@centient/secrets 0.9.0 → 0.11.0

package/dist/compatibility.d.ts

@@ -0,0 +1,199 @@
+/**
+ * The compatibility floor: what an OLD `@centient/secrets` silently does wrong,
+ * published as data so a consumer can grade itself (#214).
+ *
+ * ## Why this exists
+ *
+ * Five consumers pin this package at four disjoint minors (`^0.5.0` … `0.10.0`)
+ * with no negotiation surface between them and the provider. Several releases
+ * closed defects whose only symptom, at the old version, is **silence**: a
+ * denied credential operation that leaves no audit trace, a keychain write that
+ * reports success into a keychain this context's reader cannot see, a malformed
+ * key that stores on one backend and reads as absent on the next. A consumer
+ * running such a version has no way to learn that from the package — the
+ * behaviour looks fine and the logs look clean.
+ *
+ * So the provider publishes the list. {@link COMPATIBILITY_FLOOR} names each
+ * closed gap, the version that closed it, and the symptom it presented before
+ * then; {@link assessCompatibility} turns an installed version into a grade a
+ * `doctor` command can print.
+ *
+ * ## What this is NOT
+ *
+ * **Never a boot-time refusal.** Nothing here runs at import, nothing throws
+ * from a constructor, and no vault path consults it. A package that refuses to
+ * load because the caller is old converts a documentation problem into an
+ * outage. Every function in this module is pure, total, and advisory: malformed
+ * input comes back as a typed `"unknown"` grade carrying the reason (P2, No
+ * Silent Degradation; P10, Honest Uncertainty), never as a throw.
+ *
+ * ## What a consumer does with it
+ *
+ * ```ts
+ * import { assessCompatibility, SECRETS_PACKAGE_VERSION } from "@centient/secrets";
+ *
+ * const assessment = assessCompatibility(SECRETS_PACKAGE_VERSION);
+ * if (assessment.grade !== "ok") {
+ *   for (const gap of assessment.openGaps) {
+ *     report(`${gap.severity}: ${gap.symptom} (fixed in ${gap.closedIn}, ${gap.reference})`);
+ *   }
+ * }
+ * ```
+ *
+ * `SECRETS_PACKAGE_VERSION` is the version of the build the consumer actually
+ * imported, so the assessment describes the code in that tree — not whatever is
+ * latest on the registry. A consumer auditing a *manifest* range instead (`the
+ * pin says ^0.6.0 — what does that admit at worst?`) uses {@link assessPin}.
+ *
+ * Issue: centient-labs/centient-sdk#214 (findings C6-27, C6-29, C6-61).
+ */
+/**
+ * The version of THIS build of `@centient/secrets`.
+ *
+ * Kept in step with `package.json` two ways: `scripts/sync-claudemd-versions.mjs`
+ * rewrites it during `pnpm run version-packages` (the same step that syncs the
+ * CLAUDE.md package table), and `tests/compatibility.test.ts` fails the build if
+ * the two ever disagree. A stale constant here would misgrade every consumer, so
+ * drift is a test failure rather than a silent wrong answer.
+ */
+export declare const SECRETS_PACKAGE_VERSION = "0.11.0";
+/**
+ * The oldest version {@link COMPATIBILITY_FLOOR} can honestly describe.
+ *
+ * `0.5.0` is the oldest release any current consumer pins, and the oldest one
+ * whose behaviour the table's entries were written against. Below it the table
+ * is not wrong so much as **incomplete** — returning its short list for a 0.4.x
+ * install would understate what is open — so {@link assessCompatibility} grades
+ * such a version `"unsupported"` and says so, rather than quietly reporting the
+ * gaps it happens to know about.
+ *
+ * This is an epistemic limit on the table, not a support policy and not a gate:
+ * an `"unsupported"` grade still returns every gap the table does know about.
+ */
+export declare const MIN_ASSESSABLE_VERSION = "0.5.0";
+/** How badly the gap bites a consumer still running below `closedIn`. */
+export type GapSeverity = "high" | "medium" | "low";
+/**
+ * One known behavioural gap, keyed by the version that closed it.
+ *
+ * A gap is **open** for an installed version `v` exactly when
+ * `v < closedIn` — there is no upper bound, because a fix that shipped is not
+ * un-shipped. Everything here is value-free public metadata: no credential
+ * material, no host paths, nothing that changes at runtime.
+ */
+export interface CompatibilityGap {
+    /** Stable machine-readable id. Never renamed — consumers may suppress by id. */
+    readonly id: string;
+    /** The first release in which the gap is closed. A valid `major.minor.patch`. */
+    readonly closedIn: string;
+    /** How badly this bites a consumer still below `closedIn`. */
+    readonly severity: GapSeverity;
+    /** One line, consumer-facing: what the OLD version does wrong. */
+    readonly symptom: string;
+    /** Issue or PR that closed it, `owner/repo#n`. */
+    readonly reference: string;
+    /**
+     * What the consumer must change when it adopts the fix, when adopting is not
+     * a pure no-op. Absent means "bump and nothing else". This is the field that
+     * turns the table from a scorecard into a bump plan.
