approval-md 0.0.1 → 0.2.0

package/dist/src/core/verify.js

@@ -0,0 +1,549 @@
+/**
+ * Hash-chain verification for `.approval/log/events.jsonl` (SPEC.md §8:
+ * "`approval log verify` MUST detect any mutation or truncation").
+ *
+ * This module is the read side of the append-only log. It re-derives every
+ * record's digest from its canonical serialization and walks the `prev` chain
+ * and the `seq` succession end to end, reporting the *first* place the log
+ * stops being self-consistent.
+ *
+ * **Read-only, by definition.** Verification opens the log for reading and
+ * nothing else: it never truncates, never rewrites, never repairs, and never
+ * creates a lockfile. A torn tail is *reported*, never auto-truncated — a log
+ * that heals itself is a log that can be made to forget. Repair is a human
+ * decision, made explicitly: a later CLI task may offer it behind an explicit
+ * flag, but the core provides detection only.
+ *
+ * **What verification detects.** Any mutation of a record without a full
+ * recompute of every descendant; truncation of the tail (with an external
+ * anchor); deletion, insertion, reorder, or splice anywhere in the chain;
+ * `alg` tampering; a malformed or schema-invalid line; a duplicated or skipped
+ * `seq`; a non-genesis first record; and — given an anchor — a fully
+ * recomputed forged suffix.
+ *
+ * **The detection boundary — state it plainly.** A hash chain is
+ * tamper-*evident*, not tamper-*proof*. A forger who rewrites record N and then
+ * recomputes every descendant (new hash, fixed `prev`) produces a file that is
+ * internally self-consistent in every respect, and `verify(logPath)` on that
+ * file alone CANNOT distinguish it from an honest log. The same is true of
+ * dropping records off the tail: the surviving prefix is a valid chain. Closing
+ * that gap requires something the forger does not control:
+ *
+ * - an externally anchored head — pass {@link VerifyOptions.expectedHead} with
+ *   a `(seq, hash)` pair recorded elsewhere (a channel message, another host, a
+ *   human's notes); a mismatch is reported as `head-mismatch`;
+ * - a retained copy of the log held outside the writer's reach;
+ * - the optional per-event git commits of SPEC.md §8, where the daemon commits
+ *   each record under its own identity, giving signed, distributed evidence.
+ *
+ * Three questions that keep arriving separately have one answer (APRV-141, F7):
+ * the digest covers each record's CANONICAL CONTENT, its RFC 8785
+ * serialization, and never the bytes of the line it was read from, so a
+ * re-serialization that changes only byte format verifies clean, a line
+ * carrying a duplicate key is settled by the JSON parse that precedes
+ * canonicalization rather than by the chain, and an unanchored tail truncation
+ * leaves a valid prefix that nothing inside the file can contradict.
+ *
+ * **Anomalies, which are reported and never enforced (APRV-40).** SPEC.md §8
+ * requires that "verification treats gate-type events with implausible skew
+ * relative to their neighbors as a reportable anomaly, never silently accepted".
+ * Every non-corrupt result therefore carries {@link VerifyResult.anomalies}, a
+ * list that says nothing about integrity: a clean log with anomalies is clean,
+ * exits 0, and authorizes exactly what it authorized before. The separation is
+ * the point. Chain integrity is a proof, skew is a judgment, and folding a
+ * judgment into a proof would turn `log verify` into a check people learn to
+ * pass a flag to silence. See {@link chainAnomalies}.
+ *
+ * Determinism: the result is a pure function of (log bytes, schema files,
+ * options). No clock, no network, no cross-call state — the anomaly pass reads
+ * the records' own timestamps and never the current time.
+ */
+import { readFileSync } from "node:fs";
+import { ALG, computeRecordHash } from "./log.js";
+import { loadPolicy } from "./policy-load.js";
+import { prepareValidator } from "./validate.js";
+// ---------------------------------------------------------------------------
+// Anomalies (SPEC.md §8, timestamp rules) — reportable, never a verdict
+// ---------------------------------------------------------------------------
+/**
+ * SPEC.md §8: "Events written through the gate (`approval.*`, `execution.*`,
+ * `budget.*`, `audit.*`, `policy.updated`) have `ts` assigned by the runtime at
+ * the write boundary."
+ *
+ * These are the types whose timestamps the runtime authored, so these are the
+ * only types whose timestamps the runtime may be held to. Every other type is
+ * writable directly by callers who legitimately supply their own `ts` (an
+ * importer replaying a historical log is the obvious case), so comparing them
+ * would manufacture anomalies out of correct behavior.
