@coderifts/agent-guard 1.0.0 → 1.1.0

package/dist/cjs/detector.d.ts

@@ -7,6 +7,6 @@
  * mandatory fixture set; this detector passes all 68 (46 trigger, 22 no-trigger).
  */
 import type { TriggerDetector } from './types.js';
-export declare const DETECTOR_VERSION = "builtin/1.0.0";
+export declare const DETECTOR_VERSION = "builtin/1.1.0";
 export declare const builtinDetector: TriggerDetector;
 //# sourceMappingURL=detector.d.ts.map

package/dist/cjs/detector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"detector.d.ts","sourceRoot":"","sources":["../../src/detector.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,YAAY,CAAC;AAEhF,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AA8OhD,eAAO,MAAM,eAAe,EAAE,eA4C7B,CAAC"}
+{"version":3,"file":"detector.d.ts","sourceRoot":"","sources":["../../src/detector.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,YAAY,CAAC;AAIhF,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAkWhD,eAAO,MAAM,eAAe,EAAE,eA4D7B,CAAC"}

package/dist/cjs/detector.js

@@ -9,7 +9,10 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.builtinDetector = exports.DETECTOR_VERSION = void 0;
-exports.DETECTOR_VERSION = 'builtin/1.0.0';
+const node_zlib_1 = require("node:zlib");
+// builtin/1.1.0: additive deep-argument-scan (DG-1) — walks ALL argument values (any key, depth,
+// arrays) + bounded decode of encoded payloads, monotonic toward caution. Output shape unchanged.
+exports.DETECTOR_VERSION = 'builtin/1.1.0';
 // ── Path classification ────────────────────────────────────────────────────────
 const CONTRACT_PATH_RE = [
     /openapi/i, /swagger/i, /asyncapi/i,
@@ -25,7 +28,7 @@ const CONTRACT_PATH_RE = [
 ];
 // Paths whose content is NOT a production SSOT — contract-looking content there does not trigger.
 const NON_SSOT_PATH_RE = [
-    /(^|\/)tests?\//i, /(^|\/)__tests__\//i, /\/fixtures?\//i,
+    /(^|\/)tests?\//i, /(^|\/)__tests__\//i, /(^|\/)__mocks__\//i, /\/fixtures?\//i, /(^|\/)mocks?\//i,
     /\.test\.[jt]sx?$/i, /\.spec\.[jt]sx?$/i,
     /(^|\/)src\/internal\//i,
     /(^|\/)node_modules\//i,
@@ -71,7 +74,7 @@ const INERT_KEY_RE = [
     /^examples?\s*:/i, /^["']examples?["']\s*:/i,
     /^x-[\w-]+\s*:/i, /^["']x-[\w-]+["']\s*:/i,
 ];
-const READ_ONLY_TOOLS = new Set(['read', 'grep', 'glob', 'ls', 'cat', 'view', 'search', 'list']);
+const READ_ONLY_TOOLS = new Set(['read', 'grep', 'glob', 'ls', 'cat', 'view', 'search', 'list', 'get']);
 const FORMATTER_RE = /\b(prettier|eslint\s+--fix|gofmt|rustfmt|black|clang-format|dprint)\b/i;
 const GATE_KEYWORD_RE = /coderifts|agent-guard|contract-check|contract\b|preflight|spectral|\bbuf\b/i;
 function anyMatch(res, s) { return res.some((r) => r.test(s)); }
@@ -297,6 +300,161 @@ function commandMutatesContract(call) {
     const mutates = /(>|>>|\bmv\b|\bcp\b|\bln\s|git\s+mv|curl|wget|-o\b|base64\s+-d|xxd|\bjq\b|\bsed\b|\btee\b|echo|printf|\bcat\b)/i.test(cmd);
     return touchesContract && mutates;
 }
+// ── Deep argument scan (DG-1 hardening) — additive, bounded, monotonic toward caution ──────────
+// Caps (stated): recursion depth 8; total scanned bytes 262144 (256KB); per-value decode output
+// 65536 (64KB); decode chain levels 3 (base64→json→…); opacity min length 40 chars.
+const DEEP_MAX_DEPTH = 8;
+const DEEP_MAX_BYTES = 262144;
+const DEEP_DECODE_MAX_BYTES = 65536;
+const DEEP_DECODE_LEVELS = 3;
+const OPAQUE_MIN_LEN = 40;
+/** A short, single-line, filename-ish value we should test against the PATH regexes (never content). */
+function looksLikePath(v) {
+    return v.length > 0 && v.length <= 256 && !/[\n\r{}<>]/.test(v) && /(^|\/)[\w.@-]+\.[A-Za-z0-9]+$/.test(v.trim());
+}
+/** Bounded set of decodings of a value (base64, hex, url, gzip+base64, json-string-unescape). */
+function decodeCandidates(v) {
+    const out = [];
+    const push = (s) => { if (s && s.length > 0 && s.length <= DEEP_DECODE_MAX_BYTES)
+        out.push(s); };
+    const compact = v.replace(/\s+/g, '');
+    // base64 (charset excludes ':' so plaintext YAML/JSON contracts never match)
+    if (compact.length >= 16 && compact.length % 4 === 0 && /^[A-Za-z0-9+/]+={0,2}$/.test(compact)) {
+        try {
+            push(Buffer.from(compact, 'base64').toString('utf8'));
+        }
+        catch { /* ignore */ }
+        try {
+            const b = Buffer.from(compact, 'base64');
+            push((0, node_zlib_1.gunzipSync)(b).toString('utf8'));
+        }
+        catch { /* not gzip */ }
+    }
+    // hex
+    if (compact.length >= 16 && compact.length % 2 === 0 && /^[0-9a-fA-F]+$/.test(compact)) {
+        try {
+            push(Buffer.from(compact, 'hex').toString('utf8'));
+        }
+        catch { /* ignore */ }
+    }
+    // url-encoded
+    if (/%[0-9a-fA-F]{2}/.test(v)) {
+        try {
+            push(decodeURIComponent(v));
+        }
+        catch { /* ignore */ }
+    }
+    // JSON string literal / double-encoded (unescape one JSON level)
+    if (/\\["\\/]|^\s*"/.test(v)) {
+        try {
+            const p = JSON.parse(v);
+            if (typeof p === 'string')
+                push(p);
+        }
+        catch { /* ignore */ }
+    }
+    return out;
+}
+/** True iff a value looks encoded (long base64/hex) — used to decide opacity when unclassifiable. */
+function looksEncoded(v) {
+    const c = v.replace(/\s+/g, '');
+    if (c.length < OPAQUE_MIN_LEN)
+        return false;
+    return (/^[A-Za-z0-9+/]+={0,2}$/.test(c) && c.length % 4 === 0) || (/^[0-9a-fA-F]+$/.test(c) && c.length % 2 === 0);
+}
+/** Recursively scan every string value in `arguments` (any key, depth, array) + bounded decode. */
+function deepArgScan(call) {
+    const acc = { contractContent: false, pathContractSsot: false, pathNonSsot: false, pathLikeCount: 0, proseCount: 0, opaque: false, capHit: false };
+    let budget = DEEP_MAX_BYTES;
+    const scanString = (s) => {
+        // path-like values -> classify against path regexes (never run path regexes on content).
+        if (looksLikePath(s)) {
+            acc.pathLikeCount++;
+            if (anyMatch(NON_SSOT_PATH_RE, s))
+                acc.pathNonSsot = true;
+            else if (anyMatch(PROSE_PATH_RE, s))
+                acc.proseCount++;
+            else if (isContractPath(s))
+                acc.pathContractSsot = true;
+            return;
+        }
+        // content: existing contract regexes on the raw value.
+        if (anyMatch(CONTRACT_CONTENT_RE, s) || anyMatch(CONTRACT_STRUCTURE_RE, s)) {
+            acc.contractContent = true;
+            return;
+        }
+        // bounded decode chain (base64/hex/url/gzip/json), re-scanning each level.
+        let level = [s];
+        for (let d = 0; d < DEEP_DECODE_LEVELS && !acc.contractContent; d++) {
+            const next = [];
+            for (const val of level) {
+                for (const dec of decodeCandidates(val)) {
+                    if (anyMatch(CONTRACT_CONTENT_RE, dec) || anyMatch(CONTRACT_STRUCTURE_RE, dec)) {
+                        acc.contractContent = true;
+                        break;
+                    }
+                    next.push(dec);
+                }
+                if (acc.contractContent)
+                    break;
+            }
+            level = next;
+        }
+        // opacity: looked encoded but nothing classifiable came out -> unscannable -> caution.
+        if (!acc.contractContent && looksEncoded(s) && level.every((x) => !isReadableText(x)))
+            acc.opaque = true;
+    };
+    const walk = (node, depth) => {
+        if (acc.capHit || budget <= 0)
+            return;
+        if (depth > DEEP_MAX_DEPTH) {
+            acc.capHit = true;
+            return;
+        }
+        if (typeof node === 'string') {
+            budget -= node.length;
+            if (budget <= 0) {
+                acc.capHit = true;
+                return;
+            }
+            scanString(node);
+        }
+        else if (Array.isArray(node)) {
+            for (const el of node) {
+                if (acc.capHit)
+                    break;
+                walk(el, depth + 1);
+            }
+        }
+        else if (node && typeof node === 'object') {
+            for (const val of Object.values(node)) {
+                if (acc.capHit)
+                    break;
+                walk(val, depth + 1);
+            }
+        }
+    };
+    try {
+        walk(call.arguments, 0);
+    }
+    catch {
+        acc.capHit = true;
+    } // scan error -> fail-safe
+    return acc;
+}
+/** A decoded blob that is mostly printable text (so a failed-to-classify decode isn't "opaque"). */
+function isReadableText(s) {
+    if (!s)
+        return false;
+    let printable = 0;
+    const n = Math.min(s.length, 512);
+    for (let i = 0; i < n; i++) {
+        const c = s.charCodeAt(i);
+        if (c === 9 || c === 10 || c === 13 || (c >= 32 && c < 127))
+            printable++;
+    }
+    return printable / n > 0.85;
+}
 exports.builtinDetector = {
     version: exports.DETECTOR_VERSION,
     detect(call) {
@@ -341,6 +499,21 @@ exports.builtinDetector = {
             signals.push('ambiguous_contract_surface');
             return { trigger: true, artifacts, signals, confident: false };
         }
+        // ── DG-1: deep argument scan (runs AFTER the read-only short-circuit + whitelist surface path;
+        // additive, monotonic toward caution — only flips false->true / lowers confident). ──
+        const deep = deepArgScan(call);
+        if (deep.contractContent || deep.pathContractSsot) {
+            // Apply the SAME suppressors to the newly-seen input: non-SSOT / prose destination, inert-only.
+            const deepInProse = deep.pathLikeCount > 0 && deep.proseCount === deep.pathLikeCount && !deep.pathContractSsot;
+            if (!deep.pathNonSsot && !deepInProse && !isInertOnly(call)) {
+                signals.push(deep.contractContent ? 'arguments_deep_contract' : 'arguments_deep_path');
+                return { trigger: true, artifacts, signals, confident: false };
+            }
+        }
+        if (deep.opaque || deep.capHit) {
+            signals.push(deep.capHit ? 'arguments_scan_capped' : 'arguments_opaque');
+            return { trigger: true, artifacts, signals, confident: false };
+        }
         if (intentMentionsContract(call.intent)) {
             signals.push('intent_contract_reference');
             return { trigger: true, artifacts, signals, confident: false };

