@vericto/sdk 0.0.0-stage → 0.2.0

package/dist/chunk-I4I35HUY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/dialects.ts","../src/errors.ts","../src/verdict.ts","../src/version.ts","../src/runtime-api.ts","../src/guard.ts"],"names":[],"mappings":";AAKO,IAAM,iBAAiB,CAAC,UAAA,EAAY,SAAS,QAAA,EAAU,OAAA,EAAS,aAAa,QAAQ;AAE5F,IAAM,OAAA,GAA4C;AAAA,EAChD,QAAA,EAAU,UAAA;AAAA,EACV,UAAA,EAAY,UAAA;AAAA,EACZ,EAAA,EAAI,UAAA;AAAA,EACJ,KAAA,EAAO,OAAA;AAAA,EACP,MAAA,EAAQ,OAAA;AAAA,EACR,OAAA,EAAS,OAAA;AAAA,EACT,MAAA,EAAQ,QAAA;AAAA,EACR,QAAA,EAAU,QAAA;AAAA,EACV,KAAA,EAAO,OAAA;AAAA,EACP,SAAA,EAAW,OAAA;AAAA,EACX,OAAA,EAAS,OAAA;AAAA,EACT,SAAA,EAAW,WAAA;AAAA,EACX,MAAA,EAAQ,QAAA;AAAA,EACR,OAAA,EAAS,QAAA;AAAA,EACT,gBAAA,EAAkB;AACpB,CAAA;AAMO,SAAS,iBAAiB,IAAA,EAAsB;AACrD,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,EAAK,CAAE,WAAA,EAAY;AACpC,EAAA,OAAO,OAAA,CAAQ,GAAG,CAAA,IAAK,GAAA;AACzB;;;AC7BO,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EACtC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,OAAO,GAAA,CAAA,MAAA,CAAW,IAAA;AAAA,EACzB;AACF;AAOO,IAAM,kBAAA,GAAN,cAAiC,YAAA,CAAa;AAAA,EAC1C,MAAA;AAAA,EACA,IAAA;AAAA,EAET,WAAA,CAAY,OAAA,EAAiB,OAAA,GAA8C,EAAC,EAAG;AAC7E,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACtB,IAAA,IAAA,CAAK,OAAO,OAAA,CAAQ,IAAA;AAAA,EACtB;AACF;AAOO,IAAM,8BAAA,GAAN,cAA6C,kBAAA,CAAmB;AAAA,EAC5D,OAAA;AAAA,EACA,SAAA;AAAA,EAET,WAAA,CAAY,OAAA,EAAiB,SAAA,EAA8B,MAAA,EAAgB;AACzE,IAAA,MAAM,SAAS,SAAA,CAAU,MAAA,GAAS,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,GAAI,eAAA;AACzD,IAAA,KAAA;AAAA,MACE,CAAA,mBAAA,EAAsB,MAAM,CAAA,uBAAA,EAA0B,OAAO,yBAAyB,MAAM,CAAA,uEAAA,CAAA;AAAA,MAE5F,EAAE,MAAM,qBAAA;AAAsB,KAChC;AACA,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AACF;AAMO,IAAM,uBAAA,GAAN,cAAsC,YAAA,CAAa;AAAA,EAC/C,MAAA;AAAA,EACA,IAAA;AAAA,EAET,WAAA,CAAY,OAAA,EAAiB,OAAA,GAA8C,EAAC,EAAG;AAC7E,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACtB,IAAA,IAAA,CAAK,OAAO,OAAA,CAAQ,IAAA;AAAA,EACtB;AACF;AAGO,IAAM,yBAAA,GAAN,cAAwC,uBAAA,CAAwB;AAAA,EAC5D,QAAA;AAAA,EACA,UAAA;AAAA,EAET,WAAA,CAAY,OAAA,EAAiB,OAAA,GAAsD,EAAC,EAAG;AACrF,IAAA,KAAA,CAAM,SAAS,EAAE,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAM,kBAAkB,CAAA;AACtD,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,QAAA;AACxB,IAAA,IAAA,CAAK,aAAa,OAAA,CAAQ,UAAA;AAAA,EAC5B;AACF;AAGO,IAAM,mBAAA,GAAN,cAAkC,YAAA,CAAa;AAAA,EAC3C,OAAA;AAAA,EACA,GAAA;AAAA,EAET,WAAA,CAAY,SAAkB,GAAA,EAAa;AACzC,IAAA,IAAI,OAAA,GAAU,CAAA,iBAAA,EAAoB,OAAA,CAAQ,QAAA,IAAY,gBAAgB,CAAA,CAAA;AACtE,IAAA,IAAI,OAAA,CAAQ,QAAA,EAAU,OAAA,IAAW,CAAA,WAAA,EAAc,QAAQ,QAAQ,CAAA,CAAA,CAAA;AAC/D,IAAA,IAAI,OAAA,CAAQ,OAAA,EAAS,OAAA,IAAW,CAAA,EAAA,EAAK,QAAQ,OAAO,CAAA,CAAA;AACpD,IAAA,IAAI,OAAA,CAAQ,YAAA,EAAc,OAAA,IAAW,CAAA,iBAAA,EAAoB,QAAQ,YAAY,CAAA,CAAA;AAC7E,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AAAA,EACb;AAAA,EAEA,IAAI,QAAA,GAA+B;AACjC,IAAA,OAAO,KAAK,OAAA,CAAQ,QAAA;AAAA,EACtB;AAAA,EAEA,IAAI,YAAA,GAAmC;AACrC,IAAA,OAAO,KAAK,OAAA,CAAQ,YAAA;AAAA,EACtB;AACF;;;AC1FA,IAAM,gBAAA,uBAA4C,GAAA,CAAI,CAAC,WAAW,SAAA,EAAW,WAAA,EAAa,aAAA,EAAe,SAAS,CAAC,CAAA;AAuC5G,SAAS,aAAa,OAAA,EAA0B;AACrD,EAAA,OAAO,OAAA,CAAQ,kBAAkB,OAAA,CAAQ,GAAA;AAC3C;AAEO,SAAS,SAAS,OAAA,EAA2B;AAClD,EAAA,OAAO,OAAA,CAAQ,QAAQ,cAAc,CAAA;AACvC;AAGO,SAAS,mBAAA,CAAoB,IAAA,EAA+B,GAAA,EAAa,OAAA,EAA0B;AACxG,EAAA,MAAM,GAAA,GAAA,CAAO,OAAO,IAAA,CAAK,QAAA,KAAa,WAAW,IAAA,CAAK,QAAA,GAAW,IAAI,WAAA,EAAY;AAEjF,EAAA,MAAM,QAAA,GAAqB,gBAAA,CAAiB,GAAA,CAAI,GAAG,IAAK,GAAA,GAAmB,SAAA;AAC3E,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA;AACtC,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA;AACrC,EAAA,MAAM,YAAA,GAAe,MAAA,CAAO,IAAA,CAAK,oBAAoB,CAAA;AACrD,EAAA,IAAI,OAAA,GAAU,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA;AAC/B,EAAA,IAAI,WAAW,QAAA,IAAY,OAAA,KAAY,CAAA,sBAAA,EAAyB,QAAQ,IAAI,OAAA,GAAU,MAAA;AACtF,EAAA,OAAO;AAAA,IACL,QAAA;AAAA,IACA,GAAA;AAAA,IACA,OAAA;AAAA,IACA,QAAA;AAAA,IACA,QAAA;AAAA,IACA,OAAA;AAAA,IACA,YAAA;AAAA;AAAA,IAEA,gBAAgB,QAAA,KAAa,SAAA,GAAY,MAAA,GAAY,MAAA,CAAO,KAAK,eAAe,CAAA;AAAA,IAChF,UAAA,EAAY,MAAA,CAAO,IAAA,CAAK,WAAW,CAAA;AAAA,IACnC,QAAA,EAAU,UAAA,CAAW,IAAA,EAAM,QAAA,EAAU,UAAU,YAAY,CAAA;AAAA,IAC3D,gBAAA,EAAkB,MAAM,OAAA,CAAQ,IAAA,CAAK,iBAAiB,CAAA,GAAI,IAAA,CAAK,oBAAoB,EAAC;AAAA,IACpF,YAAA,EAAc,MAAM,OAAA,CAAQ,IAAA,CAAK,aAAa,CAAA,GAAI,IAAA,CAAK,gBAAgB,EAAC;AAAA,IACxE,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA;AAAA,IAC7B,cAAA,EAAgB,MAAA,CAAO,IAAA,CAAK,eAAe,CAAA;AAAA,IAC3C,MAAA,EAAQ,KAAA;AAAA,IACR,GAAA,EAAK;AAAA,GACP;AACF;AAEO,SAAS,kBAAA,CAAmB,GAAA,EAAa,OAAA,EAAiB,MAAA,EAAyB;AACxF,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,aAAA;AAAA,IACV,GAAA;AAAA,IACA,OAAA;AAAA,IACA,OAAA,EAAS,MAAA;AAAA,IACT,UAAU,EAAC;AAAA,IACX,kBAAkB,EAAC;AAAA,IACnB,cAAc,EAAC;AAAA,IACf,MAAA,EAAQ,KAAA;AAAA,IACR,KAAK;AAAC,GACR;AACF;AAEA,SAAS,OAAO,KAAA,EAAoC;AAClD,EAAA,IAAI,UAAU,IAAA,IAAQ,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAI,OAAO,MAAA;AAClE,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,IAAA,CAAK,UAAU,KAAK,CAAA;AACjE;AAEA,SAAS,UAAA,CACP,IAAA,EACA,QAAA,EACA,QAAA,EACA,YAAA,EACW;AAEX,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,QAAA,IAAY,IAAA,CAAK,UAAA;AACrC,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AACzB,IAAA,MAAM,MAAiB,EAAC;AACxB,IAAA,KAAA,MAAW,QAAQ,MAAA,EAAqB;AACtC,MAAA,IAAI,CAAC,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,EAAU;AACvC,MAAA,MAAM,CAAA,GAAI,IAAA;AACV,MAAA,MAAM,IAAA,GAAO,MAAA,CAAO,CAAA,CAAE,SAAA,IAAa,EAAE,IAAI,CAAA;AACzC,MAAA,IAAI,CAAC,IAAA,EAAM;AACX,MAAA,GAAA,CAAI,IAAA,CAAK;AAAA,QACP,QAAA,EAAU,IAAA;AAAA,QACV,QAAA,EAAU,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAA;AAAA,QAC3B,MAAA,EAAQ,MAAA,CAAO,CAAA,CAAE,OAAO,CAAA;AAAA,QACxB,WAAA,EAAa,MAAA,CAAO,CAAA,CAAE,aAAa,CAAA;AAAA,QACnC,YAAA,EAAc,MAAA,CAAO,CAAA,CAAE,oBAAA,IAAwB,EAAE,aAAa;AAAA,OAC/D,CAAA;AAAA,IACH;AACA,IAAA,IAAI,GAAA,CAAI,QAAQ,OAAO,GAAA;AAAA,EACzB;AACA,EAAA,IAAI,CAAC,QAAA,EAAU,OAAO,EAAC;AACvB,EAAA,OAAO;AAAA,IACL;AAAA,MACE,QAAA;AAAA,MACA,QAAA;AAAA,MACA,MAAA,EAAQ,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA;AAAA,MAC3B,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,aAAa,CAAA;AAAA,MACtC;AAAA;AACF,GACF;AACF;;;ACzIO,IAAM,OAAA,GAAU;;;ACShB,IAAM,eAAA,GAAkB;AACxB,IAAM,aAAA,GAAgB;AACtB,IAAM,WAAA,GAAc;AAE3B,IAAM,OAAA,GAAU,iEAAA;AAChB,IAAM,SAAA,uBAAgB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAC9C,IAAM,WAAA,uBAAkB,GAAA,CAAI,CAAC,aAAa,WAAA,EAAa,OAAA,EAAS,KAAK,CAAC,CAAA;AACtE,IAAM,cAAA,GAAiB,GAAA;AAgChB,IAAM,sBAAN,MAA+C;AAAA,EAC3C,MAAA;AAAA,EACA,UAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,cAAA;AAAA,EACA,MAAA;AAAA,EACT,SAAA;AAAA,EACA,WAAA,GAAc,CAAA;AAAA,EACd,gBAAA;AAAA,EAEA,WAAA,CAAY,OAAA,GAA6B,EAAC,EAAG;AAC3C,IAAA,MAAM,GAAA,GAAM,QAAQ,GAAA,KAAQ,OAAO,YAAY,WAAA,GAAc,OAAA,CAAQ,MAAM,EAAC,CAAA;AAC5E,IAAA,MAAM,OAAO,OAAA,CAAQ,MAAA,IAAU,GAAA,CAAI,eAAA,IAAmB,IAAI,IAAA,EAAK;AAC/D,IAAA,IAAI,CAAC,GAAA,EAAK;AACR,MAAA,MAAM,IAAI,kBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,CAAC,GAAA,CAAI,UAAA,CAAW,OAAO,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,mBAAmB,8EAA8E,CAAA;AAAA,IAC7G;AACA,IAAA,IAAA,CAAK,OAAA,GAAU,GAAA;AAEf,IAAA,MAAM,MAAM,OAAA,CAAQ,UAAA,IAAc,GAAA,CAAI,mBAAA,IAAuB,IAAI,IAAA,EAAK;AACtE,IAAA,IAAI,CAAC,EAAA,EAAI;AACP,MAAA,MAAM,IAAI,kBAAA;AAAA,QACR;AAAA,OAEF;AAAA,IACF;AACA,IAAA,IAAI,CAAC,OAAA,CAAQ,IAAA,CAAK,EAAE,CAAA,EAAG;AACrB,MAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,4CAAA,EAA+C,IAAA,CAAK,SAAA,CAAU,EAAA,CAAG,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,IAChH;AACA,IAAA,IAAA,CAAK,UAAA,GAAa,GAAG,WAAA,EAAY;AAEjC,IAAA,MAAM,GAAA,GAAA,CAAA,CAAQ,OAAA,CAAQ,MAAA,IAAU,GAAA,CAAI,eAAA,IAAmB,EAAA,EAAI,IAAA,EAAK,IAAK,eAAA,EAAiB,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AACxG,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,IAAI,IAAI,GAAG,CAAA;AAAA,IACtB,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,wBAAA,EAA2B,KAAK,SAAA,CAAU,GAAG,CAAC,CAAA,wBAAA,CAA0B,CAAA;AAAA,IACvG;AACA,IAAA,IAAI,MAAA,CAAO,QAAA,KAAa,QAAA,IAAY,MAAA,CAAO,aAAa,OAAA,EAAS;AAC/D,MAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,wBAAA,EAA2B,KAAK,SAAA,CAAU,GAAG,CAAC,CAAA,wBAAA,CAA0B,CAAA;AAAA,IACvG;AACA,IAAA,IAAI,MAAA,CAAO,aAAa,OAAA,IAAW,CAAC,YAAY,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAA,EAAG;AACpE,MAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,gDAAA,EAAmD,MAAA,CAAO,QAAQ,CAAA,eAAA,CAAiB,CAAA;AAAA,IAClH;AACA,IAAA,IAAA,CAAK,MAAA,GAAS,GAAA;AAEd,IAAA,IAAI,YAAY,OAAA,CAAQ,SAAA;AACxB,IAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,MAAA,MAAM,OAAA,GAAA,CAAW,GAAA,CAAI,eAAA,IAAmB,EAAA,EAAI,IAAA,EAAK;AACjD,MAAA,SAAA,GAAY,OAAA,GAAU,MAAA,CAAO,OAAO,CAAA,GAAI,GAAA,GAAO,GAAA;AAC/C,MAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,EAAG;AAC/B,QAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,iDAAA,EAAoD,KAAK,SAAA,CAAU,OAAO,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,MAC7G;AAAA,IACF;AACA,IAAA,IAAI,EAAE,SAAA,GAAY,CAAA,CAAA,EAAI,MAAM,IAAI,mBAAmB,mCAAmC,CAAA;AACtF,IAAA,MAAM,UAAA,GAAa,QAAQ,UAAA,IAAc,CAAA;AACzC,IAAA,IAAI,EAAE,UAAA,IAAc,CAAA,CAAA,EAAI,MAAM,IAAI,mBAAmB,gCAAgC,CAAA;AACrF,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