tutanus 0.12.0

package/dist/guardian/gpg.js

@@ -0,0 +1,82 @@
+import { CHAVE_PRIVADA_CAMINHO, CHAVE_PUBLICA_CAMINHO } from './index.js';
+import { messages } from '../core/messages/index.js';
+import { lerEstado, salvarEstado } from '../shared/persistence/index.js';
+import * as openpgp from 'openpgp';
+export async function gerarParDeChaves() {
+    const { privateKey, publicKey } = await openpgp.generateKey({
+        type: 'ecc',
+        curve: 'ed25519Legacy',
+        userIDs: [{ name: 'Tutanus Guardian', comment: 'Chave do sistema de integridade Guardian' }],
+        format: 'armored'
+    });
+    return { chavePrivada: privateKey, chavePublica: publicKey };
+}
+export async function assinarConteudo(conteudo, chavePrivadaArmored) {
+    const chavePrivada = chavePrivadaArmored || await carregarChavePrivada();
+    if (!chavePrivada) {
+        throw new Error(messages.GuardianMensagens.gpgChavePrivadaIndisponivel);
+    }
+    const chavePrivadaObj = await openpgp.readPrivateKey({ armoredKey: chavePrivada });
+    const assinatura = await openpgp.sign({
+        message: await openpgp.createMessage({ text: conteudo }),
+        signingKeys: chavePrivadaObj,
+        detached: true
+    });
+    return assinatura;
+}
+export async function verificarAssinatura(conteudo, assinaturaArmored, chavePublicaArmored) {
+    const chavePublica = chavePublicaArmored || await carregarChavePublica();
+    if (!chavePublica) {
+        throw new Error(messages.GuardianMensagens.gpgChavePublicaIndisponivel);
+    }
+    const chavePublicaObj = await openpgp.readKey({ armoredKey: chavePublica });
+    const mensagem = await openpgp.createMessage({ text: conteudo });
+    const assinaturaObj = await openpgp.readSignature({ armoredSignature: assinaturaArmored });
+    try {
+        const resultado = await openpgp.verify({
+            message: mensagem,
+            signature: assinaturaObj,
+            verificationKeys: [chavePublicaObj]
+        });
+        const { verified } = resultado.signatures[0];
+        await verified;
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function carregarChavePublica() {
+    try {
+        return await lerEstado(CHAVE_PUBLICA_CAMINHO);
+    }
+    catch {
+        return null;
+    }
+}
+export async function carregarChavePrivada() {
+    try {
+        return await lerEstado(CHAVE_PRIVADA_CAMINHO);
+    }
+    catch {
+        return null;
+    }
+}
+export async function salvarChavePublica(chave) {
+    await salvarEstado(CHAVE_PUBLICA_CAMINHO, chave);
+}
+export async function salvarChavePrivada(chave) {
+    await salvarEstado(CHAVE_PRIVADA_CAMINHO, chave);
+}
+export async function inicializarChaves() {
+    const pubExistente = await carregarChavePublica();
+    const privExistente = await carregarChavePrivada();
+    if (pubExistente && privExistente) {
+        return { chavePrivada: privExistente, chavePublica: pubExistente };
+    }
+    const par = await gerarParDeChaves();
+    await salvarChavePublica(par.chavePublica);
+    await salvarChavePrivada(par.chavePrivada);
+    return par;
+}
+//# sourceMappingURL=gpg.js.map

