@catp-protocol/cli 0.7.3 → 0.7.5

package/dist/audit/logger.js

@@ -1,8 +1,12 @@
 import { createHash } from "node:crypto";
-import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readSync, statSync } from "node:fs";
+import { closeSync, existsSync, fsyncSync, ftruncateSync, openSync, readFileSync, readSync, statSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { lockSync } from "proper-lockfile";
-import { auditDirForDate } from "./paths.js";
+import { actionSidecarPath, auditDirForDate } from "./paths.js";
+import { sha256Hex, stableStringify } from "../evidence/canonical.js";
+import { computeActionCommitment } from "../evidence/commitments.js";
+import { nodeAuditStorage } from "./durable.js";
+import { verifyEntryChain } from "./verifier.js";
 const AUDIT_LOCK_STALE_MS = 5_000;
 const AUDIT_LOCK_WAIT_MS = 2_000;
 const AUDIT_LOCK_RETRY_MS = 10;
@@ -29,6 +33,34 @@ export function summarizeInput(input) {
     const raw = JSON.stringify(input.toolInput);
     return raw.length > 200 ? raw.slice(0, 200) + "…" : raw;
 }
+// Domain separator for version-4 audit-entry commitments. v4 is a NEW format
+// with no backward-compatibility constraint, so it uses the shared canonical
+// serializer and an explicit domain string. Legacy v1--v3 commitments above are
+// left byte-for-byte unchanged.
+const AUDIT_ENTRY_V4_DOMAIN = "catp:audit-entry:v4\n";
+/**
+ * Version-4 entry commitment. Covers every security-relevant field with a
+ * domain separator: prev_commitment, phase, tool, decision, ts, rule, reason,
+ * the enforcement-time policy commitment, and the complete-action commitment.
+ * `inputSummary` is chained for display tamper-evidence only; the authoritative
+ * action binding is `actionCommitment`.
+ */
+export function computeCommitmentV4(fields) {
+    const payload = {
+        phase: fields.phase,
+        tool: fields.tool,
+        decision: fields.decision,
+        ts: fields.ts,
+        ruleMatched: fields.ruleMatched,
+        reason: fields.reason,
+        inputSummary: fields.inputSummary,
+        policyCommitment: fields.policyCommitment,
+        actionCommitment: fields.actionCommitment,
+        authorization: fields.authorization ?? null,
+        prev: fields.prev,
+    };
+    return sha256Hex(AUDIT_ENTRY_V4_DOMAIN + stableStringify(payload));
+}
 export function auditDir(agentId) {
     const date = new Date().toISOString().slice(0, 10);
     return auditDirForDate(agentId, date);
@@ -75,27 +107,51 @@ function readLastAuditLine(file) {
         closeSync(fd);
     }
 }
-export function appendAuditEntry(agentId, entry) {
-    const dir = auditDir(agentId);
-    mkdirSync(dir, { recursive: true });
-    const file = join(dir, "actions.jsonl");
-    withAuditLock(file, () => appendEntryToFile(file, entry));
+export function appendAuditEntry(agentId, entry, storage = nodeAuditStorage) {
+    const file = join(auditDir(agentId), "actions.jsonl");
+    withAuditLock(file, storage, () => appendEntryToFile(file, entry, storage));
 }
-export function appendChainedAuditEntry(agentId, build) {
-    const dir = auditDir(agentId);
-    mkdirSync(dir, { recursive: true });
+/**
+ * Append a v4 entry produced by `build`, persisting the complete canonical
+ * action as a content-addressed sidecar BEFORE the entry that references it.
+ *
+ * The sidecar write and the entry append both happen while holding the same
+ * per-log lock used to choose `prev_commitment`, so the ordering is atomic with
+ * respect to concurrent appends. A crash may leave an unreferenced sidecar, but
+ * never a committed entry whose action evidence was not flushed first. Any
+ * storage/fsync error propagates so the caller (pre-hook) can fail closed.
+ */
+export function appendChainedAuditEntry(agentId, build, storage = nodeAuditStorage) {
+    // Compute the date once so the log file and its action sidecars always land
+    // in the same daily directory even across a midnight boundary.
+    const date = new Date().toISOString().slice(0, 10);
+    const dir = auditDirForDate(agentId, date);
     const file = join(dir, "actions.jsonl");
-    return withAuditLock(file, () => {
+    return withAuditLock(file, storage, () => {
         const result = build(getLastCommitmentFromFile(file));
-        appendEntryToFile(file, result.auditEntry);
+        const entry = result.auditEntry;
+        // Re-check the binding at the persistence boundary so a mismatched
+        // entry/action pair can never be durably recorded.
+        if (computeActionCommitment(result.action) !== entry.action_commitment) {
+            throw new Error("internal error: action evidence does not match audit entry binding");
+        }
+        const sidecar = actionSidecarPath(agentId, date, entry.action_commitment);
+        storage.writeContentAddressed(sidecar, Buffer.from(stableStringify(result.action), "utf8"));
+        appendEntryToFile(file, entry, storage);
         return result;
     });
 }
-function appendEntryToFile(file, entry) {
-    appendFileSync(file, JSON.stringify(entry) + "\n", "utf8");
+// `input_summary` is capped for operator readability and is NON-AUTHORITATIVE:
+// the security binding is the content-addressed action sidecar plus the entry's
+// action_commitment, never this display string.
+function appendEntryToFile(file, entry, storage) {
+    storage.appendLine(file, JSON.stringify(entry));
 }
-function withAuditLock(file, operation) {
-    closeSync(openSync(file, "a"));
+function withAuditLock(file, storage, operation) {
+    // Durably materialize the log file (fsync new file + parent) before
+    // proper-lockfile resolves its realpath, so lock setup cannot bypass the
+    // new-file durability path.
+    storage.createEmptyFile(file);
     const release = acquireAuditLock(file);
     try {
         return operation();
@@ -122,18 +178,42 @@ function acquireAuditLock(file) {
         }
     }
 }
-export function buildEntry(input, decision, ruleMatched, prevCommitment = "0") {
+/**
+ * Build a version-4 audit entry that binds the decision to the exact
+ * enforcement-time policy commitment and complete-action commitment. The caller
+ * (enforcement core) computes both commitments from the normalized policy and
+ * canonical action used for the decision; this function never recomputes them
+ * from mutable files.
+ */
+export function buildEntry(input, decision, ruleMatched, prevCommitment, bindings) {
     const ts = new Date().toISOString();
     const inputSummary = summarizeInput(input);
     const authorization = extractAuthorizationAction(input);
+    const phase = input.phase;
+    const commitment = computeCommitmentV4({
+        phase,
+        tool: input.toolName,
+        decision,
+        ts,
+        ruleMatched,
+        reason: bindings.reason,
+        inputSummary,
+        policyCommitment: bindings.policyCommitment,
+        actionCommitment: bindings.actionCommitment,
+        authorization,
+        prev: prevCommitment,
+    });
     const entry = {
-        commitment_version: 3,
-        phase: input.phase,
+        commitment_version: 4,
+        phase,
         ts,
         tool: input.toolName,
         decision,
         rule_matched: ruleMatched,
-        commitment: computeCommitment(input.toolName, decision, ts, prevCommitment, ruleMatched, inputSummary, authorization, 3, input.phase),
+        reason: bindings.reason,
+        policy_commitment: bindings.policyCommitment,
+        action_commitment: bindings.actionCommitment,
+        commitment,
         input_summary: inputSummary,
     };
     if (authorization) {
@@ -165,4 +245,103 @@ export function extractAuthorizationAction(input) {
 function isStringOrNumber(value) {
     return typeof value === "string" || typeof value === "number";
 }
+/**
+ * Explicitly repair a torn audit-log tail left by a crashed append. This is the
+ * ONLY sanctioned recovery path for a partial final line; the append path itself
+ * stays fail-closed and never self-heals silently.
+ *
+ * Lock-protected (same per-log lock appends use) and deliberately conservative:
+ * 1. The complete, newline-terminated prefix is parsed and its hash chain
+ *    verified BEFORE anything is removed. A corrupt or chain-broken COMPLETE
+ *    entry is never auto-deleted -- such a file is reported and left untouched.
+ * 2. Only a trailing fragment that CANNOT be a complete JSONL entry (it does not
+ *    parse as JSON) is truncated, back to the last verified newline boundary.
+ * 3. A trailing fragment that DOES parse as a complete JSON object is left
+ *    alone and reported: it may be a genuine entry whose newline never flushed,
+ *    so guessing would risk destroying valid evidence.
+ *
+ * Repairs the current (today's) daily log for the agent, which is the file new
+ * appends target and therefore the one a torn tail would block.
+ */
+export function repairAuditLogTail(agentId, storage = nodeAuditStorage) {
+    const date = new Date().toISOString().slice(0, 10);
+    const file = join(auditDirForDate(agentId, date), "actions.jsonl");
+    return withAuditLock(file, storage, () => repairTornTail(file));
+}
+function repairTornTail(file) {
+    if (!existsSync(file)) {
+        return { file, status: "clean", entries: 0, removedFragment: null, removedBytes: 0 };
+    }
+    // Read raw bytes so the truncation offset is byte-accurate even if the torn
+    // fragment ends mid-way through a multi-byte UTF-8 sequence.
+    const buf = readFileSync(file);
+    if (buf.byteLength === 0) {
+        return { file, status: "clean", entries: 0, removedFragment: null, removedBytes: 0 };
+    }
+    const lastNl = buf.lastIndexOf(0x0a); // '\n'
+    const keepBytes = lastNl === -1 ? 0 : lastNl + 1;
+    const prefixStr = buf.subarray(0, keepBytes).toString("utf8");
+    const tailBuf = buf.subarray(keepBytes);
+    // Verify the complete prefix chain before touching the file.
+    const prefixEntries = parseCompletePrefix(prefixStr, file);
+    const verification = verifyEntryChain(prefixEntries);
+    if (!verification.ok) {
+        throw new Error(`refusing to repair ${file}: the complete prefix fails chain verification at entry ` +
+            `${verification.broken_at} (${verification.message}); a complete but invalid entry is ` +
+            `never auto-deleted`);
+    }
+    if (tailBuf.byteLength === 0) {
+        // Every entry is newline-terminated and the chain is intact: nothing torn.
+        return { file, status: "clean", entries: prefixEntries.length, removedFragment: null, removedBytes: 0 };
+    }
+    const tail = tailBuf.toString("utf8");
+    if (parsesAsJson(tail)) {
+        throw new Error(`refusing to repair ${file}: the trailing fragment is a complete JSON object without a ` +
+            `terminating newline, so it may be a valid entry whose newline was never flushed; it will ` +
+            `not be auto-truncated (manual review required)`);
+    }
+    // The fragment cannot constitute a complete JSONL entry: truncate it away and
+    // flush, restoring the file to its last verified newline boundary.
+    truncateFileTo(file, keepBytes);
+    return {
+        file,
+        status: "repaired",
+        entries: prefixEntries.length,
+        removedFragment: tail,
+        removedBytes: tailBuf.byteLength,
+    };
+}
+function parseCompletePrefix(prefixStr, file) {
+    const lines = prefixStr.split("\n").filter((l) => l.length > 0);
+    const entries = [];
+    for (let i = 0; i < lines.length; i++) {
+        try {
+            entries.push(JSON.parse(lines[i]));
+        }
+        catch {
+            throw new Error(`refusing to repair ${file}: complete line ${i + 1} is not valid JSON; a corrupt ` +
+                `complete entry is never auto-deleted (manual review required)`);
+        }
+    }
+    return entries;
+}
+function parsesAsJson(fragment) {
+    try {
+        JSON.parse(fragment);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function truncateFileTo(file, bytes) {
+    const fd = openSync(file, "r+");
+    try {
+        ftruncateSync(fd, bytes);
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
 //# sourceMappingURL=logger.js.map