AACjB,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA,CAAK,KAAA,CAAM,UAAU,CAAA;AACvC,IAAA,IAAA,CAAK,aAAa,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,OAAA,CAAQ,aAAa,GAAG,CAAA;AACtD,IAAA,IAAA,CAAK,cAAA,GAAiB,QAAQ,aAAA,IAAiB,GAAA;AAE/C,IAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,KAAA,IAAU,UAAA,CAAqC,KAAA;AACjE,IAAA,IAAI,CAAC,CAAA,EAAG,MAAM,IAAI,mBAAmB,uEAAuE,CAAA;AAC5G,IAAA,IAAA,CAAK,MAAA,GAAS,CAAA;AAAA,EAChB;AAAA,EAEA,QAAA,GAAmB;AACjB,IAAA,OAAO,CAAA,2BAAA,EAA8B,IAAA,CAAK,MAAM,CAAA,aAAA,EAAgB,KAAK,UAAU,CAAA,CAAA,CAAA;AAAA,EACjF;AAAA,EAEA,MAAA,GAAkC;AAChC,IAAA,OAAO,EAAE,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,UAAA,EAAY,KAAK,UAAA,EAAW;AAAA,EAC5D;AAAA,EAEA,MAAM,QAAA,CAAS,GAAA,EAAa,OAAA,EAAmC;AAC7D,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,KAAK,WAAA,EAAa,IAAA,CAAK,UAAA,EAAY,OAAA,EAAS,CAAA;AACpF,IAAA,IAAI,SAAA,GAAY,iBAAA;AAChB,IAAA,IAAI,YAAA;AAEJ,IAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,IAAA,CAAK,YAAY,OAAA,EAAA,EAAW;AAC3D,MAAA,IAAI,OAAA,GAAU,GAAG,MAAM,KAAA,CAAM,KAAK,MAAA,CAAO,OAAA,EAAS,YAAY,CAAC,CAAA;AAC/D,MAAA,YAAA,GAAe,MAAA;AAEf,MAAA,IAAI,QAAA;AACJ,MAAA,IAAI;AACF,QAAA,QAAA,GAAW,MAAM,IAAA,CAAK,QAAA,CAAS,aAAA,EAAe;AAAA,UAC5C,MAAA,EAAQ,MAAA;AAAA,UACR,OAAA,EAAS,EAAE,GAAG,IAAA,CAAK,QAAA,IAAY,cAAA,EAAgB,kBAAA,EAAoB,WAAA,EAAa,IAAA,CAAK,OAAA,EAAQ;AAAA,UAC7F,IAAA,EAAM;AAAA,SACP,CAAA;AAAA,MACH,SAAS,GAAA,EAAK;AACZ,QAAA,SAAA,GAAY,GAAG,SAAA,CAAU,GAAG,CAAC,CAAA,eAAA,EAAkB,KAAK,MAAM,CAAA,CAAA;AAC1D,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,SAAS,QAAA,CAAS,MAAA;AACxB,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,QAAQ,CAAA;AACpC,MAAA,IAAI,MAAA,KAAW,GAAA,IAAQ,MAAA,KAAW,GAAA,IAAA,CAAQ,OAAO,IAAA,CAAK,QAAA,KAAa,QAAA,GAAW,IAAA,CAAK,QAAA,GAAW,EAAA,EAAI,WAAA,OAAkB,SAAA,EAAY;AAC9H,QAAA,IAAI,EAAE,cAAc,IAAA,CAAA,EAAO;AACzB,UAAA,SAAA,GAAY,CAAA,KAAA,EAAQ,MAAM,CAAA,yBAAA,EAA4B,IAAA,CAAK,MAAM,CAAA,CAAA;AACjE,UAAA;AAAA,QACF;AACA,QAAA,OAAO,mBAAA,CAAoB,IAAA,EAAM,GAAA,EAAK,OAAO,CAAA;AAAA,MAC/C;AAEA,MAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,IAAS,OAAO,KAAK,KAAA,KAAU,QAAA,GAAY,IAAA,CAAK,KAAA,GAAoC,EAAC;AACxG,MAAA,MAAM,IAAA,GAAO,OAAO,KAAA,CAAM,IAAA,KAAS,YAAY,KAAA,CAAM,IAAA,GAAO,MAAM,IAAA,GAAO,MAAA;AACzE,MAAA,MAAM,OAAA,GAAU,OAAO,KAAA,CAAM,OAAA,KAAY,YAAY,KAAA,CAAM,OAAA,GAAU,MAAM,OAAA,GAAU,MAAA;AAErF,MAAA,IAAI,MAAA,KAAW,GAAA,IAAO,IAAA,KAAS,gBAAA,EAAkB;AAC/C,QAAA,MAAM,WAAW,OAAO,KAAA,CAAM,SAAA,KAAc,QAAA,GAAW,MAAM,SAAA,GAAY,MAAA;AACzE,QAAA,MAAM,IAAI,yBAAA;AAAA,UACR,CAAA,sDAAA,EAAyD,QAAA,GAAW,CAAA,eAAA,EAAkB,QAAQ,KAAK,EAAE,CAAA,CAAA,CAAA;AAAA,UACrG,EAAE,UAAU,UAAA,EAAY,OAAO,MAAM,WAAA,KAAgB,QAAA,GAAW,KAAA,CAAM,WAAA,GAAc,MAAA;AAAU,SAChG;AAAA,MACF;AACA,MAAA,IAAI,MAAA,KAAW,GAAA,IAAO,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA,EAAG;AAC3C,QAAA,SAAA,GAAY,CAAA,KAAA,EAAQ,MAAM,CAAA,EAAG,IAAA,GAAO,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,GAAK,EAAE,CAAA,MAAA,EAAS,IAAA,CAAK,MAAM,CAAA,CAAA;AACvE,QAAA,YAAA,GAAe,WAAW,QAAA,CAAS,OAAA,CAAQ,IAAI,aAAa,CAAA,EAAG,MAAM,mBAAmB,CAAA;AACxF,QAAA;AAAA,MACF;AACA,MAAA,MAAM,MAAM,IAAA,CAAK,YAAA,CAAa,MAAA,EAAQ,IAAA,EAAM,SAAS,OAAO,CAAA;AAAA,IAC9D;AACA,IAAA,MAAM,IAAI,uBAAA;AAAA,MACR,CAAA,uCAAA,EAA0C,IAAA,CAAK,UAAA,GAAa,CAAC,gBAAgB,SAAS,CAAA,CAAA;AAAA,KACxF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,iBAAA,GAA4D;AAChE,IAAA,IAAI,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,GAAA,EAAI,GAAI,KAAK,WAAA,GAAc,IAAA,CAAK,cAAA,EAAgB,OAAO,IAAA,CAAK,SAAA;AACvF,IAAA,IAAA,CAAK,gBAAA,KAAqB,IAAA,CAAK,cAAA,EAAe,CAAE,QAAQ,MAAM;AAC5D,MAAA,IAAA,CAAK,gBAAA,GAAmB,MAAA;AAAA,IAC1B,CAAC,CAAA;AACD,IAAA,OAAO,IAAA,CAAK,gBAAA;AAAA,EACd;AAAA,EAEA,MAAM,cAAA,GAAyD;AAC7D,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,QAAA,CAAS,WAAA,EAAa,EAAE,MAAA,EAAQ,KAAA,EAAO,OAAA,EAAS,IAAA,CAAK,QAAA,EAAS,EAAG,CAAA;AAC7F,MAAA,IAAI,QAAA,CAAS,MAAA,KAAW,GAAA,EAAK,OAAO,IAAA,CAAK,SAAA;AACzC,MAAA,MAAM,MAAA,GAAA,CAAU,MAAM,QAAA,CAAS,QAAQ,CAAA,EAAG,QAAA;AAC1C,MAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,SAAU,IAAA,CAAK,SAAA;AACxC,MAAA,MAAM,GAAA,GAAM,OACT,GAAA,CAAI,CAAC,MAAgB,CAAA,IAAK,OAAO,MAAM,QAAA,GAAY,CAAA,CAA8B,KAAK,KAAA,CAAU,CAAA,CAChG,OAAO,CAAC,EAAA,KAAqB,OAAO,EAAA,KAAO,QAAA,IAAY,EAAA,CAAG,MAAA,GAAS,CAAC,CAAA;AACvE,MAAA,IAAA,CAAK,SAAA,GAAY,GAAA;AACjB,MAAA,IAAA,CAAK,WAAA,GAAc,KAAK,GAAA,EAAI;AAC5B,MAAA,OAAO,GAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA,CAAK,SAAA;AAAA,IACd;AAAA,EACF;AAAA,EAEA,QAAA,GAAmC;AACjC,IAAA,OAAO,EAAE,MAAA,EAAQ,kBAAA,EAAoB,YAAA,EAAc,CAAA,aAAA,EAAgB,OAAO,CAAA,CAAA,EAAG;AAAA,EAC/E;AAAA,EAEA,MAAM,QAAA,CAAS,IAAA,EAAc,IAAA,EAAsC;AACjE,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAAE,MAAA,UAAA,CAAW,KAAA,EAAM;AAAA,IAAG,CAAA,EAAG,KAAK,SAAS,CAAA;AACtE,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,SAAS,IAAA,EAAM,EAAE,GAAG,IAAA,EAAM,QAAA,EAAU,QAAA,EAAU,MAAA,EAAQ,UAAA,CAAW,QAAQ,CAAA;AAAA,IACzG,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AAAA,EAEA,MAAA,CAAO,SAAiB,YAAA,EAA0C;AAChE,IAAA,IAAI,iBAAiB,MAAA,EAAW,OAAO,IAAA,CAAK,GAAA,CAAI,cAAc,cAAc,CAAA;AAC5E,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,UAAA,GAAa,CAAA,KAAM,OAAA,GAAU,CAAA,CAAA;AAC/C,IAAA,OAAO,IAAA,CAAK,IAAI,cAAA,EAAgB,IAAA,IAAQ,MAAM,IAAA,CAAK,MAAA,KAAW,CAAA,CAAE,CAAA;AAAA,EAClE;AAAA,EAEA,MAAM,YAAA,CACJ,MAAA,EACA,IAAA,EACA,SACA,OAAA,EAC6B;AAC7B,IAAA,IAAI,WAAW,GAAA,EAAK;AAClB,MAAA,OAAO,IAAI,mBAAmB,iEAAA,EAAmE;AAAA,QAC/F,MAAA;AAAA,QACA;AAAA,OACD,CAAA;AAAA,IACH;AACA,IAAA,IAAI,WAAW,GAAA,EAAK;AAClB,MAAA,OAAO,IAAI,kBAAA;AAAA,QACT,CAAA,qCAAA,EAAwC,OAAO,CAAA,EAAA,EAAK,IAAI,KAAK,EAAE,CAAA,GAAA,EAC1D,WAAW,yDAAyD,CAAA,CAAA,CAAA;AAAA,QACzE,EAAE,QAAQ,IAAA;AAAK,OACjB;AAAA,IACF;AACA,IAAA,IAAI,WAAW,GAAA,EAAK;AAClB,MAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,iBAAA,EAAkB;AAC/C,MAAA,IAAI,SAAA,IAAa,CAAC,SAAA,CAAU,QAAA,CAAS,OAAO,CAAA,EAAG;AAC7C,QAAA,OAAO,IAAI,8BAAA,CAA+B,OAAA,EAAS,SAAA,EAAW,KAAK,MAAM,CAAA;AAAA,MAC3E;AAAA,IACF;AACA,IAAA,OAAO,IAAI,kBAAA;AAAA,MACT,CAAA,mCAAA,EAAsC,MAAM,CAAA,EAAG,IAAA,GAAO,CAAA,EAAA,EAAK,IAAI,CAAA,CAAA,GAAK,EAAE,CAAA,CAAA,EAAI,OAAA,GAAU,CAAA,EAAA,EAAK,OAAO,KAAK,GAAG,CAAA,CAAA;AAAA,MACxG,EAAE,QAAQ,IAAA;AAAK,KACjB;AAAA,EACF;AACF;AAEA,eAAe,SAAS,QAAA,EAAsD;AAC5E,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,IAAA,MAAM,SAAkB,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,IAAI,EAAC;AACnD,IAAA,OAAO,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,MAAM,OAAA,CAAQ,MAAM,CAAA,GAAK,MAAA,GAAqC,EAAC;AAAA,EACjH,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAEA,SAAS,UAAA,CAAW,QAAuB,SAAA,EAAwC;AACjF,EAAA,KAAA,MAAW,KAAA,IAAS,CAAC,MAAA,EAAQ,SAAS,CAAA,EAAG;AACvC,IAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,KAAA,KAAU,MAAA,IAAa,UAAU,EAAA,EAAI;AAC3D,IAAA,MAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AAC5B,IAAA,IAAI,MAAA,CAAO,SAAS,OAAO,CAAA,SAAU,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,OAAA,GAAU,GAAI,CAAA;AAAA,EACjE;AACA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,UAAU,GAAA,EAAsB;AACvC,EAAA,IAAI,eAAe,KAAA,EAAO,OAAO,IAAI,IAAA,KAAS,YAAA,GAAe,YAAY,GAAA,CAAI,IAAA;AAC7E,EAAA,OAAO,OAAA;AACT;AAEA,SAAS,MAAM,EAAA,EAA2B;AACxC,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AACzD;;;AC7PA,IAAM,cAAA,GAAgC;AAAA,EACpC,MAAM,MAAM;AAAA,EAAC,CAAA;AAAA,EACb,IAAA,EAAM,CAAC,CAAA,KAAM;AAAE,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAAG,CAAA;AAAA,EAChC,KAAA,EAAO,CAAC,CAAA,KAAM;AAAE,IAAA,OAAA,CAAQ,MAAM,CAAC,CAAA;AAAA,EAAG;AACpC,CAAA;AACA,IAAM,MAAA,GAAwB,EAAE,IAAA,EAAM,MAAM;AAAC,CAAA,EAAG,MAAM,MAAM;AAAC,CAAA,EAAG,OAAO,MAAM;AAAC,CAAA,EAAE;AAOzE,IAAM,UAAN,MAAc;AAAA,EACV,SAAA;AAAA,EACA,QAAA;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EAET,WAAA,CAAY,OAAA,GAA0B,EAAC,EAAG;AACxC,IAAA,IAAA,CAAK,SAAA,GAAY,OAAA,CAAQ,SAAA,IAAa,IAAI,oBAAoB,OAAO,CAAA;AACrE,IAAA,MAAM,GAAA,GAAM,QAAQ,GAAA,KAAQ,OAAO,YAAY,WAAA,GAAc,OAAA,CAAQ,MAAM,EAAC,CAAA;AAC5E,IAAA,MAAM,IAAA,GAAA,CAAQ,QAAQ,QAAA,IAAY,GAAA,CAAI,qBAAqB,QAAA,EAAU,IAAA,GAAO,WAAA,EAAY;AACxF,IAAA,IAAI,IAAA,KAAS,QAAA,IAAY,IAAA,KAAS,MAAA,EAAQ;AACxC,MAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,yCAAA,EAA4C,KAAK,SAAA,CAAU,IAAI,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,IAClG;AACA,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,MAAM,GAAA,GAAM,QAAQ,UAAA,IAAc,CAAA;AAClC,IAAA,MAAM,IAAA,GAAO,QAAQ,SAAA,IAAa,IAAA;AAClC,IAAA,IAAI,MAAM,CAAA,IAAK,IAAA,GAAO,GAAG,MAAM,IAAI,mBAAmB,6CAA6C,CAAA;AACnG,IAAA,IAAA,CAAK,SAAS,GAAA,GAAM,CAAA,GAAI,IAAI,YAAA,CAAa,GAAA,EAAK,IAAI,CAAA,GAAI,MAAA;AACtD,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,SAAA;AACzB,IAAA,IAAA,CAAK,UAAU,OAAA,CAAQ,MAAA,KAAW,KAAA,GAAQ,MAAA,GAAU,QAAQ,MAAA,IAAU,cAAA;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,eAAe,OAAA,EAAkC;AACrD,IAAA,MAAM,IAAA,GAAO,iBAAiB,OAAO,CAAA;AACrC,IAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,SAAA,CAAU,iBAAA,EAAkB;AACzD,IAAA,IAAI,SAAA,IAAa,CAAC,SAAA,CAAU,QAAA,CAAS,IAAI,CAAA,EAAG;AAC1C,MAAA,MAAM,IAAI,8BAAA,CAA+B,IAAA,EAAM,WAAW,IAAA,CAAK,SAAA,CAAU,UAAU,0BAA0B,CAAA;AAAA,IAC/G;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,KAAA,CAAM,GAAA,EAAa,OAAA,EAAmC;AAC1D,IAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,MAAA,MAAM,