+     */
+    readonly adoptionNote?: string;
+    /** The C6 audit finding this gap corresponds to, where one exists. */
+    readonly finding?: string;
+}
+/**
+ * The published floor — deeply frozen at module initialization (every field on
+ * a {@link CompatibilityGap} is a primitive, so freezing each entry plus the
+ * array is a complete freeze). `assessCompatibility()` defaults to this same
+ * object, so a runtime mutation — a JS consumer, a test helper, a cast past
+ * the `readonly` type — would silently change every later assessment in the
+ * process. Frozen, the mutation throws at the mutation site instead
+ * (mb:f/7e54ba; the same no-silent-degradation stance as the rest of this
+ * module).
+ */
+export declare const COMPATIBILITY_FLOOR: readonly CompatibilityGap[];
+/** The grade a consumer's installed version earns against the floor. */
+export type CompatibilityGrade = 
+/** At or above every known fix. Nothing in the table is open. */
+"ok"
+/** Assessable, but one or more known gaps are open. `openGaps` lists them. */
+ | "degraded"
+/** Below {@link MIN_ASSESSABLE_VERSION}: the table cannot claim to be complete. */
+ | "unsupported"
+/** The version could not be parsed. `reason` says why. Never a throw. */
+ | "unknown";
+/**
+ * The result of grading one version against the floor. Every field is derived
+ * and value-free; the input is echoed back so a caller can see what was graded
+ * (P6, Single Source of Truth — echo interpreted parameters).
+ */
+export interface CompatibilityAssessment {
+    readonly grade: CompatibilityGrade;
+    /** The version as given, echoed verbatim — including unparseable input. */
+    readonly installedVersion: string;
+    /** The version of the build that produced this assessment. */
+    readonly currentVersion: string;
+    /** The floor below which the table is incomplete. */
+    readonly minAssessableVersion: string;
+    /**
+     * Gaps open at `installedVersion`, oldest fix first. Empty for `"ok"` and for
+     * `"unknown"` — and for `"unknown"` that emptiness means `not assessed`, which
+     * is why the grade, not the list length, is what a caller branches on.
+     */
+    readonly openGaps: readonly CompatibilityGap[];
+    /** The worst severity among `openGaps`, or `null` when there are none. */
+    readonly highestSeverity: GapSeverity | null;
+    /** One line suitable for a doctor's status column. */
+    readonly summary: string;
+    /** Why the grade is `"unknown"` or `"unsupported"`. Absent otherwise. */
+    readonly reason?: string;
+}
+/**
+ * Grade an installed version against the compatibility floor.
+ *
+ * Pure and total: it reads no environment, touches no keychain, and **never
+ * throws** — a version string it cannot parse comes back as
+ * `grade: "unknown"` naming the problem. Totality is enforced here rather than
+ * assumed of the parser: input is narrowed by this module's own guard, so a JS
+ * caller handing it `null`, `undefined`, a number or an object gets the same
+ * typed `"unknown"` result as a misspelt version, never an exception. Call it
+ * from a `doctor`, a startup log line, or a CI check; do not call it from a
+ * code path that would refuse to run on the answer.
+ *
+ * @param installedVersion - the version actually installed in the consumer's
+ *   tree. Import {@link SECRETS_PACKAGE_VERSION} for that; a leading `v` and
+ *   surrounding whitespace are tolerated.
+ * @param floor - the gap table to grade against. Defaults to
+ *   {@link COMPATIBILITY_FLOOR}; injectable so a test can grade a fixture table
+ *   without pinning itself to the shipped one.
+ */
+export declare function assessCompatibility(installedVersion: string, floor?: readonly CompatibilityGap[]): CompatibilityAssessment;
+/**
+ * The lowest version a dependency range admits, or `null` when the range form
+ * is one this helper does not understand.
+ *
+ * Deliberately narrow: it recognises the forms that actually appear in the
+ * consumers' manifests — `^x.y.z`, `~x.y.z`, `>=x.y.z` and a bare `x.y.z` — and
+ * returns `null` for everything else rather than guessing. A guess here would
+ * grade the wrong version and report a clean bill of health for a pin nobody
+ * checked.
+ *
+ * The accepted grammar is matched whole and enumerated on
+ * {@link SUPPORTED_RANGE}; nothing outside it is partially interpreted. Total:
+ * a non-string, an empty string, and every unsupported form all return `null`.
+ */
+export declare function lowestVersionInRange(range: string): string | null;
+/**
+ * Grade a manifest **pin** by its worst admissible version.
+ *
+ * `assessCompatibility` answers "what is open in the build I imported"; this
+ * answers "what could be open in any build this pin admits". A `^0.6.0` pin can
+ * resolve to any 0.6.x, so the version worth grading is its base — which is also
+ * the one a lockfile that has never been refreshed is most likely holding.
