@flowdot.ai/guardian-agent 0.1.0

package/dist/cli/guardian-correlator.js

@@ -0,0 +1,217 @@
+#!/usr/bin/env node
+/**
+ * guardian-correlator — offline cross-surface correlation CLI. SPEC §14
+ * (v0.5.0+).
+ *
+ * Reads two or more audit JSONL files for the same `agent_id` and reports
+ * patterns that span surfaces: overlapping sessions, identical-args
+ * collisions, similar tool-frequency sequences. Writes findings as
+ * `x_cross_surface_match` JSONL to its own log (NEVER mutates source
+ * files).
+ *
+ * Usage:
+ *   guardian-correlator <file1.jsonl>:<surface1> <file2.jsonl>:<surface2> [...]
+ *   guardian-correlator <file1>:<surface1> <file2>:<surface2> --out <correlations.jsonl>
+ *   guardian-correlator <files...> --threshold <0..1>   # cosine threshold (default 0.9)
+ *   guardian-correlator <files...> --window-ms <N>      # args-hash window (default 60000)
+ *
+ * Exit codes:
+ *   0 — success (matches written or none found; either way, exit 0)
+ *   1 — IO error / bad JSONL
+ *   2 — usage error
+ *
+ * Not a runtime tripwire. Output is for operator review.
+ */
+import { appendFileSync, existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { AuditLogReader } from '../audit/reader.js';
+import { correlate, } from '../audit/correlation.js';
+export function parseArgs(argv) {
+    const args = argv.slice();
+    const sources = [];
+    let out;
+    let threshold = 0.9;
+    let argsHashWindowMs = 60_000;
+    let similarityWindowMs = 600_000;
+    let similarityMinCalls = 5;
+    while (args.length > 0) {
+        const a = args.shift();
+        /* c8 ignore next */
+        if (a === undefined)
+            break;
+        if (a === '--out') {
+            out = args.shift();
+            if (out === undefined)
+                return null;
+        }
+        else if (a === '--threshold') {
+            const v = args.shift();
+            if (v === undefined)
+                return null;
+            const n = Number(v);
+            if (!Number.isFinite(n) || n < 0 || n > 1)
+                return null;
+            threshold = n;
+        }
+        else if (a === '--window-ms') {
+            const v = args.shift();
+            if (v === undefined)
+                return null;
+            const n = Number(v);
+            if (!Number.isFinite(n) || n <= 0)
+                return null;
+            argsHashWindowMs = n;
+        }
+        else if (a === '--similarity-window-ms') {
+            const v = args.shift();
+            if (v === undefined)
+                return null;
+            const n = Number(v);
+            if (!Number.isFinite(n) || n <= 0)
+                return null;
+            similarityWindowMs = n;
+        }
+        else if (a === '--similarity-min-calls') {
+            const v = args.shift();
+            if (v === undefined)
+                return null;
+            const n = Number(v);
+            if (!Number.isFinite(n) || n < 1)
+                return null;
+            similarityMinCalls = n;
+        }
+        else if (a.startsWith('--')) {
+            return null;
+        }
+        else {
+            // Positional: path:surface
+            const idx = a.lastIndexOf(':');
+            if (idx <= 0 || idx === a.length - 1)
+                return null;
+            const path = a.slice(0, idx);
+            const surface = a.slice(idx + 1);
+            sources.push({ path, surface });
+        }
+    }
+    if (sources.length < 2)
+        return null;
+    return {
+        sources,
+        out,
+        threshold,
+        argsHashWindowMs,
+        similarityWindowMs,
+        similarityMinCalls,
+    };
+}
+export function defaultCorrelationsPath() {
+    return process.env.FLOWDOT_CORRELATIONS_PATH ?? join(homedir(), '.flowdot', 'audit', 'correlations.jsonl');
