@mcp-audit-gateway/core 0.1.0 → 0.4.0

package/.github/workflows/ci.yml

@@ -0,0 +1,37 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [20, 22]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+      - run: npm ci
+      - run: npm run build
+      - run: npm test
+
+  vectors:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: npm ci
+      - run: node test/vectors/verify-checkpoint.mjs
+      - run: python3 test/vectors/verify-checkpoint.py
+      - run: node test/vectors/aps-action-ref-v1.mjs

package/.well-known/agent-governance.json

@@ -0,0 +1,47 @@
+{
+  "$schema": "https://ossf.github.io/security-insights/governance-declaration/v0.1",
+  "version": "0.1.0",
+  "framework": "mcp-audit-gateway",
+  "attestation": {
+    "predicate_type": "https://in-toto.io/attestation/ai-agent-action/v0.1",
+    "signing_algorithm": "ed25519",
+    "chain_algorithm": "sha256",
+    "tamper_evidence": "hash-chain",
+    "parties": [
+      {
+        "role": "witness",
+        "entity": "gateway",
+        "scope": [
+          "tool", "arguments", "result", "timing",
+          "principal", "namespace", "upstream",
+          "previousHash", "recordId", "method", "success"
+        ]
+      },
+      {
+        "role": "asserter",
+        "entity": "policy-engine",
+        "scope": ["decisionContextDigest"]
+      }
+    ]
+  },
+  "policy": {
+    "engine": "opa",
+    "bundle_digest_algorithm": "sha256",
+    "evaluation_record": true,
+    "human_approval_required": false
+  },
+  "observability": {
+    "otel_semconv": "mcp/v1.44.0",
+    "metrics": [
+      "mcp.client.operation.duration",
+      "mcp.server.operation.duration"
+    ],
+    "traces": true,
+    "context_propagation": "w3c-traceparent"
+  },
+  "verification": {
+    "conformance_vectors": "https://github.com/elang2/mcp-audit-gateway/tree/main/test/vectors",
+    "cross_language": ["javascript", "python"],
+    "vector_count": 17
+  }
+}

package/.well-known/security-insights-snippet.yml

@@ -0,0 +1,9 @@
+# Example security-insights.yml snippet demonstrating SIEP-171 integration
+# This shows how governance-declaration works with a machine-readable target
+
+repository:
+  url: https://github.com/elang2/mcp-audit-gateway
+  status: active
+  agent-assisted-production:
+    used: true
+    governance-declaration: https://github.com/elang2/mcp-audit-gateway/blob/main/.well-known/agent-governance.json

package/CHANGELOG.md

@@ -0,0 +1,32 @@
+# Changelog
+
+## [0.2.0] - 2026-08-22
+
+### Added
+
+- Multi-party attribution: each audit record now declares which entity (gateway, policy-engine) witnessed or asserted which fields via the `parties` array
+- `decisionContextDigest` field: SHA-256 digest of the policy evaluation context, linking audit records to specific policy decisions
+- Conformance test vectors: 17 vectors covering canonicalization (8), hash chain (3), and party attribution (6)
+- Cross-language verifiers: JavaScript (`test/vectors/verify.mjs`) and Python (`test/vectors/verify.py`) both pass all 17 vectors byte-identical
+- `.well-known/agent-governance.json`: machine-readable governance declaration implementing the OpenSSF SIEP-171 pattern
+- Edge-case vectors for party attribution: empty array vs null, scope ordering significance, chain continuity with parties
+
+### Changed
+
+- Canonical form now conditionally includes `decisionContextDigest` at position 10 and `parties` at the end when present
+- Backward-compatible: records without these fields produce identical canonical hashes to v0.1.0
+
+## [0.1.0] - 2026-08-16
+
+### Added
+
+- Initial release
+- Transparent MCP proxy with `mcp-audit wrap` CLI
+- HMAC-SHA256 and Ed25519 attestation signing
+- SHA-256 hash-chained audit log (JSONL)
+- Full gateway mode with multi-upstream routing and tool namespacing
+- OPA-style policy engine with glob-based ACLs and per-principal rate limits
+- OpenTelemetry traces and metrics export
+- Chain verification CLI (`mcp-audit verify`)
+- Live tail CLI (`mcp-audit tail`)
+- Key generation CLI (`mcp-audit keygen`)

package/README.md

@@ -137,18 +137,46 @@ See [gateway configuration](gateway.config.example.json) for the full schema.
 ## Install
 
 ```bash
-npm install -g @mcp-gateway/audit
+npm install -g @mcp-audit-gateway/core
 ```
 
 This installs the `mcp-audit` CLI globally. Or use without installing:
 ```bash
-npx @mcp-gateway/audit wrap -- <your mcp server command>
+npx @mcp-audit-gateway/core wrap -- <your mcp server command>
 ```
 