package/dist/guardian/gpg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gpg.js","sourceRoot":"","sources":["../../src/guardian/gpg.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAOnC,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC;QAC1D,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,eAAe;QACtB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;QAC5F,MAAM,EAAE,SAAS;KAClB,CAAC,CAAC;IAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,mBAA4B;IAClF,MAAM,YAAY,GAAG,mBAAmB,IAAI,MAAM,oBAAoB,EAAE,CAAC;IAEzE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,2BAA2B,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;QACpC,OAAO,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACxD,WAAW,EAAE,eAAe;QAC5B,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;IAEH,OAAO,UAAoB,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,iBAAyB,EACzB,mBAA4B;IAE5B,MAAM,YAAY,GAAG,mBAAmB,IAAI,MAAM,oBAAoB,EAAE,CAAC;IAEzE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,2BAA2B,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAE3F,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;YACrC,OAAO,EAAE,QAAQ;YACjB,SAAS,EAAE,aAAa;YACxB,gBAAgB,EAAE,CAAC,eAAe,CAAC;SACpC,CAAC,CAAC;QAEH,MAAM,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7C,MAAM,QAAQ,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAS,qBAAqB,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAS,qBAAqB,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAa;IACpD,MAAM,YAAY,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAa;IACpD,MAAM,YAAY,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,YAAY,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAClD,MAAM,aAAa,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAEnD,IAAI,YAAY,IAAI,aAAa,EAAE,CAAC;QAClC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;IACrE,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACrC,MAAM,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3C,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nimport { CHAVE_PRIVADA_CAMINHO, CHAVE_PUBLICA_CAMINHO } from '@guardian';\nimport { messages } from '@core/messages';\nimport { lerEstado, salvarEstado } from '@shared/persistence';\nimport * as openpgp from 'openpgp';\n\nexport interface ParDeChaves {\n  chavePrivada: string;\n  chavePublica: string;\n}\n\nexport async function gerarParDeChaves(): Promise<ParDeChaves> {\n  const { privateKey, publicKey } = await openpgp.generateKey({\n    type: 'ecc',\n    curve: 'ed25519Legacy',\n    userIDs: [{ name: 'Tutanus Guardian', comment: 'Chave do sistema de integridade Guardian' }],\n    format: 'armored'\n  });\n\n  return { chavePrivada: privateKey, chavePublica: publicKey };\n}\n\nexport async function assinarConteudo(conteudo: string, chavePrivadaArmored?: string): Promise<string> {\n  const chavePrivada = chavePrivadaArmored || await carregarChavePrivada();\n\n  if (!chavePrivada) {\n    throw new Error(messages.GuardianMensagens.gpgChavePrivadaIndisponivel);\n  }\n\n  const chavePrivadaObj = await openpgp.readPrivateKey({ armoredKey: chavePrivada });\n  const assinatura = await openpgp.sign({\n    message: await openpgp.createMessage({ text: conteudo }),\n    signingKeys: chavePrivadaObj,\n    detached: true\n  });\n\n  return assinatura as string;\n}\n\nexport async function verificarAssinatura(\n  conteudo: string,\n  assinaturaArmored: string,\n  chavePublicaArmored?: string\n): Promise<boolean> {\n  const chavePublica = chavePublicaArmored || await carregarChavePublica();\n\n  if (!chavePublica) {\n    throw new Error(messages.GuardianMensagens.gpgChavePublicaIndisponivel);\n  }\n\n  const chavePublicaObj = await openpgp.readKey({ armoredKey: chavePublica });\n  const mensagem = await openpgp.createMessage({ text: conteudo });\n  const assinaturaObj = await openpgp.readSignature({ armoredSignature: assinaturaArmored });\n\n  try {\n    const resultado = await openpgp.verify({\n      message: mensagem,\n      signature: assinaturaObj,\n      verificationKeys: [chavePublicaObj]\n    });\n\n    const { verified } = resultado.signatures[0];\n    await verified;\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport async function carregarChavePublica(): Promise<string | null> {\n  try {\n    return await lerEstado<string>(CHAVE_PUBLICA_CAMINHO);\n  } catch {\n    return null;\n  }\n}\n\nexport async function carregarChavePrivada(): Promise<string | null> {\n  try {\n    return await lerEstado<string>(CHAVE_PRIVADA_CAMINHO);\n  } catch {\n    return null;\n  }\n}\n\nexport async function salvarChavePublica(chave: string): Promise<void> {\n  await salvarEstado(CHAVE_PUBLICA_CAMINHO, chave);\n}\n\nexport async function salvarChavePrivada(chave: string): Promise<void> {\n  await salvarEstado(CHAVE_PRIVADA_CAMINHO, chave);\n}\n\nexport async function inicializarChaves(): Promise<ParDeChaves> {\n  const pubExistente = await carregarChavePublica();\n  const privExistente = await carregarChavePrivada();\n\n  if (pubExistente && privExistente) {\n    return { chavePrivada: privExistente, chavePublica: pubExistente };\n  }\n\n  const par = await gerarParDeChaves();\n  await salvarChavePublica(par.chavePublica);\n  await salvarChavePrivada(par.chavePrivada);\n  return par;\n}\n"]}

package/dist/guardian/hash.d.ts

@@ -0,0 +1,3 @@
+export declare function gerarHashHex(conteudo: string): Promise<string>;
+export declare function gerarSnapshotDoConteudo(conteudo: string): Promise<string>;
+//# sourceMappingURL=hash.d.ts.map

package/dist/guardian/hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../../src/guardian/hash.ts"],"names":[],"mappings":"AAUA,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGpE;AASD,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAU/E"}

package/dist/guardian/hash.js

@@ -0,0 +1,17 @@
+import { assinarConteudo, inicializarChaves } from './index.js';
+export async function gerarHashHex(conteudo) {
+    await inicializarChaves();
+    return assinarConteudo(conteudo);
+}
+export async function gerarSnapshotDoConteudo(conteudo) {
+    await inicializarChaves();
+    const assinatura = await assinarConteudo(conteudo);
+    const linhas = conteudo.split('\n');
+    const snapshot = {
+        assinatura,
+        linhas: linhas.length,
+        amostra: linhas[0]?.slice(0, 200) ?? ''
+    };
+    return snapshot.assinatura;
+}
+//# sourceMappingURL=hash.js.map

package/dist/guardian/hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../../src/guardian/hash.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAS/D,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,MAAM,iBAAiB,EAAE,CAAC;IAC1B,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,QAAgB;IAC5D,MAAM,iBAAiB,EAAE,CAAC;IAC1B,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAoB;QAChC,UAAU;QACV,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE;KACxC,CAAC;IACF,OAAO,QAAQ,CAAC,UAAU,CAAC;AAC7B,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nimport { assinarConteudo, inicializarChaves } from '@guardian';\n\nimport type { SnapshotArquivo } from '@';\n\n/**\n * Gera uma assinatura GPG a partir do conteúdo fornecido.\n * Se as chaves ainda não existirem, gera um novo par automaticamente.\n */\n\nexport async function gerarHashHex(conteudo: string): Promise<string> {\n  await inicializarChaves();\n  return assinarConteudo(conteudo);\n}\n\n/**\n * Gera um snapshot do conteúdo incluindo:\n * - Assinatura GPG de integridade\n * - Número de linhas\n * - Amostra textual do início do arquivo\n */\n\nexport async function gerarSnapshotDoConteudo(conteudo: string): Promise<string> {\n  await inicializarChaves();\n  const assinatura = await assinarConteudo(conteudo);\n  const linhas = conteudo.split('\\n');\n  const snapshot: SnapshotArquivo = {\n    assinatura,\n    linhas: linhas.length,\n    amostra: linhas[0]?.slice(0, 200) ?? ''\n  };\n  return snapshot.assinatura;\n}\n"]}

