@intutic/shared-types 2.2.0 → 2.4.0

package/dist/policyGuardrails.d.ts

@@ -1,5 +1,5 @@
 /**
- * Wire types for the Policy Clause Ledger (LLD #71): what
+ * Wire types for the Policy Clause Ledger: what
  * `/api/v1/policy-guardrails/*` returns, as the control plane, the dashboard
  * page and `intutic guardrails` all read it. The control plane's service
  * imports these rather than declaring its own, so a field cannot drift
@@ -8,12 +8,13 @@
  * camelCase throughout: the routes select through Drizzle column maps, and
  * that is the casing they emit.
  */
-import type { GuardrailIr } from './guardrailIr.js';
+import { z } from 'zod';
+import { type GuardrailIr } from './guardrailIr.js';
 export declare const GUARDRAIL_STATUSES: readonly ["PROPOSED", "SHADOW", "ENFORCING", "REJECTED", "RETIRED"];
 /**
  * Statuses in which a guardrail's citation is live — the ones conflicts are
  * reported for and the ones that keep the cited document from being written
- * back over (LLD #71, Wave 8). A rejected proposal does not freeze a source.
+ * back over. A rejected proposal does not freeze a source.
  */
 export declare const LIVE_GUARDRAIL_STATUSES: readonly ["PROPOSED", "SHADOW", "ENFORCING"];
 /**
@@ -34,16 +35,110 @@ export declare function guardrailFileStem(guardrailId: string): string;
 export declare function guardrailIdFromSopTitle(title: string): string | null;
 export type GuardrailStatus = (typeof GUARDRAIL_STATUSES)[number];
 /**
- * `workspace_setting` (TD-474 item 2) is the one target no rule endpoint
+ * `workspace_setting` is the one target no rule endpoint
  * projects: an `allowed_models` or `egress_allow` guardrail is written into
  * the workspace setting the proxy already enforces when a member promotes it,
  * and unwound when it is retired.
  */
 export declare const GUARDRAIL_TARGETS: readonly ["hook_rule", "sop_front_matter", "wasm_rule", "workspace_setting"];
 export type GuardrailTarget = (typeof GUARDRAIL_TARGETS)[number];
-export declare const GUARDRAIL_EVENT_TYPES: readonly ["PROPOSED", "SHADOW_APPROVED", "PROMOTED", "REJECTED", "RETIRED", "SOURCE_STALE", "SOURCE_RECONFIRMED", "CITATION_REBOUND", "RENDER_REBOUND"];
+export declare const GUARDRAIL_EVENT_TYPES: readonly ["PROPOSED", "SHADOW_APPROVED", "PROMOTED", "REJECTED", "RETIRED", "SOURCE_STALE", "SOURCE_RECONFIRMED", "CITATION_REBOUND", "RENDER_REBOUND", "UPDATED"];
 export type GuardrailEventType = (typeof GUARDRAIL_EVENT_TYPES)[number];
-/** The one promotion rule (LLD #71 decision 7), as `GET …/thresholds` reports it. */
+/**
+ * Where a guardrail came from.
+ *
+ * - `extracted`: compiled from a cited clause of a policy document. It stands
+ *   on a passage, carries the quote, and goes stale when the passage changes.
+ * - `authored`: written directly by an OWNER or ADMIN (API, CLI, Terraform or
+ *   the dashboard). It has a name and an optional description instead of a
+ *   citation, and is held to the same IR and the same validator — minus the
+ *   checks that ground a model's proposal in the passage it was shown, which
+ *   have nothing to read.
+ *
+ * Both start PROPOSED and move through the same transitions on the same
+ * evidence.
+ */
+export declare const GUARDRAIL_PROVENANCES: readonly ["extracted", "authored"];
+export type GuardrailProvenance = (typeof GUARDRAIL_PROVENANCES)[number];
+/** An authored guardrail's name is a one-line label: it titles the projected SOP and the review card. */
+export declare const AUTHORED_NAME_MAX_CHARS = 80;
+/** The description stands where an extracted guardrail's quote stands — in a hook rule's block message, among others — so it has the quote's ceiling. */
+export declare const AUTHORED_DESCRIPTION_MAX_CHARS = 480;
+/**
+ * `POST /api/v1/policy-guardrails/guardrails`. The IR is checked by the
+ * guardrail validator, not here: this schema only says the envelope is right.
+ */
+export declare const AuthoredGuardrailCreateSchema: z.ZodObject<{
+    name: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    ir: z.ZodEffects<z.ZodUnknown, {} | null, unknown>;
+}, "strict", z.ZodTypeAny, {
+    name: string;
+    ir: {} | null;
+    description?: string | null | undefined;
+}, {
+    name: string;
+    ir?: unknown;
+    description?: string | null | undefined;
+}>;
+/**
+ * `PUT /api/v1/policy-guardrails/guardrails/:guardrailId`: any of the three.
+ * A changed IR creates a new version; `description: null` clears it.
+ */
+export declare const AuthoredGuardrailUpdateSchema: z.ZodEffects<z.ZodObject<{
+    name: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>>;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    ir: z.ZodOptional<z.ZodUnknown>;
+}, "strict", z.ZodTypeAny, {
+    name?: string | undefined;
+    ir?: unknown;
+    description?: string | null | undefined;
+}, {
+    name?: string | undefined;
+    ir?: unknown;
+    description?: string | null | undefined;
+}>, {
+    name?: string | undefined;
+    ir?: unknown;
+    description?: string | null | undefined;
+}, {
+    name?: string | undefined;
+    ir?: unknown;
+    description?: string | null | undefined;
+}>;
+export type AuthoredGuardrailCreate = z.infer<typeof AuthoredGuardrailCreateSchema>;
+export type AuthoredGuardrailUpdate = z.infer<typeof AuthoredGuardrailUpdateSchema>;
+/** One named validator check, in the order the checks ran. */
+export interface GuardrailCheckResult {
+    name: string;
+    passed: boolean;
+    detail: string;
+}
+/** `POST …/guardrails/validate`: what a create or an IR edit would be refused for, without writing anything. */
+export interface GuardrailValidationResponse {
+    valid: boolean;
+    validation: GuardrailCheckResult[];
+    /** The enforcer the IR is projected into; null when the IR did not validate. */
+    target: GuardrailTarget | null;
+    /** The artifact the enforcer would read; null when the IR did not validate. */
+    rendered: unknown;
+}
+/** The 400 a create or an IR edit answers with when a check refuses the IR. */
+export interface GuardrailValidationFailure {
+    error: string;
+    code: 'invalid_guardrail';
+    validation: GuardrailCheckResult[];
+}
+/** The answer to an authored create (201) or update (200). */
+export interface AuthoredGuardrailWriteResult {
+    ok: true;
+    guardrail: GuardrailDetail;
+    /** The IR changed: a new version, back in PROPOSED with no evidence, replaced the old one, which is now RETIRED. */
+    forked: boolean;
+    /** The id of the version this one replaced, when `forked`. */
+    supersedes: string | null;
+}
+/** The one promotion rule, as `GET …/thresholds` reports it. */
 export interface GuardrailThresholds {
     minShadowEvaluations: number;
     maxWouldActRate: number;
@@ -76,6 +171,15 @@ export interface GuardrailDocumentRef {
 }
 export interface GuardrailSummary {
     guardrailId: string;
+    provenance: GuardrailProvenance;
+    /** Authored only: the author's label for it. Null for an extracted guardrail, whose label is its document and quote. */
+    name: string | null;
+    /** Authored only: what the rule is for, in the author's words; shown where an extracted guardrail shows its quote. */
+    description: string | null;
+    /** 1 for an extracted guardrail. Each IR edit of an authored guardrail creates the next version under a new id. */
+    version: number;
+    /** The guardrail id of the version this one replaced, or null. */
+    supersedes: string | null;
     target: GuardrailTarget;
     status: GuardrailStatus;
     ir: GuardrailIr;
@@ -87,14 +191,16 @@ export interface GuardrailSummary {
     shadowWouldAct: number;
     enforcingFires: number;
     sourceStale: boolean;
-    /** wasm_rule only: the rule candidate this guardrail was handed to on shadow approval (LLD #71, Wave 7). */
+    /** wasm_rule only: the rule candidate this guardrail was handed to on shadow approval. */
     ruleCandidateId: string | null;
     proposedAt: string;
     shadowAt: string | null;
     promotedAt: string | null;
     rejectedReason: string | null;
-    clause: GuardrailClauseRef;
-    document: GuardrailDocumentRef;
+    /** Null for an authored guardrail: it cites nothing. */
+    clause: GuardrailClauseRef | null;
+    /** Null for an authored guardrail. */
+    document: GuardrailDocumentRef | null;
 }
 export interface GuardrailEvent {
     eventId: string;
@@ -114,10 +220,13 @@ export interface GuardrailDetail extends GuardrailSummary {
     validation: unknown;
     passage: GuardrailPassageRef | null;
     events: GuardrailEvent[];
+    /** The id of the version that replaced this one (an authored guardrail whose IR was edited), or null. */
+    supersededBy: string | null;
 }
 export interface GuardrailListFilters {
     status?: GuardrailStatus;
     target?: GuardrailTarget;
+    provenance?: GuardrailProvenance;
     docId?: string;
     limit?: number;
 }
@@ -268,7 +377,7 @@ export interface TokenCoverage {
     }>;
 }
 /**
- * The ledger's two Jaccard lines (LLD #71): passages at or above the overlap
+ * The ledger's two Jaccard lines: passages at or above the overlap
  * line are recorded as OVERLAPS edges, and a retired passage's successor must
  * clear the near-identical line to be recorded as SUPERSEDES. One definition
  * for the ingest that writes the edges and the duplicates query that reads
@@ -436,5 +545,13 @@ export interface CandidateCitationEvidence {
         documentTitle: string;
     };
 }
+/** A candidate's evidence entry when the guardrail it came from was authored, not extracted: there is no citation to carry. */
+export interface AuthoredCandidateEvidence {
+    authored: {
+        guardrailId: string;
+        name: string;
+        version: number;
+    };
+}
 export declare function isCandidateCitationEvidence(value: unknown): value is CandidateCitationEvidence;
 //# sourceMappingURL=policyGuardrails.d.ts.map

package/dist/policyGuardrails.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policyGuardrails.d.ts","sourceRoot":"","sources":["../src/policyGuardrails.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAEnD,eAAO,MAAM,kBAAkB,qEAAsE,CAAA;AACrG;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,8CAA+C,CAAA;AAEnF;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,eAAe,CAAA;AAEtD,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKpE;AACD,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,8EAA+E,CAAA;AAC7G,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEhE,eAAO,MAAM,qBAAqB,yJAWxB,CAAA;AACV,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEvE,qFAAqF;AACrF,MAAM,WAAW,mBAAmB;IAClC,oBAAoB,EAAE,MAAM,CAAA;IAC5B,eAAe,EAAE,MAAM,CAAA;IACvB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,+BAA+B,EAAE,MAAM,CAAA;CACxC;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,mBAAmB,CAAA;IAC9B,IAAI,EAAE;QAAE,oBAAoB,EAAE,MAAM,CAAC;QAAC,oBAAoB,EAAE,MAAM,CAAA;KAAE,CAAA;IACpE,UAAU,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,eAAe,CAAA;IACvB,MAAM,EAAE,eAAe,CAAA;IACvB,EAAE,EAAE,WAAW,CAAA;IACf,uIAAuI;IACvI,QAAQ,EAAE,OAAO,CAAA;IACjB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,iBAAiB,EAAE,MAAM,CAAA;IACzB,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,OAAO,CAAA;IACpB,4GAA4G;IAC5G,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,MAAM,EAAE,kBAAkB,CAAA;IAC1B,QAAQ,EAAE,oBAAoB,CAAA;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,kBAAkB,CAAA;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,MAAM,EAAE,OAAO,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD,4DAA4D;IAC5D,UAAU,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAAA;IACnC,MAAM,EAAE,cAAc,EAAE,CAAA;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,eAAe,CAAA;IACxB,MAAM,CAAC,EAAE,eAAe,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAA;IACd,oEAAoE;IACpE,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,kGAAkG;IAClG,UAAU,EAAE,OAAO,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,cAAc,EAAE,MAAM,CAAA;IACtB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,mBAAmB,CAAA;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,iJAAiJ;IACjJ,MAAM,EAAE,iBAAiB,GAAG,mBAAmB,GAAG,kBAAkB,GAAG,MAAM,CAAA;IAC7E,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAChE,SAAS,EAAE,OAAO,CAAA;IAClB,0HAA0H;IAC1H,WAAW,EAAE,MAAM,EAAE,CAAA;CACtB;AAED,MAAM,MAAM,qBAAqB,GAAG,eAAe,GAAG,mBAAmB,GAAG,qBAAqB,GAAG,+BAA+B,CAAA;AAEnI,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,qBAAqB,CAAA;IAC3B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IAChC,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IAChC,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,gBAAgB,EAAE,OAAO,CAAA;IACzB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,MAAM,CAAA;IACtB,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAA;CACvC;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,OAAO,CAAA;IACf,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,EAAE,EAAE,OAAO,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,OAAO,CAAA;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,sBAAuB,SAAQ,sBAAsB;IACpE,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,oBAAqB,SAAQ,qBAAqB;IACjE,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,EAAE,gBAAgB,EAAE,CAAA;IAC5B,OAAO,EAAE,eAAe,EAAE,CAAA;IAC1B,IAAI,EAAE,sBAAsB,EAAE,CAAA;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,aAAa,GAAG,WAAW,GAAG,iBAAiB,GAAG,cAAc,GAAG,IAAI,CAAA;IAChF,GAAG,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IAC1C,cAAc,EAAE,OAAO,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,MAAM,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,oBAAoB,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;IAChF,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IAC5D,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACtI,UAAU,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACtI;AAED;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,MAAM,CAAA;AACzC,eAAO,MAAM,6BAA6B,OAAO,CAAA;AAEjD,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB,IAAI,CAAA;AAExC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,sHAAuH,CAAA;AACrJ,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE/D,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACzJ,0HAA0H;IAC1H,QAAQ,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IAChI,OAAO,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC7I,UAAU,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC5F,yDAAyD;IACzD,QAAQ,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAClH,wEAAwE;IACxE,OAAO,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAA;IAChE,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,cAAc,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IACpF,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,4IAA4I;AAC5I,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;IACxD,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACtH,OAAO,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAClH,UAAU,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACjK,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,oGAAoG;AACpG,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACrJ;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,EAAE,CAAA;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAA;IAClB,sFAAsF;IACtF,YAAY,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAC;QAAC,CAAC,EAAE,mBAAmB,CAAC;QAAC,CAAC,EAAE,mBAAmB,CAAA;KAAE,CAAC,CAAA;IACrJ,gEAAgE;IAChE,QAAQ,EAAE,KAAK,CAAC;QACd,WAAW,EAAE,MAAM,CAAA;QACnB,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,KAAK,CAAC;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC,CAAA;KAC9I,CAAC,CAAA;CACH;AAED,qGAAqG;AACrG,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE;QACR,WAAW,EAAE,MAAM,CAAA;QACnB,KAAK,EAAE,MAAM,CAAA;QACb,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;QACxB,WAAW,EAAE,MAAM,CAAA;QACnB,aAAa,EAAE,MAAM,CAAA;KACtB,CAAA;CACF;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,yBAAyB,CAI9F"}
+{"version":3,"file":"policyGuardrails.d.ts","sourceRoot":"","sources":["../src/policyGuardrails.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAwC,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAEzF,eAAO,MAAM,kBAAkB,qEAAsE,CAAA;AACrG;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,8CAA+C,CAAA;AAEnF;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,eAAe,CAAA;AAEtD,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKpE;AACD,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,8EAA+E,CAAA;AAC7G,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEhE,eAAO,MAAM,qBAAqB,oKAaxB,CAAA;AACV,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEvE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,oCAAqC,CAAA;AACvE,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAA;AAExE,yGAAyG;AACzG,eAAO,MAAM,uBAAuB,KAAkB,CAAA;AACtD,yJAAyJ;AACzJ,eAAO,MAAM,8BAA8B,MAAsB,CAAA;AAWjE;;;GAGG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;EAM/B,CAAA;AAEX;;;GAGG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;EAOiH,CAAA;AAE3J,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAA;AACnF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAA;AAEnF,8DAA8D;AAC9D,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf;AAED,gHAAgH;AAChH,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,OAAO,CAAA;IACd,UAAU,EAAE,oBAAoB,EAAE,CAAA;IAClC,gFAAgF;IAChF,MAAM,EAAE,eAAe,GAAG,IAAI,CAAA;IAC9B,+EAA+E;IAC/E,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED,+EAA+E;AAC/E,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,mBAAmB,CAAA;IACzB,UAAU,EAAE,oBAAoB,EAAE,CAAA;CACnC;AAED,8DAA8D;AAC9D,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,IAAI,CAAA;IACR,SAAS,EAAE,eAAe,CAAA;IAC1B,oHAAoH;IACpH,MAAM,EAAE,OAAO,CAAA;IACf,8DAA8D;IAC9D,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,gEAAgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,oBAAoB,EAAE,MAAM,CAAA;IAC5B,eAAe,EAAE,MAAM,CAAA;IACvB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,+BAA+B,EAAE,MAAM,CAAA;CACxC;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,mBAAmB,CAAA;IAC9B,IAAI,EAAE;QAAE,oBAAoB,EAAE,MAAM,CAAC;QAAC,oBAAoB,EAAE,MAAM,CAAA;KAAE,CAAA;IACpE,UAAU,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,mBAAmB,CAAA;IAC/B,wHAAwH;IACxH,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,sHAAsH;IACtH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,mHAAmH;IACnH,OAAO,EAAE,MAAM,CAAA;IACf,kEAAkE;IAClE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,eAAe,CAAA;IACvB,MAAM,EAAE,eAAe,CAAA;IACvB,EAAE,EAAE,WAAW,CAAA;IACf,uIAAuI;IACvI,QAAQ,EAAE,OAAO,CAAA;IACjB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,iBAAiB,EAAE,MAAM,CAAA;IACzB,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,OAAO,CAAA;IACpB,0FAA0F;IAC1F,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,wDAAwD;IACxD,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAAA;IACjC,sCAAsC;IACtC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAAA;CACtC;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,kBAAkB,CAAA;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,MAAM,EAAE,OAAO,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD,4DAA4D;IAC5D,UAAU,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAAA;IACnC,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,yGAAyG;IACzG,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,eAAe,CAAA;IACxB,MAAM,CAAC,EAAE,eAAe,CAAA;IACxB,UAAU,CAAC,EAAE,mBAAmB,CAAA;IAChC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAA;IACd,oEAAoE;IACpE,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,kGAAkG;IAClG,UAAU,EAAE,OAAO,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,cAAc,EAAE,MAAM,CAAA;IACtB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,mBAAmB,CAAA;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,iJAAiJ;IACjJ,MAAM,EAAE,iBAAiB,GAAG,mBAAmB,GAAG,kBAAkB,GAAG,MAAM,CAAA;IAC7E,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAChE,SAAS,EAAE,OAAO,CAAA;IAClB,0HAA0H;IAC1H,WAAW,EAAE,MAAM,EAAE,CAAA;CACtB;AAED,MAAM,MAAM,qBAAqB,GAAG,eAAe,GAAG,mBAAmB,GAAG,qBAAqB,GAAG,+BAA+B,CAAA;AAEnI,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,qBAAqB,CAAA;IAC3B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IAChC,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IAChC,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,gBAAgB,EAAE,OAAO,CAAA;IACzB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,MAAM,CAAA;IACtB,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAA;CACvC;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,OAAO,CAAA;IACf,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,EAAE,EAAE,OAAO,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,OAAO,CAAA;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,sBAAuB,SAAQ,sBAAsB;IACpE,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,oBAAqB,SAAQ,qBAAqB;IACjE,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,EAAE,gBAAgB,EAAE,CAAA;IAC5B,OAAO,EAAE,eAAe,EAAE,CAAA;IAC1B,IAAI,EAAE,sBAAsB,EAAE,CAAA;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,aAAa,GAAG,WAAW,GAAG,iBAAiB,GAAG,cAAc,GAAG,IAAI,CAAA;IAChF,GAAG,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IAC1C,cAAc,EAAE,OAAO,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,MAAM,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,oBAAoB,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;IAChF,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IAC5D,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACtI,UAAU,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACtI;AAED;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,MAAM,CAAA;AACzC,eAAO,MAAM,6BAA6B,OAAO,CAAA;AAEjD,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB,IAAI,CAAA;AAExC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,sHAAuH,CAAA;AACrJ,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE/D,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACzJ,0HAA0H;IAC1H,QAAQ,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IAChI,OAAO,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC7I,UAAU,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC5F,yDAAyD;IACzD,QAAQ,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAClH,wEAAwE;IACxE,OAAO,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAA;IAChE,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,cAAc,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IACpF,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,4IAA4I;AAC5I,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;IACxD,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACtH,OAAO,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAClH,UAAU,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACjK,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,oGAAoG;AACpG,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACrJ;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,EAAE,CAAA;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAA;IAClB,sFAAsF;IACtF,YAAY,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAC;QAAC,CAAC,EAAE,mBAAmB,CAAC;QAAC,CAAC,EAAE,mBAAmB,CAAA;KAAE,CAAC,CAAA;IACrJ,gEAAgE;IAChE,QAAQ,EAAE,KAAK,CAAC;QACd,WAAW,EAAE,MAAM,CAAA;QACnB,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,KAAK,CAAC;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC,CAAA;KAC9I,CAAC,CAAA;CACH;AAED,qGAAqG;AACrG,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE;QACR,WAAW,EAAE,MAAM,CAAA;QACnB,KAAK,EAAE,MAAM,CAAA;QACb,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;QACxB,WAAW,EAAE,MAAM,CAAA;QACnB,aAAa,EAAE,MAAM,CAAA;KACtB,CAAA;CACF;AAED,+HAA+H;AAC/H,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE;QACR,WAAW,EAAE,MAAM,CAAA;QACnB,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,yBAAyB,CAI9F"}

package/dist/policyGuardrails.js

@@ -1,6 +1,6 @@
 "use strict";
 /**
- * Wire types for the Policy Clause Ledger (LLD #71): what
+ * Wire types for the Policy Clause Ledger: what
  * `/api/v1/policy-guardrails/*` returns, as the control plane, the dashboard
  * page and `intutic guardrails` all read it. The control plane's service
  * imports these rather than declaring its own, so a field cannot drift
@@ -10,15 +10,17 @@
  * that is the casing they emit.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LEDGER_EDGE_TYPES = exports.LEDGER_IMPACT_MAX_DEPTH = exports.LEDGER_NEAR_IDENTICAL_JACCARD = exports.LEDGER_OVERLAP_JACCARD = exports.GUARDRAIL_EVENT_TYPES = exports.GUARDRAIL_TARGETS = exports.GUARDRAIL_SOP_TITLE_PREFIX = exports.LIVE_GUARDRAIL_STATUSES = exports.GUARDRAIL_STATUSES = void 0;
+exports.LEDGER_EDGE_TYPES = exports.LEDGER_IMPACT_MAX_DEPTH = exports.LEDGER_NEAR_IDENTICAL_JACCARD = exports.LEDGER_OVERLAP_JACCARD = exports.AuthoredGuardrailUpdateSchema = exports.AuthoredGuardrailCreateSchema = exports.AUTHORED_DESCRIPTION_MAX_CHARS = exports.AUTHORED_NAME_MAX_CHARS = exports.GUARDRAIL_PROVENANCES = exports.GUARDRAIL_EVENT_TYPES = exports.GUARDRAIL_TARGETS = exports.GUARDRAIL_SOP_TITLE_PREFIX = exports.LIVE_GUARDRAIL_STATUSES = exports.GUARDRAIL_STATUSES = void 0;
 exports.guardrailFileStem = guardrailFileStem;
 exports.guardrailIdFromSopTitle = guardrailIdFromSopTitle;
 exports.isCandidateCitationEvidence = isCandidateCitationEvidence;
+const zod_1 = require("zod");
+const guardrailIr_js_1 = require("./guardrailIr.js");
 exports.GUARDRAIL_STATUSES = ['PROPOSED', 'SHADOW', 'ENFORCING', 'REJECTED', 'RETIRED'];
 /**
  * Statuses in which a guardrail's citation is live — the ones conflicts are
  * reported for and the ones that keep the cited document from being written
- * back over (LLD #71, Wave 8). A rejected proposal does not freeze a source.
+ * back over. A rejected proposal does not freeze a source.
  */
 exports.LIVE_GUARDRAIL_STATUSES = ['PROPOSED', 'SHADOW', 'ENFORCING'];
 /**
@@ -46,7 +48,7 @@ function guardrailIdFromSopTitle(title) {
     return stem ? stem[1] : null;
 }
 /**
- * `workspace_setting` (TD-474 item 2) is the one target no rule endpoint
+ * `workspace_setting` is the one target no rule endpoint
  * projects: an `allowed_models` or `egress_allow` guardrail is written into
  * the workspace setting the proxy already enforces when a member promotes it,
  * and unwound when it is retired.
@@ -61,11 +63,62 @@ exports.GUARDRAIL_EVENT_TYPES = [
     'SOURCE_STALE',
     'SOURCE_RECONFIRMED',
     'CITATION_REBOUND',
-    /** The stored render was recomputed by the current renderer (TD-478); shadow evidence gathered under the old render was reset. */
+    /** The stored render was recomputed by the current renderer; shadow evidence gathered under the old render was reset. */
     'RENDER_REBOUND',
+    /** An authored guardrail's name or description changed in place; what it enforces did not. */
+    'UPDATED',
 ];
 /**
- * The ledger's two Jaccard lines (LLD #71): passages at or above the overlap
+ * Where a guardrail came from.
+ *
+ * - `extracted`: compiled from a cited clause of a policy document. It stands
+ *   on a passage, carries the quote, and goes stale when the passage changes.
+ * - `authored`: written directly by an OWNER or ADMIN (API, CLI, Terraform or
+ *   the dashboard). It has a name and an optional description instead of a
+ *   citation, and is held to the same IR and the same validator — minus the
+ *   checks that ground a model's proposal in the passage it was shown, which
+ *   have nothing to read.
+ *
+ * Both start PROPOSED and move through the same transitions on the same
+ * evidence.
+ */
+exports.GUARDRAIL_PROVENANCES = ['extracted', 'authored'];
+/** An authored guardrail's name is a one-line label: it titles the projected SOP and the review card. */
+exports.AUTHORED_NAME_MAX_CHARS = guardrailIr_js_1.MAX_TITLE_CHARS;
+/** The description stands where an extracted guardrail's quote stands — in a hook rule's block message, among others — so it has the quote's ceiling. */
+exports.AUTHORED_DESCRIPTION_MAX_CHARS = guardrailIr_js_1.MAX_RATIONALE_CHARS;
+const AuthoredName = zod_1.z
+    .string()
+    .min(1)
+    .max(exports.AUTHORED_NAME_MAX_CHARS)
+    .refine((v) => [...v].every((ch) => ch.charCodeAt(0) >= 0x20 && ch.charCodeAt(0) !== 0x7f), { message: 'a name is one line: no tab, newline or control character' })
+    .refine((v) => v === v.trim(), { message: 'a name has no leading or trailing whitespace' });
+const AuthoredDescription = zod_1.z.string().min(1).max(exports.AUTHORED_DESCRIPTION_MAX_CHARS);
+/**
+ * `POST /api/v1/policy-guardrails/guardrails`. The IR is checked by the
+ * guardrail validator, not here: this schema only says the envelope is right.
+ */
+exports.AuthoredGuardrailCreateSchema = zod_1.z
+    .object({
+    name: AuthoredName,
+    description: AuthoredDescription.nullable().optional(),
+    ir: zod_1.z.unknown().refine((v) => v !== undefined, { message: 'ir is required' }),
+})
+    .strict();
+/**
+ * `PUT /api/v1/policy-guardrails/guardrails/:guardrailId`: any of the three.
+ * A changed IR creates a new version; `description: null` clears it.
+ */
+exports.AuthoredGuardrailUpdateSchema = zod_1.z
+    .object({
+    name: AuthoredName.optional(),
+    description: AuthoredDescription.nullable().optional(),
+    ir: zod_1.z.unknown().optional(),
+})
+    .strict()
+    .refine((v) => v.name !== undefined || v.description !== undefined || v.ir !== undefined, { message: 'nothing to update: send name, description or ir' });
+/**
+ * The ledger's two Jaccard lines: passages at or above the overlap
  * line are recorded as OVERLAPS edges, and a retired passage's successor must
  * clear the near-identical line to be recorded as SUPERSEDES. One definition
  * for the ingest that writes the edges and the duplicates query that reads

package/dist/policyGuardrails.js.map

@@ -1 +1 @@
-{"version":3,"file":"policyGuardrails.js","sourceRoot":"","sources":["../src/policyGuardrails.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAsBH,8CAEC;AAOD,0DAKC;AAgUD,kEAIC;AApWY,QAAA,kBAAkB,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,CAAU,CAAA;AACrG;;;;GAIG;AACU,QAAA,uBAAuB,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,WAAW,CAAU,CAAA;AAEnF;;;;;;GAMG;AACU,QAAA,0BAA0B,GAAG,YAAY,CAAA;AAEtD,oFAAoF;AACpF,SAAgB,iBAAiB,CAAC,WAAmB;IACnD,OAAO,aAAa,WAAW,EAAE,CAAA;AACnC,CAAC;AAED;;;;GAIG;AACH,SAAgB,uBAAuB,CAAC,KAAa;IACnD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAA;IACtE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,CAAC,CAAE,CAAA;IAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAA;IAC7D,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/B,CAAC;AAGD;;;;;GAKG;AACU,QAAA,iBAAiB,GAAG,CAAC,WAAW,EAAE,kBAAkB,EAAE,WAAW,EAAE,mBAAmB,CAAU,CAAA;AAGhG,QAAA,qBAAqB,GAAG;IACnC,UAAU;IACV,iBAAiB;IACjB,UAAU;IACV,UAAU;IACV,SAAS;IACT,cAAc;IACd,oBAAoB;IACpB,kBAAkB;IAClB,kIAAkI;IAClI,gBAAgB;CACR,CAAA;AAgNV;;;;;;GAMG;AACU,QAAA,sBAAsB,GAAG,GAAG,CAAA;AAC5B,QAAA,6BAA6B,GAAG,IAAI,CAAA;AAEjD,4EAA4E;AAC/D,QAAA,uBAAuB,GAAG,CAAC,CAAA;AAExC;;;;;;;;;;;GAWG;AACU,QAAA,iBAAiB,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,CAAU,CAAA;AAgErJ,SAAgB,2BAA2B,CAAC,KAAc;IACxD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACrD,MAAM,CAAC,GAAI,KAAgC,CAAC,QAAQ,CAAA;IACpD,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAyB,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAQ,CAA+B,CAAC,WAAW,KAAK,QAAQ,CAAA;AACjK,CAAC"}
+{"version":3,"file":"policyGuardrails.js","sourceRoot":"","sources":["../src/policyGuardrails.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAuBH,8CAEC;AAOD,0DAKC;AAsbD,kEAIC;AA7dD,6BAAuB;AACvB,qDAAyF;AAE5E,QAAA,kBAAkB,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,CAAU,CAAA;AACrG;;;;GAIG;AACU,QAAA,uBAAuB,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,WAAW,CAAU,CAAA;AAEnF;;;;;;GAMG;AACU,QAAA,0BAA0B,GAAG,YAAY,CAAA;AAEtD,oFAAoF;AACpF,SAAgB,iBAAiB,CAAC,WAAmB;IACnD,OAAO,aAAa,WAAW,EAAE,CAAA;AACnC,CAAC;AAED;;;;GAIG;AACH,SAAgB,uBAAuB,CAAC,KAAa;IACnD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAA;IACtE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,CAAC,CAAE,CAAA;IAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAA;IAC7D,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/B,CAAC;AAGD;;;;;GAKG;AACU,QAAA,iBAAiB,GAAG,CAAC,WAAW,EAAE,kBAAkB,EAAE,WAAW,EAAE,mBAAmB,CAAU,CAAA;AAGhG,QAAA,qBAAqB,GAAG;IACnC,UAAU;IACV,iBAAiB;IACjB,UAAU;IACV,UAAU;IACV,SAAS;IACT,cAAc;IACd,oBAAoB;IACpB,kBAAkB;IAClB,yHAAyH;IACzH,gBAAgB;IAChB,8FAA8F;IAC9F,SAAS;CACD,CAAA;AAGV;;;;;;;;;;;;;GAaG;AACU,QAAA,qBAAqB,GAAG,CAAC,WAAW,EAAE,UAAU,CAAU,CAAA;AAGvE,yGAAyG;AAC5F,QAAA,uBAAuB,GAAG,gCAAe,CAAA;AACtD,yJAAyJ;AAC5I,QAAA,8BAA8B,GAAG,oCAAmB,CAAA;AAEjE,MAAM,YAAY,GAAG,OAAC;KACnB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,+BAAuB,CAAC;KAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC;KACnK,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC,CAAA;AAE7F,MAAM,mBAAmB,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,sCAA8B,CAAC,CAAA;AAEjF;;;GAGG;AACU,QAAA,6BAA6B,GAAG,OAAC;KAC3C,MAAM,CAAC;IACN,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtD,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;CAC9E,CAAC;KACD,MAAM,EAAE,CAAA;AAEX;;;GAGG;AACU,QAAA,6BAA6B,GAAG,OAAC;KAC3C,MAAM,CAAC;IACN,IAAI,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC7B,WAAW,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtD,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,EAAE,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC,CAAA;AAkQ3J;;;;;;GAMG;AACU,QAAA,sBAAsB,GAAG,GAAG,CAAA;AAC5B,QAAA,6BAA6B,GAAG,IAAI,CAAA;AAEjD,4EAA4E;AAC/D,QAAA,uBAAuB,GAAG,CAAC,CAAA;AAExC;;;;;;;;;;;GAWG;AACU,QAAA,iBAAiB,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,CAAU,CAAA;AAyErJ,SAAgB,2BAA2B,CAAC,KAAc;IACxD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACrD,MAAM,CAAC,GAAI,KAAgC,CAAC,QAAQ,CAAA;IACpD,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAyB,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAQ,CAA+B,CAAC,WAAW,KAAK,QAAQ,CAAA;AACjK,CAAC"}

package/dist/posturePresets.js

@@ -121,7 +121,7 @@ exports.COST_POSTURES = [
         name: 'quality-first',
         title: 'Quality first',
         description: 'No routing, no semantic cache: every request is served by the requested ' +
-            'model, fresh, with only byte-identical repeats served from cache.',
+            'model, fresh, with only exact repeats of a whole request served from cache.',
         settings: {},
         featureFlags: {
             ff_bandit_routing: false,

package/dist/posturePresets.js.map

@@ -1 +1 @@
-{"version":3,"file":"posturePresets.js","sourceRoot":"","sources":["../src/posturePresets.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;;AA6HH,kCAGC;AApHD;;GAEG;AACU,QAAA,iBAAiB,GAA6B;IACzD;QACE,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,QAAQ;QACf,WAAW,EACT,iFAAiF;YACjF,2EAA2E;YAC3E,oEAAoE;QACtE,QAAQ,EAAE;YACR,qBAAqB,EAAE,WAAW;YAClC,oBAAoB,EAAE,QAAQ;SAC/B;QACD,qEAAqE;QACrE,mEAAmE;QACnE,uEAAuE;QACvE,+DAA+D;QAC/D,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,YAAY,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,wBAAwB,EAAE,IAAI,EAAE;KAC/E;IACD;QACE,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,UAAU;QACjB,WAAW,EACT,+EAA+E;YAC/E,0EAA0E;YAC1E,6BAA6B;QAC/B,QAAQ,EAAE;YACR,qBAAqB,EAAE,SAAS;YAChC,oBAAoB,EAAE,MAAM;SAC7B;QACD,YAAY,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE;KAC/C;IACD;QACE,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,SAAS;QAChB,WAAW,EACT,gFAAgF;YAChF,gFAAgF;YAChF,4EAA4E;QAC9E,QAAQ,EAAE;YACR,qBAAqB,EAAE,YAAY;YACnC,oBAAoB,EAAE,MAAM;SAC7B;QACD,YAAY,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE;KAC9C;CACO,CAAA;AAEV;;;;;;;GAOG;AACU,QAAA,aAAa,GAA6B;IACrD;QACE,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,aAAa;QACpB,WAAW,EACT,yEAAyE;YACzE,2EAA2E;YAC3E,gFAAgF;QAClF,QAAQ,EAAE,EAAE;QACZ,YAAY,EAAE;YACZ,iBAAiB,EAAE,IAAI;YACvB,iBAAiB,EAAE,KAAK;YACxB,uBAAuB,EAAE,IAAI;YAC7B,0BAA0B,EAAE,IAAI;SACjC;KACF;IACD;QACE,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,UAAU;QACjB,WAAW,EACT,8EAA8E;YAC9E,8EAA8E;YAC9E,+CAA+C;QACjD,QAAQ,EAAE,EAAE;QACZ,YAAY,EAAE;YACZ,iBAAiB,EAAE,KAAK;YACxB,iBAAiB,EAAE,IAAI;YACvB,uBAAuB,EAAE,IAAI;YAC7B,0BAA0B,EAAE,KAAK;SAClC;KACF;IACD;QACE,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,0EAA0E;YAC1E,mEAAmE;QACrE,QAAQ,EAAE,EAAE;QACZ,YAAY,EAAE;YACZ,iBAAiB,EAAE,KAAK;YACxB,iBAAiB,EAAE,KAAK;YACxB,uBAAuB,EAAE,IAAI;YAC7B,0BAA0B,EAAE,KAAK;SAClC;KACF;CACO,CAAA;AAIV,yEAAyE;AACzE,SAAgB,WAAW,CAAC,IAAiB,EAAE,IAAY;IACzD,MAAM,GAAG,GAAG,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,yBAAiB,CAAC,CAAC,CAAC,qBAAa,CAAA;IACnE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;AACzC,CAAC"}
+{"version":3,"file":"posturePresets.js","sourceRoot":"","sources":["../src/posturePresets.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;;AA6HH,kCAGC;AApHD;;GAEG;AACU,QAAA,iBAAiB,GAA6B;IACzD;QACE,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,QAAQ;QACf,WAAW,EACT,iFAAiF;YACjF,2EAA2E;YAC3E,oEAAoE;QACtE,QAAQ,EAAE;YACR,qBAAqB,EAAE,WAAW;YAClC,oBAAoB,EAAE,QAAQ;SAC/B;QACD,qEAAqE;QACrE,mEAAmE;QACnE,uEAAuE;QACvE,+DAA+D;QAC/D,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,YAAY,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,wBAAwB,EAAE,IAAI,EAAE;KAC/E;IACD;QACE,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,UAAU;QACjB,WAAW,EACT,+EAA+E;YAC/E,0EAA0E;YAC1E,6BAA6B;QAC/B,QAAQ,EAAE;YACR,qBAAqB,EAAE,SAAS;YAChC,oBAAoB,EAAE,MAAM;SAC7B;QACD,YAAY,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE;KAC/C;IACD;QACE,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,SAAS;QAChB,WAAW,EACT,gFAAgF;YAChF,gFAAgF;YAChF,4EAA4E;QAC9E,QAAQ,EAAE;YACR,qBAAqB,EAAE,YAAY;YACnC,oBAAoB,EAAE,MAAM;SAC7B;QACD,YAAY,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE;KAC9C;CACO,CAAA;AAEV;;;;;;;GAOG;AACU,QAAA,aAAa,GAA6B;IACrD;QACE,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,aAAa;QACpB,WAAW,EACT,yEAAyE;YACzE,2EAA2E;YAC3E,gFAAgF;QAClF,QAAQ,EAAE,EAAE;QACZ,YAAY,EAAE;YACZ,iBAAiB,EAAE,IAAI;YACvB,iBAAiB,EAAE,KAAK;YACxB,uBAAuB,EAAE,IAAI;YAC7B,0BAA0B,EAAE,IAAI;SACjC;KACF;IACD;QACE,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,UAAU;QACjB,WAAW,EACT,8EAA8E;YAC9E,8EAA8E;YAC9E,+CAA+C;QACjD,QAAQ,EAAE,EAAE;QACZ,YAAY,EAAE;YACZ,iBAAiB,EAAE,KAAK;YACxB,iBAAiB,EAAE,IAAI;YACvB,uBAAuB,EAAE,IAAI;YAC7B,0BAA0B,EAAE,KAAK;SAClC;KACF;IACD;QACE,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,0EAA0E;YAC1E,6EAA6E;QAC/E,QAAQ,EAAE,EAAE;QACZ,YAAY,EAAE;YACZ,iBAAiB,EAAE,KAAK;YACxB,iBAAiB,EAAE,KAAK;YACxB,uBAAuB,EAAE,IAAI;YAC7B,0BAA0B,EAAE,KAAK;SAClC;KACF;CACO,CAAA;AAIV,yEAAyE;AACzE,SAAgB,WAAW,CAAC,IAAiB,EAAE,IAAY;IACzD,MAAM,GAAG,GAAG,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,yBAAiB,CAAC,CAAC,CAAC,qBAAa,CAAA;IACnE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;AACzC,CAAC"}

