atabey-shared 0.0.22 → 0.0.25

package/README.md

@@ -1,6 +1,6 @@
 # [GOV] Atabey Shared — Core Utility Library for AI Governance Platform
 
-[![Version](https://img.shields.io/badge/Version-v0.0.22-blue.svg)](https://github.com/ysf-bkr/atabey)
+[![Version](https://img.shields.io/badge/Version-v0.0.23-blue.svg)](https://github.com/ysf-bkr/atabey)
 [![npm](https://img.shields.io/npm/v/atabey-shared)](https://www.npmjs.com/package/atabey-shared)
 [![License: AGPL-3.0](https://img.shields.io/badge/License-AGPL--3.0-blue.svg)](https://www.gnu.org/licenses/agpl-3.0)
 

package/dist/audit-chain.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Tamper-evident audit hash chain helpers (Phase 1.4).
+ *
+ * Chain: each entry stores prev_hash (previous entry hash or GENESIS) and hash = SHA-256(payload).
+ * Any mutation of historical rows fails verification.
+ */
+export declare const AUDIT_CHAIN_GENESIS = "GENESIS";
+export declare function sha256Hex(payload: string): string;
+/**
+ * Canonical payload for agent execution logs (Storage.saveLog).
+ * MUST stay stable — changing it breaks verification of existing DBs.
+ */
+export declare function buildAgentLogChainPayload(fields: {
+    prevHash: string;
+    agent: string;
+    action: string;
+    traceId: string;
+    status: string;
+    summary: string;
+    timestamp: string;
+}): string;
+/**
+ * Canonical payload for structured Audit.log entries.
+ */
+export declare function buildStructuredAuditChainPayload(fields: {
+    prevHash: string;
+    agent: string;
+    action: string;
+    status: string;
+    traceId: string;
+    timestamp: string;
+    detailsJson: string;
+    errorMessage: string;
+}): string;
+export interface ChainRow {
+    id: number;
+    prev_hash: string | null;
+    hash: string | null;
+}
+export interface ChainVerifyResult {
+    valid: boolean;
+    checked: number;
+    failedLogId?: number;
+    reason?: string;
+    tip?: string;
+}
+/**
+ * Verify a sequence of rows already ordered by id ASC.
+ * `computePayload(row, prevHash)` must rebuild the exact string used at insert time.
+ */
+export declare function verifyHashChain<T extends ChainRow>(rows: T[], computePayload: (row: T, prevHash: string) => string): ChainVerifyResult;

package/dist/audit-chain.js

@@ -0,0 +1,85 @@
+/**
+ * Tamper-evident audit hash chain helpers (Phase 1.4).
+ *
+ * Chain: each entry stores prev_hash (previous entry hash or GENESIS) and hash = SHA-256(payload).
+ * Any mutation of historical rows fails verification.
+ */
+import crypto from "crypto";
+export const AUDIT_CHAIN_GENESIS = "GENESIS";
+export function sha256Hex(payload) {
+    return crypto.createHash("sha256").update(payload, "utf8").digest("hex");
+}
+/**
+ * Canonical payload for agent execution logs (Storage.saveLog).
+ * MUST stay stable — changing it breaks verification of existing DBs.
+ */
+export function buildAgentLogChainPayload(fields) {
+    return [
+        fields.prevHash,
+        fields.agent,
+        fields.action,
+        fields.traceId,
+        fields.status,
+        fields.summary,
+        fields.timestamp,
+    ].join("|");
+}
+/**
+ * Canonical payload for structured Audit.log entries.
+ */
+export function buildStructuredAuditChainPayload(fields) {
+    return [
+        fields.prevHash,
+        fields.agent,
+        fields.action,
+        fields.status,
+        fields.traceId,
+        fields.timestamp,
+        fields.detailsJson,
+        fields.errorMessage,
+    ].join("|");
+}
+/**
+ * Verify a sequence of rows already ordered by id ASC.
+ * `computePayload(row, prevHash)` must rebuild the exact string used at insert time.
+ */
+export function verifyHashChain(rows, computePayload) {
+    let expectedPrev = AUDIT_CHAIN_GENESIS;
+    let checked = 0;
+    for (const row of rows) {
+        checked++;
+        const prev = row.prev_hash || "";
+        if (prev !== expectedPrev) {
+            return {
+                valid: false,
+                checked,
+                failedLogId: row.id,
+                reason: `prev_hash mismatch at row ${row.id}`,
+                tip: "A log was deleted, reordered, or inserted out of chain order.",
+            };
+        }
+        if (!row.hash) {
+            return {
+                valid: false,
+                checked,
+                failedLogId: row.id,
+                reason: `Missing hash at row ${row.id}`,
+                tip: "Legacy row without hash; re-seed or accept and re-hash from tip.",
+            };
+        }
+        const payload = computePayload(row, prev);
+        const calculated = sha256Hex(payload);
+        if (calculated !== row.hash) {
+            return {
+                valid: false,
+                checked,
+                failedLogId: row.id,
+                reason: `Hash corruption at row ${row.id}`,
+                tip: "Row content was modified after append.",
+            };
+        }
+        expectedPrev = row.hash;
+    }
+    return { valid: true, checked };
+}
+//# sourceMappingURL=audit-chain.js.map