+}
+async function loadSource(path, surface) {
+    const reader = await AuditLogReader.open(path);
+    try {
+        const records = [];
+        for await (const r of reader.records())
+            records.push(r);
+        return { surface, records };
+    }
+    finally {
+        await reader.close();
+    }
+}
+export async function runCorrelator(args) {
+    for (const s of args.sources) {
+        if (!existsSync(s.path)) {
+            return {
+                exitCode: 1,
+                message: `audit file not found: ${s.path}`,
+                matches: [],
+                outPath: undefined,
+            };
+        }
+    }
+    // Load all sources.
+    let sources;
+    try {
+        sources = await Promise.all(args.sources.map((s) => loadSource(s.path, s.surface)));
+    }
+    catch (err) {
+        return {
+            exitCode: 1,
+            /* c8 ignore next */
+            message: `failed to read audit file: ${err instanceof Error ? err.message : String(err)}`,
+            matches: [],
+            outPath: undefined,
+        };
+    }
+    const opts = {
+        argsHashWindowMs: args.argsHashWindowMs,
+        similarityThreshold: args.threshold,
+        similarityWindowMs: args.similarityWindowMs,
+        similarityMinCalls: args.similarityMinCalls,
+    };
+    const matches = correlate(sources, opts);
+    const outPath = args.out ?? defaultCorrelationsPath();
+    const outDir = dirname(outPath);
+    if (!existsSync(outDir)) {
+        mkdirSync(outDir, { recursive: true, mode: 0o700 });
+    }
+    // Append each match as one JSONL row with `ts` stamped at write time.
+    if (matches.length > 0) {
+        const lines = matches.map((m) => JSON.stringify({ ts: new Date().toISOString(), ...m }) + '\n').join('');
+        // Create the file with 0o600 if it doesn't exist; otherwise append.
+        if (!existsSync(outPath)) {
+            writeFileSync(outPath, lines, { mode: 0o600 });
+        }
+        else {
+            appendFileSync(outPath, lines);
+        }
+    }
+    return {
+        exitCode: 0,
+        message: matches.length === 0
+            ? `no cross-surface matches across ${sources.length} sources`
+            : `wrote ${matches.length} match(es) to ${outPath}`,
+        matches,
+        outPath: matches.length === 0 ? undefined : outPath,
+    };
+}
+const USAGE = `Usage:
+  guardian-correlator <file1>:<surface1> <file2>:<surface2> [...]
+  guardian-correlator <files...> [--out <correlations.jsonl>]
+  guardian-correlator <files...> [--threshold <0..1>]              # cosine threshold (default 0.9)
+  guardian-correlator <files...> [--window-ms <N>]                 # args-hash window (default 60000)
+  guardian-correlator <files...> [--similarity-window-ms <N>]      # session-start window (default 600000)
+  guardian-correlator <files...> [--similarity-min-calls <N>]      # min calls per session (default 5)
+
+Exit codes:
+  0 — success (matches written or none found)
+  1 — IO error / bad JSONL
+  2 — usage error
+`;
+/* c8 ignore start */
+async function main() {
+    const parsed = parseArgs(process.argv.slice(2));
+    if (!parsed) {
+        process.stderr.write(USAGE);
+        process.exit(2);
+    }
+    const result = await runCorrelator(parsed);
+    process.stdout.write(result.message + '\n');
+    if (result.exitCode !== 0) {
+        process.stderr.write(result.message + '\n');
+    }
+    process.exit(result.exitCode);
+}
+/* c8 ignore stop */
+const isMain = typeof process !== 'undefined' &&
+    typeof process.argv !== 'undefined' &&
+    process.argv[1] !== undefined &&
+    /guardian-correlator(\.js|\.ts)?$/.test(process.argv[1]);
+/* c8 ignore start */
+if (isMain) {
+    void main();
+}
+/* c8 ignore stop */
+//# sourceMappingURL=guardian-correlator.js.map