package/dist/guardian/index.d.ts

@@ -0,0 +1,10 @@
+export * from './baseline.js';
+export * from './constants.js';
+export * from './diff.js';
+export * from './gpg.js';
+export * from './hash.js';
+export * from './records.js';
+export * from './sentinel.js';
+export * from './verifier.js';
+export * from './watcher-hidden.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/guardian/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/guardian/index.ts"],"names":[],"mappings":"AAKA,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC"}

package/dist/guardian/index.js

@@ -0,0 +1,10 @@
+export * from './baseline.js';
+export * from './constants.js';
+export * from './diff.js';
+export * from './gpg.js';
+export * from './hash.js';
+export * from './records.js';
+export * from './sentinel.js';
+export * from './verifier.js';
+export * from './watcher-hidden.js';
+//# sourceMappingURL=index.js.map

package/dist/guardian/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/guardian/index.ts"],"names":[],"mappings":"AAKA,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\n/**\n * @fileoverview Guardian: baseline, diff, hash, sentinela, verificador\n */\n\nexport * from './baseline.js';\nexport * from './constants.js';\nexport * from './diff.js';\nexport * from './gpg.js';\nexport * from './hash.js';\nexport * from './records.js';\nexport * from './sentinel.js';\nexport * from './verifier.js';\nexport * from './watcher-hidden.js';\n"]}

package/dist/guardian/records.d.ts

@@ -0,0 +1,4 @@
+import type { FileEntry, RegistroIntegridade } from '../types/index.js';
+export declare function salvarRegistros(fileEntries: FileEntry[], destino?: string): Promise<void>;
+export declare function carregarRegistros(caminho?: string): Promise<RegistroIntegridade[]>;
+//# sourceMappingURL=records.d.ts.map

package/dist/guardian/records.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"records.d.ts","sourceRoot":"","sources":["../../src/guardian/records.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,GAAG,CAAC;AAUxD,wBAAsB,eAAe,CACnC,WAAW,EAAE,SAAS,EAAE,EACxB,OAAO,GAAE,MAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAYf;AAMD,wBAAsB,iBAAiB,CACrC,OAAO,GAAE,MAAuB,GAC/B,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAOhC"}

package/dist/guardian/records.js

@@ -0,0 +1,30 @@
+import path from 'node:path';
+import { config } from '../core/config/index.js';
+import { getMessages } from '../core/messages/index.js';
+import { gerarSnapshotDoConteudo } from './index.js';
+import { ensureDir } from '../shared/helpers/index.js';
+import { lerEstado, salvarEstado } from '../shared/persistence/index.js';
+const { log } = getMessages();
+const DESTINO_PADRAO = path.join(config.STATE_DIR, 'integridade.json');
+export async function salvarRegistros(fileEntries, destino = DESTINO_PADRAO) {
+    const registros = [];
+    for (const { relPath, content } of fileEntries) {
+        if (!relPath || typeof content !== 'string' || !content.trim())
+            continue;
+        const assinatura = await gerarSnapshotDoConteudo(content);
+        registros.push({ arquivo: relPath, assinatura });
+    }
+    await ensureDir(destino);
+    await salvarEstado(destino, registros);
+    log.sucesso(`??? Registro de integridade salvo em: ${destino}`);
+}
+export async function carregarRegistros(caminho = DESTINO_PADRAO) {
+    try {
+        return await lerEstado(caminho);
+    }
+    catch {
+        log.aviso(`?? Nenhum registro encontrado em ${caminho}`);
+        return [];
+    }
+}
+//# sourceMappingURL=records.js.map

package/dist/guardian/records.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"records.js","sourceRoot":"","sources":["../../src/guardian/records.ts"],"names":[],"mappings":"AACA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAI9D,MAAM,EAAE,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;AAE9B,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;AAMvE,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,WAAwB,EACxB,UAAkB,cAAc;IAEhC,MAAM,SAAS,GAA0B,EAAE,CAAC;IAE5C,KAAK,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,WAAW,EAAE,CAAC;QAC/C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;YAAE,SAAS;QACzE,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC1D,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACvC,GAAG,CAAC,OAAO,CAAC,yCAAyC,OAAO,EAAE,CAAC,CAAC;AAClE,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAAkB,cAAc;IAEhC,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAwB,OAAO,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,oCAAoC,OAAO,EAAE,CAAC,CAAC;QACzD,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nimport path from 'node:path';\n\nimport { config } from '@core/config';\nimport { getMessages } from '@core/messages';\nimport { gerarSnapshotDoConteudo } from '@guardian';\nimport { ensureDir } from '@shared/helpers';\nimport { lerEstado, salvarEstado } from '@shared/persistence';\n\nimport type { FileEntry, RegistroIntegridade } from '@';\n\nconst { log } = getMessages();\n\nconst DESTINO_PADRAO = path.join(config.STATE_DIR, 'integridade.json');\n\n/**\n * Salva as assinaturas GPG dos arquivos fornecidos em um arquivo de integridade.\n */\n\nexport async function salvarRegistros(\n  fileEntries: FileEntry[],\n  destino: string = DESTINO_PADRAO,\n): Promise<void> {\n  const registros: RegistroIntegridade[] = [];\n\n  for (const { relPath, content } of fileEntries) {\n    if (!relPath || typeof content !== 'string' || !content.trim()) continue;\n    const assinatura = await gerarSnapshotDoConteudo(content);\n    registros.push({ arquivo: relPath, assinatura });\n  }\n\n  await ensureDir(destino);\n  await salvarEstado(destino, registros);\n  log.sucesso(`??? Registro de integridade salvo em: ${destino}`);\n}\n\n/**\n * Carrega os registros de integridade persistidos. Retorna lista vazia se não existir.\n */\n\nexport async function carregarRegistros(\n  caminho: string = DESTINO_PADRAO,\n): Promise<RegistroIntegridade[]> {\n  try {\n    return await lerEstado<RegistroIntegridade[]>(caminho);\n  } catch {\n    log.aviso(`?? Nenhum registro encontrado em ${caminho}`);\n    return [];\n  }\n}\n"]}