+ */
+function isGateTyped(event) {
+    return (event.startsWith("approval.") ||
+        event.startsWith("execution.") ||
+        event.startsWith("budget.") ||
+        event.startsWith("audit.") ||
+        // Amended SPEC.md §8 (APRV-127): `reconciliation.*` is written through the
+        // gate for the same reason `audit.*` is. The obligation is appended by the
+        // runtime as a consequence of a human's denial and the satisfaction is a
+        // human's act recorded at the write boundary; neither takes a caller's
+        // clock, so both may be held to the runtime's.
+        event.startsWith("reconciliation.") ||
+        // Amended SPEC.md §8 (APRV-214): `gate.*` is written through the write
+        // boundary clock like everything above it. The open window's expiry is
+        // derived from `gate.opened`'s own `ts`, so an opener who could author that
+        // timestamp could author the window's length; holding the trio to the
+        // runtime's clock is what makes §8's skew report cover it.
+        event.startsWith("gate.") ||
+        // Amended SPEC.md §8/§9 (APRV-220): a checkpoint's whole content is a claim
+        // about a moment — "this head was signed then" — so its `ts` is stamped at
+        // the write boundary, and a signer who could author it could backdate the
+        // one record whose value is when it was taken.
+        event === "log.checkpoint" ||
+        event === "policy.updated");
+}
+/**
+ * The skew allowance, in milliseconds, before a backwards step between two
+ * gate-typed records is reported.
+ *
+ * ### Why 2 seconds, and why any number at all
+ *
+ * Gate-typed timestamps are stamped by `core/clock.ts` at the write boundary. In
+ * one process they come from one `Date.now()` and never go backwards. Across
+ * processes and hosts — the daemon on one machine, a CLI verb on another, both
+ * appending to a shared log — they come from separate wall clocks, and two
+ * healthy NTP-disciplined clocks routinely disagree by tens of milliseconds and
+ * occasionally by a few hundred during a step correction. A tolerance of zero
+ * would therefore report ordinary distributed operation as an anomaly, which is
+ * the fastest way to make an anomaly channel ignored.
+ *
+ * 2000 ms is chosen as roughly an order of magnitude above the disagreement a
+ * synchronized fleet actually exhibits, and two to three orders of magnitude
+ * below the skew that a *useful* lie requires. The thing this check exists to
+ * catch is a timestamp placed to change a judgment: a `ts` inside a lapsed TTL
+ * (minutes to hours), or one moved outside a rolling budget window (hours). No
+ * attack is bought by 1.9 seconds, and no healthy fleet needs 2.1.
+ *
+ * It is the DEFAULT rather than the only value since APRV-58: an operator
+ * running a single host may tighten it to 250 ms, one running across a WAN with
+ * poor time discipline may loosen it to 5 s, and `audit.skew_tolerance` in the
+ * policy is where they say so. A policy that declares nothing (or that fails to
+ * load at all) leaves this number in force, so the reference runtime still has
+ * exactly one value that every reader can see.
+ *
+ * Widening the tolerance permits nothing: the threshold is report-only in both
+ * directions, so a loosened value hides evidence from a human and cannot make
+ * any action allowed that was refused before.
+ */
+export const GATE_TS_SKEW_TOLERANCE_MS = 2_000;
+/**
+ * `audit.skew_tolerance` in milliseconds, or the default when it says nothing.
+ *
+ * Fails closed to the default exactly as `daemon/prune.ts`'s retention read
+ * does: a policy that cannot be loaded configures nothing, and for THIS key the
+ * safe fallback is the shipped number rather than zero — a zero allowance would
+ * report every ordinary clock disagreement as an anomaly, and an anomaly channel
+ * that cries wolf is one operators stop reading. An unparseable duration never
+ * reaches here: the schema's duration pattern rejects it and `loadPolicy` fails
+ * the whole policy, precisely as a bad `defaults.approval_ttl` does.
+ */
+export function skewToleranceMsOf(policy, schemaDir) {
+    const where = policy.file !== undefined ? { file: policy.file } : { dir: policy.dir ?? process.cwd() };
+    if (schemaDir !== undefined)
+        where.schemaDir = schemaDir;
+    const load = loadPolicy(where);
+    if (!load.ok)
+        return GATE_TS_SKEW_TOLERANCE_MS;
+    return load.durations.skewToleranceMs ?? GATE_TS_SKEW_TOLERANCE_MS;
+}
+/**
+ * Machine-readable anomaly kinds. Closed union, additive-only, each pinned by a
+ * test — the same contract every other frozen union in this codebase carries.
+ */
+export const CHAIN_ANOMALY_KINDS = [
+    /**
+     * A gate-typed record's `ts` is earlier than the previous gate-typed record's
+     * `ts` by more than {@link GATE_TS_SKEW_TOLERANCE_MS}.
+     *
+     * One kind covers both directions SPEC.md §8 describes. "Earlier than its
+     * predecessor" and "later than its successor" are the same disagreement seen
+     * from the two ends of one adjacent pair, and reporting it twice would double
+     * every entry without adding a fact.
