@schema-weaver/pg-connector 0.0.0-stage → 2.0.0

package/dist/esm/audit/files.js

@@ -0,0 +1,361 @@
+import * as fs from 'fs';
+import * as path from 'path';
+/**
+ * Mode for the audit **directory**. A directory needs the execute bit to be
+ * traversable; creating one with a regular file's mode (0o600) makes every
+ * stat/open/readdir inside it fail with EACCES, which is how a clean install
+ * ended up with no audit trail at all.
+ */
+export const AUDIT_DIR_MODE = 0o700;
+/** Mode for the audit log files themselves: read/write for the owner only. */
+export const AUDIT_FILE_MODE = 0o600;
+function posixModes() {
+    return process.platform !== 'win32';
+}
+/**
+ * Repairs an audit directory left with a mode that cannot be traversed.
+ *
+ * `fs.mkdir({ recursive: true })` is a no-op on an existing directory, so a
+ * directory created earlier with the wrong mode stays wrong and every later
+ * append keeps failing EACCES. The explicit chmod is what makes an
+ * already-broken install repair itself.
+ *
+ * @returns true when the mode had to be corrected.
+ */
+export async function repairAuditDirMode(dir, mode = AUDIT_DIR_MODE) {
+    if (!posixModes())
+        return false;
+    let st;
+    try {
+        st = await fs.promises.stat(dir);
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return false;
+        throw err;
+    }
+    if (!st.isDirectory()) {
+        throw new Error(`audit path exists but is not a directory: ${dir}`);
+    }
+    if ((st.mode & 0o777) === mode)
+        return false;
+    await fs.promises.chmod(dir, mode);
+    return true;
+}
+/**
+ * Ensures the audit directory exists and is traversable, creating it at mode
+ * 0o700 and repairing a pre-existing wrong mode.
+ *
+ * Idempotent and safe to call from setup, startup, append and repair paths:
+ *
+ * ```ts
+ * await ensureAuditDir(path.join(getSwAgentDir(), 'audit'));
+ * ```
+ *
+ * @returns true when the directory had to be created or its mode corrected.
+ */
+export async function ensureAuditDir(dir, opts = {}) {
+    const dirMode = opts.dirMode ?? AUDIT_DIR_MODE;
+    let existed = true;
+    try {
+        await fs.promises.stat(dir);
+    }
+    catch {
+        existed = false;
+    }
+    await fs.promises.mkdir(dir, { recursive: true, mode: dirMode });
+    const repaired = await repairAuditDirMode(dir, dirMode);
+    return !existed || repaired;
+}
+/**
+ * Startup gate for the audit path: creates/repairs the directory, then proves a
+ * real write + fsync succeeds. "Audit loss must not be silent" is only
+ * enforceable if startup refuses to claim the log is fine without trying it.
+ */
+export async function probeAuditDir(dir, opts = {}) {
+    const dirMode = opts.dirMode ?? AUDIT_DIR_MODE;
+    const fileMode = opts.fileMode ?? AUDIT_FILE_MODE;
+    let repaired = false;
+    let actualMode = dirMode;
+    try {
+        repaired = await repairAuditDirMode(dir, dirMode).catch(() => false);
+        const st = await fs.promises.stat(dir);
+        if (!st.isDirectory()) {
+            return { ok: false, dir, dirMode, repaired, reason: `audit path is not a directory: ${dir}` };
+        }
+        actualMode = st.mode & 0o777;
+    }
+    catch (err) {
+        return {
+            ok: false,
+            dir,
+            dirMode,
+            repaired,
+            reason: `cannot create audit directory: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    const probe = path.join(dir, '.write_test');
+    try {
+        const fd = await fs.promises.open(probe, 'w', fileMode);
+        try {
+            await fd.writeFile('audit preflight');
+            await fd.sync();
+        }
+        finally {
+            await fd.close();
+        }
+        await fs.promises.unlink(probe);
+    }
+    catch (err) {
+        return {
+            ok: false,
+            dir,
+            dirMode: actualMode,
+            repaired,
+            reason: `audit directory is not writable: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    return { ok: true, dir, dirMode: actualMode, repaired };
+}
+/**
+ * Returns audit log files in strict chronological order:
+ * audit-N.jsonl (oldest archive) -> ... -> audit-1.jsonl (most recent archive) -> audit.jsonl (active file)
+ */
+export async function getAuditFilesChronological(auditDir) {
+    const archives = [];
+    let hasActive = false;
+    try {
+        const entries = await fs.promises.readdir(auditDir);
+        for (const entry of entries) {
+            if (entry === 'audit.jsonl') {
+                hasActive = true;
+                continue;
+            }
+            const match = entry.match(/^audit-(\d+)\.jsonl$/);
+            if (match) {
+                archives.push({ file: path.join(auditDir, entry), index: parseInt(match[1], 10) });
+            }
+        }
+    }
+    catch {
+        return [];
+    }
+    // Older archives have higher numbers (audit-2 is older than audit-1)
+    archives.sort((a, b) => b.index - a.index);
+    const result = archives.map((a) => a.file);
+    if (hasActive) {
+        result.push(path.join(auditDir, 'audit.jsonl'));
+    }
+    return result;
+}
+/**
+ * Returns audit log files in reverse-chronological order:
+ * audit.jsonl (active, newest) -> audit-1.jsonl -> audit-2.jsonl -> ... -> audit-N.jsonl (oldest)
+ */
+export async function getAuditFilesReverse(auditDir) {
+    const chrono = await getAuditFilesChronological(auditDir);
+    return chrono.reverse();
+}
+/**
+ * Parse relative time string (e.g. "15m", "1h", "24h", "7d", "today") or ISO string into unix timestamp (ms).
+ */
+export function parseSince(since) {
+    if (since === undefined || since === null || since === '')
+        return null;
+    if (typeof since === 'number')
+        return since;
+    const s = since.trim().toLowerCase();
+    if (s === 'today') {
+        const startOfToday = new Date();
+        startOfToday.setHours(0, 0, 0, 0);
+        return startOfToday.getTime();
+    }
+    const relMatch = s.match(/^(\d+)\s*(s|sec|m|min|h|hr|d|day|w|week)s?$/);
+    if (relMatch) {
+        const val = parseInt(relMatch[1], 10);
+        const unit = relMatch[2];
+        let mult = 1000;
+        if (unit.startsWith('s'))
+            mult = 1000;
+        else if (unit.startsWith('m'))
+            mult = 60 * 1000;
+        else if (unit.startsWith('h'))
+            mult = 3600 * 1000;
+        else if (unit.startsWith('d'))
+            mult = 86400 * 1000;
+        else if (unit.startsWith('w'))
+            mult = 7 * 86400 * 1000;
+        return Date.now() - val * mult;
+    }
+    const parsed = Date.parse(since);
+    if (!Number.isNaN(parsed)) {
+        return parsed;
+    }
+    return null;
+}
+function stripBom(content) {
+    return content.charCodeAt(0) === 0xfeff ? content.slice(1) : content;
+}
+/**
+ * Reads every record of the audit log in strict chronological order across all
+ * rotated files, with no limit.
+ *
+ * Chain verification must see the log as one sequence: verifying each rotated
+ * file in isolation reports every file that begins mid-chain as broken, which is
+ * what made routine rotation look like tampering.
+ */
+export async function readAuditLogChronological(auditDir) {
+    const result = {
+        files: [],
+        events: [],
+        unreadableFiles: [],
+        malformedLines: 0,
+    };
+    const files = await getAuditFilesChronological(auditDir);
+    result.files = files;
+    for (const file of files) {
+        let content;
+        try {
+            content = await fs.promises.readFile(file, 'utf8');
+        }
+        catch {
+            result.unreadableFiles.push(file);
+            continue;
+        }
+        const lines = content.split('\n').filter((l) => l.trim().length > 0);
+        for (let i = 0; i < lines.length; i++) {
+            const raw = i === 0 ? stripBom(lines[i]) : lines[i];
+            try {
+                const parsed = JSON.parse(raw);
+                if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+                    result.malformedLines++;
+                    continue;
+                }
+                result.events.push(parsed);
+            }
+            catch {
+                result.malformedLines++;
+            }
+        }
+    }
+    return result;
+}
+/**
+ * Checks whether an event satisfies the given filter.
