@schema-weaver/pg-connector 0.0.0-stage → 2.0.0

package/dist/types/audit/cloud-writer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-writer.d.ts","sourceRoot":"","sources":["../../../src/audit/cloud-writer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAe,SAAS,EAAE,gBAAgB,EAAkB,MAAM,gBAAgB,CAAC;AAG1F,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,wEAAwE;IACxE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,UAAU,GAAG,gBAAgB,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC7D,yDAAyD;IACzD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAID;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAC3C,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,YAAY,CAAK;gBAEb,MAAM,EAAE,iBAAiB;IAKrC,OAAO,CAAC,UAAU;IA0BZ,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAqBxD,qEAAqE;IACrE,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,gFAAgF;IAChF,KAAK,IAAI,gBAAgB,GAAG,IAAI;IAIhC,iEAAiE;IAC3D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAK7B"}

package/dist/types/audit/context.d.ts

@@ -0,0 +1,51 @@
+import type { DbEntry } from '../config/db-config';
+/**
+ * The database identity an audit record is written under.
+ *
+ *  made this a required part of every record: the audit trail used to
+ * carry only the caller-asserted `project`, so a frame that named one database
+ * and executed against another left a record that named a database the
+ * operation never touched, with no field able to name the one it did.
+ *
+ * These two values come from the entry the request actually resolved to, never
+ * from the frame.
+ */
+export interface ResolvedDbIdentity {
+    resolved_db_alias: string;
+    resolved_database: string;
+}
+/**
+ * The fail-closed identity: this request resolved to no database.
+ *
+ * Used when no context is established (an agent-generated record, a refusal, a
+ * record written outside a request) and whenever the values are missing. It is
+ * deliberately an obvious non-name rather than an empty string, so a record can
+ * never be mistaken for one that resolved to a database whose alias happens to
+ * be blank.
+ */
+export declare const UNRESOLVED_DB_ALIAS = "unresolved";
+export declare const UNRESOLVED_DB_IDENTITY: Readonly<ResolvedDbIdentity>;
+/**
+ * Build an identity from a resolved entry, failing closed.
+ *
+ * A missing or blank `db_alias`/`database` yields `'unresolved'` rather than an
+ * empty string, so "we could not tell" is distinguishable from "the database has
+ * no alias" at read time and in a MAC-verified record.
+ */
+export declare function resolvedIdentityOf(entry: DbEntry | null | undefined): ResolvedDbIdentity;
+/**
+ * Run `fn` with every audit record written inside it attributed to `identity`.
+ *
+ * This is the durable half of the  fix: the audit sink stamps the resolved
+ * identity from this context on every record it builds, so no call site can
+ * forget it and no call site can override it with the frame's own claim. The
+ * dispatcher establishes the context at the single point where the resolved
+ * entry is known.
+ */
+export declare function withResolvedDatabase<T>(identity: ResolvedDbIdentity, fn: () => T): T;
+/**
+ * The identity of the request currently in scope, or the fail-closed
+ * `'unresolved'` default when none was established.
+ */
+export declare function currentResolvedDbIdentity(): ResolvedDbIdentity;
+//# sourceMappingURL=context.d.ts.map

package/dist/types/audit/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../src/audit/context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAEhD,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,kBAAkB,CAG9D,CAAC;AAaH;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,kBAAkB,CAOxF;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAEpF;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,IAAI,kBAAkB,CAE9D"}