package/dist/audit-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-chain.js","sourceRoot":"","sources":["../src/audit-chain.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAE7C,MAAM,UAAU,SAAS,CAAC,OAAe;IACrC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAQzC;IACG,OAAO;QACH,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,KAAK;QACZ,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,OAAO;QACd,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,OAAO;QACd,MAAM,CAAC,SAAS;KACnB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gCAAgC,CAAC,MAShD;IACG,OAAO;QACH,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,KAAK;QACZ,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,OAAO;QACd,MAAM,CAAC,SAAS;QAChB,MAAM,CAAC,WAAW;QAClB,MAAM,CAAC,YAAY;KACtB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChB,CAAC;AAgBD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC3B,IAAS,EACT,cAAoD;IAEpD,IAAI,YAAY,GAAG,mBAAmB,CAAC;IACvC,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACrB,OAAO,EAAE,CAAC;QACV,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC;QACjC,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;YACxB,OAAO;gBACH,KAAK,EAAE,KAAK;gBACZ,OAAO;gBACP,WAAW,EAAE,GAAG,CAAC,EAAE;gBACnB,MAAM,EAAE,6BAA6B,GAAG,CAAC,EAAE,EAAE;gBAC7C,GAAG,EAAE,+DAA+D;aACvE,CAAC;QACN,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACZ,OAAO;gBACH,KAAK,EAAE,KAAK;gBACZ,OAAO;gBACP,WAAW,EAAE,GAAG,CAAC,EAAE;gBACnB,MAAM,EAAE,uBAAuB,GAAG,CAAC,EAAE,EAAE;gBACvC,GAAG,EAAE,kEAAkE;aAC1E,CAAC;QACN,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,UAAU,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;YAC1B,OAAO;gBACH,KAAK,EAAE,KAAK;gBACZ,OAAO;gBACP,WAAW,EAAE,GAAG,CAAC,EAAE;gBACnB,MAAM,EAAE,0BAA0B,GAAG,CAAC,EAAE,EAAE;gBAC1C,GAAG,EAAE,wCAAwC;aAChD,CAAC;QACN,CAAC;QACD,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC"}

package/dist/audit.d.ts

@@ -13,6 +13,7 @@
  *   Audit.log("user.create", "SUCCESS", { userId: "usr_123" });
  *   Audit.query({ action: "user.create", status: "FAILED" });
  */
+import { type ChainVerifyResult } from "./audit-chain.js";
 export type AuditStatus = "SUCCESS" | "FAILED" | "BLOCKED" | "APPROVED" | "REJECTED";
 export type DataCategory = "OPERATIONAL" | "USER_DATA" | "API_CALL" | "SECURITY" | "COMPLIANCE";
 export interface AuditEntry {
@@ -28,6 +29,9 @@ export interface AuditEntry {
     dataCategory?: DataCategory;
     /** [KVKK] Data retention period (days). null = unlimited (not recommended) */
     retentionDays?: number;
+    /** Tamper-evident chain (Phase 1.4) */
+    prev_hash?: string;
+    hash?: string;
 }
 export declare class Audit {
     private static TABLE;
@@ -50,6 +54,10 @@ export declare class Audit {
         /** [KVKK] Custom retention period (days). Default: 30 */
         retentionDays?: number;
     }): void;
+    /**
+     * Verify tamper-evident chain for structured audit_log table.
+     */
+    static verifyIntegrity(): ChainVerifyResult;
     /**
      * Queries audit logs with filters.
      */