package/dist/guardian/sentinel.d.ts

@@ -0,0 +1,13 @@
+import type { FileEntry } from '../types/index.js';
+import { IntegridadeStatus } from '../types/index.js';
+export declare function scanSystemIntegrity(fileEntries: FileEntry[], options?: {
+    justDiff?: boolean;
+    suppressLogs?: boolean;
+}): Promise<{
+    status: IntegridadeStatus;
+    timestamp: string;
+    detalhes?: string[];
+    baselineModificado?: boolean;
+}>;
+export declare function acceptNewBaseline(fileEntries: FileEntry[]): Promise<void>;
+//# sourceMappingURL=sentinel.d.ts.map

package/dist/guardian/sentinel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentinel.d.ts","sourceRoot":"","sources":["../../src/guardian/sentinel.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,GAAG,CAAC;AACnC,OAAO,EAAiB,iBAAiB,EAAE,MAAM,GAAG,CAAC;AA2BrD,wBAAsB,mBAAmB,CAAC,WAAW,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,EAAE;IAC5E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,GAAG,OAAO,CAAC;IACV,MAAM,EAAE,iBAAiB,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC,CAmFD;AACD,wBAAsB,iBAAiB,CAAC,WAAW,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAW/E"}

package/dist/guardian/sentinel.js

@@ -0,0 +1,114 @@
+import { config } from '../core/config/index.js';
+import { getMessages } from '../core/messages/index.js';
+import { carregarBaseline, diffSnapshots, gerarSnapshotDoConteudo, LINHA_BASE_CAMINHO, salvarBaseline, verificarErros } from './index.js';
+import { ensureDir, normalizePath } from '../shared/helpers/index.js';
+import micromatch from 'micromatch';
+import { GuardianError, IntegridadeStatus } from '../types/index.js';
+const { log, GuardianMensagens } = getMessages();
+function getErrMsg(err) {
+    return typeof err === 'object' && err && 'message' in err ? err.message : String(err);
+}
+async function construirSnapshot(fileEntries) {
+    const snapshot = {};
+    for (const { relPath, content } of fileEntries) {
+        if (typeof content !== 'string' || !content.trim())
+            continue;
+        try {
+            snapshot[relPath] = await gerarSnapshotDoConteudo(content);
+        }
+        catch (err) {
+            log.aviso(`\u001Fx Falha ao gerar assinatura GPG de ${relPath}: ${getErrMsg(err)}`);
+        }
+    }
+    return snapshot;
+}
+export async function scanSystemIntegrity(fileEntries, options) {
+    const agora = new Date().toISOString();
+    await ensureDir(LINHA_BASE_CAMINHO);
+    let baselineAnterior = null;
+    try {
+        baselineAnterior = await carregarBaseline();
+    }
+    catch (err) {
+        log.aviso(GuardianMensagens.baselineInvalido(getErrMsg(err)));
+    }
+    const ignorados = config.INCLUDE_EXCLUDE_RULES && config.INCLUDE_EXCLUDE_RULES.globalExcludeGlob || [];
+    const filtrados = fileEntries.filter(arquivo => {
+        const rel = normalizePath(arquivo.relPath);
+        return !micromatch.isMatch(rel, ignorados);
+    });
+    if (config.DEV_MODE) {
+        const removidos = fileEntries.length - filtrados.length;
+        log.info(GuardianMensagens.filtroAplicado(filtrados.length, removidos));
+    }
+    const { gerarSnapshotDoConteudo: gerar } = await import('./hash.js');
+    const snapshotAtual = {};
+    for (const { relPath, content } of filtrados) {
+        if (typeof content !== 'string' || !content.trim())
+            continue;
+        try {
+            snapshotAtual[relPath] = await gerar(content);
+        }
+        catch (err) {
+            log.aviso(`\u001Fx Falha ao gerar assinatura GPG de ${relPath}: ${getErrMsg(err)}`);
+        }
+    }
+    if (!baselineAnterior) {
+        if (options?.justDiff) {
+            return {
+                status: IntegridadeStatus.Ok,
+                timestamp: agora,
+                detalhes: []
+            };
+        }
+        if (!options?.suppressLogs) {
+            log.info(GuardianMensagens.baselineInicialCriado);
+        }
+        await salvarBaseline(snapshotAtual);
+        return {
+            status: IntegridadeStatus.Criado,
+            timestamp: agora
+        };
+    }
+    if (process.argv.includes('--aceitar')) {
+        if (!options?.suppressLogs) {
+            log.info(GuardianMensagens.baselineAceitoManualmente);
+        }
+        await salvarBaseline(snapshotAtual);
+        return {
+            status: IntegridadeStatus.Aceito,
+            timestamp: agora
+        };
+    }
+    const diffs = diffSnapshots(baselineAnterior, snapshotAtual);
+    const erros = verificarErros(diffs);
+    if (options?.justDiff) {
+        return {
+            status: erros.length ? IntegridadeStatus.AlteracoesDetectadas : IntegridadeStatus.Ok,
+            timestamp: agora,
+            detalhes: erros
+        };
+    }
+    if (erros.length) {
+        throw new GuardianError(erros.map(erro => ({
+            tipo: 'integridade',
+            mensagem: erro
+        })));
+    }
+    return {
+        status: IntegridadeStatus.Ok,
+        timestamp: agora
+    };
+}
+export async function acceptNewBaseline(fileEntries) {
+    const ignorados = [];
+    const ignoradosDyn = config.INCLUDE_EXCLUDE_RULES && config.INCLUDE_EXCLUDE_RULES.globalExcludeGlob || ignorados;
+    const filtrados = fileEntries.filter(arquivo => {
+        const rel = normalizePath(arquivo.relPath);
+        return !micromatch.isMatch(rel, ignoradosDyn);
+    });
+    const snapshotAtual = await construirSnapshot(filtrados);
+    await ensureDir(LINHA_BASE_CAMINHO);
+    await salvarBaseline(snapshotAtual);
+}
+//# sourceMappingURL=sentinel.js.map