IAAI,SAAA,CAAU,CAAA,gDAAA,EAAmD,OAAO,GAAG,CAAA,CAAA,CAAG,CAAA;AAAA,IACtF;AACA,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,cAAA,CAAe,OAAO,CAAA;AAC9C,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,MAAA,EAAQ,GAAA,CAAI,KAAK,IAAI,CAAA;AACtC,IAAA,IAAI,KAAK,OAAO,GAAA;AAChB,IAAA,MAAM,UAAU,MAAM,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,KAAK,IAAI,CAAA;AACvD,IAAA,IAAA,CAAK,MAAA,EAAQ,IAAI,OAAO,CAAA;AACxB,IAAA,OAAO,OAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,OAAA,CAAQ,GAAA,EAAa,OAAA,EAAmC;AAC5D,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,MAAM,IAAA,CAAK,KAAA,CAAM,GAAA,EAAK,OAAO,CAAA;AAAA,IACzC,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,EAAE,GAAA,YAAe,uBAAA,CAAA,EAA0B,MAAM,GAAA;AACrD,MAAA,IAAI,IAAA,CAAK,aAAa,QAAA,EAAU;AAC9B,QAAA,IAAA,CAAK,OAAA,CAAQ,KAAA,CAAM,CAAA,+DAAA,EAAkE,GAAA,CAAI,OAAO,CAAA,CAAE,CAAA;AAClG,QAAA,MAAM,GAAA;AAAA,MACR;AACA,MAAA,OAAA,GAAU,mBAAmB,GAAA,EAAK,gBAAA,CAAiB,OAAO,CAAA,EAAG,IAAI,OAAO,CAAA;AACxE,MAAA,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,CAAA,qEAAA,EAAwE,GAAA,CAAI,OAAO,CAAA,CAAE,CAAA;AACvG,MAAA,mBAAA,CAAoB,IAAI,OAAO,CAAA;AAC/B,MAAA,IAAA,CAAK,QAAQ,OAAO,CAAA;AACpB,MAAA,OAAO,OAAA;AAAA,IACT;AACA,IAAA,IAAA,CAAK,QAAQ,OAAO,CAAA;AACpB,IAAA,IAAA,CAAK,KAAK,OAAO,CAAA;AACjB,IAAA,IAAI,QAAQ,QAAA,KAAa,SAAA,QAAiB,IAAI,mBAAA,CAAoB,SAAS,GAAG,CAAA;AAC9E,IAAA,OAAO,OAAA;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,OAAA,CAAQ,GAAA,EAAa,OAAA,EAAkC;AAC3D,IAAA,OAAO,aAAa,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,EAAK,OAAO,CAAC,CAAA;AAAA,EACtD;AAAA;AAAA,EAGA,MAAM,UAAA,CAAW,UAAA,EAA+B,OAAA,EAAqC;AACnF,IAAA,MAAM,MAAiB,EAAC;AACxB,IAAA,KAAA,MAAW,SAAA,IAAa,YAAY,GAAA,CAAI,IAAA,CAAK,MAAM,IAAA,CAAK,OAAA,CAAQ,SAAA,EAAW,OAAO,CAAC,CAAA;AACnF,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEA,UAAA,GAAmB;AACjB,IAAA,IAAA,CAAK,QAAQ,KAAA,EAAM;AAAA,EACrB;AAAA,EAEA,QAAQ,OAAA,EAAwB;AAC9B,IAAA,IAAI,CAAC,KAAK,SAAA,EAAW;AACrB,IAAA,IAAI;AACF,MAAA,IAAA,CAAK,UAAU,OAAO,CAAA;AAAA,IACxB,SAAS,GAAA,EAAK;AAEZ,MAAA,IAAA,CAAK,OAAA,CAAQ,KAAA,CAAM,CAAA,mCAAA,EAAsC,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,IAC7G;AAAA,EACF;AAAA,EAEA,KAAK,OAAA,EAAwB;AAE3B,IAAA,MAAM,KAAA,GAAQ,CAAA,KAAA,EAAQ,OAAA,CAAQ,QAAA,IAAY,GAAG,CAAA,UAAA,EAAa,OAAA,CAAQ,QAAA,IAAY,GAAG,CAAA,UAAA,EAAa,OAAA,CAAQ,OAAA,IAAW,GAAG,CAAA,CAAA;AACpH,IAAA,QAAQ,QAAQ,QAAA;AAAU,MACxB,KAAK,SAAA;AACH,QAAA,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,CAAA,2BAAA,EAA8B,KAAK,CAAA,CAAE,CAAA;AACvD,QAAA;AAAA,MACF,KAAK,SAAA;AACH,QAAA,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,CAAA,2BAAA,EAA8B,KAAK,CAAA,CAAE,CAAA;AACvD,QAAA;AAAA,MACF,KAAK,aAAA;AACH,QAAA,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,CAAA,2DAAA,EAA8D,KAAK,CAAA,CAAE,CAAA;AACvF,QAAA;AAAA,MACF,KAAK,WAAA;AACH,QAAA,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,CAAA,6BAAA,EAAgC,KAAK,CAAA,CAAE,CAAA;AACzD,QAAA;AAEA;AAEJ,IAAA,IAAI,QAAA,CAAS,OAAO,CAAA,EAAG,IAAA,CAAK,QAAQ,IAAA,CAAK,CAAA,oCAAA,EAAuC,KAAK,CAAA,CAAE,CAAA;AAAA,EACzF;AACF;AAEA,SAAS,oBAAoB,MAAA,EAAsB;AACjD,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,IAAe,OAAO,OAAA,CAAQ,gBAAgB,UAAA,EAAY;AAC/E,IAAA,OAAA,CAAQ,WAAA,CAAY,CAAA,sFAAA,EAAyF,MAAM,CAAA,CAAA,EAAI;AAAA,MACrH,IAAA,EAAM,wBAAA;AAAA,MACN,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACF;AAMA,IAAM,eAAN,MAAmB;AAAA,EACR,IAAA;AAAA,EACA,KAAA;AAAA,EACA,MAAA,uBAAa,GAAA,EAA8C;AAAA,EACpE,QAAA;AAAA,EAEA,WAAA,CAAY,KAAa,IAAA,EAAc;AACrC,IAAA,IAAA,CAAK,IAAA,GAAO,GAAA;AACZ,IAAA,IAAA,CAAK,KAAA,GAAQ,IAAA;AAAA,EACf;AAAA,EAEA,GAAA,CAAI,KAAa,OAAA,EAAsC;AACrD,IAAA,MAAM,GAAA,GAAM,CAAA,EAAG,OAAO,CAAA,EAAA,EAAS,GAAG,CAAA,CAAA;AAClC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AAChC,IAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAClB,IAAA,IAAI,KAAK,GAAA,EAAI,GAAI,IAAA,CAAK,EAAA,GAAK,KAAK,IAAA,EAAM;AACpC,MAAA,IAAA,CAAK,MAAA,CAAO,OAAO,GAAG,CAAA;AACtB,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,IAAA,CAAK,MAAA,CAAO,OAAO,GAAG,CAAA;AACtB,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAA,EAAK,IAAI,CAAA;AACzB,IAAA,OAAO,EAAE,GAAG,IAAA,CAAK,OAAA,EAAS,QAAQ,IAAA,EAAK;AAAA,EACzC;AAAA,EAEA,IAAI,OAAA,EAAwB;AAC1B,IAAA,IAAI,OAAA,CAAQ,aAAa,aAAA,EAAe;AACxC,IAAA,IAAI,OAAA,CAAQ,cAAA,IAAkB,OAAA,CAAQ,cAAA,KAAmB,KAAK,QAAA,EAAU;AACtE,MAAA,IAAI,IAAA,CAAK,QAAA,KAAa,MAAA,EAAW,IAAA,CAAK,OAAO,KAAA,EAAM;AACnD,MAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,cAAA;AAAA,IAC1B;AACA,IAAA,MAAM,MAAM,CAAA,EAAG,OAAA,CAAQ,OAAO,CAAA,EAAA,EAAS,QAAQ,GAAG,CAAA,CAAA;AAClD,IAAA,IAAA,CAAK,MAAA,CAAO,OAAO,GAAG,CAAA;AACtB,IAAA,IAAA,CAAK,MAAA,CAAO,IAAI,GAAA,EAAK,EAAE,IAAI,IAAA,CAAK,GAAA,EAAI,EAAG,OAAA,EAAS,CAAA;AAChD,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,IAAA,GAAO,IAAA,CAAK,KAAA,EAAO;AACpC,MAAA,MAAM,SAAS,IAAA,CAAK,MAAA,CAAO,IAAA,EAAK,CAAE,MAAK,CAAE,KAAA;AACzC,MAAA,IAAI,WAAW,MAAA,EAAW;AAC1B,MAAA,IAAA,CAAK,MAAA,CAAO,OAAO,MAAM,CAAA;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,KAAA,GAAc;AACZ,IAAA,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,EACpB;AACF,CAAA","file":"chunk-I4I35HUY.js","sourcesContent":["/**\n * Dialects the Vericto engine evaluates (`sqlite` since vericto-engine 4.1.0). The\n * wrappers still ask the server (`GET /api/v1/meta/config`) and refuse a dialect it\n * does not list.\n */\nexport const KNOWN_DIALECTS = ['postgres', 'mysql', 'oracle', 'mssql', 'snowflake', 'sqlite'] as const;\n\nconst ALIASES: Readonly<Record<string, string>> = {\n  postgres: 'postgres',\n  postgresql: 'postgres',\n  pg: 'postgres',\n  mysql: 'mysql',\n  mysql2: 'mysql',\n  mariadb: 'mysql',\n  oracle: 'oracle',\n  oracledb: 'oracle',\n  mssql: 'mssql',\n  sqlserver: 'mssql',\n  tedious: 'mssql',\n  snowflake: 'snowflake',\n  sqlite: 'sqlite',\n  sqlite3: 'sqlite',\n  'better-sqlite3': 'sqlite',\n};\n\n/**\n * Map a driver name to the Vericto dialect id. Unknown names pass through\n * lower-cased: the server decides, and answers with a clear error.\n */\nexport function normalizeDialect(name: string): string {\n  const key = name.trim().toLowerCase();\n  return ALIASES[key] ?? key;\n}\n","import type { Finding, Verdict } from './verdict.js';\n\n/** Base class of every error this package throws. */\nexport class VerictoError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = new.target.name;\n  }\n}\n\n/**\n * The client is misconfigured: missing or rejected API key, bad database id, a key\n * without the `proxy:evaluate` scope, or a malformed request. Thrown whatever the\n * fail mode is: failing open on a revoked key would switch the firewall off silently.\n */\nexport class VerictoConfigError extends VerictoError {\n  readonly status: number | undefined;\n  readonly code: string | undefined;\n\n  constructor(message: string, options: { status?: number; code?: string } = {}) {\n    super(message);\n    this.status = options.status;\n    this.code = options.code;\n  }\n}\n\n/**\n * The Vericto server does not evaluate this dialect (it is missing from\n * `GET /api/v1/meta/config`, e.g. `sqlite` on a server older than vericto-engine\n * 4.1.0). No SQL was executed.\n */\nexport class VerictoUnsupportedDialectError extends VerictoConfigError {\n  readonly dialect: string;\n  readonly supported: readonly string[];\n\n  constructor(dialect: string, supported: readonly string[], apiUrl: string) {\n    const listed = supported.length ? supported.join(', ') : 'none reported';\n    super(\n      `The Vericto API at ${apiUrl} does not support the '${dialect}' dialect (supported: ${listed}). ` +\n        'No SQL was executed. Upgrade the server, or use a supported dialect.',\n      { code: 'UNSUPPORTED_DIALECT' },\n    );\n    this.dialect = dialect;\n    this.supported = supported;\n  }\n}\n\n/**\n * Vericto could not return a verdict after the configured retries. With\n * `failMode: 'closed'` (the default) the statement is not executed and this is thrown.\n */\nexport class VerictoUnavailableError extends VerictoError {\n  readonly status: number | undefined;\n  readonly code: string | undefined;\n\n  constructor(message: string, options: { status?: number; code?: string } = {}) {\n    super(message);\n    this.status = options.status;\n    this.code = options.code;\n  }\n}\n\n/** The workspace used its monthly query quota (HTTP 429 `QUOTA_EXCEEDED`). Not retried. */\nexport class VerictoQuotaExceededError extends VerictoUnavailableError {\n  readonly resetsAt: string | undefined;\n  readonly upgradeUrl: string | undefined;\n\n  constructor(message: string, options: { resetsAt?: string; upgradeUrl?: string } = {}) {\n    super(message, { status: 429, code: 'QUOTA_EXCEEDED' });\n    this.resetsAt = options.resetsAt;\n    this.upgradeUrl = options.upgradeUrl;\n  }\n}\n\n/** Vericto blocked the statement. It was not executed. */\nexport class VerictoBlockedError extends VerictoError {\n  readonly verdict: Verdict;\n  readonly sql: string;\n\n  constructor(verdict: Verdict, sql: string) {\n    let message = `Query blocked by ${verdict.ruleCode ?? 