@edgeproc/privacy-core 0.2.0

package/dist/egressReceipt.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Egress decisions, sealed as signed Avow effect receipts.
+ *
+ * The Egress Guard already gates whether redacted text may leave the device
+ * (see {@link file://./egress.ts}). This module makes that decision *provable*:
+ * every allow or deny is expressed as a Writ-style governed effect — an
+ * `EgressSubject` — and signed into a tamper-evident receipt via the shared
+ * `@edgeproc/avow` envelope. A holder of the signer's public key can later
+ * verify exactly which egress decisions were taken, without ever seeing the
+ * content.
+ *
+ * INVARIANT — no plaintext in a receipt: the subject stores only
+ * `args_digest = sha256(canonical({ redactedText }))`, never the text itself,
+ * and never the raw PII the vault holds. A receipt records *that* a decision
+ * happened over *this* content, not the content.
+ */
+import { type SignedReceipt } from "@edgeproc/avow";
+export { contentHash } from "@edgeproc/avow";
+/** Whether the guard let the redacted text leave the device, or refused it. */
+export type EgressDecision = "allow" | "deny";
+/**
+ * The governed effect: sending redacted text to a named provider was either
+ * allowed or denied. A type alias (not an interface) so it satisfies the
+ * `@edgeproc/avow` `JsonValue` constraint via TypeScript's implicit index
+ * signature — the subject IS a plain JSON object.
+ */
+export type EgressSubject = {
+    readonly action: "llm.egress";
+    readonly provider: string;
+    readonly args_digest: string;
+    readonly decision: EgressDecision;
+    readonly detector_version: string;
+};
+/**
+ * Version tag for the Tier-1 deterministic detector ruleset. Bumping the
+ * ruleset bumps this so a verifier can tell which detector version screened
+ * the content behind a receipt.
+ */
+export declare const DETECTOR_VERSION = "1";
+/** What the caller knows at the egress decision point. */
+export interface EgressSubjectInput {
+    readonly provider: string;
+    /** The redacted (already-scrubbed) text — hashed, never stored verbatim. */
+    readonly redactedText: string;
+    readonly decision: EgressDecision;
+    readonly detectorVersion?: string;
+}
+/** Build the signed subject, digesting the redacted text and nothing else. */
+export declare function buildEgressSubject(input: EgressSubjectInput): Promise<EgressSubject>;
+/**
+ * How a guarded provider seals its decisions. Given to
+ * {@link file://./egress.ts guardedProvider}, every allow AND every fail-closed
+ * deny at that chokepoint is signed and handed to `onReceipt` — the guard
+ * cannot act silently once governed.
+ */
+export interface EgressGovernance {
+    /** Provider name recorded in each receipt (e.g. "openrouter"). */
+    readonly provider: string;
+    /** Ed25519 seed (hex) that signs the receipts. */
+    readonly seedHex: string;
+    /** Receives every sealed decision receipt. */
+    readonly onReceipt: (receipt: SignedReceipt<EgressSubject>) => void;
+    readonly detectorVersion?: string;
+}
+/** Seal an egress decision into a signed, pinned-key-verifiable receipt. */
+export declare function sealEgressReceipt(input: EgressSubjectInput, seedHex: string): Promise<SignedReceipt<EgressSubject>>;
+//# sourceMappingURL=egressReceipt.d.ts.map

package/dist/egressReceipt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"egressReceipt.d.ts","sourceRoot":"","sources":["../src/egressReceipt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAe,KAAK,aAAa,EAAe,MAAM,gBAAgB,CAAC;AAI9E,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,+EAA+E;AAC/E,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,MAAM,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAEpC,0DAA0D;AAC1D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,8EAA8E;AAC9E,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,aAAa,CAAC,CAQxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC;IACpE,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,4EAA4E;AAC5E,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,kBAAkB,EACzB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAEvC"}

