usertrust 1.3.0 → 1.4.0

package/README.md

@@ -10,13 +10,13 @@ import Anthropic from "@anthropic-ai/sdk";
 // Audit chain and policy engine still run.
 const client = await trust(new Anthropic(), { dryRun: true, budget: 50_000 });
 
-const { response, governance } = await client.messages.create({
-  model: "claude-sonnet-4.6",
+const { response, receipt } = await client.messages.create({
+  model: "claude-sonnet-4-6",
   max_tokens: 1024,
   messages: [{ role: "user", content: "Analyze this contract" }],
 });
 
-console.log(governance);
+console.log(receipt);
 
 // REQUIRED — process hangs without this
 await client.destroy();
@@ -26,7 +26,7 @@ That's it. One function wraps any supported LLM client. Every call is metered, a
 
 ### Expected Output
 
-The `governance` receipt returned from every call:
+The `receipt` returned from every call:
 
 ```
 {
@@ -35,7 +35,7 @@ The `governance` receipt returned from every call:
   transferId: "tx_m4k7p2_a1b2c3",
   auditHash: "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
   settled: true,
-  model: "claude-sonnet-4.6",
+  model: "claude-sonnet-4-6",
   provider: "anthropic",
   inputTokens: 12,
   outputTokens: 28
@@ -61,11 +61,11 @@ import OpenAI from "openai";
 
 // Anthropic
 const anthropic = await trust(new Anthropic());
-const { response, governance } = await anthropic.messages.create({ ... });
+const { response, receipt } = await anthropic.messages.create({ ... });
 
 // OpenAI
 const openai = await trust(new OpenAI());
-const { response, governance } = await openai.chat.completions.create({ ... });
+const { response, receipt } = await openai.chat.completions.create({ ... });
 
 // With options (full mode — requires TigerBeetle)
 const client = await trust(new Anthropic(), {
@@ -73,7 +73,7 @@ const client = await trust(new Anthropic(), {
 });
 ```
 
-Every call returns `{ response, governance }` where `governance` is a receipt:
+Every call returns `{ response, receipt }`:
 
 ```typescript
 {
@@ -82,7 +82,7 @@ Every call returns `{ response, governance }` where `governance` is a receipt:
   budgetRemaining: 49_858,
   auditHash: "a3f8...",
   settled: true,
-  model: "claude-sonnet-4.6",
+  model: "claude-sonnet-4-6",
   provider: "anthropic",
   timestamp: "2026-03-16T12:00:00.000Z"
 }

package/dist/audit/chain.d.ts

@@ -11,6 +11,15 @@ export interface AuditWriter {
     flush(): Promise<void>;
     release(): void;
 }
+/**
+ * Run `fn` while holding the audit writer's advisory lock for the vault whose
+ * audit log is `logPath`. Acquires the same in-process live-writer registration
+ * + on-disk lock that {@link createAuditWriter} uses, so a live writer on the
+ * same vault in this process is refused. Use this to mutate the audit log
+ * outside the writer (e.g. snapshot restore) without risking a forked chain.
+ * The lock is always released, even if `fn` throws.
+ */
+export declare function withAuditWriterLock<T>(logPath: string, fn: () => Promise<T> | T): Promise<T>;
 /**
  * Create an audit writer instance for the given vault path.
  *

package/dist/audit/chain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../../src/audit/chain.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAKrD,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IAC3B,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1D,gBAAgB,IAAI,MAAM,CAAC;IAC3B,UAAU,IAAI,OAAO,CAAC;IACtB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,IAAI,IAAI,CAAC;CAChB;AAmQD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,CAyGhE"}
+{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../../src/audit/chain.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAKrD,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IAC3B,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1D,gBAAgB,IAAI,MAAM,CAAC;IAC3B,UAAU,IAAI,OAAO,CAAC;IACtB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,IAAI,IAAI,CAAC;CAChB;AA4MD;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EAC1C,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GACtB,OAAO,CAAC,CAAC,CAAC,CASZ;AAmGD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,CAmHhE"}

package/dist/audit/chain.js

@@ -34,17 +34,30 @@ class AsyncMutex {
         return release;
     }
 }
-// ── Advisory Lock ──
+/**
+ * Dirs currently locked by a LIVE writer in THIS process → dir → writerId.
+ *
+ * A same-PID lock file is only safe to reclaim when NO live writer in this
+ * process owns the dir (i.e. the lock is from a crashed prior instance or a
+ * recycled PID). This registry is what distinguishes a crashed writer from a
+ * live sibling — reclaiming a live sibling's lock would fork the chain, which
+ * is exactly the vulnerability the advisory lock exists to prevent.
+ */
+const inProcessLockOwners = new Map();
 /**
  * Check if a lock file is stale (held by a dead process).
  * Returns true if stale and cleaned up, false if held by a live process.
  * Throws if the lock is actively held.
  */
-function tryCleanStaleLock(candidateLockPath) {
+function tryCleanStaleLock(candidateLockPath, dir) {
     try {
         const content = readFileSync(candidateLockPath, "utf-8");
         const lockData = JSON.parse(content);
-        if (lockData.pid === process.pid) {
+        if (lockData.pid === process.pid && !inProcessLockOwners.has(dir)) {
+            // Same PID but no live writer registered for this dir → the lock is
+            // from a crashed prior instance (the registry is cleared on release)
+            // or a recycled PID. A live sibling is caught earlier by the registry
+            // guard in acquireProcessLock, which throws before we ever get here.
             console.warn(`[AUDIT] Reclaiming stale same-PID lock (PID ${process.pid}). Previous process exited without releasing the lock.`);
             unlinkSync(candidateLockPath);
             return true;
@@ -83,16 +96,24 @@ function tryCleanStaleLock(candidateLockPath) {
         return true;
     }
 }
-function acquireProcessLock(logPath, locksByDir) {
+function acquireProcessLock(logPath, locksByDir, writerId) {
     const dir = dirname(logPath);
     if (locksByDir.has(dir))
         return;
+    // AUD-471: A live writer already holds this dir in THIS process → refuse.
+    // The advisory lock guarantees exactly one writer per vault per process;
+    // reclaiming a live sibling's lock (same-PID) would fork the chain because
+    // each writer keeps an independent tail cache.