'a Vericto rule'}`;\n    if (verdict.severity) message += ` (severity ${verdict.severity})`;\n    if (verdict.message) message += `: ${verdict.message}`;\n    if (verdict.suggestedFix) message += `. Suggested fix: ${verdict.suggestedFix}`;\n    super(message);\n    this.verdict = verdict;\n    this.sql = sql;\n  }\n\n  get findings(): readonly Finding[] {\n    return this.verdict.findings;\n  }\n\n  get suggestedFix(): string | undefined {\n    return this.verdict.suggestedFix;\n  }\n}\n","/**\n * What Vericto decided. `UNEVALUATED` is local: Vericto could not answer and the\n * guard runs with `failMode: 'open'`, so the statement ran without a verdict.\n */\nexport type Decision = 'ALLOWED' | 'FLAGGED' | 'MONITORED' | 'PARSE_ERROR' | 'BLOCKED' | 'UNEVALUATED';\n\nconst SERVER_DECISIONS: ReadonlySet<string> = new Set(['ALLOWED', 'FLAGGED', 'MONITORED', 'PARSE_ERROR', 'BLOCKED']);\n\n/** A rule that matched the statement. */\nexport interface Finding {\n  readonly ruleCode: string;\n  readonly severity?: string;\n  readonly ruleId?: string;\n  readonly astNodePath?: string;\n  readonly suggestedFix?: string;\n}\n\n/** Vericto's answer for one statement. */\nexport interface Verdict {\n  readonly decision: Decision;\n  /** The statement as submitted. */\n  readonly sql: string;\n  readonly dialect: string;\n  readonly ruleCode?: string;\n  readonly severity?: string;\n  readonly message?: string;\n  readonly suggestedFix?: string;\n  /**\n   * When set, the statement to run **instead of** `sql`: the sensitive columns it\n   * reads come back masked (Sensitive Column Protection).\n   */\n  readonly rewrittenQuery?: string;\n  readonly parseError?: string;\n  readonly findings: readonly Finding[];\n  readonly sensitiveColumns: readonly unknown[];\n  readonly accessDenied: readonly unknown[];\n  /** The audit-trail event id. */\n  readonly eventId?: string;\n  readonly rulesetVersion?: string;\n  readonly cached: boolean;\n  /** The response body, for fields this version does not model yet. */\n  readonly raw: Readonly<Record<string, unknown>>;\n}\n\n/** The statement the driver must run: the masked rewrite when there is one. */\nexport function sqlToExecute(verdict: Verdict): string {\n  return verdict.rewrittenQuery ?? verdict.sql;\n}\n\nexport function isMasked(verdict: Verdict): boolean {\n  return Boolean(verdict.rewrittenQuery);\n}\n\n/** Build a verdict from a `POST /api/v1/proxy/query` response body. */\nexport function verdictFromResponse(body: Record<string, unknown>, sql: string, dialect: string): Verdict {\n  const raw = (typeof body.decision === 'string' ? body.decision : '').toUpperCase();\n  // An unknown decision must never be read as \"allowed\".\n  const decision: Decision = SERVER_DECISIONS.has(raw) ? (raw as Decision) : 'BLOCKED';\n  const ruleCode = optStr(body.rule_code);\n  const severity = optStr(body.severity);\n  const suggestedFix = optStr(body.suggested_safe_query);\n  let message = optStr(body.error);\n  if (message && ruleCode && message === `Query blocked by rule ${ruleCode}`) message = undefined;\n  return {\n    decision,\n    sql,\n    dialect,\n    ruleCode,\n    severity,\n    message,\n    suggestedFix,\n    // A blocked statement never runs, so it has nothing to rewrite.\n    rewrittenQuery: decision === 'BLOCKED' ? undefined : optStr(body.rewritten_query),\n    parseError: optStr(body.parse_error),\n    findings: findingsOf(body, ruleCode, severity, suggestedFix),\n    sensitiveColumns: Array.isArray(body.sensitive_columns) ? body.sensitive_columns : [],\n    accessDenied: Array.isArray(body.access_denied) ? body.access_denied : [],\n    eventId: optStr(body.event_id),\n    rulesetVersion: optStr(body.ruleset_version),\n    cached: false,\n    raw: body,\n  };\n}\n\nexport function unevaluatedVerdict(sql: string, dialect: string, reason: string): Verdict {\n  return {\n    decision: 'UNEVALUATED',\n    sql,\n    dialect,\n    message: reason,\n    findings: [],\n    sensitiveColumns: [],\n    accessDenied: [],\n    cached: false,\n    raw: {},\n  };\n}\n\nfunction optStr(value: unknown): string | undefined {\n  if (value === null || value === undefined || value === '') return undefined;\n  return typeof value === 'string' ? value : JSON.stringify(value);\n}\n\nfunction findingsOf(\n  body: Record<string, unknown>,\n  ruleCode: string | undefined,\n  severity: string | undefined,\n  suggestedFix: string | undefined,\n): Finding[] {\n  // The Runtime API reports the deciding rule; a later version may send the full list.\n  const listed = body.findings ?? body.violations;\n  if (Array.isArray(listed)) {\n    const out: Finding[] = [];\n    for (const item of listed as unknown[]) {\n      if (!item || typeof item !== 'object') continue;\n      const f = item as Record<string, unknown>;\n      const code = optStr(f.rule_code ?? f.code);\n      if (!code) continue;\n      out.push({\n        ruleCode: code,\n        severity: optStr(f.severity),\n        ruleId: optStr(f.rule_id),\n        astNodePath: optStr(f.ast_node_path),\n        suggestedFix: optStr(f.suggested_safe_query ?? f.suggested_fix),\n      });\n    }\n    if (out.length) return out;\n  }\n  if (!ruleCode) return [];\n  return [\n    {\n      ruleCode,\n      severity,\n      ruleId: optStr(body.rule_id),\n      astNodePath: optStr(body.ast_node_path),\n      suggestedFix,\n    },\n  ];\n}\n","/** The package version (kept in sync with package.json by a test). */\nexport const VERSION = '0.2.0';\n","import {\n  VerictoConfigError,\n  VerictoQuotaExceededError,\n  VerictoUnavailableError,\n  VerictoUnsupportedDialectError,\n} from './errors.js';\nimport type { Evaluator } from './evaluator.js';\nimport { verdictFromResponse, type Verdict } from './verdict.js';\nimport { VERSION } from './version.js';\n\nexport const DEFAULT_API_URL = 'https://api.vericto.com';\nexport const EVALUATE_PATH = '/api/v1/proxy/query';\nexport const CONFIG_PATH = '/api/v1/meta/config';\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nconst RETRYABLE = new Set([500, 502, 503, 504]);\nconst LOCAL_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]', '::1']);\nconst MAX_BACKOFF_MS = 2000;\n\ntype FetchLike = (input: string, init: RequestInit) => Promise<Response>;\n\nexport interface RuntimeApiOptions {\n  /** API key (`vtro_...`, scope `proxy:evaluate`). Default: `VERICTO_API_KEY`. */\n  apiKey?: string;\n  /** The registered database (UUID). Default: `VERICTO_DATABASE_ID`. */\n  databaseId?: string;\n  /** API base URL. Default: `VERICTO_API_URL`, then `https://api.vericto.com`. */\n  apiUrl?: string;\n  /** Per-attempt timeout in milliseconds. Default: `VERICTO_TIMEOUT` (seconds) or 5000. */\n  timeoutMs?: number;\n  /** Retries after the first attempt for network errors, timeouts, 5xx and 429 rate limits. Default 2. */\n  maxRetries?: number;\n  /** Base backoff in milliseconds (exponential, with jitter, capped at 2 s). Default 200. */\n  backoffMs?: number;\n  /** How long the server's dialect list is cached, in milliseconds. Default 10 minutes. */\n  dialectsTtlMs?: number;\n  /** A `fetch` implementation (tests, proxies). Default: the global `fetch`. */\n  fetch?: FetchLike;\n  /** Environment to read the defaults from. Default: `process.env`. */\n  env?: Record<string, string | undefined>;\n}\n\n/**\n * Evaluates statements with the Vericto Runtime API (`POST /api/v1/proxy/query`).\n *\n * The key is sent in the `X-API-Key` header, over HTTPS only (plain HTTP is accepted\n * for localhost alone), and never appears in messages or `toString()`. To trust an\n * extra CA, use Node's `NODE_EXTRA_CA_CERTS`.\n */\nexport class RuntimeApiEvaluator implements Evaluator {\n  readonly apiUrl: string;\n  readonly databaseId: string;\n  readonly timeoutMs: number;\n  readonly maxRetries: number;\n  readonly #apiKey: string;\n  readonly #backoffMs: number;\n  readonly #dialectsTtlMs: number;\n  readonly #fetch: FetchLike;\n  #dialects: readonly string[] | undefined;\n  #dialectsAt = 0;\n  #dialectsPending: Promise<readonly string[] | undefined> | undefined;\n\n  constructor(options: RuntimeApiOptions = {}) {\n    const env = options.env ?? (typeof process !== 'undefined' ? process.env : {});\n    const key = (options.apiKey ?? env.VERICTO_API_KEY ?? '').trim();\n    if (!key) {\n      throw new VerictoConfigError(\n        'No Vericto API key: pass apiKey or set VERICTO_API_KEY (a vtro_... key with the proxy:evaluate scope).',\n      );\n    }\n    if (!key.startsWith('vtro_')) {\n      throw new VerictoConfigError(\"The Vericto API key must start with 'vtro_' (the value itself is not shown).\");\n    }\n    this.#apiKey = key;\n\n    const db = (options.databaseId ?? env.VERICTO_DATABASE_ID ?? '').trim();\n    if (!db) {\n      throw new VerictoConfigError(\n        'No Vericto database id: pass databaseId or set VERICTO_DATABASE_ID ' +\n          '(the id of the database registered in your Vericto workspace).',\n      );\n    }\n    if (!UUID_RE.test(db)) {\n      throw new VerictoConfigError(`The Vericto database id must be a UUID, got ${JSON.stringify(db.slice(0, 64))}.