package/dist/egressReceipt.js

@@ -0,0 +1,41 @@
+/**
+ * Egress decisions, sealed as signed Avow effect receipts.
+ *
+ * The Egress Guard already gates whether redacted text may leave the device
+ * (see {@link file://./egress.ts}). This module makes that decision *provable*:
+ * every allow or deny is expressed as a Writ-style governed effect — an
+ * `EgressSubject` — and signed into a tamper-evident receipt via the shared
+ * `@edgeproc/avow` envelope. A holder of the signer's public key can later
+ * verify exactly which egress decisions were taken, without ever seeing the
+ * content.
+ *
+ * INVARIANT — no plaintext in a receipt: the subject stores only
+ * `args_digest = sha256(canonical({ redactedText }))`, never the text itself,
+ * and never the raw PII the vault holds. A receipt records *that* a decision
+ * happened over *this* content, not the content.
+ */
+import { contentHash, signPayload } from "@edgeproc/avow";
+// Re-exported so receipt verifiers can recompute `args_digest` with the SAME
+// canonical hash the sealer used, without importing @edgeproc/avow directly.
+export { contentHash } from "@edgeproc/avow";
+/**
+ * Version tag for the Tier-1 deterministic detector ruleset. Bumping the
+ * ruleset bumps this so a verifier can tell which detector version screened
+ * the content behind a receipt.
+ */
+export const DETECTOR_VERSION = "1";
+/** Build the signed subject, digesting the redacted text and nothing else. */
+export async function buildEgressSubject(input) {
+    return {
+        action: "llm.egress",
+        provider: input.provider,
+        args_digest: await contentHash({ redactedText: input.redactedText }),
+        decision: input.decision,
+        detector_version: input.detectorVersion ?? DETECTOR_VERSION,
+    };
+}
+/** Seal an egress decision into a signed, pinned-key-verifiable receipt. */
+export async function sealEgressReceipt(input, seedHex) {
+    return signPayload(await buildEgressSubject(input), seedHex);
+}
+//# sourceMappingURL=egressReceipt.js.map

package/dist/egressReceipt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"egressReceipt.js","sourceRoot":"","sources":["../src/egressReceipt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,WAAW,EAAsB,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE9E,6EAA6E;AAC7E,6EAA6E;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAmB7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAWpC,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAyB;IAEzB,OAAO;QACL,MAAM,EAAE,YAAY;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,MAAM,WAAW,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;QACpE,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,gBAAgB,EAAE,KAAK,CAAC,eAAe,IAAI,gBAAgB;KAC5D,CAAC;AACJ,CAAC;AAkBD,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAyB,EACzB,OAAe;IAEf,OAAO,WAAW,CAAC,MAAM,kBAAkB,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;AAC/D,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Typed failures of the privacy boundary. Every one of these is a FAIL-CLOSED
+ * signal: the safe reaction is to stop the send/restore, not to continue.
+ */
+/**
+ * Thrown by {@link approve} when handed an object the redaction pipeline never
+ * minted. A hand-built "pending" could smuggle unreviewed raw text past the
+ * guard, so it is rejected outright.
+ */
+export declare class ForgedPayloadError extends Error {
+    constructor(message: string);
+}
+/**
+ * Thrown by every provider adapter (via {@link assertApproved}) when handed a
+ * payload the egress guard never approved — e.g. a structurally identical
+ * object hand-built by the caller. The capability is checked by IDENTITY in a
+ * module-private registry, so it holds at runtime in plain JS, not only in the
+ * type system.
+ */
+export declare class UnapprovedPayloadError extends Error {
+    constructor(message: string);
+}
+/**
+ * Thrown by {@link redactForEgress} when the input already contains text
+ * matching the placeholder grammar (`[TYPE_1]`). Such text is
+ * indistinguishable from a vault token after redaction, so rehydration would
+ * silently substitute vault values into text that never contained them —
+ * fail closed instead of weakening reversibility.
+ */
+export declare class PlaceholderCollisionError extends Error {
+    constructor(message: string);
+}
+/**
+ * Thrown by {@link rehydrate} when the vault it was handed is not the vault
+ * the payload was redacted with. Restoring with the wrong vault silently
+ * yields wrong or missing values — fail closed instead.
+ */
+export declare class VaultMismatchError extends Error {
+    constructor(message: string);
+}
+/**
+ * Thrown by {@link rehydrate} when a placeholder-shaped token (`[TYPE_n]`) in
+ * the reply cannot be resolved by the bound vault. Under a bound vault an
+ * unresolvable token is an anomaly — the reply was redacted with a different
+ * vault, or a model invented a placeholder — so the safe reaction is to stop,
+ * not to leave a token that merely *looks* like redaction in place.
+ */
+export declare class UnresolvedPlaceholderError extends Error {
+    constructor(message: string);
+}
+/**
+ * Thrown by {@link redactForEgress} when a value the detector recognised (and
+ * wrote into the vault) still appears verbatim in the redacted output — e.g. a
+ * second, unlabelled copy of an account number that the label-gated rule only
+ * matched once. Emitting it would put a value the tool already knows is PII on
+ * the wire, so redaction fails closed instead of leaking it. The reversibility
+ * backstop is the human preview; this is the belt to that suspenders.
+ */
+export declare class ResidualValueError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;GAMG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;GAMG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;GAMG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF"}

