@nac3/forge-cli 0.2.1-alpha.60 → 1.0.0

package/dist/docs/doctrine/office-tools.md

@@ -100,3 +100,23 @@ similar. The verbs are cross-platform; no shell needed.
   the doc is long.
 - Pair `office.*.write` with R8 modal (policy=approval-required;
   user confirms before disk write).
+
+## Opening vs reading (desktop.open vs office.*.read)
+
+There are TWO different intents -- pick by what the user wants:
+
+- **OPEN / SHOW it to the user** ("abri la planilla", "open this Excel",
+  "show me the doc") -> `desktop.open({target})`. It launches the file
+  in its native app (.xlsx -> Excel, .docx -> Word, .pdf -> the viewer)
+  or, for a Google Sheets/Docs URL or a `.gsheet`/`.gdoc` shortcut, in
+  the browser. This is the right move when the human wants to SEE it.
+
+- **READ / COMPUTE over the data** ("what's the total", "extract the
+  rows", "summarize the doc") -> `office.excel.read` / `office.word.read`
+  / `office.pdf.read`. These return structured data for YOU to reason
+  over.
+
+NEVER open a binary office file as a pizarron editor tab
+(`forge_open_file_for_editor` / fs.read-file): the bytes render as
+noise and FREEZE the panel (PND-102). The open-file verb now refuses
+office/binary extensions and points here.

package/dist/docs/doctrine/verb-composition.md

@@ -59,6 +59,22 @@ In those cases, invoke `yujin.shell.exec` directly. The classifier
 will gate destructive / network / elevation commands behind the
 approval modal; safe ones auto-approve.
 
+## Long-running commands -> yujin.task.run (MANDATORY)
+
+`yujin.shell.exec` runs SYNCHRONOUSLY: it blocks the turn and the
+child process is killed when the turn ends. So a command that does NOT
+terminate on its own -- a dev server, a watcher, `tail -f`, a tunnel
+(`npm/pnpm run dev|start|serve|watch`, `expo start`, `vite`,
+`next dev`, `nodemon`, `wrangler dev`, `docker compose up`,
+`cloudflared tunnel`, ...) -- MUST be launched with `yujin.task.run`,
+which runs it detached so it SURVIVES the turn. Follow it with
+`yujin.task.status` / `yujin.task.list`; the user stops or deletes it
+from the Tareas tab in the pizarron.
+
+shell.exec ENFORCES this: it refuses such commands and points you to
+`yujin.task.run` (error `long_running_must_use_task`). Only pass
+`allow_long_running:true` in the rare case you truly need it in-turn.
+
 ## When to fetch this doctrine
 
 Fetch when:

package/dist/docs/doctrine/workflow-kinds.md

@@ -21,32 +21,49 @@ changed. No doc drift.
 
 ## How Forge decides + acts
 
-1. **Classify + ASK.** From the request + whether the project has
-   code, suggest a kind (the classifier is `src/workflow/select.ts`).
-   When confidence is low, ASK the user "esto es correctivo o
-   evolutivo?" before committing. Do NOT silently assume.
-2. **Set the kind.** Persist with `yujin.workflow.set({group:"kind",
-   patch:{kind:"corrective"}, top_level:true})`.
-3. **Run the right workflow.** Greenfield -> the 18-step flow.
-   corrective/evolutive -> the compact 6-stage flow above.
-4. **Log the evolution.** As you cross each stage/step boundary,
-   call `yujin.workflow.log-step({kind, stage_id, step_id?, event,
-   content})`. It writes the per-project doc `docs/WORKFLOW_LOG.md`
-   (auditable) + the mirror in `workflow.evolution[]`. The project
-   then documents its own workflow evolution -- steps + stages with
-   start/end/content.
+The orchestration is DETERMINISTIC code (`src/workflow/orchestrator.ts`),
+not LLM judgement. You drive it through verbs:
+
+1. **Open a workflow with `yujin.workflow.start({request})`.** It
+   classifies the kind (regex over the request + whether the project
+   has code -- `src/workflow/select.ts`). When the result is
+   `needs_confirm:true`, ASK the user "greenfield, correctivo o
+   evolutivo?" and call again with `{kind}`. Do NOT silently assume.
+   `start` then creates the instance (WFL-NNN) + **spawns one pending
+   per canonical task, in mandatory order**. Several workflows can
+   coexist (keyed by name) -- a fix and a feature run side by side.
+2. **Stages are NOT pendings; tasks are.** Work the task pendings in
+   order. The `yf pending close` gate REFUSES to close a task while an
+   earlier-order task is still open (override: `--force-order`). When
+   every task closes, the workflow **auto-closes** -- you do not close
+   it by hand.
+3. **Add tasks at discretion.** If the user OR you decide a
+   corrective/evolutive task is needed mid-workflow, add it with
+   `yujin.workflow.add-task({code, title})` -- it appends at the end of
+   the order (flagged `ad_hoc`).
+4. **Edit the phases/tasks on request.** `yujin.workflow.configure({patch})`
+   rewrites the project's editable definitions
+   (`.forge/workflow-config.json`); the code default stays recoverable
+   (`yf workflow config --reset`).
+5. **Log the evolution.** As you cross stage/step boundaries, call
+   `yujin.workflow.log-step(...)` -- it writes `docs/WORKFLOW_LOG.md` +
+   `workflow.evolution[]` so the project records its own workflow
+   history. Greenfield detail = the 18-step flow (`workflow`,
+   `workflow-phases`); never force it on a live project.
 
 ## Relation to the request lifecycle
 
 The pending request-lifecycle (add -> note -> close with history) is
-the MICRO level (per request). The workflow is the MACRO level (per
-project, with stages). They compose: the macro workflow names the
-stage; each request inside it runs the micro lifecycle. Do not
-duplicate -- a corrective run IS a pending item whose work crosses
-the corrective stages.
+the MICRO level (per task). The workflow is the MACRO level (per
+project, with stages). They are now the SAME store: a workflow task IS
+a pending item (with a `workflow` link). The instance names the stages;
+its tasks are pendings closed in mandatory order.
 