+    if (inProcessLockOwners.has(dir)) {
+        throw new Error(`Audit writer lock held by another writer in this process (dir ${dir}). Only one writer per vault per process.`);
+    }
     const candidateLockPath = `${dir}/.audit-writer.lock`;
     // AUD-458: Use O_WRONLY | O_CREAT | O_EXCL atomically instead of existsSync + openSync('wx').
     // This eliminates the TOCTOU race where two processes both detect a stale lock,
     // both unlink, and both try to create — one gets EEXIST.
     const lockContent = JSON.stringify({
         pid: process.pid,
+        writerId,
         startedAt: new Date().toISOString(),
     });
     // First attempt: atomic exclusive create
@@ -106,7 +127,8 @@ function acquireProcessLock(logPath, locksByDir) {
             // AUD-459: Close fd immediately — lock semantics rely on file existence, not open fd
             closeSync(fd);
         }
-        locksByDir.set(dir, { path: candidateLockPath });
+        locksByDir.set(dir, { path: candidateLockPath, writerId });
+        inProcessLockOwners.set(dir, writerId);
         return;
     }
     catch (err) {
@@ -116,7 +138,7 @@ function acquireProcessLock(logPath, locksByDir) {
         // File exists — check if stale
     }
     // Lock file exists — check if it's stale and clean up if so
-    tryCleanStaleLock(candidateLockPath);
+    tryCleanStaleLock(candidateLockPath, dir);
     // Second attempt after stale lock cleanup. If another process raced us and
     // already re-created the lock, EEXIST here means they won — report as held.
     try {
@@ -128,7 +150,8 @@ function acquireProcessLock(logPath, locksByDir) {
         finally {
             closeSync(fd);
         }
-        locksByDir.set(dir, { path: candidateLockPath });
+        locksByDir.set(dir, { path: candidateLockPath, writerId });
+        inProcessLockOwners.set(dir, writerId);
     }
     catch (retryErr) {
         if (retryErr instanceof Error &&
@@ -149,9 +172,33 @@ function releaseLocks(locksByDir) {
         catch {
             /* already removed */
         }
+        // Clear the live-writer registration so a subsequent same-process writer
+        // (or a snapshot restore via withAuditWriterLock) can acquire the dir.
+        if (inProcessLockOwners.get(dir) === lock.writerId) {
+            inProcessLockOwners.delete(dir);
+        }
         locksByDir.delete(dir);
     }
 }
+/**
+ * Run `fn` while holding the audit writer's advisory lock for the vault whose
+ * audit log is `logPath`. Acquires the same in-process live-writer registration
+ * + on-disk lock that {@link createAuditWriter} uses, so a live writer on the
+ * same vault in this process is refused. Use this to mutate the audit log
+ * outside the writer (e.g. snapshot restore) without risking a forked chain.
+ * The lock is always released, even if `fn` throws.
+ */
+export async function withAuditWriterLock(logPath, fn) {
+    const locksByDir = new Map();
+    const writerId = randomUUID();
+    acquireProcessLock(logPath, locksByDir, writerId);
+    try {
+        return await fn();
+    }
+    finally {
+        releaseLocks(locksByDir);
+    }
+}
 function getLastEvent(logPath, cache) {
     const cached = cache.get(logPath);
     if (cached)
@@ -237,6 +284,7 @@ export function createAuditWriter(vaultPath) {
         mkdirSync(auditDir, { recursive: true });
     }
     const logPath = join(auditDir, "events.jsonl");
+    const writerId = randomUUID();
     const mutex = new AsyncMutex();
     const lastEventCache = new Map();
     const locksByDir = new Map();
@@ -245,7 +293,7 @@ export function createAuditWriter(vaultPath) {
     async function appendEvent(input) {
         const release = await mutex.acquire();
         try {
-            acquireProcessLock(logPath, locksByDir);
+            acquireProcessLock(logPath, locksByDir, writerId);
             const last = getLastEvent(logPath, lastEventCache);
             const previousHash = last?.hash ?? GENESIS_HASH;
             const sequence = (last?.sequence ?? 0) + 1;
@@ -264,9 +312,17 @@ export function createAuditWriter(vaultPath) {
                 ...event,
                 hash,
             };
+            // HARDEN: persist the CANONICAL bytes, not JSON.stringify output. The
+            // hash pre-image is `canonicalize(event)`; the verifier recomputes
+            // `sha256(canonicalize(persisted − hash))`. For any value with a
+            // `toJSON` (e.g. Buffer) `JSON.stringify` diverges from `canonicalize`,
+            // which would make an untampered event verify as TAMPERED. canonicalize
+            // is idempotent over its own output, so the bytes hashed equal the bytes
+            // persisted and the verify pkg stays in lockstep (hash format unchanged).