package/dist/errors.js

@@ -0,0 +1,80 @@
+/**
+ * Typed failures of the privacy boundary. Every one of these is a FAIL-CLOSED
+ * signal: the safe reaction is to stop the send/restore, not to continue.
+ */
+/**
+ * Thrown by {@link approve} when handed an object the redaction pipeline never
+ * minted. A hand-built "pending" could smuggle unreviewed raw text past the
+ * guard, so it is rejected outright.
+ */
+export class ForgedPayloadError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ForgedPayloadError";
+    }
+}
+/**
+ * Thrown by every provider adapter (via {@link assertApproved}) when handed a
+ * payload the egress guard never approved — e.g. a structurally identical
+ * object hand-built by the caller. The capability is checked by IDENTITY in a
+ * module-private registry, so it holds at runtime in plain JS, not only in the
+ * type system.
+ */
+export class UnapprovedPayloadError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "UnapprovedPayloadError";
+    }
+}
+/**
+ * Thrown by {@link redactForEgress} when the input already contains text
+ * matching the placeholder grammar (`[TYPE_1]`). Such text is
+ * indistinguishable from a vault token after redaction, so rehydration would
+ * silently substitute vault values into text that never contained them —
+ * fail closed instead of weakening reversibility.
+ */
+export class PlaceholderCollisionError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "PlaceholderCollisionError";
+    }
+}
+/**
+ * Thrown by {@link rehydrate} when the vault it was handed is not the vault
+ * the payload was redacted with. Restoring with the wrong vault silently
+ * yields wrong or missing values — fail closed instead.
+ */
+export class VaultMismatchError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "VaultMismatchError";
+    }
+}
+/**
+ * Thrown by {@link rehydrate} when a placeholder-shaped token (`[TYPE_n]`) in
+ * the reply cannot be resolved by the bound vault. Under a bound vault an
+ * unresolvable token is an anomaly — the reply was redacted with a different
+ * vault, or a model invented a placeholder — so the safe reaction is to stop,
+ * not to leave a token that merely *looks* like redaction in place.
+ */
+export class UnresolvedPlaceholderError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "UnresolvedPlaceholderError";
+    }
+}
+/**
+ * Thrown by {@link redactForEgress} when a value the detector recognised (and
+ * wrote into the vault) still appears verbatim in the redacted output — e.g. a
+ * second, unlabelled copy of an account number that the label-gated rule only
+ * matched once. Emitting it would put a value the tool already knows is PII on
+ * the wire, so redaction fails closed instead of leaking it. The reversibility
+ * backstop is the human preview; this is the belt to that suspenders.
+ */
+export class ResidualValueError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ResidualValueError";
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * `@edgeproc/privacy-core` — a browser-side privacy boundary for LLM calls.
+ *
+ * Raw private text stays on-device; only policy-approved, redacted text can
+ * reach a provider; the model's reply is rehydrated locally. The load-bearing
+ * idea is the type-enforced Egress Guard: provider adapters accept ONLY a
+ * branded {@link RedactedPayload}, so handing raw text to a provider is a
+ * compile error.
+ *
+ * This barrel is the PRODUCTION surface. Test fixtures live behind the
+ * `@edgeproc/privacy-core/testing` subpath, never here.
+ */
+export { detect } from "./detect/detector.js";