package/dist/audit.js

@@ -13,6 +13,7 @@
  *   Audit.log("user.create", "SUCCESS", { userId: "usr_123" });
  *   Audit.query({ action: "user.create", status: "FAILED" });
  */
+import { AUDIT_CHAIN_GENESIS, buildStructuredAuditChainPayload, sha256Hex, verifyHashChain, } from "./audit-chain.js";
 import { maskObject, maskText } from "./pii.js";
 import { databaseHolder } from "./database.js";
 import { logger } from "./logger.js";
@@ -36,9 +37,22 @@ export class Audit {
                 errorMessage TEXT,
                 durationMs INTEGER,
                 dataCategory TEXT DEFAULT 'OPERATIONAL',
-                retentionDays INTEGER DEFAULT ${this.DEFAULT_RETENTION_DAYS}
+                retentionDays INTEGER DEFAULT ${this.DEFAULT_RETENTION_DAYS},
+                prev_hash TEXT,
+                hash TEXT
             )
         `);
+        // Migrate older DBs
+        try {
+            const cols = db.prepare(`PRAGMA table_info(${this.TABLE})`).all().map((c) => c.name);
+            if (!cols.includes("prev_hash"))
+                db.exec(`ALTER TABLE ${this.TABLE} ADD COLUMN prev_hash TEXT`);
+            if (!cols.includes("hash"))
+                db.exec(`ALTER TABLE ${this.TABLE} ADD COLUMN hash TEXT`);
+        }
+        catch {
+            /* ignore */
+        }
         // Indexes for performance
         db.exec(`
             CREATE INDEX IF NOT EXISTS idx_audit_action ON ${this.TABLE}(action);
@@ -62,23 +76,73 @@ export class Audit {
         const maskedError = options.errorMessage
             ? maskText(options.errorMessage)
             : undefined;
-        const entry = {
-            timestamp: new Date().toISOString(),
-            action,
-            status,
-            agent: options.agent || "@manager",
-            traceId: options.traceId,
-            details: maskedDetails,
-            errorMessage: maskedError,
-            durationMs: options.durationMs,
-            dataCategory: options.dataCategory || "OPERATIONAL",
-            retentionDays,
-        };
-        db.prepare(`
-            INSERT INTO ${this.TABLE}
-                (timestamp, action, status, agent, traceId, details, errorMessage, durationMs, dataCategory, retentionDays)
-            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-        `).run(entry.timestamp, entry.action, entry.status, entry.agent, entry.traceId || null, entry.details ? JSON.stringify(entry.details) : null, entry.errorMessage || null, entry.durationMs || null, entry.dataCategory, entry.retentionDays);
+        const timestamp = new Date().toISOString();
+        const agent = options.agent || "@manager";
+        const detailsJson = maskedDetails ? JSON.stringify(maskedDetails) : "";
+        const errorMessage = maskedError || "";
+        const traceId = options.traceId || "";
+        const dataCategory = options.dataCategory || "OPERATIONAL";
+        // Append-only hash chain inside a transaction (Phase 1.4)
+        const insert = db.transaction(() => {
+            let prevHash = AUDIT_CHAIN_GENESIS;
+            try {
+                const last = db.prepare(`SELECT hash FROM ${this.TABLE} WHERE hash IS NOT NULL ORDER BY id DESC LIMIT 1`).get();
+                if (last?.hash)
+                    prevHash = last.hash;
+            }
+            catch {
+                /* genesis */
+            }
+            const payload = buildStructuredAuditChainPayload({
+                prevHash,
+                agent,
+                action,
+                status,
+                traceId,
+                timestamp,
+                detailsJson,
+                errorMessage,
+            });
+            const hash = sha256Hex(payload);
+            db.prepare(`
+                INSERT INTO ${this.TABLE}
+                    (timestamp, action, status, agent, traceId, details, errorMessage, durationMs, dataCategory, retentionDays, prev_hash, hash)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+            `).run(timestamp, action, status, agent, options.traceId || null, detailsJson || null, errorMessage || null, options.durationMs || null, dataCategory, retentionDays, prevHash, hash);
+        });
+        insert();
+    }
+    /**
+     * Verify tamper-evident chain for structured audit_log table.
+     */
+    static verifyIntegrity() {
+        const db = databaseHolder.getDB();
+        try {
+            const rows = db.prepare(`SELECT id, prev_hash, hash, agent, action, status, traceId, timestamp, details, errorMessage
+                 FROM ${this.TABLE} ORDER BY id ASC`).all();
+            // Skip unhashed legacy rows at the head; start chain at first hashed row
+            const hashed = rows.filter((r) => r.hash);
+            if (hashed.length === 0) {
+                return { valid: true, checked: 0, reason: "No hashed audit rows yet" };
+            }
+            return verifyHashChain(hashed, (row, prevHash) => buildStructuredAuditChainPayload({
+                prevHash,
+                agent: row.agent,
+                action: row.action,
+                status: row.status,
+                traceId: row.traceId || "",
+                timestamp: row.timestamp,
+                detailsJson: row.details || "",
+                errorMessage: row.errorMessage || "",
+            }));
+        }
+        catch (err) {
+            return {
+                valid: false,
+                checked: 0,
+                reason: `Verification error: ${err.message}`,
+            };
+        }
     }
     /**
      * Queries audit logs with filters.