package/dist/cjs/detector.js.map

@@ -1 +1 @@
-{"version":3,"file":"detector.js","sourceRoot":"","sources":["../../src/detector.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAIU,QAAA,gBAAgB,GAAG,eAAe,CAAC;AAEhD,kFAAkF;AAClF,MAAM,gBAAgB,GAAG;IACvB,UAAU,EAAE,UAAU,EAAE,WAAW;IACnC,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa;IACpD,iCAAiC,EAAE,uBAAuB;IAC1D,kBAAkB,EAAE,sBAAsB,EAAE,kBAAkB;IAC9D,oBAAoB,EAAE,qBAAqB;IAC3C,8BAA8B,EAAE,kBAAkB;IAClD,mBAAmB,EAAE,qBAAqB,EAAE,qBAAqB;IACjE,0BAA0B,EAAE,oBAAoB;IAChD,4BAA4B,EAAE,8BAA8B,EAAE,qBAAqB,EAAE,cAAc;IACnG,4BAA4B,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB;CAC/E,CAAC;AACF,kGAAkG;AAClG,MAAM,gBAAgB,GAAG;IACvB,iBAAiB,EAAE,oBAAoB,EAAE,gBAAgB;IACzD,mBAAmB,EAAE,mBAAmB;IACxC,wBAAwB;IACxB,uBAAuB;CACxB,CAAC;AACF,2EAA2E;AAC3E,MAAM,aAAa,GAAG,CAAC,wBAAwB,EAAE,2BAA2B,EAAE,yBAAyB,EAAE,QAAQ,CAAC,CAAC;AACnH,qFAAqF;AACrF,MAAM,qBAAqB,GAAG,CAAC,uBAAuB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAAC;AAC5L,MAAM,YAAY,GAAG,CAAC,8BAA8B,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;AACvH,MAAM,WAAW,GAAG,+EAA+E,CAAC;AAEpG,kFAAkF;AAClF,MAAM,mBAAmB,GAAG;IAC1B,4BAA4B,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,sBAAsB;IACjG,oBAAoB,EAAE,uBAAuB;IAC7C,qBAAqB,EAAE,oBAAoB;IAC3C,0BAA0B,EAAE,8BAA8B;IAC1D,2CAA2C;IAC3C,yBAAyB,EAAE,0BAA0B;IACrD,uBAAuB,EAAoC,2BAA2B;IACtF,iBAAiB;CAClB,CAAC;AACF,MAAM,qBAAqB,GAAG;IAC5B,wCAAwC;IACxC,iCAAiC;IACjC,uBAAuB;IACvB,2CAA2C;CAC5C,CAAC;AACF,mEAAmE;AACnE,MAAM,cAAc,GAAG;IACrB,oBAAoB,EAAE,4BAA4B;IAClD,mBAAmB,EAAE,eAAe,EAAE,UAAU;IAChD,0CAA0C,EAAE,+BAA+B;IAC3E,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,aAAa,EAAE,eAAe;IACrH,yDAAyD;IACzD,wCAAwC,EAAE,uCAAuC;IACjF,UAAU;IACV,sDAAsD,EAAE,eAAe,EAAE,wBAAwB;CAClG,CAAC;AACF,iEAAiE;AACjE,MAAM,YAAY,GAAG;IACnB,mBAAmB,EAAE,2BAA2B;IAChD,eAAe,EAAE,aAAa,EAAE,eAAe,EAAE,YAAY;IAC7D,iBAAiB,EAAE,yBAAyB;IAC5C,gBAAgB,EAAE,wBAAwB;CAC3C,CAAC;AAEF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AACjG,MAAM,YAAY,GAAG,wEAAwE,CAAC;AAC9F,MAAM,eAAe,GAAG,6EAA6E,CAAC;AAEtG,SAAS,QAAQ,CAAC,GAAa,EAAE,CAAS,IAAa,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE3F,SAAS,SAAS,CAAC,IAAa;IAC9B,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,EAAE,CAAC;IAC5B,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AAC3D,CAAC;AAED,SAAS,UAAU,CAAC,IAAwB;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAgD,CAAC;IAChE,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;YACxF,MAAM,CAAC,GAAI,CAA6B,CAAC,CAAC,CAAC,CAAC;YAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,KAAK,GAAI,CAA6B,CAAC,KAAK,CAAC;QACnD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,WAAW,CAAC,IAAwB;IAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,SAAgD,CAAC;IAChE,MAAM,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAA6B,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,QAAQ,CAAC,IAAwB;IACxC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,SAAgD,CAAC;IAChE,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAA6B,CAAC,IAAI,KAAK,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAE,CAA6B,CAAC,IAAc,CAAC,CAAC;IACnJ,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,CAAS;IAC/B,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;AACvC,CAAC;AAED;8EAC8E;AAC9E,SAAS,YAAY,CAAC,IAAwB;IAC5C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5G,CAAC;IACD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,CAAC,GAAG,IAAI,CAAC,SAAgD,CAAC;IAChE,MAAM,WAAW,GAAG,CAAC,IAAa,EAAE,IAAa,EAAE,EAAE;QACnD,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAClD,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7D,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,WAAW,CAAE,CAA6B,CAAC,UAAU,EAAG,CAA6B,CAAC,UAAU,CAAC,CAAC;QAClG,MAAM,QAAQ,GAAI,CAA6B,CAAC,QAAQ,IAAK,CAA6B,CAAC,OAAO,CAAC;QACnG,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,kCAAkC;QACvH,MAAM,KAAK,GAAI,CAA6B,CAAC,KAAK,CAAC;QACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnI,MAAM,KAAK,GAAI,CAA6B,CAAC,KAAK,CAAC;QACnD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,WAAW,CAAE,CAA6B,CAAC,UAAU,EAAG,CAA6B,CAAC,UAAU,CAAC,CAAC;IACrL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,OAAO,8GAA8G,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnI,CAAC;AACD,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3G,CAAC;AAED,yEAAyE;AACzE,SAAS,YAAY,CAAC,IAAwB;IAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,wEAAwE;IACxE,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,QAAQ,GAAG,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,qDAAqD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpH,OAAO,YAAY,IAAI,QAAQ,CAAC;AAClC,CAAC;AAED,sEAAsE;AACtE,SAAS,sBAAsB,CAAC,IAAwB;IACtD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,WAAW,GAAG,iGAAiG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjI,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,WAAW,CAAC,IAAwB;IAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE7B,2EAA2E;IAC3E,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5E,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAClF,CAAC;IACD,uBAAuB;IACvB,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnG,mHAAmH;IACnH,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAChF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,wDAAwD;IACxD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,0DAA0D;IAC1D,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1F,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,OAAO,GAAG,KAAK,CAAC;IAAC,IAAI,QAAQ,GAAG,KAAK,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAC5C,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC,CAAS,UAAU;QACxF,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC,CAA4B,WAAW;QACzF,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC,CAAC,iEAAiE;QAChJ,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAClE,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC,CAAiB,mCAAmC;QACjH,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QACxI,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC,CAAa,4CAA4C;QAC1H,uBAAuB;IACzB,CAAC;IACD,OAAO,QAAQ,IAAI,CAAC,OAAO,CAAC;AAC9B,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAwB;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,oBAAoB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,sBAAsB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACrB,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;YAAE,SAAS;QACxC,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,gFAAgF,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;IACxK,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAe;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,gMAAgM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACvN,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAwB;IACtD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;WACtD,mKAAmK,CAAC,IAAI,CAAC,GAAG,CAAC;WAC7K,QAAQ,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,iHAAiH,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5I,OAAO,eAAe,IAAI,OAAO,CAAC;AACpC,CAAC;AAEY,QAAA,eAAe,GAAoB;IAC9C,OAAO,EAAE,wBAAgB;IACzB,MAAM,CAAC,IAAwB;QAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAe,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAElF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAEhH,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9F,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5F,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChD,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;QACjH,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC;QACnF,MAAM,aAAa,GAAG,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QAC7H,MAAM,aAAa,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,YAAY,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAElD,MAAM,eAAe,GAAG,YAAY,IAAI,aAAa,IAAI,aAAa,IAAI,gBAAgB,IAAI,IAAI,IAAI,YAAY,CAAC;QAEnH,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,aAAa,EAAE,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;gBAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAAC,CAAC;YAC7H,IAAI,IAAI,EAAE,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;gBAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAAC,CAAC;YACpH,IAAI,YAAY,EAAE,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;gBAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAAC,CAAC;YAChI,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;gBAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAAC,CAAC;YACjI,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,aAAa,IAAI,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC,EAAE,CAAC;gBACxF,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACjG,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACjE,CAAC;QAED,IAAI,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACjE,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACrE,CAAC;CACF,CAAC"}
+{"version":3,"file":"detector.js","sourceRoot":"","sources":["../../src/detector.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAEH,yCAAuC;AAGvC,iGAAiG;AACjG,kGAAkG;AACrF,QAAA,gBAAgB,GAAG,eAAe,CAAC;AAEhD,kFAAkF;AAClF,MAAM,gBAAgB,GAAG;IACvB,UAAU,EAAE,UAAU,EAAE,WAAW;IACnC,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa;IACpD,iCAAiC,EAAE,uBAAuB;IAC1D,kBAAkB,EAAE,sBAAsB,EAAE,kBAAkB;IAC9D,oBAAoB,EAAE,qBAAqB;IAC3C,8BAA8B,EAAE,kBAAkB;IAClD,mBAAmB,EAAE,qBAAqB,EAAE,qBAAqB;IACjE,0BAA0B,EAAE,oBAAoB;IAChD,4BAA4B,EAAE,8BAA8B,EAAE,qBAAqB,EAAE,cAAc;IACnG,4BAA4B,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB;CAC/E,CAAC;AACF,kGAAkG;AAClG,MAAM,gBAAgB,GAAG;IACvB,iBAAiB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,iBAAiB;IAClG,mBAAmB,EAAE,mBAAmB;IACxC,wBAAwB;IACxB,uBAAuB;CACxB,CAAC;AACF,2EAA2E;AAC3E,MAAM,aAAa,GAAG,CAAC,wBAAwB,EAAE,2BAA2B,EAAE,yBAAyB,EAAE,QAAQ,CAAC,CAAC;AACnH,qFAAqF;AACrF,MAAM,qBAAqB,GAAG,CAAC,uBAAuB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAAC;AAC5L,MAAM,YAAY,GAAG,CAAC,8BAA8B,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;AACvH,MAAM,WAAW,GAAG,+EAA+E,CAAC;AAEpG,kFAAkF;AAClF,MAAM,mBAAmB,GAAG;IAC1B,4BAA4B,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,sBAAsB;IACjG,oBAAoB,EAAE,uBAAuB;IAC7C,qBAAqB,EAAE,oBAAoB;IAC3C,0BAA0B,EAAE,8BAA8B;IAC1D,2CAA2C;IAC3C,yBAAyB,EAAE,0BAA0B;IACrD,uBAAuB,EAAoC,2BAA2B;IACtF,iBAAiB;CAClB,CAAC;AACF,MAAM,qBAAqB,GAAG;IAC5B,wCAAwC;IACxC,iCAAiC;IACjC,uBAAuB;IACvB,2CAA2C;CAC5C,CAAC;AACF,mEAAmE;AACnE,MAAM,cAAc,GAAG;IACrB,oBAAoB,EAAE,4BAA4B;IAClD,mBAAmB,EAAE,eAAe,EAAE,UAAU;IAChD,0CAA0C,EAAE,+BAA+B;IAC3E,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,aAAa,EAAE,eAAe;IACrH,yDAAyD;IACzD,wCAAwC,EAAE,uCAAuC;IACjF,UAAU;IACV,sDAAsD,EAAE,eAAe,EAAE,wBAAwB;CAClG,CAAC;AACF,iEAAiE;AACjE,MAAM,YAAY,GAAG;IACnB,mBAAmB,EAAE,2BAA2B;IAChD,eAAe,EAAE,aAAa,EAAE,eAAe,EAAE,YAAY;IAC7D,iBAAiB,EAAE,yBAAyB;IAC5C,gBAAgB,EAAE,wBAAwB;CAC3C,CAAC;AAEF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AACxG,MAAM,YAAY,GAAG,wEAAwE,CAAC;AAC9F,MAAM,eAAe,GAAG,6EAA6E,CAAC;AAEtG,SAAS,QAAQ,CAAC,GAAa,EAAE,CAAS,IAAa,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE3F,SAAS,SAAS,CAAC,IAAa;IAC9B,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,EAAE,CAAC;IAC5B,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AAC3D,CAAC;AAED,SAAS,UAAU,CAAC,IAAwB;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAgD,CAAC;IAChE,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;YACxF,MAAM,CAAC,GAAI,CAA6B,CAAC,CAAC,CAAC,CAAC;YAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,KAAK,GAAI,CAA6B,CAAC,KAAK,CAAC;QACnD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,WAAW,CAAC,IAAwB;IAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,SAAgD,CAAC;IAChE,MAAM,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAA6B,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,QAAQ,CAAC,IAAwB;IACxC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,SAAgD,CAAC;IAChE,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAA6B,CAAC,IAAI,KAAK,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAE,CAA6B,CAAC,IAAc,CAAC,CAAC;IACnJ,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,CAAS;IAC/B,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;AACvC,CAAC;AAED;8EAC8E;AAC9E,SAAS,YAAY,CAAC,IAAwB;IAC5C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5G,CAAC;IACD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,CAAC,GAAG,IAAI,CAAC,SAAgD,CAAC;IAChE,MAAM,WAAW,GAAG,CAAC,IAAa,EAAE,IAAa,EAAE,EAAE;QACnD,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAClD,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7D,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,WAAW,CAAE,CAA6B,CAAC,UAAU,EAAG,CAA6B,CAAC,UAAU,CAAC,CAAC;QAClG,MAAM,QAAQ,GAAI,CAA6B,CAAC,QAAQ,IAAK,CAA6B,CAAC,OAAO,CAAC;QACnG,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,kCAAkC;QACvH,MAAM,KAAK,GAAI,CAA6B,CAAC,KAAK,CAAC;QACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnI,MAAM,KAAK,GAAI,CAA6B,CAAC,KAAK,CAAC;QACnD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,WAAW,CAAE,CAA6B,CAAC,UAAU,EAAG,CAA6B,CAAC,UAAU,CAAC,CAAC;IACrL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,OAAO,8GAA8G,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnI,CAAC;AACD,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3G,CAAC;AAED,yEAAyE;AACzE,SAAS,YAAY,CAAC,IAAwB;IAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,wEAAwE;IACxE,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,QAAQ,GAAG,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,qDAAqD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpH,OAAO,YAAY,IAAI,QAAQ,CAAC;AAClC,CAAC;AAED,sEAAsE;AACtE,SAAS,sBAAsB,CAAC,IAAwB;IACtD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,WAAW,GAAG,iGAAiG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjI,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,WAAW,CAAC,IAAwB;IAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE7B,2EAA2E;IAC3E,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5E,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAClF,CAAC;IACD,uBAAuB;IACvB,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnG,mHAAmH;IACnH,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAChF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,wDAAwD;IACxD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,0DAA0D;IAC1D,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1F,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,OAAO,GAAG,KAAK,CAAC;IAAC,IAAI,QAAQ,GAAG,KAAK,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAC5C,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC,CAAS,UAAU;QACxF,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC,CAA4B,WAAW;QACzF,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC,CAAC,iEAAiE;QAChJ,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAClE,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC,CAAiB,mCAAmC;QACjH,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QACxI,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC,CAAa,4CAA4C;QAC1H,uBAAuB;IACzB,CAAC;IACD,OAAO,QAAQ,IAAI,CAAC,OAAO,CAAC;AAC9B,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAwB;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,oBAAoB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,sBAAsB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACrB,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;YAAE,SAAS;QACxC,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,gFAAgF,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;IACxK,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAe;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,gMAAgM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACvN,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAwB;IACtD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;WACtD,mKAAmK,CAAC,IAAI,CAAC,GAAG,CAAC;WAC7K,QAAQ,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,iHAAiH,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5I,OAAO,eAAe,IAAI,OAAO,CAAC;AACpC,CAAC;AAED,kGAAkG;AAClG,gGAAgG;AAChG,oFAAoF;AACpF,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,qBAAqB,GAAG,KAAK,CAAC;AACpC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,MAAM,cAAc,GAAG,EAAE,CAAC;AAY1B,wGAAwG;AACxG,SAAS,aAAa,CAAC,CAAS;IAC9B,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACpH,CAAC;AAED,iGAAiG;AACjG,SAAS,gBAAgB,CAAC,CAAS;IACjC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,CAAgB,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,qBAAqB;QAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChH,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtC,6EAA6E;IAC7E,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/F,IAAI,CAAC;YAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACrF,IAAI,CAAC;YAAC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAAC,IAAI,CAAC,IAAA,sBAAU,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;IAClH,CAAC;IACD,MAAM;IACN,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvF,IAAI,CAAC;YAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACpF,CAAC;IACD,cAAc;IACd,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC;YAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAC7D,CAAC;IACD,iEAAiE;IACjE,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YAAC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qGAAqG;AACrG,SAAS,YAAY,CAAC,CAAS;IAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,MAAM,GAAG,cAAc;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AACtH,CAAC;AAED,mGAAmG;AACnG,SAAS,WAAW,CAAC,IAAwB;IAC3C,MAAM,GAAG,GAAa,EAAE,eAAe,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC7J,IAAI,MAAM,GAAG,cAAc,CAAC;IAE5B,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE;QAC/B,yFAAyF;QACzF,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,aAAa,EAAE,CAAC;YACpB,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC;gBAAE,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC;iBACrD,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;gBAAE,GAAG,CAAC,UAAU,EAAE,CAAC;iBACjD,IAAI,cAAc,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,gBAAgB,GAAG,IAAI,CAAC;YACxD,OAAO;QACT,CAAC;QACD,uDAAuD;QACvD,IAAI,QAAQ,CAAC,mBAAmB,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,eAAe,GAAG,IAAI,CAAC;YAAC,OAAO;QAAC,CAAC;QACnH,2EAA2E;QAC3E,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,kBAAkB,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;YACpE,MAAM,IAAI,GAAa,EAAE,CAAC;YAC1B,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;gBACxB,KAAK,MAAM,GAAG,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxC,IAAI,QAAQ,CAAC,mBAAmB,EAAE,GAAG,CAAC,IAAI,QAAQ,CAAC,qBAAqB,EAAE,GAAG,CAAC,EAAE,CAAC;wBAAC,GAAG,CAAC,eAAe,GAAG,IAAI,CAAC;wBAAC,MAAM;oBAAC,CAAC;oBACtH,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACjB,CAAC;gBACD,IAAI,GAAG,CAAC,eAAe;oBAAE,MAAM;YACjC,CAAC;YACD,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,uFAAuF;QACvF,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,YAAY,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC;IAC3G,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,KAAa,EAAE,EAAE;QAC5C,IAAI,GAAG,CAAC,MAAM,IAAI,MAAM,IAAI,CAAC;YAAE,OAAO;QACtC,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;YAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC;YAAC,OAAO;QAAC,CAAC;QAC1D,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;YACtB,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;gBAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC/C,UAAU,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;gBAAC,IAAI,GAAG,CAAC,MAAM;oBAAE,MAAM;gBAAC,IAAI,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAAC,CAAC;QACxE,CAAC;aAAM,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,IAA+B,CAAC,EAAE,CAAC;gBAAC,IAAI,GAAG,CAAC,MAAM;oBAAE,MAAM;gBAAC,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAAC,CAAC;QACpH,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC;QAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC;IAAC,CAAC,CAAC,0BAA0B;IACxF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oGAAoG;AACpG,SAAS,cAAc,CAAC,CAAS;IAC/B,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC;YAAE,SAAS,EAAE,CAAC;IAAC,CAAC;IACpI,OAAO,SAAS,GAAG,CAAC,GAAG,IAAI,CAAC;AAC9B,CAAC;AAEY,QAAA,eAAe,GAAoB;IAC9C,OAAO,EAAE,wBAAgB;IACzB,MAAM,CAAC,IAAwB;QAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAe,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAElF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAEhH,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9F,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5F,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChD,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;QACjH,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC;QACnF,MAAM,aAAa,GAAG,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QAC7H,MAAM,aAAa,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,YAAY,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAElD,MAAM,eAAe,GAAG,YAAY,IAAI,aAAa,IAAI,aAAa,IAAI,gBAAgB,IAAI,IAAI,IAAI,YAAY,CAAC;QAEnH,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,aAAa,EAAE,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;gBAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAAC,CAAC;YAC7H,IAAI,IAAI,EAAE,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;gBAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAAC,CAAC;YACpH,IAAI,YAAY,EAAE,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;gBAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAAC,CAAC;YAChI,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;gBAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAAC,CAAC;YACjI,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,aAAa,IAAI,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC,EAAE,CAAC;gBACxF,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACjG,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACjE,CAAC;QAED,gGAAgG;QAChG,sFAAsF;QACtF,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAClD,gGAAgG;YAChG,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;YAC/G,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;gBACvF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YACjE,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;YACzE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACjE,CAAC;QAED,IAAI,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACjE,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACrE,CAAC;CACF,CAAC"}