package/dist/types/audit/files.d.ts

@@ -0,0 +1,111 @@
+import { AuditEvent } from './types';
+export interface AuditLogFilter {
+    project?: string;
+    user?: string;
+    action?: string;
+    decision?: string;
+    outcome?: string;
+    search?: string;
+    since?: string | number;
+    until?: string | number;
+    order?: 'asc' | 'desc';
+    limit?: number;
+}
+/** Whole-log read result, used by chain verification. */
+export interface AuditLogReadResult {
+    /** Log files in chronological order (oldest archive first, active file last). */
+    files: string[];
+    /** Every parsed record, oldest first. */
+    events: AuditEvent[];
+    /** Log files that exist but could not be read. */
+    unreadableFiles: string[];
+    /** Lines that are not parseable JSON — corruption or injected content. */
+    malformedLines: number;
+}
+/**
+ * Mode for the audit **directory**. A directory needs the execute bit to be
+ * traversable; creating one with a regular file's mode (0o600) makes every
+ * stat/open/readdir inside it fail with EACCES, which is how a clean install
+ * ended up with no audit trail at all.
+ */
+export declare const AUDIT_DIR_MODE = 448;
+/** Mode for the audit log files themselves: read/write for the owner only. */
+export declare const AUDIT_FILE_MODE = 384;
+/**
+ * Repairs an audit directory left with a mode that cannot be traversed.
+ *
+ * `fs.mkdir({ recursive: true })` is a no-op on an existing directory, so a
+ * directory created earlier with the wrong mode stays wrong and every later
+ * append keeps failing EACCES. The explicit chmod is what makes an
+ * already-broken install repair itself.
+ *
+ * @returns true when the mode had to be corrected.
+ */
+export declare function repairAuditDirMode(dir: string, mode?: number): Promise<boolean>;
+/**
+ * Ensures the audit directory exists and is traversable, creating it at mode
+ * 0o700 and repairing a pre-existing wrong mode.
+ *
+ * Idempotent and safe to call from setup, startup, append and repair paths:
+ *
+ * ```ts
+ * await ensureAuditDir(path.join(getSwAgentDir(), 'audit'));
+ * ```
+ *
+ * @returns true when the directory had to be created or its mode corrected.
+ */
+export declare function ensureAuditDir(dir: string, opts?: {
+    dirMode?: number;
+}): Promise<boolean>;
+/** Result of {@link probeAuditDir}. */
+export interface AuditDirProbe {
+    ok: boolean;
+    dir: string;
+    dirMode: number;
+    /** True when {@link repairAuditDirMode} had to change the mode. */
+    repaired: boolean;
+    reason?: string;
+}
+/**
+ * Startup gate for the audit path: creates/repairs the directory, then proves a
+ * real write + fsync succeeds. "Audit loss must not be silent" is only
+ * enforceable if startup refuses to claim the log is fine without trying it.
+ */
+export declare function probeAuditDir(dir: string, opts?: {
+    dirMode?: number;
+    fileMode?: number;
+}): Promise<AuditDirProbe>;
+/**
+ * Returns audit log files in strict chronological order:
+ * audit-N.jsonl (oldest archive) -> ... -> audit-1.jsonl (most recent archive) -> audit.jsonl (active file)
+ */
+export declare function getAuditFilesChronological(auditDir: string): Promise<string[]>;
+/**
+ * Returns audit log files in reverse-chronological order:
+ * audit.jsonl (active, newest) -> audit-1.jsonl -> audit-2.jsonl -> ... -> audit-N.jsonl (oldest)
+ */
+export declare function getAuditFilesReverse(auditDir: string): Promise<string[]>;
+/**
+ * Parse relative time string (e.g. "15m", "1h", "24h", "7d", "today") or ISO string into unix timestamp (ms).
+ */
+export declare function parseSince(since?: string | number): number | null;
+/**
+ * Reads every record of the audit log in strict chronological order across all
+ * rotated files, with no limit.
+ *
+ * Chain verification must see the log as one sequence: verifying each rotated
+ * file in isolation reports every file that begins mid-chain as broken, which is
+ * what made routine rotation look like tampering.
+ */
+export declare function readAuditLogChronological(auditDir: string): Promise<AuditLogReadResult>;
+/**
+ * Checks whether an event satisfies the given filter.
+ */
+export declare function eventMatchesFilter(event: AuditEvent, filter: AuditLogFilter, sinceTs?: number | null, untilTs?: number | null, searchLower?: string): boolean;
+/**
+ * Reads audit events matching the filter.
+ * Defaults to descending order (newest first).
+ * Fast backwards reading: stops as soon as `limit` matches are satisfied.
+ */
+export declare function readAuditEvents(auditDir: string, filter?: AuditLogFilter): Promise<AuditEvent[]>;
+//# sourceMappingURL=files.d.ts.map

package/dist/types/audit/files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../../src/audit/files.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,yDAAyD;AACzD,MAAM,WAAW,kBAAkB;IACjC,iFAAiF;IACjF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yCAAyC;IACzC,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,kDAAkD;IAClD,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,0EAA0E;IAC1E,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,MAAQ,CAAC;AAEpC,8EAA8E;AAC9E,eAAO,MAAM,eAAe,MAAQ,CAAC;AAMrC;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,MAAuB,GAC5B,OAAO,CAAC,OAAO,CAAC,CAelB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9B,OAAO,CAAC,OAAO,CAAC,CAWlB;AAED,uCAAuC;AACvC,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACjD,OAAO,CAAC,aAAa,CAAC,CA4CxB;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA4BpF;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAG9E;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CA6BjE;AAMD;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAoC7F;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,cAAc,EACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,EACvB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,EACvB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CA8CT;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,cAAmB,GAC1B,OAAO,CAAC,UAAU,EAAE,CAAC,CAiEvB"}