package/dist/guardian/sentinel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentinel.js","sourceRoot":"","sources":["../../src/guardian/sentinel.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACzI,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,UAAU,MAAM,YAAY,CAAC;AAGpC,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,GAAG,CAAC;AAErD,MAAM,EACJ,GAAG,EACH,iBAAiB,EAClB,GAAG,WAAW,EAAE,CAAC;AAElB,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,IAAI,SAAS,IAAI,GAAG,CAAC,CAAC,CAAE,GAA2B,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACjH,CAAC;AAGD,KAAK,UAAU,iBAAiB,CAAC,WAAwB;IACvD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,EACT,OAAO,EACP,OAAO,EACR,IAAI,WAAW,EAAE,CAAC;QACjB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;YAAE,SAAS;QAC7D,IAAI,CAAC;YACH,QAAQ,CAAC,OAAO,CAAC,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,4CAA4C,OAAO,KAAK,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,WAAwB,EAAE,OAGnE;IAMC,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACvC,MAAM,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACpC,IAAI,gBAAgB,GAAoB,IAAI,CAAC;IAC7C,IAAI,CAAC;QACH,gBAAgB,GAAG,MAAM,gBAAgB,EAAE,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IAGD,MAAM,SAAS,GAAG,MAAM,CAAC,qBAAqB,IAAI,MAAM,CAAC,qBAAqB,CAAC,iBAAiB,IAAI,EAAE,CAAC;IACvG,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;QAC7C,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3C,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,EACJ,uBAAuB,EAAE,KAAK,EAC/B,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAC9B,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,KAAK,MAAM,EACT,OAAO,EACP,OAAO,EACR,IAAI,SAAS,EAAE,CAAC;QACf,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;YAAE,SAAS;QAC7D,IAAI,CAAC;YACH,aAAa,CAAC,OAAO,CAAC,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,4CAA4C,OAAO,KAAK,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YAEtB,OAAO;gBACL,MAAM,EAAE,iBAAiB,CAAC,EAAE;gBAC5B,SAAS,EAAE,KAAK;gBAChB,QAAQ,EAAE,EAAE;aACb,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC;YAC3B,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,cAAc,CAAC,aAAa,CAAC,CAAC;QACpC,OAAO;YACL,MAAM,EAAE,iBAAiB,CAAC,MAAM;YAChC,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC;YAC3B,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,yBAAyB,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,cAAc,CAAC,aAAa,CAAC,CAAC;QACpC,OAAO;YACL,MAAM,EAAE,iBAAiB,CAAC,MAAM;YAChC,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE;YACpF,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,KAAK;SAChB,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,IAAI,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzC,IAAI,EAAE,aAAsB;YAC5B,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC,CAAC,CAAC;IACP,CAAC;IACD,OAAO;QACL,MAAM,EAAE,iBAAiB,CAAC,EAAE;QAC5B,SAAS,EAAE,KAAK;KACjB,CAAC;AACJ,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,WAAwB;IAC9D,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,MAAM,YAAY,GAAG,MAAM,CAAC,qBAAqB,IAAI,MAAM,CAAC,qBAAqB,CAAC,iBAAiB,IAAI,SAAS,CAAC;IACjH,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;QAC7C,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3C,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACpC,MAAM,cAAc,CAAC,aAAa,CAAC,CAAC;AACtC,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\n// @tutanus-disable tipo-inseguro-unknown\n// Justificativa: getErrMsg recebe unknown de catch blocks intencionalmente.\n\nimport { config } from '@core/config';\nimport { getMessages } from '@core/messages';\nimport { carregarBaseline, diffSnapshots, gerarSnapshotDoConteudo, LINHA_BASE_CAMINHO, salvarBaseline, verificarErros } from '@guardian';\nimport { ensureDir, normalizePath } from '@shared/helpers';\nimport micromatch from 'micromatch';\n\nimport type { FileEntry } from '@';\nimport { GuardianError, IntegridadeStatus } from '@';\n\nconst {\n  log,\n  GuardianMensagens\n} = getMessages();\n\nfunction getErrMsg(err: unknown): string {\n  return typeof err === 'object' && err && 'message' in err ? (err as { message: string }).message : String(err);\n}\n\ntype Snapshot = Record<string, string>;\nasync function construirSnapshot(fileEntries: FileEntry[]): Promise<Snapshot> {\n  const snapshot: Snapshot = {};\n  for (const {\n    relPath,\n    content\n  } of fileEntries) {\n    if (typeof content !== 'string' || !content.trim()) continue;\n    try {\n      snapshot[relPath] = await gerarSnapshotDoConteudo(content);\n    } catch (err) {\n      log.aviso(`\\u001Fx Falha ao gerar assinatura GPG de ${relPath}: ${getErrMsg(err)}`);\n    }\n  }\n  return snapshot;\n}\nexport async function scanSystemIntegrity(fileEntries: FileEntry[], options?: {\n  justDiff?: boolean;\n  suppressLogs?: boolean;\n}): Promise<{\n  status: IntegridadeStatus;\n  timestamp: string;\n  detalhes?: string[];\n  baselineModificado?: boolean;\n}> {\n  const agora = new Date().toISOString();\n  await ensureDir(LINHA_BASE_CAMINHO);\n  let baselineAnterior: Snapshot | null = null;\n  try {\n    baselineAnterior = await carregarBaseline();\n  } catch (err) {\n    log.aviso(GuardianMensagens.baselineInvalido(getErrMsg(err)));\n  }\n\n  // Filtra entradas conforme padrões ignorados específicos do Guardian\n  const ignorados = config.INCLUDE_EXCLUDE_RULES && config.INCLUDE_EXCLUDE_RULES.globalExcludeGlob || [];\n  const filtrados = fileEntries.filter(arquivo => {\n    const rel = normalizePath(arquivo.relPath);\n    return !micromatch.isMatch(rel, ignorados);\n  });\n  if (config.DEV_MODE) {\n    const removidos = fileEntries.length - filtrados.length;\n    log.info(GuardianMensagens.filtroAplicado(filtrados.length, removidos));\n  }\n  // Usa import dinâmico para alinhar com mocks de teste (vi.mock/vi.doMock)\n  const {\n    gerarSnapshotDoConteudo: gerar\n  } = await import('./hash.js');\n  const snapshotAtual: Snapshot = {};\n  for (const {\n    relPath,\n    content\n  } of filtrados) {\n    if (typeof content !== 'string' || !content.trim()) continue;\n    try {\n      snapshotAtual[relPath] = await gerar(content);\n    } catch (err) {\n      log.aviso(`\\u001Fx Falha ao gerar assinatura GPG de ${relPath}: ${getErrMsg(err)}`);\n    }\n  }\n  if (!baselineAnterior) {\n    if (options?.justDiff) {\n      // Em modo justDiff, ausência de baseline implica sem alterações reportáveis\n      return {\n        status: IntegridadeStatus.Ok,\n        timestamp: agora,\n        detalhes: []\n      };\n    }\n    if (!options?.suppressLogs) {\n      log.info(GuardianMensagens.baselineInicialCriado);\n    }\n    await salvarBaseline(snapshotAtual);\n    return {\n      status: IntegridadeStatus.Criado,\n      timestamp: agora\n    };\n  }\n  if (process.argv.includes('--aceitar')) {\n    if (!options?.suppressLogs) {\n      log.info(GuardianMensagens.baselineAceitoManualmente);\n    }\n    await salvarBaseline(snapshotAtual);\n    return {\n      status: IntegridadeStatus.Aceito,\n      timestamp: agora\n    };\n  }\n  const diffs = diffSnapshots(baselineAnterior, snapshotAtual);\n  const erros = verificarErros(diffs);\n  if (options?.justDiff) {\n    return {\n      status: erros.length ? IntegridadeStatus.AlteracoesDetectadas : IntegridadeStatus.Ok,\n      timestamp: agora,\n      detalhes: erros\n    };\n  }\n  if (erros.length) {\n    throw new GuardianError(erros.map(erro => ({\n      tipo: 'integridade' as const,\n      mensagem: erro\n    })));\n  }\n  return {\n    status: IntegridadeStatus.Ok,\n    timestamp: agora\n  };\n}\nexport async function acceptNewBaseline(fileEntries: FileEntry[]): Promise<void> {\n  const ignorados: string[] = [];\n  // Preferir configuração dinâmica quando disponível\n  const ignoradosDyn = config.INCLUDE_EXCLUDE_RULES && config.INCLUDE_EXCLUDE_RULES.globalExcludeGlob || ignorados;\n  const filtrados = fileEntries.filter(arquivo => {\n    const rel = normalizePath(arquivo.relPath);\n    return !micromatch.isMatch(rel, ignoradosDyn);\n  });\n  const snapshotAtual = await construirSnapshot(filtrados);\n  await ensureDir(LINHA_BASE_CAMINHO);\n  await salvarBaseline(snapshotAtual);\n}"]}