 ## Canonical steps source
 
-The canonical step definitions come from the worker (general,
-shared) with a LOCAL fallback (`src/workflow/definitions.ts`) so
-Forge keeps working offline -- same pattern as doctrines + lessons.
+The canonical step definitions live in `src/workflow/definitions.ts`
+(the immutable DEFAULT + disaster-recovery source). A project may
+override them in `.forge/workflow-config.json` (edited via
+`yujin.workflow.configure`); a `.default.json` snapshot keeps the
+default recoverable. The worker-canonical layer plugs in later, same
+pattern as doctrines + lessons.

package/dist/docs/doctrine/workflow.md

@@ -1,8 +1,16 @@
-# Workflow doctrine -- 6 phases / 18 steps
+# Workflow doctrine -- 6 phases / 18 steps (GREENFIELD)
 
-Yujin Forge guides delivery through 6 phases / 18 steps (PRODUCT_WORKFLOW.md).
-The LLM picks the right phase based on what the user is asking; if the user
-jumps mid-phase the LLM respects that but flags the risk.
+SCOPE: this 6-phase / 18-step methodology is the GREENFIELD workflow --
+building a new app from zero. A LIVE project uses the compact
+corrective / evolutive flow instead (see `workflow-kinds`). Never force
+these 18 steps on an existing project. Open any workflow with
+`yujin.workflow.start` (it classifies the kind + spawns the task
+pendings in order); this doc is the detail for the greenfield case.
+
+Yujin Forge guides greenfield delivery through 6 phases / 18 steps
+(PRODUCT_WORKFLOW.md). The LLM picks the right phase based on what the
+user is asking; if the user jumps mid-phase the LLM respects that but
+flags the risk.
 
 PHASE I -- INTAKE (steps 1-3.5)
   1.   Complexity triage           Simple / Medium / Full tier

package/dist/license/auto_sync.d.ts

@@ -0,0 +1,22 @@
+export interface EnsureLicenseOptions {
+    /** Force a sync regardless of the throttle window. */
+    force?: boolean;
+    /** Network timeout. Default 2500ms. */
+    timeoutMs?: number;
+    /** Sink for the transition note. Default: console.error (stderr, so
+     *  it never pollutes a command's stdout / JSON output). */
+    notify?: (line: string) => void;
+}
+/**
+ * Refresh the local license cache if it is stale. Resolves to the new
+ * plan string when a sync ran, or null when it was skipped/failed. Never
+ * throws.
+ */
+export declare function ensureLicenseFresh(opts?: EnsureLicenseOptions): Promise<string | null>;
+/** Resolve the top-level command name for a (possibly nested) leaf. */
+export declare function topLevelName(actionCommand: {
+    name(): string;
+    parent?: unknown;
+} | null): string;
+export declare function shouldAutoSync(topName: string): boolean;
+//# sourceMappingURL=auto_sync.d.ts.map

package/dist/license/auto_sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto_sync.d.ts","sourceRoot":"","sources":["../../src/license/auto_sync.ts"],"names":[],"mappings":"AAwCA,MAAM,WAAW,oBAAoB;IACnC,sDAAsD;IACtD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;+DAC2D;IAC3D,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,GAAE,oBAAyB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4BhG;AAWD,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,aAAa,EAAE;IAAE,IAAI,IAAI,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,GAAG,MAAM,CAS/F;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEvD"}

package/dist/license/auto_sync.js

@@ -0,0 +1,91 @@
+/**
+ * Auto-sync the Polar license, silently, so the user NEVER runs
+ * `yf license sync` by hand.
+ *
+ * Wired as a global Commander `preAction` hook (src/bin/yf.ts): before
+ * any command runs, we opportunistically pull the canonical license row
+ * from HITO 4 and refresh ~/.yujin-forge/license.json. This closes the
+ * gap where a user paid on Polar but the local cache still said "none"
+ * until they manually synced.
+ *
+ * Design rules (zero friction, never get in the way):
+ *   - Best-effort: every error is swallowed. Offline / no handle / no
+ *     server -> the command proceeds with the cached license.
+ *   - Time-boxed: a slow/unreachable server can never hang the CLI.
+ *   - Throttled: we do not hit the network on every keystroke. When the
+ *     plan is already active we refresh at most hourly; when it is not
+ *     active yet (just paid, waiting on the webhook) we retry quickly so
+ *     the paid status is picked up within ~90s of the next command.
+ *   - Silent on no-op; a one-line note only when the plan actually
+ *     transitions (e.g. none -> paid) so the user sees the win.
+ *
+ * ASCII-only.
+ */
+import { readLicense as readPolarLicense, isActive as isPolarActive } from '../core/polar.js';
+import { syncLicense } from './sync.js';
+const FRESH_ACTIVE_MS = 60 * 60 * 1000; /* active plan: refresh hourly */
+const FRESH_INACTIVE_MS = 90 * 1000; /* not active yet: retry fast  */
+const DEFAULT_TIMEOUT_MS = 2500;
+function withTimeout(p, ms) {
+    return new Promise((resolve, reject) => {
+        const t = setTimeout(() => reject(new Error('auto-sync timeout')), ms);
+        p.then((v) => { clearTimeout(t); resolve(v); }, (e) => { clearTimeout(t); reject(e); });
+    });
+}
+/**
+ * Refresh the local license cache if it is stale. Resolves to the new
+ * plan string when a sync ran, or null when it was skipped/failed. Never
+ * throws.
+ */
+export async function ensureLicenseFresh(opts = {}) {
+    try {
+        const local = await readPolarLicense();
+        /* No handle -> we literally cannot ask the server who this is.
+         * The activate flow captures it; until then, nothing to do. */
+        if (!local.user_handle)
+            return null;
+        if (!opts.force) {
+            const active = isPolarActive(local);
+            const window = active ? FRESH_ACTIVE_MS : FRESH_INACTIVE_MS;
+            const lastV = local.last_validated_at ? Date.parse(local.last_validated_at) : 0;
+            if (lastV && Number.isFinite(lastV) && (Date.now() - lastV) < window) {
+                return null; /* still fresh enough */
+            }
+        }
+        const before = local.plan;
+        const report = await withTimeout(syncLicense(), opts.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+        if (!report.ok)
+            return null;
+        if (report.local_plan_after && report.local_plan_after !== before) {
+            const notify = opts.notify ?? ((l) => process.stderr.write(l + '\n'));
+            notify('Forge: license updated (' + before + ' -> ' + report.local_plan_after + ').');
+        }
+        return report.local_plan_after ?? null;
+    }
+    catch {
+        return null; /* offline / not configured / timeout -- proceed quietly */
+    }
+}
+/** Top-level command names that must NOT trigger auto-sync (they either
+ *  manage the license themselves -> recursion, or are pure offline
+ *  utilities where a network probe is unwanted). */
+const SKIP_AUTOSYNC = new Set([
+    'license', /* activate/status/sync/cancel manage the cache directly */
+    'help',
+    'completion',
+]);
+/** Resolve the top-level command name for a (possibly nested) leaf. */
+export function topLevelName(actionCommand) {
+    let cur = actionCommand;
+    let last = cur;
+    /* Walk up until the parent is the root program (parent has no parent). */
+    while (cur && cur.parent) {
+        last = cur;
+        cur = cur.parent ?? null;
+    }
+    return last ? last.name() : '';
+}
+export function shouldAutoSync(topName) {
+    return !SKIP_AUTOSYNC.has(topName);
+}
+//# sourceMappingURL=auto_sync.js.map