+     */
+    "gate-ts-regression",
+];
+/**
+ * Timestamp anomalies among the gate-typed records of a verified chain.
+ *
+ * Pure: a function of the records alone, with no clock and no I/O. Comparison is
+ * between each gate-typed record and the previous **gate-typed** record, not the
+ * previous record of any kind, for the reason {@link isGateTyped} states.
+ *
+ * This changes no verdict. A log full of anomalies is still `clean` if its chain
+ * verifies, still exits 0, and still authorizes exactly what it authorized
+ * before. Skew is evidence for a human to weigh, and a verifier that refused on
+ * it would be refusing on a heuristic — which is how a tamper-evidence tool
+ * starts being run with a flag that turns it off.
+ */
+export function chainAnomalies(records, toleranceMs = GATE_TS_SKEW_TOLERANCE_MS) {
+    const anomalies = [];
+    let previous = null;
+    for (const record of records) {
+        if (!isGateTyped(record.event))
+            continue;
+        const millis = Date.parse(record.ts);
+        if (Number.isNaN(millis))
+            continue; // the schema's date-time format precedes this
+        if (previous !== null) {
+            const skewMs = previous.millis - millis;
+            if (skewMs > toleranceMs) {
+                anomalies.push({
+                    kind: "gate-ts-regression",
+                    seq: record.seq,
+                    ts: record.ts,
+                    event: record.event,
+                    previousSeq: previous.seq,
+                    previousTs: previous.ts,
+                    skewMs,
+                    message: `record ${record.seq} (${record.event}) is timestamped ${record.ts}, ${String(skewMs)}ms BEFORE the previous gate-typed record ${previous.seq} at ${previous.ts}. Gate-typed timestamps are stamped by the runtime at the write boundary (SPEC.md §8), so a backwards step larger than ${String(toleranceMs)}ms means either a clock that stepped backwards or a timestamp that was authored rather than stamped. The chain still verifies and nothing is refused: this is reported for a human to weigh, because TTL judgment and budget windows read ts.`,
+                });
+            }
+        }
+        previous = { seq: record.seq, ts: record.ts, millis };
+    }
+    return anomalies;
+}
+/**
+ * How many records pass between progress calls.
+ *
+ * Count-based rather than time-based, and reported here rather than throttled
+ * here: this module has no clock, a listener that fires on a deterministic
+ * schedule is a listener a test can assert on exactly, and the decision about
+ * how often a HUMAN should see a repaint belongs to the thing holding the
+ * terminal (`cli/progress.ts`), which is the only layer that knows whether
+ * there is one.
+ */
+export const PROGRESS_INTERVAL = 250;
+/** The tolerance a verification run should apply, from its options alone. */
+function toleranceOf(options) {
+    if (options.skewToleranceMs !== undefined)
+        return options.skewToleranceMs;
+    if (options.policy === undefined)
+        return GATE_TS_SKEW_TOLERANCE_MS;
+    return skewToleranceMsOf(options.policy, options.schemaDir);
+}
+function corrupt(reason, firstBadSeq, message) {
+    // A chain that does not verify gets no anomaly report. Anomalies are a
+    // secondary reading of records the walk vouched for, and reading timestamps
+    // off a log whose integrity is in question would dress up untrusted bytes as
+    // findings. The corruption is the finding.
+    return { status: "corrupt", firstBadSeq, reason, message, anomalies: [] };
+}
+/** `seq` as reported by a raw parsed line, or `null` when unusable. */
+function readSeq(record) {
+    const seq = record["seq"];
+    return typeof seq === "number" && Number.isInteger(seq) && seq >= 1 ? seq : null;
+}
+/**
+ * Split the raw file into complete lines plus an optional torn tail.
+ *
+ * A torn tail is *only* an unterminated final segment. {@link appendEvent}
+ * writes `line + "\n"` in a single `write(2)` on an `O_APPEND` handle, so a
+ * crashed writer can leave a partial line but cannot leave a complete,
+ * newline-terminated line that is malformed. A malformed line that *is*
+ * newline-terminated is therefore corruption, not a torn write, and is reported
+ * as such wherever it appears — final line included.
+ */
+function splitLines(raw) {
+    const segments = raw.split("\n");
+    const last = segments[segments.length - 1] ?? "";
+    if (last.length === 0) {
+        segments.pop(); // the empty segment after the final newline
+        return { complete: segments, torn: null };
+    }
+    segments.pop();
+    return { complete: segments, torn: last };
+}
+const GENESIS_START = { prevSeq: 0, prevHash: null, lineNumberBase: 0 };
+/**
+ * Walk `lines` as a hash chain. Returns `null` when the whole prefix verifies,
+ * otherwise the first failure.