+            const persisted = canonicalize(fullEvent);
             const fd = openSync(logPath, "a");
             try {
-                writeSync(fd, `${JSON.stringify(fullEvent)}\n`);
+                writeSync(fd, `${persisted}\n`);
                 fsyncSync(fd);
             }
             finally {

package/dist/audit/chain.js.map

@@ -1 +1 @@
-{"version":3,"file":"chain.js","sourceRoot":"","sources":["../../src/audit/chain.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EACN,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,SAAS,GACT,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEjE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAkB9C,mBAAmB;AAEnB;;;;;;GAMG;AACH,MAAM,UAAU;IACP,KAAK,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEjD,KAAK,CAAC,OAAO;QACZ,IAAI,OAAiC,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC1C,OAAO,GAAG,OAAO,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,MAAM,IAAI,CAAC;QACX,OAAO,OAAqB,CAAC;IAC9B,CAAC;CACD;AAED,sBAAsB;AAEtB;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,iBAAyB;IACnD,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,YAAY,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAoB,CAAC;QACxD,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CACX,+CAA+C,OAAO,CAAC,GAAG,wDAAwD,CAClH,CAAC;YACF,UAAU,CAAC,iBAAiB,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC;QACb,CAAC;QACD,IAAI,CAAC;YACJ,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC9B,kCAAkC;YAClC,MAAM,IAAI,KAAK,CACd,iCAAiC,QAAQ,CAAC,GAAG,6DAA6D,iBAAiB,EAAE,CAC7H,CAAC;QACH,CAAC;QAAC,OAAO,OAAgB,EAAE,CAAC;YAC3B,IAAI,OAAO,YAAY,KAAK,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;gBACnD,MAAM,IAAI,GAAI,OAA6B,CAAC,IAAI,CAAC;gBACjD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;oBACtB,+BAA+B;oBAC/B,UAAU,CAAC,iBAAiB,CAAC,CAAC;oBAC9B,OAAO,IAAI,CAAC;gBACb,CAAC;gBACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;oBACtB,MAAM,IAAI,KAAK,CACd,iCAAiC,QAAQ,CAAC,GAAG,6DAA6D,iBAAiB,EAAE,CAC7H,CAAC;gBACH,CAAC;YACF,CAAC;YACD,MAAM,OAAO,CAAC;QACf,CAAC;IACF,CAAC;IAAC,OAAO,QAAQ,EAAE,CAAC;QACnB,IAAI,QAAQ,YAAY,KAAK,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;YACtF,MAAM,QAAQ,CAAC;QAChB,CAAC;QACD,gCAAgC;QAChC,IAAI,CAAC;YACJ,UAAU,CAAC,iBAAiB,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACR,iBAAiB;QAClB,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe,EAAE,UAAyC;IACrF,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO;IAEhC,MAAM,iBAAiB,GAAG,GAAG,GAAG,qBAAqB,CAAC;IAEtD,8FAA8F;IAC9F,gFAAgF;IAChF,yDAAyD;IACzD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;QAClC,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACnC,CAAC,CAAC;IAEH,yCAAyC;IACzC,IAAI,CAAC;QACJ,MAAM,EAAE,GAAG,QAAQ,CAClB,iBAAiB,EACjB,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,MAAM,EAC/D,KAAK,CACL,CAAC;QACF,IAAI,CAAC;YACJ,SAAS,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;YAC3B,SAAS,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;gBAAS,CAAC;YACV,qFAAqF;YACrF,SAAS,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACjD,OAAO;IACR,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG,IAAK,GAAyB,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC9F,MAAM,GAAG,CAAC;QACX,CAAC;QACD,+BAA+B;IAChC,CAAC;IAED,4DAA4D;IAC5D,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IAErC,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAI,CAAC;QACJ,MAAM,EAAE,GAAG,QAAQ,CAClB,iBAAiB,EACjB,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,MAAM,EAC/D,KAAK,CACL,CAAC;QACF,IAAI,CAAC;YACJ,SAAS,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;YAC3B,SAAS,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;gBAAS,CAAC;YACV,SAAS,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,QAAiB,EAAE,CAAC;QAC5B,IACC,QAAQ,YAAY,KAAK;YACzB,MAAM,IAAI,QAAQ;YACjB,QAA8B,CAAC,IAAI,KAAK,QAAQ,EAChD,CAAC;YACF,MAAM,IAAI,KAAK,CACd,uFAAuF,iBAAiB,EAAE,CAC1G,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,CAAC;IAChB,CAAC;AACF,CAAC;AAED,+DAA+D;AAC/D,+DAA+D;AAC/D,SAAS,YAAY,CAAC,UAAyC;IAC9D,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,UAAU,EAAE,CAAC;QACtC,IAAI,CAAC;YACJ,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACR,qBAAqB;QACtB,CAAC;QACD,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;AACF,CAAC;AASD,SAAS,YAAY,CAAC,OAAe,EAAE,KAA8B;IACpE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,QAAQ,GAAG,GAAG,OAAO,OAAO,CAAC;QACnC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACJ,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAGtD,CAAC;gBACF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACR,yBAAyB;YAC1B,CAAC;QACF,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAuC,CAAC;QACzE,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;QACpF,MAAM,IAAI,GAAe,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;QACxD,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,QAAQ,GAAG,GAAG,OAAO,OAAO,CAAC;QACnC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACJ,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAGtD,CAAC;gBACF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACR,yBAAyB;YAC1B,CAAC;QACF,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,mBAAmB;AAEnB,SAAS,eAAe,CACvB,SAAiB,EACjB,KAOC;IAED,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,gEAAgE;QAChE,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpF,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;QAElC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;QACnD,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC;YACJ,SAAS,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC7C,SAAS,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;gBAAS,CAAC;YACV,SAAS,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,2DAA2D;QAC3D,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;AACF,CAAC;AAED,gBAAgB;AAEhB;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAE/C,MAAM,KAAK,GAAG,IAAI,UAAU,EAAE,CAAC;IAC/B,MAAM,cAAc,GAAG,IAAI,GAAG,EAAsB,CAAC;IACrD,MAAM,UAAU,GAAG,IAAI,GAAG,EAA4B,CAAC;IACvD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,KAAK,UAAU,WAAW,CAAC,KAAuB;QACjD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACtC,IAAI,CAAC;YACJ,kBAAkB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAExC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YACnD,MAAM,YAAY,GAAG,IAAI,EAAE,IAAI,IAAI,YAAY,CAAC;YAChD,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAE3C,MAAM,KAAK,GAAoD;gBAC9D,EAAE,EAAE,UAAU,EAAE;gBAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,YAAY;gBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ;aACR,CAAC;YAEF,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAElE,MAAM,SAAS,GAAsC;gBACpD,GAAG,KAAK;gBACR,IAAI;aACJ,CAAC;YAEF,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC;gBACJ,SAAS,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBAChD,SAAS,CAAC,EAAE,CAAC,CAAC;YACf,CAAC;oBAAS,CAAC;gBACV,SAAS,CAAC,EAAE,CAAC,CAAC;YACf,CAAC;YACD,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YAEhD,kEAAkE;YAClE,MAAM,QAAQ,GAAG,GAAG,OAAO,OAAO,CAAC;YACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACvC,IAAI,CAAC;gBACJ,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAChE,SAAS,CAAC,MAAM,CAAC,CAAC;YACnB,CAAC;oBAAS,CAAC;gBACV,SAAS,CAAC,MAAM,CAAC,CAAC;YACnB,CAAC;YAED,OAAO,SAAS,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,QAAQ,GAAG,IAAI,CAAC;YAChB,aAAa,EAAE,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC,6CAA6C,EAAE;gBAC3D,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACvD,CAAC,CAAC;YACH,eAAe,CAAC,SAAS,EAAE;gBAC1B,MAAM,EAAE,yBAAyB;gBACjC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACvD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACnC,CAAC,CAAC;YACH,MAAM,GAAG,CAAC;QACX,CAAC;gBAAS,CAAC;YACV,OAAO,EAAE,CAAC;QACX,CAAC;IACF,CAAC;IAED,SAAS,gBAAgB;QACxB,OAAO,aAAa,CAAC;IACtB,CAAC;IAED,SAAS,YAAY;QACpB,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,KAAK;QACnB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACtC,OAAO,EAAE,CAAC;IACX,CAAC;IAED,SAAS,aAAa;QACrB,cAAc,CAAC,KAAK,EAAE,CAAC;QACvB,YAAY,CAAC,UAAU,CAAC,CAAC;QACzB,QAAQ,GAAG,KAAK,CAAC;QACjB,aAAa,GAAG,CAAC,CAAC;IACnB,CAAC;IAED,OAAO;QACN,WAAW;QACX,gBAAgB;QAChB,UAAU,EAAE,YAAY;QACxB,KAAK;QACL,OAAO,EAAE,aAAa;KACtB,CAAC;AACH,CAAC"}
+{"version":3,"file":"chain.js","sourceRoot":"","sources":["../../src/audit/chain.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EACN,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,SAAS,GACT,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEjE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAkB9C,mBAAmB;AAEnB;;;;;;GAMG;AACH,MAAM,UAAU;IACP,KAAK,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEjD,KAAK,CAAC,OAAO;QACZ,IAAI,OAAiC,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC1C,OAAO,GAAG,OAAO,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,MAAM,IAAI,CAAC;QACX,OAAO,OAAqB,CAAC;IAC9B,CAAC;CACD;AASD;;;;;;;;GAQG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEtD;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,iBAAyB,EAAE,GAAW;IAChE,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,YAAY,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAoB,CAAC;QACxD,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnE,oEAAoE;YACpE,qEAAqE;YACrE,sEAAsE;YACtE,qEAAqE;YACrE,OAAO,CAAC,IAAI,CACX,+CAA+C,OAAO,CAAC,GAAG,wDAAwD,CAClH,CAAC;YACF,UAAU,CAAC,iBAAiB,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC;QACb,CAAC;QACD,IAAI,CAAC;YACJ,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC9B,kCAAkC;YAClC,MAAM,IAAI,KAAK,CACd,iCAAiC,QAAQ,CAAC,GAAG,6DAA6D,iBAAiB,EAAE,CAC7H,CAAC;QACH,CAAC;QAAC,OAAO,OAAgB,EAAE,CAAC;YAC3B,IAAI,OAAO,YAAY,KAAK,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;gBACnD,MAAM,IAAI,GAAI,OAA6B,CAAC,IAAI,CAAC;gBACjD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;oBACtB,+BAA+B;oBAC/B,UAAU,CAAC,iBAAiB,CAAC,CAAC;oBAC9B,OAAO,IAAI,CAAC;gBACb,CAAC;gBACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;oBACtB,MAAM,IAAI,KAAK,CACd,iCAAiC,QAAQ,CAAC,GAAG,6DAA6D,iBAAiB,EAAE,CAC7H,CAAC;gBACH,CAAC;YACF,CAAC;YACD,MAAM,OAAO,CAAC;QACf,CAAC;IACF,CAAC;IAAC,OAAO,QAAQ,EAAE,CAAC;QACnB,IAAI,QAAQ,YAAY,KAAK,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;YACtF,MAAM,QAAQ,CAAC;QAChB,CAAC;QACD,gCAAgC;QAChC,IAAI,CAAC;YACJ,UAAU,CAAC,iBAAiB,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACR,iBAAiB;QAClB,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,kBAAkB,CAC1B,OAAe,EACf,UAAkC,EAClC,QAAgB;IAEhB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO;IAEhC,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,+CAA+C;IAC/C,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACd,iEAAiE,GAAG,2CAA2C,CAC/G,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,GAAG,GAAG,GAAG,qBAAqB,CAAC;IAEtD,8FAA8F;IAC9F,gFAAgF;IAChF,yDAAyD;IACzD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;QAClC,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ;QACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACnC,CAAC,CAAC;IAEH,yCAAyC;IACzC,IAAI,CAAC;QACJ,MAAM,EAAE,GAAG,QAAQ,CAClB,iBAAiB,EACjB,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,MAAM,EAC/D,KAAK,CACL,CAAC;QACF,IAAI,CAAC;YACJ,SAAS,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;YAC3B,SAAS,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;gBAAS,CAAC;YACV,qFAAqF;YACrF,SAAS,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3D,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACvC,OAAO;IACR,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG,IAAK,GAAyB,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC9F,MAAM,GAAG,CAAC;QACX,CAAC;QACD,+BAA+B;IAChC,CAAC;IAED,4DAA4D;IAC5D,iBAAiB,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAE1C,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAI,CAAC;QACJ,MAAM,EAAE,GAAG,QAAQ,CAClB,iBAAiB,EACjB,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,MAAM,EAC/D,KAAK,CACL,CAAC;QACF,IAAI,CAAC;YACJ,SAAS,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;YAC3B,SAAS,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;gBAAS,CAAC;YACV,SAAS,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3D,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,QAAiB,EAAE,CAAC;QAC5B,IACC,QAAQ,YAAY,KAAK;YACzB,MAAM,IAAI,QAAQ;YACjB,QAA8B,CAAC,IAAI,KAAK,QAAQ,EAChD,CAAC;YACF,MAAM,IAAI,KAAK,CACd,uFAAuF,iBAAiB,EAAE,CAC1G,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,CAAC;IAChB,CAAC;AACF,CAAC;AAED,+DAA+D;AAC/D,+DAA+D;AAC/D,SAAS,YAAY,CAAC,UAAkC;IACvD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,UAAU,EAAE,CAAC;QACtC,IAAI,CAAC;YACJ,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACR,qBAAqB;QACtB,CAAC;QACD,yEAAyE;QACzE,uEAAuE;QACvE,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpD,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QACD,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;AACF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAe,EACf,EAAwB;IAExB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAqB,CAAC;IAChD,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;IAC9B,kBAAkB,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,CAAC;QACJ,OAAO,MAAM,EAAE,EAAE,CAAC;IACnB,CAAC;YAAS,CAAC;QACV,YAAY,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;AACF,CAAC;AASD,SAAS,YAAY,CAAC,OAAe,EAAE,KAA8B;IACpE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,QAAQ,GAAG,GAAG,OAAO,OAAO,CAAC;QACnC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACJ,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAGtD,CAAC;gBACF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACR,yBAAyB;YAC1B,CAAC;QACF,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAuC,CAAC;QACzE,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;QACpF,MAAM,IAAI,GAAe,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;QACxD,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,QAAQ,GAAG,GAAG,OAAO,OAAO,CAAC;QACnC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACJ,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAGtD,CAAC;gBACF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACR,yBAAyB;YAC1B,CAAC;QACF,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,mBAAmB;AAEnB,SAAS,eAAe,CACvB,SAAiB,EACjB,KAOC;IAED,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,gEAAgE;QAChE,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpF,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;QAElC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;QACnD,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC;YACJ,SAAS,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC7C,SAAS,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;gBAAS,CAAC;YACV,SAAS,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,2DAA2D;QAC3D,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;AACF,CAAC;AAED,gBAAgB;AAEhB;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAE/C,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,UAAU,EAAE,CAAC;IAC/B,MAAM,cAAc,GAAG,IAAI,GAAG,EAAsB,CAAC;IACrD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAqB,CAAC;IAChD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,KAAK,UAAU,WAAW,CAAC,KAAuB;QACjD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACtC,IAAI,CAAC;YACJ,kBAAkB,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YAElD,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YACnD,MAAM,YAAY,GAAG,IAAI,EAAE,IAAI,IAAI,YAAY,CAAC;YAChD,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAE3C,MAAM,KAAK,GAAoD;gBAC9D,EAAE,EAAE,UAAU,EAAE;gBAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,YAAY;gBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ;aACR,CAAC;YAEF,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAElE,MAAM,SAAS,GAAsC;gBACpD,GAAG,KAAK;gBACR,IAAI;aACJ,CAAC;YAEF,sEAAsE;YACtE,mEAAmE;YACnE,iEAAiE;YACjE,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,0EAA0E;YAC1E,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;YAE1C,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC;gBACJ,SAAS,CAAC,EAAE,EAAE,GAAG,SAAS,IAAI,CAAC,CAAC;gBAChC,SAAS,CAAC,EAAE,CAAC,CAAC;YACf,CAAC;oBAAS,CAAC;gBACV,SAAS,CAAC,EAAE,CAAC,CAAC;YACf,CAAC;YACD,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YAEhD,kEAAkE;YAClE,MAAM,QAAQ,GAAG,GAAG,OAAO,OAAO,CAAC;YACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACvC,IAAI,CAAC;gBACJ,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAChE,SAAS,CAAC,MAAM,CAAC,CAAC;YACnB,CAAC;oBAAS,CAAC;gBACV,SAAS,CAAC,MAAM,CAAC,CAAC;YACnB,CAAC;YAED,OAAO,SAAS,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,QAAQ,GAAG,IAAI,CAAC;YAChB,aAAa,EAAE,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC,6CAA6C,EAAE;gBAC3D,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACvD,CAAC,CAAC;YACH,eAAe,CAAC,SAAS,EAAE;gBAC1B,MAAM,EAAE,yBAAyB;gBACjC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACvD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACnC,CAAC,CAAC;YACH,MAAM,GAAG,CAAC;QACX,CAAC;gBAAS,CAAC;YACV,OAAO,EAAE,CAAC;QACX,CAAC;IACF,CAAC;IAED,SAAS,gBAAgB;QACxB,OAAO,aAAa,CAAC;IACtB,CAAC;IAED,SAAS,YAAY;QACpB,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,KAAK;QACnB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACtC,OAAO,EAAE,CAAC;IACX,CAAC;IAED,SAAS,aAAa;QACrB,cAAc,CAAC,KAAK,EAAE,CAAC;QACvB,YAAY,CAAC,UAAU,CAAC,CAAC;QACzB,QAAQ,GAAG,KAAK,CAAC;QACjB,aAAa,GAAG,CAAC,CAAC;IACnB,CAAC;IAED,OAAO;QACN,WAAW;QACX,gBAAgB;QAChB,UAAU,EAAE,YAAY;QACxB,KAAK;QACL,OAAO,EAAE,aAAa;KACtB,CAAC;AACH,CAAC"}

package/dist/audit/verify.d.ts

@@ -6,5 +6,24 @@ export interface ChainVerificationResult {
     latestHash: string;
     verifiedAt: string;
 }
+export interface VaultVerificationResult {
+    valid: boolean;
+    errors: string[];
+    chainLength: number;
+    validHashes: number;
+    merkleRoot: string | null;
+    firstEvent: string | null;
+    lastEvent: string | null;
+}
 export declare function verifyChain(logPath: string): ChainVerificationResult;
+/**
+ * Verify an entire `.usertrust` vault directory, anchored to the `.meta` head.
+ *
+ * Gathers `events.jsonl` plus every rotated `*.jsonl` segment, orders all events
+ * by the persisted global `sequence`, walks a single continuous chain (GENESIS
+ * required only at the global head), enforces sequence continuity (so whole-
+ * segment deletion surfaces as a sequence gap rather than an indistinguishable
+ * "previousHash mismatch"), and checks the `.meta` tail anchor.
+ */
+export declare function verifyVault(vaultPath: string): VaultVerificationResult;
 //# sourceMappingURL=verify.d.ts.map

package/dist/audit/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/audit/verify.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,uBAAuB;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,uBAAuB,CAiFpE"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/audit/verify.ts"],"names":[],"mappings":"AA6BA,MAAM,WAAW,uBAAuB;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AA0BD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,uBAAuB,CAgGpE;AAaD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,uBAAuB,CAuKtE"}

package/dist/audit/verify.js

@@ -7,29 +7,63 @@
  * 1. Each event's hash matches the SHA-256 of its canonical representation
  * 2. Each event's previousHash links to the prior event's hash
  * 3. The first event chains from GENESIS_HASH
+ * 4. The fsync'd `.meta` head anchor matches the tail (detects truncation /
+ *    deletion of an otherwise internally-consistent chain)
+ *
+ * `verifyVault` extends this across rotated segment files: it parses every
+ * `*.jsonl` segment, orders by the persisted global `sequence`, walks ONE
+ * continuous chain (GENESIS required only at the global head), and checks the
+ * `.meta` tail anchor. This algorithm is mirrored byte-for-byte in the zero-dep
+ * `usertrust-verify` package (packages/verify/src/index.ts) — the differential
+ * test pins them together.