package/dist/providerVerification.d.ts

@@ -1,5 +1,5 @@
 /**
- * Provider credential verification (LLD #70, model catalog & cohort wizard).
+ * Provider credential verification (model catalog & cohort wizard).
  *
  * Pure, network-free description of how to check whether a credential works —
  * the cheapest authenticated call each provider's own API exposes. Two
@@ -29,8 +29,16 @@ export interface ProviderProbeRequest {
     url: string;
     method: 'GET' | 'POST';
     headers: Record<string, string>;
-    /** Present only for POST probes (currently: Anthropic's 1-token message). */
+    /** Present only for POST probes (the cloud token and STS calls). */
     body?: string;
+    /** A provider-specific reading of the answer; `classifyProbeResponse` otherwise. */
+    classify?: (status: number, headers: {
+        get(name: string): string | null;
+    }) => ProbeVerdict;
+    /** What a `valid` answer proves, when it is narrower than "the credential works". */
+    validDetail?: string;
+    /** Decided without a request (a key that cannot be used at all); nothing is sent. */
+    localVerdict?: ProbeVerdict;
 }
 /**
  * Build the cheapest authenticated request that proves a credential works,
@@ -38,18 +46,36 @@ export interface ProviderProbeRequest {
  *
  * `fields` is the provider's credential field map exactly as stored — the
  * same shape `PROVIDER_REGISTRY`'s `ProviderCredentialField.key`s describe
- * (`providers.ts`), e.g. `{ apiKey: '...' }` for Anthropic, `{ apiKey, endpoint,
- * deploymentName }` for Azure OpenAI.
+ * (`providers.ts`), e.g. `{ apiKey: '...' }` for Anthropic, `{ apiKey, endpoint }`
+ * for Azure OpenAI.
  *
- * Bedrock and Vertex AI return `null`: verifying them means SigV4 request
- * signing or a GCP OAuth2/JWT exchange, neither of which exists anywhere in
- * this codebase yet (the same "real per-provider engineering, not a config
- * change" boundary LLD #67 §3 draws around routing those two providers). A
- * caller seeing `null` should say "cannot verify automatically," not fail
- * the credential.
+ * Bedrock and Vertex AI return `null` here: their probe is signed per
+ * request, which takes WebCrypto and is asynchronous — see
+ * `buildVerificationProbeAsync`, which every executor calls. A caller seeing
+ * `null` from that should say "cannot verify automatically," not fail the
+ * credential.
  */
 export declare function buildVerificationProbe(provider: string, fields: Record<string, string>): ProviderProbeRequest | null;
 export type ProbeVerdict = 'valid' | 'invalid' | 'unknown';
+/**
+ * The model ids in a provider's list-models answer (the body a `valid`
+ * verification probe got back), deduplicated and sorted; `null` when this
+ * provider's probe does not list the models a request can name, or the body
+ * is not the expected shape.
+ *
+ * Azure OpenAI's probe lists base models, while a request names a deployment,
+ * so its list would mislead; Bedrock and Vertex AI probe identity, not models.
+ */
+export declare function parseProviderModels(provider: string, body: unknown): string[] | null;
+/**
+ * The probe for any provider: a signed cloud probe for Bedrock and Vertex AI
+ * (`cloudProbe.ts`), the plain request description otherwise.
+ */
+export declare function buildVerificationProbeAsync(provider: string, fields: Record<string, string>, now?: Date): Promise<ProviderProbeRequest | null>;
+/** The verdict for a probe's answer: the probe's own reading when it has one. */
+export declare function classifyProbe(probe: ProviderProbeRequest, status: number, headers?: {
+    get(name: string): string | null;
+}): ProbeVerdict;
 /**
  * Classify a probe's HTTP response. Deliberately narrow about what counts as
  * "invalid": only 401/403 mean the credential itself is wrong. A 429

package/dist/providerVerification.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providerVerification.d.ts","sourceRoot":"","sources":["../src/providerVerification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAiBH,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,KAAK,GAAG,MAAM,CAAA;IACtB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,oBAAoB,GAAG,IAAI,CAkH7B;AAED,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAA;AAE1D;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAItE"}
+{"version":3,"file":"providerVerification.d.ts","sourceRoot":"","sources":["../src/providerVerification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAmBH,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,KAAK,GAAG,MAAM,CAAA;IACtB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,oFAAoF;IACpF,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,KAAK,YAAY,CAAA;IAC1F,qFAAqF;IACrF,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,qFAAqF;IACrF,YAAY,CAAC,EAAE,YAAY,CAAA;CAC5B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,oBAAoB,GAAG,IAAI,CA6G7B;AAED,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAA;AAe1D;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,IAAI,CAuBpF;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAEtC;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAC3B,KAAK,EAAE,oBAAoB,EAC3B,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;CAAE,GAC7C,YAAY,CAId;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAItE"}