package/dist/types/audit/index.d.ts

@@ -0,0 +1,9 @@
+export type { AuditAction, AuditDecision, AuditOutcome, AuditActor, AuditRole, AuditPermissionLevel, AuditEvent, AuditHead, AuditFilter, AuditQueryResult, AuditWriterHealth, AuditSinkHealth, } from './types';
+export { computeHash, computeMac, computeEventMac, canonicalStringify, isHash64, loadAuditKey, tryLoadAuditKey, decodeKeyMaterial, deriveChainId, readHead, readHeadFloor, resolveAnchor, writeHead, writeHeadFloor, floorPathFor, headPathFor, makeHead, verifyChain, verifyChainAgainstHead, verifyHashChain, ChainVerifier, AuditKeyError, GENESIS_HASH, AUDIT_KEY_BYTES, AUDIT_KEY_ENV, AUDIT_KEY_FILENAME, AUDIT_HEAD_FILENAME, AUDIT_FLOOR_SUFFIX, type AnchorClaim, type AuditKey, type AuditKeySource, type ChainFailureReason, type ChainVerifyResult, type ChainVerifyOptions, type MacInput, type ResolvedAnchor, type WriteHeadOptions, type LoadAuditKeyOptions, } from './chain';
+export { fingerprintStatement, previewStatement, redactSqlLiterals, isUnredactable, UNREDACTABLE, PREVIEW_MAX_LENGTH, } from './redact';
+export { LocalAuditWriter, verifyAuditLog, verifyStream, ACTIVE_AUDIT_FILE, type LocalWriterOptions, type AppendOptions, type VerifyAuditLogOptions, type VerifyStreamOptions, type AuditLogVerification, } from './local-writer';
+export { CloudAuditWriter, type CloudWriterConfig, type CloudWriterResult } from './cloud-writer';
+export { AuditSink, type AuditSinkOptions, type PendingEvent } from './sink';
+export { UNRESOLVED_DB_ALIAS, UNRESOLVED_DB_IDENTITY, currentResolvedDbIdentity, resolvedIdentityOf, withResolvedDatabase, type ResolvedDbIdentity, } from './context';
+export { getAuditFilesChronological, getAuditFilesReverse, readAuditLogChronological, ensureAuditDir, probeAuditDir, repairAuditDirMode, AUDIT_DIR_MODE, AUDIT_FILE_MODE, parseSince, eventMatchesFilter, readAuditEvents, type AuditLogFilter, type AuditLogReadResult, type AuditDirProbe, } from './files';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/audit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/audit/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,WAAW,EACX,aAAa,EACb,YAAY,EACZ,UAAU,EACV,SAAS,EACT,oBAAoB,EACpB,UAAU,EACV,SAAS,EACT,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,GAChB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,WAAW,EACX,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,QAAQ,EACR,aAAa,EACb,aAAa,EACb,SAAS,EACT,cAAc,EACd,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,WAAW,EACX,sBAAsB,EACtB,eAAe,EACf,aAAa,EACb,aAAa,EACb,YAAY,EACZ,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,GACzB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,kBAAkB,GACnB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAElG,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,KAAK,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE7E,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,EACzB,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,kBAAkB,GACxB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,yBAAyB,EACzB,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,aAAa,GACnB,MAAM,SAAS,CAAC"}

