#!/usr/bin/env node
/**
 * audit-chain-append — Node CLI wrapping pack-evaluation + SHA-256 chain.
 *
 * Thomas directive 2026-05-17 evening: "It must start up and report findings
 * to a local database on the compliance and company packs, including what
 * they are allowed and not allowed to do. It must have SHA-256 installed."
 *
 * Pre-fix audit (Explore agent 2026-05-17): audit-logger.sh writes plain
 * JSONL to .claude/governance/audit/audit-YYYY-MM-DD.jsonl with NO hash
 * chain. A regulator reviewing the file cannot detect tampering — anyone
 * can edit any line and the audit trail still parses cleanly. Separately,
 * each entry lacks the pack-evaluation verdict so compliance reasoning
 * is silent on every tool call.
 *
 * This bridge consolidates both fixes. A shell hook calls:
 *
 *   node dist/cli/audit-chain-append.js \\
 *     --tool=Bash \\
 *     --input='{"command":"ls"}' \\
 *     --base-entry='{"timestamp":"...","session":"...","user":"...","outcome":{...}}' \\
 *     --audit-file=.claude/governance/audit/audit-2026-05-17.jsonl
 *
 * The CLI:
 *   1. Runs pack-enforcement-bridge logic to get verdict + triggeringPackIds.
 *   2. Reads the last line of --audit-file to get the previousHash (or
 *      "0".repeat(64) if the file is empty / missing).
 *   3. Merges the base entry + verdict fields into a single record.
 *   4. Computes currentHash = sha256(previousHash + record_json + timestamp).
 *   5. Appends the chained record to --audit-file.
 *   6. Prints the chained record to stdout for the caller.
 *
 * Exit codes:
 *   0  ok (verdict ALLOW or LOG or WARN — record appended)
 *   1  verdict DENY (record appended, hook should refuse the tool call)
 *   2  verdict REQUIRE_APPROVAL (record appended, hook should pause)
 *   3  internal error (no record appended)
 *
 * Invariant 2 (advisory, never authoritative): a chain-append failure or
 * a bridge throw must NOT block the hook. The hook is expected to swallow
 * non-zero exit codes for verdict != DENY and proceed. The DENY path is
 * the only place the customer's tool call should be refused.
 *
 * @connexum/ai-governance — runtime
 */
export {};
//# sourceMappingURL=audit-chain-append.d.ts.map