@schema-weaver/pg-connector 0.0.0-stage → 2.0.0

package/dist/cjs/cli/commands/audit-verify.js

@@ -0,0 +1,382 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runAuditVerify = runAuditVerify;
+exports.verifyFile = verifyFile;
+const path = __importStar(require("path"));
+const fs = __importStar(require("fs"));
+const paths_1 = require("../../config/paths");
+const chain_1 = require("../../audit/chain");
+const files_1 = require("../../audit/files");
+const local_writer_1 = require("../../audit/local-writer");
+const prompt_1 = require("../prompt");
+const ui_1 = require("../ui");
+function exit_(code) {
+    if ((0, prompt_1.isReplMode)()) {
+        throw { __exitCode: code };
+    }
+    process.exit(code);
+}
+/**
+ * Parses the operator-supplied head anchor.
+ *
+ * This is the only verification input that a writer of the audit directory
+ * cannot reach. Without it, anyone who can write both the log and `head.json`
+ * produces a self-consistent chain that no local comparison can distinguish
+ * from the original, so the anchor must come from somewhere else — a ticket, a
+ * SIEM field, another host, a password manager.
+ */
+function parseAnchor(args) {
+    const inlineIdx = args.indexOf('--anchor');
+    const fileIdx = args.indexOf('--anchor-file');
+    const seqIdx = args.indexOf('--anchor-seq');
+    const hashIdx = args.indexOf('--anchor-hash');
+    if (inlineIdx !== -1) {
+        const raw = args[inlineIdx + 1];
+        if (!raw)
+            return { head: null, source: 'none', error: '--anchor requires <seq>:<hash>' };
+        const m = raw.match(/^(\d+):([0-9a-fA-F]{64})$/);
+        if (!m)
+            return {
+                head: null,
+                source: 'none',
+                error: `--anchor must be <seq>:<64-hex-hash>, got "${raw}"`,
+            };
+        return {
+            head: {
+                v: 1,
+                chain_id: '*',
+                seq: parseInt(m[1], 10),
+                last_hash: m[2].toLowerCase(),
+                written_at: '',
+            },
+            source: `--anchor ${raw}`,
+        };
+    }
+    if (seqIdx !== -1 || hashIdx !== -1) {
+        const seq = args[seqIdx + 1];
+        const lastHash = args[hashIdx + 1];
+        const parsedSeq = seq !== undefined ? Number.parseInt(seq, 10) : Number.NaN;
+        if (!Number.isInteger(parsedSeq) || parsedSeq < 0 || !lastHash) {
+            return {
+                head: null,
+                source: 'none',
+                error: '--anchor-seq and --anchor-hash must be given together',
+            };
+        }
+        if (!(0, chain_1.isHash64)(lastHash.toLowerCase())) {
+            return {
+                head: null,
+                source: 'none',
+                error: '--anchor-hash must be a 64-character hex digest',
+            };
+        }
+        return {
+            head: {
+                v: 1,
+                chain_id: '*',
+                seq: parsedSeq,
+                last_hash: lastHash.toLowerCase(),
+                written_at: '',
+            },
+            source: `--anchor-seq ${parsedSeq}`,
+        };
+    }
+    if (fileIdx !== -1) {
+        const file = args[fileIdx + 1];
+        if (!file)
+            return { head: null, source: 'none', error: '--anchor-file requires a path' };
+        let parsed;
+        try {
+            parsed = JSON.parse(fs.readFileSync(file, 'utf8').replace(/^\uFEFF/, ''));
+        }
+        catch (err) {
+            return {
+                head: null,
+                source: 'none',
+                error: `--anchor-file unreadable: ${err instanceof Error ? err.message : String(err)}`,
+            };
+        }
+        const rec = parsed;
+        const seq = typeof rec.seq === 'string' ? Number.parseInt(rec.seq, 10) : rec.seq;
+        const lastHash = typeof rec.last_hash === 'string' ? rec.last_hash.toLowerCase() : rec.last_hash;
+        if (typeof seq !== 'number' || !Number.isInteger(seq) || seq < 0) {
+            return {
+                head: null,
+                source: 'none',
+                error: '--anchor-file: "seq" must be a non-negative integer',
+            };
+        }
+        if (!(0, chain_1.isHash64)(lastHash)) {
+            return {
+                head: null,
+                source: 'none',
+                error: '--anchor-file: "last_hash" must be a 64-character hex digest',
+            };
+        }
+        return {
+            head: {
+                v: 1,
+                chain_id: typeof rec.chain_id === 'string' && rec.chain_id.length > 0 ? rec.chain_id : '*',
+                seq,
+                last_hash: lastHash,
+                written_at: '',
+            },
+            source: `--anchor-file ${path.basename(file)}`,
+        };
+    }
+    return { head: null, source: 'none' };
+}
+/** Reads the first record so legacy (pre-keying) logs can be named as such. */
+async function peekFirstRecord(auditDir) {
+    try {
+        const read = await (0, files_1.readAuditLogChronological)(auditDir);
+        return read.events[0] ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * A pre-upgrade record: written before records were MAC'd and sequenced, so it
+ * carries no `chain_id`, no `seq` and only an unkeyed SHA-256 `hash`.