+ */
+export function eventMatchesFilter(event, filter, sinceTs, untilTs, searchLower) {
+    if (filter.project && event.project.toLowerCase() !== filter.project.toLowerCase()) {
+        return false;
+    }
+    if (filter.user && !event.user_id.toLowerCase().includes(filter.user.toLowerCase())) {
+        return false;
+    }
+    if (filter.action && event.action.toLowerCase() !== filter.action.toLowerCase()) {
+        return false;
+    }
+    if (filter.decision && event.decision.toLowerCase() !== filter.decision.toLowerCase()) {
+        return false;
+    }
+    if (filter.outcome && event.outcome.toLowerCase() !== filter.outcome.toLowerCase()) {
+        return false;
+    }
+    const eventTs = new Date(event.ts).getTime();
+    if (sinceTs !== null && sinceTs !== undefined && eventTs < sinceTs) {
+        return false;
+    }
+    if (untilTs !== null && untilTs !== undefined && eventTs > untilTs) {
+        return false;
+    }
+    if (searchLower) {
+        const haystack = [
+            event.statement_preview ?? '',
+            event.project,
+            event.user_id,
+            event.action,
+            event.decision,
+            event.outcome,
+            event.error_code ?? '',
+            event.denial_reason ?? '',
+            event.statement_fingerprint ?? '',
+        ]
+            .join(' ')
+            .toLowerCase();
+        if (!haystack.includes(searchLower)) {
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * Reads audit events matching the filter.
+ * Defaults to descending order (newest first).
+ * Fast backwards reading: stops as soon as `limit` matches are satisfied.
+ */
+export async function readAuditEvents(auditDir, filter = {}) {
+    const isAsc = filter.order === 'asc';
+    const limit = filter.limit && filter.limit > 0 ? filter.limit : 50;
+    const sinceTs = parseSince(filter.since);
+    const untilTs = parseSince(filter.until);
+    const searchLower = filter.search?.trim().toLowerCase();
+    const matched = [];
+    if (!isAsc) {
+        // Newest first: read files in reverse (audit.jsonl first, then audit-1.jsonl, etc.)
+        const files = await getAuditFilesReverse(auditDir);
+        for (const file of files) {
+            try {
+                const content = await fs.promises.readFile(file, 'utf8');
+                const lines = content.split('\n').filter((l) => l.trim().length > 0);
+                // Process lines from bottom to top (newest in file to oldest)
+                for (let i = lines.length - 1; i >= 0; i--) {
+                    const raw = i === 0 ? stripBom(lines[i]) : lines[i];
+                    try {
+                        const event = JSON.parse(raw);
+                        if (eventMatchesFilter(event, filter, sinceTs, untilTs, searchLower)) {
+                            matched.push(event);
+                            if (matched.length >= limit) {
+                                return matched;
+                            }
+                        }
+                    }
+                    catch {
+                        // ignore malformed line
+                    }
+                }
+            }
+            catch {
+                // ignore unreadable file
+            }
+        }
+        return matched;
+    }
+    else {
+        // Oldest first: read files in chronological order
+        const files = await getAuditFilesChronological(auditDir);
+        for (const file of files) {
+            try {
+                const content = await fs.promises.readFile(file, 'utf8');
+                const lines = content.split('\n').filter((l) => l.trim().length > 0);
+                for (let i = 0; i < lines.length; i++) {
+                    const raw = i === 0 ? stripBom(lines[i]) : lines[i];
+                    try {
+                        const event = JSON.parse(raw);
+                        if (eventMatchesFilter(event, filter, sinceTs, untilTs, searchLower)) {
+                            matched.push(event);
+                            if (matched.length >= limit) {
+                                return matched;
+                            }
+                        }
+                    }
+                    catch {
+                        // ignore malformed line
+                    }
+                }
+            }
+            catch {
+                // ignore unreadable file
+            }
+        }
+        return matched;
+    }
+}
+//# sourceMappingURL=files.js.map