+ *
+ * Returns `grade: "unknown"` carrying the reason for a range form
+ * {@link lowestVersionInRange} does not recognise — including a non-string a JS
+ * caller slipped past the signature. Never throws.
+ */
+export declare function assessPin(pin: string, floor?: readonly CompatibilityGap[]): CompatibilityAssessment;
+//# sourceMappingURL=compatibility.d.ts.map

package/dist/compatibility.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compatibility.d.ts","sourceRoot":"","sources":["../src/compatibility.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAIH;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,WAAW,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB,UAAU,CAAC;AAE9C,yEAAyE;AACzE,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAQpD;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kDAAkD;IAClD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AA+ED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,gBAAgB,EAE1D,CAAC;AA4DF,wEAAwE;AACxE,MAAM,MAAM,kBAAkB;AAC5B,iEAAiE;AAC/D,IAAI;AACN,8EAA8E;GAC5E,UAAU;AACZ,mFAAmF;GACjF,aAAa;AACf,yEAAyE;GACvE,SAAS,CAAC;AAEd;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,2EAA2E;IAC3E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,8DAA8D;IAC9D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,qDAAqD;IACrD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC/C,0EAA0E;IAC1E,QAAQ,CAAC,eAAe,EAAE,WAAW,GAAG,IAAI,CAAC;IAC7C,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CACjC,gBAAgB,EAAE,MAAM,EACxB,KAAK,GAAE,SAAS,gBAAgB,EAAwB,GACvD,uBAAuB,CAwEzB;AA0FD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGjE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,MAAM,EACX,KAAK,GAAE,SAAS,gBAAgB,EAAwB,GACvD,uBAAuB,CAezB"}

package/dist/compatibility.js

@@ -0,0 +1,419 @@
+/**
+ * The compatibility floor: what an OLD `@centient/secrets` silently does wrong,
+ * published as data so a consumer can grade itself (#214).
+ *
+ * ## Why this exists
+ *
+ * Five consumers pin this package at four disjoint minors (`^0.5.0` … `0.10.0`)
+ * with no negotiation surface between them and the provider. Several releases
+ * closed defects whose only symptom, at the old version, is **silence**: a
+ * denied credential operation that leaves no audit trace, a keychain write that
+ * reports success into a keychain this context's reader cannot see, a malformed
+ * key that stores on one backend and reads as absent on the next. A consumer
+ * running such a version has no way to learn that from the package — the
+ * behaviour looks fine and the logs look clean.
+ *
+ * So the provider publishes the list. {@link COMPATIBILITY_FLOOR} names each
+ * closed gap, the version that closed it, and the symptom it presented before
+ * then; {@link assessCompatibility} turns an installed version into a grade a
+ * `doctor` command can print.
+ *
+ * ## What this is NOT
+ *
+ * **Never a boot-time refusal.** Nothing here runs at import, nothing throws
+ * from a constructor, and no vault path consults it. A package that refuses to
+ * load because the caller is old converts a documentation problem into an
+ * outage. Every function in this module is pure, total, and advisory: malformed
+ * input comes back as a typed `"unknown"` grade carrying the reason (P2, No
+ * Silent Degradation; P10, Honest Uncertainty), never as a throw.
+ *
+ * ## What a consumer does with it
+ *
+ * ```ts
+ * import { assessCompatibility, SECRETS_PACKAGE_VERSION } from "@centient/secrets";
+ *
+ * const assessment = assessCompatibility(SECRETS_PACKAGE_VERSION);
+ * if (assessment.grade !== "ok") {
+ *   for (const gap of assessment.openGaps) {
+ *     report(`${gap.severity}: ${gap.symptom} (fixed in ${gap.closedIn}, ${gap.reference})`);
+ *   }
+ * }
+ * ```
+ *
+ * `SECRETS_PACKAGE_VERSION` is the version of the build the consumer actually
+ * imported, so the assessment describes the code in that tree — not whatever is
+ * latest on the registry. A consumer auditing a *manifest* range instead (`the
+ * pin says ^0.6.0 — what does that admit at worst?`) uses {@link assessPin}.
+ *
+ * Issue: centient-labs/centient-sdk#214 (findings C6-27, C6-29, C6-61).
+ */
+import { compareSemver, formatSemver, tryParseSemver } from "@centient/cli-utils";
+/**
+ * The version of THIS build of `@centient/secrets`.
+ *
+ * Kept in step with `package.json` two ways: `scripts/sync-claudemd-versions.mjs`
+ * rewrites it during `pnpm run version-packages` (the same step that syncs the
+ * CLAUDE.md package table), and `tests/compatibility.test.ts` fails the build if
+ * the two ever disagree. A stale constant here would misgrade every consumer, so
+ * drift is a test failure rather than a silent wrong answer.