package/dist/guardian/verifier.d.ts

@@ -0,0 +1,3 @@
+import type { FileEntry, RegistroIntegridade, ResultadoVerificacao } from '../types/index.js';
+export declare function verificarRegistros(fileEntries: FileEntry[], registrosSalvos: RegistroIntegridade[]): Promise<ResultadoVerificacao>;
+//# sourceMappingURL=verifier.d.ts.map

package/dist/guardian/verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../src/guardian/verifier.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,GAAG,CAAC;AAW9E,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,SAAS,EAAE,EAAE,eAAe,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAuBxI"}

package/dist/guardian/verifier.js

@@ -0,0 +1,22 @@
+import { inicializarChaves, verificarAssinatura } from './index.js';
+export async function verificarRegistros(fileEntries, registrosSalvos) {
+    const registrosMap = new Map(registrosSalvos.map(raiz => [raiz.arquivo, raiz.assinatura]));
+    const corrompidos = [];
+    await inicializarChaves();
+    for (const { relPath, content } of fileEntries) {
+        if (!relPath || typeof content !== 'string' || !content.trim())
+            continue;
+        const assinaturaEsperada = registrosMap.get(relPath);
+        if (assinaturaEsperada) {
+            const valido = await verificarAssinatura(content, assinaturaEsperada);
+            if (!valido) {
+                corrompidos.push(relPath);
+            }
+        }
+    }
+    return {
+        corrompidos,
+        verificados: registrosSalvos.length
+    };
+}
+//# sourceMappingURL=verifier.js.map