package/dist/types/audit/local-writer.d.ts

@@ -0,0 +1,255 @@
+import { AUDIT_HEAD_FILENAME, type ChainVerifyResult } from './chain';
+import { AuditEvent, AuditHead, AuditWriterHealth } from './types';
+export interface LocalWriterOptions {
+    dir: string;
+    /** Rotate the active log past this size. Default 10 MiB. */
+    maxFileSize?: number;
+    /** Number of rotated archives to keep. Default 10. */
+    maxArchiveFiles?: number;
+    /** Mode for the log files themselves. Default 0o600. */
+    fileMode?: number;
+    /**
+     * Mode for the audit **directory**. Default 0o700.
+     *
+     * This must be a directory mode. A directory at 0o600 has no execute bit, is
+     * therefore untraversable, and every write into it fails EACCES — which is how
+     * a clean install ended up with no audit trail at all (finding C-06).
+     */
+    dirMode?: number;
+    /** Group-commit interval for non-durable appends. Default 50ms. */
+    flushIntervalMs?: number;
+    /** Appends buffered before a group commit is forced. Default 256. */
+    batchSize?: number;
+}
+export interface AppendOptions {
+    /**
+     * When true (the default) the record is written and `fsync`'d before the
+     * returned promise resolves. `logSync()` depends on this; `log()` does not.
+     */
+    durable?: boolean;
+}
+export declare const ACTIVE_AUDIT_FILE = "audit.jsonl";
+/** Notified after a successful fsync with the newest durable record. */
+export type CommitListener = (last: AuditEvent | null, retainedFromSeq: number | null) => void;
+/**
+ * Append-only local audit writer with group commit.
+ *
+ * Durability contract:
+ *   - `append(event, { durable: true })` resolves only after the record has been
+ *     written and `fsync`'d. This is what `AuditSink.logSync()` relies on.
+ *   - `append(event, { durable: false })` resolves once the record has been
+ *     handed to the kernel; a group commit `fsync`s it within `flushIntervalMs`,
+ *     or immediately once `batchSize` records are buffered. This is what
+ *     `AuditSink.log()` uses.
+ *   - `flush()` forces the outstanding `fsync`; `close()` flushes, `fsync`s and
+ *     releases the handle. Both are safe to call more than once and safe to race
+ *     with `append()`: every mutating operation is serialised on one chain, so a
+ *     concurrent append either lands before the close or reopens afterwards. A
+ *     failure in either is reported through `getHealth()` and rethrown — never
+ *     swallowed into a "flushed OK".
+ *
+ * One long-lived handle replaces the previous open/fsync/close per event, and
+ * the `mkdir` + `stat` per event are gone from the hot path (finding M-05).
+ */
+export declare class LocalAuditWriter {
+    private readonly opts;
+    private readonly activePath;
+    private lastKnownSize;
+    /** Serialises mutating operations so fd/size/rotation state stays coherent. */
+    private opChain;
+    private handle;
+    private unflushedBytes;
+    private pendingRecords;
+    private flushTimer;
+    private lastError;
+    private lastErrorAt;
+    private lastWriteAt;
+    private dirMode;
+    private fileMode;
+    private ready;
+    private reportedError;
+    private rotations;
+    private eventsWritten;
+    private eventsFailed;
+    private bytesWritten;
+    private commitListener;
+    private lastAppended;
+    private retainedFromSeq;
+    constructor(opts: LocalWriterOptions);
+    get dir(): string;
+    get activeFilePath(): string;
+    /**
+     * Registers the durable-commit hook. `AuditSink` uses it to anchor the chain
+     * head at exactly the point where records became durable.
+     */
+    setCommitListener(fn: CommitListener | null): void;
+    /**
+     * Oldest sequence number still on disk, or null when no record is retained.
+     *
+     * Rotation keeps a bounded number of archives, so the oldest records are
+     * eventually evicted on purpose. Whole-log verification therefore starts at
+     * this sequence number rather than at the genesis hash (finding M-06/H-13
+     * interaction: an evicted archive used to make every later verify report a
+     * phantom `seq_gap`).
+     */
+    getRetentionFloor(): number | null;
+    append(event: AuditEvent, opts?: AppendOptions): Promise<void>;
+    /**
+     * Creates the audit directory (0o700, repairing a stuck 0o600 one) and opens
+     * the log file (0o600). Called before the chain head is anchored so a broken
+     * install is repaired before anything tries to use the directory.
+     */
+    prepare(): Promise<void>;
+    /** Forces an fsync of everything written but not yet committed. */
+    flush(): Promise<void>;
+    /**
+     * Flushes every buffered record, `fsync`s it, then closes the long-lived
+     * handle. The writer stays usable afterwards — a later `append()` reopens.
+     *
+     * Shutdown contract, and the reason the daemon may call it after a signal and
+     * again on an explicit stop:
+     *   - **Idempotent.** A second `close()` is a no-op that resolves: the handle
+     *     is cleared before it is closed, so the descriptor can never be closed
+     *     twice.
+     *   - **Nothing is buffered on return.** The group-commit timer is cancelled
+     *     first, so it cannot fire against a closed descriptor afterwards.
+     *   - **The handle is released even when the flush fails.** Otherwise a
+     *     failing fsync would leak the descriptor *and* hide behind a rejected
+     *     promise that a caller may not await. The flush error is reported through
+     *     `getHealth()` and rethrown; it is never turned into a fake "flushed OK".
+     */
+    close(): Promise<void>;
+    /** Rotates the active file. Chain continuity is the caller's to preserve. */