+ */
+export const SECRETS_PACKAGE_VERSION = "0.11.0";
+/**
+ * The oldest version {@link COMPATIBILITY_FLOOR} can honestly describe.
+ *
+ * `0.5.0` is the oldest release any current consumer pins, and the oldest one
+ * whose behaviour the table's entries were written against. Below it the table
+ * is not wrong so much as **incomplete** — returning its short list for a 0.4.x
+ * install would understate what is open — so {@link assessCompatibility} grades
+ * such a version `"unsupported"` and says so, rather than quietly reporting the
+ * gaps it happens to know about.
+ *
+ * This is an epistemic limit on the table, not a support policy and not a gate:
+ * an `"unsupported"` grade still returns every gap the table does know about.
+ */
+export const MIN_ASSESSABLE_VERSION = "0.5.0";
+const SEVERITY_RANK = {
+    low: 0,
+    medium: 1,
+    high: 2,
+};
+/**
+ * Every known behavioural gap this package has closed, oldest fix first.
+ *
+ * Ordering is part of the contract (ascending `closedIn`, then `id`) so that
+ * the list a consumer prints reads as an upgrade path rather than an unordered
+ * bag; `tests/compatibility.test.ts` pins both the ordering and that every
+ * `closedIn` parses as a semver.
+ *
+ * Entries are added when a release closes a defect whose pre-fix symptom is
+ * silent. A fix a consumer would notice on its own does not need a row here.
+ */
+const FLOOR_TABLE = [
+    {
+        id: "per-consumer-vault-key",
+        closedIn: "0.8.0",
+        severity: "high",
+        symptom: "Every consumer on the host encrypts its vault with the same `centient-vault`/`vault-key` master key: `KeychainProvider` hardcodes the item and `openVault()` resolves its provider internally, so a consumer cannot name or inject a key of its own.",
+        reference: "centient-labs/centient-sdk#80",
+        adoptionNote: "Additive: pass `openVault({ keyProvider })` or `{ keychain: { service, account } }`. Defaults are unchanged, so an existing vault keeps opening until the consumer opts in — the bump alone does not isolate the key.",
+        finding: "C6-28",
+    },
+    {
+        id: "denied-operation-audit",
+        closedIn: "0.9.0",
+        severity: "high",
+        symptom: "A policy-denied credential operation leaves no audit trace: the `before` hook throws and no `after` event fires, so denied reads, writes, deletes and enumerations are simply absent from the audit trail.",
+        reference: "centient-labs/centient-sdk#120",
+        adoptionNote: "`SecretsEventType` gains four `*_rejected` members. A consumer that exhaustively switches on the event type must handle them; one that only matches the prior types is unaffected.",
+        finding: "C6-29",
+    },
+    {
+        id: "libsecret-fallback-silence",
+        closedIn: "0.9.0",
+        severity: "medium",
+        symptom: "On Linux, the libsecret D-Bus enumeration falls back to `secret-tool search` — which briefly materializes secret values on stdout — inside a bare `catch {}`, so a security-relevant degradation happens with no signal at all.",
+        reference: "centient-labs/centient-sdk#121",
+        finding: "C6-29",
+    },
+    {
+        id: "credential-key-grammar",
+        closedIn: "0.10.0",
+        severity: "high",
+        symptom: "The documented credential-key grammar is enforced nowhere on the shared path, so a key like `Auth_Token` stores successfully on the macOS keychain and env backends and is unreadable on every other one — and the enforcing backends return `null`, which is indistinguishable from `no such credential`.",
+        reference: "centient-labs/centient-sdk#168",
+        adoptionNote: "Breaking behaviour change: `storeCredential`/`getCredential`/`deleteCredential`/`listCredentials` now throw `InvalidCredentialKeyError` for a non-conforming key instead of dispatching it. Audit operator-supplied keys before bumping. `listCredentials(prefix)` is validated against the looser prefix grammar, so `\"soma.anthropic.\"` still works.",
+    },
+    {
+        id: "sessionless-keychain-read",
+        closedIn: "0.10.0",
+        severity: "high",
+        symptom: "On macOS, keychain writes preauthorize no reader (`-T \"\"`) and reads walk the session search list, so a context with no security session — a launchd system-domain daemon, an SSH login — cannot read its own credentials, and a locked login-keychain copy shadows a readable System-keychain one. Every such failure collapses to `null`, reported as `nothing configured`.",
+        reference: "centient-labs/centient-sdk#188",
+        adoptionNote: "Consumers carrying a private fork of this fix should reconcile deliberately rather than bundling it into a routine bump: the two postures can differ. See centient-labs/centient-sdk#214 (C6-31).",
+        finding: "C6-31",
+    },
+    {
+        id: "sessionless-write-reachability",
+        closedIn: "0.10.0",
+        severity: "medium",
+        symptom: "A sessionless keychain write that falls back to the default keychain for want of privileges is reported as `true` by the boolean accessors, even though this context's reader cannot see it there — a write recorded as a success the reader will never experience.",
+        reference: "centient-labs/centient-sdk#188",
+        adoptionNote: "Behaviour change on an unchanged signature: from 0.10.0 the boolean means `landed where this context's reader looks`, so a sessionless fallback write now returns `false` where it used to return `true`. Code that branches on `storeCredential`'s boolean should be tested against the new meaning before bumping, or read the discriminated `writeKeychainCredential()` result, which carries the destination and a value-free promotion command.",
+        finding: "C6-61",
+    },
+];
+/**
+ * The published floor — deeply frozen at module initialization (every field on
+ * a {@link CompatibilityGap} is a primitive, so freezing each entry plus the
+ * array is a complete freeze). `assessCompatibility()` defaults to this same
+ * object, so a runtime mutation — a JS consumer, a test helper, a cast past
+ * the `readonly` type — would silently change every later assessment in the
+ * process. Frozen, the mutation throws at the mutation site instead
+ * (mb:f/7e54ba; the same no-silent-degradation stance as the rest of this
+ * module).