+export { approve, assertApproved, guardedProvider, type LlmProvider, type PendingRedaction, type RedactedPayload, unsafeBypass, } from "./egress.js";
+export { buildEgressSubject, contentHash, DETECTOR_VERSION, type EgressDecision, type EgressGovernance, type EgressSubject, type EgressSubjectInput, sealEgressReceipt, } from "./egressReceipt.js";
+export { ForgedPayloadError, PlaceholderCollisionError, ResidualValueError, UnapprovedPayloadError, UnresolvedPlaceholderError, VaultMismatchError, } from "./errors.js";
+export { makeProvider, type ProviderConfig, type SelectedProvider, } from "./providers/factory.js";
+export { NoLLMProvider } from "./providers/nollm.js";
+export { type OpenRouterConfig, OpenRouterProvider, } from "./providers/openrouter.js";
+export { redactForEgress } from "./redact.js";
+export { rehydrate } from "./rehydrate.js";
+export type { AuditEntry, AuditSink, EntityType, RedactedResponse, Span, VaultRef, } from "./types.js";
+export { Vault } from "./vault.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,OAAO,EACL,OAAO,EACP,cAAc,EACd,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,YAAY,GACb,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,KAAK,cAAc,EACnB,KAAK,gBAAgB,GACtB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EACL,KAAK,gBAAgB,EACrB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,YAAY,EACV,UAAU,EACV,SAAS,EACT,UAAU,EACV,gBAAgB,EAChB,IAAI,EACJ,QAAQ,GACT,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,29 @@
+/**
+ * `@edgeproc/privacy-core` — a browser-side privacy boundary for LLM calls.
+ *
+ * Raw private text stays on-device; only policy-approved, redacted text can
+ * reach a provider; the model's reply is rehydrated locally. The load-bearing
+ * idea is the type-enforced Egress Guard: provider adapters accept ONLY a
+ * branded {@link RedactedPayload}, so handing raw text to a provider is a
+ * compile error.
+ *
+ * This barrel is the PRODUCTION surface. Test fixtures live behind the
+ * `@edgeproc/privacy-core/testing` subpath, never here.
+ */
+// Detection spine.
+export { detect } from "./detect/detector.js";
+// The egress boundary.
+export { approve, assertApproved, guardedProvider, unsafeBypass, } from "./egress.js";
+// Signed egress receipts (the Writ-style effect face).
+export { buildEgressSubject, contentHash, DETECTOR_VERSION, sealEgressReceipt, } from "./egressReceipt.js";
+// Typed fail-closed errors.
+export { ForgedPayloadError, PlaceholderCollisionError, ResidualValueError, UnapprovedPayloadError, UnresolvedPlaceholderError, VaultMismatchError, } from "./errors.js";
+export { makeProvider, } from "./providers/factory.js";
+// Providers.
+export { NoLLMProvider } from "./providers/nollm.js";
+export { OpenRouterProvider, } from "./providers/openrouter.js";
+// The reversible loop.
+export { redactForEgress } from "./redact.js";
+export { rehydrate } from "./rehydrate.js";
+export { Vault } from "./vault.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,mBAAmB;AACnB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,uBAAuB;AACvB,OAAO,EACL,OAAO,EACP,cAAc,EACd,eAAe,EAIf,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,uDAAuD;AACvD,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAKhB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,4BAA4B;AAC5B,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,GAGb,MAAM,wBAAwB,CAAC;AAChC,aAAa;AACb,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAEL,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,uBAAuB;AACvB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAU3C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC"}