package/dist/cjs/enforcement-gate.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Client-side authorization gate (P0-b/c) — mirrors the server §106 (binding), §111 (fail-closed on
+ * degraded) and §115 (safe_for_agent) in the guard, so the client never executes off a raw
+ * execution_action an attacker/proxy can flip. All checks are LOCAL and fail-closed.
+ *
+ * Composes with the P0-a receipt binding (receipt-binding.ts). This module reconciles the DECISION
+ * itself; receipt-binding authenticates the envelope the decision rides on.
+ */
+import type { IntegrityCause, Artifact } from './types.js';
+type Action = 'CONTINUE' | 'CONTINUE_WITH_MONITORING' | 'REQUEST_APPROVAL' | 'STOP';
+/** Local artifact_digest — byte-identical to the server change-set.js algorithm (sorted by type,id). */
+export declare function computeArtifactDigest(artifacts: Artifact[]): string;
+/** Local bundle input_fingerprint — byte-identical to the server change-set.js algorithm. */
+export declare function computeBundleFingerprint(artifacts: Artifact[]): string;
+export type GateResult = {
+    verdict: 'allow';
+    kind: 'ALLOW' | 'MONITOR';
+} | {
+    verdict: 'block-strict';
+    decision: 'BLOCK' | 'REQUIRE_APPROVAL';
+} | {
+    verdict: 'fail-closed';
+    cause: IntegrityCause;
+    detail?: string;
+};
+/**
+ * Reconcile an envelope's decision fail-closed. Order:
+ *  1. decision present + valid enum                          (CE-EP-04)   → DECISION_INCONSISTENT
+ *  2. effective decision = STRICTEST(envelope.decision, action-implied, top-level decision/action)
+ *     (CE-EP-01, CE-CC-01)  — BLOCK/REQUIRE_APPROVAL → clean block (positive control CE-EP-02 kept)
+ *  3. safe_for_agent === false on an allow-class decision    (CE-EP-03/§115) → DECISION_INCONSISTENT
+ *  4. degraded / analysis_complete=false / coverage_gap      (CE-CC-02/§111) → ANALYSIS_DEGRADED
+ *  5. artifact_digest / input_fingerprint local compare      (CE-AF-03/#6)   → ARTIFACT_MISMATCH
+ *
+ * @param response   the raw preflight response (for the top-level decision/action, CE-CC-01)
+ * @param envelope   the decision_result envelope
+ * @param executionAction  rd.executionAction from readDecision
+ * @param sentArtifacts    the artifacts the guard sent to preflight (for the digest bind)
+ */
+export declare function evaluateEnvelope(response: unknown, envelope: Record<string, unknown>, executionAction: Action, sentArtifacts: Artifact[]): GateResult;
+export {};
+//# sourceMappingURL=enforcement-gate.d.ts.map

package/dist/cjs/enforcement-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcement-gate.d.ts","sourceRoot":"","sources":["../../src/enforcement-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAG3D,KAAK,MAAM,GAAG,UAAU,GAAG,0BAA0B,GAAG,kBAAkB,GAAG,MAAM,CAAC;AAoBpF,wGAAwG;AACxG,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,MAAM,CAMnE;AAED,6FAA6F;AAC7F,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,MAAM,CAKtE;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,GAAG,SAAS,CAAA;CAAE,GAC/C;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,OAAO,GAAG,kBAAkB,CAAA;CAAE,GACnE;IAAE,OAAO,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,cAAc,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,eAAe,EAAE,MAAM,EACvB,aAAa,EAAE,QAAQ,EAAE,GACxB,UAAU,CAkDZ"}