package/dist/license/auto_sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto_sync.js","sourceRoot":"","sources":["../../src/license/auto_sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,WAAW,IAAI,gBAAgB,EAAE,QAAQ,IAAI,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAG,iCAAiC;AAC3E,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,CAAC,CAAM,iCAAiC;AAC3E,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,SAAS,WAAW,CAAI,CAAa,EAAE,EAAU;IAC/C,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC,CAAC,IAAI,CACJ,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACvC,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACvC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAYD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAA6B,EAAE;IACtE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACvC;uEAC+D;QAC/D,IAAI,CAAC,KAAK,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAEpC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,iBAAiB,CAAC;YAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAChF,IAAI,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC;gBACrE,OAAO,IAAI,CAAC,CAAC,wBAAwB;YACvC,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;QACtF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAE5B,IAAI,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,gBAAgB,KAAK,MAAM,EAAE,CAAC;YAClE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;YAC9E,MAAM,CAAC,0BAA0B,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,2DAA2D;IAC1E,CAAC;AACH,CAAC;AAED;;oDAEoD;AACpD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS;IACpC,SAAS,EAAI,2DAA2D;IACxE,MAAM;IACN,YAAY;CACb,CAAC,CAAC;AAEH,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAAC,aAA0D;IACrF,IAAI,GAAG,GAAG,aAA4D,CAAC;IACvE,IAAI,IAAI,GAAG,GAAG,CAAC;IACf,0EAA0E;IAC1E,OAAO,GAAG,IAAK,GAA4B,CAAC,MAAM,EAAE,CAAC;QACnD,IAAI,GAAG,GAAG,CAAC;QACX,GAAG,GAAI,GAAyD,CAAC,MAAM,IAAI,IAAI,CAAC;IAClF,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC"}

package/dist/license/handle_key.d.ts

@@ -0,0 +1,32 @@
+/** MUST match the worker + mobile constants exactly. */
+export declare const HANDLE_KEY_SALT = "yf-relay-handle-key:v1";
+export declare const HANDLE_KEY_INFO_PREFIX = "yf-handle:";
+/** Vault slot for the derived per-handle key (v2). */
+export declare const HANDLE_KEY_SLOT = "yf_handle_key";
+/** Vault slot for the legacy global root secret (v1). */
+export declare const ROOT_KEY_SLOT = "yf_server_api_key";
+/** Derive the per-handle signing key (hex) from the global root secret
+ *  and the user handle. node:crypto HKDF-SHA256 -- identical to the
+ *  worker (WebCrypto) + mobile (@noble) derivations. */
+export declare function deriveHandleKey(root: string, handle: string): string;
+/** A vault-like handle (the real Vault or a test fake). set/remove are
+ *  optional so a read-only fake never breaks signing. */
+export interface SigningVaultLike {
+    has(slot: string): boolean;
+    get(slot: string): string;
+    set?(slot: string, value: string): Promise<void>;
+    remove?(slot: string): Promise<boolean>;
+}
+/** Resolve the per-handle signing secret. Prefers the migrated
+ *  `yf_handle_key`; otherwise derives it from the legacy root and
+ *  persists it (best-effort). Returns null when neither slot exists.
+ *  Single source of truth for every desktop signing site, so dropping
+ *  the root later is safe everywhere. */
+export declare function resolveSigningSecret(vault: SigningVaultLike, handle: string): Promise<{
+    secret: string;
+    derivedFromRoot: boolean;
+} | null>;
+/** Drop the legacy root once the per-handle key is persisted -- after
+ *  this the device can no longer sign for any other handle. Best-effort. */
+export declare function dropLegacyRoot(vault: SigningVaultLike): Promise<void>;
+//# sourceMappingURL=handle_key.d.ts.map