+ */
+export const COMPATIBILITY_FLOOR = Object.freeze(FLOOR_TABLE.map((gap) => Object.freeze({ ...gap })));
+/**
+ * The one place caller input is narrowed to a usable string.
+ *
+ * Every exported function here is documented as total, and a JS caller — or a
+ * `JSON.parse`d manifest, or an `any` at a module boundary — can hand any of
+ * them `null`, a number, or an object regardless of what the TypeScript
+ * signature says. Rather than trusting each downstream parser to guard for
+ * itself (`tryParseSemver` does today; that is an implementation detail of
+ * another package, not a contract this module may rest its never-throws
+ * promise on), both entry points funnel through this guard, so the two paths
+ * cannot drift apart the way they had (`[mb:f/f8ecdf]`).
+ *
+ * Returns the trimmed string, or `null` for a non-string and for a string that
+ * is empty or whitespace-only — inputs no grammar below could accept anyway.
+ */
+function asInputString(value) {
+    if (typeof value !== "string")
+        return null;
+    const trimmed = value.trim();
+    return trimmed === "" ? null : trimmed;
+}
+/** `null`/`array`/`number`/… — `typeof` with the two cases it gets wrong fixed. */
+function typeNameOf(value) {
+    if (value === null)
+        return "null";
+    if (Array.isArray(value))
+        return "array";
+    return typeof value;
+}
+/**
+ * Render any value as a string without ever throwing.
+ *
+ * `String(value)` is not total: an object with a null prototype, or one whose
+ * `toString`/`Symbol.toPrimitive` throws, throws from the conversion itself —
+ * which would turn *reporting* a bad input into exactly the exception this
+ * module promises never to raise.
+ */
+function stringifySafely(value) {
+    if (value === null)
+        return "null";
+    if (value === undefined)
+        return "undefined";
+    try {
+        return String(value);
+    }
+    catch {
+        return `[unstringifiable ${typeof value}]`;
+    }
+}
+/** The input as the `installedVersion` echo field, whose declared type is `string`. */
+function echoInput(value) {
+    return typeof value === "string" ? value : stringifySafely(value);
+}
+/** The input as it appears in a `reason`: quoted when a string, named when not. */
+function describeInput(value) {
+    if (typeof value === "string")
+        return `'${value}'`;
+    if (value === null || value === undefined)
+        return stringifySafely(value);
+    return `a ${typeNameOf(value)} (${stringifySafely(value)})`;
+}
+/**
+ * Grade an installed version against the compatibility floor.
+ *
+ * Pure and total: it reads no environment, touches no keychain, and **never
+ * throws** — a version string it cannot parse comes back as
+ * `grade: "unknown"` naming the problem. Totality is enforced here rather than
+ * assumed of the parser: input is narrowed by this module's own guard, so a JS
+ * caller handing it `null`, `undefined`, a number or an object gets the same
+ * typed `"unknown"` result as a misspelt version, never an exception. Call it
+ * from a `doctor`, a startup log line, or a CI check; do not call it from a
+ * code path that would refuse to run on the answer.
+ *
+ * @param installedVersion - the version actually installed in the consumer's
+ *   tree. Import {@link SECRETS_PACKAGE_VERSION} for that; a leading `v` and
+ *   surrounding whitespace are tolerated.
+ * @param floor - the gap table to grade against. Defaults to
+ *   {@link COMPATIBILITY_FLOOR}; injectable so a test can grade a fixture table
+ *   without pinning itself to the shipped one.
+ */
+export function assessCompatibility(installedVersion, floor = COMPATIBILITY_FLOOR) {
+    const base = {
+        // Echoed through the guard so the declared `string` type of this field is
+        // true at runtime too, for a caller that got here holding a non-string.