+ *
+ * Check order per record — earlier checks report the more specific reason:
+ *
+ * 1. the line parses as a JSON object (`malformed-line`);
+ * 2. `alg` is exactly `sha256/jcs` (`bad-alg`). Checked *before* the schema so
+ *    a missing or unrecognized scheme identifier — which SPEC.md §8 requires
+ *    verifiers to reject by name — reports `bad-alg` rather than generic
+ *    schema noise;
+ * 3. the record validates against the `event` schema (`schema-invalid`);
+ * 4. the recomputed digest equals `hash` (`hash-mismatch`);
+ * 5. `seq` is exactly the predecessor's `seq` + 1, and 1 for the first record
+ *    (`seq-duplicate` when it repeats the predecessor, else `seq-gap`);
+ * 6. `prev` is the predecessor's `hash`, and `null` for the first record
+ *    (`prev-mismatch`, or `not-genesis` for a first record with a non-null
+ *    `prev`).
+ *
+ * Fails closed throughout: anything that cannot be shown to be sound is a
+ * failure, never a pass.
+ */
+function walk(lines, validateOptions, start, 
+/**
+ * Called with the number of lines consumed so far, every
+ * {@link PROGRESS_INTERVAL} records (APRV-167). Purely observational; see
+ * {@link VerifyOptions.onProgress}.
+ */
+report = null) {
+    let prevSeq = start.prevSeq;
+    let prevHash = start.prevHash;
+    const verified = [];
+    // Compiled once, on the first record that needs it, and reused for every
+    // record after: a per-record recompile is what turned a cold walk of a few
+    // thousand records into minutes of CPU (APRV-186). Lazy so that a walk over
+    // zero lines still never touches the schema directory, exactly as before.
+    let eventValidator = null;
+    for (const [index, line] of lines.entries()) {
+        const lineNumber = start.lineNumberBase + index + 1;
+        if (line.trim().length === 0) {
+            return {
+                failure: corrupt("malformed-line", null, `line ${lineNumber} is blank`),
+                head: null,
+                records: verified,
+            };
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(line);
+        }
+        catch (cause) {
+            const detail = cause instanceof Error ? cause.message : String(cause);
+            return {
+                failure: corrupt("malformed-line", null, `line ${lineNumber} is not valid JSON: ${detail}`),
+                head: null,
+                records: verified,
+            };
+        }
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+            return {
+                failure: corrupt("malformed-line", null, `line ${lineNumber} is not a JSON object`),
+                head: null,
+                records: verified,
+            };
+        }
+        const raw = parsed;
+        const seq = readSeq(raw);
+        if (raw["alg"] !== ALG) {
+            const found = raw["alg"] === undefined ? "missing" : JSON.stringify(raw["alg"]);
+            return {
+                failure: corrupt("bad-alg", seq, `line ${lineNumber}: hash-scheme identifier "alg" is ${found}, expected "${ALG}"`),
+                head: null,
+                records: verified,
+            };
+        }
+        eventValidator ??= prepareValidator("event", validateOptions);
+        const validation = eventValidator.ok ? eventValidator.check(raw) : eventValidator;
+        if (!validation.ok) {
+            const detail = validation.errors
+                .map((error) => `${error.path === "" ? "/" : error.path} ${error.message}`)
+                .join("; ");
+            return {
+                failure: corrupt("schema-invalid", seq, `line ${lineNumber} does not validate against the event schema: ${detail}`),
+                head: null,
+                records: verified,
+            };
+        }
+        // Schema-valid: the chain fields are now known to have their declared shapes.
+        const record = raw;
+        let recomputed;
+        try {
+            recomputed = computeRecordHash(record);
+        }
+        catch (cause) {
+            const detail = cause instanceof Error ? cause.message : String(cause);
+            return {
+                failure: corrupt("hash-mismatch", record.seq, `record ${record.seq} could not be canonicalized for hashing: ${detail}`),
+                head: null,
+                records: verified,
+            };
+        }
+        if (recomputed !== record.hash) {
+            return {
+                failure: corrupt("hash-mismatch", record.seq, `record ${record.seq} hash ${record.hash} does not match its contents (recomputed ${recomputed})`),
+                head: null,
+                records: verified,
+            };
+        }
+        if (record.seq !== prevSeq + 1) {
+            const duplicate = prevSeq > 0 && record.seq === prevSeq;
+            return {
+                failure: corrupt(duplicate ? "seq-duplicate" : "seq-gap", record.seq, duplicate
+                    ? `line ${lineNumber} repeats seq ${record.seq}`
+                    : `line ${lineNumber} has seq ${record.seq}, expected ${prevSeq + 1}`),
+                head: null,
+                records: verified,
+            };
+        }
+        if (prevHash === null) {
+            if (record.prev !== null) {
+                return {
+                    failure: corrupt("not-genesis", record.seq, `record ${record.seq} is the first record but its prev is ${JSON.stringify(record.prev)}, expected null`),
+                    head: null,
+                    records: verified,
+                };
+            }
+        }
+        else if (record.prev !== prevHash) {
+            return {
+                failure: corrupt("prev-mismatch", record.seq, `record ${record.seq} prev ${JSON.stringify(record.prev)} does not link to record ${prevSeq} hash ${prevHash}`),
+                head: null,
+                records: verified,
+            };
+        }
+        prevSeq = record.seq;
+        prevHash = record.hash;
+        verified.push(record);
+        if (report !== null && (index + 1) % PROGRESS_INTERVAL === 0)
+            report(index + 1);
+    }
+    return {
+        failure: null,
+        head: prevHash === null ? null : { seq: prevSeq, hash: prevHash },
+        records: verified,
+    };
+}
+/**
+ * {@link verify}, returning the verified records alongside the verdict.