package/dist/guardian/verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../src/guardian/verifier.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAanE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,WAAwB,EAAE,eAAsC;IACvG,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,MAAM,iBAAiB,EAAE,CAAC;IAE1B,KAAK,MAAM,EACT,OAAO,EACP,OAAO,EACR,IAAI,WAAW,EAAE,CAAC;QACjB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;YAAE,SAAS;QACzE,MAAM,kBAAkB,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,kBAAkB,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;YACtE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO;QACL,WAAW;QACX,WAAW,EAAE,eAAe,CAAC,MAAM;KACpC,CAAC;AACJ,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nimport { inicializarChaves, verificarAssinatura } from '@guardian';\n\nimport type { FileEntry, RegistroIntegridade, ResultadoVerificacao } from '@';\n\n/**\n * Compara os arquivos atuais com os registros de integridade salvos e detecta divergências\n * usando verificação de assinatura GPG.\n *\n * @param fileEntries Arquivos atuais lidos do sistema\n * @param registrosSalvos Registros prévios salvos (assinaturas de referência)\n * @returns Resultado contendo lista de arquivos corrompidos e total verificado\n */\n\nexport async function verificarRegistros(fileEntries: FileEntry[], registrosSalvos: RegistroIntegridade[]): Promise<ResultadoVerificacao> {\n  const registrosMap = new Map(registrosSalvos.map(raiz => [raiz.arquivo, raiz.assinatura]));\n  const corrompidos: string[] = [];\n\n  await inicializarChaves();\n\n  for (const {\n    relPath,\n    content\n  } of fileEntries) {\n    if (!relPath || typeof content !== 'string' || !content.trim()) continue;\n    const assinaturaEsperada = registrosMap.get(relPath);\n    if (assinaturaEsperada) {\n      const valido = await verificarAssinatura(content, assinaturaEsperada);\n      if (!valido) {\n        corrompidos.push(relPath);\n      }\n    }\n  }\n  return {\n    corrompidos,\n    verificados: registrosSalvos.length\n  };\n}\n"]}

package/dist/guardian/watcher-hidden.d.ts

@@ -0,0 +1,3 @@
+import type { FileEntry } from '../types/index.js';
+export declare function vigiaOculta(arquivos: FileEntry[], caminhoRegistro?: string, autoReset?: boolean): Promise<void>;
+//# sourceMappingURL=watcher-hidden.d.ts.map

package/dist/guardian/watcher-hidden.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"watcher-hidden.d.ts","sourceRoot":"","sources":["../../src/guardian/watcher-hidden.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,GAAG,CAAC;AAMnC,wBAAsB,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,eAAe,GAAE,MAAsC,EAAE,SAAS,UAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BjJ"}

package/dist/guardian/watcher-hidden.js

@@ -0,0 +1,31 @@
+import { getMessages } from '../core/messages/index.js';
+import { carregarRegistros, inicializarChaves, REGISTRO_VIGIA_CAMINHO_PADRAO, salvarRegistros, verificarAssinatura } from './index.js';
+const { log, VigiaOcultaMensagens } = getMessages();
+export async function vigiaOculta(arquivos, caminhoRegistro = REGISTRO_VIGIA_CAMINHO_PADRAO, autoReset = true) {
+    const registros = await carregarRegistros(caminhoRegistro);
+    const mapaAnterior = new Map(registros.map(raiz => [raiz.arquivo, raiz.assinatura]));
+    const corrompidos = [];
+    await inicializarChaves();
+    for (const { relPath, content } of arquivos) {
+        if (!relPath || typeof content !== 'string' || !content.trim())
+            continue;
+        const assinaturaEsperada = mapaAnterior.get(relPath);
+        if (assinaturaEsperada) {
+            const valido = await verificarAssinatura(content, assinaturaEsperada);
+            if (!valido) {
+                corrompidos.push(relPath);
+            }
+        }
+    }
+    if (corrompidos.length > 0) {
+        log.aviso(VigiaOcultaMensagens.alteracoesDetectadas.replace('{total}', String(corrompidos.length)));
+        for (const arq of corrompidos) {
+            log.info(`  - ${arq}`);
+        }
+        if (autoReset) {
+            await salvarRegistros(arquivos, caminhoRegistro);
+            log.sucesso(VigiaOcultaMensagens.registrosRecalibrados);
+        }
+    }
+}
+//# sourceMappingURL=watcher-hidden.js.map