package/dist/esm/audit/files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../../../src/audit/files.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AA4B7B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC;AAEpC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AAErC,SAAS,UAAU;IACjB,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;AACtC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAW,EACX,OAAe,cAAc;IAE7B,IAAI,CAAC,UAAU,EAAE;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,EAAE,CAAC;IACP,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACnE,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,6CAA6C,GAAG,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAW,EACX,OAA6B,EAAE;IAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC;IAC/C,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxD,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC;AAC9B,CAAC;AAYD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAW,EACX,OAAgD,EAAE;IAElD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC;IAElD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,UAAU,GAAG,OAAO,CAAC;IACzB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,kCAAkC,GAAG,EAAE,EAAE,CAAC;QAChG,CAAC;QACD,UAAU,GAAG,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,OAAO;YACP,QAAQ;YACR,MAAM,EAAE,kCAAkC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SAC7F,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;YACtC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAClB,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;QACD,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,OAAO,EAAE,UAAU;YACnB,QAAQ;YACR,MAAM,EAAE,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SAC/F,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,QAAgB;IAC/D,MAAM,QAAQ,GAAsC,EAAE,CAAC;IACvD,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;gBAC5B,SAAS,GAAG,IAAI,CAAC;gBACjB,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAClD,IAAI,KAAK,EAAE,CAAC;gBACV,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,qEAAqE;IACrE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IACzD,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IAC1D,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,KAAuB;IAChD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE5C,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;QAClB,MAAM,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC;QAChC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAClC,OAAO,YAAY,CAAC,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACxE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,IAAI,GAAG,IAAI,CAAC;aACjC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC;aAC3C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;aAC7C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,IAAI,GAAG,KAAK,GAAG,IAAI,CAAC;aAC9C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC;QACvD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC;IACjC,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe;IAC/B,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACvE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,QAAgB;IAC9D,MAAM,MAAM,GAAuB;QACjC,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,EAAE;QACV,eAAe,EAAE,EAAE;QACnB,cAAc,EAAE,CAAC;KAClB,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAErB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClC,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACpD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;gBAC1C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC3E,MAAM,CAAC,cAAc,EAAE,CAAC;oBACxB,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAoB,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAiB,EACjB,MAAsB,EACtB,OAAuB,EACvB,OAAuB,EACvB,WAAoB;IAEpB,IAAI,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QACnF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACpF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QAChF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QACtF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QACnF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC7C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,GAAG,OAAO,EAAE,CAAC;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,GAAG,OAAO,EAAE,CAAC;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG;YACf,KAAK,CAAC,iBAAiB,IAAI,EAAE;YAC7B,KAAK,CAAC,OAAO;YACb,KAAK,CAAC,OAAO;YACb,KAAK,CAAC,MAAM;YACZ,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,OAAO;YACb,KAAK,CAAC,UAAU,IAAI,EAAE;YACtB,KAAK,CAAC,aAAa,IAAI,EAAE;YACzB,KAAK,CAAC,qBAAqB,IAAI,EAAE;SAClC;aACE,IAAI,CAAC,GAAG,CAAC;aACT,WAAW,EAAE,CAAC;QAEjB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,SAAyB,EAAE;IAE3B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAExD,MAAM,OAAO,GAAiB,EAAE,CAAC;IAEjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,oFAAoF;QACpF,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACnD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACzD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAErE,8DAA8D;gBAC9D,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC3C,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBACpD,IAAI,CAAC;wBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC;wBAC5C,IAAI,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;4BACrE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;4BACpB,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;gCAC5B,OAAO,OAAO,CAAC;4BACjB,CAAC;wBACH,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,wBAAwB;oBAC1B,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,yBAAyB;YAC3B,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,kDAAkD;QAClD,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,QAAQ,CAAC,CAAC;QACzD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACzD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAErE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACtC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBACpD,IAAI,CAAC;wBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC;wBAC5C,IAAI,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;4BACrE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;4BACpB,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;gCAC5B,OAAO,OAAO,CAAC;4BACjB,CAAC;wBACH,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,wBAAwB;oBAC1B,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,yBAAyB;YAC3B,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC"}

package/dist/esm/audit/index.d.ts

@@ -0,0 +1,9 @@
+export type { AuditAction, AuditDecision, AuditOutcome, AuditActor, AuditRole, AuditPermissionLevel, AuditEvent, AuditHead, AuditFilter, AuditQueryResult, AuditWriterHealth, AuditSinkHealth, } from './types';
+export { computeHash, computeMac, computeEventMac, canonicalStringify, isHash64, loadAuditKey, tryLoadAuditKey, decodeKeyMaterial, deriveChainId, readHead, readHeadFloor, resolveAnchor, writeHead, writeHeadFloor, floorPathFor, headPathFor, makeHead, verifyChain, verifyChainAgainstHead, verifyHashChain, ChainVerifier, AuditKeyError, GENESIS_HASH, AUDIT_KEY_BYTES, AUDIT_KEY_ENV, AUDIT_KEY_FILENAME, AUDIT_HEAD_FILENAME, AUDIT_FLOOR_SUFFIX, type AnchorClaim, type AuditKey, type AuditKeySource, type ChainFailureReason, type ChainVerifyResult, type ChainVerifyOptions, type MacInput, type ResolvedAnchor, type WriteHeadOptions, type LoadAuditKeyOptions, } from './chain';
+export { fingerprintStatement, previewStatement, redactSqlLiterals, isUnredactable, UNREDACTABLE, PREVIEW_MAX_LENGTH, } from './redact';
+export { LocalAuditWriter, verifyAuditLog, verifyStream, ACTIVE_AUDIT_FILE, type LocalWriterOptions, type AppendOptions, type VerifyAuditLogOptions, type VerifyStreamOptions, type AuditLogVerification, } from './local-writer';
+export { CloudAuditWriter, type CloudWriterConfig, type CloudWriterResult } from './cloud-writer';
+export { AuditSink, type AuditSinkOptions, type PendingEvent } from './sink';
+export { UNRESOLVED_DB_ALIAS, UNRESOLVED_DB_IDENTITY, currentResolvedDbIdentity, resolvedIdentityOf, withResolvedDatabase, type ResolvedDbIdentity, } from './context';
+export { getAuditFilesChronological, getAuditFilesReverse, readAuditLogChronological, ensureAuditDir, probeAuditDir, repairAuditDirMode, AUDIT_DIR_MODE, AUDIT_FILE_MODE, parseSince, eventMatchesFilter, readAuditEvents, type AuditLogFilter, type AuditLogReadResult, type AuditDirProbe, } from './files';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/audit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/audit/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,WAAW,EACX,aAAa,EACb,YAAY,EACZ,UAAU,EACV,SAAS,EACT,oBAAoB,EACpB,UAAU,EACV,SAAS,EACT,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,GAChB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,WAAW,EACX,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,QAAQ,EACR,aAAa,EACb,aAAa,EACb,SAAS,EACT,cAAc,EACd,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,WAAW,EACX,sBAAsB,EACtB,eAAe,EACf,aAAa,EACb,aAAa,EACb,YAAY,EACZ,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,GACzB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,kBAAkB,GACnB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAElG,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,KAAK,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE7E,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,EACzB,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,kBAAkB,GACxB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,yBAAyB,EACzB,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,aAAa,GACnB,MAAM,SAAS,CAAC"}

package/dist/esm/audit/index.js

@@ -0,0 +1,8 @@