`);\n    }\n    this.databaseId = db.toLowerCase();\n\n    const url = ((options.apiUrl ?? env.VERICTO_API_URL ?? '').trim() || DEFAULT_API_URL).replace(/\\/+$/, '');\n    let parsed: URL;\n    try {\n      parsed = new URL(url);\n    } catch {\n      throw new VerictoConfigError(`Invalid Vericto API URL ${JSON.stringify(url)}: expected https://host.`);\n    }\n    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {\n      throw new VerictoConfigError(`Invalid Vericto API URL ${JSON.stringify(url)}: expected https://host.`);\n    }\n    if (parsed.protocol === 'http:' && !LOCAL_HOSTS.has(parsed.hostname)) {\n      throw new VerictoConfigError(`Refusing to send the API key over plain HTTP to ${parsed.hostname}: use https://.`);\n    }\n    this.apiUrl = url;\n\n    let timeoutMs = options.timeoutMs;\n    if (timeoutMs === undefined) {\n      const fromEnv = (env.VERICTO_TIMEOUT ?? '').trim();\n      timeoutMs = fromEnv ? Number(fromEnv) * 1000 : 5000;\n      if (!Number.isFinite(timeoutMs)) {\n        throw new VerictoConfigError(`VERICTO_TIMEOUT must be a number of seconds, got ${JSON.stringify(fromEnv)}.`);\n      }\n    }\n    if (!(timeoutMs > 0)) throw new VerictoConfigError('timeoutMs must be greater than 0.');\n    const maxRetries = options.maxRetries ?? 2;\n    if (!(maxRetries >= 0)) throw new VerictoConfigError('maxRetries cannot be negative.');\n    this.timeoutMs = timeoutMs;\n    this.maxRetries = Math.floor(maxRetries);\n    this.#backoffMs = Math.max(0, options.backoffMs ?? 200);\n    this.#dialectsTtlMs = options.dialectsTtlMs ?? 600_000;\n    // Typed as optional: Node < 18 has no global fetch.\n    const f = options.fetch ?? (globalThis as { fetch?: FetchLike }).fetch;\n    if (!f) throw new VerictoConfigError('No fetch implementation: Node 18+ is required, or pass options.fetch.');\n    this.#fetch = f;\n  }\n\n  toString(): string {\n    return `RuntimeApiEvaluator(apiUrl=${this.apiUrl}, databaseId=${this.databaseId})`;\n  }\n\n  toJSON(): Record<string, unknown> {\n    return { apiUrl: this.apiUrl, databaseId: this.databaseId };\n  }\n\n  async evaluate(sql: string, dialect: string): Promise<Verdict> {\n    const payload = JSON.stringify({ query: sql, database_id: this.databaseId, dialect });\n    let lastError = 'no attempt made';\n    let retryAfterMs: number | undefined;\n\n    for (let attempt = 0; attempt <= this.maxRetries; attempt++) {\n      if (attempt > 0) await sleep(this.#delay(attempt, retryAfterMs));\n      retryAfterMs = undefined;\n\n      let response: Response;\n      try {\n        response = await this.#request(EVALUATE_PATH, {\n          method: 'POST',\n          headers: { ...this.#headers(), 'Content-Type': 'application/json', 'X-API-Key': this.#apiKey },\n          body: payload,\n        });\n      } catch (err) {\n        lastError = `${errorName(err)} while calling ${this.apiUrl}`;\n        continue;\n      }\n\n      const status = response.status;\n      const body = await jsonBody(response);\n      if (status === 200 || (status === 403 && (typeof body.decision === 'string' ? body.decision : '').toUpperCase() === 'BLOCKED')) {\n        if (!('decision' in body)) {\n          lastError = `HTTP ${status} without a decision from ${this.apiUrl}`;\n          continue;\n        }\n        return verdictFromResponse(body, sql, dialect);\n      }\n\n      const error = body.error && typeof body.error === 'object' ? (body.error as Record<string, unknown>) : {};\n      const code = typeof error.code === 'string' && error.code ? error.code : undefined;\n      const message = typeof error.message === 'string' && error.message ? error.message : undefined;\n\n      if (status === 429 && code === 'QUOTA_EXCEEDED') {\n        const resetsAt = typeof error.resets_at === 'string' ? error.resets_at : undefined;\n        throw new VerictoQuotaExceededError(\n          `The Vericto workspace has used its monthly query quota${resetsAt ? `; it resets at ${resetsAt}` : ''}.`,\n          { resetsAt, upgradeUrl: typeof error.upgrade_url === 'string' ? error.upgrade_url : undefined },\n        );\n      }\n      if (status === 429 || RETRYABLE.has(status)) {\n        lastError = `HTTP ${status}${code ? ` ${code}` : ''} from ${this.apiUrl}`;\n        retryAfterMs = retryAfter(response.headers.get('retry-after'), error.retry_after_seconds);\n        continue;\n      }\n      throw await this.#configError(status, code, message, dialect);\n    }\n    throw new VerictoUnavailableError(\n      `Vericto did not return a verdict after ${this.maxRetries + 1} attempt(s): ${lastError}.`,\n    );\n  }\n\n  /**\n   * The dialects the server evaluates (`GET /api/v1/meta/config`), cached. `undefined`\n   * when the server cannot be asked; the evaluation request then decides.\n   */\n  async supportedDialects(): Promise<readonly string[] | undefined> {\n    if (this.#dialects && Date.now() - this.#dialectsAt < this.#dialectsTtlMs) return this.#dialects;\n    this.#dialectsPending ??= this.#fetchDialects().finally(() => {\n      this.#dialectsPending = undefined;\n    });\n    return this.#dialectsPending;\n  }\n\n  async #fetchDialects(): Promise<readonly string[] | undefined> {\n    try {\n      const response = await this.#request(CONFIG_PATH, { method: 'GET', headers: this.#headers() });\n      if (response.status !== 200) return this.#dialects;\n      const listed = (await jsonBody(response)).dialects;\n      if (!Array.isArray(listed)) return this.#dialects;\n      const ids = listed\n        .map((d: unknown) => (d && typeof d === 'object' ? (d as Record<string, unknown>).id : undefined))\n        .filter((id): id is string => typeof id === 'string' && id.length > 0);\n      this.#dialects = ids;\n      this.#dialectsAt = Date.now();\n      return ids;\n    } catch {\n      return this.#dialects;\n    }\n  }\n\n  #headers(): Record<string, string> {\n    return { Accept: 'application/json', 'User-Agent': `vericto-node/${VERSION}` };\n  }\n\n  async #request(path: string, init: RequestInit): Promise<Response> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => { controller.abort(); }, this.timeoutMs);\n    try {\n      return await this.#fetch(this.apiUrl + path, { ...init, redirect: 'manual', signal: controller.signal });\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n\n  #delay(attempt: number, retryAfterMs: number | undefined): number {\n    if (retryAfterMs !== undefined) return Math.min(retryAfterMs, MAX_BACKOFF_MS);\n    const base = this.#backoffMs * 2 ** (attempt - 1);\n    return Math.min(MAX_BACKOFF_MS, base * (0.5 + Math.random() / 2));\n  }\n\n  async #configError(\n    status: number,\n    code: string | undefined,\n    message: string | undefined,\n    dialect: string,\n  ): Promise<VerictoConfigError> {\n    if (status === 401) {\n      return new VerictoConfigError('Vericto rejected the API key (HTTP 401). Check VERICTO_API_KEY.', {\n        status,\n        code,\n      });\n    }\n    if (status === 403) {\n      return new VerictoConfigError(\n        `Vericto refused the request (HTTP 403${code ? `, ${code}` : ''}): ` +\n          `${message ?? 'the key lacks the proxy:evaluate scope or this database'}.`,\n        { status, code },\n      );\n    }\n    if (status === 400) {\n      const supported = await this.supportedDialects();\n      if (supported && !supported.includes(dialect)) {\n        return new VerictoUnsupportedDialectError(dialect, supported, this.apiUrl);\n      }\n    }\n    return new VerictoConfigError(\n      `Vericto rejected the request (HTTP ${status}${code ? `, ${code}` : ''})${message ? `: ${message}` : '.'}`,\n      { status, code },\n    );\n  }\n}\n\nasync function jsonBody(response: Response): Promise<Record<string, unknown>> {\n  try {\n    const text = await response.text();\n    const parsed: unknown = text ? JSON.parse(text) : {};\n    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? (parsed as Record<string, unknown>) : {};\n  } catch {\n    return {};\n  }\n}\n\nfunction retryAfter(header: string | null, bodyValue: unknown): number | undefined {\n  for (const value of [header, bodyValue]) {\n    if (value === null || value === undefined || value === '') continue;\n    const seconds = Number(value);\n    if (Number.isFinite(seconds)) return Math.max(0, seconds * 1000);\n  }\n  return undefined;\n}\n\nfunction errorName(err: unknown): string {\n  if (err instanceof Error) return err.name === 'AbortError' ? 