  */
 import { createHash } from "node:crypto";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { basename, join } from "node:path";
 import { GENESIS_HASH } from "../shared/constants.js";
 import { canonicalize } from "./canonical.js";
+import { buildMerkleTree } from "./merkle.js";
+/**
+ * Read the `.meta` head anchor sidecar. Fail-closed:
+ *  - absent → `null` (unanchored / legacy vault; allowed)
+ *  - present but unparseable or missing `lastHash`/`sequence` → `{ corrupt: true }`
+ *    (tampering the anchor must NOT silently disable it)
+ */
+function readAnchor(metaPath) {
+    if (!existsSync(metaPath))
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(metaPath, "utf-8"));
+        if (typeof parsed.lastHash === "string" && typeof parsed.sequence === "number") {
+            return { lastHash: parsed.lastHash, sequence: parsed.sequence };
+        }
+        return { corrupt: true };
+    }
+    catch {
+        return { corrupt: true };
+    }
+}
 export function verifyChain(logPath) {
     const errors = [];
-    if (!existsSync(logPath)) {
-        return {
-            valid: true,
-            eventsVerified: 0,
-            errors: [],
-            skipped: 0,
-            latestHash: GENESIS_HASH,
-            verifiedAt: new Date().toISOString(),
-        };
+    const anchorRaw = readAnchor(`${logPath}.meta`);
+    let anchor = null;
+    if (anchorRaw !== null) {
+        if ("corrupt" in anchorRaw) {
+            errors.push("Audit anchor (.meta) present but corrupt");
+        }
+        else {
+            anchor = anchorRaw;
+        }
     }
-    const content = readFileSync(logPath, "utf-8").trim();
-    if (!content) {
+    const content = existsSync(logPath) ? readFileSync(logPath, "utf-8").trim() : "";
+    if (content === "") {
+        if (anchor && anchor.sequence > 0) {
+            errors.push(`Audit log missing/empty but anchor records ${anchor.sequence} event(s)`);
+        }
         return {
-            valid: true,
+            valid: errors.length === 0,
             eventsVerified: 0,
-            errors: [],
+            errors,
             skipped: 0,
             latestHash: GENESIS_HASH,
             verifiedAt: new Date().toISOString(),
@@ -70,6 +104,14 @@ export function verifyChain(logPath) {
         expectedPreviousHash = storedHash;
         latestHash = storedHash;
     }
+    if (anchor) {
+        if (latestHash !== anchor.lastHash) {
+            errors.push(`anchor mismatch: expected last hash ${anchor.lastHash}, got ${latestHash} (tail truncation)`);
+        }
+        if (lines.length !== anchor.sequence) {
+            errors.push(`anchor mismatch: expected ${anchor.sequence} event(s), found ${lines.length} (truncation/deletion)`);
+        }
+    }
     return {
         valid: errors.length === 0,
         eventsVerified: lines.length,
@@ -79,4 +121,164 @@ export function verifyChain(logPath) {
         verifiedAt: new Date().toISOString(),
     };
 }
+/**
+ * Verify an entire `.usertrust` vault directory, anchored to the `.meta` head.
+ *
+ * Gathers `events.jsonl` plus every rotated `*.jsonl` segment, orders all events
+ * by the persisted global `sequence`, walks a single continuous chain (GENESIS
+ * required only at the global head), enforces sequence continuity (so whole-
+ * segment deletion surfaces as a sequence gap rather than an indistinguishable
+ * "previousHash mismatch"), and checks the `.meta` tail anchor.
+ */
+export function verifyVault(vaultPath) {
+    const auditDir = join(vaultPath, "audit");
+    const errors = [];
+    // 1-2. Gather segment files: events.jsonl first, then every other *.jsonl.
+    const segmentFiles = [];
+    const mainLog = join(auditDir, "events.jsonl");
+    if (existsSync(mainLog)) {
+        segmentFiles.push(mainLog);
+    }
+    if (existsSync(auditDir)) {
+        try {
+            for (const entry of readdirSync(auditDir).sort()) {
+                if (entry.endsWith(".jsonl") && entry !== "events.jsonl") {
+                    segmentFiles.push(join(auditDir, entry));
+                }
+            }
+        }
+        catch {
+            // Directory read failure — non-fatal
+        }
+    }
+    // 3. Read the head anchor, fail-closed.
+    const anchorRaw = readAnchor(`${mainLog}.meta`);
+    let anchor = null;
+    if (anchorRaw !== null) {
+        if ("corrupt" in anchorRaw) {
+            errors.push("Audit anchor (.meta) present but corrupt");
+        }
+        else {
+            anchor = anchorRaw;
+        }
+    }
+    // 4. No segment files.
+    if (segmentFiles.length === 0) {
+        if (!existsSync(auditDir)) {
+            errors.push(`Audit directory not found: ${auditDir}`);
+        }
+        if (anchor && anchor.sequence > 0) {
+            errors.push(`Audit log missing but anchor records ${anchor.sequence} event(s) (deletion detected)`);
+        }
+        return {
+            valid: errors.length === 0,
+            errors,
+            chainLength: 0,
+            validHashes: 0,
+            merkleRoot: null,
+            firstEvent: null,
+            lastEvent: null,
+        };
+    }
+    // 5. Parse every line of every segment.
+    const events = [];
+    for (const segmentFile of segmentFiles) {
+        let content;
+        try {
+            content = readFileSync(segmentFile, "utf-8").trim();
+        }
+        catch {
+            // Unreadable segment (e.g. broken symlink) — skip.
