAY,EAAE,WAAW;QACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,iBAAiB,EAAE,QAAQ,CAAC,gBAAgB;QAC5C,iBAAiB,EAAE,QAAQ,CAAC,gBAAgB;QAC5C,UAAU;QACV,aAAa,EAAE,YAAY;KAC5B,CAAC;IACF,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAiB;IAC1D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,kBAAkB,IAAI,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC;IACtF,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,SAAoC,CAAC;IACnD,IACE,CAAC,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC;QACnC,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,EAC9B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjG,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/F,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;AAChE,CAAC"}

package/dist/audit/paths.d.ts

@@ -2,4 +2,15 @@ export declare function catpHome(): string;
 export declare function validateAgentId(agentId: string): string;
 export declare function auditRoot(agentId: string): string;
 export declare function auditDirForDate(agentId: string, date: string): string;
+/**
+ * Directory holding the content-addressed canonical action sidecars for a given
+ * agent/day: `$CATP_HOME/audit/<agent>/<YYYY-MM-DD>/actions`.
+ */
+export declare function actionsDirForDate(agentId: string, date: string): string;
+/**
+ * Absolute path of the durable sidecar storing the complete canonical action
+ * whose digest is `actionCommitment`. The commitment must be a 64-character
+ * lowercase hex digest so it can never escape the actions directory.
+ */
+export declare function actionSidecarPath(agentId: string, date: string, actionCommitment: string): string;
 //# sourceMappingURL=paths.d.ts.map

package/dist/audit/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/audit/paths.ts"],"names":[],"mappings":"AAGA,wBAAgB,QAAQ,IAAI,MAAM,CAEjC;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAKvD;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAErE"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/audit/paths.ts"],"names":[],"mappings":"AAGA,wBAAgB,QAAQ,IAAI,MAAM,CAEjC;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAKvD;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvE;AAID;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,gBAAgB,EAAE,MAAM,GACvB,MAAM,CAKR"}

package/dist/audit/paths.js

@@ -15,4 +15,23 @@ export function auditRoot(agentId) {
 export function auditDirForDate(agentId, date) {
     return join(auditRoot(agentId), date);
 }
+/**
+ * Directory holding the content-addressed canonical action sidecars for a given
+ * agent/day: `$CATP_HOME/audit/<agent>/<YYYY-MM-DD>/actions`.
+ */
+export function actionsDirForDate(agentId, date) {
+    return join(auditDirForDate(agentId, date), "actions");
+}
+const ACTION_COMMITMENT_HEX64 = /^[0-9a-f]{64}$/;
+/**
+ * Absolute path of the durable sidecar storing the complete canonical action
+ * whose digest is `actionCommitment`. The commitment must be a 64-character
+ * lowercase hex digest so it can never escape the actions directory.
+ */
+export function actionSidecarPath(agentId, date, actionCommitment) {
+    if (!ACTION_COMMITMENT_HEX64.test(actionCommitment)) {
+        throw new Error("action commitment must be a 64-character lowercase hex digest");
+    }
+    return join(actionsDirForDate(agentId, date), `${actionCommitment}.json`);
+}
 //# sourceMappingURL=paths.js.map

package/dist/audit/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/audit/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,UAAU,QAAQ;IACtB,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,IAAY;IAC3D,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC"}
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/audit/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,UAAU,QAAQ;IACtB,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,IAAY;IAC3D,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,IAAY;IAC7D,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,uBAAuB,GAAG,gBAAgB,CAAC;AAEjD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,IAAY,EACZ,gBAAwB;IAExB,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,GAAG,gBAAgB,OAAO,CAAC,CAAC;AAC5E,CAAC"}