package/dist/cjs/enforcement-gate.js

@@ -0,0 +1,106 @@
+"use strict";
+/**
+ * Client-side authorization gate (P0-b/c) — mirrors the server §106 (binding), §111 (fail-closed on
+ * degraded) and §115 (safe_for_agent) in the guard, so the client never executes off a raw
+ * execution_action an attacker/proxy can flip. All checks are LOCAL and fail-closed.
+ *
+ * Composes with the P0-a receipt binding (receipt-binding.ts). This module reconciles the DECISION
+ * itself; receipt-binding authenticates the envelope the decision rides on.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeArtifactDigest = computeArtifactDigest;
+exports.computeBundleFingerprint = computeBundleFingerprint;
+exports.evaluateEnvelope = evaluateEnvelope;
+const node_crypto_1 = require("node:crypto");
+const DECISION_RANK = { ALLOW: 0, WARN: 1, REQUIRE_APPROVAL: 2, BLOCK: 3 };
+const ACTION_TO_DECISION = {
+    CONTINUE: 'ALLOW', CONTINUE_WITH_MONITORING: 'WARN', REQUEST_APPROVAL: 'REQUIRE_APPROVAL', STOP: 'BLOCK',
+};
+const DECISION_TO_ACTION = {
+    ALLOW: 'CONTINUE', WARN: 'CONTINUE_WITH_MONITORING', REQUIRE_APPROVAL: 'REQUEST_APPROVAL', BLOCK: 'STOP',
+};
+function isDecision(v) {
+    return v === 'ALLOW' || v === 'WARN' || v === 'REQUIRE_APPROVAL' || v === 'BLOCK';
+}
+function isAction(v) {
+    return v === 'CONTINUE' || v === 'CONTINUE_WITH_MONITORING' || v === 'REQUEST_APPROVAL' || v === 'STOP';
+}
+const NUL = '\x1f'; // matches the server's change-set canonical separator
+function sha256hex(s) { return (0, node_crypto_1.createHash)('sha256').update(s).digest('hex'); }
+function specStr(v) { return v == null ? '' : (typeof v === 'string' ? v : JSON.stringify(v)); }
+/** Local artifact_digest — byte-identical to the server change-set.js algorithm (sorted by type,id). */
+function computeArtifactDigest(artifacts) {
+    const preimage = artifacts.slice()
+        .sort((a, b) => (`${a.type}${NUL}${a.id}` < `${b.type}${NUL}${b.id}` ? -1 : 1))
+        .map((a) => `${sha256hex(specStr(a.before))}${sha256hex(specStr(a.after))}`)
+        .join(NUL);
+    return `sha256:${sha256hex(preimage)}`;
+}
+/** Local bundle input_fingerprint — byte-identical to the server change-set.js algorithm. */
+function computeBundleFingerprint(artifacts) {
+    const parts = artifacts.slice()
+        .sort((a, b) => (`${a.type}${NUL}${a.id}` < `${b.type}${NUL}${b.id}` ? -1 : 1))
+        .map((a) => [a.type, a.id, sha256hex(specStr(a.before)), sha256hex(specStr(a.after))].join(NUL));
+    return `sha256:${sha256hex(parts.join(NUL))}`;
+}
+/**
+ * Reconcile an envelope's decision fail-closed. Order:
+ *  1. decision present + valid enum                          (CE-EP-04)   → DECISION_INCONSISTENT
+ *  2. effective decision = STRICTEST(envelope.decision, action-implied, top-level decision/action)
+ *     (CE-EP-01, CE-CC-01)  — BLOCK/REQUIRE_APPROVAL → clean block (positive control CE-EP-02 kept)
+ *  3. safe_for_agent === false on an allow-class decision    (CE-EP-03/§115) → DECISION_INCONSISTENT
+ *  4. degraded / analysis_complete=false / coverage_gap      (CE-CC-02/§111) → ANALYSIS_DEGRADED
+ *  5. artifact_digest / input_fingerprint local compare      (CE-AF-03/#6)   → ARTIFACT_MISMATCH
+ *
+ * @param response   the raw preflight response (for the top-level decision/action, CE-CC-01)
+ * @param envelope   the decision_result envelope
+ * @param executionAction  rd.executionAction from readDecision
+ * @param sentArtifacts    the artifacts the guard sent to preflight (for the digest bind)
+ */
+function evaluateEnvelope(response, envelope, executionAction, sentArtifacts) {
+    // 1. decision required + valid enum.
+    const dec = envelope.decision;
+    if (!isDecision(dec)) {
+        return { verdict: 'fail-closed', cause: 'DECISION_INCONSISTENT', detail: `decision=${JSON.stringify(dec)} is missing/invalid` };
+    }
+    // 2. Strictest of every decision signal present (envelope, action-implied, top-level).
+    const signals = [dec, ACTION_TO_DECISION[executionAction]];
+    const top = (response && typeof response === 'object') ? response : {};
+    if (isDecision(top.decision))
+        signals.push(top.decision);
+    if (isAction(top.execution_action))
+        signals.push(ACTION_TO_DECISION[top.execution_action]);
+    const effective = signals.reduce((a, b) => (DECISION_RANK[b] > DECISION_RANK[a] ? b : a));
+    if (DECISION_RANK[effective] >= DECISION_RANK.REQUIRE_APPROVAL) {
+        // Stricter-wins: a BLOCK/RA anywhere (incl. an inconsistent BLOCK+CONTINUE) → clean block.
+        return { verdict: 'block-strict', decision: effective };
+    }
+    // (effective is ALLOW or WARN — but ALSO require the envelope's own action to agree, else tamper.)
+    if (DECISION_TO_ACTION[dec] !== executionAction) {
+        return { verdict: 'fail-closed', cause: 'DECISION_INCONSISTENT', detail: `decision=${dec} ≠ execution_action=${executionAction}` };
+    }
+    // 3. §115 — safe_for_agent=false is NEVER executable, regardless of action.
+    if (envelope.safe_for_agent === false) {
+        return { verdict: 'fail-closed', cause: 'DECISION_INCONSISTENT', detail: 'safe_for_agent=false on an allow-class decision' };
+    }
+    // 4. §111 — incomplete/degraded analysis is never a clean proceed.
+    const degradedReasons = envelope.degraded_reasons;
+    if (envelope.analysis_complete === false
+        || (Array.isArray(degradedReasons) && degradedReasons.length > 0)
+        || envelope.degraded === true
+        || envelope.coverage_gap === true) {
+        return { verdict: 'fail-closed', cause: 'ANALYSIS_DEGRADED', detail: 'analysis degraded / incomplete' };
+    }
+    // 5. Artifact bind (CE-AF-03) — the server must have analyzed exactly the artifacts we sent.
+    //    LOCALLY recompute artifact_digest and compare to the envelope's when present. (input_fingerprint
+    //    is NOT separately compared here: it is already authenticated by the P0-a receipt body-hash
+    //    binding — it lives inside the signed decision body — and its exact per-version preimage is
+    //    riskier to reproduce client-side, so re-deriving it here would over-block honest traffic.)
+    if (Array.isArray(sentArtifacts) && sentArtifacts.length > 0
+        && typeof envelope.artifact_digest === 'string'
+        && envelope.artifact_digest !== computeArtifactDigest(sentArtifacts)) {
+        return { verdict: 'fail-closed', cause: 'ARTIFACT_MISMATCH', detail: 'artifact_digest ≠ locally-recomputed digest of sent artifacts' };
+    }
+    return { verdict: 'allow', kind: effective === 'ALLOW' ? 'ALLOW' : 'MONITOR' };
+}
+//# sourceMappingURL=enforcement-gate.js.map