+        installedVersion: echoInput(installedVersion),
+        currentVersion: SECRETS_PACKAGE_VERSION,
+        minAssessableVersion: MIN_ASSESSABLE_VERSION,
+    };
+    const candidate = asInputString(installedVersion);
+    const installed = candidate === null ? null : tryParseSemver(candidate);
+    if (installed === null) {
+        const reason = `${describeInput(installedVersion)} is not a parseable semantic version`;
+        return {
+            ...base,
+            grade: "unknown",
+            openGaps: [],
+            highestSeverity: null,
+            reason,
+            summary: `@centient/secrets compatibility not assessed: ${reason}`,
+        };
+    }
+    // A gap with an unparseable `closedIn` cannot be positioned against the
+    // installed version. Reporting it as closed would understate the risk, so it
+    // is reported as OPEN: over-reporting is recoverable, silence is not.
+    const openGaps = floor.filter((gap) => {
+        const closedIn = tryParseSemver(gap.closedIn);
+        return closedIn === null || compareSemver(installed, closedIn) < 0;
+    });
+    const highestSeverity = openGaps.reduce((worst, gap) => worst === null || SEVERITY_RANK[gap.severity] > SEVERITY_RANK[worst] ? gap.severity : worst, null);
+    const minAssessable = tryParseSemver(MIN_ASSESSABLE_VERSION);
+    const belowFloor = minAssessable !== null && compareSemver(installed, minAssessable) < 0;
+    if (belowFloor) {
+        const reason = `${base.installedVersion} is below ${MIN_ASSESSABLE_VERSION}, the oldest version this table describes; ` +
+            `the ${openGaps.length} gap(s) listed are what is known, not necessarily all that is open`;
+        return {
+            ...base,
+            grade: "unsupported",
+            openGaps,
+            highestSeverity,
+            reason,
+            summary: `@centient/secrets ${base.installedVersion} is older than this table covers (below ${MIN_ASSESSABLE_VERSION}); upgrade to ${SECRETS_PACKAGE_VERSION}`,
+        };
+    }
+    if (openGaps.length === 0) {
+        return {
+            ...base,
+            grade: "ok",
+            openGaps,
+            highestSeverity: null,
+            summary: `@centient/secrets ${base.installedVersion} has no known open compatibility gaps`,
+        };
+    }
+    const worstFix = openGaps[openGaps.length - 1].closedIn;
+    return {
+        ...base,
+        grade: "degraded",
+        openGaps,
+        highestSeverity,
+        summary: `@centient/secrets ${base.installedVersion} has ${openGaps.length} known open gap(s) (highest severity: ${highestSeverity}); all are closed by ${worstFix}`,
+    };
+}
+/**
+ * The complete grammar {@link lowestVersionInRange} resolves, anchored.
+ *
+ * Anchored on purpose. The previous implementation asked only whether the
+ * string *started with* `^`, `~` or `>=` and then handed everything after the
+ * prefix to the parser, so a composite range like `>=0.6.0 <0.8.0` was rejected
+ * only as a side effect of its tail failing to parse. Any parser lenience —
+ * ignored build metadata, a tolerated trailing token — would silently reduce a
+ * two-sided range to its lower bound and grade a version the pin does not pin
+ * (`[mb:f/a6210f]`). Matching the WHOLE range means an unsupported form is
+ * rejected by the grammar, never by luck.
+ *
+ * Accepted, and nothing else:
+ *
+ * | Form | Example |
+ * |---|---|
+ * | caret | `^0.6.0` |
+ * | tilde | `~0.9.1` |
+ * | inclusive lower bound | `>=0.8.0` |
+ * | exact | `0.10.0` |
+ *
+ * The version component is a full `major.minor.patch`, optionally with a
+ * conventional leading `v` and a `-prerelease` suffix (kept, not rounded off —
+ * see below). Horizontal whitespace is allowed after the operator and around
+ * the whole range, and nowhere else.
+ *
+ * Rejected, each as `null`: composite ranges (`>=0.6.0 <0.8.0`), `||` unions,
+ * hyphen ranges (`1.0.0 - 2.0.0`), wildcards (`*`, `""`), x-ranges (`1.x`,
+ * `1.2.x`), partial versions (`1.2`), upper bounds and exclusive lower bounds
+ * (`<0.9.0`, `>0.9.0`), protocol pins (`workspace:*`, `npm:…`, `file:…`, a git
+ * URL), build metadata (`^1.2.3+build` — it is *discarded* by the parser rather
+ * than interpreted, which is exactly the ignored-suffix case), and anything
+ * carrying a trailing token of any kind.
+ */
+const SUPPORTED_RANGE = /^(\^|~|>=)?[ \t]*(v?\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/;
+/** One line naming the whole accepted grammar, for a `reason` a consumer reads. */
+const RANGE_GRAMMAR_HELP = "expected exactly '^x.y.z', '~x.y.z', '>=x.y.z' or 'x.y.z' " +
+    "(a leading 'v' and a '-prerelease' suffix are allowed; composite ranges, '||' unions, " +
+    "hyphen ranges, wildcards, x-ranges, protocol pins and build metadata are not)";
+/**
+ * The single strict resolver behind {@link lowestVersionInRange} and
+ * {@link assessPin} — the former discards the reason, the latter grades on it.