package/dist/providers/factory.d.ts

@@ -0,0 +1,20 @@
+import type { LlmProvider } from "../egress.js";
+/** Config for {@link makeProvider}. Host apps source these from their own env. */
+export interface ProviderConfig {
+    readonly apiKey?: string | undefined;
+    readonly model?: string | undefined;
+    readonly endpoint?: string | undefined;
+}
+/** A live provider plus a label for the UI to show which one is selected. */
+export interface SelectedProvider {
+    readonly provider: LlmProvider;
+    readonly label: string;
+}
+/**
+ * Pick a provider from config. With a non-empty API key, the OpenRouter path is
+ * selected; otherwise it falls back to the offline echo so the demo runs cold.
+ * The library stays env-agnostic — the host (e.g. the Vite demo) reads its own
+ * env and passes the values in.
+ */
+export declare function makeProvider(config?: ProviderConfig): SelectedProvider;
+//# sourceMappingURL=factory.d.ts.map

package/dist/providers/factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../src/providers/factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAIhD,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAG7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAGpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAID;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,GAAE,cAAmB,GAAG,gBAAgB,CAgB1E"}

package/dist/providers/factory.js

@@ -0,0 +1,27 @@
+import { NoLLMProvider } from "./nollm.js";
+import { OpenRouterProvider } from "./openrouter.js";
+const DEFAULT_MODEL = "openai/gpt-4o-mini";
+/**
+ * Pick a provider from config. With a non-empty API key, the OpenRouter path is
+ * selected; otherwise it falls back to the offline echo so the demo runs cold.
+ * The library stays env-agnostic — the host (e.g. the Vite demo) reads its own
+ * env and passes the values in.
+ */
+export function makeProvider(config = {}) {
+    const model = config.model ?? DEFAULT_MODEL;
+    if (config.apiKey?.trim()) {
+        return {
+            provider: new OpenRouterProvider({
+                apiKey: config.apiKey,
+                model,
+                endpoint: config.endpoint,
+            }),
+            label: `OpenRouter · ${model}`,
+        };
+    }
+    return {
+        provider: new NoLLMProvider(),
+        label: "NoLLMProvider (offline echo)",
+    };
+}
+//# sourceMappingURL=factory.js.map

package/dist/providers/factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.js","sourceRoot":"","sources":["../../src/providers/factory.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAmBrD,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,MAAM,GAAmB,EAAE;IACtD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,aAAa,CAAC;IAC5C,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;QAC1B,OAAO;YACL,QAAQ,EAAE,IAAI,kBAAkB,CAAC;gBAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,KAAK;gBACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC;YACF,KAAK,EAAE,gBAAgB,KAAK,EAAE;SAC/B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,IAAI,aAAa,EAAE;QAC7B,KAAK,EAAE,8BAA8B;KACtC,CAAC;AACJ,CAAC"}

package/dist/providers/nollm.d.ts

@@ -0,0 +1,12 @@
+import { type LlmProvider, type RedactedPayload } from "../egress.js";
+import type { RedactedResponse } from "../types.js";
+/**
+ * Offline fallback provider — runs with NO API key. It does NOT touch the
+ * network; it echoes a plausible analyst reply that references the same
+ * placeholders, so the rehydrate step has something to restore. This is what
+ * makes the demo runnable cold, with the wow-loop fully intact.
+ */
+export declare class NoLLMProvider implements LlmProvider {
+    complete(payload: RedactedPayload): Promise<RedactedResponse>;
+}
+//# sourceMappingURL=nollm.d.ts.map

package/dist/providers/nollm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nollm.d.ts","sourceRoot":"","sources":["../../src/providers/nollm.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,eAAe,EACrB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD;;;;;GAKG;AACH,qBAAa,aAAc,YAAW,WAAW;IACzC,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAqBlE;CACF"}