package/dist/cli/guardian-correlator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardian-correlator.js","sourceRoot":"","sources":["../../src/cli/guardian-correlator.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EACL,SAAS,GAIV,MAAM,yBAAyB,CAAC;AAYjC,MAAM,UAAU,SAAS,CAAC,IAAuB;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAwC,EAAE,CAAC;IACxD,IAAI,GAAuB,CAAC;IAC5B,IAAI,SAAS,GAAG,GAAG,CAAC;IACpB,IAAI,gBAAgB,GAAG,MAAM,CAAC;IAC9B,IAAI,kBAAkB,GAAG,OAAO,CAAC;IACjC,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAE3B,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACvB,oBAAoB;QACpB,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM;QAC3B,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;YAClB,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YACnB,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;QACrC,CAAC;aAAM,IAAI,CAAC,KAAK,aAAa,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACjC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvD,SAAS,GAAG,CAAC,CAAC;QAChB,CAAC;aAAM,IAAI,CAAC,KAAK,aAAa,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACjC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/C,gBAAgB,GAAG,CAAC,CAAC;QACvB,CAAC;aAAM,IAAI,CAAC,KAAK,wBAAwB,EAAE,CAAC;YAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACjC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/C,kBAAkB,GAAG,CAAC,CAAC;QACzB,CAAC;aAAM,IAAI,CAAC,KAAK,wBAAwB,EAAE,CAAC;YAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACjC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9C,kBAAkB,GAAG,CAAC,CAAC;QACzB,CAAC;aAAM,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;aAAM,CAAC;YACN,2BAA2B;YAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClD,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO;QACL,OAAO;QACP,GAAG;QACH,SAAS;QACT,gBAAgB;QAChB,kBAAkB;QAClB,kBAAkB;KACnB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,OAAO,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,oBAAoB,CAAC,CAAC;AAC7G,CAAC;AASD,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,OAAe;IACrD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC;QACnB,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAoB;IACtD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO;gBACL,QAAQ,EAAE,CAAC;gBACX,OAAO,EAAE,yBAAyB,CAAC,CAAC,IAAI,EAAE;gBAC1C,OAAO,EAAE,EAAE;gBACX,OAAO,EAAE,SAAS;aACnB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,oBAAoB;IACpB,IAAI,OAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,oBAAoB;YACpB,OAAO,EAAE,8BAA8B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YACzF,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,SAAS;SACnB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAuB;QAC/B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,mBAAmB,EAAE,IAAI,CAAC,SAAS;QACnC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;KAC5C,CAAC;IACF,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAEzC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,uBAAuB,EAAE,CAAC;IACtD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,sEAAsE;IACtE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzG,oEAAoE;QACpE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,OAAO,EACL,OAAO,CAAC,MAAM,KAAK,CAAC;YAClB,CAAC,CAAC,mCAAmC,OAAO,CAAC,MAAM,UAAU;YAC7D,CAAC,CAAC,SAAS,OAAO,CAAC,MAAM,iBAAiB,OAAO,EAAE;QACvD,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;KACpD,CAAC;AACJ,CAAC;AAED,MAAM,KAAK,GAAG;;;;;;;;;;;;CAYb,CAAC;AAEF,qBAAqB;AACrB,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC;AACD,oBAAoB;AAEpB,MAAM,MAAM,GACV,OAAO,OAAO,KAAK,WAAW;IAC9B,OAAO,OAAO,CAAC,IAAI,KAAK,WAAW;IACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;IAC7B,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3D,qBAAqB;AACrB,IAAI,MAAM,EAAE,CAAC;IACX,KAAK,IAAI,EAAE,CAAC;AACd,CAAC;AACD,oBAAoB"}