+ *
+ * Such a log is *classified*, never verified: an unkeyed chain over public data
+ * proves only internal consistency, and anyone holding the file can reproduce
+ * it. Reporting it as "tampered" would be wrong; reporting it as verified would
+ * be worse.
+ */
+function isLegacyRecord(rec) {
+    if (!rec)
+        return false;
+    return typeof rec.chain_id !== 'string' || typeof rec.seq !== 'number';
+}
+async function runAuditVerify(args, opts = {}) {
+    const verbose = opts.verbose || args.includes('--verbose') || args.includes('-v');
+    const json = args.includes('--json');
+    const allowLegacy = args.includes('--allow-legacy');
+    const spec = parseAnchor(args);
+    const swAgentDir = (0, paths_1.getSwAgentDir)();
+    const auditDir = path.join(swAgentDir, 'audit');
+    console.log();
+    console.log(ui_1.C.bold(ui_1.C.brand('  Audit Log Verification')));
+    console.log();
+    if (spec.error) {
+        console.log(`  ${ui_1.C.red(ui_1.S.cross)} ${ui_1.C.brightRed('Invalid anchor:')} ${spec.error}`);
+        console.log();
+        exit_(2);
+    }
+    const first = await peekFirstRecord(auditDir);
+    const legacy = isLegacyRecord(first);
+    // `chain_id` identifies the signing key, not the anchor: fill it in from the
+    // local head or the first record when the operator supplied only seq+hash.
+    const localHead = (0, chain_1.readHead)(auditDir);
+    const expectedHead = spec.head
+        ? {
+            ...spec.head,
+            chain_id: spec.head.chain_id !== '*'
+                ? spec.head.chain_id
+                : (localHead?.chain_id ?? (typeof first?.chain_id === 'string' ? first.chain_id : '*')),
+        }
+        : undefined;
+    let result;
+    try {
+        // Deliberately the UNCACHED verifier. `doctor` and `start` may reuse the
+        // per-file verification cache (see `verifyAuditDirCached`), because they
+        // re-ask the same question about the same bytes; this command must not.
+        //
+        // An operator runs `audit verify` precisely when they suspect the log was
+        // touched, and its contract is "verify the log as it is on disk right now".
+        // A cached verdict is a statement about bytes this process verified
+        // earlier, and it rests on stat metadata (inode, size, mtime, ctime) that a
+        // writer of the audit directory can restore. On a filesystem with coarse
+        // timestamps, a same-size rewrite with the timestamps put back would
+        // otherwise be reported here as "integrity verified" — the worst possible
+        // answer to this question. Verification is already O(1) in memory and
+        // early-exits on the first bad record, so the only thing given up is the
+        // time to re-read a log that has not changed.
+        result = await (0, local_writer_1.verifyAuditLog)(auditDir, {
+            head: expectedHead,
+            keyDir: swAgentDir,
+        });
+    }
+    catch (err) {
+        console.log(`  ${ui_1.C.red(ui_1.S.cross)} ${ui_1.C.brightRed('Verification failed to run:')} ${err instanceof Error ? err.message : String(err)}`);
+        console.log();
+        exit_(1);
+    }
+    const headPresent = result.head_present;
+    // Every anchor that was consulted is named, not only the one that decided the
+    // verdict: an operator has to be able to see that a rollback was caught by the
+    // second anchor, or they cannot tell which file to restore from.