package/dist/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAqBrC,MAAM,OAAO,KAAK;IACN,MAAM,CAAC,KAAK,GAAG,WAAW,CAAC;IACnC,oDAAoD;IAC5C,MAAM,CAAC,sBAAsB,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;IACrG,iEAAiE;IACzD,MAAM,CAAC,kBAAkB,GAAG,EAAE,CAAC;IAEhC,MAAM,CAAC,UAAU;QACpB,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,EAAE,CAAC,IAAI,CAAC;yCACyB,IAAI,CAAC,KAAK;;;;;;;;;;;gDAWH,IAAI,CAAC,sBAAsB;;SAElE,CAAC,CAAC;QACH,0BAA0B;QAC1B,EAAE,CAAC,IAAI,CAAC;6DAC6C,IAAI,CAAC,KAAK;6DACV,IAAI,CAAC,KAAK;4DACX,IAAI,CAAC,KAAK;gEACN,IAAI,CAAC,KAAK;+DACX,IAAI,CAAC,KAAK;SAChE,CAAC,CAAC;IACP,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,GAAG,CACb,MAAc,EACd,MAAmB,EACnB,UASI,EAAE;QAEN,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC1B,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,sBAAsB,EACpD,IAAI,CAAC,kBAAkB,CAC1B,CAAC;QAEF,gEAAgE;QAChE,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO;YACjC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAA4B;YACxD,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY;YACpC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC;YAChC,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,KAAK,GAA2B;YAClC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,MAAM;YACN,MAAM;YACN,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,UAAU;YAClC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,aAAa;YACtB,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,aAAa;YACnD,aAAa;SAChB,CAAC;QAEF,EAAE,CAAC,OAAO,CAAC;0BACO,IAAI,CAAC,KAAK;;;SAG3B,CAAC,CAAC,GAAG,CACF,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,OAAO,IAAI,IAAI,EACrB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EACpD,KAAK,CAAC,YAAY,IAAI,IAAI,EAC1B,KAAK,CAAC,UAAU,IAAI,IAAI,EACxB,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,aAAa,CACtB,CAAC;IACN,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,KAAK,CAAC,UAUhB,EAAE;QACF,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QACnF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QACnF,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAChF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QACtF,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAAC,CAAC;QACrG,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QACrF,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAErF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QAEnC,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACnB,iBAAiB,IAAI,CAAC,KAAK,IAAI,KAAK,2CAA2C,CAClF,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAmD,CAAC;QAElF,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACpB,GAAG,GAAG;YACN,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;SAC7D,CAAC,CAAC,CAAC;IACR,CAAC;IAED;;;;;;KAMC;IACM,MAAM,CAAC,cAAc,CAAC,MAK5B;QACG,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QACpF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAC9E,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QACjF,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACvB,UAAU,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YAC7D,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACrB,eAAe,IAAI,CAAC,KAAK,UAAU,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAChE,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;QAEjB,OAAO,MAAM,CAAC,OAAO,CAAC;IAC1B,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,YAAY;QACtB,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC;0BACR,IAAI,CAAC,KAAK;;;SAG3B,CAAC,CAAC,GAAG,EAAE,CAAC;QACT,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,oCAAoC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC;IAC1B,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,QAAQ;QAQlB,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,CAAC,YAAY,EAAE,CAAC;QAEpB,MAAM,KAAK,GAAI,EAAE,CAAC,OAAO,CAAC,iCAAiC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,EAAwB,CAAC,KAAK,CAAC;QAE3G,MAAM,YAAY,GAAG,EAAE,CAAC,OAAO,CAC3B,yCAAyC,IAAI,CAAC,KAAK,kBAAkB,CACxE,CAAC,GAAG,EAA8C,CAAC;QAEpD,MAAM,YAAY,GAAG,EAAE,CAAC,OAAO,CAC3B,yCAAyC,IAAI,CAAC,KAAK,+CAA+C,CACrG,CAAC,GAAG,EAA8C,CAAC;QAEpD,MAAM,cAAc,GAAG,EAAE,CAAC,OAAO,CAC7B,+CAA+C,IAAI,CAAC,KAAK,wBAAwB,CACpF,CAAC,GAAG,EAAoD,CAAC;QAE1D,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACrB,iBAAiB,IAAI,CAAC,KAAK,yEAAyE,CACvG,CAAC,GAAG,EAAoD,CAAC;QAE1D,MAAM,YAAY,GACd,EAAE,CAAC,OAAO,CAAC;gDACyB,IAAI,CAAC,KAAK;;;aAG7C,CAAC,CAAC,GAAG,EACT,CAAC,KAAK,CAAC;QAER,OAAO;YACH,KAAK;YACL,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACxE,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACxE,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YAClF,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC7B,GAAG,GAAG;gBACN,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;aAC7D,CAAC,CAAC;YACH,YAAY;SACf,CAAC;IACN,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,QAAQ,CAAC,gBAAwB;QAC3C,IAAI,gBAAgB,KAAK,uBAAuB,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,gCAAgC,MAAM,CAAC,OAAO,uCAAuC,CAAC,CAAC;QACnG,OAAO,MAAM,CAAC,OAAO,CAAC;IAC1B,CAAC"}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACH,mBAAmB,EACnB,gCAAgC,EAChC,SAAS,EACT,eAAe,GAElB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAwBrC,MAAM,OAAO,KAAK;IACN,MAAM,CAAC,KAAK,GAAG,WAAW,CAAC;IACnC,oDAAoD;IAC5C,MAAM,CAAC,sBAAsB,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;IACrG,iEAAiE;IACzD,MAAM,CAAC,kBAAkB,GAAG,EAAE,CAAC;IAEhC,MAAM,CAAC,UAAU;QACpB,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,EAAE,CAAC,IAAI,CAAC;yCACyB,IAAI,CAAC,KAAK;;;;;;;;;;;gDAWH,IAAI,CAAC,sBAAsB;;;;SAIlE,CAAC,CAAC;QACH,oBAAoB;QACpB,IAAI,CAAC;YACD,MAAM,IAAI,GAAI,EAAE,CAAC,OAAO,CAAC,qBAAqB,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,EAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAClH,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAAE,EAAE,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,KAAK,4BAA4B,CAAC,CAAC;YAChG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,EAAE,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,