package/dist/license/handle_key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handle_key.d.ts","sourceRoot":"","sources":["../../src/license/handle_key.ts"],"names":[],"mappings":"AAcA,wDAAwD;AACxD,eAAO,MAAM,eAAe,2BAA2B,CAAC;AACxD,eAAO,MAAM,sBAAsB,eAAe,CAAC;AAEnD,sDAAsD;AACtD,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAC/C,yDAAyD;AACzD,eAAO,MAAM,aAAa,sBAAsB,CAAC;AAEjD;;wDAEwD;AACxD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAUpE;AAED;yDACyD;AACzD,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1B,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzC;AAED;;;;yCAIyC;AACzC,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GACtC,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAAC,CAQ9D;AAED;4EAC4E;AAC5E,wBAAsB,cAAc,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAI3E"}

package/dist/license/handle_key.js

@@ -0,0 +1,56 @@
+/**
+ * Per-handle signing key derivation -- CLI side (PND-047 / sec 7.1).
+ *
+ * Mirrors packages/hito4-server/src/handle_key.ts (the worker) and
+ * nac3-rn/src/brain_client.ts (the phone): HKDF-SHA256(root, salt, info)
+ * with byte-identical constants so all three derive the SAME per-handle
+ * key. The CLI then signs bearers with this derived key instead of the
+ * raw root, so a tenant only ever holds the key for ITS handle and
+ * cannot impersonate another (HKDF is one-way). See the interop test.
+ *
+ * ASCII-only.
+ */
+import { hkdfSync } from 'node:crypto';
+/** MUST match the worker + mobile constants exactly. */
+export const HANDLE_KEY_SALT = 'yf-relay-handle-key:v1';
+export const HANDLE_KEY_INFO_PREFIX = 'yf-handle:';
+/** Vault slot for the derived per-handle key (v2). */
+export const HANDLE_KEY_SLOT = 'yf_handle_key';
+/** Vault slot for the legacy global root secret (v1). */
+export const ROOT_KEY_SLOT = 'yf_server_api_key';
+/** Derive the per-handle signing key (hex) from the global root secret
+ *  and the user handle. node:crypto HKDF-SHA256 -- identical to the
+ *  worker (WebCrypto) + mobile (@noble) derivations. */
+export function deriveHandleKey(root, handle) {
+    const enc = new TextEncoder();
+    const out = hkdfSync('sha256', enc.encode(root), enc.encode(HANDLE_KEY_SALT), enc.encode(HANDLE_KEY_INFO_PREFIX + handle.toLowerCase()), 32);
+    return Buffer.from(new Uint8Array(out)).toString('hex');
+}
+/** Resolve the per-handle signing secret. Prefers the migrated
+ *  `yf_handle_key`; otherwise derives it from the legacy root and
+ *  persists it (best-effort). Returns null when neither slot exists.
+ *  Single source of truth for every desktop signing site, so dropping
+ *  the root later is safe everywhere. */
+export async function resolveSigningSecret(vault, handle) {
+    if (vault.has(HANDLE_KEY_SLOT))
+        return { secret: vault.get(HANDLE_KEY_SLOT), derivedFromRoot: false };
+    if (vault.has(ROOT_KEY_SLOT)) {
+        const secret = deriveHandleKey(vault.get(ROOT_KEY_SLOT), handle);
+        try {
+            await vault.set?.(HANDLE_KEY_SLOT, secret);
+        }
+        catch { /* read-only fake */ }
+        return { secret, derivedFromRoot: true };
+    }
+    return null;
+}
+/** Drop the legacy root once the per-handle key is persisted -- after
+ *  this the device can no longer sign for any other handle. Best-effort. */
+export async function dropLegacyRoot(vault) {
+    try {
+        if (vault.has(HANDLE_KEY_SLOT) && vault.has(ROOT_KEY_SLOT))
+            await vault.remove?.(ROOT_KEY_SLOT);
+    }
+    catch { /* best-effort -- a later call retries */ }
+}
+//# sourceMappingURL=handle_key.js.map

package/dist/license/handle_key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handle_key.js","sourceRoot":"","sources":["../../src/license/handle_key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,wDAAwD;AACxD,MAAM,CAAC,MAAM,eAAe,GAAG,wBAAwB,CAAC;AACxD,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAEnD,sDAAsD;AACtD,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AAC/C,yDAAyD;AACzD,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAEjD;;wDAEwD;AACxD,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,MAAc;IAC1D,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,QAAQ,CAClB,QAAQ,EACR,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAChB,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAC3B,GAAG,CAAC,MAAM,CAAC,sBAAsB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,EACzD,EAAE,CACH,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAWD;;;;yCAIyC;AACzC,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAuB,EAAE,MAAc;IAEvC,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IACtG,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;QAClF,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;4EAC4E;AAC5E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAuB;IAC1D,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC;YAAE,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC,aAAa,CAAC,CAAC;IAClG,CAAC;IAAC,MAAM,CAAC,CAAC,yCAAyC,CAAC,CAAC;AACvD,CAAC"}

package/dist/license/hito4_client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hito4_client.d.ts","sourceRoot":"","sources":["../../src/license/hito4_client.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAG1C,OAAO,KAAK,EAAyB,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAGrF,eAAO,MAAM,cAAc,QAA8E,CAAC;AAiB1G,UAAU,aAAa;IACrB,QAAQ,EAAE,aAAa,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;gDAEgD;AAChD,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,aAAa,CAAC,CAelE;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;IACnC;qDACiD;IACjD,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA+BD,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,GAAE,MAAmB,GAAG,MAAM,CAG1F;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED;;;;;;8CAM8C;AAC9C,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,GAAE,eAAoB,GACvD,OAAO,CAAC,cAAc,CAAC,CAqBzB;AA+BD;;;qEAGqE;AACrE,wBAAsB,aAAa,CACjC,IAAI,GAAE,eAAe,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9C,OAAO,CAAC,cAAc,CAAC,CAiBzB;AAED;qDACqD;AACrD,wBAAsB,kBAAkB,CAAC,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAc5F"}
+{"version":3,"file":"hito4_client.d.ts","sourceRoot":"","sources":["../../src/license/hito4_client.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAO1C,OAAO,KAAK,EAAyB,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAGrF,eAAO,MAAM,cAAc,QAA8E,CAAC;AAiC1G,UAAU,aAAa;IACrB,QAAQ,EAAE,aAAa,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;gDAEgD;AAChD,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,aAAa,CAAC,CAoBlE;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;IACnC;qDACiD;IACjD,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAsDD,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,GAAE,MAAmB,GAAG,MAAM,CAG1F;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED;;;;;;8CAM8C;AAC9C,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,GAAE,eAAoB,GACvD,OAAO,CAAC,cAAc,CAAC,CAsBzB;AA+BD;;;qEAGqE;AACrE,wBAAsB,aAAa,CACjC,IAAI,GAAE,eAAe,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9C,OAAO,CAAC,cAAc,CAAC,CAkBzB;AAED;qDACqD;AACrD,wBAAsB,kBAAkB,CAAC,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAe5F"}