package/dist/cli/guardian-verify.d.ts

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+/**
+ * guardian-verify — log integrity verification CLI. SPEC §2.5, §2.6.
+ *
+ * Usage:
+ *   guardian-verify <audit.jsonl>                    # verify hash chain
+ *   guardian-verify <audit.jsonl> --pubkey <pem>     # verify hash chain + signatures
+ *
+ * Exit codes:
+ *   0 — all verifications passed
+ *   1 — hash chain broken / signature invalid / IO error
+ *   2 — usage error (bad args)
+ */
+export interface VerifyResult {
+    recordCount: number;
+    chainVerified: boolean;
+    signaturesVerified: boolean;
+    exitCode: 0 | 1 | 2;
+    message: string;
+}
+export interface VerifyArgs {
+    path: string | undefined;
+    pubkeyPath: string | undefined;
+}
+/** Parse argv. Returns the parsed args or null on usage error. */
+export declare function parseArgs(argv: readonly string[]): VerifyArgs | null;
+/** Run a verification given parsed args. */
+export declare function runVerify(args: VerifyArgs): Promise<VerifyResult>;
+export declare function usageString(): string;
+//# sourceMappingURL=guardian-verify.d.ts.map

package/dist/cli/guardian-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardian-verify.d.ts","sourceRoot":"","sources":["../../src/cli/guardian-verify.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;GAWG;AAQH,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,OAAO,CAAC;IACvB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,kEAAkE;AAClE,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CAwBpE;AAED,4CAA4C;AAC5C,wBAAsB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CA4DvE;AAED,wBAAgB,WAAW,IAAI,MAAM,CAWpC"}

package/dist/cli/guardian-verify.js

@@ -0,0 +1,149 @@
+#!/usr/bin/env node
+/**
+ * guardian-verify — log integrity verification CLI. SPEC §2.5, §2.6.
+ *
+ * Usage:
+ *   guardian-verify <audit.jsonl>                    # verify hash chain
+ *   guardian-verify <audit.jsonl> --pubkey <pem>     # verify hash chain + signatures
+ *
+ * Exit codes:
+ *   0 — all verifications passed
+ *   1 — hash chain broken / signature invalid / IO error
+ *   2 — usage error (bad args)
+ */
+import { readFileSync } from 'node:fs';
+import { AuditLogReader } from '../audit/reader.js';
+import { loadPublicKey } from '../audit/signature.js';
+import { GuardianIntegrityError } from '../errors.js';
+/** Parse argv. Returns the parsed args or null on usage error. */
+export function parseArgs(argv) {
+    const args = argv.slice();
+    let path;
+    let pubkeyPath;
+    while (args.length > 0) {
+        const a = args.shift();
+        /* c8 ignore next */
+        if (a === undefined)
+            break;
+        if (a === '--pubkey') {
+            const next = args.shift();
+            if (next === undefined)
+                return null;
+            pubkeyPath = next;
+        }
+        else if (a === '--help' || a === '-h') {
+            return { path: undefined, pubkeyPath: undefined };
+        }
+        else if (a.startsWith('--')) {
+            return null;
+        }
+        else {
+            if (path !== undefined)
+                return null; // only one positional accepted
+            path = a;
+        }
+    }
+    return { path, pubkeyPath };
+}
+/** Run a verification given parsed args. */
+export async function runVerify(args) {
+    if (!args.path) {
+        return {
+            recordCount: 0,
+            chainVerified: false,
+            signaturesVerified: false,
+            exitCode: 2,
+            message: usageString(),
+        };
+    }
+    const reader = await AuditLogReader.open(args.path);
+    try {
+        let chainCount = 0;
+        try {
+            chainCount = await reader.verifyChain();
+        }
+        catch (err) {
+            /* c8 ignore next */
+            const msg = err instanceof GuardianIntegrityError ? err.message : String(err);
+            return {
+                recordCount: 0,
+                chainVerified: false,
+                signaturesVerified: false,
+                exitCode: 1,
+                message: `chain verification failed: ${msg}`,
+            };
+        }
+        let signaturesVerified = false;
+        if (args.pubkeyPath) {
+            const pem = readFileSync(args.pubkeyPath, 'utf-8');
+            const pubkey = loadPublicKey(pem);
+            try {
+                await reader.verifySignatures(pubkey);
+                signaturesVerified = true;
+            }
+            catch (err) {
+                /* c8 ignore next */
+                const msg = err instanceof GuardianIntegrityError ? err.message : String(err);
+                return {
+                    recordCount: chainCount,
+                    chainVerified: true,
+                    signaturesVerified: false,
+                    exitCode: 1,
+                    message: `signature verification failed: ${msg}`,
+                };
+            }
+        }
+        const parts = [`chain ok (${chainCount} records)`];
+        if (signaturesVerified)
+            parts.push('signatures ok');
+        return {
+            recordCount: chainCount,
+            chainVerified: true,
+            signaturesVerified,
+            exitCode: 0,
+            message: parts.join('; '),
+        };
+    }
+    finally {
+        await reader.close();
+    }
+}
+export function usageString() {
+    return [
+        'guardian-verify — verify guardian-agent audit log integrity',
+        '',
+        'Usage:',
+        '  guardian-verify <audit.jsonl> [--pubkey <pem>]',
+        '',
+        'Options:',
+        '  --pubkey <pem>   Path to an ed25519 public key (PEM). When supplied, signatures are verified.',
+        '  --help, -h       Show this message.',
+    ].join('\n');
+}
+/* c8 ignore start */
+async function main() {
+    const parsed = parseArgs(process.argv.slice(2));
+    if (parsed === null) {
+        process.stderr.write(usageString() + '\n');
+        process.exit(2);
+    }
+    const result = await runVerify(parsed);
+    if (result.exitCode === 0) {
+        process.stdout.write(result.message + '\n');
+    }
+    else {
+        process.stderr.write(result.message + '\n');
+    }
+    process.exit(result.exitCode);
+}
+/* c8 ignore stop */
+const isMain = typeof process !== 'undefined' &&
+    typeof process.argv !== 'undefined' &&
+    process.argv[1] !== undefined &&
+    /guardian-verify(\.js|\.ts)?$/.test(process.argv[1]);
+/* c8 ignore start */
+if (isMain) {
+    void main();
+}
+/* c8 ignore stop */
+//# sourceMappingURL=guardian-verify.js.map