+    rotate(): Promise<void>;
+    getHealth(): AuditWriterHealth;
+    /**
+     * Loads every record of the log, oldest archive first.
+     *
+     * Kept for small callers (filters, tests). It materialises the whole history,
+     * so verification goes through {@link verifyAuditLog} instead of this
+     * (finding M-06).
+     */
+    readAll(opts?: {
+        limit?: number;
+    }): Promise<AuditEvent[]>;
+    /** Streams every record in chronological order, one record at a time. */
+    stream(opts?: {
+        maxRecords?: number;
+    }): AsyncGenerator<AuditEvent, void, void>;
+    /**
+     * Newest record of the newest non-empty log file.
+     *
+     * Startup chain recovery: the in-memory head is gone after a restart and
+     * `head.json` can be a tick behind the last durable append. Returns `null`
+     * when the log is empty or unreadable.
+     */
+    readTailEvent(maxBytes?: number): Promise<AuditEvent | null>;
+    private run;
+    private writeRecord;
+    private ensureReady;
+    /**
+     * Reads the sequence number of the oldest record still on disk.
+     *
+     * The oldest archive is `audit-<maxArchiveFiles>.jsonl` (higher index = older),
+     * and the floor only moves up: it is a promise about what the log retains, so
+     * it must never go backwards.
+     */
+    private refreshRetentionFloor;
+    /**
+     * Repairs a directory left untraversable by an older version. `mkdir` is a
+     * no-op when the directory already exists, so without this the wrong mode is
+     * sticky and every append keeps failing EACCES (finding C-06).
+     */
+    private repairDirMode;
+    private currentFileSize;
+    private flushNow;
+    /**
+     * A failure to anchor the head does not undo the records already on disk, so
+     * it is reported rather than thrown — but it is never swallowed either: the
+     * writer goes unhealthy and says so once.
+     */
+    private notifyCommit;
+    private scheduleFlush;
+    private cancelFlushTimer;
+    private rotateNow;
+    private closeHandle;
+    private dropHandle;
+    /**
+     * Records the failure and complains once per distinct error, so audit loss is
+     * loud without one stack trace per query.
+     */
+    private recordFailure;
+    private noteSuccess;
+}
+export interface VerifyAuditLogOptions {
+    /** Signing key. Defaults to `SW_AGENT_AUDIT_KEY` / `audit.key`. */
+    key?: Buffer | string;
+    /** Expected head. Defaults to `head.json` in `dir`; pass `null` to skip. */
+    head?: AuditHead | null;
+    /** Directory/keyfile to resolve the key from when `key` is omitted. */
+    keyDir?: string;
+    /** Stop after this many records. Guards against a runaway log. */
+    maxRecords?: number;
+    /** First sequence number the log must carry. Defaults to the head's retention floor, else 1. */
+    expectedSeq?: number;
+}
+export interface AuditLogVerification extends ChainVerifyResult {
+    /** Log files walked, oldest first. */
+    files: string[];
+    /** Records that were not parseable JSON. */
+    malformed_lines: number;
+    /** Files that exist but could not be read. */
+    unreadable_files: string[];
+    head_present: boolean;
+    chain_id: string | null;
+    /** Every anchor that was consulted, in the order given. */
+    anchor_sources: string[];
+    /** Which of them decided the verdict. */
+    anchor_source: string | null;
+}
+export interface VerifyStreamOptions {
+    /** Signing key. There is no unkeyed verification. */
+    key: Buffer | string;
+    /** Expected head. When omitted the stream is verified for internal consistency only. */
+    head?: AuditHead | null;
+    /** Sequence number the first record must carry. Default 1. */
+    expectedSeq?: number;
+    /** Hash the first record must chain from. Defaults to the genesis hash. */
+    expectedPrevHash?: string;
+    /** Chain id every record must carry. Default: pinned from the first record. */
+    chainId?: string;
+    /** Stop after this many records. */
+    maxRecords?: number;
+}
+/**
+ * Incremental verification of an ordered record stream, with early exit on the
+ * first bad record (finding M-06).
+ *
+ * Holds only the previous record's mac/seq, so peak memory is O(1) in the
+ * number of records. Anything that is not an object is treated as corruption
+ * rather than skipped: silently ignoring an unreadable line would let an
+ * attacker delete records that a partial write happened to break.
+ */
+export declare function verifyStream(source: AsyncIterable<unknown> | Iterable<unknown>, opts: VerifyStreamOptions): Promise<ChainVerifyResult>;
+/**
+ * Verifies the whole audit log as one chronological sequence across rotated
+ * files, anchored on the strongest available claim about where the chain ends.
+ *
+ * Two anchors are consulted: `head.json` inside the audit directory and the
+ * monotonic floor beside it. Either alone can be rolled back together with the
+ * log; the pair cannot, which is what makes a restored older copy detectable
+ * (finding C-05).
+ *
+ * The entry point CLI commands should call: it resolves the key, reads the
+ * anchors, streams the log in O(1) memory and early-exits on the first bad
+ * record (findings C-05, H-13, M-06).
+ */
+export declare function verifyAuditLog(dir: string, opts?: VerifyAuditLogOptions): Promise<AuditLogVerification>;
+export { AUDIT_HEAD_FILENAME };
+/**
+ * Re-exported so callers that already import from this module (setup paths,
+ * `doctor`, `init`) have one obvious entry point. The implementation lives in
+ * `./files` because it needs no writer state.
+ */
+export { AUDIT_DIR_MODE, AUDIT_FILE_MODE, ensureAuditDir, probeAuditDir, repairAuditDirMode, } from './files';
+//# sourceMappingURL=local-writer.d.ts.map

