### Install tachograph-go SDK

Source: https://context7.com/way-platform/tachograph-go/llms.txt

Use 'go get' to install the tachograph-go library.

```bash
go get github.com/way-platform/tachograph-go
```

--------------------------------

### Extract Test Data Records (VU)

Source: https://github.com/way-platform/tachograph-go/blob/main/CLAUDE.md

Command to extract test data records for VU components. Use the -start flag to specify the starting number for new directories.

```bash
go run ./internal/vu/cmd/extract-testdata-records/ -start N testdata/vu/new.DDD
```

--------------------------------

### Extract Test Data Records (Card)

Source: https://github.com/way-platform/tachograph-go/blob/main/CLAUDE.md

Command to extract test data records for card components. Use the -start flag for the starting number and -i for directory walk.

```bash
go run ./internal/card/cmd/extract-testdata-records/ -start N -i testdata/card/driver/
```

--------------------------------

### Options Embedding for Inheritance

Source: https://github.com/way-platform/tachograph-go/blob/main/CLAUDE.md

Illustrates how internal options structs embed parent-layer options to inherit methods and configurations. This example shows UnmarshalOptions embedding dd.UnmarshalOptions.

```go
// card.UnmarshalOptions embeds dd.UnmarshalOptions → inherits all dd unmarshal methods
type UnmarshalOptions struct {
    dd.UnmarshalOptions
    Strict bool
}
```

--------------------------------

### Unmarshal, Authenticate, Parse, Anonymize, and Marshal Tachograph Data in Go

Source: https://github.com/way-platform/tachograph-go/blob/main/README.md

This sequence demonstrates the core workflow of processing a .DDD file using the tachograph-go SDK. It covers unmarshalling raw bytes, authenticating signatures, parsing into a structured file, anonymizing personal data, and finally marshalling back to binary format. Ensure the DDD file content is available as a byte slice before starting.

```go
// 1. Unmarshal the raw .DDD file content into a RawFile object.
rawFile, err := tachograph.Unmarshal(dddBytes)
if err != nil {
    log.Fatalf("failed to unmarshal: %v", err)
}

// 2. Authenticate the signatures within the RawFile.
authenticatedRawFile, err := tachograph.Authenticate(context.Background(), rawFile)
if err != nil {
    log.Fatalf("failed to authenticate: %v", err)
}

// 3. Parse the authenticated RawFile into a File.
parsedFile, err := tachograph.Parse(authenticatedRawFile)
if err != nil {
    log.Fatalf("failed to parse: %v", err)
}

// 4. Anonymize personal data in the parsed File.
anonymizedFile, err := tachograph.Anonymize(parsedFile)
if err != nil {
    log.Fatalf("failed to anonymize: %v", err)
}

// 5. Marshal the file back into the binary .DDD format.
mashalledBytes, err := tachograph.Marshal(anonymizedFile)
if err != nil {
    log.Fatalf("failed to marshal: %v", err)
}

```

--------------------------------

### Build and Test Commands

Source: https://github.com/way-platform/tachograph-go/blob/main/CLAUDE.md

Commands for managing dependencies, running tests, linting code, generating protobuf files, and building the project.

```bash
go mod tidy                # dependencies
./tools/mage test          # tests
./tools/mage lint          # golangci-lint (zero tolerance)
./tools/mage generate      # proto codegen + go generate
./tools/mage build         # full CI: download → generate → lint → test → tidy → cli → diff
```

--------------------------------

### Use default certificate resolver for authentication

Source: https://context7.com/way-platform/tachograph-go/llms.txt

Demonstrates using the default `CertificateResolver` which first checks embedded EU member-state CA certificates and then falls back to fetching certificates remotely over HTTP. This is useful for standard authentication flows.

```go
package main

import (
    "context"
    "fmt"
    "log"
    "os"

    "github.com/way-platform/tachograph-go"
)

func main() {
    data, err := os.ReadFile("driver_card.DDD")
    if err != nil {
        log.Fatalf("read file: %v", err)
    }

    rawFile, err := tachograph.Unmarshal(data)
    if err != nil {
        log.Fatalf("unmarshal: %v", err)
    }

    // Explicitly use the default resolver (same behavior as tachograph.Authenticate)
    resolver := tachograph.DefaultCertificateResolver()
    opts := tachograph.AuthenticateOptions{
        CertificateResolver: resolver,
        Mutate:              false,
    }

    authRaw, err := opts.Authenticate(context.Background(), rawFile)
    if err != nil {
        log.Fatalf("authenticate: %v", err)
    }
    fmt.Println("authenticated type:", authRaw.GetType())
}
```

--------------------------------

### Protobuf File Structure Diagram

Source: https://github.com/way-platform/tachograph-go/blob/main/proto/AGENTS.md

For signed EFs, include a diagram in the message comment to illustrate the Signature block from Appendix 2. This visually represents the file structure.

```protobuf
// File Structure:
//
//     EF Identification
//     └─CardIdentification
//     Signature
```

--------------------------------

### ParseOptions Struct and Parse Method

Source: https://github.com/way-platform/tachograph-go/blob/main/CLAUDE.md

Demonstrates the Options-on-Struct pattern for parsing raw tachograph files. The ParseOptions struct allows configuration, and its Parse method performs the actual parsing.

```go
type ParseOptions struct {
    PreserveRawData bool
}
func (o ParseOptions) Parse(rawFile *tachographv1.RawFile) (*tachographv1.File, error)
```

--------------------------------

### Authenticate RawFile with signature verification

Source: https://context7.com/way-platform/tachograph-go/llms.txt

Verifies RSA/ECC signatures in a RawFile and populates Authentication fields. Uses embedded EU CA certificates with an HTTP fallback. By default, the input is deep-cloned (non-mutating). In-place mutation can be enabled via AuthenticateOptions.

```go
package main

import (
    "context"
    "fmt"
    "log"
    "os"

    "github.com/way-platform/tachograph-go"
)

func main() {
    data, err := os.ReadFile("driver_card.DDD")
    if err != nil {
        log.Fatalf("read file: %v", err)
    }

    rawFile, err := tachograph.Unmarshal(data)
    if err != nil {
        log.Fatalf("unmarshal: %v", err)
    }

    ctx := context.Background()

    // Default: deep-clone input before authenticating (safe, non-mutating)
    authenticatedRaw, err := tachograph.Authenticate(ctx, rawFile)
    if err != nil {
        log.Fatalf("authenticate: %v", err)
    }
    fmt.Println("authenticated raw type:", authenticatedRaw.GetType())

    // In-place mutation (more efficient, modifies rawFile directly)
    opts := tachograph.AuthenticateOptions{
        Mutate: true,
        // Optionally supply a custom CertificateResolver:
        // CertificateResolver: myCustomResolver,
    }
    _, err = opts.Authenticate(ctx, rawFile)
    if err != nil {
        log.Fatalf("authenticate (mutating): %v", err)
    }
}
```

--------------------------------

### Tachograph CLI Usage

Source: https://github.com/way-platform/tachograph-go/blob/main/README.md

This shows the basic command structure and available subcommands for the Tachograph CLI tool. Use 'parse' to process .DDD files and 'completion' or 'help' for utility functions.

```bash
$ tachograph

  Tachograph CLI

  USAGE

    tachograph [command] [--flags]

  .DDD FILES

    parse [file ...] [--flags]  Parse .DDD files

  UTILS

    completion [command]        Generate the autocompletion script for the specified shell
    help [command]              Help about any command

  FLAGS

    -h --help                   Help for tachograph
    -v --version                Version for tachograph


```

--------------------------------

### Update Record-Level Golden Files (Card)

Source: https://github.com/way-platform/tachograph-go/blob/main/CLAUDE.md

Command to update record-level golden JSON files for card components. Run this from the internal/card package directory.

```bash
cd internal/card && go test -update .
```

--------------------------------

### Regenerate Record-Level Golden JSONs (VU)

Source: https://github.com/way-platform/tachograph-go/blob/main/CLAUDE.md

Command to regenerate record-level golden JSON files for VU components. Run this from the internal/vu package directory.

```bash
cd internal/vu && go test -update . && cd ../card && go test -update .
```

--------------------------------

### Protobuf Message with ASN.1 Definition

Source: https://github.com/way-platform/tachograph-go/blob/main/proto/AGENTS.md

Include the ASN.1 definition in comments for messages and fields that mirror Data Dictionary types. This ensures traceability and clarity.

```protobuf
// Summary of purpose.
//
// See Data Dictionary, Section X.Y.
//
// ASN.1 Definition:
//
//     MyType ::= SEQUENCE { ... }
```

--------------------------------

### Update Record-Level Golden Files for VU

Source: https://github.com/way-platform/tachograph-go/blob/main/GEMINI.md

Run this command from the internal/vu package directory to update record-level golden files. This ensures golden files reflect the latest test data.

```bash
cd internal/vu && go test -update .
```

--------------------------------

### Tachograph Processing Pipeline Overview

Source: https://github.com/way-platform/tachograph-go/blob/main/GEMINI.md

Illustrates the five-phase pipeline for processing tachograph binary files, including intermediate representations and key operations like Unmarshal, Parse, Authenticate, Anonymize, and Marshal.

```text
Binary (.DDD)
  │  Unmarshal (binary → proto)
  ▼
RawFile (TLV/TV records with raw_data)
  │  Authenticate (signature verification at raw layer)
  │  Parse (raw records → semantic structures)
  ▼
File (semantic proto messages)
  │  Anonymize (PII removal)
  │  Unparse (semantic → raw records)
  ▼
RawFile
  │  Marshal (proto → binary)
  ▼
Binary (.DDD)
```

--------------------------------

### Marshal tachograph file to binary (.DDD)

Source: https://context7.com/way-platform/tachograph-go/llms.txt

Serializes a tachograph file back into the binary .DDD format. By default, it uses the 'raw data painting' strategy for byte-for-byte round-trip fidelity. Can also marshal from semantic fields only.

```go
package main

import (
    "bytes"
    "context"
    "fmt"
    "log"
    "os"

    "github.com/way-platform/tachograph-go"
)

func main() {
    original, err := os.ReadFile("driver_card.DDD")
    if err != nil {
        log.Fatalf("read file: %v", err)
    }

    // Full pipeline: unmarshal → authenticate → parse → anonymize → marshal
    rawFile, _ := tachograph.Unmarshal(original)
    authRaw, _ := tachograph.Authenticate(context.Background(), rawFile)
    file, _ := tachograph.Parse(authRaw)        // PreserveRawData=true by default
    anonFile, _ := tachograph.Anonymize(file)

    // Default: UseRawData=true for perfect round-trip
    out, err := tachograph.Marshal(anonFile)
    if err != nil {
        log.Fatalf("marshal: %v", err)
    }
    if err := os.WriteFile("driver_card_anon.DDD", out, 0o644); err != nil {
        log.Fatalf("write: %v", err)
    }
    fmt.Println("output bytes:", len(out))

    // Verify exact round-trip fidelity on unanonymized file
    roundTripped, _ := tachograph.Marshal(file)
    fmt.Println("byte-for-byte match:", bytes.Equal(original, roundTripped))

    // Marshal from semantic fields only (no raw_data canvas)
    opts := tachograph.MarshalOptions{UseRawData: false}
    out2, err := opts.Marshal(file)
    if err != nil {
        log.Fatalf("marshal (semantic only): %v", err)
    }
    _ = out2
}
```

--------------------------------

### CLI: Parse tachograph files

Source: https://context7.com/way-platform/tachograph-go/llms.txt

The `tachograph` CLI tool can parse `.DDD` files into JSON format. It supports options for authentication, raw output, strictness, and preserving raw data.

```bash
# Install the CLI
go install github.com/way-platform/tachograph-go/cmd/tachograph@latest

# Parse a driver card file (semantic JSON output, default)
tachograph parse driver_card.DDD

# Parse with signature authentication
tachograph parse --authenticate driver_card.DDD

# Output raw intermediate format (skip semantic parsing)
tachograph parse --raw driver_card.DDD

# Parse a vehicle unit file
tachograph parse vehicle_unit.DDD

# Parse multiple files
tachograph parse card1.DDD card2.DDD vu1.DDD

# Lenient parsing (skip unrecognized tags instead of erroring)
tachograph parse --strict=false driver_card.DDD

# Parse without preserving raw bytes (lower memory, no re-marshal)
tachograph parse --preserve-raw-data=false driver_card.DDD

# Get help
tachograph --help
tachograph parse --help
```

--------------------------------

### Unmarshal DDD file to RawFile

Source: https://context7.com/way-platform/tachograph-go/llms.txt

Parses a raw .DDD binary byte slice into a tachographv1.RawFile. File type is auto-detected. Strict mode is enabled by default, returning an error on unrecognized tags. Non-strict mode can be enabled via UnmarshalOptions.

```go
package main

import (
    "fmt"
    "log"
    "os"

    "github.com/way-platform/tachograph-go"
    tachographv1 "github.com/way-platform/tachograph-go/proto/gen/go/wayplatform/connect/tachograph/v1"
)

func main() {
    data, err := os.ReadFile("driver_card.DDD")
    if err != nil {
        log.Fatalf("read file: %v", err)
    }

    // Default: strict mode (error on unrecognized tags)
    rawFile, err := tachograph.Unmarshal(data)
    if err != nil {
        log.Fatalf("unmarshal: %v", err)
    }
    fmt.Println("file type:", rawFile.GetType()) // CARD or VEHICLE_UNIT

    // Non-strict mode: skip unrecognized tags instead of erroring
    opts := tachograph.UnmarshalOptions{Strict: false}
    rawFile, err = opts.Unmarshal(data)
    if err != nil {
        log.Fatalf("unmarshal (lenient): %v", err)
    }
    _ = rawFile
    fmt.Println("type assertion:", rawFile.GetType() == tachographv1.RawFile_CARD)
}
```

--------------------------------

### Process Tachograph File: Read, Authenticate, Parse, Anonymize, Write

Source: https://context7.com/way-platform/tachograph-go/llms.txt

This function reads a .DDD file, unmarshals it, authenticates signatures, parses it into semantic structures, anonymizes PII, and writes the anonymized binary. It handles both Driver Card and Vehicle Unit types. Ensure the necessary EU CA certificates are available for authentication.

```go
package main

import (
    "context"
    "fmt"
    "log"
    "os"

    "github.com/way-platform/tachograph-go"
    "google.golang.org/protobuf/encoding/protojson"
)

func processTachographFile(inputPath, outputPath string) error {
    // 1. Read raw .DDD bytes
    data, err := os.ReadFile(inputPath)
    if err != nil {
        return fmt.Errorf("read: %w", err)
    }

    // 2. Unmarshal binary → RawFile (auto-detects Driver Card vs Vehicle Unit)
    rawFile, err := tachograph.Unmarshal(data)
    if err != nil {
        return fmt.Errorf("unmarshal: %w", err)
    }
    fmt.Printf("file type: %v\n", rawFile.GetType())

    // 3. Authenticate: verify RSA/ECC signatures using EU CA certificates
    ctx := context.Background()
    authRaw, err := tachograph.Authenticate(ctx, rawFile)
    if err != nil {
        return fmt.Errorf("authenticate: %w", err)
    }

    // 4. Parse: RawFile → semantic File (auth results propagated automatically)
    file, err := tachograph.Parse(authRaw) // PreserveRawData=true by default
    if err != nil {
        return fmt.Errorf("parse: %w", err)
    }

    // 5. Inspect semantic data
    if dc := file.GetDriverCard(); dc != nil {
        tach := dc.GetTachograph()
        id := tach.GetIdentification()
        fmt.Printf("driver: %s %s\n",
            id.GetCardHolderName().GetHolderFirstNames(),
            id.GetCardHolderName().GetHolderSurname(),
        )
        fmt.Printf("activities count: %d\n",
            len(tach.GetDriverActivityData().GetActivityChangeInfo()),
        )
        fmt.Printf("vehicles used: %d\n",
            len(tach.GetVehiclesUsed().GetCardVehicleRecords()),
        )
    }
    if vu := file.GetVehicleUnit(); vu != nil {
        fmt.Printf("vu generation: %v\n", vu.GetGeneration())
    }

    // 6. Anonymize: replace PII with deterministic test values
    anonFile, err := tachograph.Anonymize(file)
    if err != nil {
        return fmt.Errorf("anonymize: %w", err)
    }

    // 7. Marshal: serialize back to binary .DDD format
    outBytes, err := tachograph.Marshal(anonFile)
    if err != nil {
        return fmt.Errorf("marshal: %w", err)
    }

    // 8. Write anonymized file
    if err := os.WriteFile(outputPath, outBytes, 0o644); err != nil {
        return fmt.Errorf("write: %w", err)
    }

    fmt.Printf("wrote anonymized file: %s (%d bytes)\n", outputPath, len(outBytes))
    fmt.Println(protojson.Format(anonFile))
    return nil
}

func main() {
    if err := processTachographFile("driver_card.DDD", "driver_card_anon.DDD"); err != nil {
        log.Fatal(err)
    }
}

```

--------------------------------

### tachograph parse CLI command

Source: https://context7.com/way-platform/tachograph-go/llms.txt

The `tachograph` CLI tool allows parsing of `.DDD` files into JSON format. It supports various flags for controlling authentication, output modes, and parsing strictness.

```APIDOC
## CLI — `tachograph parse`

The `tachograph` CLI parses one or more `.DDD` files and outputs their contents as JSON (protojson). Authentication and raw/semantic output mode are controllable via flags.

### Installation
```bash
go install github.com/way-platform/tachograph-go/cmd/tachograph@latest
```

### Usage Examples

- **Parse a driver card file (semantic JSON output, default):**
  ```bash
  tachograph parse driver_card.DDD
  ```

- **Parse with signature authentication:**
  ```bash
  tachograph parse --authenticate driver_card.DDD
  ```

- **Output raw intermediate format (skip semantic parsing):**
  ```bash
  tachograph parse --raw driver_card.DDD
  ```

- **Parse a vehicle unit file:**
  ```bash
  tachograph parse vehicle_unit.DDD
  ```

- **Parse multiple files:**
  ```bash
  tachograph parse card1.DDD card2.DDD vu1.DDD
  ```

- **Lenient parsing (skip unrecognized tags instead of erroring):**
  ```bash
  tachograph parse --strict=false driver_card.DDD
  ```

- **Parse without preserving raw bytes (lower memory, no re-marshal):**
  ```bash
  tachograph parse --preserve-raw-data=false driver_card.DDD
  ```

### Help

```bash
tachograph --help
tachograph parse --help
```
```

--------------------------------

### Convenience Parse Function

Source: https://github.com/way-platform/tachograph-go/blob/main/CLAUDE.md

A top-level convenience function for parsing tachograph files with default options. It delegates to ParseOptions with PreserveRawData set to true.

```go
func Parse(rawFile *tachographv1.RawFile) (*tachographv1.File, error) {
    return ParseOptions{PreserveRawData: true}.Parse(rawFile)
}
```

--------------------------------

### tachograph.Authenticate

Source: https://context7.com/way-platform/tachograph-go/llms.txt

Verifies the cryptographic signatures within a RawFile and populates authentication details. It uses an embedded certificate chain and supports both non-mutating deep cloning and in-place mutation of the input RawFile.

```APIDOC
## Authenticate

### Description
Verifies the RSA/ECC signatures embedded in a `RawFile` and populates `Authentication` fields on the raw records. Uses a certificate chain rooted in EU member-state CA certificates — embedded for offline use, with an HTTP fallback for unknown issuers. By default the input is deep-cloned (non-mutating). Authentication results are automatically propagated when `Parse` is subsequently called.

### Method
`tachograph.Authenticate(ctx context.Context, rawFile *tachographv1.RawFile) (*tachographv1.RawFile, error)`

### Options
`tachograph.AuthenticateOptions{Mutate bool, CertificateResolver CertificateResolver}`

### Example
```go
package main

import (
    "context"
    "fmt"
    "log"
    "os"

    "github.com/way-platform/tachograph-go"
)

func main() {
    data, err := os.ReadFile("driver_card.DDD")
    if err != nil {
        log.Fatalf("read file: %v", err)
    }

    rawFile, err := tachograph.Unmarshal(data)
    if err != nil {
        log.Fatalf("unmarshal: %v", err)
    }

    ctx := context.Background()

    // Default: deep-clone input before authenticating (safe, non-mutating)
    authenticatedRaw, err := tachograph.Authenticate(ctx, rawFile)
    if err != nil {
        log.Fatalf("authenticate: %v", err)
    }
    fmt.Println("authenticated raw type:", authenticatedRaw.GetType())

    // In-place mutation (more efficient, modifies rawFile directly)
    opts := tachograph.AuthenticateOptions{
        Mutate: true,
        // Optionally supply a custom CertificateResolver:
        // CertificateResolver: myCustomResolver,
    }
    _, err = opts.Authenticate(ctx, rawFile)
    if err != nil {
        log.Fatalf("authenticate (mutating): %v", err)
    }
}
```
```

--------------------------------

### tachograph.Marshal

Source: https://context7.com/way-platform/tachograph-go/llms.txt

Serializes a tachographv1.File back into the binary .DDD format. It supports a 'raw data painting' strategy for byte-for-byte round-trip fidelity by default, and can also marshal from semantic fields only.

```APIDOC
## `tachograph.Marshal` — File to Binary

Serializes a `tachographv1.File` back into the binary `.DDD` format. By default uses the "raw data painting" strategy: when `raw_data` bytes are present in the parsed messages (set by `ParseOptions{PreserveRawData: true}`), the original bytes are used as a canvas and semantic fields are painted at their known offsets — guaranteeing byte-for-byte round-trip fidelity, including reserved/padding bits not represented in the proto schema.

### Options

`MarshalOptions` can be used to control the marshaling behavior. 
- `UseRawData` (bool): If true (default), uses the raw data canvas for round-trip fidelity. If false, marshals only from semantic fields.

### Example Usage

```go
// Default marshaling (UseRawData=true)
out, err := tachograph.Marshal(file)

// Marshaling from semantic fields only
opts := tachograph.MarshalOptions{UseRawData: false}
out2, err := opts.Marshal(file)
```
```

--------------------------------

### Anonymize Tachograph File with PII Removal

Source: https://context7.com/way-platform/tachograph-go/llms.txt

Creates an anonymized copy of a tachographv1.File by replacing PII with deterministic test values. Options allow preserving distances/trip data and timestamps.

```go
package main

import (
    "fmt"
    "log"
    "os"
    "context"

    "github.com/way-platform/tachograph-go"
    "google.golang.org/protobuf/encoding/protojson"
)

func main() {
    data, err := os.ReadFile("driver_card.DDD")
    if err != nil {
        log.Fatalf("read file: %v", err)
    }

    rawFile, _ := tachograph.Unmarshal(data)
    authRaw, _ := tachograph.Authenticate(context.Background(), rawFile)
    file, err := tachograph.Parse(authRaw)
    if err != nil {
        log.Fatalf("parse: %v", err)
    }

    // Full anonymization: replace all PII, shift timestamps to 2020-01-01 epoch
    anonFile, err := tachograph.Anonymize(file)
    if err != nil {
        log.Fatalf("anonymize: %v", err)
    }
    fmt.Println("anonymized:", protojson.Format(anonFile))

    // Preserve distances/trip data while still anonymizing identity fields
    opts := tachograph.AnonymizeOptions{
        PreserveDistanceAndTrips: true,
        PreserveTimestamps:       false,
    }
    anonFile2, err := opts.Anonymize(file)
    if err != nil {
        log.Fatalf("anonymize (preserve distances): %v", err)
    }
    _ = anonFile2

    // Preserve both distances and timestamps (minimal anonymization)
    opts2 := tachograph.AnonymizeOptions{
        PreserveDistanceAndTrips: true,
        PreserveTimestamps:       true,
    }
    anonFile3, err := opts2.Anonymize(file)
    if err != nil {
        log.Fatalf("anonymize (preserve all): %v", err)
    }
    _ = anonFile3
}
```

--------------------------------

### Fixed-Size Layout Constants for Data Fields

Source: https://github.com/way-platform/tachograph-go/blob/main/GEMINI.md

Defines constants for the byte indices and lengths of fixed-size data fields within tachograph files, essential for accurate binary parsing and manipulation.

```go
const (
    idxIssuingMemberState   = 0
    lenIssuingMemberState   = 1
    idxDriverIdentification = 1
    lenDriverIdentification = 14
)
```

--------------------------------

### Parse Raw Tachograph Data to Semantic File

Source: https://context7.com/way-platform/tachograph-go/llms.txt

Converts a tachographv1.RawFile into a fully-structured tachographv1.File. By default, PreserveRawData: true stores original bytes for lossless round-tripping via Marshal. Use ParseOptions to disable raw data preservation.

```go
package main

import (
    "context"
    "fmt"
    "log"
    "os"

    "github.com/way-platform/tachograph-go"
    "google.golang.org/protobuf/encoding/protojson"
)

func main() {
    data, err := os.ReadFile("driver_card.DDD")
    if err != nil {
        log.Fatalf("read file: %v", err)
    }

    rawFile, err := tachograph.Unmarshal(data)
    if err != nil {
        log.Fatalf("unmarshal: %v", err)
    }
    authenticatedRaw, err := tachograph.Authenticate(context.Background(), rawFile)
    if err != nil {
        log.Fatalf("authenticate: %v", err)
    }

    // Default: PreserveRawData=true enables Marshal round-trip later
    file, err := tachograph.Parse(authenticatedRaw)
    if err != nil {
        log.Fatalf("parse: %v", err)
    }

    // Access driver card data
    if dc := file.GetDriverCard(); dc != nil {
        id := dc.GetTachograph().GetIdentification()
        fmt.Println("holder surname:", id.GetCardHolderName().GetHolderSurname())
        fmt.Println("card number:", id.GetCardNumber().GetOwnerIdentification().GetDriverIdentification())
    }

    // Serialize to JSON for inspection or storage
    fmt.Println(protojson.Format(file))

    // Parse without preserving raw bytes (lower memory, no Marshal round-trip)
    opts := tachograph.ParseOptions{PreserveRawData: false}
    fileNoRaw, err := opts.Parse(authenticatedRaw)
    if err != nil {
        log.Fatalf("parse (no raw): %v", err)
    }
    _ = fileNoRaw
}
```

--------------------------------

### Fixed-Size Layout Constants

Source: https://github.com/way-platform/tachograph-go/blob/main/CLAUDE.md

Defines constants for fixed-size field indices and lengths used in tachograph data structures. Always validate that the data length matches the expected type length.

```go
const (
    idxIssuingMemberState   = 0
    lenIssuingMemberState   = 1
    idxDriverIdentification = 1
    lenDriverIdentification = 14
)

Always validate: `len(data) == lenExpectedType`.
```

--------------------------------

### tachograph.DefaultCertificateResolver

Source: https://context7.com/way-platform/tachograph-go/llms.txt

Returns the default CertificateResolver used during authentication. This resolver first checks embedded EU member-state CA certificates and then falls back to fetching certificates remotely over HTTP.

```APIDOC
## `tachograph.DefaultCertificateResolver` — Certificate Resolution

Returns the default `CertificateResolver` used during authentication. The default resolver first checks embedded EU member-state CA certificates (fast, offline), then falls back to fetching unknown certificates remotely over HTTP. A custom resolver can be supplied to `AuthenticateOptions.CertificateResolver` for offline-only use, certificate caching, or testing with injected certificates.

### Usage

```go
resolver := tachograph.DefaultCertificateResolver()
opts := tachograph.AuthenticateOptions{
    CertificateResolver: resolver,
    Mutate:              false,
}
authRaw, err := opts.Authenticate(context.Background(), rawFile)
```
```

--------------------------------

### tachograph.Unmarshal

Source: https://context7.com/way-platform/tachograph-go/llms.txt

Parses a raw binary tachograph data file (.DDD) into a structured RawFile object. It supports both strict and lenient modes for handling unrecognized data tags and auto-detects the file type.

```APIDOC
## Unmarshal

### Description
Parses a raw `.DDD` binary byte slice into a `tachographv1.RawFile`. The file type (Driver Card or Vehicle Unit) is auto-detected from the binary header. By default, strict mode is enabled and returns an error on any unrecognized tag. The resulting `RawFile` preserves exact binary record boundaries and is the required input for `Authenticate`.

### Method
`tachograph.Unmarshal(data []byte) (*tachographv1.RawFile, error)`

### Options
`tachograph.UnmarshalOptions{Strict bool}`

### Example
```go
package main

import (
    "fmt"
    "log"
    "os"

    "github.com/way-platform/tachograph-go"
    tachographv1 "github.com/way-platform/tachograph-go/proto/gen/go/wayplatform/connect/tachograph/v1"
)

func main() {
    data, err := os.ReadFile("driver_card.DDD")
    if err != nil {
        log.Fatalf("read file: %v", err)
    }

    // Default: strict mode (error on unrecognized tags)
    rawFile, err := tachograph.Unmarshal(data)
    if err != nil {
        log.Fatalf("unmarshal: %v", err)
    }
    fmt.Println("file type:", rawFile.GetType()) // CARD or VEHICLE_UNIT

    // Non-strict mode: skip unrecognized tags instead of erroring
    opts := tachograph.UnmarshalOptions{Strict: false}
    rawFile, err = opts.Unmarshal(data)
    if err != nil {
        log.Fatalf("unmarshal (lenient): %v", err)
    }
    _ = rawFile
    fmt.Println("type assertion:", rawFile.GetType() == tachographv1.RawFile_CARD)
}
```
```

--------------------------------

### Remove PII Directories for VU

Source: https://github.com/way-platform/tachograph-go/blob/main/GEMINI.md

After extracting test data, remove the PII directories for VU to ensure data privacy. This command removes directories that are not anonymized.

```bash
rm -rf internal/vu/testdata/records/[0-9]*-[^a]*/
```

--------------------------------

### Remove PII Directories

Source: https://github.com/way-platform/tachograph-go/blob/main/CLAUDE.md

Commands to remove directories containing PII data after anonymization. Ensure these directories are completely removed from disk.

```bash
rm -rf internal/vu/testdata/records/[0-9]*-[^a]*/
rm -rf internal/card/testdata/records/[0-9]*-[^a]*/
```

--------------------------------

### Remove PII Directories for Card

Source: https://github.com/way-platform/tachograph-go/blob/main/GEMINI.md

After extracting test data, remove the PII directories for Card to ensure data privacy. This command removes directories that are not anonymized.

```bash
rm -rf internal/card/testdata/records/[0-9]*-[^a]*/
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.