package/dist/cli/guardian-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardian-verify.js","sourceRoot":"","sources":["../../src/cli/guardian-verify.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAetD,kEAAkE;AAClE,MAAM,UAAU,SAAS,CAAC,IAAuB;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;IAC1B,IAAI,IAAwB,CAAC;IAC7B,IAAI,UAA8B,CAAC;IAEnC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACvB,oBAAoB;QACpB,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM;QAC3B,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1B,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACpC,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;aAAM,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;QACpD,CAAC;aAAM,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;aAAM,CAAC;YACN,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC,CAAC,+BAA+B;YACpE,IAAI,GAAG,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9B,CAAC;AAED,4CAA4C;AAC5C,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAgB;IAC9C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO;YACL,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,KAAK;YACpB,kBAAkB,EAAE,KAAK;YACzB,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,WAAW,EAAE;SACvB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oBAAoB;YACpB,MAAM,GAAG,GAAG,GAAG,YAAY,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9E,OAAO;gBACL,WAAW,EAAE,CAAC;gBACd,aAAa,EAAE,KAAK;gBACpB,kBAAkB,EAAE,KAAK;gBACzB,QAAQ,EAAE,CAAC;gBACX,OAAO,EAAE,8BAA8B,GAAG,EAAE;aAC7C,CAAC;QACJ,CAAC;QAED,IAAI,kBAAkB,GAAG,KAAK,CAAC;QAC/B,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBACtC,kBAAkB,GAAG,IAAI,CAAC;YAC5B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,oBAAoB;gBACtB,MAAM,GAAG,GAAG,GAAG,YAAY,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC5E,OAAO;oBACL,WAAW,EAAE,UAAU;oBACvB,aAAa,EAAE,IAAI;oBACnB,kBAAkB,EAAE,KAAK;oBACzB,QAAQ,EAAE,CAAC;oBACX,OAAO,EAAE,kCAAkC,GAAG,EAAE;iBACjD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,CAAC,aAAa,UAAU,WAAW,CAAC,CAAC;QACnD,IAAI,kBAAkB;YAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACpD,OAAO;YACL,WAAW,EAAE,UAAU;YACvB,aAAa,EAAE,IAAI;YACnB,kBAAkB;YAClB,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;SAC1B,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO;QACL,6DAA6D;QAC7D,EAAE;QACF,QAAQ;QACR,kDAAkD;QAClD,EAAE;QACF,UAAU;QACV,iGAAiG;QACjG,uCAAuC;KACxC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,qBAAqB;AACrB,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC9C,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC;AACD,oBAAoB;AAEpB,MAAM,MAAM,GACV,OAAO,OAAO,KAAK,WAAW;IAC9B,OAAO,OAAO,CAAC,IAAI,KAAK,WAAW;IACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;IAC7B,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACvD,qBAAqB;AACrB,IAAI,MAAM,EAAE,CAAC;IACX,KAAK,IAAI,EAAE,CAAC;AACd,CAAC;AACD,oBAAoB"}