package/dist/types/audit/local-writer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-writer.d.ts","sourceRoot":"","sources":["../../../src/audit/local-writer.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,mBAAmB,EAMnB,KAAK,iBAAiB,EACvB,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEnE,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;CAOpB;AAED,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAWD,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAG/C,wEAAwE;AACxE,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+B;IACpD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,aAAa,CAAuB;IAE5C,+EAA+E;IAC/E,OAAO,CAAC,OAAO,CAAuC;IACtD,OAAO,CAAC,MAAM,CAAuC;IACrD,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,UAAU,CAA+B;IACjD,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,OAAO,CAAuB;IACtC,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,cAAc,CAA+B;IACrD,OAAO,CAAC,YAAY,CAA2B;IAC/C,OAAO,CAAC,eAAe,CAAuB;gBAElC,IAAI,EAAE,kBAAkB;IAapC,IAAI,GAAG,IAAI,MAAM,CAEhB;IAED,IAAI,cAAc,IAAI,MAAM,CAE3B;IAED;;;OAGG;IACH,iBAAiB,CAAC,EAAE,EAAE,cAAc,GAAG,IAAI,GAAG,IAAI;IAIlD;;;;;;;;OAQG;IACH,iBAAiB,IAAI,MAAM,GAAG,IAAI;IAI5B,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IA8BxE;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAS9B,mEAAmE;IAC7D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAW5B;;;;;;;;;;;;;;;OAeG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAgB5B,6EAA6E;IACvE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAS7B,SAAS,IAAI,iBAAiB;IAwB9B;;;;;;OAMG;IACG,OAAO,CAAC,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAQnE,yEAAyE;IAClE,MAAM,CAAC,IAAI,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,cAAc,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC;IAczF;;;;;;OAMG;IACG,aAAa,CAAC,QAAQ,SAAY,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAerE,OAAO,CAAC,GAAG;YASG,WAAW;YA+BX,WAAW;IAkBzB;;;;;;OAMG;YACW,qBAAqB;IA4BnC;;;;OAIG;YACW,aAAa;YAWb,eAAe;YAYf,QAAQ;IAatB;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAUpB,OAAO,CAAC,aAAa;IAWrB,OAAO,CAAC,gBAAgB;YAOV,SAAS;YAqDT,WAAW;YAOX,UAAU;IAKxB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAarB,OAAO,CAAC,WAAW;CAKpB;AAWD,MAAM,WAAW,qBAAqB;IACpC,mEAAmE;IACnE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IACxB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gGAAgG;IAChG,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAqB,SAAQ,iBAAiB;IAC7D,sCAAsC;IACtC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,4CAA4C;IAC5C,eAAe,EAAE,MAAM,CAAC;IACxB,8CAA8C;IAC9C,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,YAAY,EAAE,OAAO,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,2DAA2D;IAC3D,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,yCAAyC;IACzC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,wFAAwF;IACxF,IAAI,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IACxB,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,EAClD,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,iBAAiB,CAAC,CAc5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC,oBAAoB,CAAC,CAgH/B;AA8GD,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B;;;;GAIG;AACH,OAAO,EACL,cAAc,EACd,eAAe,EACf,cAAc,EACd,aAAa,EACb,kBAAkB,GACnB,MAAM,SAAS,CAAC"}