package/dist/license/hito4_client.js

@@ -24,10 +24,25 @@ import path from 'node:path';
 import os from 'node:os';
 import { Vault } from '../vault/store.js';
 import { configDir } from './index.js';
+import { HANDLE_KEY_SLOT, ROOT_KEY_SLOT, resolveSigningSecret, dropLegacyRoot, } from './handle_key.js';
 import { readLicense } from '../core/polar.js';
 import { renderForgeError, E_WORKER_UNREACHABLE } from '../core/error_catalog.js';
 export const HITO4_BASE_URL = process.env.YF_HITO4_BASE_URL ?? 'https://yujin-hito4.yujinapp.workers.dev';
-const SECRET_SLOT = 'yf_server_api_key';
+/* PND-051 (sec 7.8) -- the worker carries BYOK key material + bearer
+ * tokens. If an operator overrides the base URL to plain http (or any
+ * non-https, non-loopback scheme) the traffic is interceptable; warn
+ * loudly once at module load. Loopback http is allowed for local dev. */
+(() => {
+    try {
+        const u = new URL(HITO4_BASE_URL);
+        const isLoopback = u.hostname === '127.0.0.1' || u.hostname === 'localhost' || u.hostname === '::1';
+        if (u.protocol !== 'https:' && !isLoopback) {
+            console.warn('[hito4] WARNING: YF_HITO4_BASE_URL is not https (' + u.protocol + '//' + u.hostname
+                + '). BYOK keys + bearer tokens would travel in clear. Use https.');
+        }
+    }
+    catch { /* malformed override -- callers fail later with a clear error */ }
+})();
 /** Read the local plaintext provider keys cache. The mobile
  *  equivalent is the `useProviderKeys` hook. Returns null if
  *  the file does not exist yet (user has not run keys setup). */
@@ -47,29 +62,32 @@ async function readLocalProviderKeys() {
  *  the current request. Mirrors the mobile-side logic that
  *  reads from the encrypted keys-sync cache. */
 export async function resolveBrainHeaders() {
+    /* PND-051 -- the SECRET key value now comes from the encrypted Vault
+     * (src/core/provider_keys.ts), NOT the plaintext provider_keys.json.
+     * The file keeps only the NON-secret metadata (which provider is
+     * preferred + the model alias). */
     const cache = await readLocalProviderKeys();
-    if (!cache)
-        return { provider: null, apiKey: null, modelAlias: null };
-    const provider = (cache.brain_provider_preference ?? null);
+    const provider = (cache?.brain_provider_preference ?? null);
     if (!provider)
         return { provider: null, apiKey: null, modelAlias: null };
-    let apiKey;
+    const { getKey } = await import('../core/provider_keys.js');
+    let apiKey = null;
     let modelAlias;
     if (provider === 'anthropic') {
-        apiKey = cache.anthropic_api_key;
-        modelAlias = cache.anthropic_model_preference;
+        apiKey = await getKey('anthropic_api_key');
+        modelAlias = cache?.anthropic_model_preference;
     }
     else if (provider === 'openai') {
-        apiKey = cache.openai_api_key;
-        modelAlias = cache.openai_brain_model_preference;
+        apiKey = await getKey('openai_api_key');
+        modelAlias = cache?.openai_brain_model_preference;
     }
     else if (provider === 'google') {
-        apiKey = cache.google_ai_key;
-        modelAlias = cache.google_brain_model_preference;
+        apiKey = await getKey('google_ai_key');
+        modelAlias = cache?.google_brain_model_preference;
     }
     else if (provider === 'deepseek') {
-        apiKey = cache.deepseek_api_key;
-        modelAlias = cache.deepseek_model_preference;
+        apiKey = await getKey('deepseek_api_key');
+        modelAlias = cache?.deepseek_model_preference;
     }
     return {
         provider,
@@ -80,15 +98,29 @@ export async function resolveBrainHeaders() {
 function hmacHex(secret, msg) {
     return createHmac('sha256', secret).update(msg).digest('hex');
 }
-async function getSecret(deps) {
+/** PND-047 -- resolve the per-handle signing key. Prefers the migrated
+ *  `yf_handle_key` slot; otherwise derives it from the legacy root
+ *  (`yf_server_api_key`) and persists it, but KEEPS the root until a
+ *  successful v2 call confirms the worker accepts the new key (so a
+ *  client updated before the worker is never locked out). */
+async function getSigningContext(deps, handle) {
     const opener = deps.vaultOpener ?? (() => Vault.open({ configDir: configDir() }));
-    const vault = await opener();
-    if (!vault.has(SECRET_SLOT)) {
-        throw new Error('HITO 4 client: vault slot "' + SECRET_SLOT + '" is empty. '
-            + 'Run `yf vault set ' + SECRET_SLOT + '` with the value provided '
+    const vault = (await opener());
+    const resolved = await resolveSigningSecret(vault, handle);
+    if (!resolved) {
+        throw new Error('HITO 4 client: vault has neither "' + HANDLE_KEY_SLOT + '" nor "' + ROOT_KEY_SLOT + '". '
+            + 'Run `yf vault set ' + ROOT_KEY_SLOT + '` with the value provided '
             + 'at signup (or your tenant admin).');
     }
-    return vault.get(SECRET_SLOT);
+    return { vault, secret: resolved.secret, derivedFromRoot: resolved.derivedFromRoot };
+}
+/** Drop the legacy root once the per-handle key has been used in a
+ *  successful call -- after this the client can no longer sign for any
+ *  other handle (cross-tenant impersonation closed on this device). */
+async function finalizeHandleKeyMigration(ctx) {
+    if (!ctx.derivedFromRoot)
+        return;
+    await dropLegacyRoot(ctx.vault);
 }
 async function getHandle(deps) {
     if (deps.handleProvider)
@@ -113,9 +145,9 @@ export function signBearer(secret, handle, ts = Date.now()) {
  *  worker never persists nor logs the key. */
 export async function callFlow(flow, input, deps = {}) {
     const base = deps.baseUrl ?? HITO4_BASE_URL;
-    const secret = await getSecret(deps);
     const handle = await getHandle(deps);
-    const bearer = signBearer(secret, handle);
+    const ctx = await getSigningContext(deps, handle);
+    const bearer = signBearer(ctx.secret, handle);
     const fetchImpl = deps.fetchImpl ?? ((u, init) => globalThis.fetch(u, init));
     const brain = await resolveBrainHeaders();
     const url = base.replace(/\/+$/, '') + '/v1/flows/' + encodeURIComponent(flow);
@@ -131,6 +163,8 @@ export async function callFlow(flow, input, deps = {}) {
     if (brain.modelAlias)
         headers['x-yf-brain-model'] = brain.modelAlias;
     const r = await safeWorkerFetch(fetchImpl, url, { method: 'POST', headers, body: JSON.stringify(input ?? null) });
+    if (r.ok)
+        await finalizeHandleKeyMigration(ctx);
     let body = {};
     try {
         body = await r.json();
@@ -168,9 +202,9 @@ async function safeWorkerFetch(fetchImpl, url, init) {
  *  `month` arg is YYYY-MM; defaults to current month server-side. */
 export async function readCostMeter(deps = {}) {
     const base = deps.baseUrl ?? HITO4_BASE_URL;
-    const secret = await getSecret(deps);
     const handle = await getHandle(deps);
-    const bearer = signBearer(secret, handle);
+    const ctx = await getSigningContext(deps, handle);
+    const bearer = signBearer(ctx.secret, handle);
     const fetchImpl = deps.fetchImpl ?? ((u, init) => globalThis.fetch(u, init));
     const qs = deps.month && /^\d{4}-\d{2}$/.test(deps.month)
         ? '?month=' + encodeURIComponent(deps.month)
@@ -180,6 +214,8 @@ export async function readCostMeter(deps = {}) {
         method: 'GET',
         headers: { 'Authorization': 'Bearer ' + bearer },
     });
+    if (r.ok)
+        await finalizeHandleKeyMigration(ctx);
     let body = {};
     try {
         body = await r.json();
@@ -193,15 +229,17 @@ export async function readCostMeter(deps = {}) {
  *  Polar cache is then refreshed with the result. */
 export async function fetchServerLicense(deps = {}) {
     const base = deps.baseUrl ?? HITO4_BASE_URL;
-    const secret = await getSecret(deps);
     const handle = await getHandle(deps);
-    const bearer = signBearer(secret, handle);
+    const ctx = await getSigningContext(deps, handle);
+    const bearer = signBearer(ctx.secret, handle);
     const fetchImpl = deps.fetchImpl ?? ((u, init) => globalThis.fetch(u, init));
     const url = base.replace(/\/+$/, '') + '/v1/license/' + encodeURIComponent(handle);
     const r = await safeWorkerFetch(fetchImpl, url, {
         method: 'GET',
         headers: { 'Authorization': 'Bearer ' + bearer },
     });
+    if (r.ok)
+        await finalizeHandleKeyMigration(ctx);
     let body = {};
     try {
         body = await r.json();