'Timeout' : err.name;\n  return 'Error';\n}\n\nfunction sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n","import { normalizeDialect } from './dialects.js';\nimport {\n  VerictoBlockedError,\n  VerictoConfigError,\n  VerictoUnavailableError,\n  VerictoUnsupportedDialectError,\n} from './errors.js';\nimport type { Evaluator } from './evaluator.js';\nimport { RuntimeApiEvaluator, type RuntimeApiOptions } from './runtime-api.js';\nimport { isMasked, sqlToExecute, unevaluatedVerdict, type Verdict } from './verdict.js';\n\nexport type FailMode = 'closed' | 'open';\n\n/** Where the guard reports. The SQL text is never passed to it. */\nexport interface VerictoLogger {\n  info(message: string): void;\n  warn(message: string): void;\n  error(message: string): void;\n}\n\nexport interface VerictoOptions extends RuntimeApiOptions {\n  /** What evaluates statements. Default: a `RuntimeApiEvaluator` from the options above. */\n  evaluator?: Evaluator;\n  /**\n   * `closed` (default, or `VERICTO_FAIL_MODE`): when Vericto cannot answer, reject with\n   * `VerictoUnavailableError` and do not run the statement. `open`: run it unevaluated,\n   * emit a process warning (`VerictoFailOpenWarning`) and log it.\n   */\n  failMode?: FailMode;\n  /** Milliseconds to reuse a verdict for the same `(sql, dialect)`. 0 (default) disables it. */\n  cacheTtlMs?: number;\n  /** Maximum cached verdicts. Default 1024. */\n  cacheSize?: number;\n  /** Called with every verdict, including `UNEVALUATED` and `BLOCKED` ones. */\n  onVerdict?: (verdict: Verdict) => void;\n  /** Default: `console` for warnings and errors, silent for info. `false` silences it. */\n  logger?: VerictoLogger | false;\n}\n\nconst DEFAULT_LOGGER: VerictoLogger = {\n  info: () => {},\n  warn: (m) => { console.warn(m); },\n  error: (m) => { console.error(m); },\n};\nconst SILENT: VerictoLogger = { info: () => {}, warn: () => {}, error: () => {} };\n\n/**\n * Checks SQL with Vericto before it runs. Share one instance per process; the\n * wrappers call `enforce` for every statement, and you can call it yourself around\n * any other driver.\n */\nexport class Vericto {\n  readonly evaluator: Evaluator;\n  readonly failMode: FailMode;\n  readonly onVerdict: ((verdict: Verdict) => void) | undefined;\n  readonly #logger: VerictoLogger;\n  readonly #cache: VerdictCache | undefined;\n\n  constructor(options: VerictoOptions = {}) {\n    this.evaluator = options.evaluator ?? new RuntimeApiEvaluator(options);\n    const env = options.env ?? (typeof process !== 'undefined' ? process.env : {});\n    const mode = (options.failMode ?? env.VERICTO_FAIL_MODE ?? 'closed').trim().toLowerCase();\n    if (mode !== 'closed' && mode !== 'open') {\n      throw new VerictoConfigError(`failMode must be 'closed' or 'open', got ${JSON.stringify(mode)}.`);\n    }\n    this.failMode = mode;\n    const ttl = options.cacheTtlMs ?? 0;\n    const size = options.cacheSize ?? 1024;\n    if (ttl < 0 || size < 1) throw new VerictoConfigError('cacheTtlMs must be >= 0 and cacheSize >= 1.');\n    this.#cache = ttl > 0 ? new VerdictCache(ttl, size) : undefined;\n    this.onVerdict = options.onVerdict;\n    this.#logger = options.logger === false ? SILENT : (options.logger ?? DEFAULT_LOGGER);\n  }\n\n  /**\n   * Fail fast if the server reports that it does not evaluate `dialect`. Resolves the\n   * normalized dialect id. When the server cannot be asked, nothing is thrown here.\n   */\n  async requireDialect(dialect: string): Promise<string> {\n    const name = normalizeDialect(dialect);\n    const supported = await this.evaluator.supportedDialects();\n    if (supported && !supported.includes(name)) {\n      throw new VerictoUnsupportedDialectError(name, supported, this.evaluator.apiUrl ?? 'the configured evaluator');\n    }\n    return name;\n  }\n\n  /**\n   * Evaluate `sql` and resolve the verdict, whatever it is. Does not apply the fail\n   * mode and does not reject on `BLOCKED`: use it to ask, and `enforce` to guard.\n   */\n  async check(sql: string, dialect: string): Promise<Verdict> {\n    if (typeof sql !== 'string') {\n      throw new TypeError(`vericto: expected the SQL text as a string, got ${typeof sql}.`);\n    }\n    const name = await this.requireDialect(dialect);\n    const hit = this.#cache?.get(sql, name);\n    if (hit) return hit;\n    const verdict = await this.evaluator.evaluate(sql, name);\n    this.#cache?.put(verdict);\n    return verdict;\n  }\n\n  /**\n   * Evaluate `sql` and apply the decision: reject with `VerictoBlockedError` on\n   * `BLOCKED`; log `FLAGGED`/`MONITORED`/allowed `PARSE_ERROR`; apply the fail mode\n   * when Vericto cannot answer. Run `sqlToExecute(verdict)` (the masked rewrite, if any).\n   */\n  async enforce(sql: string, dialect: string): Promise<Verdict> {\n    let verdict: Verdict;\n    try {\n      verdict = await this.check(sql, dialect);\n    } catch (err) {\n      if (!(err instanceof VerictoUnavailableError)) throw err;\n      if (this.failMode === 'closed') {\n        this.#logger.error(`vericto: no verdict, statement not executed (failMode=closed): ${err.message}`);\n        throw err;\n      }\n      verdict = unevaluatedVerdict(sql, normalizeDialect(dialect), err.message);\n      this.#logger.warn(`vericto: no verdict, statement executed unevaluated (failMode=open): ${err.message}`);\n      emitFailOpenWarning(err.message);\n      this.#notify(verdict);\n      return verdict;\n    }\n    this.#notify(verdict);\n    this.#log(verdict);\n    if (verdict.decision === 'BLOCKED') throw new VerictoBlockedError(verdict, sql);\n    return verdict;\n  }\n\n  /** `enforce`, resolving the SQL text to execute. */\n  async prepare(sql: string, dialect: string): Promise<string> {\n    return sqlToExecute(await this.enforce(sql, dialect));\n  }\n\n  /** Enforce a batch in order; a block anywhere rejects before the caller runs any of it. */\n  async enforceAll(statements: readonly string[], dialect: string): Promise<Verdict[]> {\n    const out: Verdict[] = [];\n    for (const statement of statements) out.push(await this.enforce(statement, dialect));\n    return out;\n  }\n\n  clearCache(): void {\n    this.#cache?.clear();\n  }\n\n  #notify(verdict: Verdict): void {\n    if (!this.onVerdict) return;\n    try {\n      this.onVerdict(verdict);\n    } catch (err) {\n      // A broken callback must not change the decision.\n      this.#logger.error(`vericto: onVerdict callback threw: ${err instanceof Error ? err.message : String(err)}`);\n    }\n  }\n\n  #log(verdict: Verdict): void {\n    // The SQL text is never logged: it can carry personal data in literals.\n    const extra = `rule=${verdict.ruleCode ?? '-'} severity=${verdict.severity ?? '-'} event_id=${verdict.eventId ?? '-'}`;\n    switch (verdict.decision) {\n      case 'BLOCKED':\n        this.#logger.warn(`vericto: statement BLOCKED ${extra}`);\n        break;\n      case 'FLAGGED':\n        this.#logger.warn(`vericto: statement FLAGGED ${extra}`);\n        break;\n      case 'PARSE_ERROR':\n        this.#logger.warn(`vericto: statement not parsed, allowed by workspace policy ${extra}`);\n        break;\n      case 'MONITORED':\n        this.#logger.info(`vericto: statement MONITORED ${extra}`);\n        break;\n      default:\n        break;\n    }\n    if (isMasked(verdict)) this.#logger.info(`vericto: running the masked rewrite ${extra}`);\n  }\n}\n\nfunction emitFailOpenWarning(reason: string): void {\n  if (typeof process !== 'undefined' && typeof process.emitWarning === 'function') {\n    process.emitWarning(`Vericto could not evaluate the statement and failMode is 'open', so it ran unchecked: ${reason}`, {\n      type: 'VerictoFailOpenWarning',\n      code: 'VERICTO_FAIL_OPEN',\n    });\n  }\n}\n\n/**\n * Small TTL + LRU cache of server verdicts, keyed by `(sql, dialect)`. Dropped whole\n * when a response reports a different `ruleset_version`.\n */\nclass VerdictCache {\n  readonly #ttl: number;\n  readonly #size: number;\n  readonly #items = new Map<string, { at: number; verdict: Verdict }>();\n  #ruleset: string | undefined;\n\n  constructor(ttl: number, size: number) {\n    this.#ttl = ttl;\n    this.#size = size;\n  }\n\n  get(sql: string, dialect: string): Verdict | undefined {\n    const key = `${dialect}\\u0000${sql}`;\n    const item = this.#items.get(key);\n    if (!item) return undefined;\n    if (Date.now() - item.at > this.#ttl) {\n      this.#items.delete(key);\n      return undefined;\n    }\n    this.#items.delete(key);\n    this.#items.set(key, item);\n    return { ...item.verdict, cached: true };\n  }\n\n  put(verdict: Verdict): void {\n    if (verdict.decision === 'UNEVALUATED') return;\n    if (verdict.rulesetVersion && verdict.rulesetVersion !== this.#ruleset) {\n      if (this.#ruleset !== undefined) this.#items.clear();\n      this.#ruleset = verdict.rulesetVersion;\n    }\n    const key = `${verdict.dialect}\\u0000${verdict.sql}`;\n    this.#items.delete(key);\n    this.#items.set(key, { at: Date.now(), verdict });\n    while (this.#items.size > this.#size) {\n      const oldest = this.#items.keys().next().value;\n      if (oldest === undefined) break;\n      this.#items.delete(oldest);\n    }\n  }\n\n  clear(): void {\n    this.#items.clear();\n  }\n}\n"]}

package/dist/guard-BVpq8ytG.d.cts

@@ -0,0 +1,175 @@
+/**
+ * What Vericto decided. `UNEVALUATED` is local: Vericto could not answer and the
+ * guard runs with `failMode: 'open'`, so the statement ran without a verdict.