package/dist/audit/logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/audit/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACzG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAK7C,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,4EAA4E;AAC5E,0EAA0E;AAC1E,qDAAqD;AACrD,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhE,qCAAqC;AACrC,6EAA6E;AAC7E,wEAAwE;AACxE,mFAAmF;AACnF,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,QAA0B,EAC1B,EAAU,EACV,OAAe,GAAG,EAClB,cAA6B,IAAI,EACjC,eAAuB,EAAE,EACzB,aAAmC,EACnC,oBAA+B,CAAC,EAChC,KAAoB;IAEpB,MAAM,OAAO,GAAG,iBAAiB,KAAK,CAAC;QACrC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,IAAI,IAAI,EAAE,IAAI,EAAE;QACzH,CAAC,CAAC,iBAAiB,KAAK,CAAC;YACzB,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,IAAI,IAAI,EAAE,IAAI,EAAE;YAClH,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC5D,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;SAC/B,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5C,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACxC,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAY;IAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IAElC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAe,CAAC;IACjD,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC,UAAU,CAAC;AAC1B,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IACjC,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,GAAG,SAAS,CAAC,CAAC;QACrD,IAAI,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnC,mEAAmE;QACnE,gEAAgE;QAChE,IAAI,IAAI,GAAG,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,KAAiB;IACjE,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACxC,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,KAAoC;IAEpC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAExC,OAAO,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE;QAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAAiB;IACxD,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,aAAa,CAAI,IAAY,EAAE,SAAkB;IACxD,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,SAAS,EAAE,CAAC;IACrB,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC;IACjD,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,QAAQ,CAAC,IAAI,EAAE;gBACpB,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC;gBAClD,KAAK,EAAE,mBAAmB;gBAC1B,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAChF,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,KAAiB,EACjB,QAA0B,EAC1B,WAA0B,EAC1B,iBAAyB,GAAG;IAE5B,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,KAAK,GAAe;QACxB,kBAAkB,EAAE,CAAC;QACrB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,EAAE;QACF,IAAI,EAAE,KAAK,CAAC,QAAQ;QACpB,QAAQ;QACR,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,iBAAiB,CAC3B,KAAK,CAAC,QAAQ,EACd,QAAQ,EACR,EAAE,EACF,cAAc,EACd,WAAW,EACX,YAAY,EACZ,aAAa,EACb,CAAC,EACD,KAAK,CAAC,KAAK,CACZ;QACD,aAAa,EAAE,YAAY;KAC5B,CAAC;IACF,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAiB;IAC1D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,kBAAkB,IAAI,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC;IACtF,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,SAAoC,CAAC;IACnD,IACE,CAAC,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC;QACnC,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,EAC9B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjG,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/F,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;AAChE,CAAC"}
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/audit/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACtH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAA8B,MAAM,4BAA4B,CAAC;AACjG,OAAO,EAAE,gBAAgB,EAAqB,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAKjD,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,4EAA4E;AAC5E,0EAA0E;AAC1E,qDAAqD;AACrD,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhE,qCAAqC;AACrC,6EAA6E;AAC7E,wEAAwE;AACxE,mFAAmF;AACnF,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,QAA0B,EAC1B,EAAU,EACV,OAAe,GAAG,EAClB,cAA6B,IAAI,EACjC,eAAuB,EAAE,EACzB,aAAmC,EACnC,oBAA+B,CAAC,EAChC,KAAoB;IAEpB,MAAM,OAAO,GAAG,iBAAiB,KAAK,CAAC;QACrC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,IAAI,IAAI,EAAE,IAAI,EAAE;QACzH,CAAC,CAAC,iBAAiB,KAAK,CAAC;YACzB,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,IAAI,IAAI,EAAE,IAAI,EAAE;YAClH,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC5D,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;SAC/B,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5C,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAC1D,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,gFAAgF;AAChF,gCAAgC;AAChC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAgBtD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA0B;IAC5D,MAAM,OAAO,GAAG;QACd,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;QAC3C,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC;IACF,OAAO,SAAS,CAAC,qBAAqB,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACxC,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAY;IAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IAElC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAe,CAAC;IACjD,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC,UAAU,CAAC;AAC1B,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IACjC,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,GAAG,SAAS,CAAC,CAAC;QACrD,IAAI,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnC,mEAAmE;QACnE,gEAAgE;QAChE,IAAI,IAAI,GAAG,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAAe,EACf,KAAiB,EACjB,UAAwB,gBAAgB;IAExC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC,CAAC;IACtD,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAGrC,OAAe,EACf,KAAoC,EACpC,UAAwB,gBAAgB;IAExC,4EAA4E;IAC5E,+DAA+D;IAC/D,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAExC,OAAO,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE;QACvC,MAAM,MAAM,GAAG,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC;QAChC,mEAAmE;QACnE,mDAAmD;QACnD,IAAI,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC1E,OAAO,CAAC,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5F,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACxC,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,gFAAgF;AAChF,gDAAgD;AAChD,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAAiB,EAAE,OAAqB;IAC/E,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,aAAa,CAAI,IAAY,EAAE,OAAqB,EAAE,SAAkB;IAC/E,oEAAoE;IACpE,yEAAyE;IACzE,4BAA4B;IAC5B,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,SAAS,EAAE,CAAC;IACrB,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC;IACjD,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,QAAQ,CAAC,IAAI,EAAE;gBACpB,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC;gBAClD,KAAK,EAAE,mBAAmB;gBAC1B,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAChF,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;AACH,CAAC;AAQD;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,KAAiB,EACjB,QAA0B,EAC1B,WAA0B,EAC1B,cAAsB,EACtB,QAA4B;IAE5B,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,MAAM,UAAU,GAAG,mBAAmB,CAAC;QACrC,KAAK;QACL,IAAI,EAAE,KAAK,CAAC,QAAQ;QACpB,QAAQ;QACR,EAAE;QACF,WAAW;QACX,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,YAAY;QACZ,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,aAAa;QACb,IAAI,EAAE,cAAc;KACrB,CAAC,CAAC;IACH,MAAM,KAAK,GAAiB;QAC1B,kBAAkB,EAAE,CAAC;QACrB,KAAK;QACL,EAAE;QACF,IAAI,EAAE,KAAK,CAAC,QAAQ;QACpB,QAAQ;QACR,YAAY,EAAE,WAAW;QACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,iBAAiB,EAAE,QAAQ,CAAC,gBAAgB;QAC5C,iBAAiB,EAAE,QAAQ,CAAC,gBAAgB;QAC5C,UAAU;QACV,aAAa,EAAE,YAAY;KAC5B,CAAC;IACF,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAiB;IAC1D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,kBAAkB,IAAI,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC;IACtF,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,SAAoC,CAAC;IACnD,IACE,CAAC,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC;QACnC,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,EAC9B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjG,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/F,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;AAChE,CAAC;AAaD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,UAAwB,gBAAgB;IAExC,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,eAAe,CAAC,CAAC;IACnE,OAAO,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IACvF,CAAC;IACD,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IACvF,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;IAC7C,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAExC,6DAA6D;IAC7D,MAAM,aAAa,GAAG,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACrD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,sBAAsB,IAAI,0DAA0D;YAClF,GAAG,YAAY,CAAC,SAAS,KAAK,YAAY,CAAC,OAAO,qCAAqC;YACvF,oBAAoB,CACvB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QAC7B,2EAA2E;QAC3E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAC1G,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,sBAAsB,IAAI,8DAA8D;YACtF,2FAA2F;YAC3F,gDAAgD,CACnD,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,mEAAmE;IACnE,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAChC,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,UAAU;QAClB,OAAO,EAAE,aAAa,CAAC,MAAM;QAC7B,eAAe,EAAE,IAAI;QACrB,YAAY,EAAE,OAAO,CAAC,UAAU;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,SAAiB,EAAE,IAAY;IAC1D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAChE,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAe,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,sBAAsB,IAAI,mBAAmB,CAAC,GAAG,CAAC,gCAAgC;gBAChF,+DAA+D,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa;IACjD,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,aAAa,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACzB,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/audit/paths.d.ts