+export { computeHash, computeMac, computeEventMac, canonicalStringify, isHash64, loadAuditKey, tryLoadAuditKey, decodeKeyMaterial, deriveChainId, readHead, readHeadFloor, resolveAnchor, writeHead, writeHeadFloor, floorPathFor, headPathFor, makeHead, verifyChain, verifyChainAgainstHead, verifyHashChain, ChainVerifier, AuditKeyError, GENESIS_HASH, AUDIT_KEY_BYTES, AUDIT_KEY_ENV, AUDIT_KEY_FILENAME, AUDIT_HEAD_FILENAME, AUDIT_FLOOR_SUFFIX, } from './chain';
+export { fingerprintStatement, previewStatement, redactSqlLiterals, isUnredactable, UNREDACTABLE, PREVIEW_MAX_LENGTH, } from './redact';
+export { LocalAuditWriter, verifyAuditLog, verifyStream, ACTIVE_AUDIT_FILE, } from './local-writer';
+export { CloudAuditWriter } from './cloud-writer';
+export { AuditSink } from './sink';
+export { UNRESOLVED_DB_ALIAS, UNRESOLVED_DB_IDENTITY, currentResolvedDbIdentity, resolvedIdentityOf, withResolvedDatabase, } from './context';
+export { getAuditFilesChronological, getAuditFilesReverse, readAuditLogChronological, ensureAuditDir, probeAuditDir, repairAuditDirMode, AUDIT_DIR_MODE, AUDIT_FILE_MODE, parseSince, eventMatchesFilter, readAuditEvents, } from './files';
+//# sourceMappingURL=index.js.map

package/dist/esm/audit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/audit/index.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,WAAW,EACX,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,QAAQ,EACR,aAAa,EACb,aAAa,EACb,SAAS,EACT,cAAc,EACd,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,WAAW,EACX,sBAAsB,EACtB,eAAe,EACf,aAAa,EACb,aAAa,EACb,YAAY,EACZ,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,GAWnB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,kBAAkB,GACnB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,iBAAiB,GAMlB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAkD,MAAM,gBAAgB,CAAC;AAElG,OAAO,EAAE,SAAS,EAA4C,MAAM,QAAQ,CAAC;AAE7E,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,EACzB,kBAAkB,EAClB,oBAAoB,GAErB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,yBAAyB,EACzB,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,eAAe,GAIhB,MAAM,SAAS,CAAC"}

package/dist/esm/audit/local-writer.d.ts

@@ -0,0 +1,255 @@
+import { AUDIT_HEAD_FILENAME, type ChainVerifyResult } from './chain';
+import { AuditEvent, AuditHead, AuditWriterHealth } from './types';
+export interface LocalWriterOptions {
+    dir: string;
+    /** Rotate the active log past this size. Default 10 MiB. */
+    maxFileSize?: number;
+    /** Number of rotated archives to keep. Default 10. */
+    maxArchiveFiles?: number;
+    /** Mode for the log files themselves. Default 0o600. */
+    fileMode?: number;
+    /**
+     * Mode for the audit **directory**. Default 0o700.
+     *
+     * This must be a directory mode. A directory at 0o600 has no execute bit, is
+     * therefore untraversable, and every write into it fails EACCES — which is how
+     * a clean install ended up with no audit trail at all (finding C-06).
+     */
+    dirMode?: number;
+    /** Group-commit interval for non-durable appends. Default 50ms. */
+    flushIntervalMs?: number;
+    /** Appends buffered before a group commit is forced. Default 256. */
+    batchSize?: number;
+}
+export interface AppendOptions {
+    /**
+     * When true (the default) the record is written and `fsync`'d before the
+     * returned promise resolves. `logSync()` depends on this; `log()` does not.
+     */
+    durable?: boolean;
+}
+export declare const ACTIVE_AUDIT_FILE = "audit.jsonl";
+/** Notified after a successful fsync with the newest durable record. */
+export type CommitListener = (last: AuditEvent | null, retainedFromSeq: number | null) => void;
+/**
+ * Append-only local audit writer with group commit.
+ *
+ * Durability contract:
+ *   - `append(event, { durable: true })` resolves only after the record has been
+ *     written and `fsync`'d. This is what `AuditSink.logSync()` relies on.
+ *   - `append(event, { durable: false })` resolves once the record has been
+ *     handed to the kernel; a group commit `fsync`s it within `flushIntervalMs`,
+ *     or immediately once `batchSize` records are buffered. This is what
+ *     `AuditSink.log()` uses.
+ *   - `flush()` forces the outstanding `fsync`; `close()` flushes, `fsync`s and
+ *     releases the handle. Both are safe to call more than once and safe to race
+ *     with `append()`: every mutating operation is serialised on one chain, so a
+ *     concurrent append either lands before the close or reopens afterwards. A
+ *     failure in either is reported through `getHealth()` and rethrown — never
+ *     swallowed into a "flushed OK".
+ *
+ * One long-lived handle replaces the previous open/fsync/close per event, and
+ * the `mkdir` + `stat` per event are gone from the hot path (finding M-05).