package/dist/cjs/enforcement-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcement-gate.js","sourceRoot":"","sources":["../../src/enforcement-gate.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;AA2BH,sDAMC;AAGD,4DAKC;AAqBD,4CAuDC;AAnHD,6CAAyC;AAMzC,MAAM,aAAa,GAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACrG,MAAM,kBAAkB,GAA6B;IACnD,QAAQ,EAAE,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO;CACzG,CAAC;AACF,MAAM,kBAAkB,GAA6B;IACnD,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM;CACzG,CAAC;AACF,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,kBAAkB,IAAI,CAAC,KAAK,OAAO,CAAC;AACpF,CAAC;AACD,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,0BAA0B,IAAI,CAAC,KAAK,kBAAkB,IAAI,CAAC,KAAK,MAAM,CAAC;AAC1G,CAAC;AAED,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,sDAAsD;AAC1E,SAAS,SAAS,CAAC,CAAS,IAAY,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC9F,SAAS,OAAO,CAAC,CAAU,IAAY,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjH,wGAAwG;AACxG,SAAgB,qBAAqB,CAAC,SAAqB;IACzD,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,EAAE;SAC/B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,CAAC,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC9E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;SAC3E,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,UAAU,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;AACzC,CAAC;AAED,6FAA6F;AAC7F,SAAgB,wBAAwB,CAAC,SAAqB;IAC5D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE;SAC5B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,CAAC,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC9E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACnG,OAAO,UAAU,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAOD;;;;;;;;;;;;;GAaG;AACH,SAAgB,gBAAgB,CAC9B,QAAiB,EACjB,QAAiC,EACjC,eAAuB,EACvB,aAAyB;IAEzB,qCAAqC;IACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,YAAY,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;IAClI,CAAC;IAED,uFAAuF;IACvF,MAAM,OAAO,GAAe,CAAC,GAAG,EAAE,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC3F,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1F,IAAI,aAAa,CAAC,SAAS,CAAC,IAAI,aAAa,CAAC,gBAAgB,EAAE,CAAC;QAC/D,2FAA2F;QAC3F,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAyC,EAAE,CAAC;IAC1F,CAAC;IAED,mGAAmG;IACnG,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,eAAe,EAAE,CAAC;QAChD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,YAAY,GAAG,uBAAuB,eAAe,EAAE,EAAE,CAAC;IACrI,CAAC;IAED,4EAA4E;IAC5E,IAAI,QAAQ,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;IAC/H,CAAC;IAED,mEAAmE;IACnE,MAAM,eAAe,GAAG,QAAQ,CAAC,gBAAgB,CAAC;IAClD,IAAI,QAAQ,CAAC,iBAAiB,KAAK,KAAK;WACjC,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;WAC9D,QAAQ,CAAC,QAAQ,KAAK,IAAI;WAC1B,QAAQ,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IAC1G,CAAC;IAED,6FAA6F;IAC7F,sGAAsG;IACtG,gGAAgG;IAChG,gGAAgG;IAChG,gGAAgG;IAChG,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;WACrD,OAAO,QAAQ,CAAC,eAAe,KAAK,QAAQ;WAC5C,QAAQ,CAAC,eAAe,KAAK,qBAAqB,CAAC,aAAa,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,+DAA+D,EAAE,CAAC;IACzI,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AACjF,CAAC"}

package/dist/cjs/guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../src/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EACV,WAAW,EAAE,YAAY,EACT,kBAAkB,EAAE,cAAc,EAEnD,MAAM,YAAY,CAAC;AAwHpB,wBAAsB,aAAa,CAAC,CAAC,EACnC,IAAI,EAAE,kBAAkB,EACxB,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,EACjC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAuJ1B"}
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../src/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EACV,WAAW,EAAE,YAAY,EACT,kBAAkB,EAAE,cAAc,EAEnD,MAAM,YAAY,CAAC;AA+IpB,wBAAsB,aAAa,CAAC,CAAC,EACnC,IAAI,EAAE,kBAAkB,EACxB,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,EACjC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAqK1B"}