+## Attestation layer
+
+The signing and verification subsystem goes beyond per-record HMAC. It provides tamper-evidence across log rotation, crash recovery, and multi-file chains.
+
+Checkpoint records let a consumer detect tail truncation by stashing a single hash externally. The chain carries forward across file rotations (no silent resets). Forced restarts emit signed `chain_break` records instead of quietly starting fresh.
+
+The canonical form is type-tagged and injective, avoids JCS's float-formatting problem by rejecting unsafe numbers entirely, and has proven cross-language parity via 46 conformance vectors (JS + Python). See [SECURITY-DESIGN.md](docs/SECURITY-DESIGN.md) for the full specification and threat model.
+
+## Conformance
+
+This implementation satisfies the following properties (verified by cross-language conformance vectors and unit tests):
+
+- Injective canonical form (no cross-type digest collisions)
+- Cross-language sort equivalence (UTF-16 code-unit order)
+- Unpaired surrogate rejection
+- Hash chain continuity across log rotation
+- Planted state detection on startup
+- No false-positive after legitimate chain break
+- Fail-closed on corrupt or oversized input
+- Segmented monotonicity at chain_break boundaries
+- Consumer-anchored completeness via checkpoint records
+- Memory-bounded init (1MB cap)
+
+APS action-ref-v1 conformance: 51/51 vectors passing (JCS recomputation + fail-closed digest comparison).
+
 ## Testing
 
 ```bash
-npm test   # 96 tests across 12 test files
+npm test                                    # 149 unit tests
+node test/vectors/verify-checkpoint.mjs     # 46 JS conformance vectors
+python3 test/vectors/verify-checkpoint.py   # 46 Python conformance vectors
+node test/vectors/aps-action-ref-v1.mjs     # 51 APS vectors
 ```
 
 ## License

package/dist/attestation/audit-log.d.ts

@@ -1,6 +1,12 @@
-import type { AuditRecord } from "../types.js";
+import type { AuditRecord, CheckpointRecord, ChainBreakRecord } from "../types.js";
 import type { Signer } from "./signer.js";
-export declare function hashRecord(record: AuditRecord): string;
+export declare function hashRecord(record: AuditRecord | CheckpointRecord | ChainBreakRecord): string;
+export interface CheckpointConfig {
+    enabled: boolean;
+    intervalRecords: number;
+    intervalSeconds: number;
+    trigger: "records" | "time" | "whichever_first";
+}
 export declare class AuditLog {
     private path;
     private signer;
@@ -8,7 +14,13 @@ export declare class AuditLog {
     private currentSize;
     private lastHash;
     private writeQueue;
+    private recordsSinceCheckpoint;
+    private lastCheckpointTime;
+    private checkpointSequence;
+    private totalRecordCount;
+    private checkpointConfig;
     constructor(path: string, signer: Signer, rotateAfterBytes: number);
+    enableCheckpoints(config: CheckpointConfig): void;
     record(method: string, opts: {
         toolName?: string;
         namespace?: string;
@@ -17,9 +29,29 @@ export declare class AuditLog {
         durationMs: number;
         success: boolean;
         errorCode?: number;
+        decisionContextDigest?: string;
+        aiInvocation?: {
+            turnId?: string;
+            invocationReason?: string;
+            model?: string;
+        };
     }): Promise<AuditRecord>;
     private writeRecord;
+    private shouldEmitCheckpoint;
+    private writeCheckpoint;
+    emitCheckpoint(): Promise<CheckpointRecord>;
+    getLastHash(): string;
+    getCheckpointSequence(): number;
+    getRecordCount(): number;
     private rotate;
-    init(): Promise<void>;
+    private rotationBoundaryHash;
+    private persistState;
+    private persistChainState;
+    private recoverState;
+    init(opts?: {
+        forceNewChain?: boolean;
+    }): Promise<void>;
+    private emitChainBreak;
+    forceNewChain(reason: string): Promise<ChainBreakRecord>;
 }
 //# sourceMappingURL=audit-log.d.ts.map