@@ -2,4 +2,15 @@ export declare function catpHome(): string;
 export declare function validateAgentId(agentId: string): string;
 export declare function auditRoot(agentId: string): string;
 export declare function auditDirForDate(agentId: string, date: string): string;
+/**
+ * Directory holding the content-addressed canonical action sidecars for a given
+ * agent/day: `$CATP_HOME/audit/<agent>/<YYYY-MM-DD>/actions`.
+ */
+export declare function actionsDirForDate(agentId: string, date: string): string;
+/**
+ * Absolute path of the durable sidecar storing the complete canonical action
+ * whose digest is `actionCommitment`. The commitment must be a 64-character
+ * lowercase hex digest so it can never escape the actions directory.
+ */
+export declare function actionSidecarPath(agentId: string, date: string, actionCommitment: string): string;
 //# sourceMappingURL=paths.d.ts.map

package/dist/audit/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/audit/paths.ts"],"names":[],"mappings":"AAGA,wBAAgB,QAAQ,IAAI,MAAM,CAEjC;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAKvD;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAErE"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/audit/paths.ts"],"names":[],"mappings":"AAGA,wBAAgB,QAAQ,IAAI,MAAM,CAEjC;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAKvD;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvE;AAID;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,gBAAgB,EAAE,MAAM,GACvB,MAAM,CAKR"}