+ *
+ * Two independent checks, both of which must pass: {@link SUPPORTED_RANGE}
+ * validates the *shape* of the entire trimmed range, and `tryParseSemver`
+ * validates the *contents* of the captured version (per-identifier pre-release
+ * rules live there, and stay there). Neither is asked to stand in for the other.
+ */
+function resolveRange(range) {
+    const candidate = asInputString(range);
+    if (candidate === null) {
+        return {
+            ok: false,
+            reason: `${describeInput(range)} is not a range form this helper resolves (${RANGE_GRAMMAR_HELP})`,
+        };
+    }
+    const match = SUPPORTED_RANGE.exec(candidate);
+    if (match === null) {
+        return {
+            ok: false,
+            reason: `'${candidate}' is not a range form this helper resolves (${RANGE_GRAMMAR_HELP})`,
+        };
+    }
+    const parsed = tryParseSemver(match[2]);
+    if (parsed === null) {
+        return {
+            ok: false,
+            reason: `'${candidate}' has a version component that is not a parseable semantic version (${RANGE_GRAMMAR_HELP})`,
+        };
+    }
+    // Re-serialized rather than returned verbatim, so a leading `v` or stray
+    // whitespace is normalized away — but the pre-release suffix is KEPT.
+    // Dropping it would round `^1.0.0-rc.1` up to `1.0.0` and credit the consumer
+    // for a release it is not running.
+    return { ok: true, version: formatSemver(parsed) };
+}
+/**
+ * The lowest version a dependency range admits, or `null` when the range form
+ * is one this helper does not understand.
+ *
+ * Deliberately narrow: it recognises the forms that actually appear in the
+ * consumers' manifests — `^x.y.z`, `~x.y.z`, `>=x.y.z` and a bare `x.y.z` — and
+ * returns `null` for everything else rather than guessing. A guess here would
+ * grade the wrong version and report a clean bill of health for a pin nobody
+ * checked.
+ *
+ * The accepted grammar is matched whole and enumerated on
+ * {@link SUPPORTED_RANGE}; nothing outside it is partially interpreted. Total:
+ * a non-string, an empty string, and every unsupported form all return `null`.
+ */
+export function lowestVersionInRange(range) {
+    const resolved = resolveRange(range);
+    return resolved.ok ? resolved.version : null;
+}
+/**
+ * Grade a manifest **pin** by its worst admissible version.
+ *
+ * `assessCompatibility` answers "what is open in the build I imported"; this
+ * answers "what could be open in any build this pin admits". A `^0.6.0` pin can
+ * resolve to any 0.6.x, so the version worth grading is its base — which is also
+ * the one a lockfile that has never been refreshed is most likely holding.
+ *
+ * Returns `grade: "unknown"` carrying the reason for a range form
+ * {@link lowestVersionInRange} does not recognise — including a non-string a JS
+ * caller slipped past the signature. Never throws.
+ */
+export function assessPin(pin, floor = COMPATIBILITY_FLOOR) {
+    const resolved = resolveRange(pin);
+    if (!resolved.ok) {
+        return {
+            grade: "unknown",
+            installedVersion: echoInput(pin),
+            currentVersion: SECRETS_PACKAGE_VERSION,
+            minAssessableVersion: MIN_ASSESSABLE_VERSION,
+            openGaps: [],
+            highestSeverity: null,
+            reason: resolved.reason,
+            summary: `@centient/secrets compatibility not assessed: ${resolved.reason}`,
+        };
+    }
+    return assessCompatibility(resolved.version, floor);
+}
+//# sourceMappingURL=compatibility.js.map

package/dist/compatibility.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compatibility.js","sourceRoot":"","sources":["../src/compatibility.