+ */
+export declare class LocalAuditWriter {
+    private readonly opts;
+    private readonly activePath;
+    private lastKnownSize;
+    /** Serialises mutating operations so fd/size/rotation state stays coherent. */
+    private opChain;
+    private handle;
+    private unflushedBytes;
+    private pendingRecords;
+    private flushTimer;
+    private lastError;
+    private lastErrorAt;
+    private lastWriteAt;
+    private dirMode;
+    private fileMode;
+    private ready;
+    private reportedError;
+    private rotations;
+    private eventsWritten;
+    private eventsFailed;
+    private bytesWritten;
+    private commitListener;
+    private lastAppended;
+    private retainedFromSeq;
+    constructor(opts: LocalWriterOptions);
+    get dir(): string;
+    get activeFilePath(): string;
+    /**
+     * Registers the durable-commit hook. `AuditSink` uses it to anchor the chain
+     * head at exactly the point where records became durable.
+     */
+    setCommitListener(fn: CommitListener | null): void;
+    /**
+     * Oldest sequence number still on disk, or null when no record is retained.
+     *
+     * Rotation keeps a bounded number of archives, so the oldest records are
+     * eventually evicted on purpose. Whole-log verification therefore starts at
+     * this sequence number rather than at the genesis hash (finding M-06/H-13
+     * interaction: an evicted archive used to make every later verify report a
+     * phantom `seq_gap`).
+     */
+    getRetentionFloor(): number | null;
+    append(event: AuditEvent, opts?: AppendOptions): Promise<void>;
+    /**
+     * Creates the audit directory (0o700, repairing a stuck 0o600 one) and opens
+     * the log file (0o600). Called before the chain head is anchored so a broken
+     * install is repaired before anything tries to use the directory.
+     */
+    prepare(): Promise<void>;
+    /** Forces an fsync of everything written but not yet committed. */
+    flush(): Promise<void>;
+    /**
+     * Flushes every buffered record, `fsync`s it, then closes the long-lived
+     * handle. The writer stays usable afterwards — a later `append()` reopens.
+     *
+     * Shutdown contract, and the reason the daemon may call it after a signal and
+     * again on an explicit stop:
+     *   - **Idempotent.** A second `close()` is a no-op that resolves: the handle
+     *     is cleared before it is closed, so the descriptor can never be closed
+     *     twice.
+     *   - **Nothing is buffered on return.** The group-commit timer is cancelled
+     *     first, so it cannot fire against a closed descriptor afterwards.
+     *   - **The handle is released even when the flush fails.** Otherwise a
+     *     failing fsync would leak the descriptor *and* hide behind a rejected
+     *     promise that a caller may not await. The flush error is reported through
+     *     `getHealth()` and rethrown; it is never turned into a fake "flushed OK".
+     */
+    close(): Promise<void>;
+    /** Rotates the active file. Chain continuity is the caller's to preserve. */
+    rotate(): Promise<void>;
+    getHealth(): AuditWriterHealth;
+    /**
+     * Loads every record of the log, oldest archive first.
+     *
+     * Kept for small callers (filters, tests). It materialises the whole history,
+     * so verification goes through {@link verifyAuditLog} instead of this
+     * (finding M-06).
+     */
+    readAll(opts?: {
+        limit?: number;
+    }): Promise<AuditEvent[]>;
+    /** Streams every record in chronological order, one record at a time. */
+    stream(opts?: {
+        maxRecords?: number;
+    }): AsyncGenerator<AuditEvent, void, void>;
+    /**
+     * Newest record of the newest non-empty log file.
+     *
+     * Startup chain recovery: the in-memory head is gone after a restart and
+     * `head.json` can be a tick behind the last durable append. Returns `null`
+     * when the log is empty or unreadable.
+     */
+    readTailEvent(maxBytes?: number): Promise<AuditEvent | null>;
+    private run;
+    private writeRecord;
+    private ensureReady;
+    /**
+     * Reads the sequence number of the oldest record still on disk.
+     *
+     * The oldest archive is `audit-<maxArchiveFiles>.jsonl` (higher index = older),
+     * and the floor only moves up: it is a promise about what the log retains, so
+     * it must never go backwards.
+     */
+    private refreshRetentionFloor;
+    /**
+     * Repairs a directory left untraversable by an older version. `mkdir` is a
+     * no-op when the directory already exists, so without this the wrong mode is
+     * sticky and every append keeps failing EACCES (finding C-06).