+    const consulted = result.anchor_sources.length > 0 ? result.anchor_sources.join(' + ') : 'none';
+    const anchorSource = spec.source === 'none'
+        ? headPresent
+            ? `${consulted} (local)`
+            : 'none'
+        : `${spec.source} + ${consulted}`;
+    const anchored = spec.source !== 'none' || headPresent;
+    if (json) {
+        console.log(JSON.stringify({
+            ...result,
+            legacy,
+            anchor_source: anchorSource,
+            anchor_present: anchored,
+            allowed_legacy: allowLegacy,
+        }, null, 2));
+        exit_(verdictExitCode(result, legacy, allowLegacy));
+    }
+    const spinner = (0, ui_1.createSpinner)();
+    spinner.start('Verifying audit log integrity...');
+    await new Promise((resolve) => setTimeout(resolve, 300));
+    spinner.stop();
+    console.log();
+    console.log(`  ${ui_1.C.bold('Results:')}`);
+    console.log(`    Log files:   ${ui_1.C.white(String(result.files.length))}`);
+    console.log(`    Records:     ${ui_1.C.white(String(result.events))}`);
+    if (result.malformed_lines > 0) {
+        console.log(`    Parse errors: ${ui_1.C.red(String(result.malformed_lines))}`);
+    }
+    if (result.unreadable_files.length > 0) {
+        console.log(`    Unreadable:   ${ui_1.C.red(result.unreadable_files.join(', '))}`);
+    }
+    if (result.observed) {
+        console.log(`    Head found:  ${ui_1.C.white(`seq ${result.observed.seq}`)} ${ui_1.C.dim(`chain ${result.observed.chain_id}`)}`);
+    }
+    console.log(`    Anchor:      ${anchored ? ui_1.C.white(anchorSource) : ui_1.C.yellow('none available')}`);
+    if (!anchored) {
+        console.log(`      ${ui_1.C.dim('Without an anchor, truncation, deletion and rollback cannot be detected.')}`);
+    }
+    console.log(result.reason === 'key_unavailable'
+        ? `    Chain key:   ${ui_1.C.yellow('unavailable — the log was NOT cryptographically checked')}`
+        : `    Chain key:   ${ui_1.C.white('HMAC-SHA256 (per-installation key)')}`);
+    console.log();
+    if (legacy) {
+        console.log(`  ${ui_1.C.yellow(ui_1.S.warning)} ${ui_1.C.bold('LEGACY LOG')} — records predate keyed chaining (plain SHA-256).`);
+        console.log(`      ${ui_1.C.dim('An unkeyed chain over public data can be recomputed by anyone holding the file,')}`);
+        console.log(`      ${ui_1.C.dim('so these records are reported as UNVERIFIED rather than checked.')}`);
+        if (allowLegacy) {
+            console.log(`      ${ui_1.C.dim('Accepted because --allow-legacy was given.')}`);
+        }
+        else {
+            console.log(`      ${ui_1.C.dim('Re-run with --allow-legacy to accept a legacy log, or archive it and start a new log.')}`);
+        }
+        console.log();
+    }
+    if (result.intact && !legacy) {
+        console.log(`  ${ui_1.C.green(ui_1.S.check)} ${ui_1.C.brightGreen('Audit log integrity verified.')}`);
+        console.log(`      ${ui_1.C.dim('Proves: no record was modified, inserted, removed or reordered without the chain key,')}`);
+        console.log(`      ${ui_1.C.dim(`        and the log ends exactly at the anchored head (seq ${result.observed?.seq ?? 0}).`)}`);
+        console.log(`      ${ui_1.C.dim('Does NOT prove: who performed the actions, or completeness past rotation retention.')}`);
+    }
+    else if (result.intact && legacy && allowLegacy) {
+        console.log(`  ${ui_1.C.yellow(ui_1.S.warning)} ${ui_1.C.bold('Accepted as a legacy log (--allow-legacy). Records were NOT cryptographically verified.')}`);
+    }
+    else if (legacy) {
+        console.log(`  ${ui_1.C.red(ui_1.S.cross)} ${ui_1.C.brightRed('Legacy log: records cannot be cryptographically verified.')}`);
+    }
+    else {
+        console.log(`  ${ui_1.C.red(ui_1.S.cross)} ${ui_1.C.brightRed('Audit log integrity check FAILED.')}`);
+        if (result.reason) {
+            console.log(`      Reason: ${ui_1.C.yellow(result.reason)}`);
+        }
+        if (result.detail) {
+            console.log(`      ${ui_1.C.dim(result.detail)}`);
+        }
+        if (result.brokenAt !== undefined) {
+            console.log(`      First bad record index: ${ui_1.C.red(String(result.brokenAt))}`);
+        }
+    }
+    if (verbose) {
+        console.log();
+        console.log(`  ${ui_1.C.dim(`audit dir: ${auditDir}`)}`);
+    }
+    console.log();
+    exit_(verdictExitCode(result, legacy, allowLegacy));
+}
+/**
+ * Exit policy, strict by default:
+ *   - a log that fails verification never exits 0
+ *   - a log that cannot be verified at all — legacy, or no key — never exits 0
+ *     unless the operator passes --allow-legacy, which downgrades the verdict to
+ *     "accepted, unverified" and is visible in the output
+ *   - "nothing to verify" is a failure, never a pass
+ */
+function verdictExitCode(result, legacy, allowLegacy) {
+    if (result.reason === 'empty')
+        return 1;
+    if (!result.intact)
+        return 1;
+    if (legacy && !allowLegacy)
+        return 1;
+    return 0;
+}
+/**
+ * Per-file diagnostic view retained for callers that report on individual
+ * rotated files. It reports parse integrity only; chain verdicts come from
+ * `verifyAuditLog`, which verifies the whole log as one sequence.