+ *
+ * This exists so that a reader which needs *both* — the gate, the token module,
+ * the executor, via `core/state.ts` — can have one walk produce both, rather
+ * than verifying with this module and then parsing the same bytes a second time
+ * with a private walk that could disagree with it (APRV-20 finding S1).
+ */
+export function verifyWithRecords(logPath, options = {}) {
+    let raw;
+    try {
+        raw = readFileSync(logPath, "utf8");
+    }
+    catch (cause) {
+        if (cause.code !== "ENOENT") {
+            const detail = cause instanceof Error ? cause.message : String(cause);
+            return {
+                result: corrupt("malformed-line", null, `log ${logPath} could not be read: ${detail}`),
+                records: [],
+            };
+        }
+        // An absent file is an empty log — but it still has to satisfy an anchor,
+        // so it falls through to the same walk rather than short-circuiting here.
+        raw = "";
+    }
+    return verifyText(logPath, raw, options, null);
+}
+/**
+ * {@link verifyWithRecords} over text already in hand, optionally resuming
+ * behind a {@link VerifiedPrefix}.
+ *
+ * With `prefix === null`, `text` is the whole log and the walk starts at
+ * genesis: this is exactly what {@link verifyWithRecords} does, and the two
+ * share every check, message, and line number as a result. With a `prefix`,
+ * `text` is the *remainder* of the file (the bytes from `prefix.byteLength` on)
+ * and the walk chains onto `prefix.head` with line numbers offset by
+ * `prefix.lines`, so a resumed verdict is textually identical to the cold one.
+ *
+ * Exported for `core/state.ts`'s verified-read cache and for nothing else. Every
+ * schema check, hash recompute, `seq` succession check, and `prev` link check
+ * still runs on every record the walk covers; resuming changes only *which*
+ * records are covered, never how.
+ */
+export function verifyText(logPath, text, options = {}, prefix = null) {
+    // The read boundary, explicitly (APRV-121). A record that was valid when it
+    // was appended stays valid forever: the log is append-only, so a verifier
+    // that refused the monetary representation of its own history would declare
+    // every log written before the change corrupt. The write boundary is
+    // unaffected and stays strict — see `ValidationMode` in `core/validate.ts`.
+    const validateOptions = options.schemaDir === undefined
+        ? { mode: "historical" }
+        : { schemaDir: options.schemaDir, mode: "historical" };
+    const start = prefix === null
+        ? GENESIS_START
+        : { prevSeq: prefix.head.seq, prevHash: prefix.head.hash, lineNumberBase: prefix.lines };
+    const priorRecords = prefix === null ? [] : prefix.records;
+    const priorLines = prefix === null ? 0 : prefix.lines;
+    const { complete, torn } = text.length === 0 ? { complete: [], torn: null } : splitLines(text);
+    // Absolute over the whole log, not over this walk: a resumed read behind a
+    // verified prefix has already accounted for `priorLines` records, and an
+    // operator watching "1500/3000" should not see it restart at zero because
+    // the process happened to hold a warm cache (APRV-167).
+    const progressTotal = priorLines + complete.length;
+    const listener = options.onProgress;
+    let reported = -1;
+    const report = listener === undefined
+        ? null
+        : (consumed) => {
+            // Never twice for the same count, and never backwards: the closing
+            // call below lands on a number an interval boundary may already have
+            // reported, and a listener drawing a bar should not see it repeat.
+            if (consumed <= reported)
+                return;
+            reported = consumed;
+            listener({ done: priorLines + consumed, total: progressTotal });
+        };
+    const walked = walk(complete, validateOptions, start, report);
+    // The closing call: the count the walk actually reached, which is the total
+    // when the chain held and the verified prefix when it did not. Reporting the
+    // total for a walk that stopped at record 12 would be a progress meter
+    // claiming work that was refused.