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAElF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,QAAQ,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAK9C,MAAM,aAAa,GAA0C;IAC3D,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;CACR,CAAC;AA+BF;;;;;;;;;;GAUG;AACH,MAAM,WAAW,GAAgC;IAC/C;QACE,EAAE,EAAE,wBAAwB;QAC5B,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,MAAM;QAChB,OAAO,EACL,sPAAsP;QACxP,SAAS,EAAE,+BAA+B;QAC1C,YAAY,EACV,uNAAuN;QACzN,OAAO,EAAE,OAAO;KACjB;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,MAAM;QAChB,OAAO,EACL,4MAA4M;QAC9M,SAAS,EAAE,gCAAgC;QAC3C,YAAY,EACV,oLAAoL;QACtL,OAAO,EAAE,OAAO;KACjB;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EACL,iOAAiO;QACnO,SAAS,EAAE,gCAAgC;QAC3C,OAAO,EAAE,OAAO;KACjB;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,MAAM;QAChB,OAAO,EACL,4SAA4S;QAC9S,SAAS,EAAE,gCAAgC;QAC3C,YAAY,EACV,0VAA0V;KAC7V;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,MAAM;QAChB,OAAO,EACL,iXAAiX;QACnX,SAAS,EAAE,gCAAgC;QAC3C,YAAY,EACV,mMAAmM;QACrM,OAAO,EAAE,OAAO;KACjB;IACD;QACE,EAAE,EAAE,gCAAgC;QACpC,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EACL,qQAAqQ;QACvQ,SAAS,EAAE,gCAAgC;QAC3C,YAAY,EACV,sbAAsb;QACxb,OAAO,EAAE,OAAO;KACjB;CACF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAgC,MAAM,CAAC,MAAM,CAC3E,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CACpD,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AACzC,CAAC;AAED,mFAAmF;AACnF,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACzC,OAAO,OAAO,KAAK,CAAC;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAC5C,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,oBAAoB,OAAO,KAAK,GAAG,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED,mFAAmF;AACnF,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,KAAK,GAAG,CAAC;IACnD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IACzE,OAAO,KAAK,UAAU,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC;AAC9D,CAAC;AAwCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,mBAAmB,CACjC,gBAAwB,EACxB,QAAqC,mBAAmB;IAExD,MAAM,IAAI,GAAG;QACX,0EAA0E;QAC1E,wEAAwE;QACxE,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,CAAC;QAC7C,cAAc,EAAE,uBAAuB;QACvC,oBAAoB,EAAE,sBAAsB;KACpC,CAAC;IAEX,MAAM,SAAS,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IACxE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,GAAG,aAAa,CAAC,gBAAgB,CAAC,sCAAsC,CAAC;QACxF,OAAO;YACL,GAAG,IAAI;YACP,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,EAAE;YACZ,eAAe,EAAE,IAAI;YACrB,MAAM;YACN,OAAO,EAAE,iDAAiD,MAAM,EAAE;SACnE,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,6EAA6E;IAC7E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACpC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9C,OAAO,QAAQ,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CACrC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACb,KAAK,KAAK,IAAI,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAC7F,IAAI,CACL,CAAC;IAEF,MAAM,aAAa,GAAG,cAAc,CAAC,sBAAsB,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,aAAa,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC;IAEzF,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,MAAM,GACV,GAAG,IAAI,CAAC,gBAAgB,aAAa,sBAAsB,6CAA6C;YACxG,OAAO,QAAQ,CAAC,MAAM,oEAAoE,CAAC;QAC7F,OAAO;YACL,GAAG,IAAI;YACP,KAAK,EAAE,aAAa;YACpB,QAAQ;YACR,eAAe;YACf,MAAM;YACN,OAAO,EAAE,qBAAqB,IAAI,CAAC,gBAAgB,2CAA2C,sBAAsB,iBAAiB,uBAAuB,EAAE;SAC/J,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,GAAG,IAAI;YACP,KAAK,EAAE,IAAI;YACX,QAAQ;YACR,eAAe,EAAE,IAAI;YACrB,OAAO,EAAE,qBAAqB,IAAI,CAAC,gBAAgB,uCAAuC;SAC3F,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,QAAQ,CAAC;IACzD,OAAO;QACL,GAAG,IAAI;QACP,KAAK,EAAE,UAAU;QACjB,QAAQ;QACR,eAAe;QACf,OAAO,EAAE,qBAAqB,IAAI,CAAC,gBAAgB,QAAQ,QAAQ,CAAC,MAAM,yCAAyC,eAAe,wBAAwB,QAAQ,EAAE;KACrK,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,eAAe,GAAG,yDAAyD,CAAC;AAElF,mFAAmF;AACnF,MAAM,kBAAkB,GACtB,4DAA4D;IAC5D,wFAAwF;IACxF,+EAA+E,CAAC;AAOlF;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,8CAA8C,kBAAkB,GAAG;SACnG,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,IAAI,SAAS,+CAA+C,kBAAkB,GAAG;SAC1F,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,IAAI,SAAS,uEAAuE,kBAAkB,GAAG;SAClH,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,sEAAsE;IACtE,8EAA8E;IAC9E,mCAAmC;IACnC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CACvB,GAAW,EACX,QAAqC,mBAAmB;IAExD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,KAAK,EAAE,SAAS;YAChB,gBAAgB,EAAE,SAAS,CAAC,GAAG,CAAC;YAChC,cAAc,EAAE,uBAAuB;YACvC,oBAAoB,EAAE,sBAAsB;YAC5C,QAAQ,EAAE,EAAE;YACZ,eAAe,EAAE,IAAI;YACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,iDAAiD,QAAQ,CAAC,MAAM,EAAE;SAC5E,CAAC;IACJ,CAAC;IACD,OAAO,mBAAmB,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACtD,CAAC"}