KAAK,uBAAuB,CAAC,CAAC;QAC1F,CAAC;QAAC,MAAM,CAAC;YACL,YAAY;QAChB,CAAC;QACD,0BAA0B;QAC1B,EAAE,CAAC,IAAI,CAAC;6DAC6C,IAAI,CAAC,KAAK;6DACV,IAAI,CAAC,KAAK;4DACX,IAAI,CAAC,KAAK;gEACN,IAAI,CAAC,KAAK;+DACX,IAAI,CAAC,KAAK;SAChE,CAAC,CAAC;IACP,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,GAAG,CACb,MAAc,EACd,MAAmB,EACnB,UASI,EAAE;QAEN,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC1B,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,sBAAsB,EACpD,IAAI,CAAC,kBAAkB,CAC1B,CAAC;QAEF,gEAAgE;QAChE,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO;YACjC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAA4B;YACxD,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY;YACpC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC;YAChC,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC;QAC1C,MAAM,WAAW,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,YAAY,GAAG,WAAW,IAAI,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QACtC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,aAAa,CAAC;QAE3D,0DAA0D;QAC1D,MAAM,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YAC/B,IAAI,QAAQ,GAAG,mBAAmB,CAAC;YACnC,IAAI,CAAC;gBACD,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACnB,oBAAoB,IAAI,CAAC,KAAK,kDAAkD,CACnF,CAAC,GAAG,EAAkC,CAAC;gBACxC,IAAI,IAAI,EAAE,IAAI;oBAAE,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;YACzC,CAAC;YAAC,MAAM,CAAC;gBACL,aAAa;YACjB,CAAC;YAED,MAAM,OAAO,GAAG,gCAAgC,CAAC;gBAC7C,QAAQ;gBACR,KAAK;gBACL,MAAM;gBACN,MAAM;gBACN,OAAO;gBACP,SAAS;gBACT,WAAW;gBACX,YAAY;aACf,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;YAEhC,EAAE,CAAC,OAAO,CAAC;8BACO,IAAI,CAAC,KAAK;;;aAG3B,CAAC,CAAC,GAAG,CACF,SAAS,EACT,MAAM,EACN,MAAM,EACN,KAAK,EACL,OAAO,CAAC,OAAO,IAAI,IAAI,EACvB,WAAW,IAAI,IAAI,EACnB,YAAY,IAAI,IAAI,EACpB,OAAO,CAAC,UAAU,IAAI,IAAI,EAC1B,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,IAAI,CACP,CAAC;QACN,CAAC,CAAC,CAAC;QACH,MAAM,EAAE,CAAC;IACb,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,eAAe;QACzB,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,CAAC;YACD,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACnB;wBACQ,IAAI,CAAC,KAAK,kBAAkB,CACvC,CAAC,GAAG,EAWH,CAAC;YAEH,yEAAyE;YACzE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;YAC3E,CAAC;YAED,OAAO,eAAe,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,CAC7C,gCAAgC,CAAC;gBAC7B,QAAQ;gBACR,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE;gBAC1B,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,WAAW,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE;gBAC9B,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,EAAE;aACvC,CAAC,CACL,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO;gBACH,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,CAAC;gBACV,MAAM,EAAE,uBAAwB,GAAa,CAAC,OAAO,EAAE;aAC1D,CAAC;QACN,CAAC;IACL,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,KAAK,CAAC,UAUhB,EAAE;QACF,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QACnF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QACnF,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAChF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QACtF,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAAC,CAAC;QACrG,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QACrF,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAErF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QAEnC,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACnB,iBAAiB,IAAI,CAAC,KAAK,IAAI,KAAK,2CAA2C,CAClF,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAmD,CAAC;QAElF,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACpB,GAAG,GAAG;YACN,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;SAC7D,CAAC,CAAC,CAAC;IACR,CAAC;IAED;;;;;;KAMC;IACM,MAAM,CAAC,cAAc,CAAC,MAK5B;QACG,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QACpF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAC9E,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QACjF,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACvB,UAAU,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YAC7D,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACrB,eAAe,IAAI,CAAC,KAAK,UAAU,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAChE,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;QAEjB,OAAO,MAAM,CAAC,OAAO,CAAC;IAC1B,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,YAAY;QACtB,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC;0BACR,IAAI,CAAC,KAAK;;;SAG3B,CAAC,CAAC,GAAG,EAAE,CAAC;QACT,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,oCAAoC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC;IAC1B,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,QAAQ;QAQlB,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,CAAC,YAAY,EAAE,CAAC;QAEpB,MAAM,KAAK,GAAI,EAAE,CAAC,OAAO,CAAC,iCAAiC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,EAAwB,CAAC,KAAK,CAAC;QAE3G,MAAM,YAAY,GAAG,EAAE,CAAC,OAAO,CAC3B,yCAAyC,IAAI,CAAC,KAAK,kBAAkB,CACxE,CAAC,GAAG,EAA8C,CAAC;QAEpD,MAAM,YAAY,GAAG,EAAE,CAAC,OAAO,CAC3B,yCAAyC,IAAI,CAAC,KAAK,+CAA+C,CACrG,CAAC,GAAG,EAA8C,CAAC;QAEpD,MAAM,cAAc,GAAG,EAAE,CAAC,OAAO,CAC7B,+CAA+C,IAAI,CAAC,KAAK,wBAAwB,CACpF,CAAC,GAAG,EAAoD,CAAC;QAE1D,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACrB,iBAAiB,IAAI,CAAC,KAAK,yEAAyE,CACvG,CAAC,GAAG,EAAoD,CAAC;QAE1D,MAAM,YAAY,GACd,EAAE,CAAC,OAAO,CAAC;gDACyB,IAAI,CAAC,KAAK;;;aAG7C,CAAC,CAAC,GAAG,EACT,CAAC,KAAK,CAAC;QAER,OAAO;YACH,KAAK;YACL,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACxE,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACxE,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YAClF,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC7B,GAAG,GAAG;gBACN,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;aAC7D,CAAC,CAAC;YACH,YAAY;SACf,CAAC;IACN,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,QAAQ,CAAC,gBAAwB;QAC3C,IAAI,gBAAgB,KAAK,uBAAuB,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,gCAAgC,MAAM,CAAC,OAAO,uCAAuC,CAAC,CAAC;QACnG,OAAO,MAAM,CAAC,OAAO,CAAC;IAC1B,CAAC"}