package/dist/license/hito4_client.js.map

@@ -1 +1 @@
-{"version":3,"file":"hito4_client.js","sourceRoot":"","sources":["../../src/license/hito4_client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAElF,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,0CAA0C,CAAC;AAC1G,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAExC;;iEAEiE;AACjE,KAAK,UAAU,qBAAqB;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IACzE,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,oBAAoB,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;QACxD,IAAI,MAAM,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC,CAAC,aAAa,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC;AACd,CAAC;AAQD;;gDAEgD;AAChD,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,KAAK,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACtE,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,yBAAyB,IAAI,IAAI,CAAyB,CAAC;IACnF,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACzE,IAAI,MAA0B,CAAC;IAAC,IAAI,UAA8B,CAAC;IACnE,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAAC,MAAM,GAAG,KAAK,CAAC,iBAAiB,CAAC;QAAC,UAAU,GAAG,KAAK,CAAC,0BAA0B,CAAC;IAAC,CAAC;SAC7G,IAAI,QAAQ,KAAK,QAAQ,EAAK,CAAC;QAAC,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC;QAAI,UAAU,GAAG,KAAK,CAAC,6BAA6B,CAAC;IAAC,CAAC;SACrH,IAAI,QAAQ,KAAK,QAAQ,EAAK,CAAC;QAAC,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC;QAAK,UAAU,GAAG,KAAK,CAAC,6BAA6B,CAAC;IAAC,CAAC;SACrH,IAAI,QAAQ,KAAK,UAAU,EAAG,CAAC;QAAC,MAAM,GAAG,KAAK,CAAC,gBAAgB,CAAC;QAAE,UAAU,GAAG,KAAK,CAAC,yBAAyB,CAAC;IAAC,CAAC;IACtH,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,MAAM,IAAI,IAAI;QACtB,UAAU,EAAE,UAAU,IAAI,IAAI;KAC/B,CAAC;AACJ,CAAC;AAYD,SAAS,OAAO,CAAC,MAAc,EAAE,GAAW;IAC1C,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAqB;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,MAAM,MAAM,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,6BAA6B,GAAG,WAAW,GAAG,cAAc;cAC1D,oBAAoB,GAAG,WAAW,GAAG,4BAA4B;cACjE,mCAAmC,CACtC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAqB;IAC5C,IAAI,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC;IACtD,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,4DAA4D;cAC1D,kEAAkE,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,WAAW,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,MAAc,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;IAChF,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC;IAC7D,OAAO,EAAE,GAAG,GAAG,GAAG,GAAG,CAAC;AACxB,CAAC;AAQD;;;;;;8CAM8C;AAC9C,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAY,EAAE,KAAc,EAAE,OAAwB,EAAE;IAExD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAM,EAAE,IAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACxF,MAAM,KAAK,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,YAAY,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC/E,MAAM,OAAO,GAA2B;QACtC,eAAe,EAAE,SAAS,GAAG,MAAM;QACnC,kBAAkB,EAAE,MAAM;QAC1B,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,KAAK,CAAC,QAAQ;QAAI,OAAO,CAAC,qBAAqB,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;IACtE,IAAI,KAAK,CAAC,MAAM;QAAM,OAAO,CAAC,gBAAgB,CAAC,GAAQ,KAAK,CAAC,MAAM,CAAC;IACpE,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO,CAAC,kBAAkB,CAAC,GAAM,KAAK,CAAC,UAAU,CAAC;IACxE,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,GAAG,EAC5C,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;IACpE,IAAI,IAAI,GAA4B,EAAE,CAAC;IACvC,IAAI,CAAC;QAAC,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,EAA6B,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,IAAI,GAAG,EAAE,CAAC;IAAC,CAAC;IAC9E,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;eAMe;AACf,KAAK,UAAU,eAAe,CAC5B,SAA6E,EAC7E,GAAW,EACX,IAA6B;IAE7B,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7D,CAAuC,CAAC,WAAW,GAAG,gBAAgB,CACrE,oBAAoB,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CACjD,CAAC;QACF,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED;;;;iEAIiE;AAEjE;;;qEAGqE;AACrE,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAA6C,EAAE;IAE/C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAM,EAAE,IAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACxF,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QACvD,CAAC,CAAC,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAC5C,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,iBAAiB,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;IAC3F,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE;QAC9C,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,eAAe,EAAE,SAAS,GAAG,MAAM,EAAE;KACjD,CAAC,CAAC;IACH,IAAI,IAAI,GAA4B,EAAE,CAAC;IACvC,IAAI,CAAC;QAAC,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,EAA6B,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,IAAI,GAAG,EAAE,CAAC;IAAC,CAAC;IAC9E,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED;qDACqD;AACrD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAwB,EAAE;IACjE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAM,EAAE,IAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACxF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACnF,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE;QAC9C,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,eAAe,EAAE,SAAS,GAAG,MAAM,EAAE;KACjD,CAAC,CAAC;IACH,IAAI,IAAI,GAA4B,EAAE,CAAC;IACvC,IAAI,CAAC;QAAC,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,EAA6B,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,IAAI,GAAG,EAAE,CAAC;IAAC,CAAC;IAC9E,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"hito4_client.js","sourceRoot":"","sources":["../../src/license/hito4_client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EACL,eAAe,EAAE,aAAa,EAAE,oBAAoB,EAAE,cAAc,GAErE,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAElF,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,0CAA0C,CAAC;AAE1G;;;yEAGyE;AACzE,CAAC,GAAG,EAAE;IACJ,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;QAClC,MAAM,UAAU,GAAG,CAAC,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC;QACpG,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