package/dist/providers/nollm.js

@@ -0,0 +1,28 @@
+import { assertApproved, } from "../egress.js";
+/**
+ * Offline fallback provider — runs with NO API key. It does NOT touch the
+ * network; it echoes a plausible analyst reply that references the same
+ * placeholders, so the rehydrate step has something to restore. This is what
+ * makes the demo runnable cold, with the wow-loop fully intact.
+ */
+export class NoLLMProvider {
+    async complete(payload) {
+        // Runtime guard: even the offline echo refuses a forged payload.
+        assertApproved(payload);
+        const tokens = [...payload.redactedText.matchAll(/\[[A-Z]+_\d+\]/g)].map((m) => m[0]);
+        const list = tokens.length ? tokens.join(", ") : "no sensitive values";
+        const lines = [
+            "Summary (offline echo — no API key set):",
+            `I reviewed your statement. It referenced ${tokens.length} redacted value(s): ${list}.`,
+        ];
+        // Only ever echo placeholders that ACTUALLY came from this payload — the
+        // vault can resolve those. Inventing a token the vault never minted would
+        // (correctly) trip rehydrate's fail-closed guard.
+        if (tokens[0]) {
+            lines.push(`The first flagged value, ${tokens[0]}, is the one to check.`);
+        }
+        lines.push("(Set OPENROUTER_API_KEY + VITE_USE_OPENROUTER=1 to call a real model via the dev proxy.)");
+        return { redactedText: lines.join("\n") };
+    }
+}
+//# sourceMappingURL=nollm.js.map

package/dist/providers/nollm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nollm.js","sourceRoot":"","sources":["../../src/providers/nollm.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,GAGf,MAAM,cAAc,CAAC;AAGtB;;;;;GAKG;AACH,MAAM,OAAO,aAAa;IACxB,KAAK,CAAC,QAAQ,CAAC,OAAwB;QACrC,iEAAiE;QACjE,cAAc,CAAC,OAAO,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CACtE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CACZ,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC;QACvE,MAAM,KAAK,GAAG;YACZ,0CAA0C;YAC1C,4CAA4C,MAAM,CAAC,MAAM,uBAAuB,IAAI,GAAG;SACxF,CAAC;QACF,yEAAyE;QACzE,0EAA0E;QAC1E,kDAAkD;QAClD,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAC5E,CAAC;QACD,KAAK,CAAC,IAAI,CACR,0FAA0F,CAC3F,CAAC;QACF,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC5C,CAAC;CACF"}

package/dist/providers/openrouter.d.ts

@@ -0,0 +1,18 @@
+import { type LlmProvider, type RedactedPayload } from "../egress.js";
+import type { RedactedResponse } from "../types.js";
+export interface OpenRouterConfig {
+    readonly apiKey: string;
+    readonly model: string;
+    readonly endpoint?: string | undefined;
+}
+/**
+ * OpenRouter (OpenAI-compatible chat/completions). It accepts ONLY a
+ * RedactedPayload, so by construction only placeholder text can ever be put on
+ * the wire — the raw values are never in scope here.
+ */
+export declare class OpenRouterProvider implements LlmProvider {
+    private readonly cfg;
+    constructor(cfg: OpenRouterConfig);
+    complete(payload: RedactedPayload): Promise<RedactedResponse>;
+}
+//# sourceMappingURL=openrouter.d.ts.map

package/dist/providers/openrouter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openrouter.d.ts","sourceRoot":"","sources":["../../src/providers/openrouter.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,eAAe,EACrB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAgBD;;;;GAIG;AACH,qBAAa,kBAAmB,YAAW,WAAW;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG;IAAhC,YAA6B,GAAG,EAAE,gBAAgB,EAAI;IAEhD,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAwBlE;CACF"}

package/dist/providers/openrouter.js

@@ -0,0 +1,43 @@
+import { assertApproved, } from "../egress.js";
+const DEFAULT_ENDPOINT = "https://openrouter.ai/api/v1/chat/completions";
+const SYSTEM_PROMPT = "You are a personal finance assistant. The user's text has had sensitive " +
+    "values replaced by typed placeholders like [CARD_1] or [NAME_2]. Reason " +
+    "about the placeholders as opaque tokens and reuse the SAME placeholders in " +
+    "your reply. Never invent real values.";
+/**
+ * OpenRouter (OpenAI-compatible chat/completions). It accepts ONLY a
+ * RedactedPayload, so by construction only placeholder text can ever be put on
+ * the wire — the raw values are never in scope here.
+ */
+export class OpenRouterProvider {
+    cfg;
+    constructor(cfg) {
+        this.cfg = cfg;
+    }
+    async complete(payload) {
+        // Runtime guard: a structurally forged payload never reaches the wire.
+        assertApproved(payload);
+        const body = JSON.stringify({
+            model: this.cfg.model,
+            messages: [
+                { role: "system", content: SYSTEM_PROMPT },
+                { role: "user", content: payload.redactedText },
+            ],
+        });
+        const res = await fetch(this.cfg.endpoint ?? DEFAULT_ENDPOINT, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                authorization: `Bearer ${this.cfg.apiKey}`,
+            },
+            body,
+        });
+        if (!res.ok) {
+            throw new Error(`OpenRouter ${res.status}: ${await res.text()}`);
+        }
+        const json = (await res.json());
+        const content = json.choices?.[0]?.message?.content ?? "";
+        return { redactedText: content };
+    }
+}
+//# sourceMappingURL=openrouter.js.map