+     */
+    private repairDirMode;
+    private currentFileSize;
+    private flushNow;
+    /**
+     * A failure to anchor the head does not undo the records already on disk, so
+     * it is reported rather than thrown — but it is never swallowed either: the
+     * writer goes unhealthy and says so once.
+     */
+    private notifyCommit;
+    private scheduleFlush;
+    private cancelFlushTimer;
+    private rotateNow;
+    private closeHandle;
+    private dropHandle;
+    /**
+     * Records the failure and complains once per distinct error, so audit loss is
+     * loud without one stack trace per query.
+     */
+    private recordFailure;
+    private noteSuccess;
+}
+export interface VerifyAuditLogOptions {
+    /** Signing key. Defaults to `SW_AGENT_AUDIT_KEY` / `audit.key`. */
+    key?: Buffer | string;
+    /** Expected head. Defaults to `head.json` in `dir`; pass `null` to skip. */
+    head?: AuditHead | null;
+    /** Directory/keyfile to resolve the key from when `key` is omitted. */
+    keyDir?: string;
+    /** Stop after this many records. Guards against a runaway log. */
+    maxRecords?: number;
+    /** First sequence number the log must carry. Defaults to the head's retention floor, else 1. */
+    expectedSeq?: number;
+}
+export interface AuditLogVerification extends ChainVerifyResult {
+    /** Log files walked, oldest first. */
+    files: string[];
+    /** Records that were not parseable JSON. */
+    malformed_lines: number;
+    /** Files that exist but could not be read. */
+    unreadable_files: string[];
+    head_present: boolean;
+    chain_id: string | null;
+    /** Every anchor that was consulted, in the order given. */
+    anchor_sources: string[];
+    /** Which of them decided the verdict. */
+    anchor_source: string | null;
+}
+export interface VerifyStreamOptions {
+    /** Signing key. There is no unkeyed verification. */
+    key: Buffer | string;
+    /** Expected head. When omitted the stream is verified for internal consistency only. */
+    head?: AuditHead | null;
+    /** Sequence number the first record must carry. Default 1. */
+    expectedSeq?: number;
+    /** Hash the first record must chain from. Defaults to the genesis hash. */
+    expectedPrevHash?: string;
+    /** Chain id every record must carry. Default: pinned from the first record. */
+    chainId?: string;
+    /** Stop after this many records. */
+    maxRecords?: number;
+}
+/**
+ * Incremental verification of an ordered record stream, with early exit on the
+ * first bad record (finding M-06).
+ *
+ * Holds only the previous record's mac/seq, so peak memory is O(1) in the
+ * number of records. Anything that is not an object is treated as corruption
+ * rather than skipped: silently ignoring an unreadable line would let an
+ * attacker delete records that a partial write happened to break.
+ */
+export declare function verifyStream(source: AsyncIterable<unknown> | Iterable<unknown>, opts: VerifyStreamOptions): Promise<ChainVerifyResult>;
+/**
+ * Verifies the whole audit log as one chronological sequence across rotated
+ * files, anchored on the strongest available claim about where the chain ends.
+ *
+ * Two anchors are consulted: `head.json` inside the audit directory and the
+ * monotonic floor beside it. Either alone can be rolled back together with the
+ * log; the pair cannot, which is what makes a restored older copy detectable
+ * (finding C-05).
+ *
+ * The entry point CLI commands should call: it resolves the key, reads the
+ * anchors, streams the log in O(1) memory and early-exits on the first bad
+ * record (findings C-05, H-13, M-06).
+ */
+export declare function verifyAuditLog(dir: string, opts?: VerifyAuditLogOptions): Promise<AuditLogVerification>;
+export { AUDIT_HEAD_FILENAME };
+/**
+ * Re-exported so callers that already import from this module (setup paths,
+ * `doctor`, `init`) have one obvious entry point. The implementation lives in
+ * `./files` because it needs no writer state.
+ */
+export { AUDIT_DIR_MODE, AUDIT_FILE_MODE, ensureAuditDir, probeAuditDir, repairAuditDirMode, } from './files';
+//# sourceMappingURL=local-writer.d.ts.map