+    if (report !== null) {
+        report(walked.failure === null ? complete.length : walked.records.length);
+    }
+    const { failure, head } = walked;
+    const records = priorRecords.length === 0 ? walked.records : [...priorRecords, ...walked.records];
+    const lineCount = priorLines + complete.length;
+    // A corrupt prefix outranks a torn tail: the tear is the least of the log's
+    // problems, and reporting it would understate the damage.
+    if (failure !== null)
+        return { result: failure, records };
+    // Computed once over the records the walk vouched for, and attached to every
+    // non-corrupt verdict. Additive: it changes no status, no exit code, and no
+    // authorization. Clean with anomalies is clean.
+    const anomalies = chainAnomalies(records, toleranceOf(options));
+    if (torn !== null) {
+        return {
+            result: {
+                status: "torn-tail",
+                anomalies,
+                records: lineCount,
+                intactThroughSeq: head === null ? 0 : head.seq,
+                message: `log ${logPath} ends with an unterminated line of ${torn.length} byte(s); records 1..${head === null ? 0 : head.seq} verify clean. This is the signature of a crashed write. The log is NOT repaired here: truncating the torn line is a human decision.`,
+            },
+            records,
+        };
+    }
+    const expected = options.expectedHead;
+    if (expected !== undefined) {
+        if (head === null) {
+            return {
+                result: corrupt("head-mismatch", null, `log ${logPath} is empty but the anchored head is seq ${expected.seq} ${expected.hash}: records have been removed`),
+                records,
+            };
+        }
+        if (head.seq !== expected.seq || head.hash !== expected.hash) {
+            return {
+                result: corrupt("head-mismatch", head.seq, `log ${logPath} ends at seq ${head.seq} ${head.hash}, but the anchored head is seq ${expected.seq} ${expected.hash}: the log is internally consistent, so this is truncation or a fully recomputed forged suffix`),
+                records,
+            };
+        }
+    }
+    return { result: { status: "clean", records: lineCount, head, anomalies }, records };
+}
+/**
+ * Verify the hash chain of the log at `logPath`.
+ *
+ * An absent file is an empty log, which is clean with zero records and a `null`
+ * head — an audit trail that has recorded nothing is not evidence of tampering.
+ *
+ * The file is opened for reading only; see the module header for the recovery
+ * stance and the detection boundary. This is {@link verifyWithRecords} with the
+ * records dropped — one walk, one implementation.
+ */
+export function verify(logPath, options = {}) {
+    return verifyWithRecords(logPath, options).result;
+}
+//# sourceMappingURL=verify.js.map

package/dist/src/core/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/core/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,GAAG,EAAE,iBAAiB,EAAkC,MAAM,UAAU,CAAC;AAClF,OAAO,EAAE,UAAU,EAA0B,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAwB,MAAM,eAAe,CAAC;AAWvE,8EAA8E;AAC9E,wEAAwE;AACxE,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,CACL,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC;QAC7B,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QAC9B,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAC3B,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC1B,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,uEAAuE;QACvE,+CAA+C;QAC/C,KAAK,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACnC,uEAAuE;QACvE,uEAAuE;QACvE,4EAA4E;QAC5E,sEAAsE;QACtE,2DAA2D;QAC3D,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;QACzB,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,+CAA+C;QAC/C,KAAK,KAAK,gBAAgB;QAC1B,KAAK,KAAK,gBAAgB,CAC3B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAE/C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAuC,EACvC,SAAkB;IAElB,MAAM,KAAK,GACT,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;IAC3F,IAAI,SAAS,KAAK,SAAS;QAAE,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,yBAAyB,CAAC;IAC/C,OAAO,IAAI,CAAC,SAAS,CAAC,eAAe,IAAI,yBAAyB,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC;;;;;;;;OAQG;IACH,oBAAoB;CACZ,CAAC;AAmBX;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAC5B,OAA+B,EAC/B,WAAW,GAAW,yBAAyB;IAE/C,MAAM,SAAS,GAAmB,EAAE,CAAC;IACrC,IAAI,QAAQ,GAAuD,IAAI,CAAC;IAExE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,SAAS;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,SAAS,CAAC,8CAA8C;QAElF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