+ */
+type Decision = 'ALLOWED' | 'FLAGGED' | 'MONITORED' | 'PARSE_ERROR' | 'BLOCKED' | 'UNEVALUATED';
+/** A rule that matched the statement. */
+interface Finding {
+    readonly ruleCode: string;
+    readonly severity?: string;
+    readonly ruleId?: string;
+    readonly astNodePath?: string;
+    readonly suggestedFix?: string;
+}
+/** Vericto's answer for one statement. */
+interface Verdict {
+    readonly decision: Decision;
+    /** The statement as submitted. */
+    readonly sql: string;
+    readonly dialect: string;
+    readonly ruleCode?: string;
+    readonly severity?: string;
+    readonly message?: string;
+    readonly suggestedFix?: string;
+    /**
+     * When set, the statement to run **instead of** `sql`: the sensitive columns it
+     * reads come back masked (Sensitive Column Protection).
+     */
+    readonly rewrittenQuery?: string;
+    readonly parseError?: string;
+    readonly findings: readonly Finding[];
+    readonly sensitiveColumns: readonly unknown[];
+    readonly accessDenied: readonly unknown[];
+    /** The audit-trail event id. */
+    readonly eventId?: string;
+    readonly rulesetVersion?: string;
+    readonly cached: boolean;
+    /** The response body, for fields this version does not model yet. */
+    readonly raw: Readonly<Record<string, unknown>>;
+}
+/** The statement the driver must run: the masked rewrite when there is one. */
+declare function sqlToExecute(verdict: Verdict): string;
+declare function isMasked(verdict: Verdict): boolean;
+/** Build a verdict from a `POST /api/v1/proxy/query` response body. */
+declare function verdictFromResponse(body: Record<string, unknown>, sql: string, dialect: string): Verdict;
+
+/**
+ * Turns `(sql, dialect)` into a verdict.
+ *
+ * This release ships one implementation, `RuntimeApiEvaluator`, which asks the Vericto
+ * Runtime API. An embedded evaluator (the engine in-process, for example as WASM or a
+ * native addon with synced rules) can be added later behind the same interface
+ * without touching the wrappers.
+ *
+ * Implementations resolve a verdict for every evaluated statement (`BLOCKED`
+ * included: blocking is the guard's job), reject with `VerictoUnavailableError` when
+ * no verdict can be produced, and with `VerictoConfigError` when the request can
+ * never succeed.
+ */
+interface Evaluator {
+    evaluate(sql: string, dialect: string): Promise<Verdict>;
+    /** The dialects this evaluator handles, or `undefined` when it cannot tell. */
+    supportedDialects(): Promise<readonly string[] | undefined>;
+    /** Shown in error messages. */
+    readonly apiUrl?: string;
+}
+
+declare const DEFAULT_API_URL = "https://api.vericto.com";
+declare const EVALUATE_PATH = "/api/v1/proxy/query";
+declare const CONFIG_PATH = "/api/v1/meta/config";
+type FetchLike = (input: string, init: RequestInit) => Promise<Response>;
+interface RuntimeApiOptions {
+    /** API key (`vtro_...`, scope `proxy:evaluate`). Default: `VERICTO_API_KEY`. */
+    apiKey?: string;
+    /** The registered database (UUID). Default: `VERICTO_DATABASE_ID`. */
+    databaseId?: string;
+    /** API base URL. Default: `VERICTO_API_URL`, then `https://api.vericto.com`. */
+    apiUrl?: string;
+    /** Per-attempt timeout in milliseconds. Default: `VERICTO_TIMEOUT` (seconds) or 5000. */
+    timeoutMs?: number;
+    /** Retries after the first attempt for network errors, timeouts, 5xx and 429 rate limits. Default 2. */
+    maxRetries?: number;
+    /** Base backoff in milliseconds (exponential, with jitter, capped at 2 s). Default 200. */
+    backoffMs?: number;
+    /** How long the server's dialect list is cached, in milliseconds. Default 10 minutes. */
+    dialectsTtlMs?: number;
+    /** A `fetch` implementation (tests, proxies). Default: the global `fetch`. */
+    fetch?: FetchLike;
+    /** Environment to read the defaults from. Default: `process.env`. */
+    env?: Record<string, string | undefined>;
+}
+/**
+ * Evaluates statements with the Vericto Runtime API (`POST /api/v1/proxy/query`).
+ *
+ * The key is sent in the `X-API-Key` header, over HTTPS only (plain HTTP is accepted
+ * for localhost alone), and never appears in messages or `toString()`. To trust an
+ * extra CA, use Node's `NODE_EXTRA_CA_CERTS`.
+ */
+declare class RuntimeApiEvaluator implements Evaluator {
+    #private;
+    readonly apiUrl: string;
+    readonly databaseId: string;
+    readonly timeoutMs: number;
+    readonly maxRetries: number;
+    constructor(options?: RuntimeApiOptions);
+    toString(): string;
+    toJSON(): Record<string, unknown>;
+    evaluate(sql: string, dialect: string): Promise<Verdict>;
+    /**
+     * The dialects the server evaluates (`GET /api/v1/meta/config`), cached. `undefined`
+     * when the server cannot be asked; the evaluation request then decides.
+     */
+    supportedDialects(): Promise<readonly string[] | undefined>;
+}
+
+type FailMode = 'closed' | 'open';
+/** Where the guard reports. The SQL text is never passed to it. */
+interface VerictoLogger {
+    info(message: string): void;
+    warn(message: string): void;
+    error(message: string): void;
+}
+interface VerictoOptions extends RuntimeApiOptions {
+    /** What evaluates statements. Default: a `RuntimeApiEvaluator` from the options above. */
+    evaluator?: Evaluator;
+    /**
+     * `closed` (default, or `VERICTO_FAIL_MODE`): when Vericto cannot answer, reject with
+     * `VerictoUnavailableError` and do not run the statement. `open`: run it unevaluated,
+     * emit a process warning (`VerictoFailOpenWarning`) and log it.
+     */
+    failMode?: FailMode;
+    /** Milliseconds to reuse a verdict for the same `(sql, dialect)`. 0 (default) disables it. */
+    cacheTtlMs?: number;
+    /** Maximum cached verdicts. Default 1024. */
+    cacheSize?: number;
+    /** Called with every verdict, including `UNEVALUATED` and `BLOCKED` ones. */
+    onVerdict?: (verdict: Verdict) => void;
+    /** Default: `console` for warnings and errors, silent for info. `false` silences it. */
+    logger?: VerictoLogger | false;
+}
+/**
+ * Checks SQL with Vericto before it runs. Share one instance per process; the
+ * wrappers call `enforce` for every statement, and you can call it yourself around
+ * any other driver.
+ */
+declare class Vericto {
+    #private;
+    readonly evaluator: Evaluator;
+    readonly failMode: FailMode;
+    readonly onVerdict: ((verdict: Verdict) => void) | undefined;
+    constructor(options?: VerictoOptions);
+    /**
+     * Fail fast if the server reports that it does not evaluate `dialect`. Resolves the
+     * normalized dialect id. When the server cannot be asked, nothing is thrown here.
+     */
+    requireDialect(dialect: string): Promise<string>;
+    /**
+     * Evaluate `sql` and resolve the verdict, whatever it is. Does not apply the fail
+     * mode and does not reject on `BLOCKED`: use it to ask, and `enforce` to guard.
+     */
+    check(sql: string, dialect: string): Promise<Verdict>;
+    /**
+     * Evaluate `sql` and apply the decision: reject with `VerictoBlockedError` on
+     * `BLOCKED`; log `FLAGGED`/`MONITORED`/allowed `PARSE_ERROR`; apply the fail mode
+     * when Vericto cannot answer. Run `sqlToExecute(verdict)` (the masked rewrite, if any).
+     */
+    enforce(sql: string, dialect: string): Promise<Verdict>;
+    /** `enforce`, resolving the SQL text to execute. */
+    prepare(sql: string, dialect: string): Promise<string>;
+    /** Enforce a batch in order; a block anywhere rejects before the caller runs any of it. */
+    enforceAll(statements: readonly string[], dialect: string): Promise<Verdict[]>;
+    clearCache(): void;
+}
+
+export { CONFIG_PATH as C, DEFAULT_API_URL as D, EVALUATE_PATH as E, RuntimeApiEvaluator as R, Vericto as V, isMasked as i, sqlToExecute as s, verdictFromResponse as v };
+export type { Finding as F, Verdict as a, Decision as b, Evaluator as c, FailMode as d, RuntimeApiOptions as e, VerictoLogger as f, VerictoOptions as g };

package/dist/guard-BVpq8ytG.d.ts

@@ -0,0 +1,175 @@
+/**
+ * What Vericto decided. `UNEVALUATED` is local: Vericto could not answer and the
+ * guard runs with `failMode: 'open'`, so the statement ran without a verdict.
+ */
+type Decision = 'ALLOWED' | 'FLAGGED' | 'MONITORED' | 'PARSE_ERROR' | 'BLOCKED' | 'UNEVALUATED';
+/** A rule that matched the statement. */
+interface Finding {
+    readonly ruleCode: string;
+    readonly severity?: string;
+    readonly ruleId?: string;
+    readonly astNodePath?: string;
+    readonly suggestedFix?: string;
+}
+/** Vericto's answer for one statement. */
+interface Verdict {
+    readonly decision: Decision;
+    /** The statement as submitted. */
+    readonly sql: string;
+    readonly dialect: string;
+    readonly ruleCode?: string;
+    readonly severity?: string;
+    readonly message?: string;
+    readonly suggestedFix?: string;
+    /**
+     * When set, the statement to run **instead of** `sql`: the sensitive columns it
+     * reads come back masked (Sensitive Column Protection).
+     */
+    readonly rewrittenQuery?: string;
+    readonly parseError?: string;
+    readonly findings: readonly Finding[];
+    readonly sensitiveColumns: readonly unknown[];
+    readonly accessDenied: readonly unknown[];
+    /** The audit-trail event id. */
+    readonly eventId?: string;
+    readonly rulesetVersion?: string;
+    readonly cached: boolean;
+    /** The response body, for fields this version does not model yet. */
+    readonly raw: Readonly<Record<string, unknown>>;
+}
+/** The statement the driver must run: the masked rewrite when there is one. */
+declare function sqlToExecute(verdict: Verdict): string;
+declare function isMasked(verdict: Verdict): boolean;
+/** Build a verdict from a `POST /api/v1/proxy/query` response body. */
+declare function verdictFromResponse(body: Record<string, unknown>, sql: string, dialect: string): Verdict;
+
+/**
+ * Turns `(sql, dialect)` into a verdict.