package/dist/guardian/watcher-hidden.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"watcher-hidden.js","sourceRoot":"","sources":["../../src/guardian/watcher-hidden.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAItI,MAAM,EACJ,GAAG,EACH,oBAAoB,EACrB,GAAG,WAAW,EAAE,CAAC;AAClB,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAqB,EAAE,kBAA0B,6BAA6B,EAAE,SAAS,GAAG,IAAI;IAChI,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAiB,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACrG,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,MAAM,iBAAiB,EAAE,CAAC;IAE1B,KAAK,MAAM,EACT,OAAO,EACP,OAAO,EACR,IAAI,QAAQ,EAAE,CAAC;QACd,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;YAAE,SAAS;QACzE,MAAM,kBAAkB,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,kBAAkB,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;YACtE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpG,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,eAAe,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;YACjD,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,qBAAqB,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nimport { getMessages } from '@core/messages';\nimport { carregarRegistros, inicializarChaves, REGISTRO_VIGIA_CAMINHO_PADRAO, salvarRegistros, verificarAssinatura } from '@guardian';\n\nimport type { FileEntry } from '@';\n\nconst {\n  log,\n  VigiaOcultaMensagens\n} = getMessages();\nexport async function vigiaOculta(arquivos: FileEntry[], caminhoRegistro: string = REGISTRO_VIGIA_CAMINHO_PADRAO, autoReset = true): Promise<void> {\n  const registros = await carregarRegistros(caminhoRegistro);\n  const mapaAnterior = new Map<string, string>(registros.map(raiz => [raiz.arquivo, raiz.assinatura]));\n  const corrompidos: string[] = [];\n\n  await inicializarChaves();\n\n  for (const {\n    relPath,\n    content\n  } of arquivos) {\n    if (!relPath || typeof content !== 'string' || !content.trim()) continue;\n    const assinaturaEsperada = mapaAnterior.get(relPath);\n    if (assinaturaEsperada) {\n      const valido = await verificarAssinatura(content, assinaturaEsperada);\n      if (!valido) {\n        corrompidos.push(relPath);\n      }\n    }\n  }\n  if (corrompidos.length > 0) {\n    log.aviso(VigiaOcultaMensagens.alteracoesDetectadas.replace('{total}', String(corrompidos.length)));\n    for (const arq of corrompidos) {\n      log.info(`  - ${arq}`);\n    }\n    if (autoReset) {\n      await salvarRegistros(arquivos, caminhoRegistro);\n      log.sucesso(VigiaOcultaMensagens.registrosRecalibrados);\n    }\n  }\n}\n"]}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { iniciarServidorApi } from './api/server.js';
+export { analyzeFile, analyzeProject } from './sdk/analyzer.js';
+export type { AnalyzeFileResult, AnalyzeProjectResult } from './types/sdk/analyzer.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAChE,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export { iniciarServidorApi } from './api/server.js';
+export { analyzeFile, analyzeProject } from './sdk/analyzer.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nexport { iniciarServidorApi } from './api/server.js';\nexport { analyzeFile, analyzeProject } from './sdk/analyzer.js';\nexport type { AnalyzeFileResult, AnalyzeProjectResult } from './types/sdk/analyzer.js';\n"]}

package/dist/lib/api.d.ts

@@ -0,0 +1,10 @@
+export interface AppInfo {
+    slug: string;
+    installUrl: string;
+    appUrl: string;
+    setupUrl?: string;
+}
+export declare const api: {
+    getAppInfo(): Promise<AppInfo>;
+};
+//# sourceMappingURL=api.d.ts.map

package/dist/lib/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/lib/api.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAWD,eAAO,MAAM,GAAG;kBACA,OAAO,CAAC,OAAO,CAAC;CAG/B,CAAC"}

package/dist/lib/api.js

@@ -0,0 +1,15 @@
+const BASE = '/api/github';
+async function request(url) {
+    const res = await fetch(url);
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) {
+        throw new Error(typeof data.erro === 'string' ? data.erro : `HTTP ${res.status}`);
+    }
+    return data;
+}
+export const api = {
+    getAppInfo() {
+        return request(`${BASE}/app-info`);
+    }
+};
+//# sourceMappingURL=api.js.map

package/dist/lib/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/lib/api.ts"],"names":[],"mappings":"AACA,MAAM,IAAI,GAAG,aAAa,CAAC;AAS3B,KAAK,UAAU,OAAO,CAAI,GAAW;IACnC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAA4B,CAAC;IAC3E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,IAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG;IACjB,UAAU;QACR,OAAO,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IACrC,CAAC;CACF,CAAC","sourcesContent":["/** Cliente mínimo para a landing (GitHub App). */\nconst BASE = '/api/github';\n\nexport interface AppInfo {\n  slug: string;\n  installUrl: string;\n  appUrl: string;\n  setupUrl?: string;\n}\n\nasync function request<T>(url: string): Promise<T> {\n  const res = await fetch(url);\n  const data = await res.json().catch(() => ({})) as Record<string, unknown>;\n  if (!res.ok) {\n    throw new Error(typeof data.erro === 'string' ? data.erro : `HTTP ${res.status}`);\n  }\n  return data as T;\n}\n\nexport const api = {\n  getAppInfo(): Promise<AppInfo> {\n    return request(`${BASE}/app-info`);\n  }\n};\n"]}

package/dist/lib/index.d.ts

@@ -0,0 +1,2 @@
+export * from './api.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC"}

package/dist/lib/index.js

@@ -0,0 +1,2 @@
+export * from './api.js';
+//# sourceMappingURL=index.js.map

package/dist/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/lib/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC","sourcesContent":["export * from './api.js';\n"]}

package/dist/licenses/disclaimer.d.ts

@@ -0,0 +1,13 @@
+import type { DisclaimerOptions } from '../types/licenses/licenses.js';
+export type { DisclaimerOptions };
+export declare function addDisclaimer({ root, disclaimerPath, dryRun }?: DisclaimerOptions): Promise<{
+    updatedArquivos: string[];
+}>;
+export declare function verifyDisclaimer({ root, disclaimerPath }?: Pick<DisclaimerOptions, 'root' | 'disclaimerPath'>): Promise<{
+    missing: string[];
+}>;
+export declare const disclaimerModule: {
+    addDisclaimer: typeof addDisclaimer;
+    verifyDisclaimer: typeof verifyDisclaimer;
+};
+//# sourceMappingURL=disclaimer.d.ts.map

package/dist/licenses/disclaimer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"disclaimer.d.ts","sourceRoot":"","sources":["../../src/licenses/disclaimer.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,YAAY,EAAE,iBAAiB,EAAE,CAAC;AAmDlC,wBAAsB,aAAa,CAAC,EAClC,IAAoB,EACpB,cAAyC,EACzC,MAAc,EACf,GAAE,iBAAsB,GAAG,OAAO,CAAC;IAClC,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B,CAAC,CAoBD;AACD,wBAAsB,gBAAgB,CAAC,EACrC,IAAoB,EACpB,cAAyC,EAC1C,GAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,GAAG,gBAAgB,CAAM,GAAG,OAAO,CAAC;IACnE,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC,CAaD;AACD,eAAO,MAAM,gBAAgB;;;CAG5B,CAAC"}