package/dist/attestation/audit-log.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../src/attestation/audit-log.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,wBAAgB,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAGtD;AAED,qBAAa,QAAQ;IAMjB,OAAO,CAAC,IAAI;IACZ,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,gBAAgB;IAP1B,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,UAAU,CAAoC;gBAG5C,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,MAAM;IAG5B,MAAM,CACV,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;QACJ,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GACA,OAAO,CAAC,WAAW,CAAC;YAaT,WAAW;YAmCX,MAAM;IAUd,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAmC5B"}
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../src/attestation/audit-log.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAiC,MAAM,aAAa,CAAC;AAElH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA6B1C,wBAAgB,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,MAAM,CAG5F;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,SAAS,GAAG,MAAM,GAAG,iBAAiB,CAAC;CACjD;AAED,qBAAa,QAAQ;IAWjB,OAAO,CAAC,IAAI;IACZ,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,gBAAgB;IAZ1B,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,UAAU,CAAoC;IACtD,OAAO,CAAC,sBAAsB,CAAK;IACnC,OAAO,CAAC,kBAAkB,CAAc;IACxC,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,gBAAgB,CAAiC;gBAG/C,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,MAAM;IAGlC,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI;IAI3C,MAAM,CACV,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;QACJ,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAC/B,YAAY,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC/E,GACA,OAAO,CAAC,WAAW,CAAC;YAaT,WAAW;IA8CzB,OAAO,CAAC,oBAAoB;YAWd,eAAe;IAyBvB,cAAc,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAajD,WAAW,IAAI,MAAM;IAIrB,qBAAqB,IAAI,MAAM;IAI/B,cAAc,IAAI,MAAM;YAIV,MAAM;IAapB,OAAO,CAAC,oBAAoB,CAAqB;YAEnC,YAAY;YAaZ,iBAAiB;YAajB,YAAY;IAsBpB,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;YAqK/C,cAAc;IA+BtB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAY/D"}