package/dist/audit/paths.js

@@ -15,4 +15,23 @@ export function auditRoot(agentId) {
 export function auditDirForDate(agentId, date) {
     return join(auditRoot(agentId), date);
 }
+/**
+ * Directory holding the content-addressed canonical action sidecars for a given
+ * agent/day: `$CATP_HOME/audit/<agent>/<YYYY-MM-DD>/actions`.
+ */
+export function actionsDirForDate(agentId, date) {
+    return join(auditDirForDate(agentId, date), "actions");
+}
+const ACTION_COMMITMENT_HEX64 = /^[0-9a-f]{64}$/;
+/**
+ * Absolute path of the durable sidecar storing the complete canonical action
+ * whose digest is `actionCommitment`. The commitment must be a 64-character
+ * lowercase hex digest so it can never escape the actions directory.
+ */
+export function actionSidecarPath(agentId, date, actionCommitment) {
+    if (!ACTION_COMMITMENT_HEX64.test(actionCommitment)) {
+        throw new Error("action commitment must be a 64-character lowercase hex digest");
+    }
+    return join(actionsDirForDate(agentId, date), `${actionCommitment}.json`);
+}
 //# sourceMappingURL=paths.js.map

package/dist/audit/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/audit/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,UAAU,QAAQ;IACtB,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,IAAY;IAC3D,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC"}
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/audit/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,UAAU,QAAQ;IACtB,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,IAAY;IAC3D,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,IAAY;IAC7D,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,uBAAuB,GAAG,gBAAgB,CAAC;AAEjD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,IAAY,EACZ,gBAAwB;IAExB,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,GAAG,gBAAgB,OAAO,CAAC,CAAC;AAC5E,CAAC"}

package/dist/audit/verifier.d.ts

@@ -1,3 +1,4 @@
+import type { AuditEntry } from "../policy/types.js";
 export interface VerifyResult {
     ok: boolean;
     checked: number;
@@ -5,4 +6,12 @@ export interface VerifyResult {
     message: string;
 }
 export declare function verifyChain(logFile: string): Promise<VerifyResult>;
+/**
+ * Pure chain validation over already-parsed entries. Both the on-disk
+ * `verifyChain` wrapper and offline audit-export verification delegate here, so
+ * the exact same commitment rules apply to a live daily log and to a portable
+ * export bundle. `broken_at`/`checked` are entry indices (0-based); messages use
+ * the human-facing 1-based `line N` wording shared with the file wrapper.
+ */
+export declare function verifyEntryChain(entries: AuditEntry[]): VerifyResult;
 //# sourceMappingURL=verifier.d.ts.map

package/dist/audit/verifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../src/audit/verifier.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CA6DxE"}
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../src/audit/verifier.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;CACjB;AAID,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAexE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,YAAY,CA0FpE"}

package/dist/audit/verifier.js

@@ -1,25 +1,44 @@
 import { createReadStream } from "node:fs";
 import { createInterface } from "node:readline";
-import { computeCommitment } from "./logger.js";
+import { computeCommitment, computeCommitmentV4 } from "./logger.js";
+const HEX64 = /^[0-9a-f]{64}$/;
 export async function verifyChain(logFile) {
     const lines = await readLines(logFile);
     if (lines.length === 0) {
         return { ok: true, checked: 0, broken_at: null, message: "empty log" };
     }
-    let prev = "0";
+    const entries = [];
     for (let i = 0; i < lines.length; i++) {
-        let entry;
         try {
-            entry = JSON.parse(lines[i]);
+            entries.push(JSON.parse(lines[i]));
         }
         catch {
             return { ok: false, checked: i, broken_at: i, message: `line ${i + 1}: invalid JSON` };
         }
+    }
+    return verifyEntryChain(entries);
+}
+/**
+ * Pure chain validation over already-parsed entries. Both the on-disk
+ * `verifyChain` wrapper and offline audit-export verification delegate here, so
+ * the exact same commitment rules apply to a live daily log and to a portable
+ * export bundle. `broken_at`/`checked` are entry indices (0-based); messages use
+ * the human-facing 1-based `line N` wording shared with the file wrapper.
+ */
+export function verifyEntryChain(entries) {
+    if (entries.length === 0) {
+        return { ok: true, checked: 0, broken_at: null, message: "empty log" };
+    }
+    let prev = "0";
+    for (let i = 0; i < entries.length; i++) {
+        const entry = entries[i];
         const decision = entry.decision;
-        if (entry.commitment_version !== undefined &&
-            entry.commitment_version !== 1 &&
-            entry.commitment_version !== 2 &&
-            entry.commitment_version !== 3) {
+        const version = entry.commitment_version;
+        if (version !== undefined &&
+            version !== 1 &&
+            version !== 2 &&
+            version !== 3 &&
+            version !== 4) {
             return {
                 ok: false,
                 checked: i,
@@ -27,16 +46,49 @@ export async function verifyChain(logFile) {
                 message: `line ${i + 1}: unsupported commitment version`,
             };
         }
-        const commitmentVersion = entry.commitment_version ?? 1;
-        if (commitmentVersion === 3 && entry.phase !== "pre" && entry.phase !== "post") {
-            return {
-                ok: false,
-                checked: i,
-                broken_at: i,
-                message: `line ${i + 1}: commitment version 3 requires a valid phase`,
-            };
+        let expected;
+        if (entry.commitment_version === 4) {
+            // Version 4 binds the decision to the enforcement-time policy and the
+            // complete normalized action. Require both bindings present and
+            // lowercase-hex, plus a valid phase, before recomputing.
+            if (typeof entry.reason !== "string") {
+                return { ok: false, checked: i, broken_at: i, message: `line ${i + 1}: commitment version 4 requires a reason` };
+            }
+            if (typeof entry.policy_commitment !== "string" || !HEX64.test(entry.policy_commitment)) {
+                return { ok: false, checked: i, broken_at: i, message: `line ${i + 1}: commitment version 4 requires a lowercase-hex policy_commitment` };
+            }
+            if (typeof entry.action_commitment !== "string" || !HEX64.test(entry.action_commitment)) {
+                return { ok: false, checked: i, broken_at: i, message: `line ${i + 1}: commitment version 4 requires a lowercase-hex action_commitment` };
+            }
+            if (entry.phase !== "pre" && entry.phase !== "post") {
+                return { ok: false, checked: i, broken_at: i, message: `line ${i + 1}: commitment version 4 requires a valid phase` };
+            }
+            expected = computeCommitmentV4({
+                phase: entry.phase,
+                tool: entry.tool,
+                decision,
+                ts: entry.ts,
+                ruleMatched: entry.rule_matched,
+                reason: entry.reason,
+                inputSummary: entry.input_summary,
+                policyCommitment: entry.policy_commitment,
+                actionCommitment: entry.action_commitment,
+                authorization: entry.authorization,
+                prev,
+            });
+        }
+        else {
+            const commitmentVersion = entry.commitment_version ?? 1;
+            if (commitmentVersion === 3 && entry.phase !== "pre" && entry.phase !== "post") {
+                return {
+                    ok: false,
+                    checked: i,
+                    broken_at: i,
+                    message: `line ${i + 1}: commitment version 3 requires a valid phase`,
+                };
+            }
+            expected = computeCommitment(entry.tool, decision, entry.ts, prev, entry.rule_matched, entry.input_summary, entry.authorization, commitmentVersion, entry.phase);
         }
-        const expected = computeCommitment(entry.tool, decision, entry.ts, prev, entry.rule_matched, entry.input_summary, entry.authorization, commitmentVersion, entry.phase);
         if (entry.commitment !== expected) {
             return {
                 ok: false,
@@ -47,7 +99,7 @@ export async function verifyChain(logFile) {
         }
         prev = entry.commitment;
     }
-    return { ok: true, checked: lines.length, broken_at: null, message: "chain intact" };
+    return { ok: true, checked: entries.length, broken_at: null, message: "chain intact" };
 }
 async function readLines(file) {
     return new Promise((resolve, reject) => {