;YACxC,IAAI,MAAM,GAAG,WAAW,EAAE,CAAC;gBACzB,SAAS,CAAC,IAAI,CAAC;oBACb,IAAI,EAAE,oBAAoB;oBAC1B,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,WAAW,EAAE,QAAQ,CAAC,GAAG;oBACzB,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,MAAM;oBACN,OAAO,EAAE,UAAU,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,KAAK,oBAAoB,MAAM,CAAC,EAAE,KAAK,MAAM,CACpF,MAAM,CACP,4CAA4C,QAAQ,CAAC,GAAG,OAAO,QAAQ,CAAC,EAAE,0HAA0H,MAAM,CACzM,WAAW,CACZ,+OAA+O;iBACjP,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,QAAQ,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAqGD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC,6EAA6E;AAC7E,SAAS,WAAW,CAAC,OAAsB;IACzC,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,eAAe,CAAC;IAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,yBAAyB,CAAC;IACnE,OAAO,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,OAAO,CACd,MAA2B,EAC3B,WAA0B,EAC1B,OAAe;IAEf,uEAAuE;IACvE,4EAA4E;IAC5E,6EAA6E;IAC7E,2CAA2C;IAC3C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED,uEAAuE;AACvE,SAAS,OAAO,CAAC,MAA+B;IAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACnF,CAAC;AASD;;;;;;;;;GASG;AACH,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,4CAA4C;QAC5D,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5C,CAAC;IACD,QAAQ,CAAC,GAAG,EAAE,CAAC;IACf,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5C,CAAC;AAoBD,MAAM,aAAa,GAAc,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;AAEnF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,IAAI,CACX,KAAe,EACf,eAAgC,EAChC,KAAgB;AAChB;;;;GAIG;AACH,MAAM,GAAwC,IAAI;IAElD,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC5B,IAAI,QAAQ,GAAkB,KAAK,CAAC,QAAQ,CAAC;IAC7C,MAAM,QAAQ,GAAkB,EAAE,CAAC;IAEnC,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,cAAc,GAA+C,IAAI,CAAC;IAEtE,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,cAAc,GAAG,KAAK,GAAG,CAAC,CAAC;QAEpD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,OAAO,EAAE,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,QAAQ,UAAU,WAAW,CAAC;gBACvE,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,QAAQ;aAClB,CAAC;QACJ,CAAC;QAED,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,OAAO;gBACL,OAAO,EAAE,OAAO,CACd,gBAAgB,EAChB,IAAI,EACJ,QAAQ,UAAU,uBAAuB,MAAM,EAAE,CAClD;gBACD,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,QAAQ;aAClB,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO;gBACL,OAAO,EAAE,OAAO,CACd,gBAAgB,EAChB,IAAI,EACJ,QAAQ,UAAU,uBAAuB,CAC1C;gBACD,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,QAAQ;aAClB,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,MAAiC,CAAC;QAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAEzB,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YAChF,OAAO;gBACL,OAAO,EAAE,OAAO,CACd,SAAS,EACT,GAAG,EACH,QAAQ,UAAU,qCAAqC,KAAK,eAAe,GAAG,GAAG,CAClF;gBACD,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,QAAQ;aAClB,CAAC;QACJ,CAAC;QAED,cAAc,KAAK,gBAAgB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;QAClF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM;iBAC7B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;iBAC1E,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,OAAO;gBACL,OAAO,EAAE,OAAO,CACd,gBAAgB,EAChB,GAAG,EACH,QAAQ,UAAU,gDAAgD,MAAM,EAAE,CAC3E;gBACD,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,QAAQ;aAClB,CAAC;QACJ,CAAC;QAED,8EAA8E;QAC9E,MAAM,MAAM,GAAG,GAA6B,CAAC;QAE7C,IAAI,UAAkB,CAAC;QACvB,IAAI,CAAC;YACH,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,OAAO;gBACL,OAAO,EAAE,OAAO,CACd,eAAe,EACf,MAAM,CAAC,GAAG,EACV,UAAU,MAAM,CAAC,GAAG,4CAA4C,MAAM,EAAE,CACzE;gBACD,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,QAAQ;aAClB,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YAC/B,OAAO;gBACL,OAAO,EAAE,OAAO,CACd,eAAe,EACf,MAAM,CAAC,GAAG,EACV,UAAU,MAAM,CAAC,GAAG,SAAS,MAAM,CAAC,IAAI,4CAA4C,UAAU,GAAG,CAClG;gBACD,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,QAAQ;aAClB,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC;YACxD,OAAO;gBACL,OAAO,EAAE,OAAO,CACd,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,EACvC,MAAM,CAAC,GAAG,EACV,SAAS;oBACP,CAAC,CAAC,QAAQ,UAAU,gBAAgB,MAAM,CAAC,GAAG,EAAE;oBAChD,CAAC,CAAC,QAAQ,UAAU,YAAY,MAAM,CAAC,GAAG,cAAc,OAAO,GAAG,CAAC,EAAE,CACxE;gBACD,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,QAAQ;aAClB,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACzB,OAAO;oBACL,OAAO,EAAE,OAAO,CACd,aAAa,EACb,MAAM,CAAC,GAAG,EACV,UAAU,MAAM,CAAC,GAAG,wCAAwC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CACzG;oBACD,IAAI,EAAE,IAAI;oBACV,OAAO,EAAE,QAAQ;iBAClB,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO;gBACL,OAAO,EAAE,OAAO,CACd,eAAe,EACf,MAAM,CAAC,GAAG,EACV,UAAU,MAAM,CAAC,GAAG,SAAS,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,OAAO,SAAS,QAAQ,EAAE,CAC/G;gBACD,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,QAAQ;aAClB,CAAC;QACJ,CAAC;QAED,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC;QACrB,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEtB,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,iBAAiB,KAAK,CAAC;YAAE,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAClF,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE;QACjE,OAAO,EAAE,QAAQ;KAClB,CAAC;AACJ,CAAC;AAeD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,OAAO,GAAkB,EAAE;IAC5E,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,OAAO,OAAO,uBAAuB,MAAM,EAAE,CAAC;gBACtF,OAAO,EAAE,EAAE;aACZ,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,0EAA0E;QAC1E,GAAG,GAAG,EAAE,CAAC;IACX,CAAC;IAED,OAAO,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AACjD,CAAC;AA0BD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,UAAU,CACxB,OAAe,EACf,IAAY,EACZ,OAAO,GAAkB,EAAE,EAC3B,MAAM,GAA0B,IAAI;IAEpC,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,qEAAqE;IACrE,4EAA4E;IAC5E,MAAM,eAAe,GACnB,OAAO,CAAC,SAAS,KAAK,SAAS;QAC7B,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE;QACxB,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAE3D,MAAM,KAAK,GACT,MAAM,KAAK,IAAI;QACb,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC7F,MAAM,YAAY,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IAC3D,MAAM,UAAU,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;IAEtD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAE/F,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,wDAAwD;IACxD,MAAM,aAAa,GAAG,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC;IACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IACpC,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;IAClB,MAAM,MAAM,GACV,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,CAAC,QAAgB,EAAQ,EAAE;YACzB,mEAAmE;YACnE,qEAAqE;YACrE,mEAAmE;YACnE,IAAI,QAAQ,IAAI,QAAQ;gBAAE,OAAO;YACjC,QAAQ,GAAG,QAAQ,CAAC;YACpB,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC;IAER,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9D,4EAA4E;IAC5E,6EAA6E;IAC7E,uEAAuE;IACvE,kCAAkC;IAClC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IACjC,MAAM,OAAO,GACX,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC;IAE/C,4EAA4E;IAC5E,0DAA0D;IAC1D,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAE1D,6EAA6E;IAC7E,4EAA4E;IAC5E,gDAAgD;IAChD,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAEhE,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO;YACL,MAAM,EAAE;gBACN,MAAM,EAAE,WAAW;gBACnB,SAAS;gBACT,OAAO,EAAE,SAAS;gBAClB,gBAAgB,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG;gBAC9C,OAAO,EAAE,OAAO,OAAO,sCAAsC,IAAI,CAAC,MAAM,wBACtE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAC3B,sIAAsI;aACvI;YACD,OAAO;SACR,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO;gBACL,MAAM,EAAE,OAAO,CACb,eAAe,EACf,IAAI,EACJ,OAAO,OAAO,0CAA0C,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,IAAI,6BAA6B,CACnH;gBACD,OAAO;aACR,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC7D,OAAO;gBACL,MAAM,EAAE,OAAO,CACb,eAAe,EACf,IAAI,CAAC,GAAG,EACR,OAAO,OAAO,gBAAgB,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,kCAAkC,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,IAAI,+FAA+F,CAClN;gBACD,OAAO;aACR,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC;AACvF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,MAAM,CAAC,OAAe,EAAE,OAAO,GAAkB,EAAE;IACjE,OAAO,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC;AACpD,CAAC"}

package/dist/src/core/version.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Version constants for the approval.md runtime.
+ *
+ * `SPEC_VERSION` tracks the version of SPEC.md this build implements.
+ */
+export declare const SPEC_VERSION = "0.1.0-draft";
+/** Policy schema version accepted in `APPROVAL.md` frontmatter (`version:`). */
+export declare const POLICY_VERSION = "0.1";

package/dist/src/core/version.js

@@ -0,0 +1,9 @@
+/**
+ * Version constants for the approval.md runtime.
+ *
+ * `SPEC_VERSION` tracks the version of SPEC.md this build implements.
+ */
+export const SPEC_VERSION = "0.1.0-draft";
+/** Policy schema version accepted in `APPROVAL.md` frontmatter (`version:`). */
+export const POLICY_VERSION = "0.1";
+//# sourceMappingURL=version.js.map

package/dist/src/core/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../../../src/core/version.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,aAAa,CAAC;AAE1C,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC"}