+            continue;
+        }
+        if (content === "")
+            continue;
+        const lines = content.split("\n").filter((l) => l.trim());
+        for (let i = 0; i < lines.length; i++) {
+            const raw = lines[i];
+            try {
+                const parsed = JSON.parse(raw);
+                events.push({
+                    id: typeof parsed.id === "string" ? parsed.id : "",
+                    hash: typeof parsed.hash === "string" ? parsed.hash : "",
+                    previousHash: typeof parsed.previousHash === "string" ? parsed.previousHash : "",
+                    sequence: typeof parsed.sequence === "number" ? parsed.sequence : undefined,
+                    timestamp: typeof parsed.timestamp === "string" ? parsed.timestamp : undefined,
+                    parsed,
+                    sourceFile: segmentFile,
+                    line: i + 1,
+                });
+            }
+            catch {
+                errors.push(`malformed JSON (${basename(segmentFile)}:${i + 1})`);
+            }
+        }
+    }
+    // 6. Order by the persisted global sequence when available (legacy fallback:
+    // file order, for hand-built sequence-less single-segment fixtures).
+    const allHaveSeq = events.every((e) => typeof e.sequence === "number");
+    const ordered = allHaveSeq
+        ? [...events].sort((a, b) => a.sequence - b.sequence)
+        : events;
+    // 7. One continuous continuity walk.
+    let expectedPrev = GENESIS_HASH;
+    let validHashes = 0;
+    let firstEvent = null;
+    let lastEvent = null;
+    for (let i = 0; i < ordered.length; i++) {
+        const e = ordered[i];
+        if (e.previousHash !== expectedPrev) {
+            errors.push(`Event ${i + 1} (${e.id}): previousHash mismatch. Expected ${expectedPrev}, got ${e.previousHash}`);
+        }
+        if (allHaveSeq && i === 0 && e.sequence !== 1) {
+            errors.push(`Sequence starts at ${e.sequence}, expected 1 (leading events deleted)`);
+        }
+        if (allHaveSeq && i > 0) {
+            const prevSeq = ordered[i - 1].sequence;
+            if (e.sequence !== prevSeq + 1) {
+                errors.push(`Sequence gap: event ${e.sequence} follows ${prevSeq} (segment/event deletion)`);
+            }
+        }
+        const { hash: _storedHash, ...rest } = e.parsed;
+        const computed = createHash("sha256").update(canonicalize(rest)).digest("hex");
+        if (e.hash !== computed) {
+            errors.push(`Event ${i + 1} (${e.id}): hash mismatch. Expected ${computed}, got ${e.hash}`);
+        }
+        else {
+            validHashes++;
+        }
+        if (e.timestamp) {
+            if (firstEvent === null)
+                firstEvent = e.timestamp;
+            lastEvent = e.timestamp;
+        }
+        expectedPrev = e.hash;
+    }
+    // 8. Tail anchor (only when the anchor is present and well-formed).
+    if (anchor) {
+        const last = ordered.at(-1);
+        if (last && last.hash !== anchor.lastHash) {
+            errors.push(`anchor mismatch: expected last hash ${anchor.lastHash}, got ${last.hash} (tail truncation)`);
+        }
+        if (ordered.length !== anchor.sequence) {
+            errors.push(`anchor mismatch: expected ${anchor.sequence} event(s), found ${ordered.length} (truncation/deletion)`);
+        }
+    }
+    // 9. Merkle root over the ordered event hashes (informational).
+    let merkleRoot = null;
+    if (ordered.length > 0) {
+        const tree = buildMerkleTree(ordered.map((e) => e.hash));
+        merkleRoot = tree.root ?? null;
+    }
+    // 10.
+    return {
+        valid: errors.length === 0,
+        errors,
+        chainLength: events.length,
+        validHashes,
+        merkleRoot,
+        firstEvent,
+        lastEvent,
+    };
+}
 //# sourceMappingURL=verify.js.map

package/dist/audit/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/audit/verify.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAW9C,MAAM,UAAU,WAAW,CAAC,OAAe;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO;YACN,KAAK,EAAE,IAAI;YACX,cAAc,EAAE,CAAC;YACjB,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,YAAY;YACxB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO;YACN,KAAK,EAAE,IAAI;YACX,cAAc,EAAE,CAAC;YACjB,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,YAAY;YACxB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,oBAAoB,GAAG,YAAY,CAAC;IACxC,IAAI,UAAU,GAAG,YAAY,CAAC;IAC9B,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;QAEhC,IAAI,KAAiB,CAAC;QACtB,IAAI,CAAC;YACJ,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;QACxC,CAAC;QAAC,OAAO,SAAS,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CACV,IAAI,CAAC,SAAS,CAAC;gBACd,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,KAAK,EAAE,gBAAgB;gBACvB,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;aAC3B,CAAC,CACF,CAAC;YACF,4DAA4D;YAC5D,iEAAiE;YACjE,OAAO,EAAE,CAAC;YACV,SAAS;QACV,CAAC;QAED,IAAI,KAAK,CAAC,YAAY,KAAK,oBAAoB,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CACV,SAAS,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,EAAE,4BAA4B;gBACtD,YAAY,oBAAoB,SAAS,KAAK,CAAC,YAAY,EAAE,CAC9D,CAAC;QACH,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,gBAAgB,EAAE,GAAG,KAAK,CAAC;QACxD,MAAM,SAAS,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;QACjD,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE1E,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CACV,SAAS,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,EAAE,oBAAoB;gBAC9C,YAAY,YAAY,SAAS,UAAU,EAAE,CAC9C,CAAC;QACH,CAAC;QAED,oBAAoB,GAAG,UAAU,CAAC;QAClC,UAAU,GAAG,UAAU,CAAC;IACzB,CAAC;IAED,OAAO;QACN,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,cAAc,EAAE,KAAK,CAAC,MAAM;QAC5B,MAAM;QACN,OAAO;QACP,UAAU;QACV,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;AACH,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/audit/verify.