package/dist/providers/openrouter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openrouter.js","sourceRoot":"","sources":["../../src/providers/openrouter.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,GAGf,MAAM,cAAc,CAAC;AAStB,MAAM,gBAAgB,GAAG,+CAA+C,CAAC;AAEzE,MAAM,aAAa,GACjB,0EAA0E;IAC1E,0EAA0E;IAC1E,6EAA6E;IAC7E,uCAAuC,CAAC;AAQ1C;;;;GAIG;AACH,MAAM,OAAO,kBAAkB;IACA,GAAG;IAAhC,YAA6B,GAAqB;mBAArB,GAAG;IAAqB,CAAC;IAEtD,KAAK,CAAC,QAAQ,CAAC,OAAwB;QACrC,uEAAuE;QACvE,cAAc,CAAC,OAAO,CAAC,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK;YACrB,QAAQ,EAAE;gBACR,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE;gBAC1C,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;aAChD;SACF,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,gBAAgB,EAAE;YAC7D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE;aAC3C;YACD,IAAI;SACL,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,cAAc,GAAG,CAAC,MAAM,KAAK,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmB,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;QAC1D,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACnC,CAAC;CACF"}

package/dist/redact.d.ts

@@ -0,0 +1,14 @@
+import { type PendingRedaction } from "./egress.js";
+import type { AuditSink } from "./types.js";
+import type { Vault } from "./vault.js";
+/**
+ * THE ONLY legitimate constructor of a PendingRedaction.
+ *
+ * Detects PII, writes each raw value into the vault, and replaces it with a
+ * stable placeholder. The result is a review PROPOSAL — it is NOT sendable.
+ * Only the explicit `approve()` step turns it into the RedactedPayload
+ * capability a provider will accept, and that holds even when detection finds
+ * nothing: zero detections never auto-approve.
+ */
+export declare function redactForEgress(raw: string, vault: Vault, audit?: AuditSink): Promise<PendingRedaction>;
+//# sourceMappingURL=redact.d.ts.map

package/dist/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AACA,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE1E,OAAO,KAAK,EAAE,SAAS,EAAQ,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAoDxC;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,KAAK,EACZ,KAAK,CAAC,EAAE,SAAS,GAChB,OAAO,CAAC,gBAAgB,CAAC,CAyB3B"}