package/dist/attestation/audit-log.js

@@ -1,5 +1,31 @@
-import { appendFile, stat, rename, open } from "node:fs/promises";
+import { appendFile, stat, rename, open, writeFile as fsWriteFile } from "node:fs/promises";
 import { createHash, randomUUID } from "node:crypto";
+import { isCheckpoint } from "../types.js";
+const GATEWAY_WITNESSED_FIELDS = [
+    "id", "timestamp", "method", "toolName", "namespace",
+    "upstream", "principal", "durationMs", "success", "errorCode",
+    "previousHash",
+];
+function buildParties(hasDecisionContext, hasAiInvocation) {
+    const parties = [
+        { party: "gateway", role: "witness", scope: GATEWAY_WITNESSED_FIELDS },
+    ];
+    if (hasDecisionContext) {
+        parties.push({
+            party: "policy-engine",
+            role: "asserter",
+            scope: ["decisionContextDigest"],
+        });
+    }
+    if (hasAiInvocation) {
+        parties.push({
+            party: "client",
+            role: "asserter",
+            scope: ["aiInvocation"],
+        });
+    }
+    return parties;
+}
 export function hashRecord(record) {
     const json = JSON.stringify(record);
     return createHash("sha256").update(json).digest("hex");
@@ -11,11 +37,19 @@ export class AuditLog {
     currentSize = 0;
     lastHash = "genesis";
     writeQueue = Promise.resolve();
+    recordsSinceCheckpoint = 0;
+    lastCheckpointTime = Date.now();
+    checkpointSequence = 0;
+    totalRecordCount = 0;
+    checkpointConfig = null;
     constructor(path, signer, rotateAfterBytes) {
         this.path = path;
         this.signer = signer;
         this.rotateAfterBytes = rotateAfterBytes;
     }
+    enableCheckpoints(config) {
+        this.checkpointConfig = config;
+    }
     async record(method, opts) {
         return new Promise((resolve, reject) => {
             this.writeQueue = this.writeQueue.then(async () => {
@@ -30,11 +64,14 @@ export class AuditLog {
         });
     }
     async writeRecord(method, opts) {
+        const { aiInvocation, ...rest } = opts;
         const record = {
             id: randomUUID(),
             timestamp: new Date().toISOString(),
             method,
-            ...opts,
+            ...rest,
+            ...(aiInvocation ? { aiInvocation } : {}),
+            parties: buildParties(opts.decisionContextDigest != null, aiInvocation != null),
             previousHash: this.lastHash,
         };
         record.attestation = await this.signer.sign(record);
@@ -42,54 +79,312 @@ export class AuditLog {
         await appendFile(this.path, line);
         this.currentSize += Buffer.byteLength(line);
         this.lastHash = hashRecord(record);
+        this.totalRecordCount++;
+        this.recordsSinceCheckpoint++;
+        if (this.shouldEmitCheckpoint()) {
+            await this.writeCheckpoint();
+        }
         if (this.currentSize >= this.rotateAfterBytes) {
             await this.rotate();
         }
         return record;
     }
+    shouldEmitCheckpoint() {
+        if (!this.checkpointConfig?.enabled)
+            return false;
+        const { trigger, intervalRecords, intervalSeconds } = this.checkpointConfig;
+        const recordsHit = this.recordsSinceCheckpoint >= intervalRecords;
+        const timeHit = (Date.now() - this.lastCheckpointTime) >= intervalSeconds * 1000;
+        if (trigger === "records")
+            return recordsHit;
+        if (trigger === "time")
+            return timeHit;
+        return recordsHit || timeHit;
+    }
+    async writeCheckpoint() {
+        this.checkpointSequence++;
+        const checkpoint = {
+            id: `ckpt_${randomUUID()}`,
+            type: "checkpoint",
+            timestamp: new Date().toISOString(),
+            sequence: this.checkpointSequence,
+            recordCount: this.totalRecordCount,
+            previousHash: this.lastHash,
+            parties: [{ party: "gateway", role: "witness", scope: ["sequence", "recordCount", "previousHash"] }],
+        };
+        checkpoint.attestation = await this.signer.sign(checkpoint);
+        const line = JSON.stringify(checkpoint) + "\n";
+        await appendFile(this.path, line);
+        this.currentSize += Buffer.byteLength(line);
+        this.lastHash = hashRecord(checkpoint);
+        this.recordsSinceCheckpoint = 0;
+        this.lastCheckpointTime = Date.now();
+        return checkpoint;
+    }
+    async emitCheckpoint() {
+        return new Promise((resolve, reject) => {
+            this.writeQueue = this.writeQueue.then(async () => {
+                try {
+                    const result = await this.writeCheckpoint();
+                    resolve(result);
+                }
+                catch (err) {
+                    reject(err);
+                }
+            });
+        });
+    }
+    getLastHash() {
+        return this.lastHash;
+    }
+    getCheckpointSequence() {
+        return this.checkpointSequence;
+    }
+    getRecordCount() {
+        return this.totalRecordCount;
+    }
     async rotate() {
         const ts = new Date().toISOString().replace(/[:.]/g, "-");
         const rotatedPath = this.path.replace(/\.jsonl$/, `-${ts}.jsonl`);
         try {
             await rename(this.path, rotatedPath);
             this.currentSize = 0;
-            this.lastHash = "genesis";
+            // Chain-global: lastHash, sequence, recordCount survive rotation.