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AA0B9C;;;;;GAKG;AACH,SAAS,UAAU,CAAC,QAAgB;IACnC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAA4B,CAAC;QACtF,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChF,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;AACF,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAe;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,OAAO,OAAO,CAAC,CAAC;IAChD,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACxB,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QACzD,CAAC;aAAM,CAAC;YACP,MAAM,GAAG,SAAS,CAAC;QACpB,CAAC;IACF,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACpB,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,8CAA8C,MAAM,CAAC,QAAQ,WAAW,CAAC,CAAC;QACvF,CAAC;QACD,OAAO;YACN,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC1B,cAAc,EAAE,CAAC;YACjB,MAAM;YACN,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,YAAY;YACxB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,oBAAoB,GAAG,YAAY,CAAC;IACxC,IAAI,UAAU,GAAG,YAAY,CAAC;IAC9B,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;QAEhC,IAAI,KAAiB,CAAC;QACtB,IAAI,CAAC;YACJ,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;QACxC,CAAC;QAAC,OAAO,SAAS,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CACV,IAAI,CAAC,SAAS,CAAC;gBACd,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,KAAK,EAAE,gBAAgB;gBACvB,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;aAC3B,CAAC,CACF,CAAC;YACF,4DAA4D;YAC5D,iEAAiE;YACjE,OAAO,EAAE,CAAC;YACV,SAAS;QACV,CAAC;QAED,IAAI,KAAK,CAAC,YAAY,KAAK,oBAAoB,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CACV,SAAS,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,EAAE,4BAA4B;gBACtD,YAAY,oBAAoB,SAAS,KAAK,CAAC,YAAY,EAAE,CAC9D,CAAC;QACH,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,gBAAgB,EAAE,GAAG,KAAK,CAAC;QACxD,MAAM,SAAS,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;QACjD,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE1E,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CACV,SAAS,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,EAAE,oBAAoB;gBAC9C,YAAY,YAAY,SAAS,UAAU,EAAE,CAC9C,CAAC;QACH,CAAC;QAED,oBAAoB,GAAG,UAAU,CAAC;QAClC,UAAU,GAAG,UAAU,CAAC;IACzB,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACZ,IAAI,UAAU,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CACV,uCAAuC,MAAM,CAAC,QAAQ,SAAS,UAAU,oBAAoB,CAC7F,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CACV,6BAA6B,MAAM,CAAC,QAAQ,oBAAoB,KAAK,CAAC,MAAM,wBAAwB,CACpG,CAAC;QACH,CAAC;IACF,CAAC;IAED,OAAO;QACN,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,cAAc,EAAE,KAAK,CAAC,MAAM;QAC5B,MAAM;QACN,OAAO;QACP,UAAU;QACV,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;AACH,CAAC;AAaD;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,2EAA2E;IAC3E,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC/C,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC;YACJ,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBAClD,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,cAAc,EAAE,CAAC;oBAC1D,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;gBAC1C,CAAC;YACF,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,qCAAqC;QACtC,CAAC;IACF,CAAC;IAED,wCAAwC;IACxC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,OAAO,OAAO,CAAC,CAAC;IAChD,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACxB,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QACzD,CAAC;aAAM,CAAC;YACP,MAAM,GAAG,SAAS,CAAC;QACpB,CAAC;IACF,CAAC;IAED,uBAAuB;IACvB,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,8BAA8B,QAAQ,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CACV,wCAAwC,MAAM,CAAC,QAAQ,+BAA+B,CACtF,CAAC;QACH,CAAC;QACD,OAAO;YACN,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC1B,MAAM;YACN,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,CAAC;YACd,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;SACf,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACxC,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACJ,OAAO,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACR,mDAAmD;YACnD,SAAS;QACV,CAAC;QACD,IAAI,OAAO,KAAK,EAAE;YAAE,SAAS;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;YAC/B,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;gBAC1D,MAAM,CAAC,IAAI,CAAC;oBACX,EAAE,EAAE,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;oBAClD,IAAI,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;oBACxD,YAAY,EAAE,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;oBAChF,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;oBAC3E,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;oBAC9E,MAAM;oBACN,UAAU,EAAE,WAAW;oBACvB,IAAI,EAAE,CAAC,GAAG,CAAC;iBACX,CAAC,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACR,MAAM,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnE,CAAC;QACF,CAAC;IACF,CAAC;IAED,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,UAAU;QACzB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,QAAmB,GAAI,CAAC,CAAC,QAAmB,CAAC;QAC7E,CAAC,CAAC,MAAM,CAAC;IAEV,qCAAqC;IACrC,IAAI,YAAY,GAAG,YAAY,CAAC;IAChC,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAgB,CAAC;QAEpC,IAAI,CAAC,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CACV,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,sCAAsC,YAAY,SAAS,CAAC,CAAC,YAAY,EAAE,CAClG,CAAC;QACH,CAAC;QAED,IAAI,UAAU,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,QAAQ,uCAAuC,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,UAAU,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,OAAO,GAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAiB,CAAC,QAAkB,CAAC;YACnE,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CACV,uBAAuB,CAAC,CAAC,QAAQ,YAAY,OAAO,2BAA2B,CAC/E,CAAC;YACH,CAAC;QACF,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;QAChD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/E,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,8BAA8B,QAAQ,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;aAAM,CAAC;YACP,WAAW,EAAE,CAAC;QACf,CAAC;QAED,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;YACjB,IAAI,UAAU,KAAK,IAAI;gBAAE,UAAU,GAAG,CAAC,CAAC,SAAS,CAAC;YAClD,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;QACzB,CAAC;QAED,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,oEAAoE;IACpE,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CACV,uCAAuC,MAAM,CAAC,QAAQ,SAAS,IAAI,CAAC,IAAI,oBAAoB,CAC5F,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CACV,6BAA6B,MAAM,CAAC,QAAQ,oBAAoB,OAAO,CAAC,MAAM,wBAAwB,CACtG,CAAC;QACH,CAAC;IACF,CAAC;IAED,gEAAgE;IAChE,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,UAAU,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;IAChC,CAAC;IAED,MAAM;IACN,OAAO;QACN,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM;QACN,WAAW,EAAE,MAAM,CAAC,MAAM;QAC1B,WAAW;QACX,UAAU;QACV,UAAU;QACV,SAAS;KACT,CAAC;AACH,CAAC"}

package/dist/cli/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/cli/init.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,UAAU;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;CACtB;AAgCD,wBAAsB,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAuO5E"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/cli/init.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,UAAU;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;CACtB;AAwCD,wBAAsB,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAuO5E"}

package/dist/cli/init.js

@@ -19,7 +19,15 @@ const ENV_VAR_MAP = {
     google: "GOOGLE_API_KEY",
 };
 const DEFAULT_POLICY = `rules:
-  - name: block-zero-budget
+  - name: block-budget-overshoot
+    effect: deny
+    enforcement: hard
+    conditions:
+      - field: budget_remaining_after
+        operator: lt
+        value: 0
+
+  - name: block-budget-exhausted
     effect: deny
     enforcement: hard
     conditions: