@attested-intelligence/aga-mcp-server 3.3.2 → 3.5.0

package/CHANGELOG.md

@@ -0,0 +1,164 @@
+# Changelog
+
+All notable changes to `@attested-intelligence/aga-mcp-server` are recorded here, newest first. This package follows [Semantic Versioning](https://semver.org). The signed receipt and evidence-bundle wire format is the canonical SEP profile; any format-affecting change is called out explicitly.
+
+## 3.5.0 — 2026-08-29
+
+**Version ruled 2026-08-29.** `3.4.0` was claimed by two different trees ~93 commits apart, so
+publishing either line under that number would permanently burn it for the other. This line ships as
+**3.5.0** and `3.4.0` is abandoned unpublished. Everything below — the 2026-08-28 honesty and safety
+work *and* the 3.4.0 work completed 2026-07-31 — releases together; npm `latest` has been 3.3.3 since
+2026-07-03.
+
+### BEHAVIOR CHANGE — TTL expiry now fails closed
+
+**If you rely on measurement continuing after an artifact's TTL lapses, this release breaks that.**
+Founder decision D1, ruled 2026-08-29.
+
+Previously `Portal.measure()` treated TTL expiry as *graceful degradation*: it moved the portal to
+`SAFE_STATE`, logged the reason, and **kept accepting measurements indefinitely**. An expired artifact
+therefore went on being measured, and the receipt recorded no enforcement because none occurred.
+
+Now TTL expiry sets `TERMINATED`, exactly as the sibling revocation branch always has — TTL was the
+odd one out, not the new behavior. Concretely:
+
+- The first post-expiry `measure()` returns `ttl_ok: false`, `degraded: true`, and the portal is
+  `TERMINATED`.
+- **Any subsequent `measure()` throws `Portal is terminated`.** Re-attestation is the only way back.
+  Callers that looped on `measure()` past expiry must handle this.
+- `measure_integrity` now seals `enforcement_action: 'TERMINATE'` on TTL expiry, and that is accurate:
+  termination genuinely happens. The invariant across every version of this code is unchanged — the
+  receipt says what actually happened. Only the underlying behavior moved.
+- The `TTL_EXPIRED` degradation entry is still written. It is the forensic record of *why* the portal
+  terminated, and dropping it would trade one honesty problem for another.
+
+**Semver note, stated plainly:** this is a behavioral break and a strict reading argues for a major
+version. It ships as a minor because the previous behavior contradicted the documented intent, and
+because no released consumer depends on post-expiry measurement (npm `latest` has been 3.3.3 since
+2026-07-03). If that reading is wrong for your deployment, pin `3.3.3`.
+
+Found while implementing this: `tests/core/fail-closed.test.ts` contained a test named
+**"fail-closed: expired TTL blocks execution"** that asserted `SAFE_STATE` — the state in which
+measurement *continues*. A test whose name claimed the boundary blocked execution had been green while
+proving it did not. It now asserts termination and that a second call throws. Six other assertions
+across four files encoded the old behavior and were updated with it; all were seen to go red before
+going green.
+
+Checked and unchanged: no shipped document and no public page makes a TTL enforcement claim, so this
+change corrects no external copy.
+
+### Documentation: proxy key-persistence claims corrected
+
+`DEPLOYMENT.md` and `THREAT_BOUNDARY.md` ship inside this tarball, and both described key persistence
+that **`aga-proxy` does not implement**. DEPLOYMENT §1 is explicitly about the proxy; §2 then told
+operators to set `AGA_GATEWAY_KEY` / `AGA_GATEWAY_KEY_FILE`, said the ephemeral fallback "warns on
+stderr", and pointed at `get_server_info`. For the proxy none of that is true — an operator following
+it pinned a key that rotates on the next restart.
+
+- `GovernanceProxy` calls `generateSigner()` unconditionally in its constructor: no key CLI option, no
+  environment variable, no signer through `ProxyServerOptions`. Two runs with an identical
+  `AGA_GATEWAY_KEY` produce different gateway public keys (measured). `dist/server.js` carries the
+  `EPHEMERAL gateway signing key` stderr warning; `dist/proxy/` has none.
+- `THREAT_BOUNDARY.md` §3.4 previously read **"Key persistence — mitigated in 3.0"** while §3.1–3.3 are
+  each prefixed "Proxy —" and §3.4 was not, so it scanned as covering the package. A residual-risk
+  register must not record an unmitigated risk as mitigated. It now states the asymmetry.
+- Both files gained an entry-point comparison table, and record that a verifier handed a key taken from
+  the bundle under test will still print `provenance verified` — that check is **circular**, and only a
+  key obtained beforehand proves issuance.
+
+**KNOWN LIMITATION, unchanged in this release:** `aga-proxy` still has no way to persist its signing
+key, so proxy-issued bundles are integrity-verifiable but **not provenance-pinnable across restarts**.
+`aga-mcp-server` (the stdio server) is unaffected and persists normally. Closing the proxy gap is
+runtime work that is deliberately out of scope here.
+
+### Honesty + safety fixes (2026-08-28)
+
+- **Security: two HIGH-severity production advisories cleared, both newly in range.** `npm audit
+  --omit=dev --audit-level=high` was **failing** on this branch:
+  - `fast-uri` — GHSA-v2hh-gcrm-f6hx (host confusion via backslash authority delimiter, CVSS 7.5).
+    **The 3.4.0 entry below is not wrong about what it did** — it refreshed `fast-uri` to 3.1.4, which
+    was clean at the time. The advisory range has since **widened to `<3.1.5`**, so the pinned version
+    became vulnerable without anything in this repo changing. Now overridden to `^3.1.5` (resolves 3.1.6).
+  - `ip-address` — GHSA-mwp4-54f8-5fhr (Address4 decodes leading-zero octets as decimal while
+    resolvers decode them as octal; SSRF / trust-boundary bypass). Overridden to `>=10.3.1`
+    (resolves 10.5.0). Reached via `@modelcontextprotocol/sdk` → `express-rate-limit`.
+  - `hono` — the existing `>=4.12.25` override no longer covered a moderate CORS ReDoS whose range
+    extends to `<4.12.34`; bumped accordingly (resolves 4.13.5).
+
+  Production dependencies are once again **clean at all severities** (`npm audit --omit=dev`:
+  found 0 vulnerabilities), which is what the 3.4.0 entry claims — that claim had silently gone false.
+  **This is a standing hazard worth naming: a dependency claim is only true as of the day it was
+  measured.** Advisory ranges widen over unchanged code, so a "clean" statement in a changelog decays
+  on its own. Re-run the audit immediately before publishing, not once at RC time.
+  Verified after the change: suite 404/404, `npm run build` clean, cross-stack 61/61.
+
+> Resolved 2026-08-29: this line ships as **3.5.0**; `3.4.0` is abandoned unpublished so the number
+> stays free for the other tree. See the release heading above.
+
+- **TTL expiry no longer signs an enforcement that never happened.** `measure_integrity` sealed
+  `enforcement_action: "TERMINATE"` into a signed receipt on TTL expiry and described the branch as
+  "fail-closed termination". Nothing terminates: the portal degrades to `SAFE_STATE` and keeps
+  accepting measurements, and `portal.enforce()` is never called on that path — nor *can* it be, since
+  it throws unless the state is `DRIFT_DETECTED`. Post-expiry calls kept succeeding and kept minting
+  fresh receipts, each asserting a termination that did not occur. The receipt now records what
+  actually happened. The sibling revocation branch was already honest and is unchanged.
+  **Not changed here:** whether TTL expiry *should* hard-terminate and force re-attestation. That is an
+  open product decision; until it is ruled, the record must not claim a behavior the code lacks.
+- **`aga-proxy export --output` no longer destroys an existing file.** Pointing `--output` at an
+  existing path silently truncated it and exited 0 reporting success — an ordinary path, no symlink,
+  no attacker, on the very artifact a verifier consumes. Export is now exclusive-create by default;
+  replacing a file requires an explicit `--force`.
+- **A malformed `--pubkey` is now a hard error (exit 2) instead of a silent downgrade.** A truncated or
+  mistyped key previously produced `VERIFIED (integrity only)` at exit 0, so an operator who intended
+  to pin provenance got a green result. The reference verifier has always guarded this; the guard had
+  never propagated to the CLI that becomes the published package.
+- **The cross-stack release gate now exercises the pinned path.** The corpus had no wrong-pin case, and
+  the harness collapses each stack to VERIFIED/FAILED without reading `issuerVerified`, so a verifier
+  that silently discarded the pin still read VERIFIED and the gate stayed green. A valid-but-wrong pin
+  control was added; all six verifiers agree FAILED across 61 cases.
+  Recorded, not fixed: on a 64-hex pin that is **not a valid curve point**, the stacks split 1-vs-5 on
+  whether that means "no pin" or "a pin that cannot match". Needs a spec ruling on malformed-pin
+  semantics before "six verifiers agree" is stated without qualification.
+
+### Included from the abandoned 3.4.0 line (work completed 2026-07-31, never published)
+
+> **Not published.** This header previously read as a dated, shipped release. It is not on npm and has
+> not been since the work was completed. Nothing below is available to a consumer running
+> `npm install @attested-intelligence/aga-mcp-server`, which still resolves 3.3.3.
+
+- **Verification now fail-closed rejects integers outside ±2^53 in receipt/checkpoint numeric fields — bundles previously VERIFIED may now FAIL; this closes the cross-language verdict split.** JavaScript loses integer precision beyond `Number.MAX_SAFE_INTEGER`, so a bundle carrying e.g. `leaf_count > 2^53` could VERIFY in the JS stack on bytes the Go and Python verifiers read as a different number. Every stack now rejects the same out-of-range bundles at the same floor.
+- Security: cleared GHSA-frvp-7c67-39w9 (`@hono/node-server` < 2.0.5, Windows encoded-backslash path traversal in `serve-static`, moderate): `@modelcontextprotocol/sdk` bumped to `^1.30.0` (resolves `@hono/node-server` 2.0.12) and an `overrides` pin holds `@hono/node-server` at `>= 2.0.5`. Production dependencies (`npm audit --omit=dev`) are clean at all severities; `body-parser` (2.3.0) and `fast-uri` (3.1.4) transitives refreshed in the same pass.
+- Verifier CLI entry guard (developed in this repo, shipping alongside in `@attested-intelligence/aga-verify` 2.2.0): the CLI now runs only when the verifier module itself is the executed entry script (resolved-path identity against `import.meta.url`), replacing a substring check that ran the CLI — hijacking stdout and calling `process.exit()` — whenever the entry script's path merely contained `verify`.
+- Regression coverage for the safe-integer floor above (`tests/sep/safe-integer-floor.test.ts`): a consistently re-signed bundle carrying a numeric field isolates the floor from the signature and structural checks, so removing the floor flips the verdict and the suite goes red. The cross-stack corpus also gains the ±2^53 and non-finite raw-literal cases (all six verifiers agree FAILED).
+- Proxy CLI hardening: an unrecognized `--profile` value now exits 2 listing the valid names (`permissive`, `standard`, `restrictive`) instead of silently falling back to `permissive`; starting with an `audit_only` policy prints a loud multi-line stderr banner stating that every call is permitted and recorded and no call is denied in that mode. The default profile is unchanged. `aga-proxy run` (a documented foreground alias of `start`) is fixed — it exited 1 on every invocation from 3.0.0 through 3.3.3 because of a stray-argument delegation bug, and now shares the `start` implementation directly; `policy switch` gained the same own-property profile guard as `start`.
+- MCP registry: `package.json` gains `"mcpName": "io.github.attestedintelligence/aga-mcp-server"` for npm package-ownership validation by the official registry.
+
+## 3.3.3 — 2026-07-03
+
+- Internal source-comment cleanup only: **no runtime, verifier, or evidence-bundle change** (behavior is byte-identical to 3.3.2).
+- CI: added a production-only dependency-CVE audit gate (`npm audit --omit=dev` plus an OSV scan) to both the build and pre-publish flows; dev-only advisories never ship and are excluded from the gate.
+- CI: tightened workflow token permissions to least-privilege (`contents: read`).
+- Release hygiene: the pack guard now scans the emitted `dist/` content directly, not just the pack manifest, so a stray marker cannot slip through even if the manifest drifts.
+- Docs: README documentation links normalized to absolute URLs, and the Live Gateway URL corrected to `aga-mcp-gateway.attested-intelligence.workers.dev`.
+
+## 3.3.2 — 2026-07-02
+
+- Added out-of-process evidence export from a running proxy: `aga-proxy start` opens a loopback-only (`127.0.0.1`) read-only control channel, and a separate `aga-proxy export` invocation fetches the same signed bundle the live proxy would emit. The in-memory ledger still does not survive a proxy restart; the exported signed bundle remains the durable record.
+- Hardened proxy export: a gateway-identity header, an evidence-bundle shape guard, and an honest banner and docs pass.
+- CI: the verifier's zero-import guard is now actually enforced (previously a silent no-op).
+
+## 3.3.1 — 2026-07-01
+
+- Extended the release pack-guard content scan to ten high-confidence "must never ship" markers.
+- Wired npm build-provenance and attestation verification into the release workflow (checkable by consumers with `npm audit signatures`).
+- Brought the standalone `aga-verify` verifier into the same provenance flow.
+
+## 3.3.0 — 2026-06-29
+
+- Exposed the offline verifier as a library API through the `./verify` and `./sep` subpath exports (previously reachable only via the CLI).
+- Honest-scoped the package description and keywords (removed a turnkey-enforcement overclaim).
+
+## Earlier releases
+
+- **3.2.0** introduced the algorithm-agile verifier and the v2 `ML-DSA-65+Ed25519-SHA256-JCS` composite profile (a NIST FIPS-204 ML-DSA-65 plus RFC-8032 Ed25519 signature, both of which must verify), selected per-bundle with a `VERIFIED / FAILED / UNSUPPORTED_PROFILE` trichotomy. The v1 `Ed25519-SHA256-JCS` profile remains the default the gateway emits.
+- For the full pre-3.3.0 history, see the tagged releases and `git log` in the repository.

package/DEPLOYMENT.md

@@ -38,29 +38,47 @@ Only `method === "tools/call"` is policy-evaluated. Other JSON-RPC methods are f
 
 The **gateway key** is the Ed25519 key that signs every receipt and checkpoint. Pinning its public key is what turns a bundle from "internally consistent" into "provably issued by *this* gateway."
 
+> ### ⚠️ Which entry point are you running? The two do NOT handle the key the same way.
+>
+> | | `aga-mcp-server` (stdio MCP server) | `aga-proxy` (governance proxy) |
+> |---|---|---|
+> | Reads `AGA_GATEWAY_KEY` / `AGA_GATEWAY_KEY_FILE` | **yes** | **no — silently ignored** |
+> | Key when unset | ephemeral, **warns on stderr** | ephemeral, **no warning** |
+> | Provenance pinnable across restarts | yes, once persisted | **no** |
+>
+> `aga-proxy` calls `generateSigner()` unconditionally at construction: it takes no key CLI option, reads no key environment variable, and accepts no signer through its constructor. Setting `AGA_GATEWAY_KEY` before starting the proxy has **no effect and produces no warning** — two runs with an identical `AGA_GATEWAY_KEY` produce different gateway public keys.
+>
+> **Consequence for the proxy:** its bundles verify for *integrity* normally, but its public key changes on every restart, so a key you record and distribute today is wrong after the next restart. Treat `aga-proxy` evidence as integrity-verifiable and **not** provenance-pinnable across restarts. Note also that a verifier given a key lifted out of the same bundle it is checking will still print `provenance verified` — it cannot know where you got the key. That check is circular; only a key you obtained **before** the bundle proves issuance.
+>
+> Everything in the rest of this section — persisting, obtaining, pinning — applies to **`aga-mcp-server`**. Verified against 3.3.3.
+
 ### Generate a 32-byte seed (64-hex)
 ```bash
 node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
 ```
 
-### Persist it (so provenance survives restarts and is pinnable)
+### Persist it (so provenance survives restarts and is pinnable) — `aga-mcp-server` only
 Either:
 ```bash
 export AGA_GATEWAY_KEY=<64-hex-seed>            # environment variable
 # or
 export AGA_GATEWAY_KEY_FILE=/run/secrets/aga-gateway-key   # file containing the hex seed
 ```
-If neither is set, the server uses an **ephemeral** key that rotates on every restart (it warns on stderr). Ephemeral is fine for local experiments but means **provenance cannot be pinned across restarts** — avoid it in anything you'll later audit.
+If neither is set, `aga-mcp-server` uses an **ephemeral** key that rotates on every restart (it warns on stderr). Ephemeral is fine for local experiments but means **provenance cannot be pinned across restarts** — avoid it in anything you'll later audit.
+
+`aga-proxy` ignores both variables and always uses an ephemeral key — see the table above.
 
 ### Obtain the public key to pin
-Call the `get_server_info` tool → **`gateway_public_key`**. That 64-hex value is what verifiers pin.
+For `aga-mcp-server`: call the `get_server_info` tool → **`gateway_public_key`**. That 64-hex value is what verifiers pin.
+
+For `aga-proxy` there is no equivalent: `aga-proxy status` reports only `running` and `pid`, and the gateway key appears **only inside an exported bundle** (`public_key`). Since that key is this process's key and rotates on restart, pinning it proves the bundle is internally consistent — not who issued it.
 
 ### Pin it when verifying
 ```bash
 # reference verifier (zero deps)
 node aga-receipt-spec/verify/verify-sep.mjs evidence-bundle.json --pubkey <gateway_public_key>
-# or the published CLI (@attested-intelligence/aga-verify 2.0.0)
-aga-verify evidence-bundle.json --pubkey <gateway_public_key>
+# or the published CLI (ships on npm; renders the identical verdict)
+npx -y @attested-intelligence/aga-verify evidence-bundle.json --pubkey <gateway_public_key>
 ```
 Or via the tool: `verify_bundle_offline(bundle, pinned_public_key=<gateway_public_key>)`. **Without a pin you get an integrity-only result** (`issuerVerified=false`, summary says "NOT provenance"). See §3.7 of the boundary doc.
 

package/README.md

@@ -4,7 +4,7 @@ Cryptographic runtime governance for AI agents and autonomous systems.
 
 [![npm](https://img.shields.io/npm/v/@attested-intelligence/aga-mcp-server)](https://www.npmjs.com/package/@attested-intelligence/aga-mcp-server)
 [![PyPI](https://img.shields.io/pypi/v/aga-governance)](https://pypi.org/project/aga-governance/)
-[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://github.com/attestedintelligence/aga-mcp-server/blob/main/LICENSE)
 [![npm provenance](https://img.shields.io/badge/npm-SLSA%20provenance-brightgreen)](https://www.npmjs.com/package/@attested-intelligence/aga-mcp-server)
 
 > **Status: published to npm; this release carries SLSA build provenance (check it: `npm audit signatures`).** The server tools and the `aga-proxy` emit the **canonical SEP evidence bundle**, verifiable offline by the published `@attested-intelligence/aga-verify` and the reference verifier `aga-receipt-spec/verify/verify-sep.mjs`. **Since 3.2.0 the verifier is algorithm-agile and ships a post-quantum profile:** v1 `Ed25519-SHA256-JCS` (the default the gateway emits) and v2 `ML-DSA-65+Ed25519-SHA256-JCS` (a NIST FIPS-204 ML-DSA-65 + RFC-8032 Ed25519 **composite**, both must verify), selected per-bundle by the `algorithm` field with a `VERIFIED / FAILED / UNSUPPORTED_PROFILE` trichotomy. Pre-3.0 releases (a legacy continuity-chain bundle that does *not* verify under the SEP verifier) are deprecated; use `^3.0.0`. Claim scope and residual attack surface are documented honestly in `THREAT_BOUNDARY.md`.
@@ -28,7 +28,7 @@ node aga-receipt-spec/verify/verify-sep.mjs fixtures/valid_minimal.json   # OVER
 node aga-receipt-spec/verify/verify-sep.mjs fixtures/tampered.json        # OVERALL: FAILED
 ```
 
-The published `@attested-intelligence/aga-verify` CLI renders the identical verdict, and `npm run conformance:cross-stack` (first: `npm run build && npm --prefix independent-verifier run build`) proves six v1 verifier configurations, spanning **three independent toolchains (JavaScript, Go, and Python, including a pure-stdlib, no-third-party-crypto path)**, agree on all **57** cross-stack cases; `npm run conformance:cross-stack-v2` proves **two genuinely independent-language oracles (@noble/JS and CIRCL/Go)** agree on the v2 composite corpus. For a full trust-free reproduction (build the package yourself, reproduce the published tarball byte-for-byte, re-run every gate), see the **[REVIEWER_GUIDE.md](REVIEWER_GUIDE.md)** (a command-by-command self-service path), **[REPRODUCIBILITY.md](REPRODUCIBILITY.md)**, and the step-by-step **[SKEPTICAL_AUDITOR.md](SKEPTICAL_AUDITOR.md)**. This release carries SLSA build provenance, checkable with `npm audit signatures`.
+The published `@attested-intelligence/aga-verify` CLI renders the identical verdict, and `npm run conformance:cross-stack` (first: `npm run build && npm --prefix independent-verifier run build`) proves **six v1 verifier configurations** — spanning **three independent toolchains (JavaScript, Go, and Python, including a pure-stdlib, no-third-party-crypto path)** — agree on the **54 object-level cases**, and the **five file-parsing verifiers** agree on the **7 raw-byte/file-parse cases** (**61 total**). The in-server engine is library-only, receiving parsed objects rather than raw file bytes, so it does not run the file-parse cases; six configurations do not agree on all 61 and this no longer claims they do. `npm run conformance:cross-stack-v2` proves **two genuinely independent-language oracles (@noble/JS and CIRCL/Go)** agree on the v2 composite corpus. For a full trust-free reproduction (build the package yourself, reproduce the published tarball byte-for-byte, re-run every gate), see the **[REVIEWER_GUIDE.md](https://github.com/attestedintelligence/aga-mcp-server/blob/main/REVIEWER_GUIDE.md)** (a command-by-command self-service path), **[REPRODUCIBILITY.md](https://github.com/attestedintelligence/aga-mcp-server/blob/main/REPRODUCIBILITY.md)**, and the step-by-step **[SKEPTICAL_AUDITOR.md](https://github.com/attestedintelligence/aga-mcp-server/blob/main/SKEPTICAL_AUDITOR.md)**. This release carries SLSA build provenance, checkable with `npm audit signatures`.
 
 ## What This Does
 
@@ -99,11 +99,14 @@ Keep the seed secret and out of version control; see `DEPLOYMENT.md` for key han
 A bundle this package emits (via the `generate_evidence_bundle` MCP tool) is a **canonical SEP bundle**. Verify it offline, with no network and no callback to us:
 
 ```bash
-# Reference verifier (zero deps, Node 18+). Pin the gateway key (from get_server_info) to prove provenance.
+# Published verifier CLI — ships on npm, nothing to clone. Pin the gateway key (from get_server_info) to prove provenance.
+npx -y @attested-intelligence/aga-verify evidence-bundle.json --pubkey <gateway-public-key>
+
+# Or, from a clone of this repo, the zero-dep reference verifier (Node 18+) renders the identical verdict:
 node aga-receipt-spec/verify/verify-sep.mjs evidence-bundle.json --pubkey <gateway-public-key>
 ```
 
-The published `@attested-intelligence/aga-verify` CLI mirrors this reference (published on npm; the older forgeable 1.0.0 is deprecated). Without `--pubkey` you get an **integrity-only** result (`issuerVerified=false`); pin the key to also prove *who* issued it. See `THREAT_BOUNDARY.md` §3.7. A hosted browser verifier is linked under [Links](#links).
+The published `@attested-intelligence/aga-verify` CLI is the shipped path (the older forgeable 1.0.0 is deprecated); the reference `verify-sep.mjs` renders the identical verdict from a repo clone. Without `--pubkey` you get an **integrity-only** result (`issuerVerified=false`); pin the key to also prove *who* issued it. See `THREAT_BOUNDARY.md` §3.7. A hosted browser verifier is linked under [Links](#links).
 
 The reference §6 algorithm is implemented in **three languages**: JavaScript (`aga-receipt-spec/verify/verify-sep.mjs`), Go (`verify.go`, stdlib `crypto/ed25519`), and Python (`verify.py`, pure-stdlib RFC-8032 Ed25519). A cross-stack harness (`npm run conformance:cross-stack`; first: `npm run build && npm --prefix independent-verifier run build`) proves all three, plus the in-server engine and `aga-verify`, render **identical verdicts** on the canonical vectors (valid, adversarial, and every small-order forgery). The **v2 composite** profile (`ML-DSA-65+Ed25519-SHA256-JCS`) is held to the same bar by a second harness (`npm run conformance:cross-stack-v2`): a `@noble`/JavaScript engine and a CIRCL/Go oracle, two genuinely independent toolchains, render identical verdicts on the pinned v2 corpus, and the **reference** v1 verifier (`verify-sep.mjs`/`verify.py`/`verify.go`) returns `UNSUPPORTED_PROFILE` (exit 3) on a v2 bundle, signalling "profile not implemented" rather than a misleading "invalid". *(The published `aga-verify` CLI does not implement this profile trichotomy: on a v2 bundle it returns FAILED (exit 1). Use exit 3 as the unsupported-profile signal only with the reference verifiers.)*
 
@@ -172,7 +175,7 @@ npx -y @attested-intelligence/aga-verify evidence.json --pubkey <gateway-public-
 
 If no proxy is running, `aga-proxy export` prints `no running proxy found; start it first, or export from within the session` and exits non-zero — it never emits an empty or placeholder bundle. Within the MCP **server** session you can also call the `generate_evidence_bundle` tool and save the returned JSON.
 
-**In-memory ledger:** the exported bundle is the durable cryptographic record, but the live in-process chain does **not** survive a proxy restart. This flow makes the *live* ledger reachable from another process; it does **not** add cross-restart persistence, which needs the persistent (SQLite) backend and remains roadmap (see [`KNOWN_LIMITATIONS.md`](KNOWN_LIMITATIONS.md)).
+**In-memory ledger:** the exported bundle is the durable cryptographic record, but the live in-process chain does **not** survive a proxy restart. This flow makes the *live* ledger reachable from another process; it does **not** add cross-restart persistence, which needs the persistent (SQLite) backend and remains roadmap (see [`KNOWN_LIMITATIONS.md`](https://github.com/attestedintelligence/aga-mcp-server/blob/main/KNOWN_LIMITATIONS.md)).
 
 The proxy intercepts `tools/call` requests, evaluates them against a sealed policy, and generates a signed SEP receipt for **every** decision. Permitted calls are forwarded to the downstream server; denied calls return an MCP error and never reach it. Every decision is hash-linked and checkpoint-bound into a tamper-evident bundle. (Methods other than `tools/call` aren't policy-evaluated, but non-benign ones are recorded as signed *passthrough* receipts for auditability, and an optional denylist can reject them; see `THREAT_BOUNDARY.md` §3.2.)
 
@@ -181,6 +184,8 @@ Three built-in policy profiles:
 - **standard** - rate limits + blocks destructive operations
 - **restrictive** - explicit tool allowlist, all unknown tools denied
 
+Because the default (`permissive`) is audit-only, starting with an `audit_only` policy prints a loud stderr banner stating that every call is permitted and recorded and **no call is denied** in that mode — denial happens only under an allowlist-mode policy (`standard`, `restrictive`, or a custom `--policy` file). An unrecognized `--profile` value is a hard error (exit 2 listing the valid names), never a silent fallback to `permissive`.
+
 ## Verification _(canonical SEP 3.0; normative §6 algorithm in `aga-receipt-spec/verify/verify-sep.mjs`)_
 
 1. **Structural floor** - Bundle declares Ed25519-SHA256-JCS, public key well-formed (all small-order encodings + non-canonical `y ≥ p` rejected), `receipts.length > 0`, proof count = receipt count
@@ -205,10 +210,10 @@ A demo gateway is deployed on Cloudflare Workers (a **separate deployment** that
 
 ```bash
 # Check status
-curl https://aga-mcp-gateway.attestedintelligence.workers.dev/health
+curl https://aga-mcp-gateway.attested-intelligence.workers.dev/health
 
 # Export evidence bundle
-curl https://aga-mcp-gateway.attestedintelligence.workers.dev/bundle -o evidence-bundle.json
+curl https://aga-mcp-gateway.attested-intelligence.workers.dev/bundle -o evidence-bundle.json
 ```
 
 ## Python SDK
@@ -248,7 +253,7 @@ pip install aga-governance && python -c "import aga; print(aga.__version__)"   #
 
 ## Benchmarks
 
-Receipt-format determinism is reproducible here: `npm test` runs the cross-language vectors, and `npm run conformance:cross-stack` (first: `npm run build && npm --prefix independent-verifier run build`) shows the six v1 verifier configurations (across three independent toolchains: JS, Go, Python) agree on the canonical 57-case corpus, while `npm run conformance:cross-stack-v2` shows the two independent-language v2 oracles agree on the composite corpus.
+Receipt-format determinism is reproducible here: `npm test` runs the cross-language vectors, and `npm run conformance:cross-stack` (first: `npm run build && npm --prefix independent-verifier run build`) shows the six v1 verifier configurations (across three independent toolchains: JS, Go, Python) agree on the 54 object-level cases of the canonical 61-case corpus — the remaining 7 are raw-byte/file-parse cases run by the five file-parsing verifiers, since the in-server engine never receives raw bytes — while `npm run conformance:cross-stack-v2` shows the two independent-language v2 oracles agree on the composite corpus.
 
 ## Project Structure
 
@@ -276,7 +281,7 @@ tests/                 # TypeScript test suite (384 automated tests)
 
 ## Security
 
-See [SECURITY.md](SECURITY.md) for vulnerability reporting.
+See [SECURITY.md](https://github.com/attestedintelligence/aga-mcp-server/blob/main/SECURITY.md) for vulnerability reporting.
 
 ## Contributing
 
@@ -284,7 +289,7 @@ See [CONTRIBUTING.md](https://github.com/attestedintelligence/aga-mcp-server/blo
 
 ## License
 
-[MIT](LICENSE)
+[MIT](https://github.com/attestedintelligence/aga-mcp-server/blob/main/LICENSE)
 
 ---
 

package/THREAT_BOUNDARY.md

@@ -46,17 +46,17 @@ Claim scope is **integrity-of-present-receipts, NOT non-omission**: a PASS prove
 1. **Proxy — mandatory mediation is a deployment property.** `GovernanceProxy` governs the path *through it*; if the agent can reach the upstream MCP server **directly** (network), it bypasses governance entirely. `upstreamUrl` (HTTP) is directly reachable. → **Deployment requirement:** the agent must be network-isolated so the proxy is its *only* route to tools. Documented, not code-enforceable here. *(Empirically demonstrated in CP3 A7 — a direct POST to the upstream fired a side effect with no receipt; the red-team scripts are maintained in the private validation tree, not shipped in this package.)* **See `DEPLOYMENT.md` §1: stdio-upstream is the hardened default — the upstream is a non-network-reachable child process, closing this bypass by construction; HTTP-upstream mode now warns on stderr.**
 2. **Proxy — only `method === "tools/call"` is policy-evaluated; partially mitigated in 3.0.** Other JSON-RPC methods are still forwarded (not policy-evaluated), but they are now recorded as **signed passthrough receipts** in the evidence bundle for auditability — so a side-effecting non-`tools/call` method is no longer *invisible* (the CP3 A7 `admin/deleteAllData` would now appear as a `(passthrough)` receipt with `method` set and `reason: forwarded, not policy-evaluated`). Benign protocol methods (`initialize`, `ping`, `tools/list`, `*/list`, `notifications/*`, …) are excluded by default; an optional `denyMethods` denylist rejects known side-effecting methods (a **DENIED** passthrough receipt, not forwarded). **What this closes:** invisibility — every forwarded non-benign method is now in the tamper-evident, checkpoint-bound bundle. **What it does NOT close:** the method is not policy-evaluated and still *executes* unless explicitly denylisted (this is *visibility, not governance*), and a direct-to-upstream call (§3.1) still bypasses the proxy entirely. Full per-method policy evaluation remains future work.
 3. **Proxy — denial is observable.** A DENIED call returns a distinctive `-32600` error, which an adversary can use as a policy-probing oracle. Low severity; structured denial metadata could be tightened later.
-4. **Key persistence — mitigated in 3.0.** The gateway signing key can be **persisted** via `AGA_GATEWAY_KEY` (64-hex seed) or `AGA_GATEWAY_KEY_FILE` (`DEPLOYMENT.md` §2), so `gateway_public_key` is stable and **pinnable across restarts**. The default remains an ephemeral key (warned on stderr). HSM/KMS backing remains future work. A verifier MUST still pin the key it expects.
+4. **Key persistence — mitigated in 3.0 for `aga-mcp-server`; NOT mitigated for `aga-proxy`.** For the stdio MCP server, the gateway signing key can be **persisted** via `AGA_GATEWAY_KEY` (64-hex seed) or `AGA_GATEWAY_KEY_FILE` (`DEPLOYMENT.md` §2), so `gateway_public_key` is stable and **pinnable across restarts**; its default remains an ephemeral key, warned on stderr. **`aga-proxy` has no such path:** `GovernanceProxy` calls `generateSigner()` unconditionally in its constructor, exposes no key CLI option, reads neither environment variable, and emits **no ephemeral-key warning** — so a proxy's `gateway_public_key` rotates on every restart and is **not pinnable across restarts**. Proxy-issued bundles are integrity-verifiable but cannot carry provenance in the sense §3.7 requires. Since items 1–3 above are proxy-specific and this one is not, note the asymmetry explicitly: the component that performs runtime governance is the component that cannot persist its identity. Closing it is runtime work, not a documentation change. HSM/KMS backing remains future work. A verifier MUST still pin the key it expects — **and MUST obtain that key independently of the bundle**, since a key lifted from the bundle under test yields a circular `provenance verified` (see §3.7).
 5. **Storage durability (Sprint 5).** Default storage is in-memory → the live chain is lost on **process restart**. The cryptographic record survives via the **exported signed bundle**; durable cross-restart retention needs the SQLite/persistent backend (Sprint 5). The raw quarantine forensic buffer is in-memory by design (only the `arguments_hash` commitment is signed — privacy-preserving and sufficient to *prove* a capture).
 6. **Out of scope entirely (not what AGA does).** AGA does not prevent: model jailbreaks, model-weight theft, credential compromise, or infrastructure compromise. It provides *accountability and provenance* for governed decisions, not prevention of those classes. If an attacker holds the gateway signing key, they can author receipts — protect the key (Sprint 4).
 7. **Verifier-UX / unpinned consumers (NEW — CP3 A5).** A consumer that verifies a bundle **without pinning** the gateway key gets an integrity-only `VERIFIED` with `issuerVerified=false` — *even on a forged, attacker-signed, denial-free bundle*. This is correct (integrity-of-present-receipts ≠ provenance, and the result object/CLI say so explicitly), but a UI that shows a bare "VERIFIED" without prominently propagating `issuerVerified=false` could mislead a non-expert. → Downstream consumers (esp. the website demo) MUST pin the gateway key and never present an unpinned PASS as proof of *who* issued the bundle. **Mitigated in 3.0:** the verify result now carries a prominent `summary` — `VERIFIED (provenance verified …)` vs `VERIFIED (integrity only — NOT provenance …)` — surfaced by `verify_bundle_offline` and the reference/`aga-verify` CLIs; key-pinning ergonomics are in `DEPLOYMENT.md` §2. Consumers must still pin.
-8. **Cross-stack verifier conformance (CLOSED — 2026-06-07).** Earlier in the 3.0 hardening only `src/sep/verify.ts` carried the full strict floor; the reference `verify-sep.mjs`, the published `aga-verify`, Go, and Python lagged. **That asymmetry is now closed.** All six verifiers — engine (`src/sep`), reference (`verify-sep.mjs`), `aga-verify`, Go (`verify.go`), and Python (audited library + pure-stdlib) — apply the identical strict floor and return **byte-identical verdicts**. The shared floor: strict field allowlist; `envelope_consistency` (binds the unsigned `gateway_id`/`merkle_root`/`generated_at` to the signed/recomputed values); checkpoint-algorithm binding; lexicographic-string canonicalization with RFC-8785 integral-number normalization; complete small-order/non-canonical-key rejection; **one library-free canonical-timestamp rule** (exact `.sssZ` UTC form via an ASCII regex + integer-arithmetic calendar + lexicographic ordering — no native date parser); merkle-direction-token strictness (`left`/`right` only, length-matched); unpaired-UTF-16-surrogate rejection; depth-bounded never-throw; and whole-document parse (trailing content rejected). Verified by `npm run conformance:cross-stack` — six verifiers agree on every case in the committed corpus (57 cases incl. raw-byte/file-parse, incl. an uppercase-Merkle-sibling cross-stack case), confirmed across multiple rounds of independent blind differential re-audit. See `fixtures/cross-stack/README.md`. **Residual (by design, not a divergence):** the bundle envelope still carries four *unsigned* metadata fields with no signed counterpart — `bundle_id`, `schema_version`, `policy_reference`, `offline_capable`. They are informational and are **not** security-identity fields (the identity fields `gateway_id`/`merkle_root`/`generated_at` ARE bound); a relying party must still trust only signed/verified values and pin the gateway key (§3.7). Of the four, **`policy_reference` is the only identity-grade one** — but the governing policy IS captured and cryptographically verified inside **every signed receipt's own `policy_reference` field** (one of the 15 signed fields), so the unsigned *envelope* `policy_reference` is only a convenience mirror, not the source of truth. Binding the envelope copy is a recommended near-term (3.1) format revision; a coordinated verifier-output flag that marks these four envelope fields as unsigned/not-verified is a recommended enhancement, deliberately deferred here to avoid adding an untested cross-language output surface immediately after the cross-stack-consistency campaign (the verdict surface already attests only the steps it runs, and never claims these fields). One further residual is **unreachable by construction:** SEP signed fields are strings plus the single integer `leaf_count` (the emit guard `assertSignedReceiptFieldsAreStrings` forbids any other number in a signed field), so a verifier's canonicalization of a *non-integer / exponential* number placed in a signed field — which no conformant gateway can emit — is intentionally left unspecified and MAY differ across language stdlibs; it cannot affect any bundle a conformant gateway produces. Reachable string content is fully cross-stack-consistent (an exhaustive 0..0x10FFFF code-point sweep confirms the only ever-divergent characters, `U+2028`/`U+2029`, are normalized identically by every verifier).
+8. **Cross-stack verifier conformance (CLOSED — 2026-06-07).** Earlier in the 3.0 hardening only `src/sep/verify.ts` carried the full strict floor; the reference `verify-sep.mjs`, the published `aga-verify`, Go, and Python lagged. **That asymmetry is now closed.** All six verifiers — engine (`src/sep`), reference (`verify-sep.mjs`), `aga-verify`, Go (`verify.go`), and Python (audited library + pure-stdlib) — apply the identical strict floor and return **byte-identical verdicts**. The shared floor: strict field allowlist; `envelope_consistency` (binds the unsigned `gateway_id`/`merkle_root`/`generated_at` to the signed/recomputed values); checkpoint-algorithm binding; lexicographic-string canonicalization with RFC-8785 integral-number normalization; complete small-order/non-canonical-key rejection; **one library-free canonical-timestamp rule** (exact `.sssZ` UTC form via an ASCII regex + integer-arithmetic calendar + lexicographic ordering — no native date parser); merkle-direction-token strictness (`left`/`right` only, length-matched); unpaired-UTF-16-surrogate rejection; depth-bounded never-throw; and whole-document parse (trailing content rejected). Verified by `npm run conformance:cross-stack` — six verifier configurations agree on the 54 object-level cases of the committed corpus, and the five file-parsing verifiers agree on its 7 raw-byte/file-parse cases (61 total, incl. an uppercase-Merkle-sibling cross-stack case). The agreement itself was confirmed across multiple rounds of independent blind differential re-audit. The engine is library-only and never receives raw file bytes, so it does not run the file-parse subset; the earlier phrasing here ("six verifiers agree on every case … 57 cases incl. raw-byte/file-parse") overclaimed by one verifier on those seven and carried a stale total. See `fixtures/cross-stack/README.md`. **Residual (by design, not a divergence):** the bundle envelope still carries four *unsigned* metadata fields with no signed counterpart — `bundle_id`, `schema_version`, `policy_reference`, `offline_capable`. They are informational and are **not** security-identity fields (the identity fields `gateway_id`/`merkle_root`/`generated_at` ARE bound); a relying party must still trust only signed/verified values and pin the gateway key (§3.7). Of the four, **`policy_reference` is the only identity-grade one** — but the governing policy IS captured and cryptographically verified inside **every signed receipt's own `policy_reference` field** (one of the 15 signed fields), so the unsigned *envelope* `policy_reference` is only a convenience mirror, not the source of truth. Binding the envelope copy is a recommended near-term (3.1) format revision; a coordinated verifier-output flag that marks these four envelope fields as unsigned/not-verified is a recommended enhancement, deliberately deferred here to avoid adding an untested cross-language output surface immediately after the cross-stack-consistency campaign (the verdict surface already attests only the steps it runs, and never claims these fields). One further residual is **unreachable by construction:** SEP signed fields are strings plus the single integer `leaf_count` (the emit guard `assertSignedReceiptFieldsAreStrings` forbids any other number in a signed field), so a verifier's canonicalization of a *non-integer / exponential* number placed in a signed field — which no conformant gateway can emit — is intentionally left unspecified and MAY differ across language stdlibs; it cannot affect any bundle a conformant gateway produces. Reachable string content is fully cross-stack-consistent (an exhaustive 0..0x10FFFF code-point sweep confirms the only ever-divergent characters, `U+2028`/`U+2029`, are normalized identically by every verifier).
 
 ---
 
 ## 4. CP3 adversarial verification results (2026-06-06)
 
-A focused adversarial workflow ran **7 independent red-team attacks** on the core claim. Each was attempted *concretely* against the real in-process MCP server / proxy and the **pinned** reference verifier (`verify-sep.mjs`) and published-sound `aga-verify@2.0.0`. A1–A5 were fully adjudicated + agreed in the original workflow. **A6 and A7 — whose original adjudication hit a session usage cap — were re-adjudicated first-hand on 2026-06-07 from the source:** **A6 HELD** — `src/middleware/governance.ts` shows `UNGOVERNED_TOOLS` contains only read/bootstrap/evidence/monitor tools (no mutating agent-action), a tool is GOVERNED iff absent from that set, and every GOVERNED call that is blocked emits a signed DENIED receipt via the `deny()` path (including the fail-closed branch for uncanonicalizable arguments); **A7 RESIDUAL** — the only upstream-reach bypasses are exactly the documented §3.1 (direct upstream HTTP, a deployment/network-isolation property) and §3.2 (non-`tools/call` methods, now recorded as signed passthrough receipts); no new bypass was found. (Red-team scripts are maintained in the private validation tree, not shipped in this package.)
+A focused adversarial workflow ran **7 independent red-team attacks** on the core claim. Each was attempted *concretely* against the real in-process MCP server / proxy and the **pinned** reference verifier (`verify-sep.mjs`) and the published-sound `aga-verify` CLI. A1–A5 were fully adjudicated + agreed in the original workflow. **A6 and A7 — whose original adjudication hit a session usage cap — were re-adjudicated first-hand on 2026-06-07 from the source:** **A6 HELD** — `src/middleware/governance.ts` shows `UNGOVERNED_TOOLS` contains only read/bootstrap/evidence/monitor tools (no mutating agent-action), a tool is GOVERNED iff absent from that set, and every GOVERNED call that is blocked emits a signed DENIED receipt via the `deny()` path (including the fail-closed branch for uncanonicalizable arguments); **A7 RESIDUAL** — the only upstream-reach bypasses are exactly the documented §3.1 (direct upstream HTTP, a deployment/network-isolation property) and §3.2 (non-`tools/call` methods, now recorded as signed passthrough receipts); no new bypass was found. (Red-team scripts are maintained in the private validation tree, not shipped in this package.)
 
 | # | Attack | Result | Why |
 |---|---|---|---|
@@ -68,7 +68,7 @@ A focused adversarial workflow ran **7 independent red-team attacks** on the cor
 | A6 | PEP bypass (ungoverned mutating action) | **HELD** | all 15 tools censused; no ungoverned mutating agent-action; even blocked governed calls emit a DENIED receipt; `measure_behavior` enforcement is coupled to a signed receipt |
 | A7 | Proxy bypass | **RESIDUAL** | every governed `tools/call` gets a receipt (PERMITTED+DENIED; DENIED never reaches upstream); the two bypasses are the already-documented §3.1 (direct upstream reach) and §3.2 (non-`tools/call` methods) |
 
-**Verdict: 0 guarantee-broken — 6 HELD, 1 RESIDUAL (out-of-claim, already documented).** The core claim — *denials cannot be silently erased by the agent through tampering, truncation, reordering, or re-attestation, and forgery is caught when the gateway key is pinned* — **holds under the tested adversarial pressure**, on both the reference verifier and the published-sound `aga-verify@2.0.0`.
+**Verdict: 0 guarantee-broken — 6 HELD, 1 RESIDUAL (out-of-claim, already documented).** The core claim — *denials cannot be silently erased by the agent through tampering, truncation, reordering, or re-attestation, and forgery is caught when the gateway key is pinned* — **holds under the tested adversarial pressure**, on both the reference verifier and the published-sound `aga-verify` CLI.
 
 ---
 

package/dist/core/portal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"portal.d.ts","sourceRoot":"","sources":["../../src/core/portal.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClG,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,gBAAgB,EAAE,OAAO,CAAC;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,MAAM;IACjB,KAAK,EAAE,WAAW,CAAoB;IACtC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAQ;IACvC,eAAe,SAAK;IACpB,YAAY,EAAE,OAAO,GAAG,IAAI,CAAQ;IACpC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAa;IACrC,cAAc,EAAE,gBAAgB,EAAE,CAAM;IAExC,YAAY,CAAC,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAiB5F,OAAO,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,GAAG,iBAAiB;IAuC3E,OAAO,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI;IAUxC,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAKhC,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAEtC,KAAK,IAAI,IAAI;CAId"}
+{"version":3,"file":"portal.d.ts","sourceRoot":"","sources":["../../src/core/portal.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClG,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,gBAAgB,EAAE,OAAO,CAAC;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,MAAM;IACjB,KAAK,EAAE,WAAW,CAAoB;IACtC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAQ;IACvC,eAAe,SAAK;IACpB,YAAY,EAAE,OAAO,GAAG,IAAI,CAAQ;IACpC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAa;IACrC,cAAc,EAAE,gBAAgB,EAAE,CAAM;IAExC,YAAY,CAAC,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAiB5F,OAAO,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,GAAG,iBAAiB;IAsD3E,OAAO,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI;IAUxC,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAKhC,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAEtC,KAAK,IAAI,IAAI;CAId"}

package/dist/core/portal.js

@@ -42,11 +42,26 @@ export class Portal {
         const empty = { currentBytesHash: '', currentMetaHash: '',
             expectedBytesHash: this.artifact.subject_identifier.bytes_hash,
             expectedMetaHash: this.artifact.subject_identifier.metadata_hash };
-        // Graceful degradation: TTL expiry -> SAFE_STATE + DEGRADATION event + continued logging
+        // FAIL CLOSED on TTL expiry (founder decision D1, ruled 2026-08-29).
+        //
+        // This branch previously set SAFE_STATE and kept accepting measurements, so an expired artifact
+        // went on being measured indefinitely and every public page describing TTL as an enforcement
+        // boundary was describing a behavior the code did not have. It now terminates, which is exactly
+        // what the revocation branch immediately below already does — TTL was the odd one out, not the
+        // new behavior.
+        //
+        // Consequence, deliberate: the entry guard above throws on TERMINATED, so the FIRST post-expiry
+        // measurement returns this result and any SUBSEQUENT call throws 'Portal is terminated'. That is
+        // the point of failing closed — an expired artifact stops being a usable measurement channel and
+        // re-attestation is required to get one back. Callers that previously looped on measure() past
+        // expiry must handle the throw.
+        //
+        // The degradation entry is still recorded. It is the forensic record of WHY termination happened,
+        // and dropping it would trade one honesty problem for another.
         const ttl_ok = !isExpired(this.artifact.issued_timestamp, this.artifact.enforcement_parameters.ttl_seconds);
         if (!ttl_ok) {
             const prevState = this.state;
-            this.state = 'SAFE_STATE';
+            this.state = 'TERMINATED';
             this.degradationLog.push({
                 reason: 'TTL_EXPIRED',
                 timestamp: utcNow(),

package/dist/core/portal.js.map

@@ -1 +1 @@
-{"version":3,"file":"portal.js","sourceRoot":"","sources":["../../src/core/portal.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAuB1E,MAAM,OAAO,MAAM;IACjB,KAAK,GAAgB,gBAAgB,CAAC;IACtC,QAAQ,GAA0B,IAAI,CAAC;IACvC,eAAe,GAAG,CAAC,CAAC;IACpB,YAAY,GAAmB,IAAI,CAAC;IACpC,WAAW,GAAgB,IAAI,GAAG,EAAE,CAAC;IACrC,cAAc,GAAuB,EAAE,CAAC;IAExC,YAAY,CAAC,QAAwB,EAAE,WAAmB;QACxD,IAAI,CAAC,KAAK,GAAG,uBAAuB,CAAC;QACrC,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC;QAC5C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YAClF,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC;YAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,mBAAmB,EAAE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC3F,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC;YAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;QAC9F,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC;YAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;QACtF,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,mBAAmB,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,OAAO,CAAC,YAAwB,EAAE,IAAqB;QACrD,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACzE,sDAAsD;QACtD,MAAM,KAAK,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE;YACvD,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,UAAU;YAC9D,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAErE,yFAAyF;QACzF,MAAM,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;QAC5G,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC;YAC7B,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC;YAC1B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;gBACvB,MAAM,EAAE,aAAa;gBACrB,SAAS,EAAE,MAAM,EAAE;gBACnB,kBAAkB,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW;gBAC7C,cAAc,EAAE,SAAS;aAC1B,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;QACnF,CAAC;QAED,gCAAgC;QAChC,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC;YAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;QAC5F,CAAC;QAED,MAAM,gBAAgB,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;QACnD,MAAM,eAAe,GAAG,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,gBAAgB,KAAK,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,UAAU;YAChE,eAAe,KAAK,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,aAAa,CAAC;QAEjF,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,mBAAmB;YAAE,IAAI,CAAC,KAAK,GAAG,gBAAgB,CAAC;QAChF,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,eAAe;YAC/C,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,UAAU;YAC9D,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,aAAa;YAChE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,OAAO,CAAC,MAAyB;QAC/B,IAAI,IAAI,CAAC,KAAK,KAAK,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9F,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,WAAW,CAAC;YAAC,KAAK,YAAY;gBAAE,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC;gBAAC,MAAM;YACtE,KAAK,YAAY;gBAAE,IAAI,CAAC,KAAK,GAAG,oBAAoB,CAAC;gBAAC,MAAM;YAC5D,KAAK,YAAY;gBAAE,IAAI,CAAC,KAAK,GAAG,mBAAmB,CAAC;gBAAC,MAAM;YAC3D,OAAO,CAAC,CAAC,MAAM;QACjB,CAAC;IACH,CAAC;IAED,MAAM,CAAC,UAAkB;QACvB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,QAAQ,EAAE,WAAW,KAAK,UAAU;YAAE,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC;IAC3E,CAAC;IAED,SAAS,CAAC,UAAkB,IAAa,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAEnF,KAAK;QACH,IAAI,CAAC,KAAK,GAAG,gBAAgB,CAAC;QAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACpD,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC;QAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IACrD,CAAC;CACF"}
+{"version":3,"file":"portal.js","sourceRoot":"","sources":["../../src/core/portal.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAuB1E,MAAM,OAAO,MAAM;IACjB,KAAK,GAAgB,gBAAgB,CAAC;IACtC,QAAQ,GAA0B,IAAI,CAAC;IACvC,eAAe,GAAG,CAAC,CAAC;IACpB,YAAY,GAAmB,IAAI,CAAC;IACpC,WAAW,GAAgB,IAAI,GAAG,EAAE,CAAC;IACrC,cAAc,GAAuB,EAAE,CAAC;IAExC,YAAY,CAAC,QAAwB,EAAE,WAAmB;QACxD,IAAI,CAAC,KAAK,GAAG,uBAAuB,CAAC;QACrC,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC;QAC5C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YAClF,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC;YAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,mBAAmB,EAAE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC3F,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC;YAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;QAC9F,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC;YAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;QACtF,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,mBAAmB,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,OAAO,CAAC,YAAwB,EAAE,IAAqB;QACrD,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACzE,sDAAsD;QACtD,MAAM,KAAK,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE;YACvD,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,UAAU;YAC9D,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAErE,qEAAqE;QACrE,EAAE;QACF,gGAAgG;QAChG,6FAA6F;QAC7F,gGAAgG;QAChG,+FAA+F;QAC/F,gBAAgB;QAChB,EAAE;QACF,gGAAgG;QAChG,iGAAiG;QACjG,iGAAiG;QACjG,+FAA+F;QAC/F,gCAAgC;QAChC,EAAE;QACF,kGAAkG;QAClG,+DAA+D;QAC/D,MAAM,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;QAC5G,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC;YAC7B,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC;YAC1B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;gBACvB,MAAM,EAAE,aAAa;gBACrB,SAAS,EAAE,MAAM,EAAE;gBACnB,kBAAkB,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW;gBAC7C,cAAc,EAAE,SAAS;aAC1B,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;QACnF,CAAC;QAED,gCAAgC;QAChC,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC;YAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;QAC5F,CAAC;QAED,MAAM,gBAAgB,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;QACnD,MAAM,eAAe,GAAG,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,gBAAgB,KAAK,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,UAAU;YAChE,eAAe,KAAK,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,aAAa,CAAC;QAEjF,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,mBAAmB;YAAE,IAAI,CAAC,KAAK,GAAG,gBAAgB,CAAC;QAChF,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,eAAe;YAC/C,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,UAAU;YAC9D,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,aAAa;YAChE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,OAAO,CAAC,MAAyB;QAC/B,IAAI,IAAI,CAAC,KAAK,KAAK,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9F,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,WAAW,CAAC;YAAC,KAAK,YAAY;gBAAE,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC;gBAAC,MAAM;YACtE,KAAK,YAAY;gBAAE,IAAI,CAAC,KAAK,GAAG,oBAAoB,CAAC;gBAAC,MAAM;YAC5D,KAAK,YAAY;gBAAE,IAAI,CAAC,KAAK,GAAG,mBAAmB,CAAC;gBAAC,MAAM;YAC3D,OAAO,CAAC,CAAC,MAAM;QACjB,CAAC;IACH,CAAC;IAED,MAAM,CAAC,UAAkB;QACvB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,QAAQ,EAAE,WAAW,KAAK,UAAU;YAAE,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC;IAC3E,CAAC;IAED,SAAS,CAAC,UAAkB,IAAa,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAEnF,KAAK;QACH,IAAI,CAAC,KAAK,GAAG,gBAAgB,CAAC;QAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACpD,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC;QAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IACrD,CAAC;CACF"}

package/dist/core/types.d.ts

@@ -24,7 +24,7 @@ export interface EnforcementParams {
     measurement_types: MeasurementType[];
     behavioral_baseline?: BehavioralBaselineRef;
 }
-/** Inline behavioral baseline reference for EnforcementParams (NCCoE §6, CAISI §1a) */
+/** Inline behavioral baseline reference for EnforcementParams (NCCoE §6, behavioral-drift guard) */
 export interface BehavioralBaselineRef {
     permitted_tools: string[];
     forbidden_sequences: string[][];

package/dist/core/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/core/types.ts"],"names":[],"mappings":"AAAA;;EAEE;AACF,OAAO,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAI5E,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAID,MAAM,MAAM,iBAAiB,GACzB,WAAW,GACX,YAAY,GACZ,iBAAiB,GACjB,YAAY,GACZ,YAAY,GACZ,kBAAkB,GAClB,qBAAqB,GACrB,YAAY,CAAC;AAEjB,MAAM,MAAM,eAAe,GACvB,kBAAkB,GAAG,gBAAgB,GAAG,iBAAiB,GACzD,iBAAiB,GAAI,MAAM,GAAa,WAAW,GACnD,gBAAgB,GAAK,cAAc,GAAK,mBAAmB,GAC3D,gBAAgB,CAAC;AAErB,MAAM,WAAW,iBAAiB;IAChC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB,EAAE,iBAAiB,EAAE,CAAC;IAC1C,uBAAuB,EAAE,OAAO,CAAC;IACjC,iBAAiB,EAAE,eAAe,EAAE,CAAC;IACrC,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;CAC7C;AAED,uFAAuF;AACvF,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,mBAAmB,EAAE,MAAM,EAAE,EAAE,CAAC;IAChC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAID,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,aAAa,GAAG,SAAS,GAAG,aAAa,CAAC;AAC/E,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,YAAY,GAAG,aAAa,CAAC;AAEzE,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,WAAW,CAAC;IACzB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,eAAe,EAAE,cAAc,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,gBAAgB;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,gBAAgB;IAC/B,eAAe,EAAE,WAAW,EAAE,CAAC;IAC/B,kBAAkB,EAAE,gBAAgB,EAAE,CAAC;CACxC;AAID,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,OAAO,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAID,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,iBAAiB,CAAC;IACtC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sBAAsB,EAAE,iBAAiB,CAAC;IAC1C,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,oBAAoB,EAAE,wBAAwB,EAAE,CAAC;IACjD,SAAS,EAAE,eAAe,CAAC;CAC5B;AAMD,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,iBAAiB,CAAC;IACtC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,OAAO,CAAC;IACxB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,kBAAkB,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC7C,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAAC;IACnC,gBAAgB,EAAE,eAAe,CAAC;CACnC;AAID,MAAM,MAAM,SAAS,GACjB,SAAS,GACT,iBAAiB,GACjB,qBAAqB,GACrB,YAAY,GACZ,aAAa,GACb,cAAc,GACd,YAAY,GACZ,cAAc,GACd,cAAc,GACd,kBAAkB,GAClB,YAAY,GACZ,aAAa,GACb,gBAAgB,CAAC;AAErB,MAAM,WAAW,cAAc;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,MAAM,EAAE,SAAS,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,SAAS,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAAC;IACnC,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,eAAe,CAAC;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,SAAS,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAAC;CACpC;AAQD,MAAM,WAAW,iBAAiB;IAChC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,cAAc,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,eAAe,CAAC;CAC5B;AAID,MAAM,MAAM,WAAW,GACnB,gBAAgB,GAChB,uBAAuB,GACvB,mBAAmB,GACnB,gBAAgB,GAChB,oBAAoB,GACpB,YAAY,GACZ,YAAY,CAAC;AAEjB,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAM5D,MAAM,WAAW,gBAAgB;IAC/B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC3E,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAID,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,yBAAyB,EAAE,OAAO,CAAC;IACnC,cAAc,EAAE,cAAc,CAAC;IAC/B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;CACxB;AAID,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;CACxB;AAID,MAAM,MAAM,gBAAgB,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/core/types.ts"],"names":[],"mappings":"AAAA;;EAEE;AACF,OAAO,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAI5E,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAID,MAAM,MAAM,iBAAiB,GACzB,WAAW,GACX,YAAY,GACZ,iBAAiB,GACjB,YAAY,GACZ,YAAY,GACZ,kBAAkB,GAClB,qBAAqB,GACrB,YAAY,CAAC;AAEjB,MAAM,MAAM,eAAe,GACvB,kBAAkB,GAAG,gBAAgB,GAAG,iBAAiB,GACzD,iBAAiB,GAAI,MAAM,GAAa,WAAW,GACnD,gBAAgB,GAAK,cAAc,GAAK,mBAAmB,GAC3D,gBAAgB,CAAC;AAErB,MAAM,WAAW,iBAAiB;IAChC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB,EAAE,iBAAiB,EAAE,CAAC;IAC1C,uBAAuB,EAAE,OAAO,CAAC;IACjC,iBAAiB,EAAE,eAAe,EAAE,CAAC;IACrC,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;CAC7C;AAED,oGAAoG;AACpG,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,mBAAmB,EAAE,MAAM,EAAE,EAAE,CAAC;IAChC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAID,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,aAAa,GAAG,SAAS,GAAG,aAAa,CAAC;AAC/E,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,YAAY,GAAG,aAAa,CAAC;AAEzE,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,WAAW,CAAC;IACzB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,eAAe,EAAE,cAAc,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,gBAAgB;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,gBAAgB;IAC/B,eAAe,EAAE,WAAW,EAAE,CAAC;IAC/B,kBAAkB,EAAE,gBAAgB,EAAE,CAAC;CACxC;AAID,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,OAAO,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAID,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,iBAAiB,CAAC;IACtC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sBAAsB,EAAE,iBAAiB,CAAC;IAC1C,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,oBAAoB,EAAE,wBAAwB,EAAE,CAAC;IACjD,SAAS,EAAE,eAAe,CAAC;CAC5B;AAMD,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,iBAAiB,CAAC;IACtC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,OAAO,CAAC;IACxB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,kBAAkB,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC7C,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAAC;IACnC,gBAAgB,EAAE,eAAe,CAAC;CACnC;AAID,MAAM,MAAM,SAAS,GACjB,SAAS,GACT,iBAAiB,GACjB,qBAAqB,GACrB,YAAY,GACZ,aAAa,GACb,cAAc,GACd,YAAY,GACZ,cAAc,GACd,cAAc,GACd,kBAAkB,GAClB,YAAY,GACZ,aAAa,GACb,gBAAgB,CAAC;AAErB,MAAM,WAAW,cAAc;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,MAAM,EAAE,SAAS,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,SAAS,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAAC;IACnC,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,eAAe,CAAC;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,SAAS,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAAC;CACpC;AAQD,MAAM,WAAW,iBAAiB;IAChC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,cAAc,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,eAAe,CAAC;CAC5B;AAID,MAAM,MAAM,WAAW,GACnB,gBAAgB,GAChB,uBAAuB,GACvB,mBAAmB,GACnB,gBAAgB,GAChB,oBAAoB,GACpB,YAAY,GACZ,YAAY,CAAC;AAEjB,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAM5D,MAAM,WAAW,gBAAgB;IAC/B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC3E,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAID,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,yBAAyB,EAAE,OAAO,CAAC;IACnC,cAAc,EAAE,cAAc,CAAC;IAC/B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;CACxB;AAID,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;CACxB;AAID,MAAM,MAAM,gBAAgB,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC"}

package/dist/proxy/control.d.ts

@@ -88,12 +88,18 @@ export declare function fetchBundleViaControl(loc: ControlLocator): Promise<unkn
  * live proxy over its loopback control channel. Never writes an empty/placeholder bundle — if no
  * live proxy can be reached it throws {@link ExportUnavailableError}.
  */
+export declare class ExportTargetExistsError extends Error {
+    readonly output: string;
+    constructor(output: string);
+}
 export declare function exportBundleToFile(opts: {
     proxy: {
         exportBundle(): unknown;
     } | null;
     dataDir: string;
     output: string;
+    /** RC9-06 / D-21.7: replacement is opt-in only. Default refuses an existing destination. */
+    force?: boolean;
     writeFile?: (filePath: string, data: string) => void;
 }): Promise<{
     source: 'in-process' | 'control-channel';

package/dist/proxy/control.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"control.d.ts","sourceRoot":"","sources":["../../src/proxy/control.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAMH,qEAAqE;AACrE,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,oGAAoG;AACpG,eAAO,MAAM,oBAAoB,QAAQ,CAAC;AAC1C,oGAAoG;AACpG,eAAO,MAAM,cAAc,kBAAkB,CAAC;AAC9C,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAEhD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAUpD;AAED,iFAAiF;AACjF,MAAM,WAAW,kBAAkB;IACjC,YAAY,IAAI,OAAO,CAAC;IACxB,SAAS,IAAI,OAAO,CAAC;IACrB,WAAW,IAAI,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;gBAEhC,MAAM,EAAE,kBAAkB;IAItC,8FAA8F;IACxF,KAAK,CAAC,IAAI,GAAE,MAA6B,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAmB5F,wFAAwF;IACxF,OAAO,IAAI,MAAM;IAKjB,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,OAAO,CAAC,MAAM;IAgCd,OAAO,CAAC,IAAI;IAQZ,qCAAqC;IAC/B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAO5B;AAID,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI,CAE3E;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAYtE;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAMvD;AAID,6FAA6F;AAC7F,eAAO,MAAM,gBAAgB,8EACgD,CAAC;AAE9E,sFAAsF;AACtF,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,GAAE,MAAyB;CAI/C;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CA4BjF;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,KAAK,EAAE;QAAE,YAAY,IAAI,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACtD,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,YAAY,GAAG,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAmB9F"}
+{"version":3,"file":"control.d.ts","sourceRoot":"","sources":["../../src/proxy/control.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAMH,qEAAqE;AACrE,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,oGAAoG;AACpG,eAAO,MAAM,oBAAoB,QAAQ,CAAC;AAC1C,oGAAoG;AACpG,eAAO,MAAM,cAAc,kBAAkB,CAAC;AAC9C,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAEhD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAUpD;AAED,iFAAiF;AACjF,MAAM,WAAW,kBAAkB;IACjC,YAAY,IAAI,OAAO,CAAC;IACxB,SAAS,IAAI,OAAO,CAAC;IACrB,WAAW,IAAI,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;gBAEhC,MAAM,EAAE,kBAAkB;IAItC,8FAA8F;IACxF,KAAK,CAAC,IAAI,GAAE,MAA6B,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAmB5F,wFAAwF;IACxF,OAAO,IAAI,MAAM;IAKjB,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,OAAO,CAAC,MAAM;IAgCd,OAAO,CAAC,IAAI;IAQZ,qCAAqC;IAC/B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAO5B;AAID,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI,CAE3E;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAYtE;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAMvD;AAID,6FAA6F;AAC7F,eAAO,MAAM,gBAAgB,8EACgD,CAAC;AAE9E,sFAAsF;AACtF,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,GAAE,MAAyB;CAI/C;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CA4BjF;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;aACpB,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM;CAQ3C;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,KAAK,EAAE;QAAE,YAAY,IAAI,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACtD,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,YAAY,GAAG,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CA+B9F"}

package/dist/proxy/control.js

@@ -222,8 +222,32 @@ export async function fetchBundleViaControl(loc) {
  * live proxy over its loopback control channel. Never writes an empty/placeholder bundle — if no
  * live proxy can be reached it throws {@link ExportUnavailableError}.
  */
+export class ExportTargetExistsError extends Error {
+    output;
+    constructor(output) {
+        super(`Refusing to overwrite an existing file: ${output}\n` +
+            `Export writes with exclusive-create by default so it can never destroy an operator's file.\n` +
+            `Choose a different --output path, or pass --force to replace this file deliberately.`);
+        this.output = output;
+        this.name = 'ExportTargetExistsError';
+    }
+}
 export async function exportBundleToFile(opts) {
-    const write = opts.writeFile ?? ((p, d) => fs.writeFileSync(p, d));
+    // RC9-06 (founder ruling D-21.7): this previously called fs.writeFileSync unconditionally, so
+    // `export --output <existing-file>` silently TRUNCATED whatever the operator pointed at — a
+    // config, a key file, a prior bundle — and exited 0 reporting success. No attacker and no
+    // unusual deployment required, on the exact artifact a verifier consumes. Default is now
+    // exclusive-create ('wx', which fails if the path exists); replacement requires --force.
+    const write = opts.writeFile ?? ((p, d) => {
+        try {
+            fs.writeFileSync(p, d, opts.force ? undefined : { flag: 'wx' });
+        }
+        catch (e) {
+            if (!opts.force && e?.code === 'EEXIST')
+                throw new ExportTargetExistsError(p);
+            throw e;
+        }
+    });
     let bundle;
     let source;
     if (opts.proxy) {

package/dist/proxy/control.js.map

@@ -1 +1 @@
-{"version":3,"file":"control.js","sourceRoot":"","sources":["../../src/proxy/control.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,qEAAqE;AACrE,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CAAC;AACxC,oGAAoG;AACpG,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAC1C,oGAAoG;AACpG,MAAM,CAAC,MAAM,cAAc,GAAG,eAAe,CAAC;AAC9C,MAAM,CAAC,MAAM,oBAAoB,GAAG,WAAW,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAU;IACzC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,6FAA6F;IAC7F,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,EAAE,GAAG,CAAC,CAAC,UAAiD,CAAC;IAC/D,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,OAAO,EAAE,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACzF,OAAO,IAAI,CAAC;AACd,CAAC;AASD;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IACrB,MAAM,GAAuB,IAAI,CAAC;IAClC,SAAS,GAAG,CAAC,CAAC;IACL,MAAM,CAAqB;IAE5C,YAAY,MAA0B;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,8FAA8F;IAC9F,KAAK,CAAC,KAAK,CAAC,OAAe,oBAAoB;QAC7C,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,OAAO,GAAG,CAAC,GAAU,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9B,6FAA6F;YAC7F,4FAA4F;YAC5F,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE;gBACrC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACxC,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC3D,CAAC;IAED,wFAAwF;IACxF,OAAO;QACL,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACpC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;IACxE,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAEO,MAAM,CAAC,GAAyB,EAAE,GAAwB;QAChE,4EAA4E;QAC5E,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iEAAiE,EAAE,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,IAAI,MAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;gBACtC,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,sFAAsF;oBACtF,yFAAyF;oBACzF,0CAA0C;oBAC1C,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,EAAE,CAAC,CAAC;oBACzF,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC9B,CAAC;iBAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC/B,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YAC/C,CAAC;iBAAM,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;gBACjC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6EAA6E,EAAE,CAAC,CAAC;YAChH,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,GAAwB,EAAE,MAAc,EAAE,IAAa;QAClE,+FAA+F;QAC/F,4FAA4F;QAC5F,+EAA+E;QAC/E,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,cAAc,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACtG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC;IAED,qCAAqC;IACrC,KAAK,CAAC,IAAI;QACR,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QACtB,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;QACnB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC;CACF;AAWD,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,GAAmB;IACnE,EAAE,CAAC,aAAa,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAA4B,CAAC;QACzG,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACjD,OAAO;YACL,IAAI,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY;YAClE,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACrD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;AACH,CAAC;AAED,wFAAwF;AAExF,6FAA6F;AAC7F,MAAM,CAAC,MAAM,gBAAgB,GAC3B,2EAA2E,CAAC;AAE9E,sFAAsF;AACtF,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,UAAkB,gBAAgB;QAC5C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAmB;IAC7D,MAAM,GAAG,GAAG,UAAU,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,SAAS,CAAC;IACpD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,8EAA8E;QAC9E,MAAM,IAAI,sBAAsB,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,yCAAyC,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,iGAAiG;IACjG,0FAA0F;IAC1F,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,oBAAoB,EAAE,CAAC;QAC7D,MAAM,IAAI,sBAAsB,EAAE,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,gGAAgG;IAChG,6DAA6D;IAC7D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAC;IACjH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAKxC;IACC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACnF,IAAI,MAAe,CAAC;IACpB,IAAI,MAAwC,CAAC;IAE7C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACnC,MAAM,GAAG,YAAY,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,sBAAsB,EAAE,CAAC;QAC7C,MAAM,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,GAAG,iBAAiB,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAI,MAAiC,CAAC,QAAQ,CAAC;IAC7D,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC;AACvD,CAAC"}
+{"version":3,"file":"control.js","sourceRoot":"","sources":["../../src/proxy/control.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,qEAAqE;AACrE,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CAAC;AACxC,oGAAoG;AACpG,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAC1C,oGAAoG;AACpG,MAAM,CAAC,MAAM,cAAc,GAAG,eAAe,CAAC;AAC9C,MAAM,CAAC,MAAM,oBAAoB,GAAG,WAAW,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAU;IACzC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,6FAA6F;IAC7F,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,EAAE,GAAG,CAAC,CAAC,UAAiD,CAAC;IAC/D,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,OAAO,EAAE,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACzF,OAAO,IAAI,CAAC;AACd,CAAC;AASD;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IACrB,MAAM,GAAuB,IAAI,CAAC;IAClC,SAAS,GAAG,CAAC,CAAC;IACL,MAAM,CAAqB;IAE5C,YAAY,MAA0B;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,8FAA8F;IAC9F,KAAK,CAAC,KAAK,CAAC,OAAe,oBAAoB;QAC7C,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,OAAO,GAAG,CAAC,GAAU,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9B,6FAA6F;YAC7F,4FAA4F;YAC5F,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE;gBACrC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACxC,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC3D,CAAC;IAED,wFAAwF;IACxF,OAAO;QACL,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACpC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;IACxE,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAEO,MAAM,CAAC,GAAyB,EAAE,GAAwB;QAChE,4EAA4E;QAC5E,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iEAAiE,EAAE,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,IAAI,MAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;gBACtC,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,sFAAsF;oBACtF,yFAAyF;oBACzF,0CAA0C;oBAC1C,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,EAAE,CAAC,CAAC;oBACzF,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC9B,CAAC;iBAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC/B,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YAC/C,CAAC;iBAAM,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;gBACjC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6EAA6E,EAAE,CAAC,CAAC;YAChH,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,GAAwB,EAAE,MAAc,EAAE,IAAa;QAClE,+FAA+F;QAC/F,4FAA4F;QAC5F,+EAA+E;QAC/E,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,cAAc,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACtG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC;IAED,qCAAqC;IACrC,KAAK,CAAC,IAAI;QACR,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QACtB,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;QACnB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC;CACF;AAWD,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,GAAmB;IACnE,EAAE,CAAC,aAAa,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAA4B,CAAC;QACzG,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACjD,OAAO;YACL,IAAI,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY;YAClE,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACrD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;AACH,CAAC;AAED,wFAAwF;AAExF,6FAA6F;AAC7F,MAAM,CAAC,MAAM,gBAAgB,GAC3B,2EAA2E,CAAC;AAE9E,sFAAsF;AACtF,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,UAAkB,gBAAgB;QAC5C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAmB;IAC7D,MAAM,GAAG,GAAG,UAAU,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,SAAS,CAAC;IACpD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,8EAA8E;QAC9E,MAAM,IAAI,sBAAsB,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,yCAAyC,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,iGAAiG;IACjG,0FAA0F;IAC1F,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,oBAAoB,EAAE,CAAC;QAC7D,MAAM,IAAI,sBAAsB,EAAE,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,gGAAgG;IAChG,6DAA6D;IAC7D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAC;IACjH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACpB;IAA5B,YAA4B,MAAc;QACxC,KAAK,CACH,2CAA2C,MAAM,IAAI;YACrD,8FAA8F;YAC9F,sFAAsF,CACvF,CAAC;QALwB,WAAM,GAAN,MAAM,CAAQ;QAMxC,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAOxC;IACC,8FAA8F;IAC9F,4FAA4F;IAC5F,0FAA0F;IAC1F,yFAAyF;IACzF,yFAAyF;IACzF,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE;QACxD,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,KAAK,IAAK,CAA2B,EAAE,IAAI,KAAK,QAAQ;gBAAE,MAAM,IAAI,uBAAuB,CAAC,CAAC,CAAC,CAAC;YACzG,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,MAAe,CAAC;IACpB,IAAI,MAAwC,CAAC;IAE7C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACnC,MAAM,GAAG,YAAY,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,sBAAsB,EAAE,CAAC;QAC7C,MAAM,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,GAAG,iBAAiB,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAI,MAAiC,CAAC,QAAQ,CAAC;IAC7D,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC;AACvD,CAAC"}

package/dist/proxy/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/proxy/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;GAcG;AAmRH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5E,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/proxy/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;GAcG;AAsSH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5E,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC"}

package/dist/proxy/index.js

@@ -19,7 +19,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as os from 'node:os';
 import { GovernanceProxy } from './server.js';
-import { PROFILES } from './profiles.js';
+import { PROFILES, resolveProfile, auditOnlyWarningBanner } from './profiles.js';
 import { ProxyControlServer, DEFAULT_CONTROL_PORT, writeControlFile, removeControlFile, exportBundleToFile, ExportUnavailableError, } from './control.js';
 // Single-source the version from package.json (resolves from src/ via tsx and dist/proxy/ when published).
 const PKG = JSON.parse(fs.readFileSync(new URL('../../package.json', import.meta.url), 'utf8'));
@@ -46,7 +46,12 @@ program
     .option('--upstream-url <url>', 'Downstream MCP server URL (HTTP)')
     .option('--profile <name>', 'Policy profile: permissive, standard, restrictive', 'permissive')
     .option('--policy <path>', 'Custom policy JSON file')
-    .action(async (opts) => {
+    .action(startAction);
+// Shared by `start` and `run` (identical option sets). `run` previously delegated by re-parsing
+// argv through the start subcommand with 'start' left in the array, which commander rejects as a
+// stray operand — `aga-proxy run` exited 1 on every invocation from 3.0.0 through 3.3.3 without
+// ever reaching policy resolution. A shared action function cannot regress that way.
+async function startAction(opts) {
     const port = parseInt(opts.port, 10);
     const controlPort = parseInt(opts.controlPort, 10);
     let policy;
@@ -54,7 +59,19 @@ program
         policy = JSON.parse(fs.readFileSync(opts.policy, 'utf-8'));
     }
     else {
-        policy = PROFILES[opts.profile] ?? PROFILES.permissive;
+        // REL-04: an unrecognized profile name is a hard error, not a silent
+        // fallback to 'permissive' (which is audit_only and denies nothing).
+        const resolved = resolveProfile(opts.profile);
+        if (!resolved) {
+            console.error(`aga-proxy: unknown --profile '${opts.profile}'. Valid profiles: ${Object.keys(PROFILES).join(', ')}.\n` +
+                `Refusing to start: silently falling back to 'permissive' would run in audit-only mode (no call denied).`);
+            process.exit(2);
+        }
+        policy = resolved;
+    }
+    // REL-04: audit_only permits everything — make that impossible to miss.
+    if (policy.mode === 'audit_only') {
+        console.error(auditOnlyWarningBanner(opts.policy ? `--policy ${opts.policy}` : `--profile ${opts.profile}`));
     }
     const upstream = opts.upstream ? parseUpstreamCommand(opts.upstream) : undefined;
     proxy = new GovernanceProxy({
@@ -114,7 +131,7 @@ program
     };
     process.on('SIGINT', shutdown);
     process.on('SIGTERM', shutdown);
-});
+}
 // ── run (foreground, alias for start) ────────────────────────
 program
     .command('run')
@@ -125,10 +142,7 @@ program
     .option('--upstream-url <url>', 'Downstream MCP server URL (HTTP)')
     .option('--profile <name>', 'Policy profile', 'permissive')
     .option('--policy <path>', 'Custom policy JSON file')
-    .action(async (opts) => {
-    // Delegate to start - identical behavior in Node.js
-    await program.commands.find(c => c.name() === 'start').parseAsync(['node', 'aga-proxy', 'start', ...process.argv.slice(3)]);
-});
+    .action(startAction);
 // ── stop ─────────────────────────────────────────────────────
 program
     .command('stop')
@@ -180,12 +194,13 @@ program
     .command('export')
     .description('Export the canonical SEP evidence bundle from the running proxy (in-process, or a live proxy over its loopback control channel)')
     .option('-o, --output <path>', 'Output file', 'evidence-bundle.json')
+    .option('--force', 'Replace the output file if it already exists (default: refuse, never destroy an existing file)')
     .action(async (opts) => {
     // Two paths, one artifact: if this process IS the running proxy, export its ledger directly;
     // otherwise reach the live proxy over 127.0.0.1 using the control port it published in the data
     // dir. Never emit an empty bundle when no proxy is running — fail loudly instead.
     try {
-        const res = await exportBundleToFile({ proxy, dataDir: getDataDir(), output: opts.output });
+        const res = await exportBundleToFile({ proxy, dataDir: getDataDir(), output: opts.output, force: opts.force === true });
         console.log(`Evidence bundle exported to ${res.output} (${res.receiptCount} receipts, via ${res.source})`);
     }
     catch (err) {
@@ -248,7 +263,9 @@ policyCmd
         console.error('Proxy not running in this process.');
         process.exit(1);
     }
-    const newPolicy = PROFILES[profile];
+    // REL-04: own-property lookup, so `policy switch constructor` (etc.) resolves undefined and is
+    // rejected, matching the `start --profile` guard rather than picking up an Object.prototype key.
+    const newPolicy = resolveProfile(profile);
     if (!newPolicy) {
         console.error(`Unknown profile: ${profile}. Available: ${Object.keys(PROFILES).join(', ')}`);
         process.exit(1);

package/dist/proxy/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/proxy/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,OAAO,EACL,kBAAkB,EAAE,oBAAoB,EACxC,gBAAgB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,sBAAsB,GAChF,MAAM,cAAc,CAAC;AAEtB,2GAA2G;AAC3G,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAwB,CAAC;AAEvH,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAC9B,IAAI,KAAK,GAA2B,IAAI,CAAC;AACzC,IAAI,OAAO,GAA8B,IAAI,CAAC;AAE9C,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED,OAAO;KACJ,IAAI,CAAC,WAAW,CAAC;KACjB,WAAW,CAAC,4EAA4E,CAAC;KACzF,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAExB,gEAAgE;AAEhE,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,4BAA4B,CAAC;KACzC,MAAM,CAAC,mBAAmB,EAAE,YAAY,EAAE,OAAO,CAAC;KAClD,MAAM,CAAC,uBAAuB,EAAE,yEAAyE,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC;KACxI,MAAM,CAAC,sBAAsB,EAAE,uCAAuC,CAAC;KACvE,MAAM,CAAC,sBAAsB,EAAE,kCAAkC,CAAC;KAClE,MAAM,CAAC,kBAAkB,EAAE,mDAAmD,EAAE,YAAY,CAAC;KAC7F,MAAM,CAAC,iBAAiB,EAAE,yBAAyB,CAAC;KACpD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACnD,IAAI,MAAkB,CAAC;IAEvB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC;IACzD,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjF,KAAK,GAAG,IAAI,eAAe,CAAC;QAC1B,IAAI;QACJ,MAAM;QACN,QAAQ;QACR,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC;IAEH,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAoB,EAAE,EAAE;QACpD,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACrE,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;QAC/B,OAAO,CAAC,KAAK,CAAC,gBAAgB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,yBAAyB;IACzB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAExE,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IAEpB,iBAAiB;IACjB,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAEpD,+FAA+F;IAC/F,2FAA2F;IAC3F,4FAA4F;IAC5F,4EAA4E;IAC5E,OAAO,GAAG,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC/C,gBAAgB,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,yEAAyE,CAAC,CAAC;IACjJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,GAAG,IAAI,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,mDAAmD,WAAW,KAAM,GAAa,CAAC,OAAO,4GAA4G,CAAC,CAAC;IACvN,CAAC;IAED,oBAAoB;IACpB,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAClC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC3B,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,IAAI,CAAC;gBAAC,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC;AAEL,gEAAgE;AAEhE,OAAO;KACJ,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,yDAAyD,CAAC;KACtE,MAAM,CAAC,mBAAmB,EAAE,YAAY,EAAE,OAAO,CAAC;KAClD,MAAM,CAAC,uBAAuB,EAAE,wCAAwC,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC;KACvG,MAAM,CAAC,sBAAsB,EAAE,uCAAuC,CAAC;KACvE,MAAM,CAAC,sBAAsB,EAAE,kCAAkC,CAAC;KAClE,MAAM,CAAC,kBAAkB,EAAE,gBAAgB,EAAE,YAAY,CAAC;KAC1D,MAAM,CAAC,iBAAiB,EAAE,yBAAyB,CAAC;KACpD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,oDAAoD;IACpD,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,OAAO,CAAE,CAAC,UAAU,CAChE,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CACzD,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,gEAAgE;AAEhE,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,wBAAwB,CAAC;KACrC,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,8BAA8B,GAAG,GAAG,CAAC,CAAC;QAClD,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC7D,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,gEAAgE;AAEhE,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,mBAAmB,CAAC;KAChC,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAC7B,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,iBAAiB;gBACvC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,gEAAgE;AAEhE,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,iIAAiI,CAAC;KAC9I,MAAM,CAAC,qBAAqB,EAAE,aAAa,EAAE,sBAAsB,CAAC;KACpE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,6FAA6F;IAC7F,gGAAgG;IAChG,kFAAkF;IAClF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5F,OAAO,CAAC,GAAG,CAAC,+BAA+B,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,YAAY,kBAAkB,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7G,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;YAC1C,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,gEAAgE;AAEhE,OAAO;KACJ,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,6IAA6I,CAAC;KAC1J,MAAM,CAAC,aAAa,EAAE,mEAAmE,CAAC;KAC1F,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE;IACjC,qFAAqF;IACrF,yFAAyF;IACzF,yFAAyF;IACzF,0FAA0F;IAC1F,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC5D,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,CAAC,2GAA2G,CAAC,CAAC;IACxI,2FAA2F;IAC3F,8FAA8F;IAC9F,uEAAuE;IACvE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrG,CAAC,CAAC,CAAC;AAEL,gEAAgE;AAEhE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;AAE7E,SAAS;KACN,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,qBAAqB,CAAC;KAClC,MAAM,CAAC,GAAG,EAAE;IACX,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC,CAAC,CAAC;AAEL,SAAS;KACN,OAAO,CAAC,kBAAkB,CAAC;KAC3B,WAAW,CAAC,uBAAuB,CAAC;KACpC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,gBAAgB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,UAAU,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEL,gEAAgE;AAEhE,SAAS,oBAAoB,CAAC,GAAW;IACvC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,gEAAgE;AAEhE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAG5E,iCAAiC;AACjC,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;AACjG,IAAI,WAAW,EAAE,CAAC;IAChB,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACjC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/proxy/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAEjF,OAAO,EACL,kBAAkB,EAAE,oBAAoB,EACxC,gBAAgB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,sBAAsB,GAChF,MAAM,cAAc,CAAC;AAEtB,2GAA2G;AAC3G,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAwB,CAAC;AAEvH,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAC9B,IAAI,KAAK,GAA2B,IAAI,CAAC;AACzC,IAAI,OAAO,GAA8B,IAAI,CAAC;AAE9C,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED,OAAO;KACJ,IAAI,CAAC,WAAW,CAAC;KACjB,WAAW,CAAC,4EAA4E,CAAC;KACzF,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAExB,gEAAgE;AAEhE,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,4BAA4B,CAAC;KACzC,MAAM,CAAC,mBAAmB,EAAE,YAAY,EAAE,OAAO,CAAC;KAClD,MAAM,CAAC,uBAAuB,EAAE,yEAAyE,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC;KACxI,MAAM,CAAC,sBAAsB,EAAE,uCAAuC,CAAC;KACvE,MAAM,CAAC,sBAAsB,EAAE,kCAAkC,CAAC;KAClE,MAAM,CAAC,kBAAkB,EAAE,mDAAmD,EAAE,YAAY,CAAC;KAC7F,MAAM,CAAC,iBAAiB,EAAE,yBAAyB,CAAC;KACpD,MAAM,CAAC,WAAW,CAAC,CAAC;AAEvB,gGAAgG;AAChG,iGAAiG;AACjG,gGAAgG;AAChG,qFAAqF;AACrF,KAAK,UAAU,WAAW,CAAC,IAAsH;IAC7I,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACnD,IAAI,MAAkB,CAAC;IAEvB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,qEAAqE;QACrE,qEAAqE;QACrE,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CACX,iCAAiC,IAAI,CAAC,OAAO,sBAAsB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;gBACxG,yGAAyG,CAC1G,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,QAAQ,CAAC;IACpB,CAAC;IAED,wEAAwE;IACxE,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC/G,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjF,KAAK,GAAG,IAAI,eAAe,CAAC;QAC1B,IAAI;QACJ,MAAM;QACN,QAAQ;QACR,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC;IAEH,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAoB,EAAE,EAAE;QACpD,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACrE,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;QAC/B,OAAO,CAAC,KAAK,CAAC,gBAAgB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,yBAAyB;IACzB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAExE,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IAEpB,iBAAiB;IACjB,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAEpD,+FAA+F;IAC/F,2FAA2F;IAC3F,4FAA4F;IAC5F,4EAA4E;IAC5E,OAAO,GAAG,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC/C,gBAAgB,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,yEAAyE,CAAC,CAAC;IACjJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,GAAG,IAAI,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,mDAAmD,WAAW,KAAM,GAAa,CAAC,OAAO,4GAA4G,CAAC,CAAC;IACvN,CAAC;IAED,oBAAoB;IACpB,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAClC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC3B,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,IAAI,CAAC;gBAAC,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED,gEAAgE;AAEhE,OAAO;KACJ,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,yDAAyD,CAAC;KACtE,MAAM,CAAC,mBAAmB,EAAE,YAAY,EAAE,OAAO,CAAC;KAClD,MAAM,CAAC,uBAAuB,EAAE,wCAAwC,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC;KACvG,MAAM,CAAC,sBAAsB,EAAE,uCAAuC,CAAC;KACvE,MAAM,CAAC,sBAAsB,EAAE,kCAAkC,CAAC;KAClE,MAAM,CAAC,kBAAkB,EAAE,gBAAgB,EAAE,YAAY,CAAC;KAC1D,MAAM,CAAC,iBAAiB,EAAE,yBAAyB,CAAC;KACpD,MAAM,CAAC,WAAW,CAAC,CAAC;AAEvB,gEAAgE;AAEhE,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,wBAAwB,CAAC;KACrC,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,8BAA8B,GAAG,GAAG,CAAC,CAAC;QAClD,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC7D,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,gEAAgE;AAEhE,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,mBAAmB,CAAC;KAChC,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAC7B,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,iBAAiB;gBACvC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,gEAAgE;AAEhE,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,iIAAiI,CAAC;KAC9I,MAAM,CAAC,qBAAqB,EAAE,aAAa,EAAE,sBAAsB,CAAC;KACpE,MAAM,CAAC,SAAS,EAAE,gGAAgG,CAAC;KACnH,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,6FAA6F;IAC7F,gGAAgG;IAChG,kFAAkF;IAClF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC,CAAC;QACxH,OAAO,CAAC,GAAG,CAAC,+BAA+B,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,YAAY,kBAAkB,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7G,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;YAC1C,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,gEAAgE;AAEhE,OAAO;KACJ,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,6IAA6I,CAAC;KAC1J,MAAM,CAAC,aAAa,EAAE,mEAAmE,CAAC;KAC1F,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE;IACjC,qFAAqF;IACrF,yFAAyF;IACzF,yFAAyF;IACzF,0FAA0F;IAC1F,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC5D,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,CAAC,2GAA2G,CAAC,CAAC;IACxI,2FAA2F;IAC3F,8FAA8F;IAC9F,uEAAuE;IACvE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrG,CAAC,CAAC,CAAC;AAEL,gEAAgE;AAEhE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;AAE7E,SAAS;KACN,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,qBAAqB,CAAC;KAClC,MAAM,CAAC,GAAG,EAAE;IACX,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC,CAAC,CAAC;AAEL,SAAS;KACN,OAAO,CAAC,kBAAkB,CAAC;KAC3B,WAAW,CAAC,uBAAuB,CAAC;KACpC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,+FAA+F;IAC/F,iGAAiG;IACjG,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,gBAAgB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,UAAU,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEL,gEAAgE;AAEhE,SAAS,oBAAoB,CAAC,GAAW;IACvC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,gEAAgE;AAEhE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAG5E,iCAAiC;AACjC,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;AACjG,IAAI,WAAW,EAAE,CAAC;IAChB,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACjC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/proxy/profiles.d.ts

@@ -12,4 +12,20 @@ export declare const STANDARD: ToolPolicy;
 /** Explicit allowlist only. All unrecognized tools denied. Low rate limits. */
 export declare const RESTRICTIVE: ToolPolicy;
 export declare const PROFILES: Record<string, ToolPolicy>;
+/**
+ * REL-04: resolve a --profile name to its policy, or undefined for an
+ * UNRECOGNIZED name. Own-property check so prototype-chain names (e.g.
+ * 'constructor') can never resolve to garbage. The caller decides the
+ * failure behavior — the CLI refuses to start rather than silently
+ * falling back to 'permissive' (audit_only).
+ */
+export declare function resolveProfile(name: string): ToolPolicy | undefined;
+/**
+ * REL-04: the loud stderr banner printed when the proxy starts with an
+ * audit_only policy. audit_only records and signs every decision but
+ * denies nothing; denial happens only under an allowlist-mode policy
+ * (--profile standard / restrictive, or a custom --policy file).
+ * `source` names where the policy came from, e.g. "--profile permissive".
+ */
+export declare function auditOnlyWarningBanner(source: string): string;
 //# sourceMappingURL=profiles.d.ts.map

package/dist/proxy/profiles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../src/proxy/profiles.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,yDAAyD;AACzD,eAAO,MAAM,UAAU,EAAE,UAGxB,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,QAAQ,EAAE,UActB,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,WAAW,EAAE,UAOzB,CAAC;AAEF,eAAO,MAAM,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAI/C,CAAC"}
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../src/proxy/profiles.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,yDAAyD;AACzD,eAAO,MAAM,UAAU,EAAE,UAGxB,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,QAAQ,EAAE,UActB,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,WAAW,EAAE,UAOzB,CAAC;AAEF,eAAO,MAAM,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAI/C,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAEnE;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAgB7D"}

package/dist/proxy/profiles.js

@@ -39,4 +39,38 @@ export const PROFILES = {
     standard: STANDARD,
     restrictive: RESTRICTIVE,
 };
+/**
+ * REL-04: resolve a --profile name to its policy, or undefined for an
+ * UNRECOGNIZED name. Own-property check so prototype-chain names (e.g.
+ * 'constructor') can never resolve to garbage. The caller decides the
+ * failure behavior — the CLI refuses to start rather than silently
+ * falling back to 'permissive' (audit_only).
+ */
+export function resolveProfile(name) {
+    return Object.prototype.hasOwnProperty.call(PROFILES, name) ? PROFILES[name] : undefined;
+}
+/**
+ * REL-04: the loud stderr banner printed when the proxy starts with an
+ * audit_only policy. audit_only records and signs every decision but
+ * denies nothing; denial happens only under an allowlist-mode policy
+ * (--profile standard / restrictive, or a custom --policy file).
+ * `source` names where the policy came from, e.g. "--profile permissive".
+ */
+export function auditOnlyWarningBanner(source) {
+    const bar = '!'.repeat(76);
+    return [
+        bar,
+        '!!  AUDIT-ONLY MODE — THIS PROXY WILL NOT BLOCK ANY TOOL CALL',
+        '!!',
+        `!!  The active policy (${source}) has mode 'audit_only': every tool call`,
+        '!!  is PERMITTED and recorded. No call is denied in this mode. Signed',
+        '!!  receipts are still issued for every decision, so the evidence trail',
+        '!!  remains verifiable offline.',
+        '!!',
+        '!!  To enforce an allowlist (calls outside it are DENIED at the proxy',
+        '!!  boundary), start with --profile standard or --profile restrictive,',
+        '!!  or pass --policy <file> with "mode": "allowlist".',
+        bar,
+    ].join('\n');
+}
 //# sourceMappingURL=profiles.js.map

package/dist/proxy/profiles.js.map

@@ -1 +1 @@
-{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../src/proxy/profiles.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,yDAAyD;AACzD,MAAM,CAAC,MAAM,UAAU,GAAe;IACpC,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,EAAE;CAChB,CAAC;AAEF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,QAAQ,GAAe;IAClC,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE;QACX,eAAe,EAAI,EAAE,IAAI,EAAE,iBAAiB,EAAI,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE;QACzF,gBAAgB,EAAG,EAAE,IAAI,EAAE,kBAAkB,EAAG,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE;QACxI,aAAa,EAAM,EAAE,IAAI,EAAE,eAAe,EAAM,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,EAAE;QACvJ,UAAU,EAAS,EAAE,IAAI,EAAE,YAAY,EAAS,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE;QACzF,SAAS,EAAU,EAAE,IAAI,EAAE,WAAW,EAAU,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE;QACzF,YAAY,EAAO,EAAE,IAAI,EAAE,cAAc,EAAO,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,EAAE;QACxF,eAAe,EAAI,EAAE,IAAI,EAAE,iBAAiB,EAAI,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,EAAE;QACxF,aAAa,EAAM,EAAE,IAAI,EAAE,eAAe,EAAM,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE;QACzF,YAAY,EAAO,EAAE,IAAI,EAAE,cAAc,EAAO,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE;QACzF,YAAY,EAAO,EAAE,IAAI,EAAE,cAAc,EAAO,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE;KAC1F;CACF,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,WAAW,GAAe;IACrC,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE;QACX,eAAe,EAAG,EAAE,IAAI,EAAE,iBAAiB,EAAG,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;QAC7G,UAAU,EAAQ,EAAE,IAAI,EAAE,YAAY,EAAQ,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,EAAE;QACtF,aAAa,EAAK,EAAE,IAAI,EAAE,eAAe,EAAK,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE;KACxF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAA+B;IAClD,UAAU,EAAE,UAAU;IACtB,QAAQ,EAAE,QAAQ;IAClB,WAAW,EAAE,WAAW;CACzB,CAAC"}
+{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../src/proxy/profiles.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,yDAAyD;AACzD,MAAM,CAAC,MAAM,UAAU,GAAe;IACpC,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,EAAE;CAChB,CAAC;AAEF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,QAAQ,GAAe;IAClC,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE;QACX,eAAe,EAAI,EAAE,IAAI,EAAE,iBAAiB,EAAI,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE;QACzF,gBAAgB,EAAG,EAAE,IAAI,EAAE,kBAAkB,EAAG,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE;QACxI,aAAa,EAAM,EAAE,IAAI,EAAE,eAAe,EAAM,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,EAAE;QACvJ,UAAU,EAAS,EAAE,IAAI,EAAE,YAAY,EAAS,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE;QACzF,SAAS,EAAU,EAAE,IAAI,EAAE,WAAW,EAAU,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE;QACzF,YAAY,EAAO,EAAE,IAAI,EAAE,cAAc,EAAO,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,EAAE;QACxF,eAAe,EAAI,EAAE,IAAI,EAAE,iBAAiB,EAAI,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,EAAE;QACxF,aAAa,EAAM,EAAE,IAAI,EAAE,eAAe,EAAM,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE;QACzF,YAAY,EAAO,EAAE,IAAI,EAAE,cAAc,EAAO,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE;QACzF,YAAY,EAAO,EAAE,IAAI,EAAE,cAAc,EAAO,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE;KAC1F;CACF,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,WAAW,GAAe;IACrC,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE;QACX,eAAe,EAAG,EAAE,IAAI,EAAE,iBAAiB,EAAG,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;QAC7G,UAAU,EAAQ,EAAE,IAAI,EAAE,YAAY,EAAQ,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,EAAE;QACtF,aAAa,EAAK,EAAE,IAAI,EAAE,eAAe,EAAK,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE;KACxF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAA+B;IAClD,UAAU,EAAE,UAAU;IACtB,QAAQ,EAAE,QAAQ;IAClB,WAAW,EAAE,WAAW;CACzB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3B,OAAO;QACL,GAAG;QACH,+DAA+D;QAC/D,IAAI;QACJ,0BAA0B,MAAM,0CAA0C;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,iCAAiC;QACjC,IAAI;QACJ,uEAAuE;QACvE,wEAAwE;QACxE,uDAAuD;QACvD,GAAG;KACJ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/sep/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/sep/verify.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,UAAU;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;CAAE;AAC1D,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,UAAU,GAAG,QAAQ,GAAG,qBAAqB,CAAC;IACvD,yGAAyG;IACzG,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,OAAO,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AACD,MAAM,WAAW,aAAa;IAC5B;uGACmG;IACnG,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAyCD,wBAAgB,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,qBAAqB,CAsHpH"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/sep/verify.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,UAAU;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;CAAE;AAC1D,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,UAAU,GAAG,QAAQ,GAAG,qBAAqB,CAAC;IACvD,yGAAyG;IACzG,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,OAAO,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AACD,MAAM,WAAW,aAAa;IAC5B;uGACmG;IACnG,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AA8DD,wBAAgB,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,qBAAqB,CA4HpH"}

package/dist/sep/verify.js

@@ -10,7 +10,7 @@
  * profile this verifier does not implement (e.g. a v1-only build handed a v2 bundle). An UNKNOWN /
  * unregistered algorithm is FAILED, never a false VERIFIED, never a partial verify.
  */
-import { canonicalize } from './canonical.js';
+import { canonicalize, MAX_CANON_DEPTH } from './canonical.js';
 import { sha256Hex, isHex } from './crypto.js';
 import { nodeHash } from './merkle.js';
 import { SEP_RECEIPT_FIELDS } from './receipt.js';
@@ -18,6 +18,34 @@ import { SEP_CHECKPOINT_FIELDS } from './checkpoint.js';
 import { isRegisteredProfile, validPublicKeyForProfile, verifyForProfile, ALL_PROFILES, REGISTERED_PROFILES, } from './profiles.js';
 const leaf = (r) => sha256Hex(canonicalize(r));
 const strip = (o, f) => Object.fromEntries(Object.entries(o).filter(([k]) => k !== f));
+/**
+ * R3 safe-integer floor (VERIFY-side). A validly-signed receipt/checkpoint carrying a JSON number
+ * that is NOT a JS SAFE INTEGER — an integer with |value| > 2^53-1, a non-integral, or a non-finite
+ * number — splits the six verifiers: JS JSON.parse rounds it to an IEEE-754 double before canon
+ * (breaking the signed bytes -> FAILED) while Go (json.Number) and Python (arbitrary-precision int)
+ * preserve the literal and VERIFY. The engine's `canonicalize` is a SHARED emit+verify primitive
+ * (it also hashes tool arguments, which may legitimately carry integers > 2^53), so the floor is
+ * applied HERE, only to the objects the signed path canonicalizes (each receipt and the checkpoint).
+ * Throwing is caught by verifySepBundle's outer try/catch -> FAILED, matching the reference verdict.
+ * The only SIGNED numeric in a conformant bundle is the small integer checkpoint.leaf_count;
+ * leaf_index lives in the unsigned merkle_proofs, outside this floor (a bad leaf_index is caught by
+ * merkle_and_bijection instead). [R3]
+ */
+const assertSafeNumbers = (o, depth = 0) => {
+    if (depth > MAX_CANON_DEPTH)
+        throw new Error(`canonicalize: input nesting exceeds ${MAX_CANON_DEPTH} levels`);
+    if (typeof o === 'number' && !Number.isSafeInteger(o))
+        throw new Error('canonicalize: number is not a JS-safe integer');
+    if (o === null || typeof o !== 'object')
+        return;
+    if (Array.isArray(o)) {
+        for (const v of o)
+            assertSafeNumbers(v, depth + 1);
+        return;
+    }
+    for (const v of Object.values(o))
+        assertSafeNumbers(v, depth + 1);
+};
 /**
  * Canonical SEP timestamp validation (cross-stack unified). A timestamp is VALID iff it matches the
  * EXACT fixed-width UTC form Date.prototype.toISOString() emits AND its calendar fields are in range —
@@ -75,6 +103,12 @@ export function verifySepBundle(bundle, expectedPublicKey, opts) {
         const receipts = Array.isArray(bundle?.receipts) ? bundle.receipts : [];
         const proofs = Array.isArray(bundle?.merkle_proofs) ? bundle.merkle_proofs : [];
         const pub = bundle?.public_key;
+        // R3 safe-integer floor: reject (fail closed) any non-JS-safe-integer number in a signed object
+        // (each receipt + the checkpoint) — the objects the signed path canonicalizes — so a >2^53 /
+        // non-integral / non-finite literal cannot split this stack from the reference verifiers.
+        for (const r of receipts)
+            assertSafeNumbers(r);
+        assertSafeNumbers(bundle?.checkpoint);
         // A pin is honored only if it is well-formed for the bundle's (supported, registered) profile;
         // a malformed pin is an integrity-only check (pinned=false), never a silent provenance pass.
         pinned = isRegisteredProfile(algorithm) && supported.includes(algorithm)

package/dist/sep/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/sep/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,mBAAmB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,YAAY,EAAE,mBAAmB,GACnG,MAAM,eAAe,CAAC;AAiBvB,MAAM,IAAI,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,MAAM,KAAK,GAAG,CAAC,CAA0B,EAAE,CAAS,EAA2B,EAAE,CAC/E,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEjE;;;;GAIG;AACH,MAAM,KAAK,GAAG,oEAAoE,CAAC;AACnF,MAAM,MAAM,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC;AACvF,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE,CACnD,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3E,MAAM,gBAAgB,GAAG,CAAC,EAAW,EAAW,EAAE;IAChD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACxC,OAAO,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE;WAC3B,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC;WAC3C,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE;WACvB,MAAM,IAAI,CAAC,IAAI,MAAM,IAAI,EAAE;WAC3B,MAAM,IAAI,CAAC,IAAI,MAAM,IAAI,EAAE,CAAC;AACnC,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,YAAY,GAAG,CAAC,CAAU,EAAE,MAAyB,EAAW,EAAE;IACtE,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAA4B,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1G,CAAC,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,MAAW,EAAE,iBAA0B,EAAE,IAAoB;IAC3F,MAAM,SAAS,GAAG,IAAI,EAAE,iBAAiB,IAAI,YAAY,CAAC;IAC1D,MAAM,SAAS,GAAW,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAM,CAAC,SAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpG,+FAA+F;IAC/F,qGAAqG;IACrG,gFAAgF;IAChF,IAAI,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACrE,OAAO;YACL,OAAO,EAAE,qBAAqB;YAC9B,OAAO,EAAE,mEAAmE,SAAS,OAAO,mBAAmB,CAAC,SAAS,CAAC,+BAA+B;YACzJ,cAAc,EAAE,KAAK;YACrB,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;SAChD,CAAC;IACJ,CAAC;IAED,uFAAuF;IACvF,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,KAAK,GAAiB,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAW,EAAW,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7F,MAAM,QAAQ,GAAU,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,MAAM,MAAM,GAAU,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,GAAG,GAAW,MAAM,EAAE,UAAU,CAAC;QAEvC,+FAA+F;QAC/F,6FAA6F;QAC7F,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;eACnE,OAAO,iBAAiB,KAAK,QAAQ,IAAI,wBAAwB,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;QAErG,mGAAmG;QACnG,wFAAwF;QACxF,GAAG,CAAC,YAAY,EACd,mBAAmB,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC;eACxG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;eACxD,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAEjE,8FAA8F;QAC9F,GAAG,CAAC,oBAAoB,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAE5J,mGAAmG;QACnG,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAChC,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAChD,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,qBAAqB,IAAI,EAAE,CAAC,KAAK,UAAU;gBAAE,KAAK,GAAG,KAAK,CAAC;YAC5E,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACjC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAAE,KAAK,GAAG,KAAK,CAAC;iBACpC,CAAC;gBAAC,IAAI,MAAM,KAAK,IAAI,IAAI,EAAE,GAAG,MAAM;oBAAE,KAAK,GAAG,KAAK,CAAC;gBAAC,MAAM,GAAG,EAAE,CAAC;YAAC,CAAC;QAC1E,CAAC;QACD,GAAG,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;QAEjC,oGAAoG;QACpG,qGAAqG;QACrG,uGAAuG;QACvG,6FAA6F;QAC7F,IAAI,IAAI,GAAkB,IAAI,CAAC;QAC/B,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACvB,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACtF,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,CAAC,CAAC,SAAS;gBAAE,MAAM,GAAG,KAAK,CAAC;YACtE,IAAI,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC;YACtB,MAAM,GAAG,GAAa,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,MAAM,GAAG,GAAa,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAAE,MAAM,GAAG,KAAK,CAAC;YACrI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;gBAAE,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7G,IAAI,CAAC,CAAC,WAAW,KAAK,GAAG;gBAAE,MAAM,GAAG,KAAK,CAAC,CAAU,2DAA2D;YAC/G,IAAI,IAAI,KAAK,IAAI;gBAAE,IAAI,GAAG,GAAG,CAAC;iBAAM,IAAI,IAAI,KAAK,GAAG;gBAAE,MAAM,GAAG,KAAK,CAAC;QACvE,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChI,GAAG,CAAC,sBAAsB,EAAE,MAAM,IAAI,SAAS,CAAC,CAAC;QAEjD,qGAAqG;QACrG,+EAA+E;QAC/E,MAAM,EAAE,GAAG,MAAM,EAAE,UAAU,CAAC;QAC9B,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,YAAY,CAAC,EAAE,EAAE,qBAAqB,CAAC,EAAE,CAAC;YAC5C,IAAI,GAAG,EAAE,CAAC,SAAS,KAAK,SAAS;mBAC5B,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC;mBACpF,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC,WAAW,KAAK,IAAI;mBACxC,EAAE,CAAC,UAAU,KAAK,QAAQ,CAAC,MAAM;mBACjC,EAAE,CAAC,cAAc,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;QAE/B,kGAAkG;QAClG,kGAAkG;QAClG,MAAM,WAAW,GAAG,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAE,EAA8B,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5G,MAAM,aAAa,GAAG,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAE,EAA8B,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QAChH,GAAG,CAAC,sBAAsB,EACxB,QAAQ,CAAC,MAAM,GAAG,CAAC;eAChB,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC;eAC3C,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,EAAE,UAAU,CAAC;eAC1D,WAAW,KAAK,MAAM,EAAE,UAAU;eAClC,MAAM,EAAE,YAAY,KAAK,aAAa;eACtC,IAAI,KAAK,IAAI,IAAI,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC,CAAC;QAEpD,0DAA0D;QAC1D,MAAM,cAAc,GAAG,MAAM,IAAI,GAAG,KAAK,iBAAiB,CAAC;QAC3D,IAAI,MAAM;YAAE,GAAG,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC;QAErD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;QACjE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,GAAG,SAAS,MAAM,mBAAmB,CAAC,SAAS,CAAC,IAAI,GAAG,GAAG,CAAC;QAC9E,MAAM,OAAO,GAAG,OAAO,KAAK,QAAQ;YAClC,CAAC,CAAC,2CAA2C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,GAAG;YAC9E,CAAC,CAAC,MAAM;gBACN,CAAC,CAAC,aAAa,UAAU,2DAA2D;gBACpF,CAAC,CAAC,aAAa,UAAU,iFAAiF,CAAC;QAC/G,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,kDAAkD,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC3L,CAAC;AACH,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/sep/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,mBAAmB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,YAAY,EAAE,mBAAmB,GACnG,MAAM,eAAe,CAAC;AAiBvB,MAAM,IAAI,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,MAAM,KAAK,GAAG,CAAC,CAA0B,EAAE,CAAS,EAA2B,EAAE,CAC/E,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEjE;;;;;;;;;;;;GAYG;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAU,EAAE,KAAK,GAAG,CAAC,EAAQ,EAAE;IACxD,IAAI,KAAK,GAAG,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,eAAe,SAAS,CAAC,CAAC;IAC9G,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACxH,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAAC,KAAK,MAAM,CAAC,IAAI,CAAC;YAAE,iBAAiB,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IACrF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAA4B,CAAC;QAAE,iBAAiB,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;AAC/F,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,KAAK,GAAG,oEAAoE,CAAC;AACnF,MAAM,MAAM,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC;AACvF,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE,CACnD,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3E,MAAM,gBAAgB,GAAG,CAAC,EAAW,EAAW,EAAE;IAChD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACxC,OAAO,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE;WAC3B,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC;WAC3C,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE;WACvB,MAAM,IAAI,CAAC,IAAI,MAAM,IAAI,EAAE;WAC3B,MAAM,IAAI,CAAC,IAAI,MAAM,IAAI,EAAE,CAAC;AACnC,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,YAAY,GAAG,CAAC,CAAU,EAAE,MAAyB,EAAW,EAAE;IACtE,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAA4B,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1G,CAAC,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,MAAW,EAAE,iBAA0B,EAAE,IAAoB;IAC3F,MAAM,SAAS,GAAG,IAAI,EAAE,iBAAiB,IAAI,YAAY,CAAC;IAC1D,MAAM,SAAS,GAAW,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAM,CAAC,SAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpG,+FAA+F;IAC/F,qGAAqG;IACrG,gFAAgF;IAChF,IAAI,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACrE,OAAO;YACL,OAAO,EAAE,qBAAqB;YAC9B,OAAO,EAAE,mEAAmE,SAAS,OAAO,mBAAmB,CAAC,SAAS,CAAC,+BAA+B;YACzJ,cAAc,EAAE,KAAK;YACrB,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;SAChD,CAAC;IACJ,CAAC;IAED,uFAAuF;IACvF,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,KAAK,GAAiB,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAW,EAAW,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7F,MAAM,QAAQ,GAAU,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,MAAM,MAAM,GAAU,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,GAAG,GAAW,MAAM,EAAE,UAAU,CAAC;QAEvC,gGAAgG;QAChG,6FAA6F;QAC7F,0FAA0F;QAC1F,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAC/C,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAEtC,+FAA+F;QAC/F,6FAA6F;QAC7F,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;eACnE,OAAO,iBAAiB,KAAK,QAAQ,IAAI,wBAAwB,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;QAErG,mGAAmG;QACnG,wFAAwF;QACxF,GAAG,CAAC,YAAY,EACd,mBAAmB,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC;eACxG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;eACxD,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAEjE,8FAA8F;QAC9F,GAAG,CAAC,oBAAoB,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAE5J,mGAAmG;QACnG,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAChC,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAChD,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,qBAAqB,IAAI,EAAE,CAAC,KAAK,UAAU;gBAAE,KAAK,GAAG,KAAK,CAAC;YAC5E,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACjC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAAE,KAAK,GAAG,KAAK,CAAC;iBACpC,CAAC;gBAAC,IAAI,MAAM,KAAK,IAAI,IAAI,EAAE,GAAG,MAAM;oBAAE,KAAK,GAAG,KAAK,CAAC;gBAAC,MAAM,GAAG,EAAE,CAAC;YAAC,CAAC;QAC1E,CAAC;QACD,GAAG,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;QAEjC,oGAAoG;QACpG,qGAAqG;QACrG,uGAAuG;QACvG,6FAA6F;QAC7F,IAAI,IAAI,GAAkB,IAAI,CAAC;QAC/B,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACvB,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACtF,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,CAAC,CAAC,SAAS;gBAAE,MAAM,GAAG,KAAK,CAAC;YACtE,IAAI,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC;YACtB,MAAM,GAAG,GAAa,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,MAAM,GAAG,GAAa,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAAE,MAAM,GAAG,KAAK,CAAC;YACrI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;gBAAE,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7G,IAAI,CAAC,CAAC,WAAW,KAAK,GAAG;gBAAE,MAAM,GAAG,KAAK,CAAC,CAAU,2DAA2D;YAC/G,IAAI,IAAI,KAAK,IAAI;gBAAE,IAAI,GAAG,GAAG,CAAC;iBAAM,IAAI,IAAI,KAAK,GAAG;gBAAE,MAAM,GAAG,KAAK,CAAC;QACvE,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChI,GAAG,CAAC,sBAAsB,EAAE,MAAM,IAAI,SAAS,CAAC,CAAC;QAEjD,qGAAqG;QACrG,+EAA+E;QAC/E,MAAM,EAAE,GAAG,MAAM,EAAE,UAAU,CAAC;QAC9B,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,YAAY,CAAC,EAAE,EAAE,qBAAqB,CAAC,EAAE,CAAC;YAC5C,IAAI,GAAG,EAAE,CAAC,SAAS,KAAK,SAAS;mBAC5B,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC;mBACpF,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC,WAAW,KAAK,IAAI;mBACxC,EAAE,CAAC,UAAU,KAAK,QAAQ,CAAC,MAAM;mBACjC,EAAE,CAAC,cAAc,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;QAE/B,kGAAkG;QAClG,kGAAkG;QAClG,MAAM,WAAW,GAAG,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAE,EAA8B,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5G,MAAM,aAAa,GAAG,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAE,EAA8B,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QAChH,GAAG,CAAC,sBAAsB,EACxB,QAAQ,CAAC,MAAM,GAAG,CAAC;eAChB,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC;eAC3C,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,EAAE,UAAU,CAAC;eAC1D,WAAW,KAAK,MAAM,EAAE,UAAU;eAClC,MAAM,EAAE,YAAY,KAAK,aAAa;eACtC,IAAI,KAAK,IAAI,IAAI,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC,CAAC;QAEpD,0DAA0D;QAC1D,MAAM,cAAc,GAAG,MAAM,IAAI,GAAG,KAAK,iBAAiB,CAAC;QAC3D,IAAI,MAAM;YAAE,GAAG,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC;QAErD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;QACjE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,GAAG,SAAS,MAAM,mBAAmB,CAAC,SAAS,CAAC,IAAI,GAAG,GAAG,CAAC;QAC9E,MAAM,OAAO,GAAG,OAAO,KAAK,QAAQ;YAClC,CAAC,CAAC,2CAA2C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,GAAG;YAC9E,CAAC,CAAC,MAAM;gBACN,CAAC,CAAC,aAAa,UAAU,2DAA2D;gBACpF,CAAC,CAAC,aAAa,UAAU,iFAAiF,CAAC;QAC/G,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,kDAAkD,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC3L,CAAC;AACH,CAAC"}

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA6EpE,wBAAsB,eAAe,IAAI,OAAO,CAAC,SAAS,CAAC,CAqY1D"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA6EpE,wBAAsB,eAAe,IAAI,OAAO,CAAC,SAAS,CAAC,CAkZ1D"}

package/dist/server.js

@@ -229,7 +229,20 @@ export async function createAGAServer() {
         let action = null;
         let driftDesc = null;
         if (!result.ttl_ok) {
-            driftDesc = 'TTL expired - fail-closed termination';
+            // D1 RULED 2026-08-29: TTL expiry fails closed.
+            //
+            // History worth keeping, because it is the reason this comment is long. This branch once
+            // sealed 'TERMINATE' while portal.measure() only degraded to SAFE_STATE and kept accepting
+            // measurements — a signed receipt asserting an enforcement that never happened, which is the
+            // exact failure this product exists to prevent. That was corrected by making the RECEIPT
+            // honest about the weaker behavior (action = null). The founder has now ruled the other way:
+            // the BEHAVIOR is what changes, so portal.measure() genuinely sets TERMINATED on TTL expiry
+            // (see core/portal.ts) and sealing 'TERMINATE' is accurate again — for the same reason it has
+            // always been accurate on the sibling `revoked` branch below.
+            //
+            // The invariant across all three versions is the one that matters: the receipt says what
+            // actually happened. Only the underlying behavior moved.
+            driftDesc = 'TTL expired - fail-closed termination; re-attestation required';
             action = 'TERMINATE';
         }
         else if (result.revoked) {

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACxF,yFAAyF;AACzF,kGAAkG;AAClG,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAgB,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,aAAa,EAAmB,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAoB,MAAM,4BAA4B,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAE1F,0FAA0F;AAC1F,mFAAmF;AACnF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAwB,CAAC;AACjH,MAAM,cAAc,GAAW,GAAG,CAAC,OAAO,CAAC;AAE3C;;;;;;;GAOG;AACH,SAAS,kBAAkB,CAAC,QAAoB;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IACjD,IAAI,CAAC;QACH,IAAI,MAAM;YAAE,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,OAAO;YAAE,OAAO,WAAW,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,0BAA0B,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,sBAAsB,gBAAgB,MAAM,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC;IAC9J,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,2OAA2O,CAAC,CAAC;IAC3P,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,mEAAmE;AAEnE,MAAM,mBAAmB,GAAsB;IAC7C,sBAAsB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI;IAC/C,oBAAoB,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC;IACjD,uBAAuB,EAAE,IAAI;IAC7B,iBAAiB,EAAE,CAAC,mBAAmB,EAAE,iBAAiB,CAAC;CAC5D,CAAC;AAEF,MAAM,cAAc,GAAqB;IACvC,eAAe,EAAE;QACf,EAAE,QAAQ,EAAE,eAAe,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,oBAAoB,EAAE,cAAc,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,YAAY,CAAC,EAAE;QAChK,EAAE,QAAQ,EAAE,oBAAoB,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,cAAc,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE;QACjK,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE;QACvJ,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,YAAY,CAAC,EAAE;QACpK,EAAE,QAAQ,EAAE,oBAAoB,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,mBAAmB,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE;QACrL,EAAE,QAAQ,EAAE,mBAAmB,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE;KAC/I;IACD,kBAAkB,EAAE,EAAE;CACvB,CAAC;AAEF,MAAM,YAAY,GAA4B;IAC5C,eAAe,EAAE,eAAe,EAAE,oBAAoB,EAAE,SAAS,EAAE,cAAc,EAAE,uBAAuB;IAC1G,cAAc,EAAE,EAAE,EAAE,oBAAoB,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI;CAC7E,CAAC;AAEF,mEAAmE;AAEnE,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAClF,MAAM,OAAO,GAAe,IAAI,aAAa,EAAE,CAAC;IAChD,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;IAE3B,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,OAAO,GAAI,eAAe,EAAE,CAAC;IACnC,MAAM,MAAM,GAAK,IAAI,MAAM,EAAE,CAAC;IAC9B,IAAI,UAAU,GAA2B,IAAI,CAAC;IAC9C,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAE7B,iEAAiE;IACjE,KAAK,UAAU,SAAS,CAAC,IAAuC,EAAE,OAAgB;QAChF,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,EAAE,SAAS,CAAC,mCAAmC,CAAC,CAAC,CAAC;YAC5F,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAClC,gBAAgB,GAAG,IAAI,CAAC;YACxB,MAAM,CAAC,eAAe,GAAG,CAAC,CAAC;YAC3B,MAAM,CAAC,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC;QAC1C,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACxD,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;QAC/C,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,CAAC,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAEvG,iEAAiE;IACjE,MAAM,aAAa,GAAG,EAAE,IAAI,OAAO,KAAK,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAElD,gFAAgF;IAChF,4FAA4F;IAC5F,iGAAiG;IACjG,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,EAAE,cAAc,CAAC,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;IAE5H,mGAAmG;IACnG,mGAAmG;IACnG,4GAA4G;IAC5G,uFAAuF;IACvF,SAAS,YAAY,CACnB,IAAY,EAAE,WAAmB,EAAE,MAAW,EAC9C,OAAoB;QAEpB,MAAM,IAAI,GAAG,uBAAuB,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,EACjF,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpH,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,iEAAiE;IACjE,wBAAwB;IACxB,iEAAiE;IACjE,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,qDAAqD,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;QACtG,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,cAAc;QACjD,QAAQ,EAAE,+BAA+B;QACzC,aAAa,EAAE,oDAAoD;QACnE,eAAe,EAAE,CAAC,gBAAgB,EAAE,yBAAyB,CAAC;QAC9D,iBAAiB,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC9C,iBAAiB,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC9C,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;QAC5C,kBAAkB,EAAE,GAAG,CAAC,YAAY,EAAI,mDAAmD;QAC3F,iBAAiB,EAAE,GAAG,CAAC,KAAK;QAC5B,iBAAiB,EAAE,gBAAgB;QACnC,YAAY,EAAE,MAAM,CAAC,KAAK;KAC3B,CAAC,CAAC,CAAC;IAEJ,iEAAiE;IACjE,2DAA2D;IAC3D,iEAAiE;IACjE,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,yEAAyE,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3H,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ;QAClC,WAAW,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,IAAI,IAAI;QACjD,WAAW,EAAE,MAAM,CAAC,QAAQ,EAAE,sBAAsB,CAAC,WAAW,IAAI,IAAI;QACxE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,IAAI,IAAI;QACpD,oBAAoB,EAAE,MAAM,CAAC,QAAQ,EAAE,sBAAsB,CAAC,oBAAoB,IAAI,EAAE;QACxF,gBAAgB,EAAE,MAAM,CAAC,eAAe;QACxC,iBAAiB,EAAE,UAAU,EAAE,MAAM,IAAI,KAAK;KAC/C,CAAC,CAAC,CAAC;IAEJ,iEAAiE;IACjE,mBAAmB;IACnB,iEAAiE;IACjE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,iDAAiD,EACzE,EAAE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,EAC7C,KAAK,EAAE,EAAE,kBAAkB,EAAE,EAAE,EAAE;QAC/B,IAAI,gBAAgB;YAAE,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACvF,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC,CAAC;QAClH,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAClC,gBAAgB,GAAG,IAAI,CAAC;QACxB,MAAM,CAAC,eAAe,GAAG,CAAC,CAAC;QAC3B,MAAM,CAAC,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC;QACxC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,QAAQ,EAAE,iBAAiB,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACxG,CAAC,CACF,CAAC;IAEF,iEAAiE;IACjE,uBAAuB;IACvB,iEAAiE;IACjE,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAC1B,0EAA0E,EAC1E;QACE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QACpE,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;QACnK,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACzF,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC;YAC5B,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YACpC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YACjC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;SACtB,CAAC,CAAC,QAAQ,EAAE;KACd,EACD,KAAK,EAAE,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,mBAAmB,EAAE,EAAE,EAAE;QACnF,MAAM,KAAK,GAAG,0BAA0B,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC;QAC5E,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3G,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,SAAS;YAAE,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAElH,MAAM,QAAQ,GAAG,gBAAgB,CAAC;YAChC,kBAAkB,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;YACzE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS;YACtD,sBAAsB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,cAAc;YAC9E,oBAAoB,EAAE,GAAG,CAAC,oBAAoB,EAAE,cAAc,EAAE,QAAQ;SACzE,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAEtC,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3D,UAAU,GAAG,IAAI,CAAC;QAClB,iBAAiB,CAAC,KAAK,EAAE,CAAC;QAC1B,iFAAiF;QACjF,wFAAwF;QACxF,yFAAyF;QACzF,6EAA6E;QAC7E,IAAI,mBAAmB;YAAE,iBAAiB,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;QAE5E,MAAM,SAAS,CAAC,iBAAiB,EAAE,EAAE,aAAa,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAEjH,OAAO,CAAC,CAAC;YACP,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW;YACvF,kBAAkB,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK;YACrD,iBAAiB,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,iEAAiE;IACjE,0BAA0B;IAC1B,kEAAkE;IAClE,8CAA8C;IAC9C,iEAAiE;IACjE,YAAY,CAAC,mBAAmB,EAC9B,qGAAqG,EACrG;QACE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;QACtE,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;KACpK,EACD,KAAK,EAAE,EAAE,eAAe,EAAE,gBAAgB,EAAE,EAAE,EAAE;QAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC,CAAC;QAC5G,IAAI,MAAM,CAAC,KAAK,KAAK,YAAY;YAAE,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC,CAAC;QAEpH,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,gBAAgB,KAAK,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;QACrH,MAAM,SAAS,GAAG,GAAG,MAAM,CAAC,iBAAiB,KAAK,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAE5E,+BAA+B;QAC/B,IAAI,MAAM,GAAG,IAA0D,CAAC;QACxE,IAAI,SAAS,GAAkB,IAAI,CAAC;QAEpC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,SAAS,GAAG,uCAAuC,CAAC;YACpD,MAAM,GAAG,WAAW,CAAC;QACvB,CAAC;aAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC1B,SAAS,GAAG,4CAA4C,CAAC;YACzD,MAAM,GAAG,WAAW,CAAC;QACvB,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACzB,SAAS,GAAG,kCAAkC,CAAC;YAC/C,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC;YACxF,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACvB,IAAI,MAAM,KAAK,YAAY;gBAAE,UAAU,GAAG,cAAc,EAAE,CAAC;QAC7D,CAAC;QAED,wDAAwD;QACxD,MAAM,OAAO,GAAG,eAAe,CAAC;YAC9B,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,EAAE,WAAW,EAAE,MAAM;YAClE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS;YAC9C,aAAa,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,gBAAgB,EAAE,SAAS;YACzD,MAAM,EAAE,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;YAC3F,GAAG,EAAE,MAAM,CAAC,eAAe,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,QAAQ;SACzE,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,SAAS,CAAC,qBAAqB,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,cAAc,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,CAAC;QAEtI,OAAO,CAAC,CAAC;YACP,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,cAAc,EAAE,CAAC,MAAM,CAAC,KAAK;YACjE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO;YAC9C,kBAAkB,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK;YACtD,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,iEAAiE;IACjE,kDAAkD;IAClD,iEAAiE;IACjE,YAAY,CAAC,iBAAiB,EAC5B,uGAAuG,EACvG;QACE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;QACrE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;KACrD,EACD,KAAK,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE;QAChC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAqB;YAC/B,oBAAoB,EAAE,WAAW,EAAE,MAAM;YACzC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE;SAC7D,CAAC;QACF,MAAM,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACtC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACxF,CAAC,CACF,CAAC;IAEF,iEAAiE;IACjE,qBAAqB;IACrB,iEAAiE;IACjE,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,oCAAoC,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC5C,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1I,CAAC,CAAC,CAAC;IAEH,4FAA4F;IAC5F,8FAA8F;IAC9F,4CAA4C;IAE5C,iEAAiE;IACjE,iCAAiC;IACjC,iEAAiE;IACjE,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,wSAAwS,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE;QAC/V,IAAI,GAAG,CAAC,KAAK,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8FAA8F,EAAE,CAAC,CAAC;QACzJ,OAAO,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,iEAAiE;IACjE,0CAA0C;IAC1C,iEAAiE;IACjE,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,kOAAkO,EACrQ,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,EAC7D,KAAK,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,EAAE;QACtC,IAAI,CAAC;YAAC,OAAO,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAAC,CAAC;QAC7D,OAAO,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,+CAA+C,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;IAC5H,CAAC,CACF,CAAC;IAEF,iEAAiE;IACjE,sBAAsB;IACtB,iEAAiE;IACjE,YAAY,CAAC,eAAe,EAAE,4DAA4D,EACxF,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EACxJ,KAAK,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE;QACzC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,iBAAiB,CAC9B,EAAE,kBAAkB,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EACzE,cAAc,EAAE,YAAY,EAAE,CAAC,EAAE,MAAM,EAAE,eAAe,IAAI,CAAC,EAAE,QAAQ,CACxE,CAAC;QACF,IAAI,MAAM,CAAC,oBAAoB;YAAE,MAAM,SAAS,CAAC,cAAc,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC;;YACzF,MAAM,SAAS,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QACpF,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC,CACF,CAAC;IAEF,iEAAiE;IACjE,oBAAoB;IACpB,iEAAiE;IACjE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,gDAAgD,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE;QAC1F,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACxL,CAAC,CAAC,CAAC;IAEH,iEAAiE;IACjE,+DAA+D;IAC/D,iEAAiE;IACjE,YAAY,CAAC,sBAAsB,EACjC,6HAA6H,EAC7H;QACE,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,uCAAuC,CAAC;QAC3F,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;QACrF,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qDAAqD,CAAC;QACjG,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC;KACrE,EACD,KAAK,EAAE,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,EAAE,EAAE;QAC/F,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC,CAAC;QAE5G,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE;YAC7C,oBAAoB,EAAE,oBAAqE;YAC3F,iBAAiB,EAAE,iBAAgE;YACnF,qBAAqB;YACrB,kBAAkB;SACnB,EAAE,QAAQ,CAAC,CAAC;QAEb,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,SAAS,CAAC,aAAa,EAAE;gBAC7B,IAAI,EAAE,YAAY;gBAClB,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;gBACjD,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;gBAC/C,aAAa,EAAE,MAAM,CAAC,qBAAqB;gBAC3C,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,OAAO,EAAE,kBAAkB;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC,CACF,CAAC;IAEF,iEAAiE;IACjE,0CAA0C;IAC1C,iEAAiE;IACjE,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAC5B,0RAA0R,EAC1R,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EACvC,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;QACpB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,CAAC;QAChD,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClE,wGAAwG;YACxG,IAAI,OAAO,IAAI,MAAM,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;gBAC7C,MAAM,CAAC,KAAK,GAAG,oBAAoB,CAAC;gBACpC,UAAU,GAAG,cAAc,EAAE,CAAC;gBAC9B,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;YACD,kGAAkG;YAClG,GAAG,CAAC,MAAM,CAAC;gBACT,SAAS,EAAE,kBAAkB;gBAC7B,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW;gBAC3C,MAAM,EAAE,8BAA8B,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,8BAA8B,MAAM,OAAO,EAAE;gBACvH,SAAS,EAAE,EAAE,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE,eAAe,EAAE,WAAW,CAAC,eAAe,EAAE;aAChG,CAAC,CAAC;YACH,MAAM,SAAS,CAAC,qBAAqB,EAAE;gBACrC,IAAI,EAAE,kBAAkB;gBACxB,UAAU,EAAE,WAAW,CAAC,UAAU;gBAClC,eAAe,EAAE,WAAW,CAAC,eAAe;gBAC5C,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,CAAC;YACP,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,gBAAgB;YAChD,QAAQ;YACR,GAAG,WAAW;YACd,eAAe,EAAE,WAAW,CAAC,UAAU,CAAC,MAAM;SAC/C,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,iEAAiE;IACjE,8BAA8B;IAC9B,iEAAiE;IACjE,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,2DAA2D,EACrF,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,EACxC,KAAK,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE;QAC1B,MAAM,QAAQ,GAAG,aAAa;YAC5B,CAAC,CAAC,MAAM,OAAO,CAAC,qBAAqB,CAAC,aAAa,CAAC;YACpD,CAAC,CAAC,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC;QACnC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,kBAAkB,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9O,CAAC,CACF,CAAC;IAEF,iEAAiE;IACjE,kCAAkC;IAClC,iEAAiE;IACjE,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,8BAA8B,EAC5D,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,EACpE,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;QAC/B,MAAM,MAAM,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,CAAC;YAC/D,CAAC,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC;YAC7C,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;QACjC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7N,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACxF,yFAAyF;AACzF,kGAAkG;AAClG,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAgB,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,aAAa,EAAmB,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAoB,MAAM,4BAA4B,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAE1F,0FAA0F;AAC1F,mFAAmF;AACnF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAwB,CAAC;AACjH,MAAM,cAAc,GAAW,GAAG,CAAC,OAAO,CAAC;AAE3C;;;;;;;GAOG;AACH,SAAS,kBAAkB,CAAC,QAAoB;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IACjD,IAAI,CAAC;QACH,IAAI,MAAM;YAAE,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,OAAO;YAAE,OAAO,WAAW,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,0BAA0B,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,sBAAsB,gBAAgB,MAAM,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC;IAC9J,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,2OAA2O,CAAC,CAAC;IAC3P,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,mEAAmE;AAEnE,MAAM,mBAAmB,GAAsB;IAC7C,sBAAsB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI;IAC/C,oBAAoB,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC;IACjD,uBAAuB,EAAE,IAAI;IAC7B,iBAAiB,EAAE,CAAC,mBAAmB,EAAE,iBAAiB,CAAC;CAC5D,CAAC;AAEF,MAAM,cAAc,GAAqB;IACvC,eAAe,EAAE;QACf,EAAE,QAAQ,EAAE,eAAe,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,oBAAoB,EAAE,cAAc,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,YAAY,CAAC,EAAE;QAChK,EAAE,QAAQ,EAAE,oBAAoB,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,cAAc,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE;QACjK,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE;QACvJ,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,YAAY,CAAC,EAAE;QACpK,EAAE,QAAQ,EAAE,oBAAoB,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,mBAAmB,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE;QACrL,EAAE,QAAQ,EAAE,mBAAmB,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE;KAC/I;IACD,kBAAkB,EAAE,EAAE;CACvB,CAAC;AAEF,MAAM,YAAY,GAA4B;IAC5C,eAAe,EAAE,eAAe,EAAE,oBAAoB,EAAE,SAAS,EAAE,cAAc,EAAE,uBAAuB;IAC1G,cAAc,EAAE,EAAE,EAAE,oBAAoB,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI;CAC7E,CAAC;AAEF,mEAAmE;AAEnE,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAClF,MAAM,OAAO,GAAe,IAAI,aAAa,EAAE,CAAC;IAChD,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;IAE3B,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,OAAO,GAAI,eAAe,EAAE,CAAC;IACnC,MAAM,MAAM,GAAK,IAAI,MAAM,EAAE,CAAC;IAC9B,IAAI,UAAU,GAA2B,IAAI,CAAC;IAC9C,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAE7B,iEAAiE;IACjE,KAAK,UAAU,SAAS,CAAC,IAAuC,EAAE,OAAgB;QAChF,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,EAAE,SAAS,CAAC,mCAAmC,CAAC,CAAC,CAAC;YAC5F,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAClC,gBAAgB,GAAG,IAAI,CAAC;YACxB,MAAM,CAAC,eAAe,GAAG,CAAC,CAAC;YAC3B,MAAM,CAAC,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC;QAC1C,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACxD,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;QAC/C,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,CAAC,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAEvG,iEAAiE;IACjE,MAAM,aAAa,GAAG,EAAE,IAAI,OAAO,KAAK,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAElD,gFAAgF;IAChF,4FAA4F;IAC5F,iGAAiG;IACjG,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,EAAE,cAAc,CAAC,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;IAE5H,mGAAmG;IACnG,mGAAmG;IACnG,4GAA4G;IAC5G,uFAAuF;IACvF,SAAS,YAAY,CACnB,IAAY,EAAE,WAAmB,EAAE,MAAW,EAC9C,OAAoB;QAEpB,MAAM,IAAI,GAAG,uBAAuB,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,EACjF,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpH,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,iEAAiE;IACjE,wBAAwB;IACxB,iEAAiE;IACjE,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,qDAAqD,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;QACtG,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,cAAc;QACjD,QAAQ,EAAE,+BAA+B;QACzC,aAAa,EAAE,oDAAoD;QACnE,eAAe,EAAE,CAAC,gBAAgB,EAAE,yBAAyB,CAAC;QAC9D,iBAAiB,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC9C,iBAAiB,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC9C,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;QAC5C,kBAAkB,EAAE,GAAG,CAAC,YAAY,EAAI,mDAAmD;QAC3F,iBAAiB,EAAE,GAAG,CAAC,KAAK;QAC5B,iBAAiB,EAAE,gBAAgB;QACnC,YAAY,EAAE,MAAM,CAAC,KAAK;KAC3B,CAAC,CAAC,CAAC;IAEJ,iEAAiE;IACjE,2DAA2D;IAC3D,iEAAiE;IACjE,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,yEAAyE,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3H,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ;QAClC,WAAW,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,IAAI,IAAI;QACjD,WAAW,EAAE,MAAM,CAAC,QAAQ,EAAE,sBAAsB,CAAC,WAAW,IAAI,IAAI;QACxE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,IAAI,IAAI;QACpD,oBAAoB,EAAE,MAAM,CAAC,QAAQ,EAAE,sBAAsB,CAAC,oBAAoB,IAAI,EAAE;QACxF,gBAAgB,EAAE,MAAM,CAAC,eAAe;QACxC,iBAAiB,EAAE,UAAU,EAAE,MAAM,IAAI,KAAK;KAC/C,CAAC,CAAC,CAAC;IAEJ,iEAAiE;IACjE,mBAAmB;IACnB,iEAAiE;IACjE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,iDAAiD,EACzE,EAAE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,EAC7C,KAAK,EAAE,EAAE,kBAAkB,EAAE,EAAE,EAAE;QAC/B,IAAI,gBAAgB;YAAE,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACvF,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC,CAAC;QAClH,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAClC,gBAAgB,GAAG,IAAI,CAAC;QACxB,MAAM,CAAC,eAAe,GAAG,CAAC,CAAC;QAC3B,MAAM,CAAC,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC;QACxC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,QAAQ,EAAE,iBAAiB,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACxG,CAAC,CACF,CAAC;IAEF,iEAAiE;IACjE,uBAAuB;IACvB,iEAAiE;IACjE,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAC1B,0EAA0E,EAC1E;QACE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QACpE,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;QACnK,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACzF,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC;YAC5B,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YACpC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YACjC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;SACtB,CAAC,CAAC,QAAQ,EAAE;KACd,EACD,KAAK,EAAE,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,mBAAmB,EAAE,EAAE,EAAE;QACnF,MAAM,KAAK,GAAG,0BAA0B,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC;QAC5E,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3G,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,SAAS;YAAE,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAElH,MAAM,QAAQ,GAAG,gBAAgB,CAAC;YAChC,kBAAkB,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;YACzE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS;YACtD,sBAAsB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,cAAc;YAC9E,oBAAoB,EAAE,GAAG,CAAC,oBAAoB,EAAE,cAAc,EAAE,QAAQ;SACzE,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAEtC,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3D,UAAU,GAAG,IAAI,CAAC;QAClB,iBAAiB,CAAC,KAAK,EAAE,CAAC;QAC1B,iFAAiF;QACjF,wFAAwF;QACxF,yFAAyF;QACzF,6EAA6E;QAC7E,IAAI,mBAAmB;YAAE,iBAAiB,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;QAE5E,MAAM,SAAS,CAAC,iBAAiB,EAAE,EAAE,aAAa,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAEjH,OAAO,CAAC,CAAC;YACP,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW;YACvF,kBAAkB,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK;YACrD,iBAAiB,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,iEAAiE;IACjE,0BAA0B;IAC1B,kEAAkE;IAClE,8CAA8C;IAC9C,iEAAiE;IACjE,YAAY,CAAC,mBAAmB,EAC9B,qGAAqG,EACrG;QACE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;QACtE,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;KACpK,EACD,KAAK,EAAE,EAAE,eAAe,EAAE,gBAAgB,EAAE,EAAE,EAAE;QAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC,CAAC;QAC5G,IAAI,MAAM,CAAC,KAAK,KAAK,YAAY;YAAE,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC,CAAC;QAEpH,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,gBAAgB,KAAK,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;QACrH,MAAM,SAAS,GAAG,GAAG,MAAM,CAAC,iBAAiB,KAAK,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAE5E,+BAA+B;QAC/B,IAAI,MAAM,GAAG,IAA0D,CAAC;QACxE,IAAI,SAAS,GAAkB,IAAI,CAAC;QAEpC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,gDAAgD;YAChD,EAAE;YACF,yFAAyF;YACzF,2FAA2F;YAC3F,6FAA6F;YAC7F,yFAAyF;YACzF,6FAA6F;YAC7F,4FAA4F;YAC5F,8FAA8F;YAC9F,8DAA8D;YAC9D,EAAE;YACF,yFAAyF;YACzF,yDAAyD;YACzD,SAAS,GAAG,gEAAgE,CAAC;YAC7E,MAAM,GAAG,WAAW,CAAC;QACvB,CAAC;aAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC1B,SAAS,GAAG,4CAA4C,CAAC;YACzD,MAAM,GAAG,WAAW,CAAC;QACvB,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACzB,SAAS,GAAG,kCAAkC,CAAC;YAC/C,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC;YACxF,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACvB,IAAI,MAAM,KAAK,YAAY;gBAAE,UAAU,GAAG,cAAc,EAAE,CAAC;QAC7D,CAAC;QAED,wDAAwD;QACxD,MAAM,OAAO,GAAG,eAAe,CAAC;YAC9B,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,EAAE,WAAW,EAAE,MAAM;YAClE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS;YAC9C,aAAa,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,gBAAgB,EAAE,SAAS;YACzD,MAAM,EAAE,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;YAC3F,GAAG,EAAE,MAAM,CAAC,eAAe,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,QAAQ;SACzE,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,SAAS,CAAC,qBAAqB,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,cAAc,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,CAAC;QAEtI,OAAO,CAAC,CAAC;YACP,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,cAAc,EAAE,CAAC,MAAM,CAAC,KAAK;YACjE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO;YAC9C,kBAAkB,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK;YACtD,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,iEAAiE;IACjE,kDAAkD;IAClD,iEAAiE;IACjE,YAAY,CAAC,iBAAiB,EAC5B,uGAAuG,EACvG;QACE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;QACrE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;KACrD,EACD,KAAK,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE;QAChC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAqB;YAC/B,oBAAoB,EAAE,WAAW,EAAE,MAAM;YACzC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE;SAC7D,CAAC;QACF,MAAM,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACtC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACxF,CAAC,CACF,CAAC;IAEF,iEAAiE;IACjE,qBAAqB;IACrB,iEAAiE;IACjE,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,oCAAoC,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC5C,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1I,CAAC,CAAC,CAAC;IAEH,4FAA4F;IAC5F,8FAA8F;IAC9F,4CAA4C;IAE5C,iEAAiE;IACjE,iCAAiC;IACjC,iEAAiE;IACjE,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,wSAAwS,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE;QAC/V,IAAI,GAAG,CAAC,KAAK,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8FAA8F,EAAE,CAAC,CAAC;QACzJ,OAAO,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,iEAAiE;IACjE,0CAA0C;IAC1C,iEAAiE;IACjE,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,kOAAkO,EACrQ,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,EAC7D,KAAK,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,EAAE;QACtC,IAAI,CAAC;YAAC,OAAO,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAAC,CAAC;QAC7D,OAAO,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,+CAA+C,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;IAC5H,CAAC,CACF,CAAC;IAEF,iEAAiE;IACjE,sBAAsB;IACtB,iEAAiE;IACjE,YAAY,CAAC,eAAe,EAAE,4DAA4D,EACxF,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EACxJ,KAAK,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE;QACzC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,iBAAiB,CAC9B,EAAE,kBAAkB,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EACzE,cAAc,EAAE,YAAY,EAAE,CAAC,EAAE,MAAM,EAAE,eAAe,IAAI,CAAC,EAAE,QAAQ,CACxE,CAAC;QACF,IAAI,MAAM,CAAC,oBAAoB;YAAE,MAAM,SAAS,CAAC,cAAc,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC;;YACzF,MAAM,SAAS,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QACpF,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC,CACF,CAAC;IAEF,iEAAiE;IACjE,oBAAoB;IACpB,iEAAiE;IACjE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,gDAAgD,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE;QAC1F,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACxL,CAAC,CAAC,CAAC;IAEH,iEAAiE;IACjE,+DAA+D;IAC/D,iEAAiE;IACjE,YAAY,CAAC,sBAAsB,EACjC,6HAA6H,EAC7H;QACE,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,uCAAuC,CAAC;QAC3F,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;QACrF,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qDAAqD,CAAC;QACjG,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC;KACrE,EACD,KAAK,EAAE,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,EAAE,EAAE;QAC/F,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC,CAAC;QAE5G,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE;YAC7C,oBAAoB,EAAE,oBAAqE;YAC3F,iBAAiB,EAAE,iBAAgE;YACnF,qBAAqB;YACrB,kBAAkB;SACnB,EAAE,QAAQ,CAAC,CAAC;QAEb,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,SAAS,CAAC,aAAa,EAAE;gBAC7B,IAAI,EAAE,YAAY;gBAClB,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;gBACjD,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;gBAC/C,aAAa,EAAE,MAAM,CAAC,qBAAqB;gBAC3C,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,OAAO,EAAE,kBAAkB;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC,CACF,CAAC;IAEF,iEAAiE;IACjE,0CAA0C;IAC1C,iEAAiE;IACjE,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAC5B,0RAA0R,EAC1R,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EACvC,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;QACpB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,CAAC;QAChD,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClE,wGAAwG;YACxG,IAAI,OAAO,IAAI,MAAM,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;gBAC7C,MAAM,CAAC,KAAK,GAAG,oBAAoB,CAAC;gBACpC,UAAU,GAAG,cAAc,EAAE,CAAC;gBAC9B,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;YACD,kGAAkG;YAClG,GAAG,CAAC,MAAM,CAAC;gBACT,SAAS,EAAE,kBAAkB;gBAC7B,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW;gBAC3C,MAAM,EAAE,8BAA8B,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,8BAA8B,MAAM,OAAO,EAAE;gBACvH,SAAS,EAAE,EAAE,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE,eAAe,EAAE,WAAW,CAAC,eAAe,EAAE;aAChG,CAAC,CAAC;YACH,MAAM,SAAS,CAAC,qBAAqB,EAAE;gBACrC,IAAI,EAAE,kBAAkB;gBACxB,UAAU,EAAE,WAAW,CAAC,UAAU;gBAClC,eAAe,EAAE,WAAW,CAAC,eAAe;gBAC5C,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,CAAC;YACP,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,gBAAgB;YAChD,QAAQ;YACR,GAAG,WAAW;YACd,eAAe,EAAE,WAAW,CAAC,UAAU,CAAC,MAAM;SAC/C,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,iEAAiE;IACjE,8BAA8B;IAC9B,iEAAiE;IACjE,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,2DAA2D,EACrF,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,EACxC,KAAK,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE;QAC1B,MAAM,QAAQ,GAAG,aAAa;YAC5B,CAAC,CAAC,MAAM,OAAO,CAAC,qBAAqB,CAAC,aAAa,CAAC;YACpD,CAAC,CAAC,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC;QACnC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,kBAAkB,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9O,CAAC,CACF,CAAC;IAEF,iEAAiE;IACjE,kCAAkC;IAClC,iEAAiE;IACjE,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,8BAA8B,EAC5D,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,EACpE,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;QAC/B,MAAM,MAAM,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,CAAC;YAC/D,CAAC,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC;YAC7C,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;QACjC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7N,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@attested-intelligence/aga-mcp-server",
-  "version": "3.3.2",
+  "version": "3.5.0",
+  "mcpName": "io.github.attestedintelligence/aga-mcp-server",
   "description": "MCP governance proxy and evidence engine for AI agent tool calls: evaluate each call against a sealed policy, permit or deny it at the proxy boundary, and prove every decision with signed, offline-verifiable evidence bundles.",
   "author": "Attested Intelligence Holdings LLC",
   "license": "MIT",
@@ -33,6 +34,7 @@
   "files": [
     "dist/",
     "README.md",
+    "CHANGELOG.md",
     "LICENSE",
     "SECURITY.md",
     "THREAT_BOUNDARY.md",
@@ -66,7 +68,7 @@
     "prepublishOnly": "npm run build && npm run test && npm run test:conformance && npm run check:pack"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "@noble/ed25519": "2.1.0",
     "@noble/hashes": "1.6.1",
     "@noble/post-quantum": "0.6.1",
@@ -77,7 +79,10 @@
     "better-sqlite3": "^11.7.0"
   },
   "overrides": {
-    "hono": ">=4.12.25"
+    "hono": ">=4.12.34",
+    "@hono/node-server": ">=2.0.5",
+    "fast-uri": "^3.1.5",
+    "ip-address": ">=10.3.1"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.12",