+            // The first record in the new file chains to the last hash of the
+            // previous file. Resetting to "genesis" would allow truncation-via-rotation.
+            await this.persistState();
         }
         catch { }
     }
-    async init() {
+    rotationBoundaryHash = "genesis";
+    async persistState() {
+        const statePath = this.path.replace(/\.jsonl$/, ".state.json");
+        const tmpPath = statePath + ".tmp";
+        const state = {
+            lastHash: this.lastHash,
+            rotationBoundaryHash: this.lastHash,
+            checkpointSequence: this.checkpointSequence,
+            totalRecordCount: this.totalRecordCount,
+        };
+        await fsWriteFile(tmpPath, JSON.stringify(state));
+        await rename(tmpPath, statePath);
+    }
+    async persistChainState() {
+        const statePath = this.path.replace(/\.jsonl$/, ".state.json");
+        const tmpPath = statePath + ".tmp";
+        const state = {
+            lastHash: this.lastHash,
+            rotationBoundaryHash: this.rotationBoundaryHash,
+            checkpointSequence: this.checkpointSequence,
+            totalRecordCount: this.totalRecordCount,
+        };
+        await fsWriteFile(tmpPath, JSON.stringify(state));
+        await rename(tmpPath, statePath);
+    }
+    async recoverState() {
+        const statePath = this.path.replace(/\.jsonl$/, ".state.json");
+        try {
+            const { readFile } = await import("node:fs/promises");
+            const raw = await readFile(statePath, "utf-8");
+            const state = JSON.parse(raw);
+            if (typeof state.lastHash !== "string" || typeof state.checkpointSequence !== "number" ||
+                typeof state.rotationBoundaryHash !== "string") {
+                return "corrupt";
+            }
+            this.lastHash = state.lastHash;
+            this.rotationBoundaryHash = state.rotationBoundaryHash;
+            this.checkpointSequence = state.checkpointSequence ?? 0;
+            this.totalRecordCount = state.totalRecordCount ?? 0;
+            return "found";
+        }
+        catch (err) {
+            const code = err?.code;
+            if (code === "ENOENT")
+                return "not_found";
+            return "corrupt";
+        }
+    }
+    async init(opts) {
+        const stateResult = await this.recoverState();
+        let logExists = false;
         let s;
         try {
             s = await stat(this.path);
+            logExists = true;
         }
         catch {
+            logExists = false;
+        }
+        // Three-way startup:
+        // (a) No state file, no log → genuine first run
+        if (stateResult === "not_found" && !logExists) {
+            this.currentSize = 0;
+            return;
+        }
+        // (c) State file corrupt or exists but unparseable → refuse unless forced
+        if (stateResult === "corrupt") {
+            if (opts?.forceNewChain) {
+                await this.emitChainBreak("state_file_corrupt");
+                return;
+            }
+            throw new Error("[audit-log] state file corrupt or inconsistent. " +
+                "Use --force-new-chain to start a new chain (emits a signed chain_break record).");
+        }
+        // (b) State file present and parseable → base+delta resume
+        if (!logExists) {
             this.currentSize = 0;
             return;
         }
         this.currentSize = s.size;
         if (s.size > 0) {
-            const tailSize = Math.min(s.size, 8192);
+            const boundaryHash = stateResult === "found" ? this.rotationBoundaryHash : undefined;
             const fh = await open(this.path, "r");
             try {
+                let headBuf = Buffer.alloc(0);
+                let offset = 0;
+                const chunkSize = 4096;
+                const maxFirstLine = 1024 * 1024;
+                let firstLine = null;
+                while (offset < s.size) {
+                    if (headBuf.length >= maxFirstLine) {
+                        if (opts?.forceNewChain) {
+                            await this.emitChainBreak("log_first_record_oversize");
+                            return;
+                        }
+                        throw new Error("[audit-log] first record exceeds 1MB cap (no newline found within limit). " +
+                            "Use --force-new-chain to start a new chain.");
+                    }
+                    const readSize = Math.min(chunkSize, s.size - offset);
+                    const chunk = Buffer.alloc(readSize);
+                    await fh.read(chunk, 0, readSize, offset);
+                    headBuf = Buffer.concat([headBuf, chunk]);
+                    const text = headBuf.toString("utf-8");
+                    const nlIdx = text.indexOf("\n");
+                    if (nlIdx !== -1) {
+                        firstLine = text.slice(0, nlIdx);
+                        break;
+                    }
+                    offset += readSize;
+                }
+                if (firstLine === null) {
+                    const text = headBuf.toString("utf-8").trim();
+                    if (text.length === 0) {
+                        if (opts?.forceNewChain) {
+                            await this.emitChainBreak("log_empty_no_newline");
+                            return;
+                        }
+                        throw new Error("[audit-log] log file exists but contains no parseable content. " +
+                            "Use --force-new-chain to start a new chain.");
+                    }
+                    firstLine = text;
+                }
+                // Parse first record — if it doesn't parse, the log is corrupt
+                let firstRecordPrevHash;
+                let firstRecordIsBreak = false;
+                try {
+                    const firstRecord = JSON.parse(firstLine);
+                    if (firstRecord.type === "chain_break") {
+                        firstRecordIsBreak = true;
+                        firstRecordPrevHash = firstRecord.priorHead;
+                    }
+                    else {
+                        firstRecordPrevHash = firstRecord.previousHash;
+                    }
+                }
+                catch {
+                    if (opts?.forceNewChain) {
+                        await this.emitChainBreak("log_first_record_corrupt");
+                        return;
+                    }
+                    throw new Error("[audit-log] first record in log is corrupt (unparseable JSON). " +
+                        "Use --force-new-chain to start a new chain.");
+                }
+                // Read tail: recover chain head and checkpoint state
+                const tailSize = Math.min(s.size, 8192);
                 const buf = Buffer.alloc(tailSize);
                 await fh.read(buf, 0, tailSize, s.size - tailSize);
                 const tail = buf.toString("utf-8");
                 const lines = tail.trimEnd().split("\n");
+                let foundLast = false;
+                let recordCountFromTail = 0;
+                let tailMaxSequence = 0;
                 for (let i = lines.length - 1; i >= 0; i--) {
                     try {
-                        const record = JSON.parse(lines[i]);
-                        this.lastHash = hashRecord(record);
-                        return;
+                        const parsed = JSON.parse(lines[i]);
+                        recordCountFromTail++;
+                        if (!foundLast) {
+                            this.lastHash = hashRecord(parsed);
+                            foundLast = true;
+                        }
+                        if (isCheckpoint(parsed)) {
+                            if (parsed.sequence > tailMaxSequence) {
+                                tailMaxSequence = parsed.sequence;
+                            }
+                        }
                     }
                     catch {
                         process.stderr.write(`[audit-log] warning: corrupt record in tail, skipping\n`);
                     }
                 }
+                if (tailMaxSequence > this.checkpointSequence) {
+                    this.checkpointSequence = tailMaxSequence;
+                }
+                if (boundaryHash !== undefined && firstRecordPrevHash !== undefined &&
+                    firstRecordPrevHash !== boundaryHash) {
+                    if (opts?.forceNewChain) {
+                        await this.emitChainBreak("state_log_inconsistent");
+                        return;
+                    }
+                    throw new Error("[audit-log] state file inconsistent with log: first record does not " +
+                        "chain from rotationBoundaryHash. Use --force-new-chain to start a new chain.");
+                }
+                if (stateResult === "not_found") {
+                    this.totalRecordCount = recordCountFromTail;
+                }
             }
             finally {
                 await fh.close();
             }
         }
     }
+    async emitChainBreak(reason) {
+        const record = {
+            id: `break_${randomUUID()}`,
+            type: "chain_break",
+            timestamp: new Date().toISOString(),
+            reason,
+            priorHead: this.lastHash !== "genesis" ? this.lastHash : undefined,
+            priorSequence: this.checkpointSequence > 0 ? this.checkpointSequence : undefined,
+            priorRecordCount: this.totalRecordCount > 0 ? this.totalRecordCount : undefined,
+        };
+        record.attestation = await this.signer.sign(record);
+        const line = JSON.stringify(record) + "\n";
+        await appendFile(this.path, line);
+        this.currentSize += Buffer.byteLength(line);
+        // Reset chain state — this is a new chain.
+        // rotationBoundaryHash is NOT updated: it tracks the file boundary,
+        // not the chain boundary. The linkage check compares the first record
+        // of a file against rotationBoundaryHash, so mid-file breaks must not
+        // overwrite it.
+        this.lastHash = hashRecord(record);
+        this.checkpointSequence = 0;
+        this.totalRecordCount = 0;
+        this.recordsSinceCheckpoint = 0;
+        await this.persistChainState();
+        return record;
+    }
+    async forceNewChain(reason) {
+        return new Promise((resolve, reject) => {
+            this.writeQueue = this.writeQueue.then(async () => {
+                try {
+                    const result = await this.emitChainBreak(reason);
+                    resolve(result);
+                }
+                catch (err) {
+                    reject(err);
+                }
+            });
+        });
+    }
 }
 //# sourceMappingURL=audit-log.js.map