package/dist/audit/verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../src/audit/verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAUhD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAe;IAC/C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IACzE,CAAC;IAED,IAAI,IAAI,GAAG,GAAG,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,KAAiB,CAAC;QACtB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAe,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACzF,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,QAA4B,CAAC;QACpD,IACE,KAAK,CAAC,kBAAkB,KAAK,SAAS;YACtC,KAAK,CAAC,kBAAkB,KAAK,CAAC;YAC9B,KAAK,CAAC,kBAAkB,KAAK,CAAC;YAC9B,KAAK,CAAC,kBAAkB,KAAK,CAAC,EAC9B,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,CAAC;gBACV,SAAS,EAAE,CAAC;gBACZ,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,kCAAkC;aACzD,CAAC;QACJ,CAAC;QACD,MAAM,iBAAiB,GAAG,KAAK,CAAC,kBAAkB,IAAI,CAAC,CAAC;QACxD,IAAI,iBAAiB,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YAC/E,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,CAAC;gBACV,SAAS,EAAE,CAAC;gBACZ,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,+CAA+C;aACtE,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,iBAAiB,CAChC,KAAK,CAAC,IAAI,EACV,QAAQ,EACR,KAAK,CAAC,EAAE,EACR,IAAI,EACJ,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,aAAa,EACnB,iBAAiB,EACjB,KAAK,CAAC,KAAK,CACZ,CAAC;QACF,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,CAAC;gBACV,SAAS,EAAE,CAAC;gBACZ,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,kDAAkD;aACzE,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC;IAC1B,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;AACvF,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY;IACnC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnF,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACrC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../src/audit/verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAUrE,MAAM,KAAK,GAAG,gBAAgB,CAAC;AAE/B,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAe;IAC/C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IACzE,CAAC;IAED,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAe,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACzF,CAAC;IACH,CAAC;IACD,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAqB;IACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IACzE,CAAC;IAED,IAAI,IAAI,GAAG,GAAG,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAEzB,MAAM,QAAQ,GAAG,KAAK,CAAC,QAA4B,CAAC;QACpD,MAAM,OAAO,GAAG,KAAK,CAAC,kBAAkB,CAAC;QACzC,IACE,OAAO,KAAK,SAAS;YACrB,OAAO,KAAK,CAAC;YACb,OAAO,KAAK,CAAC;YACb,OAAO,KAAK,CAAC;YACb,OAAO,KAAK,CAAC,EACb,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,CAAC;gBACV,SAAS,EAAE,CAAC;gBACZ,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,kCAAkC;aACzD,CAAC;QACJ,CAAC;QAED,IAAI,QAAgB,CAAC;QACrB,IAAI,KAAK,CAAC,kBAAkB,KAAK,CAAC,EAAE,CAAC;YACnC,sEAAsE;YACtE,gEAAgE;YAChE,yDAAyD;YACzD,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,0CAA0C,EAAE,CAAC;YACnH,CAAC;YACD,IAAI,OAAO,KAAK,CAAC,iBAAiB,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACxF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,mEAAmE,EAAE,CAAC;YAC5I,CAAC;YACD,IAAI,OAAO,KAAK,CAAC,iBAAiB,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACxF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,mEAAmE,EAAE,CAAC;YAC5I,CAAC;YACD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;gBACpD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,+CAA+C,EAAE,CAAC;YACxH,CAAC;YACD,QAAQ,GAAG,mBAAmB,CAAC;gBAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ;gBACR,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,WAAW,EAAE,KAAK,CAAC,YAAY;gBAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,YAAY,EAAE,KAAK,CAAC,aAAa;gBACjC,gBAAgB,EAAE,KAAK,CAAC,iBAAiB;gBACzC,gBAAgB,EAAE,KAAK,CAAC,iBAAiB;gBACzC,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,IAAI;aACL,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,iBAAiB,GAAG,KAAK,CAAC,kBAAkB,IAAI,CAAC,CAAC;YACxD,IAAI,iBAAiB,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;gBAC/E,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE,CAAC;oBACV,SAAS,EAAE,CAAC;oBACZ,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,+CAA+C;iBACtE,CAAC;YACJ,CAAC;YACD,QAAQ,GAAG,iBAAiB,CAC1B,KAAK,CAAC,IAAI,EACV,QAAQ,EACR,KAAK,CAAC,EAAE,EACR,IAAI,EACJ,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,aAAa,EACnB,iBAAiB,EACjB,KAAK,CAAC,KAAK,CACZ,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,CAAC;gBACV,SAAS,EAAE,CAAC;gBACZ,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,kDAAkD;aACzE,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC;IAC1B,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;AACzF,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY;IACnC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnF,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACrC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli.js