package/dist/errors.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Public error types.
+ */
+/**
+ * Thrown inside a tool wrapper when the runtime is halted.
+ * SPEC §5.2.
+ */
+export declare class GuardianHaltedError extends Error {
+    readonly reason: string | undefined;
+    readonly operatorId: string | undefined;
+    constructor(message: string, reason?: string, operatorId?: string);
+}
+/**
+ * Thrown for invalid configuration: malformed policy YAML, missing required
+ * options, contradictory rules, etc.
+ */
+export declare class GuardianConfigError extends Error {
+    constructor(message: string);
+}
+/**
+ * Thrown when integrity verification fails: a broken audit-log hash chain,
+ * a failed HMAC on a policy file, or a bad ed25519 signature.
+ */
+export declare class GuardianIntegrityError extends Error {
+    readonly detail: string | undefined;
+    constructor(message: string, detail?: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;gBAE5B,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;CAMlE;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;gBAExB,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;CAK7C"}

package/dist/errors.js

@@ -0,0 +1,40 @@
+/**
+ * Public error types.
+ */
+/**
+ * Thrown inside a tool wrapper when the runtime is halted.
+ * SPEC §5.2.
+ */
+export class GuardianHaltedError extends Error {
+    reason;
+    operatorId;
+    constructor(message, reason, operatorId) {
+        super(message);
+        this.name = 'GuardianHaltedError';
+        this.reason = reason;
+        this.operatorId = operatorId;
+    }
+}
+/**
+ * Thrown for invalid configuration: malformed policy YAML, missing required
+ * options, contradictory rules, etc.
+ */
+export class GuardianConfigError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'GuardianConfigError';
+    }
+}
+/**
+ * Thrown when integrity verification fails: a broken audit-log hash chain,
+ * a failed HMAC on a policy file, or a bad ed25519 signature.
+ */
+export class GuardianIntegrityError extends Error {
+    detail;
+    constructor(message, detail) {
+        super(message);
+        this.name = 'GuardianIntegrityError';
+        this.detail = detail;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,MAAM,CAAqB;IAC3B,UAAU,CAAqB;IAExC,YAAY,OAAe,EAAE,MAAe,EAAE,UAAmB;QAC/D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,MAAM,CAAqB;IAEpC,YAAY,OAAe,EAAE,MAAe;QAC1C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF"}

package/dist/estop/heartbeat.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Dead-man's-switch heartbeat. SPEC §6 (v0.4.0+).
+ *
+ * For long-running surfaces (CLI daemon, MCP server's persistent session,
+ * Native main loop) the agent (or its harness) must call
+ * `monitor.heartbeat()` every N seconds. If no heartbeat arrives within
+ * `softMs`, an `x_heartbeat_warning` audit row is written (no behavior
+ * change). If still no heartbeat by `hardMs`, the configured `EStopLocal`
+ * is pressed with `reason: 'heartbeat_missed'`.
+ *
+ * Pure mechanism: setInterval + timestamp arithmetic. The supervisor does
+ * not decide whether the agent should be alive — only whether it is
+ * claiming to be.
+ *
+ * OPT-IN PER SURFACE. Default OFF. A surface that hasn't wired
+ * `heartbeat()` calls into its main loop must not enable this — that's a
+ * day-1 false E-stop.
+ */
+import type { AuditLogWriter } from '../audit/writer.js';
+import type { EStopLocal } from './local.js';
+export interface HeartbeatMonitorOptions {
+    /** Audit log writer for `x_heartbeat_warning` rows. Optional. */
+    audit?: AuditLogWriter;
+    /**
+     * EStopLocal to press on hard miss. When omitted, hard-miss behavior is
+     * audit-only (mostly useful for testing the monitor itself).
+     */
+    estop?: EStopLocal;
+    /**
+     * Soft window in ms. After this many ms with no heartbeat, write
+     * `x_heartbeat_warning`. Must be < hardMs.
+     */
+    softMs: number;
+    /**
+     * Hard window in ms. After this many ms with no heartbeat, press the
+     * EStop with `reason: 'heartbeat_missed'`.
+     */
+    hardMs: number;
+    /**
+     * How often to check (ms). Default = min(softMs, hardMs) / 4, clamped
+     * to [50, 5000]. Smaller = tighter response; larger = lower CPU cost.
+     */
+    checkIntervalMs?: number;
+    /** Time source override (testing). */
+    now?: () => number;
+    /**
+     * setInterval override (testing). Must return a token that
+     * `clearIntervalFn` accepts.
+     */
+    setIntervalFn?: (cb: () => void, ms: number) => unknown;
+    /** clearInterval override (testing). */
+    clearIntervalFn?: (handle: unknown) => void;
+}
+/**
+ * State machine: idle → softMissed → hardMissed. Each transition writes
+ * an audit row (warning for softMissed, estop_press for hardMissed). The
+ * monitor stops checking once hardMissed fires; restart by constructing a
+ * new monitor (a new session).
+ */
+export declare class HeartbeatMonitor {
+    private readonly audit;
+    private readonly estop;
+    private readonly softMs;
+    private readonly hardMs;
+    private readonly checkIntervalMs;
+    private readonly now;
+    private readonly setIntervalFn;
+    private readonly clearIntervalFn;
+    private lastBeat;
+    private state;
+    private interval;
+    private stopped;
+    constructor(options: HeartbeatMonitorOptions);
+    /** Start the watchdog. Idempotent. */
+    start(): void;
+    /** Stop the watchdog. Idempotent. Call from supervisor close(). */
+    stop(): void;
+    /**
+     * Record a heartbeat. Resets the state machine to `idle` if a soft
+     * warning had fired but no hard miss yet.
+     */
+    heartbeat(): void;
+    /** Current state (for tests + introspection). */
+    getState(): {
+        state: 'idle' | 'softMissed' | 'hardMissed';
+        lastBeatMs: number;
+    };
+    /**
+     * Public tick. Called automatically by the interval; exposed so tests can
+     * drive deterministically without real timers.
+     */
+    tick(): Promise<void>;
+}
+//# sourceMappingURL=heartbeat.d.ts.map

package/dist/estop/heartbeat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"heartbeat.d.ts","sourceRoot":"","sources":["../../src/estop/heartbeat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,WAAW,uBAAuB;IACtC,iEAAiE;IACjE,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB;;;OAGG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sCAAsC;IACtC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;OAGG;IACH,aAAa,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC;IACxD,wCAAwC;IACxC,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;CAC7C;AAED;;;;;GAKG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;IACnD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyB;IAC/C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0C;IACxE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAE5D,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,KAAK,CAAgD;IAC7D,OAAO,CAAC,QAAQ,CAAiB;IACjC,OAAO,CAAC,OAAO,CAAS;gBAEZ,OAAO,EAAE,uBAAuB;IAmB5C,sCAAsC;IACtC,KAAK,IAAI,IAAI;IAQb,mEAAmE;IACnE,IAAI,IAAI,IAAI;IAQZ;;;OAGG;IACH,SAAS,IAAI,IAAI;IASjB,iDAAiD;IACjD,QAAQ,IAAI;QAAE,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,YAAY,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE;IAI/E;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAuC5B"}