package/dist/attestation/audit-log.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-log.js","sourceRoot":"","sources":["../../src/attestation/audit-log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIrD,MAAM,UAAU,UAAU,CAAC,MAAmB;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,OAAO,QAAQ;IAMT;IACA;IACA;IAPF,WAAW,GAAG,CAAC,CAAC;IAChB,QAAQ,GAAW,SAAS,CAAC;IAC7B,UAAU,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEtD,YACU,IAAY,EACZ,MAAc,EACd,gBAAwB;QAFxB,SAAI,GAAJ,IAAI,CAAQ;QACZ,WAAM,GAAN,MAAM,CAAQ;QACd,qBAAgB,GAAhB,gBAAgB,CAAQ;IAC/B,CAAC;IAEJ,KAAK,CAAC,MAAM,CACV,MAAc,EACd,IAQC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBAChD,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;oBACpD,OAAO,CAAC,MAAM,CAAC,CAAC;gBAClB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,MAAc,EACd,IAQC;QAED,MAAM,MAAM,GAAgB;YAC1B,EAAE,EAAE,UAAU,EAAE;YAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,MAAM;YACN,GAAG,IAAI;YACP,YAAY,EAAE,IAAI,CAAC,QAAQ;SAC5B,CAAC;QAEF,MAAM,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;QAE3C,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAE5C,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAEnC,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACtB,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YACrC,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;YACrB,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,CAAC;QACN,IAAI,CAAC;YACH,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;QAE1B,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACxC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACnC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,GAAG,QAAQ,CAAC,CAAC;gBACnD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACnC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACzC,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC3C,IAAI,CAAC;wBACH,MAAM,MAAM,GAAgB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;wBACjD,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;wBACnC,OAAO;oBACT,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yDAAyD,CAC1D,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"audit-log.js","sourceRoot":"","sources":["../../src/attestation/audit-log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EAAE,YAAY,EAAgB,MAAM,aAAa,CAAC;AAGzD,MAAM,wBAAwB,GAAG;IAC/B,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW;IACpD,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW;IAC7D,cAAc;CACf,CAAC;AAEF,SAAS,YAAY,CAAC,kBAA2B,EAAE,eAAwB;IACzE,MAAM,OAAO,GAAuB;QAClC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,wBAAwB,EAAE;KACvE,CAAC;IACF,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,eAAe;YACtB,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,CAAC,uBAAuB,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,QAAQ;YACf,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,CAAC,cAAc,CAAC;SACxB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAyD;IAClF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AASD,MAAM,OAAO,QAAQ;IAWT;IACA;IACA;IAZF,WAAW,GAAG,CAAC,CAAC;IAChB,QAAQ,GAAW,SAAS,CAAC;IAC7B,UAAU,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC9C,sBAAsB,GAAG,CAAC,CAAC;IAC3B,kBAAkB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAChC,kBAAkB,GAAG,CAAC,CAAC;IACvB,gBAAgB,GAAG,CAAC,CAAC;IACrB,gBAAgB,GAA4B,IAAI,CAAC;IAEzD,YACU,IAAY,EACZ,MAAc,EACd,gBAAwB;QAFxB,SAAI,GAAJ,IAAI,CAAQ;QACZ,WAAM,GAAN,MAAM,CAAQ;QACd,qBAAgB,GAAhB,gBAAgB,CAAQ;IAC/B,CAAC;IAEJ,iBAAiB,CAAC,MAAwB;QACxC,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,MAAM,CACV,MAAc,EACd,IAUC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBAChD,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;oBACpD,OAAO,CAAC,MAAM,CAAC,CAAC;gBAClB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,MAAc,EACd,IAUC;QAED,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;QACvC,MAAM,MAAM,GAAgB;YAC1B,EAAE,EAAE,UAAU,EAAE;YAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,MAAM;YACN,GAAG,IAAI;YACP,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,qBAAqB,IAAI,IAAI,EAAE,YAAY,IAAI,IAAI,CAAC;YAC/E,YAAY,EAAE,IAAI,CAAC,QAAQ;SAC5B,CAAC;QAEF,MAAM,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;QAE3C,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAE5C,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAE9B,IAAI,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC/B,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACtB,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,oBAAoB;QAC1B,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO;YAAE,OAAO,KAAK,CAAC;QAClD,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,sBAAsB,IAAI,eAAe,CAAC;QAClE,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,eAAe,GAAG,IAAI,CAAC;QAEjF,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC;QAC7C,IAAI,OAAO,KAAK,MAAM;YAAE,OAAO,OAAO,CAAC;QACvC,OAAO,UAAU,IAAI,OAAO,CAAC;IAC/B,CAAC;IAEO,KAAK,CAAC,eAAe;QAC3B,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAqB;YACnC,EAAE,EAAE,QAAQ,UAAU,EAAE,EAAE;YAC1B,IAAI,EAAE,YAAY;YAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,QAAQ,EAAE,IAAI,CAAC,kBAAkB;YACjC,WAAW,EAAE,IAAI,CAAC,gBAAgB;YAClC,YAAY,EAAE,IAAI,CAAC,QAAQ;YAC3B,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC;SACrG,CAAC;QAEF,UAAU,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;QAE/C,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAE5C,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,CAAC,sBAAsB,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAErC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBAChD,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;oBAC5C,OAAO,CAAC,MAAM,CAAC,CAAC;gBAClB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,qBAAqB;QACnB,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YACrC,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;YACrB,kEAAkE;YAClE,kEAAkE;YAClE,6EAA6E;YAC7E,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAEO,oBAAoB,GAAW,SAAS,CAAC;IAEzC,KAAK,CAAC,YAAY;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;QACnC,MAAM,KAAK,GAAG;YACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,oBAAoB,EAAE,IAAI,CAAC,QAAQ;YACnC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;SACxC,CAAC;QACF,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAClD,MAAM,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;QACnC,MAAM,KAAK,GAAG;YACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;SACxC,CAAC;QACF,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAClD,MAAM,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAC/D,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,kBAAkB,KAAK,QAAQ;gBAClF,OAAO,KAAK,CAAC,oBAAoB,KAAK,QAAQ,EAAE,CAAC;gBACnD,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;YAC/B,IAAI,CAAC,oBAAoB,GAAG,KAAK,CAAC,oBAAoB,CAAC;YACvD,IAAI,CAAC,kBAAkB,GAAG,KAAK,CAAC,kBAAkB,IAAI,CAAC,CAAC;YACxD,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,IAAI,CAAC,CAAC;YACpD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;YAClD,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,WAAW,CAAC;YAC1C,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAkC;QAC3C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAE9C,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC,CAAC;QACN,IAAI,CAAC;YACH,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;QAED,qBAAqB;QACrB,gDAAgD;QAChD,IAAI,WAAW,KAAK,WAAW,IAAI,CAAC,SAAS,EAAE,CAAC;YAC9C,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,0EAA0E;QAC1E,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,IAAI,EAAE,aAAa,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,MAAM,IAAI,KAAK,CACb,kDAAkD;gBAClD,iFAAiF,CAClF,CAAC;QACJ,CAAC;QAED,2DAA2D;QAC3D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,CAAE,CAAC,IAAI,CAAC;QAE3B,IAAI,CAAE,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAChB,MAAM,YAAY,GAAG,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC;YACrF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACtC,IAAI,CAAC;gBACH,IAAI,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC9B,IAAI,MAAM,GAAG,CAAC,CAAC;gBACf,MAAM,SAAS,GAAG,IAAI,CAAC;gBACvB,MAAM,YAAY,GAAG,IAAI,GAAG,IAAI,CAAC;gBACjC,IAAI,SAAS,GAAkB,IAAI,CAAC;gBACpC,OAAO,MAAM,GAAG,CAAE,CAAC,IAAI,EAAE,CAAC;oBACxB,IAAI,OAAO,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;wBACnC,IAAI,IAAI,EAAE,aAAa,EAAE,CAAC;4BACxB,MAAM,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,CAAC;4BACvD,OAAO;wBACT,CAAC;wBACD,MAAM,IAAI,KAAK,CACb,4EAA4E;4BAC5E,6CAA6C,CAC9C,CAAC;oBACJ,CAAC;oBACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAE,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC;oBACvD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;oBACrC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;oBAC1C,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;oBAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;oBACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBACjC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;wBACjB,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;wBACjC,MAAM;oBACR,CAAC;oBACD,MAAM,IAAI,QAAQ,CAAC;gBACrB,CAAC;gBACD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;oBACvB,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;oBAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBACtB,IAAI,IAAI,EAAE,aAAa,EAAE,CAAC;4BACxB,MAAM,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;4BAClD,OAAO;wBACT,CAAC;wBACD,MAAM,IAAI,KAAK,CACb,iEAAiE;4BACjE,6CAA6C,CAC9C,CAAC;oBACJ,CAAC;oBACD,SAAS,GAAG,IAAI,CAAC;gBACnB,CAAC;gBAED,+DAA+D;gBAC/D,IAAI,mBAAuC,CAAC;gBAC5C,IAAI,kBAAkB,GAAG,KAAK,CAAC;gBAC/B,IAAI,CAAC;oBACH,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;oBAC1C,IAAI,WAAW,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;wBACvC,kBAAkB,GAAG,IAAI,CAAC;wBAC1B,mBAAmB,GAAG,WAAW,CAAC,SAAS,CAAC;oBAC9C,CAAC;yBAAM,CAAC;wBACN,mBAAmB,GAAG,WAAW,CAAC,YAAY,CAAC;oBACjD,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,IAAI,EAAE,aAAa,EAAE,CAAC;wBACxB,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC,CAAC;wBACtD,OAAO;oBACT,CAAC;oBACD,MAAM,IAAI,KAAK,CACb,iEAAiE;wBACjE,6CAA6C,CAC9C,CAAC;gBACJ,CAAC;gBAED,qDAAqD;gBACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACzC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACnC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAE,CAAC,IAAI,GAAG,QAAQ,CAAC,CAAC;gBACpD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACnC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACzC,IAAI,SAAS,GAAG,KAAK,CAAC;gBACtB,IAAI,mBAAmB,GAAG,CAAC,CAAC;gBAC5B,IAAI,eAAe,GAAG,CAAC,CAAC;gBAExB,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC3C,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;wBACpC,mBAAmB,EAAE,CAAC;wBAEtB,IAAI,CAAC,SAAS,EAAE,CAAC;4BACf,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;4BACnC,SAAS,GAAG,IAAI,CAAC;wBACnB,CAAC;wBAED,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;4BACzB,IAAI,MAAM,CAAC,QAAQ,GAAG,eAAe,EAAE,CAAC;gCACtC,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC;4BACpC,CAAC;wBACH,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yDAAyD,CAC1D,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,IAAI,eAAe,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBAC9C,IAAI,CAAC,kBAAkB,GAAG,eAAe,CAAC;gBAC5C,CAAC;gBAED,IAAI,YAAY,KAAK,SAAS,IAAI,mBAAmB,KAAK,SAAS;oBAC/D,mBAAmB,KAAK,YAAY,EAAE,CAAC;oBACzC,IAAI,IAAI,EAAE,aAAa,EAAE,CAAC;wBACxB,MAAM,IAAI,CAAC,cAAc,CAAC,wBAAwB,CAAC,CAAC;wBACpD,OAAO;oBACT,CAAC;oBACD,MAAM,IAAI,KAAK,CACb,sEAAsE;wBACtE,8EAA8E,CAC/E,CAAC;gBACJ,CAAC;gBAED,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;oBAChC,IAAI,CAAC,gBAAgB,GAAG,mBAAmB,CAAC;gBAC9C,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,MAAc;QACzC,MAAM,MAAM,GAAqB;YAC/B,EAAE,EAAE,SAAS,UAAU,EAAE,EAAE;YAC3B,IAAI,EAAE,aAAa;YACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YAClE,aAAa,EAAE,IAAI,CAAC,kBAAkB,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;YAChF,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;SAChF,CAAC;QAEF,MAAM,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;QAE3C,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAE5C,2CAA2C;QAC3C,oEAAoE;QACpE,sEAAsE;QACtE,sEAAsE;QACtE,gBAAgB;QAChB,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,kBAAkB,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,sBAAsB,GAAG,CAAC,CAAC;QAEhC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAc;QAChC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBAChD,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;oBACjD,OAAO,CAAC,MAAM,CAAC,CAAC;gBAClB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}