package/dist/file-lock.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Atomic File-Based Locking — OS-level exclusive create via open('wx').
+ *
+ * Replaces check-then-act lock races. No Redis/Redlock required.
+ *
+ * Pattern:
+ *   resource  →  .atabey/locks/<relative>.lock  (created with O_EXCL / 'wx')
+ *   holder writes JSON metadata after exclusive create
+ *   release unlinks the lock file
+ *
+ * Stale locks (TTL exceeded) are reclaimed atomically when possible.
+ */
+export interface FileLockOptions {
+    /** Base directory for lock files. Default: `.atabey/locks` under cwd or projectRoot. */
+    locksDir?: string;
+    /** Project root used to relativize resource paths. Default: process.cwd(). */
+    projectRoot?: string;
+    /** Lock TTL in ms. Stale locks may be stolen after this. Default: 5 minutes. */
+    ttlMs?: number;
+    /** Retry interval when waiting for a lock. Default: 50ms. */
+    retryMs?: number;
+    /** Max wait when using acquireAsync. Default: 10s. */
+    timeoutMs?: number;
+}
+export interface FileLockMeta {
+    ownerId: string;
+    resource: string;
+    acquiredAt: string;
+    expiresAt: string;
+    reason?: string;
+    pid: number;
+    hostname: string;
+}
+export declare class AtomicFileLock {
+    private readonly locksDir;
+    private readonly projectRoot;
+    private readonly ttlMs;
+    private readonly retryMs;
+    private readonly timeoutMs;
+    constructor(options?: FileLockOptions);
+    /** Absolute path of the lock file for a resource. */
+    getLockPath(resource: string): string;
+    /**
+     * Try to acquire a lock once (non-blocking).
+     * Uses atomic exclusive file create (`wx` = O_CREAT | O_EXCL | O_WRONLY).
+     */
+    tryAcquire(resource: string, ownerId: string, reason?: string, _reclaimDepth?: number): {
+        acquired: boolean;
+        meta?: FileLockMeta;
+        heldBy?: FileLockMeta;
+    };
+    /**
+     * Acquire with async retry until timeout.
+     */
+    acquireAsync(resource: string, ownerId: string, options?: {
+        reason?: string;
+        timeoutMs?: number;
+        retryMs?: number;
+    }): Promise<FileLockMeta>;
+    /**
+     * Release lock only if owned by ownerId (or force=true).
+     */
+    release(resource: string, ownerId: string, force?: boolean): boolean;
+    isLocked(resource: string): FileLockMeta | null;
+    /**
+     * Run `fn` while holding the lock.
+     * ALWAYS releases in `finally` even if `fn` throws (disk full, parse errors, etc.).
+     */
+    withLock<T>(resource: string, ownerId: string, fn: () => Promise<T> | T, options?: {
+        reason?: string;
+        timeoutMs?: number;
+    }): Promise<T>;
+    /**
+     * Synchronous withLock — same try/finally release guarantee.
+     */
+    withLockSync<T>(resource: string, ownerId: string, fn: () => T, options?: {
+        reason?: string;
+    }): T;
+    private reclaimIfStale;
+    private isExpired;
+    private readMeta;
+    private forceRemove;
+}
+/** Convenience: lock under project `.atabey/locks`. */
+export declare function createProjectFileLock(projectRoot: string, options?: Omit<FileLockOptions, "projectRoot">): AtomicFileLock;

package/dist/file-lock.js

@@ -0,0 +1,246 @@
+/**
+ * Atomic File-Based Locking — OS-level exclusive create via open('wx').
+ *
+ * Replaces check-then-act lock races. No Redis/Redlock required.
+ *
+ * Pattern:
+ *   resource  →  .atabey/locks/<relative>.lock  (created with O_EXCL / 'wx')
+ *   holder writes JSON metadata after exclusive create
+ *   release unlinks the lock file
+ *
+ * Stale locks (TTL exceeded) are reclaimed atomically when possible.
+ */
+import fs from "fs";
+import path from "path";
+import os from "os";
+export class AtomicFileLock {
+    locksDir;
+    projectRoot;
+    ttlMs;
+    retryMs;
+    timeoutMs;
+    constructor(options = {}) {
+        this.projectRoot = options.projectRoot ?? process.cwd();
+        this.locksDir = options.locksDir
+            ? path.resolve(options.locksDir)
+            : path.join(this.projectRoot, ".atabey", "locks");
+        this.ttlMs = options.ttlMs ?? 5 * 60 * 1000;
+        this.retryMs = options.retryMs ?? 50;
+        this.timeoutMs = options.timeoutMs ?? 10_000;
+    }
+    /** Absolute path of the lock file for a resource. */
+    getLockPath(resource) {
+        const abs = path.isAbsolute(resource)
+            ? resource
+            : path.resolve(this.projectRoot, resource);
+        let relative = path.relative(this.projectRoot, abs);
+        if (relative.startsWith("..")) {
+            // Outside project root — hash path to avoid escaping locks dir
+            relative = `_ext/${Buffer.from(abs).toString("base64url")}`;
+        }
+        // Normalize separators for cross-platform lock paths
+        relative = relative.split(path.sep).join("/");
+        return path.join(this.locksDir, `${relative}.lock`);
+    }
+    /**
+     * Try to acquire a lock once (non-blocking).
+     * Uses atomic exclusive file create (`wx` = O_CREAT | O_EXCL | O_WRONLY).
+     */
+    tryAcquire(resource, ownerId, reason, _reclaimDepth = 0) {
+        const lockPath = this.getLockPath(resource);
+        fs.mkdirSync(path.dirname(lockPath), { recursive: true });
+        // Reclaim stale lock first (best-effort, still atomic on create)
+        this.reclaimIfStale(lockPath);
+        const now = Date.now();
+        const meta = {
+            ownerId,
+            resource,
+            acquiredAt: new Date(now).toISOString(),
+            expiresAt: new Date(now + this.ttlMs).toISOString(),
+            reason,
+            pid: process.pid,
+            hostname: os.hostname(),
+        };
+        let fd;
+        try {
+            // Atomic exclusive create — fails if file already exists
+            fd = fs.openSync(lockPath, "wx");
+            try {
+                fs.writeFileSync(fd, JSON.stringify(meta, null, 2), "utf8");
+            }
+            catch (writeErr) {
+                // CRITICAL: meta write failed after wx create (e.g. ENOSPC) — remove orphan lock
+                try {
+                    if (fd !== undefined)
+                        fs.closeSync(fd);
+                }
+                catch { /* ignore */ }
+                fd = undefined;
+                this.forceRemove(lockPath, null);
+                throw writeErr;
+            }
+            fs.closeSync(fd);
+            fd = undefined;
+            return { acquired: true, meta };
+        }
+        catch (err) {
+            if (fd !== undefined) {
+                try {
+                    fs.closeSync(fd);
+                }
+                catch { /* ignore */ }
+            }
+            const code = err.code;
+            if (code === "EEXIST") {
+                // Race: another process created the lock between reclaim and open
+                const heldBy = this.readMeta(lockPath) ?? undefined;
+                // Corrupt lock (unreadable JSON) or expired → reclaim and retry once
+                if ((!heldBy || this.isExpired(heldBy)) && _reclaimDepth < 1) {
+                    this.forceRemove(lockPath, heldBy ?? null);
+                    return this.tryAcquire(resource, ownerId, reason, _reclaimDepth + 1);
+                }
+                return { acquired: false, heldBy };
+            }
+            throw err;
+        }
+    }
+    /**
+     * Acquire with async retry until timeout.
+     */
+    async acquireAsync(resource, ownerId, options) {
+        const timeoutMs = options?.timeoutMs ?? this.timeoutMs;
+        const retryMs = options?.retryMs ?? this.retryMs;
+        const start = Date.now();
+        while (true) {
+            const result = this.tryAcquire(resource, ownerId, options?.reason);
+            if (result.acquired && result.meta) {
+                return result.meta;
+            }
+            if (Date.now() - start >= timeoutMs) {
+                const holder = result.heldBy?.ownerId ?? "unknown";
+                throw new Error(`[AtomicFileLock] Timeout acquiring lock for "${resource}" after ${timeoutMs}ms (held by ${holder})`);
+            }
+            await sleep(retryMs);
+        }
+    }
+    /**
+     * Release lock only if owned by ownerId (or force=true).
+     */
+    release(resource, ownerId, force = false) {
+        const lockPath = this.getLockPath(resource);
+        if (!fs.existsSync(lockPath))
+            return true;
+        const meta = this.readMeta(lockPath);
+        if (!meta) {
+            this.forceRemove(lockPath, null);
+            return true;
+        }
+        if (!force && meta.ownerId !== ownerId) {
+            return false;
+        }
+        this.forceRemove(lockPath, meta);
+        return true;
+    }
+    isLocked(resource) {
+        const lockPath = this.getLockPath(resource);
+        if (!fs.existsSync(lockPath))
+            return null;
+        const meta = this.readMeta(lockPath);
+        if (!meta)
+            return null;
+        if (this.isExpired(meta)) {
+            this.forceRemove(lockPath, meta);
+            return null;
+        }
+        return meta;
+    }
+    /**
+     * Run `fn` while holding the lock.
+     * ALWAYS releases in `finally` even if `fn` throws (disk full, parse errors, etc.).
+     */
+    async withLock(resource, ownerId, fn, options) {
+        await this.acquireAsync(resource, ownerId, options);
+        try {
+            return await fn();
+        }
+        finally {
+            try {
+                this.release(resource, ownerId);
+            }
+            catch {
+                this.forceRemove(this.getLockPath(resource), null);
+            }
+            const stillHeld = this.isLocked(resource);
+            if (stillHeld && stillHeld.ownerId === ownerId) {
+                this.forceRemove(this.getLockPath(resource), stillHeld);
+            }
+        }
+    }
+    /**
+     * Synchronous withLock — same try/finally release guarantee.
+     */
+    withLockSync(resource, ownerId, fn, options) {
+        const result = this.tryAcquire(resource, ownerId, options?.reason);
+        if (!result.acquired) {
+            const holder = result.heldBy?.ownerId ?? "unknown";
+            throw new Error(`[AtomicFileLock] Could not acquire lock for "${resource}" (held by ${holder})`);
+        }
+        try {
+            return fn();
+        }
+        finally {
+            try {
+                this.release(resource, ownerId);
+            }
+            catch {
+                this.forceRemove(this.getLockPath(resource), null);
+            }
+            const stillHeld = this.isLocked(resource);
+            if (stillHeld && stillHeld.ownerId === ownerId) {
+                this.forceRemove(this.getLockPath(resource), stillHeld);
+            }
+        }
+    }
+    reclaimIfStale(lockPath) {
+        if (!fs.existsSync(lockPath))
+            return;
+        const meta = this.readMeta(lockPath);
+        if (!meta || this.isExpired(meta)) {
+            this.forceRemove(lockPath, meta);
+        }
+    }
+    isExpired(meta) {
+        const exp = Date.parse(meta.expiresAt);
+        if (Number.isNaN(exp)) {
+            // Fallback: acquiredAt + ttl
+            const acq = Date.parse(meta.acquiredAt);
+            return Number.isNaN(acq) ? true : Date.now() - acq > this.ttlMs;
+        }
+        return Date.now() > exp;
+    }
+    readMeta(lockPath) {
+        try {
+            const raw = fs.readFileSync(lockPath, "utf8");
+            return JSON.parse(raw);
+        }
+        catch {
+            return null;
+        }
+    }
+    forceRemove(lockPath, _meta) {
+        try {
+            fs.unlinkSync(lockPath);
+        }
+        catch {
+            // ignore ENOENT races
+        }
+    }
+}
+function sleep(ms) {
+    return new Promise((r) => setTimeout(r, ms));
+}
+/** Convenience: lock under project `.atabey/locks`. */
+export function createProjectFileLock(projectRoot, options) {
+    return new AtomicFileLock({ ...options, projectRoot });
+}
+//# sourceMappingURL=file-lock.js.map