@@ -6,7 +6,7 @@ import { runPostHook } from "./hook/post.js";
 import { formatSupportedRuntimeAdapters, getRuntimeAdapter, supportedRuntimeAdapters } from "./adapters/index.js";
 import { cmdInit } from "./commands/init.js";
 import { cmdValidate } from "./commands/validate.js";
-import { cmdLogExport, cmdLogShow, cmdLogVerify } from "./commands/log.js";
+import { cmdLogExport, cmdLogRepair, cmdLogShow, cmdLogVerify } from "./commands/log.js";
 import { cmdAnchor } from "./commands/anchor.js";
 import { cmdWitness } from "./commands/witness.js";
 import { cmdProveAuthorization, cmdVerifyAuthorization } from "./commands/authorization.js";
@@ -78,9 +78,15 @@ log
     .description("Verify commitment chain integrity")
     .option("--agent <id>", "agent id (default: from policy file)")
     .action(cmdLogVerify);
+log
+    .command("repair")
+    .description("Repair a torn audit-log tail left by a crashed append (truncates only an unterminated fragment that cannot be a complete entry)")
+    .option("--agent <id>", "agent id (default: from policy file)")
+    .option("--json", "write the repair result as JSON")
+    .action(cmdLogRepair);
 log
     .command("export")
-    .description("Export a deterministic audit entry bundle")
+    .description("Export a self-contained audit evidence bundle (catp_audit_export_v2)")
     .option("--commitment <hex>", "audit entry commitment to export")
     .option("--latest", "export the latest audit entry")
     .option("--tool <name>", "export the latest audit entry matching a tool name")
@@ -143,31 +149,31 @@ receipt
     .action(cmdReceiptKeygen);
 receipt
     .command("sign")
-    .description("Sign a CATP audit export as an authorization receipt")
-    .requiredOption("--audit-export <path>", "catp_audit_export_v1 JSON from catp log export")
+    .description("Sign a self-contained v2 audit export as an enforcement-time-bound authorization receipt")
+    .requiredOption("--audit-export <path>", "catp_audit_export_v2 JSON from catp log export")
     .requiredOption("--private-key <path>", "Ed25519 private key PEM")
-    .option("-f, --file <path>", "path to catp-policy.toml to bind into the receipt")
+    .option("-f, --file <path>", "policy file to verify against the recorded enforcement-time commitment (evidence only, never the binding source)")
     .option("--out <path>", "write receipt JSON to file instead of stdout")
     .action(cmdReceiptSign);
 receipt
     .command("issue")
-    .description("Export an audit entry by commitment and sign it as an authorization receipt")
+    .description("Export an audit entry by commitment and sign it as an enforcement-time-bound authorization receipt")
     .option("--commitment <hex>", "audit entry commitment to issue a receipt for")
     .option("--latest", "issue a receipt for the latest audit entry")
     .option("--tool <name>", "issue a receipt for the latest audit entry matching a tool name")
     .option("--decision <allow|deny>", "filter --latest or --tool by decision")
     .requiredOption("--private-key <path>", "Ed25519 private key PEM")
     .option("--agent <id>", "agent id (default: from policy file)")
-    .option("-f, --file <path>", "path to catp-policy.toml to bind into the receipt")
-    .option("--audit-export-out <path>", "also write the generated catp_audit_export_v1 JSON")
+    .option("-f, --file <path>", "policy file to verify against the recorded enforcement-time commitment (evidence only, never the binding source)")
+    .option("--audit-export-out <path>", "also write the generated catp_audit_export_v2 JSON")
     .option("--out <path>", "write receipt JSON to file instead of stdout")
     .action(cmdReceiptIssue);
 receipt
     .command("verify")
-    .description("Verify a signed CATP authorization receipt")
-    .requiredOption("--receipt <path>", "catp_authorization_receipt_v1 JSON")
-    .requiredOption("--public-key <path>", "trusted Ed25519 public key PEM")
-    .option("--audit-export <path>", "also check the receipt against a catp_audit_export_v1 JSON bundle")
+    .description("Verify a signed CATP authorization receipt (v2, or legacy v1)")
+    .requiredOption("--receipt <path>", "catp_authorization_receipt_v2 JSON (legacy v1 also accepted)")
+    .requiredOption("--public-key <path>", "independently trusted Ed25519 public key PEM")
+    .option("--audit-export <path>", "catp_audit_export_v2 JSON bundle; REQUIRED for v2 receipts (enforcement-time-bound assurance), optional for legacy v1")
     .option("-f, --file <path>", "also check the receipt against a catp-policy.toml commitment")
     .option("--json", "write verification summary as JSON")
     .action(cmdReceiptVerify);