3C,OAAO,CAAC,IAAI,CACV,mDAAmD,GAAG,CAAC,CAAC,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ;kBAClF,gEAAgE,CACnE,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,iEAAiE,CAAC,CAAC;AAC/E,CAAC,CAAC,EAAE,CAAC;AAEL;;iEAEiE;AACjE,KAAK,UAAU,qBAAqB;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IACzE,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,oBAAoB,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;QACxD,IAAI,MAAM,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC,CAAC,aAAa,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC;AACd,CAAC;AAQD;;gDAEgD;AAChD,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC;;;uCAGmC;IACnC,MAAM,KAAK,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,yBAAyB,IAAI,IAAI,CAAyB,CAAC;IACpF,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACzE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;IAC5D,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,UAA8B,CAAC;IACnC,IAAI,QAAQ,KAAK,WAAW,EAAO,CAAC;QAAC,MAAM,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAAC,UAAU,GAAG,KAAK,EAAE,0BAA0B,CAAC;IAAC,CAAC;SAC7H,IAAI,QAAQ,KAAK,QAAQ,EAAK,CAAC;QAAC,MAAM,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAAI,UAAU,GAAG,KAAK,EAAE,6BAA6B,CAAC;IAAC,CAAC;SAChI,IAAI,QAAQ,KAAK,QAAQ,EAAK,CAAC;QAAC,MAAM,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QAAK,UAAU,GAAG,KAAK,EAAE,6BAA6B,CAAC;IAAC,CAAC;SAChI,IAAI,QAAQ,KAAK,UAAU,EAAG,CAAC;QAAC,MAAM,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAAG,UAAU,GAAG,KAAK,EAAE,yBAAyB,CAAC;IAAC,CAAC;IAClI,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,MAAM,IAAI,IAAI;QACtB,UAAU,EAAE,UAAU,IAAI,IAAI;KAC/B,CAAC;AACJ,CAAC;AAYD,SAAS,OAAO,CAAC,MAAc,EAAE,GAAW;IAC1C,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAWD;;;;6DAI6D;AAC7D,KAAK,UAAU,iBAAiB,CAAC,IAAqB,EAAE,MAAc;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,CAAC,MAAM,MAAM,EAAE,CAAqB,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,oCAAoC,GAAG,eAAe,GAAG,SAAS,GAAG,aAAa,GAAG,KAAK;cACxF,oBAAoB,GAAG,aAAa,GAAG,4BAA4B;cACnE,mCAAmC,CACtC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,CAAC;AACvF,CAAC;AAED;;uEAEuE;AACvE,KAAK,UAAU,0BAA0B,CAAC,GAAmB;IAC3D,IAAI,CAAC,GAAG,CAAC,eAAe;QAAE,OAAO;IACjC,MAAM,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAqB;IAC5C,IAAI,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC;IACtD,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,4DAA4D;cAC1D,kEAAkE,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,WAAW,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,MAAc,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;IAChF,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC;IAC7D,OAAO,EAAE,GAAG,GAAG,GAAG,GAAG,CAAC;AACxB,CAAC;AAQD;;;;;;8CAM8C;AAC9C,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAY,EAAE,KAAc,EAAE,OAAwB,EAAE;IAExD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAM,EAAE,IAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACxF,MAAM,KAAK,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,YAAY,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC/E,MAAM,OAAO,GAA2B;QACtC,eAAe,EAAE,SAAS,GAAG,MAAM;QACnC,kBAAkB,EAAE,MAAM;QAC1B,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,KAAK,CAAC,QAAQ;QAAI,OAAO,CAAC,qBAAqB,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;IACtE,IAAI,KAAK,CAAC,MAAM;QAAM,OAAO,CAAC,gBAAgB,CAAC,GAAQ,KAAK,CAAC,MAAM,CAAC;IACpE,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO,CAAC,kBAAkB,CAAC,GAAM,KAAK,CAAC,UAAU,CAAC;IACxE,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,GAAG,EAC5C,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC,CAAC,EAAE;QAAE,MAAM,0BAA0B,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,IAAI,GAA4B,EAAE,CAAC;IACvC,IAAI,CAAC;QAAC,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,EAA6B,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,IAAI,GAAG,EAAE,CAAC;IAAC,CAAC;IAC9E,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;eAMe;AACf,KAAK,UAAU,eAAe,CAC5B,SAA6E,EAC7E,GAAW,EACX,IAA6B;IAE7B,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7D,CAAuC,CAAC,WAAW,GAAG,gBAAgB,CACrE,oBAAoB,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CACjD,CAAC;QACF,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED;;;;iEAIiE;AAEjE;;;qEAGqE;AACrE,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAA6C,EAAE;IAE/C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAM,EAAE,IAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACxF,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QACvD,CAAC,CAAC,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAC5C,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,iBAAiB,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;IAC3F,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE;QAC9C,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,eAAe,EAAE,SAAS,GAAG,MAAM,EAAE;KACjD,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,EAAE;QAAE,MAAM,0BAA0B,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,IAAI,GAA4B,EAAE,CAAC;IACvC,IAAI,CAAC;QAAC,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,EAA6B,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,IAAI,GAAG,EAAE,CAAC;IAAC,CAAC;IAC9E,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED;qDACqD;AACrD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAwB,EAAE;IACjE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAM,EAAE,IAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACxF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACnF,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE;QAC9C,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,eAAe,EAAE,SAAS,GAAG,MAAM,EAAE;KACjD,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,EAAE;QAAE,MAAM,0BAA0B,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,IAAI,GAA4B,EAAE,CAAC;IACvC,IAAI,CAAC;QAAC,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,EAA6B,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,IAAI,GAAG,EAAE,CAAC;IAAC,CAAC;IAC9E,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC"}