package/dist/types/audit/redact.d.ts

@@ -0,0 +1,151 @@
+/**
+ * Sentinel returned when a statement cannot be fully accounted for — an
+ * unterminated literal, comment or dollar quote, or input larger than
+ * {@link MAX_SQL_SCAN_BYTES}. Callers must treat it as "no redacted text
+ * available" and emit this marker instead of any part of the statement.
+ */
+export declare const UNREDACTABLE = "/* unredactable */";
+/** Character cap on a statement preview. */
+export declare const PREVIEW_MAX_LENGTH = 200;
+/** Alias for {@link PREVIEW_MAX_LENGTH}. */
+export declare const PREVIEW_MAX_CHARS = 200;
+/**
+ * Byte cap on a statement preview. Character counting alone is not a size
+ * bound — 200 characters can be 800 bytes of multi-byte UTF-8 — and preview
+ * text is written to the local audit log *and* shipped to the cloud.
+ */
+export declare const PREVIEW_MAX_BYTES = 512;
+/**
+ * Hard ceiling on how much SQL a single redaction pass will lex. A statement
+ * larger than this is reported unredactable rather than passed through.
+ */
+export declare const MAX_SQL_SCAN_BYTES = 1048576;
+export type LexForm = 'string' | 'estring' | 'unicode_string' | 'dollar' | 'identifier';
+export type LexToken = {
+    kind: 'text';
+    value: string;
+}
+/** `value` is the raw source slice; `open` is the length of its opening delimiter. */
+ | {
+    kind: 'literal';
+    value: string;
+    form: LexForm;
+    open: number;
+};
+export interface LexResult {
+    safe: boolean;
+    reason?: string;
+    tokens: LexToken[];
+}
+/**
+ * Scans a PostgreSQL statement far enough to guarantee that every character
+ * which could carry data is either SQL syntax or has been replaced.
+ *
+ * Every literal form is tracked: single quotes with doubled-quote escapes,
+ * `E'...'` escape strings with backslash escapes, `U&'...'` unicode strings
+ * with `\XXXX` / `\+XXXXXX` escapes, untagged and tagged dollar quotes, and
+ * double-quoted identifiers including the `U&"..."` form. Both comment forms
+ * are tracked too: line comments, which run to end of line and are never
+ * continued by a backslash, and nestable block comments. `#` is not a comment
+ * in PostgreSQL and is not treated as one here.
+ *
+ * The `E'…'` and `U&'…'` introducers count only when they are not glued to a
+ * preceding identifier character, which is what PostgreSQL's scanner does: in
+ * `xE'a\'b'` the identifier is `xE` and the quote opens an ordinary string whose
+ * body is `a\`, and this lexer closes it at the same quote the server would.
+ * The two quote characters are also kept apart: a `"` inside `'…'` is data, and
+ * ending the literal on it would print the remainder of the statement as text.
+ * Text outside a literal is left as it is — it is syntax and identifiers, and an
+ * unquoted identifier can contain neither `@` nor `.`, so nothing the server
+ * would accept as row data can reach the output through it. Quoted identifiers
+ * *are* tokens, because PostgreSQL prints row values between double quotes.
+ *
+ * Anything the scan cannot account for reports `safe: false`, and the caller
+ * must emit {@link UNREDACTABLE} rather than any part of the statement.
+ */
+export declare function lexSql(sql: string): LexResult;
+export interface RedactOptions {
+    /**
+     * Also replace `"..."` / `U&"..."` quoted identifiers with `?`.
+     *
+     * **On by default.** A double-quoted run carries row data just as often as it
+     * carries a schema name: PostgreSQL reports rejected values that way
+     * (`invalid input syntax for type integer: "alice@corp.com"`), and a statement
+     * assembled from untrusted input can put anything between the quotes. The
+     * preview is an audit record, so losing `"MySchema"` there costs readability
+     * while keeping it costs an email address. Pass `false` only where the
+     * identifier is known-good SQL that was not built from user input.
+     */
+    redactIdentifiers?: boolean;
+    /** Apply the `Key (col)=(value)` -> `= (?)` pass. Default true. */
+    redactKeyValues?: boolean;
+}
+/**
+ * The default for {@link RedactOptions.redactIdentifiers}, and the default every
+ * exported entry point uses.
+ *
+ * **On.** A double-quoted run is a schema name only when the statement really is
+ * trusted SQL. It is also how PostgreSQL reports a rejected row value
+ * (`invalid input syntax for type integer: "alice@corp.com"`), how a careless
+ * developer labels a column (`SELECT 1 AS "alice@corp.com"`) and how a path is