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAClH,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE5G,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;AAEtE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,MAAM,CAAC;KACZ,WAAW,CAAC,sEAAsE,CAAC;KACnF,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,sDAAsD,CAAC;KACnE,MAAM,CAAC,iBAAiB,EAAE,wDAAwD,CAAC;KACnF,MAAM,CAAC,OAAO,CAAC,CAAC;AAEnB,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,kCAAkC,CAAC;KAC/C,MAAM,CAAC,mBAAmB,EAAE,8CAA8C,CAAC;KAC3E,MAAM,CAAC,WAAW,CAAC,CAAC;AAEvB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,0CAA0C,CAAC,CAAC;AAE7F,SAAS,kBAAkB,CAAC,OAAe,EAAE,kBAAyB,CAAC;IACrE,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,OAAO,iBAAiB,wBAAwB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9H,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,IAAI;KACD,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,oCAAoC,CAAC;KACjD,MAAM,CAAC,GAAG,EAAE;IACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,CAAC,CAAC;AACzD,CAAC,CAAC,CAAC;AAEL,IAAI;KACD,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,yDAAyD,CAAC;KACtE,MAAM,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,aAAa,CAAC;KAC7D,MAAM,CAAC,CAAC,IAAyB,EAAE,EAAE;IACpC,UAAU,CAAC,EAAE,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAClF,MAAM,MAAM,GAAG,mBAAoB,GAAa,CAAC,OAAO,EAAE,CAAC;QAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,MAAM,IAAI,CAAC,CAAC;QAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,IAAI;KACD,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,8DAA8D,CAAC;KAC3E,MAAM,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,aAAa,CAAC;KAC7D,MAAM,CAAC,CAAC,IAAyB,EAAE,EAAE;IACpC,WAAW,CAAC,EAAE,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC,CAAC,CAAC;AAEL,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC;AAErE,GAAG;KACA,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,kCAAkC,CAAC;KAC/C,MAAM,CAAC,iBAAiB,EAAE,yBAAyB,EAAE,IAAI,CAAC;KAC1D,MAAM,CAAC,cAAc,EAAE,sCAAsC,CAAC;KAC9D,MAAM,CAAC,eAAe,EAAE,mCAAmC,CAAC;KAC5D,MAAM,CAAC,QAAQ,EAAE,oCAAoC,CAAC;KACtD,MAAM,CAAC,eAAe,EAAE,wCAAwC,CAAC;KACjE,MAAM,CAAC,yBAAyB,EAAE,uCAAuC,CAAC;KAC1E,MAAM,CAAC,UAAU,CAAC,CAAC;AAEtB,GAAG;KACA,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,mCAAmC,CAAC;KAChD,MAAM,CAAC,cAAc,EAAE,sCAAsC,CAAC;KAC9D,MAAM,CAAC,YAAY,CAAC,CAAC;AAExB,GAAG;KACA,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,2CAA2C,CAAC;KACxD,MAAM,CAAC,oBAAoB,EAAE,kCAAkC,CAAC;KAChE,MAAM,CAAC,UAAU,EAAE,+BAA+B,CAAC;KACnD,MAAM,CAAC,eAAe,EAAE,oDAAoD,CAAC;KAC7E,MAAM,CAAC,yBAAyB,EAAE,uCAAuC,CAAC;KAC1E,MAAM,CAAC,cAAc,EAAE,sCAAsC,CAAC;KAC9D,MAAM,CAAC,cAAc,EAAE,mDAAmD,CAAC;KAC3E,MAAM,CAAC,YAAY,CAAC,CAAC;AAExB,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,2EAA2E,CAAC;KACxF,MAAM,CAAC,cAAc,EAAE,sCAAsC,CAAC;KAC9D,MAAM,CAAC,cAAc,EAAE,yCAAyC,CAAC;KACjE,MAAM,CAAC,SAAS,CAAC,CAAC;AAErB,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,uEAAuE,CAAC;KACpF,MAAM,CAAC,iBAAiB,EAAE,gCAAgC,CAAC;KAC3D,MAAM,CAAC,0BAA0B,EAAE,4CAA4C,CAAC;KAChF,MAAM,CAAC,cAAc,EAAE,6DAA6D,CAAC;KACrF,MAAM,CAAC,mBAAmB,EAAE,mDAAmD,CAAC;KAChF,MAAM,CAAC,cAAc,EAAE,8CAA8C,CAAC;KACtE,MAAM,CAAC,2BAA2B,EAAE,kCAAkC,CAAC;KACvE,MAAM,CAAC,0BAA0B,EAAE,iCAAiC,CAAC;KACrE,MAAM,CAAC,UAAU,CAAC,CAAC;AAEtB,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,sCAAsC,CAAC,CAAC;AAE3F,KAAK;KACF,OAAO,CAAC,eAAe,CAAC;KACxB,WAAW,CAAC,qFAAqF,CAAC;KAClG,MAAM,CAAC,mBAAmB,EAAE,uDAAuD,CAAC;KACpF,MAAM,CAAC,iBAAiB,EAAE,iCAAiC,CAAC;KAC5D,MAAM,CAAC,0BAA0B,EAAE,2CAA2C,CAAC;KAC/E,MAAM,CAAC,cAAc,EAAE,6DAA6D,CAAC;KACrF,MAAM,CAAC,mBAAmB,EAAE,mDAAmD,CAAC;KAChF,MAAM,CAAC,2BAA2B,EAAE,kCAAkC,CAAC;KACvE,MAAM,CAAC,0BAA0B,EAAE,iCAAiC,CAAC;KACrE,MAAM,CAAC,uBAAuB,EAAE,4CAA4C,CAAC;KAC7E,MAAM,CAAC,sBAAsB,EAAE,0CAA0C,CAAC;KAC1E,MAAM,CAAC,wBAAwB,EAAE,iCAAiC,CAAC;KACnE,MAAM,CAAC,qBAAqB,EAAE,iEAAiE,CAAC;KAChG,MAAM,CAAC,sBAAsB,EAAE,gDAAgD,CAAC;KAChF,MAAM,CAAC,8BAA8B,EAAE,yBAAyB,CAAC;KACjE,MAAM,CAAC,iBAAiB,EAAE,sCAAsC,CAAC;KACjE,MAAM,CAAC,mBAAmB,EAAE,uDAAuD,CAAC;KACpF,MAAM,CAAC,cAAc,EAAE,qDAAqD,CAAC;KAC7E,MAAM,CAAC,qBAAqB,CAAC,CAAC;AAEjC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,6BAA6B,CAAC,CAAC;AAEpF,MAAM;KACH,OAAO,CAAC,eAAe,CAAC;KACxB,WAAW,CAAC,0CAA0C,CAAC;KACvD,cAAc,CAAC,mBAAmB,EAAE,mCAAmC,CAAC;KACxE,MAAM,CAAC,eAAe,EAAE,0DAA0D,CAAC;KACnF,MAAM,CAAC,oBAAoB,EAAE,oDAAoD,CAAC;KAClF,MAAM,CAAC,sBAAsB,CAAC,CAAC;AAElC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,uCAAuC,CAAC,CAAC;AAEhG,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,wDAAwD,CAAC;KACrE,MAAM,CAAC,sBAAsB,EAAE,yBAAyB,EAAE,0BAA0B,CAAC;KACrF,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,EAAE,yBAAyB,CAAC;KAClF,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAE5B,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,sDAAsD,CAAC;KACnE,cAAc,CAAC,uBAAuB,EAAE,gDAAgD,CAAC;KACzF,cAAc,CAAC,sBAAsB,EAAE,yBAAyB,CAAC;KACjE,MAAM,CAAC,mBAAmB,EAAE,mDAAmD,CAAC;KAChF,MAAM,CAAC,cAAc,EAAE,8CAA8C,CAAC;KACtE,MAAM,CAAC,cAAc,CAAC,CAAC;AAE1B,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,6EAA6E,CAAC;KAC1F,MAAM,CAAC,oBAAoB,EAAE,+CAA+C,CAAC;KAC7E,MAAM,CAAC,UAAU,EAAE,4CAA4C,CAAC;KAChE,MAAM,CAAC,eAAe,EAAE,iEAAiE,CAAC;KAC1F,MAAM,CAAC,yBAAyB,EAAE,uCAAuC,CAAC;KAC1E,cAAc,CAAC,sBAAsB,EAAE,yBAAyB,CAAC;KACjE,MAAM,CAAC,cAAc,EAAE,sCAAsC,CAAC;KAC9D,MAAM,CAAC,mBAAmB,EAAE,mDAAmD,CAAC;KAChF,MAAM,CAAC,2BAA2B,EAAE,oDAAoD,CAAC;KACzF,MAAM,CAAC,cAAc,EAAE,8CAA8C,CAAC;KACtE,MAAM,CAAC,eAAe,CAAC,CAAC;AAE3B,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,4CAA4C,CAAC;KACzD,cAAc,CAAC,kBAAkB,EAAE,oCAAoC,CAAC;KACxE,cAAc,CAAC,qBAAqB,EAAE,gCAAgC,CAAC;KACvE,MAAM,CAAC,uBAAuB,EAAE,mEAAmE,CAAC;KACpG,MAAM,CAAC,mBAAmB,EAAE,8DAA8D,CAAC;KAC3F,MAAM,CAAC,QAAQ,EAAE,oCAAoC,CAAC;KACtD,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAE5B,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAU,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;IAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAClH,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACzF,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE5G,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;AAEtE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,MAAM,CAAC;KACZ,WAAW,CAAC,sEAAsE,CAAC;KACnF,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,sDAAsD,CAAC;KACnE,MAAM,CAAC,iBAAiB,EAAE,wDAAwD,CAAC;KACnF,MAAM,CAAC,OAAO,CAAC,CAAC;AAEnB,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,kCAAkC,CAAC;KAC/C,MAAM,CAAC,mBAAmB,EAAE,8CAA8C,CAAC;KAC3E,MAAM,CAAC,WAAW,CAAC,CAAC;AAEvB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,0CAA0C,CAAC,CAAC;AAE7F,SAAS,kBAAkB,CAAC,OAAe,EAAE,kBAAyB,CAAC;IACrE,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,OAAO,iBAAiB,wBAAwB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9H,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,IAAI;KACD,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,oCAAoC,CAAC;KACjD,MAAM,CAAC,GAAG,EAAE;IACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,CAAC,CAAC;AACzD,CAAC,CAAC,CAAC;AAEL,IAAI;KACD,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,yDAAyD,CAAC;KACtE,MAAM,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,aAAa,CAAC;KAC7D,MAAM,CAAC,CAAC,IAAyB,EAAE,EAAE;IACpC,UAAU,CAAC,EAAE,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAClF,MAAM,MAAM,GAAG,mBAAoB,GAAa,CAAC,OAAO,EAAE,CAAC;QAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,MAAM,IAAI,CAAC,CAAC;QAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,IAAI;KACD,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,8DAA8D,CAAC;KAC3E,MAAM,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,aAAa,CAAC;KAC7D,MAAM,CAAC,CAAC,IAAyB,EAAE,EAAE;IACpC,WAAW,CAAC,EAAE,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC,CAAC,CAAC;AAEL,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC;AAErE,GAAG;KACA,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,kCAAkC,CAAC;KAC/C,MAAM,CAAC,iBAAiB,EAAE,yBAAyB,EAAE,IAAI,CAAC;KAC1D,MAAM,CAAC,cAAc,EAAE,sCAAsC,CAAC;KAC9D,MAAM,CAAC,eAAe,EAAE,mCAAmC,CAAC;KAC5D,MAAM,CAAC,QAAQ,EAAE,oCAAoC,CAAC;KACtD,MAAM,CAAC,eAAe,EAAE,wCAAwC,CAAC;KACjE,MAAM,CAAC,yBAAyB,EAAE,uCAAuC,CAAC;KAC1E,MAAM,CAAC,UAAU,CAAC,CAAC;AAEtB,GAAG;KACA,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,mCAAmC,CAAC;KAChD,MAAM,CAAC,cAAc,EAAE,sCAAsC,CAAC;KAC9D,MAAM,CAAC,YAAY,CAAC,CAAC;AAExB,GAAG;KACA,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,iIAAiI,CAAC;KAC9I,MAAM,CAAC,cAAc,EAAE,sCAAsC,CAAC;KAC9D,MAAM,CAAC,QAAQ,EAAE,iCAAiC,CAAC;KACnD,MAAM,CAAC,YAAY,CAAC,CAAC;AAExB,GAAG;KACA,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,sEAAsE,CAAC;KACnF,MAAM,CAAC,oBAAoB,EAAE,kCAAkC,CAAC;KAChE,MAAM,CAAC,UAAU,EAAE,+BAA+B,CAAC;KACnD,MAAM,CAAC,eAAe,EAAE,oDAAoD,CAAC;KAC7E,MAAM,CAAC,yBAAyB,EAAE,uCAAuC,CAAC;KAC1E,MAAM,CAAC,cAAc,EAAE,sCAAsC,CAAC;KAC9D,MAAM,CAAC,cAAc,EAAE,mDAAmD,CAAC;KAC3E,MAAM,CAAC,YAAY,CAAC,CAAC;AAExB,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,2EAA2E,CAAC;KACxF,MAAM,CAAC,cAAc,EAAE,sCAAsC,CAAC;KAC9D,MAAM,CAAC,cAAc,EAAE,yCAAyC,CAAC;KACjE,MAAM,CAAC,SAAS,CAAC,CAAC;AAErB,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,uEAAuE,CAAC;KACpF,MAAM,CAAC,iBAAiB,EAAE,gCAAgC,CAAC;KAC3D,MAAM,CAAC,0BAA0B,EAAE,4CAA4C,CAAC;KAChF,MAAM,CAAC,cAAc,EAAE,6DAA6D,CAAC;KACrF,MAAM,CAAC,mBAAmB,EAAE,mDAAmD,CAAC;KAChF,MAAM,CAAC,cAAc,EAAE,8CAA8C,CAAC;KACtE,MAAM,CAAC,2BAA2B,EAAE,kCAAkC,CAAC;KACvE,MAAM,CAAC,0BAA0B,EAAE,iCAAiC,CAAC;KACrE,MAAM,CAAC,UAAU,CAAC,CAAC;AAEtB,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,sCAAsC,CAAC,CAAC;AAE3F,KAAK;KACF,OAAO,CAAC,eAAe,CAAC;KACxB,WAAW,CAAC,qFAAqF,CAAC;KAClG,MAAM,CAAC,mBAAmB,EAAE,uDAAuD,CAAC;KACpF,MAAM,CAAC,iBAAiB,EAAE,iCAAiC,CAAC;KAC5D,MAAM,CAAC,0BAA0B,EAAE,2CAA2C,CAAC;KAC/E,MAAM,CAAC,cAAc,EAAE,6DAA6D,CAAC;KACrF,MAAM,CAAC,mBAAmB,EAAE,mDAAmD,CAAC;KAChF,MAAM,CAAC,2BAA2B,EAAE,kCAAkC,CAAC;KACvE,MAAM,CAAC,0BAA0B,EAAE,iCAAiC,CAAC;KACrE,MAAM,CAAC,uBAAuB,EAAE,4CAA4C,CAAC;KAC7E,MAAM,CAAC,sBAAsB,EAAE,0CAA0C,CAAC;KAC1E,MAAM,CAAC,wBAAwB,EAAE,iCAAiC,CAAC;KACnE,MAAM,CAAC,qBAAqB,EAAE,iEAAiE,CAAC;KAChG,MAAM,CAAC,sBAAsB,EAAE,gDAAgD,CAAC;KAChF,MAAM,CAAC,8BAA8B,EAAE,yBAAyB,CAAC;KACjE,MAAM,CAAC,iBAAiB,EAAE,sCAAsC,CAAC;KACjE,MAAM,CAAC,mBAAmB,EAAE,uDAAuD,CAAC;KACpF,MAAM,CAAC,cAAc,EAAE,qDAAqD,CAAC;KAC7E,MAAM,CAAC,qBAAqB,CAAC,CAAC;AAEjC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,6BAA6B,CAAC,CAAC;AAEpF,MAAM;KACH,OAAO,CAAC,eAAe,CAAC;KACxB,WAAW,CAAC,0CAA0C,CAAC;KACvD,cAAc,CAAC,mBAAmB,EAAE,mCAAmC,CAAC;KACxE,MAAM,CAAC,eAAe,EAAE,0DAA0D,CAAC;KACnF,MAAM,CAAC,oBAAoB,EAAE,oDAAoD,CAAC;KAClF,MAAM,CAAC,sBAAsB,CAAC,CAAC;AAElC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,uCAAuC,CAAC,CAAC;AAEhG,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,wDAAwD,CAAC;KACrE,MAAM,CAAC,sBAAsB,EAAE,yBAAyB,EAAE,0BAA0B,CAAC;KACrF,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,EAAE,yBAAyB,CAAC;KAClF,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAE5B,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,0FAA0F,CAAC;KACvG,cAAc,CAAC,uBAAuB,EAAE,gDAAgD,CAAC;KACzF,cAAc,CAAC,sBAAsB,EAAE,yBAAyB,CAAC;KACjE,MAAM,CAAC,mBAAmB,EAAE,kHAAkH,CAAC;KAC/I,MAAM,CAAC,cAAc,EAAE,8CAA8C,CAAC;KACtE,MAAM,CAAC,cAAc,CAAC,CAAC;AAE1B,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,oGAAoG,CAAC;KACjH,MAAM,CAAC,oBAAoB,EAAE,+CAA+C,CAAC;KAC7E,MAAM,CAAC,UAAU,EAAE,4CAA4C,CAAC;KAChE,MAAM,CAAC,eAAe,EAAE,iEAAiE,CAAC;KAC1F,MAAM,CAAC,yBAAyB,EAAE,uCAAuC,CAAC;KAC1E,cAAc,CAAC,sBAAsB,EAAE,yBAAyB,CAAC;KACjE,MAAM,CAAC,cAAc,EAAE,sCAAsC,CAAC;KAC9D,MAAM,CAAC,mBAAmB,EAAE,kHAAkH,CAAC;KAC/I,MAAM,CAAC,2BAA2B,EAAE,oDAAoD,CAAC;KACzF,MAAM,CAAC,cAAc,EAAE,8CAA8C,CAAC;KACtE,MAAM,CAAC,eAAe,CAAC,CAAC;AAE3B,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,+DAA+D,CAAC;KAC5E,cAAc,CAAC,kBAAkB,EAAE,8DAA8D,CAAC;KAClG,cAAc,CAAC,qBAAqB,EAAE,8CAA8C,CAAC;KACrF,MAAM,CAAC,uBAAuB,EAAE,uHAAuH,CAAC;KACxJ,MAAM,CAAC,mBAAmB,EAAE,8DAA8D,CAAC;KAC3F,MAAM,CAAC,QAAQ,EAAE,oCAAoC,CAAC;KACtD,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAE5B,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAU,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;IAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}