package/dist/providerVerification.js

@@ -1,6 +1,6 @@
 "use strict";
 /**
- * Provider credential verification (LLD #70, model catalog & cohort wizard).
+ * Provider credential verification (model catalog & cohort wizard).
  *
  * Pure, network-free description of how to check whether a credential works —
  * the cheapest authenticated call each provider's own API exposes. Two
@@ -28,7 +28,11 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildVerificationProbe = buildVerificationProbe;
+exports.parseProviderModels = parseProviderModels;
+exports.buildVerificationProbeAsync = buildVerificationProbeAsync;
+exports.classifyProbe = classifyProbe;
 exports.classifyProbeResponse = classifyProbeResponse;
+const cloudProbe_js_1 = require("./cloudProbe.js");
 /**
  * Strip trailing `/` characters, without a regex. `endpoint`/`apiBase` are
  * workspace-provisioned credential fields — CodeQL correctly flagged the
@@ -50,15 +54,14 @@ function stripTrailingSlashes(s) {
  *
  * `fields` is the provider's credential field map exactly as stored — the
  * same shape `PROVIDER_REGISTRY`'s `ProviderCredentialField.key`s describe
- * (`providers.ts`), e.g. `{ apiKey: '...' }` for Anthropic, `{ apiKey, endpoint,
- * deploymentName }` for Azure OpenAI.
+ * (`providers.ts`), e.g. `{ apiKey: '...' }` for Anthropic, `{ apiKey, endpoint }`
+ * for Azure OpenAI.
  *
- * Bedrock and Vertex AI return `null`: verifying them means SigV4 request
- * signing or a GCP OAuth2/JWT exchange, neither of which exists anywhere in
- * this codebase yet (the same "real per-provider engineering, not a config
- * change" boundary LLD #67 §3 draws around routing those two providers). A
- * caller seeing `null` should say "cannot verify automatically," not fail
- * the credential.
+ * Bedrock and Vertex AI return `null` here: their probe is signed per
+ * request, which takes WebCrypto and is asynchronous — see
+ * `buildVerificationProbeAsync`, which every executor calls. A caller seeing
+ * `null` from that should say "cannot verify automatically," not fail the
+ * credential.
  */
 function buildVerificationProbe(provider, fields) {
     switch (provider) {
@@ -66,21 +69,16 @@ function buildVerificationProbe(provider, fields) {
             const apiKey = fields.apiKey;
             if (!apiKey)
                 return null;
-            // Anthropic's API has no /v1/models endpoint to probe cheaply, so the
-            // cheapest real call is a 1-max-token message — costs about one token.
+            // Listing models is the cheapest authenticated call Anthropic has: it
+            // spends no tokens, and the answer says which models the key reaches.
+            // 1000 is the page-size ceiling, enough for the whole catalog in one call.
             return {
-                url: 'https://api.anthropic.com/v1/messages',
-                method: 'POST',
+                url: 'https://api.anthropic.com/v1/models?limit=1000',
+                method: 'GET',
                 headers: {
                     'x-api-key': apiKey,
                     'anthropic-version': '2023-06-01',
-                    'content-type': 'application/json',
                 },
-                body: JSON.stringify({
-                    model: 'claude-haiku-4-5',
-                    max_tokens: 1,
-                    messages: [{ role: 'user', content: 'hi' }],
-                }),
             };
         }
         case 'openai': {
@@ -138,7 +136,7 @@ function buildVerificationProbe(provider, fields) {
             if (!apiKey)
                 return null;
             return {
-                url: `https://generativelanguage.googleapis.com/v1beta/models?key=${encodeURIComponent(apiKey)}`,
+                url: `https://generativelanguage.googleapis.com/v1beta/models?pageSize=1000&key=${encodeURIComponent(apiKey)}`,
                 method: 'GET',
                 headers: {},
             };
@@ -174,6 +172,68 @@ function buildVerificationProbe(provider, fields) {
             return null;
     }
 }
+/** `body[listKey][].{idKey}` values that are non-empty strings. */
+function pluck(body, listKey, idKey) {
+    if (typeof body !== 'object' || body === null)
+        return null;
+    const list = body[listKey];
+    if (!Array.isArray(list))
+        return null;
+    const ids = [];
+    for (const entry of list) {
+        const id = typeof entry === 'object' && entry !== null ? entry[idKey] : undefined;
+        if (typeof id === 'string' && id.length > 0)
+            ids.push(id);
+    }
+    return ids;
+}
+/**
+ * The model ids in a provider's list-models answer (the body a `valid`
+ * verification probe got back), deduplicated and sorted; `null` when this
+ * provider's probe does not list the models a request can name, or the body
+ * is not the expected shape.
+ *
+ * Azure OpenAI's probe lists base models, while a request names a deployment,
+ * so its list would mislead; Bedrock and Vertex AI probe identity, not models.
+ */
+function parseProviderModels(provider, body) {
+    let ids;
+    switch (provider) {
+        case 'anthropic':
+        case 'openai':
+        case 'mistral':
+        case 'openrouter':
+        case 'deepseek':
+            ids = pluck(body, 'data', 'id');
+            break;
+        case 'gemini':
+            // Gemini names a model `models/gemini-2.5-pro`; requests use the bare id.
+            ids = pluck(body, 'models', 'name')?.map((n) => (n.startsWith('models/') ? n.slice('models/'.length) : n)) ?? null;
+            break;
+        case 'cohere':
+        case 'ollama':
+            ids = pluck(body, 'models', 'name');
+            break;
+        default:
+            return null;
+    }
+    if (!ids)
+        return null;
+    return [...new Set(ids.filter((id) => id.length > 0))].sort();
+}
+/**
+ * The probe for any provider: a signed cloud probe for Bedrock and Vertex AI
+ * (`cloudProbe.ts`), the plain request description otherwise.
+ */
+async function buildVerificationProbeAsync(provider, fields, now = new Date()) {
+    return (await (0, cloudProbe_js_1.buildCloudVerificationProbe)(provider, fields, now)) ?? buildVerificationProbe(provider, fields);
+}
+/** The verdict for a probe's answer: the probe's own reading when it has one. */
+function classifyProbe(probe, status, headers) {
+    return probe.classify
+        ? probe.classify(status, headers ?? { get: () => null })
+        : classifyProbeResponse(status);
+}
 /**
  * Classify a probe's HTTP response. Deliberately narrow about what counts as
  * "invalid": only 401/403 mean the credential itself is wrong. A 429