package/dist/llm/gemini_client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gemini_client.d.ts","sourceRoot":"","sources":["../../src/llm/gemini_client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAMvD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC;QAClE,MAAM,EAAE,OAAO,CAAC;QAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC,CAAC;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,SAAS,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AA6BD,qBAAa,cAAe,SAAQ,KAAK;IACvC,MAAM,EAAE,MAAM,CAAC;gBACH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAK5C;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,SAAS,CAAe;IAChC,OAAO,CAAC,YAAY,CAAS;gBAEjB,IAAI,EAAE,mBAAmB;IAS/B,IAAI,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;CAiLhE"}
+{"version":3,"file":"gemini_client.d.ts","sourceRoot":"","sources":["../../src/llm/gemini_client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAMvD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC;QAClE,MAAM,EAAE,OAAO,CAAC;QAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC,CAAC;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,SAAS,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AA6BD,qBAAa,cAAe,SAAQ,KAAK;IACvC,MAAM,EAAE,MAAM,CAAC;gBACH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAK5C;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,SAAS,CAAe;IAChC,OAAO,CAAC,YAAY,CAAS;gBAEjB,IAAI,EAAE,mBAAmB;IAS/B,IAAI,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;CAoLhE"}

package/dist/llm/gemini_client.js

@@ -68,10 +68,13 @@ export class GeminiClient {
                 body.tools = [{ functionDeclarations }];
                 body.toolConfig = { functionCallingConfig: { mode: 'AUTO' } };
             }
-            const url = GEMINI_BASE + encodeURIComponent(model) + ':generateContent?key=' + encodeURIComponent(this.apiKey);
+            /* PND-051 (sec 4.6) -- pass the API key in the x-goog-api-key
+             * header, not the query string. Query strings land in access
+             * logs, proxy logs and Referer headers; the header does not. */
+            const url = GEMINI_BASE + encodeURIComponent(model) + ':generateContent';
             const res = await this.fetchImpl(url, {
                 method: 'POST',
-                headers: { 'content-type': 'application/json' },
+                headers: { 'content-type': 'application/json', 'x-goog-api-key': this.apiKey },
                 body: JSON.stringify(body),
             });
             const json = await res.json();