package/dist/redact.js

@@ -0,0 +1,79 @@
+import { detect } from "./detect/detector.js";
+import { mintPendingRedaction } from "./egress.js";
+import { PlaceholderCollisionError, ResidualValueError } from "./errors.js";
+/**
+ * The placeholder grammar (same shape `rehydrate` restores). Input containing
+ * it would be indistinguishable from vault tokens after redaction.
+ */
+const PLACEHOLDER_SHAPE = /\[[A-Z]+_\d+\]/;
+/** Escape a raw value so it can be embedded literally inside a RegExp. */
+function escapeForRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+ * Match the value only as a STANDALONE token: no alphanumeric character may sit
+ * immediately before or after it. This is the \b-style guard for values whose
+ * edges are digits/letters (every label-gated ACCOUNT/ROUTING value is), and it
+ * is what separates a real leak (`... 021000021` standalone) from a benign
+ * superstring (`0123456789A`, `1002003009`) that merely contains the digits.
+ * For a value whose own edge is a non-word char the adjacent guard is simply
+ * inert there, degrading to a raw-presence check — safe, since such a value
+ * cannot be a substring of a longer alphanumeric token anyway.
+ */
+function survivesAsToken(out, value) {
+    const standalone = new RegExp(`(?<![A-Za-z0-9])${escapeForRegExp(value)}(?![A-Za-z0-9])`);
+    return standalone.test(out);
+}
+/**
+ * Fail closed if any detected value survived as a standalone token in the
+ * redacted output. The span-by-span rebuild only removes the ranges the
+ * detector matched, so a value that recurs where the ruleset did not
+ * independently match it (a duplicate copy of a label-gated ACCOUNT/ROUTING
+ * number) can slip through. A detected value is one the tool already vaulted as
+ * PII; emitting a verbatim standalone copy would leak it, so refuse rather than
+ * send. A value that survives only as a substring of a longer alphanumeric
+ * token (a benign order id / tracking number) is NOT a leak and does not refuse.
+ */
+function assertNoResidual(out, spans) {
+    for (const s of spans) {
+        if (survivesAsToken(out, s.value)) {
+            throw new ResidualValueError(`a detected ${s.type} value survived redaction and would cross the wire ` +
+                "verbatim (a duplicate the ruleset matched only once) — refusing to " +
+                "emit a payload that leaks a value already known to be PII");
+        }
+    }
+}
+/**
+ * THE ONLY legitimate constructor of a PendingRedaction.
+ *
+ * Detects PII, writes each raw value into the vault, and replaces it with a
+ * stable placeholder. The result is a review PROPOSAL — it is NOT sendable.
+ * Only the explicit `approve()` step turns it into the RedactedPayload
+ * capability a provider will accept, and that holds even when detection finds
+ * nothing: zero detections never auto-approve.
+ */
+export async function redactForEgress(raw, vault, audit) {
+    const collision = raw.match(PLACEHOLDER_SHAPE);
+    if (collision) {
+        throw new PlaceholderCollisionError(`input already contains placeholder-shaped text ("${collision[0]}") — ` +
+            "redacting it would make restore ambiguous, so the redaction is refused");
+    }
+    const spans = detect(raw);
+    // Rebuild text left-to-right, swapping each span for its vault token.
+    let out = "";
+    let cursor = 0;
+    const placeholders = [];
+    for (const s of spans) {
+        out += raw.slice(cursor, s.start);
+        const token = vault.tokenize(s.type, s.value);
+        out += token;
+        placeholders.push(token);
+        cursor = s.end;
+    }
+    out += raw.slice(cursor);
+    // Fail closed BEFORE auditing/minting: a redact that leaks is not a redact.
+    assertNoResidual(out, spans);
+    audit?.({ kind: "redact", at: Date.now(), placeholders });
+    return mintPendingRedaction(out, vault.ref, placeholders);
+}
+//# sourceMappingURL=redact.js.map

package/dist/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAyB,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAI5E;;;GAGG;AACH,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAE3C,0EAA0E;AAC1E,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,GAAW,EAAE,KAAa;IACjD,MAAM,UAAU,GAAG,IAAI,MAAM,CAC3B,mBAAmB,eAAe,CAAC,KAAK,CAAC,iBAAiB,CAC3D,CAAC;IACF,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CAAC,GAAW,EAAE,KAAsB;IAC3D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,kBAAkB,CAC1B,cAAc,CAAC,CAAC,IAAI,qDAAqD;gBACvE,qEAAqE;gBACrE,2DAA2D,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAW,EACX,KAAY,EACZ,KAAiB;IAEjB,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC/C,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,yBAAyB,CACjC,oDAAoD,SAAS,CAAC,CAAC,CAAC,OAAO;YACrE,wEAAwE,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,sEAAsE;IACtE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAC9C,GAAG,IAAI,KAAK,CAAC;QACb,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC;IACjB,CAAC;IACD,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzB,4EAA4E;IAC5E,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;IAC1D,OAAO,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;AAC5D,CAAC"}