package/dist/cjs/guard.js

@@ -13,6 +13,8 @@ exports.guardToolCall = guardToolCall;
 const node_crypto_1 = require("node:crypto");
 const sdk_1 = require("@coderifts/sdk");
 const detector_js_1 = require("./detector.js");
+const receipt_binding_js_1 = require("./receipt-binding.js");
+const enforcement_gate_js_1 = require("./enforcement-gate.js");
 // Per-config breaker state (time-window; not consecutive).
 const breakers = new WeakMap();
 const nowMs = () => Date.now();
@@ -96,22 +98,33 @@ async function preflightWithRetry(config, request) {
     }
     return { ok: false, ...last };
 }
-/** Verify the envelope's receipt via the SDK. Returns the BRANDED envelope only when verified. */
+/**
+ * Verify the envelope's receipt AND bind it to THIS envelope (P0 substitution fix). Returns the
+ * BRANDED envelope only when the receipt is valid, current, AND the LOCALLY-recomputed decision body
+ * hash + fingerprint + operation/environment/audience scope all match. On a valid-but-unbound receipt
+ * the `cause` is RECEIPT_ENVELOPE_MISMATCH; on a bad signature it is RECEIPT_UNVERIFIED. Fail-closed:
+ * any mismatch returns { verified: null }.
+ */
 async function verifyEnvelope(config, envelope) {
     if (!envelope)
-        return null;
+        return { verified: null };
     if (config.verifyReceipts === false)
-        return null; // opt-out => cannot brand => unenforceable + LKG unusable
+        return { verified: null }; // opt-out => cannot brand => unenforceable + LKG unusable
     const token = envelope.receipt?.token;
     if (!token)
-        return null;
+        return { verified: null };
     try {
         const r = await config.client.verifyReceipt(token);
-        if (r && r.valid === true)
-            return envelope;
+        const bind = (0, receipt_binding_js_1.bindReceiptToEnvelope)(envelope, r, { operation: config.operation, environment: config.environment, audience: config.audience });
+        if (bind.ok)
+            return { verified: envelope };
+        emit(config, { type: 'receipt_unverified', at: iso(), decisionId: envelope.decision_id, cause: bind.detail });
+        return { verified: null, cause: bind.cause };
+    }
+    catch {
+        // verification threw => treat as unverified (bad signature / transport)
+        return { verified: null, cause: 'RECEIPT_UNVERIFIED' };
     }
-    catch { /* verification failure is handled as RECEIPT_UNVERIFIED by the caller */ }
-    return null;
 }
 // ── Outcome builders (keep the discriminated union satisfied) ────────────────────
 async function runEnforced(config, factory, approved, redacted) {
@@ -234,29 +247,41 @@ async function guardToolCall(call, executeFactory, config) {
     const envelope = rd.envelope;
     // 5. expiry check before honoring any decision.
     const expired = isExpired(envelope);
-    const verified = await verifyEnvelope(config, envelope);
+    const bindResult = await verifyEnvelope(config, envelope);
+    const verified = bindResult.verified;
     const receiptVerified = !!verified;
     if (!receiptVerified)
         emit(config, { type: 'receipt_unverified', at: iso(), decisionId: envelope.decision_id });
     emit(config, { type: 'preflight_result', at: iso(), action: rd.executionAction, decisionId: envelope.decision_id });
-    // A bad signature (verifyReceipts on, token present, verify failed) is an INTEGRITY attack signal.
+    // A receipt that fails to verify OR fails to BIND to this envelope (P0 substitution/replay/scope) is
+    // an INTEGRITY attack signal => fail closed. RECEIPT_ENVELOPE_MISMATCH names a valid-but-unbound
+    // receipt (e.g. a real BLOCK receipt wrapped in a forged ALLOW envelope); RECEIPT_UNVERIFIED a bad
+    // signature. Both trip the breaker and STOP — the guard NEVER executes off an unbound receipt.
     if (config.verifyReceipts !== false && !receiptVerified && envelope.receipt?.token) {
         breakerRecord(config);
-        return closedIntegrity(config, 'RECEIPT_UNVERIFIED', failPolicy);
+        return closedIntegrity(config, bindResult.cause ?? 'RECEIPT_UNVERIFIED', failPolicy);
+    }
+    // ── Client-side authorization gate (P0-b/c): mirror §106/§111/§115 before honoring any action. ──
+    // A raw execution_action is NEVER trusted alone. The gate reconciles decision↔action (stricter
+    // wins), honors safe_for_agent, fails closed on degraded, and binds the analyzed artifacts to what
+    // we actually sent. Only an allow-class, safe, non-degraded, artifact-bound verdict is executable.
+    const gate = (0, enforcement_gate_js_1.evaluateEnvelope)(pf.response, envelope, rd.executionAction, detection.artifacts);
+    if (gate.verdict === 'fail-closed') {
+        breakerRecord(config);
+        return closedIntegrity(config, gate.cause, failPolicy);
+    }
+    if (gate.verdict === 'block-strict') {
+        // A real (or stricter-reconciled) BLOCK / REQUIRE_APPROVAL — clean block; the factory never runs.
+        return gate.decision === 'BLOCK'
+            ? blocked({ kind: 'BLOCK', action: 'STOP', envelope, receiptVerified }, true)
+            : blocked({ kind: 'APPROVAL', action: 'REQUEST_APPROVAL', envelope, receiptVerified }, true);
     }
-    const action = rd.executionAction;
-    // Non-executable decisions.
-    if (action === 'STOP')
-        return blocked({ kind: 'BLOCK', action: 'STOP', envelope, receiptVerified }, true);
-    if (action === 'REQUEST_APPROVAL')
-        return blocked({ kind: 'APPROVAL', action: 'REQUEST_APPROVAL', envelope, receiptVerified }, true);
+    const kind = gate.kind; // 'ALLOW' | 'MONITOR' — allow-class, safe, non-degraded, artifact-bound.
     // An expired decision cannot be honored fresh => closed (integrity: wrong-time state).
     if (expired) {
         breakerRecord(config);
         return closedIntegrity(config, 'SCHEMA_INVALID', failPolicy);
     }
-    // Executable: CONTINUE (ALLOW) or CONTINUE_WITH_MONITORING (MONITOR).
-    const kind = action === 'CONTINUE' ? 'ALLOW' : 'MONITOR';
     const sinkWired = !!config.onEvent; // v1: onEvent is the telemetry sink for MONITOR.
     if (kind === 'MONITOR') {
         if (sinkWired)
@@ -264,15 +289,19 @@ async function guardToolCall(call, executeFactory, config) {
         else
             emit(config, { type: 'monitoring_unwired', at: iso(), decisionId: envelope.decision_id });
     }
-    // observeOnly executes but never enforces.
+    // observeOnly is an EXPLICIT report-only opt-in: execute but never enforce (the one sanctioned
+    // unenforced-execution mode alongside failPolicy=open; both are documented opt-ins, not the default).
     if (config.observeOnly) {
-        emit(config, { type: 'observe_only_passthrough', at: iso(), action });
+        emit(config, { type: 'observe_only_passthrough', at: iso(), action: rd.executionAction });
         const verdict = kind === 'ALLOW'
             ? { kind: 'ALLOW', action: 'CONTINUE', envelope, receiptVerified }
             : { kind: 'MONITOR', action: 'CONTINUE_WITH_MONITORING', envelope, receiptVerified };
         return runUnenforced(config, executeFactory, envelope, verdict, true, redacted);
     }
-    // enforced:true requires a LIVE receipt-verified ALLOW/MONITOR, and (MONITOR) a wired sink.
+    // ── enforced ⟺ executed INVARIANT (contract-triggering path): execute ONLY when we can ENFORCE. ──
+    // enforceable = a bound-verified receipt AND (MONITOR) a wired sink. Anything else FAILS CLOSED —
+    // the guard NEVER runs the factory unenforced on a contract change. Closes CE-EP-06 (no receipt),
+    // CE-EP-08 (verifyReceipts:false), CE-CC-04 (MONITOR without a monitoring sink).
     const enforceable = receiptVerified && (kind === 'ALLOW' || sinkWired);
     if (enforceable) {
         const approved = kind === 'ALLOW'
@@ -280,11 +309,8 @@ async function guardToolCall(call, executeFactory, config) {
             : { kind: 'MONITOR', action: 'CONTINUE_WITH_MONITORING', envelope, receiptVerified: true };
         return runEnforced(config, executeFactory, approved, redacted);
     }
-    // MONITOR with no sink (monitoring_unwired): execute but enforced:false.
-    const verdict = kind === 'ALLOW'
-        ? { kind: 'ALLOW', action: 'CONTINUE', envelope, receiptVerified }
-        : { kind: 'MONITOR', action: 'CONTINUE_WITH_MONITORING', envelope, receiptVerified };
-    return runUnenforced(config, executeFactory, envelope, verdict, true, redacted);
+    breakerRecord(config);
+    return closedIntegrity(config, receiptVerified ? 'MONITORING_UNWIRED' : 'RECEIPT_MISSING', failPolicy);
 }
 function closedIntegrity(config, cause, failPolicy) {
     const count = (breakers.get(config)?.fails.length) ?? 1;
@@ -313,8 +339,9 @@ async function tryLkg(config, inputFp) {
     }
     if (!cached)
         return null;
-    // Receipt verification is UNCONDITIONAL for LKG (with verifyReceipts:false it cannot brand => unusable).
-    const verified = await verifyEnvelope(config, cached);
+    // Receipt verification + BINDING is UNCONDITIONAL for LKG (verifyReceipts:false => cannot brand =>
+    // unusable). An LKG envelope whose receipt does not bind to it (substitution) is also unusable.
+    const { verified } = await verifyEnvelope(config, cached);
     if (!verified)
         return null;
     // Eligibility (rule 15): decision ALLOW|WARN, unexpired, age<lkgMaxAgeMs, fingerprint + ruleset_hash