+ */
+async function verifyFile(file, _verbose) {
+    const result = {
+        file: path.basename(file),
+        totalEvents: 0,
+        validEvents: 0,
+        hashErrors: 0,
+        parseErrors: 0,
+    };
+    let content;
+    try {
+        content = await fs.promises.readFile(file, 'utf8');
+    }
+    catch {
+        return result;
+    }
+    const lines = content.split('\n').filter(Boolean);
+    result.totalEvents = lines.length;
+    for (let i = 0; i < lines.length; i++) {
+        try {
+            JSON.parse(i === 0 ? stripBom(lines[i]) : lines[i]);
+            result.validEvents++;
+        }
+        catch {
+            result.parseErrors++;
+        }
+    }
+    return result;
+}
+function stripBom(content) {
+    return content.charCodeAt(0) === 0xfeff ? content.slice(1) : content;
+}
+//# sourceMappingURL=audit-verify.js.map

package/dist/cjs/cli/commands/audit-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-verify.js","sourceRoot":"","sources":["../../../../src/cli/commands/audit-verify.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6KA,wCA0LC;AA0BD,gCA6BC;AA9ZD,2CAA6B;AAC7B,uCAAyB;AACzB,8CAAmD;AAEnD,6CAAuD;AACvD,6CAA8D;AAC9D,2DAAqF;AACrF,sCAAuC;AACvC,8BAA4C;AAE5C,SAAS,KAAK,CAAC,IAAY;IACzB,IAAI,IAAA,mBAAU,GAAE,EAAE,CAAC;QACjB,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC7B,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAqBD;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,IAAc;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAE9C,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;QACzF,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACjD,IAAI,CAAC,CAAC;YACJ,OAAO;gBACL,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,8CAA8C,GAAG,GAAG;aAC5D,CAAC;QACJ,OAAO;YACL,IAAI,EAAE;gBACJ,CAAC,EAAE,CAAC;gBACJ,QAAQ,EAAE,GAAG;gBACb,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACvB,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;gBAC7B,UAAU,EAAE,EAAE;aACf;YACD,MAAM,EAAE,YAAY,GAAG,EAAE;SAC1B,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC5E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC/D,OAAO;gBACL,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,uDAAuD;aAC/D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAA,gBAAQ,EAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACtC,OAAO;gBACL,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,iDAAiD;aACzD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE;gBACJ,CAAC,EAAE,CAAC;gBACJ,QAAQ,EAAE,GAAG;gBACb,GAAG,EAAE,SAAS;gBACd,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE;gBACjC,UAAU,EAAE,EAAE;aACf;YACD,MAAM,EAAE,gBAAgB,SAAS,EAAE;SACpC,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACzF,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,OAAO;gBACL,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aACvF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAiC,CAAC;QAC9C,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QACjF,MAAM,QAAQ,GACZ,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;QAClF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACjE,OAAO;gBACL,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,qDAAqD;aAC7D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAA,gBAAQ,EAAC,QAAQ,CAAC,EAAE,CAAC;YACxB,OAAO;gBACL,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,8DAA8D;aACtE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE;gBACJ,CAAC,EAAE,CAAC;gBACJ,QAAQ,EAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG;gBAC1F,GAAG;gBACH,SAAS,EAAE,QAAQ;gBACnB,UAAU,EAAE,EAAE;aACf;YACD,MAAM,EAAE,iBAAiB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;SAC/C,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,eAAe,CAAC,QAAgB;IAC7C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAA,iCAAyB,EAAC,QAAQ,CAAC,CAAC;QACvD,OAAQ,IAAI,CAAC,MAAM,CAAC,CAAC,CAAwC,IAAI,IAAI,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,GAAmC;IACzD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,OAAO,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC;AACzE,CAAC;AAEM,KAAK,UAAU,cAAc,CAAC,IAAc,EAAE,OAA2B,EAAE;IAChF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClF,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAE/B,MAAM,UAAU,GAAG,IAAA,qBAAa,GAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAEhD,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,MAAC,CAAC,IAAI,CAAC,MAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,EAAE,CAAC;IAEd,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,KAAK,MAAC,CAAC,GAAG,CAAC,MAAC,CAAC,KAAK,CAAC,IAAI,MAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACnF,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,KAAK,CAAC,CAAC,CAAC,CAAC;IACX,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAErC,6EAA6E;IAC7E,2EAA2E;IAC3E,MAAM,SAAS,GAAG,IAAA,gBAAQ,EAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI;QAC5B,CAAC,CAAC;YACE,GAAG,IAAI,CAAC,IAAI;YACZ,QAAQ,EACN,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,GAAG;gBACxB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ;gBACpB,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,IAAI,CAAC,OAAO,KAAK,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;SAC5F;QACH,CAAC,CAAC,SAAS,CAAC;IAEd,IAAI,MAA4B,CAAC;IACjC,IAAI,CAAC;QACH,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,EAAE;QACF,0EAA0E;QAC1E,4EAA4E;QAC5E,oEAAoE;QACpE,4EAA4E;QAC5E,yEAAyE;QACzE,qEAAqE;QACrE,0EAA0E;QAC1E,sEAAsE;QACtE,yEAAyE;QACzE,8CAA8C;QAC9C,MAAM,GAAG,MAAM,IAAA,6BAAc,EAAC,QAAQ,EAAE;YACtC,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,UAAU;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CACT,KAAK,MAAC,CAAC,GAAG,CAAC,MAAC,CAAC,KAAK,CAAC,IAAI,MAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,IAAI,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACxH,CAAC;QACF,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,KAAK,CAAC,CAAC,CAAC,CAAC;IACX,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;IACxC,8EAA8E;IAC9E,+EAA+E;IAC/E,iEAAiE;IACjE,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAChG,MAAM,YAAY,GAChB,IAAI,CAAC,MAAM,KAAK,MAAM;QACpB,CAAC,CAAC,WAAW;YACX,CAAC,CAAC,GAAG,SAAS,UAAU;YACxB,CAAC,CAAC,MAAM;QACV,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,MAAM,SAAS,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,WAAW,CAAC;IAEvD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;YACE,GAAG,MAAM;YACT,MAAM;YACN,aAAa,EAAE,YAAY;YAC3B,cAAc,EAAE,QAAQ;YACxB,cAAc,EAAE,WAAW;SAC5B,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;QACF,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,OAAO,GAAG,IAAA,kBAAa,GAAE,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAClD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IACzD,OAAO,CAAC,IAAI,EAAE,CAAC;IAEf,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,KAAK,MAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,oBAAoB,MAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,oBAAoB,MAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CACT,oBAAoB,MAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,MAAC,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,CAC1G,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,oBAAoB,QAAQ,CAAC,CAAC,CAAC,MAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACjG,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CACT,SAAS,MAAC,CAAC,GAAG,CAAC,0EAA0E,CAAC,EAAE,CAC7F,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CACT,MAAM,CAAC,MAAM,KAAK,iBAAiB;QACjC,CAAC,CAAC,oBAAoB,MAAC,CAAC,MAAM,CAAC,yDAAyD,CAAC,EAAE;QAC3F,CAAC,CAAC,oBAAoB,MAAC,CAAC,KAAK,CAAC,oCAAoC,CAAC,EAAE,CACxE,CAAC;IAEF,OAAO,CAAC,GAAG,EAAE,CAAC;IAEd,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CACT,KAAK,MAAC,CAAC,MAAM,CAAC,MAAC,CAAC,OAAO,CAAC,IAAI,MAAC,CAAC,IAAI,CAAC,YAAY,CAAC,oDAAoD,CACrG,CAAC;QACF,OAAO,CAAC,GAAG,CACT,SAAS,MAAC,CAAC,GAAG,CAAC,iFAAiF,CAAC,EAAE,CACpG,CAAC;QACF,OAAO,CAAC,GAAG,CACT,SAAS,MAAC,CAAC,GAAG,CAAC,kEAAkE,CAAC,EAAE,CACrF,CAAC;QACF,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,SAAS,MAAC,CAAC,GAAG,CAAC,4CAA4C,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CACT,SAAS,MAAC,CAAC,GAAG,CAAC,uFAAuF,CAAC,EAAE,CAC1G,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,MAAC,CAAC,KAAK,CAAC,MAAC,CAAC,KAAK,CAAC,IAAI,MAAC,CAAC,WAAW,CAAC,+BAA+B,CAAC,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,GAAG,CACT,SAAS,MAAC,CAAC,GAAG,CAAC,uFAAuF,CAAC,EAAE,CAC1G,CAAC;QACF,OAAO,CAAC,GAAG,CACT,SAAS,MAAC,CAAC,GAAG,CAAC,8DAA8D,MAAM,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9G,CAAC;QACF,OAAO,CAAC,GAAG,CACT,SAAS,MAAC,CAAC,GAAG,CAAC,qFAAqF,CAAC,EAAE,CACxG,CAAC;IACJ,CAAC;SAAM,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,IAAI,WAAW,EAAE,CAAC;QAClD,OAAO,CAAC,GAAG,CACT,KAAK,MAAC,CAAC,MAAM,CAAC,MAAC,CAAC,OAAO,CAAC,IAAI,MAAC,CAAC,IAAI,CAAC,yFAAyF,CAAC,EAAE,CAChI,CAAC;IACJ,CAAC;SAAM,IAAI,MAAM,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CACT,KAAK,MAAC,CAAC,GAAG,CAAC,MAAC,CAAC,KAAK,CAAC,IAAI,MAAC,CAAC,SAAS,CAAC,2DAA2D,CAAC,EAAE,CAClG,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,MAAC,CAAC,GAAG,CAAC,MAAC,CAAC,KAAK,CAAC,IAAI,MAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC,EAAE,CAAC,CAAC;QACvF,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,CAAC,GAAG,CAAC,SAAS,MAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,iCAAiC,MAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,KAAK,MAAC,CAAC,GAAG,CAAC,cAAc,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CACtB,MAA4B,EAC5B,MAAe,EACf,WAAoB;IAEpB,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IAC7B,IAAI,MAAM,IAAI,CAAC,WAAW;QAAE,OAAO,CAAC,CAAC;IACrC,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,QAAiB;IAC9D,MAAM,MAAM,GAAiB;QAC3B,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzB,WAAW,EAAE,CAAC;QACd,WAAW,EAAE,CAAC;QACd,UAAU,EAAE,CAAC;QACb,WAAW,EAAE,CAAC;KACf,CAAC;IAEF,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe;IAC/B,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACvE,CAAC"}

package/dist/cjs/cli/commands/clean.d.ts

@@ -0,0 +1,23 @@
+export interface CleanOptions {
+    force?: boolean;
+    logs?: boolean;
+    all?: boolean;
+    audit?: boolean;
+}
+/**
+ * Removes an audit directory together with the monotonic floor anchor that sits
+ * *beside* it.
+ *
+ * The anchor is a sibling of the audit directory, not a file inside it, so
+ * deleting the directory alone leaves a floor behind that then refuses every
+ * later append with a "log was deleted" verdict — a reset that cannot be used.
+ * The operator would have to find and delete a hidden file by hand to recover.
+ *
+ * The `audit.key` HMAC key is deliberately left alone: it lives outside the
+ * audit directory and a new chain re-derives its identity from it.
+ *
+ * @returns the paths that were actually removed, in the order they were tried.
+ */
+export declare function purgeAuditTrail(auditDir: string): string[];
+export declare function runClean(args?: string[], opts?: CleanOptions): Promise<void>;
+//# sourceMappingURL=clean.d.ts.map

package/dist/cjs/cli/commands/clean.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clean.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/clean.ts"],"names":[],"mappings":"AAsBA,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAY1D;AA0BD,wBAAsB,QAAQ,CAAC,IAAI,GAAE,MAAM,EAAO,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqL1F"}