+ * smuggled (`COPY t TO '/tmp/"secret"'`). Previews exist for auditing and
+ * fingerprinting, not for round-tripping or replay, so keeping an identifier
+ * buys a readable schema name at the cost of an egress channel. Callers that
+ * genuinely need identifiers pass `redactIdentifiers: false` explicitly.
+ */
+export declare const REDACT_IDENTIFIERS_BY_DEFAULT = true;
+/**
+ * Replaces the body of every literal token, keeping the delimiters intact.
+ * Quoted identifiers are redacted unless `redactIdentifiers` is explicitly false.
+ */
+export declare function redactTokens(tokens: LexToken[], redactIdentifiers?: boolean): string;
+/**
+ * Replaces bare numeric literals that are not part of a word, identifier or
+ * placeholder.
+ *
+ * A numeric literal is data unless it is a lone single digit standing in a
+ * structural position — the `1` of `SELECT 1`, which cannot identify a row and
+ * is noise rather than evidence. Everything else goes: any literal of two or
+ * more characters (`12345`, `1.5e3`), and any single digit in an operand
+ * position, which is where a compared value actually lives (`x = 1`,
+ * `VALUES (1, 2)`, `IN (1, 2)`).
+ */
+export declare function redactNumbers(sql: string): string;
+/**
+ * Replace data-bearing literals with placeholders.
+ *
+ * Preview text is shipped to the cloud audit store, so this is a zero-retention
+ * boundary, not truncation. Dollar-quoted bodies, escape-string literals,
+ * unicode strings, numeric literals, quoted identifiers and both comment forms
+ * all have their contents removed unless `redactIdentifiers: false` is passed
+ * explicitly. A statement that cannot be fully accounted for — an unterminated
+ * construct, or more than {@link MAX_SQL_SCAN_BYTES} — returns
+ * {@link UNREDACTABLE} and no part of the statement text.
+ */
+export declare function redactSqlLiterals(sql: string, opts?: RedactOptions): string;
+/**
+ * True when the value is {@link UNREDACTABLE} — no redacted text is available —
+ * or empty. Both must be treated as "emit nothing": an empty preview is not
+ * distinguishable from a dropped one in an audit record.
+ */
+export declare function isUnredactable(value: string | undefined | null): boolean;
+/**
+ * Stable id for "the same statement, whatever values were passed".
+ *
+ * Whitespace, letter case, comments and literal values are not part of a
+ * statement's identity, so they are normalised away. Quoted identifiers are
+ * *not* — they are structure, and see {@link fingerprintTokens}.
+ *
+ * A statement that cannot be redacted shares one fingerprint with every other
+ * unredactable statement. That is deliberate: deriving the id from raw text
+ * would put attacker-chosen bytes into a value that leaves the process.
+ */
+export declare function fingerprintStatement(sql: string): string;
+/**
+ * Redacted, character- and byte-capped preview for the audit record. Capping
+ * happens after redaction so the cap can never split a redaction marker, and an
+ * unredactable statement collapses to a fixed placeholder rather than any of its
+ * text.
+ */
+export declare function previewStatement(sql: string): string;
+//# sourceMappingURL=redact.d.ts.map

package/dist/types/audit/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../../src/audit/redact.ts"],"names":[],"mappings":"AAOA;;;;;GAKG;AACH,eAAO,MAAM,YAAY,uBAAuB,CAAC;AAEjD,4CAA4C;AAC5C,eAAO,MAAM,kBAAkB,MAAM,CAAC;AAEtC,4CAA4C;AAC5C,eAAO,MAAM,iBAAiB,MAAqB,CAAC;AAEpD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAErC;;;GAGG;AACH,eAAO,MAAM,kBAAkB,UAAY,CAAC;AAU5C,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,gBAAgB,GAAG,QAAQ,GAAG,YAAY,CAAC;AAExF,MAAM,MAAM,QAAQ,GAChB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AACjC,sFAAsF;GACpF;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpE,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,QAAQ,EAAE,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAgI7C;AAyED,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,mEAAmE;IACnE,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAElD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,iBAAiB,UAAO,GAAG,MAAM,CAgBjF;AAQD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAiDjD;AAgBD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,aAAkB,GAAG,MAAM,CAO/E;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAExE;AA+DD;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAaxD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAapD"}