+ *
+ * This release ships one implementation, `RuntimeApiEvaluator`, which asks the Vericto
+ * Runtime API. An embedded evaluator (the engine in-process, for example as WASM or a
+ * native addon with synced rules) can be added later behind the same interface
+ * without touching the wrappers.
+ *
+ * Implementations resolve a verdict for every evaluated statement (`BLOCKED`
+ * included: blocking is the guard's job), reject with `VerictoUnavailableError` when
+ * no verdict can be produced, and with `VerictoConfigError` when the request can
+ * never succeed.
+ */
+interface Evaluator {
+    evaluate(sql: string, dialect: string): Promise<Verdict>;
+    /** The dialects this evaluator handles, or `undefined` when it cannot tell. */
+    supportedDialects(): Promise<readonly string[] | undefined>;
+    /** Shown in error messages. */
+    readonly apiUrl?: string;
+}
+
+declare const DEFAULT_API_URL = "https://api.vericto.com";
+declare const EVALUATE_PATH = "/api/v1/proxy/query";
+declare const CONFIG_PATH = "/api/v1/meta/config";
+type FetchLike = (input: string, init: RequestInit) => Promise<Response>;
+interface RuntimeApiOptions {
+    /** API key (`vtro_...`, scope `proxy:evaluate`). Default: `VERICTO_API_KEY`. */
+    apiKey?: string;
+    /** The registered database (UUID). Default: `VERICTO_DATABASE_ID`. */
+    databaseId?: string;
+    /** API base URL. Default: `VERICTO_API_URL`, then `https://api.vericto.com`. */
+    apiUrl?: string;
+    /** Per-attempt timeout in milliseconds. Default: `VERICTO_TIMEOUT` (seconds) or 5000. */
+    timeoutMs?: number;
+    /** Retries after the first attempt for network errors, timeouts, 5xx and 429 rate limits. Default 2. */
+    maxRetries?: number;
+    /** Base backoff in milliseconds (exponential, with jitter, capped at 2 s). Default 200. */
+    backoffMs?: number;
+    /** How long the server's dialect list is cached, in milliseconds. Default 10 minutes. */
+    dialectsTtlMs?: number;
+    /** A `fetch` implementation (tests, proxies). Default: the global `fetch`. */
+    fetch?: FetchLike;
+    /** Environment to read the defaults from. Default: `process.env`. */
+    env?: Record<string, string | undefined>;
+}
+/**
+ * Evaluates statements with the Vericto Runtime API (`POST /api/v1/proxy/query`).
+ *
+ * The key is sent in the `X-API-Key` header, over HTTPS only (plain HTTP is accepted
+ * for localhost alone), and never appears in messages or `toString()`. To trust an
+ * extra CA, use Node's `NODE_EXTRA_CA_CERTS`.
+ */
+declare class RuntimeApiEvaluator implements Evaluator {
+    #private;
+    readonly apiUrl: string;
+    readonly databaseId: string;
+    readonly timeoutMs: number;
+    readonly maxRetries: number;
+    constructor(options?: RuntimeApiOptions);
+    toString(): string;
+    toJSON(): Record<string, unknown>;
+    evaluate(sql: string, dialect: string): Promise<Verdict>;
+    /**
+     * The dialects the server evaluates (`GET /api/v1/meta/config`), cached. `undefined`
+     * when the server cannot be asked; the evaluation request then decides.
+     */
+    supportedDialects(): Promise<readonly string[] | undefined>;
+}
+
+type FailMode = 'closed' | 'open';
+/** Where the guard reports. The SQL text is never passed to it. */
+interface VerictoLogger {
+    info(message: string): void;
+    warn(message: string): void;
+    error(message: string): void;
+}
+interface VerictoOptions extends RuntimeApiOptions {
+    /** What evaluates statements. Default: a `RuntimeApiEvaluator` from the options above. */
+    evaluator?: Evaluator;
+    /**
+     * `closed` (default, or `VERICTO_FAIL_MODE`): when Vericto cannot answer, reject with
+     * `VerictoUnavailableError` and do not run the statement. `open`: run it unevaluated,
+     * emit a process warning (`VerictoFailOpenWarning`) and log it.
+     */
+    failMode?: FailMode;
+    /** Milliseconds to reuse a verdict for the same `(sql, dialect)`. 0 (default) disables it. */
+    cacheTtlMs?: number;
+    /** Maximum cached verdicts. Default 1024. */
+    cacheSize?: number;
+    /** Called with every verdict, including `UNEVALUATED` and `BLOCKED` ones. */
+    onVerdict?: (verdict: Verdict) => void;
+    /** Default: `console` for warnings and errors, silent for info. `false` silences it. */
+    logger?: VerictoLogger | false;
+}
+/**
+ * Checks SQL with Vericto before it runs. Share one instance per process; the
+ * wrappers call `enforce` for every statement, and you can call it yourself around
+ * any other driver.
+ */
+declare class Vericto {
+    #private;
+    readonly evaluator: Evaluator;
+    readonly failMode: FailMode;
+    readonly onVerdict: ((verdict: Verdict) => void) | undefined;
+    constructor(options?: VerictoOptions);
+    /**
+     * Fail fast if the server reports that it does not evaluate `dialect`. Resolves the
+     * normalized dialect id. When the server cannot be asked, nothing is thrown here.
+     */
+    requireDialect(dialect: string): Promise<string>;
+    /**
+     * Evaluate `sql` and resolve the verdict, whatever it is. Does not apply the fail
+     * mode and does not reject on `BLOCKED`: use it to ask, and `enforce` to guard.
+     */
+    check(sql: string, dialect: string): Promise<Verdict>;
+    /**
+     * Evaluate `sql` and apply the decision: reject with `VerictoBlockedError` on
+     * `BLOCKED`; log `FLAGGED`/`MONITORED`/allowed `PARSE_ERROR`; apply the fail mode
+     * when Vericto cannot answer. Run `sqlToExecute(verdict)` (the masked rewrite, if any).
+     */
+    enforce(sql: string, dialect: string): Promise<Verdict>;
+    /** `enforce`, resolving the SQL text to execute. */
+    prepare(sql: string, dialect: string): Promise<string>;
+    /** Enforce a batch in order; a block anywhere rejects before the caller runs any of it. */
+    enforceAll(statements: readonly string[], dialect: string): Promise<Verdict[]>;
+    clearCache(): void;
+}
+
+export { CONFIG_PATH as C, DEFAULT_API_URL as D, EVALUATE_PATH as E, RuntimeApiEvaluator as R, Vericto as V, isMasked as i, sqlToExecute as s, verdictFromResponse as v };
+export type { Finding as F, Verdict as a, Decision as b, Evaluator as c, FailMode as d, RuntimeApiOptions as e, VerictoLogger as f, VerictoOptions as g };

package/dist/index.cjs

@@ -0,0 +1,76 @@
+'use strict';
+
+var chunkHFL7W4WC_cjs = require('./chunk-HFL7W4WC.cjs');
+
+
+
+Object.defineProperty(exports, "CONFIG_PATH", {
+  enumerable: true,
+  get: function () { return chunkHFL7W4WC_cjs.CONFIG_PATH; }
+});
+Object.defineProperty(exports, "DEFAULT_API_URL", {
+  enumerable: true,
+  get: function () { return chunkHFL7W4WC_cjs.DEFAULT_API_URL; }
+});
+Object.defineProperty(exports, "EVALUATE_PATH", {
+  enumerable: true,
+  get: function () { return chunkHFL7W4WC_cjs.EVALUATE_PATH; }
+});
+Object.defineProperty(exports, "KNOWN_DIALECTS", {
+  enumerable: true,
+  get: function () { return chunkHFL7W4WC_cjs.KNOWN_DIALECTS; }
+});
+Object.defineProperty(exports, "RuntimeApiEvaluator", {
+  enumerable: true,
+  get: function () { return chunkHFL7W4WC_cjs.RuntimeApiEvaluator; }
+});
+Object.defineProperty(exports, "VERSION", {
+  enumerable: true,
+  get: function () { return chunkHFL7W4WC_cjs.VERSION; }
+});
+Object.defineProperty(exports, "Vericto", {
+  enumerable: true,
+  get: function () { return chunkHFL7W4WC_cjs.Vericto; }
+});
+Object.defineProperty(exports, "VerictoBlockedError", {
+  enumerable: true,
+  get: function () { return chunkHFL7W4WC_cjs.VerictoBlockedError; }
+});
+Object.defineProperty(exports, "VerictoConfigError", {
+  enumerable: true,
+  get: function () { return chunkHFL7W4WC_cjs.VerictoConfigError; }
+});
+Object.defineProperty(exports, "VerictoError", {
+  enumerable: true,
+  get: function () { return chunkHFL7W4WC_cjs.VerictoError; }
+});
+Object.defineProperty(exports, "VerictoQuotaExceededError", {
+  enumerable: true,
+  get: function () { return chunkHFL7W4WC_cjs.VerictoQuotaExceededError; }
+});
+Object.defineProperty(exports, "VerictoUnavailableError", {
+  enumerable: true,
+  get: function () { return chunkHFL7W4WC_cjs.VerictoUnavailableError; }
+});
+Object.defineProperty(exports, "VerictoUnsupportedDialectError", {
+  enumerable: true,
+  get: function () { return chunkHFL7W4WC_cjs.VerictoUnsupportedDialectError; }
+});
+Object.defineProperty(exports, "isMasked", {
+  enumerable: true,
+  get: function () { return chunkHFL7W4WC_cjs.isMasked; }
+});
+Object.defineProperty(exports, "normalizeDialect", {
+  enumerable: true,
+  get: function () { return chunkHFL7W4WC_cjs.normalizeDialect; }
+});
+Object.defineProperty(exports, "sqlToExecute", {
+  enumerable: true,
+  get: function () { return chunkHFL7W4WC_cjs.sqlToExecute; }
+});
+Object.defineProperty(exports, "verdictFromResponse", {
+  enumerable: true,
+  get: function () { return chunkHFL7W4WC_cjs.verdictFromResponse; }
+});
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.cjs"}

package/dist/index.d.cts

@@ -0,0 +1,76 @@
+import { a as Verdict, F as Finding } from './guard-BVpq8ytG.cjs';
+export { C as CONFIG_PATH, D as DEFAULT_API_URL, b as Decision, E as EVALUATE_PATH, c as Evaluator, d as FailMode, R as RuntimeApiEvaluator, e as RuntimeApiOptions, V as Vericto, f as VerictoLogger, g as VerictoOptions, i as isMasked, s as sqlToExecute, v as verdictFromResponse } from './guard-BVpq8ytG.cjs';
+
+/**
+ * Dialects the Vericto engine evaluates (`sqlite` since vericto-engine 4.1.0). The
+ * wrappers still ask the server (`GET /api/v1/meta/config`) and refuse a dialect it
+ * does not list.
+ */
+declare const KNOWN_DIALECTS: readonly ["postgres", "mysql", "oracle", "mssql", "snowflake", "sqlite"];
+/**
+ * Map a driver name to the Vericto dialect id. Unknown names pass through
+ * lower-cased: the server decides, and answers with a clear error.
+ */
+declare function normalizeDialect(name: string): string;
+
+/** Base class of every error this package throws. */
+declare class VerictoError extends Error {
+    constructor(message: string);
+}
+/**
+ * The client is misconfigured: missing or rejected API key, bad database id, a key
+ * without the `proxy:evaluate` scope, or a malformed request. Thrown whatever the
+ * fail mode is: failing open on a revoked key would switch the firewall off silently.
+ */
+declare class VerictoConfigError extends VerictoError {
+    readonly status: number | undefined;
+    readonly code: string | undefined;
+    constructor(message: string, options?: {
+        status?: number;
+        code?: string;
+    });
+}
+/**
+ * The Vericto server does not evaluate this dialect (it is missing from
+ * `GET /api/v1/meta/config`, e.g. `sqlite` on a server older than vericto-engine
+ * 4.1.0). No SQL was executed.
+ */
+declare class VerictoUnsupportedDialectError extends VerictoConfigError {
+    readonly dialect: string;
+    readonly supported: readonly string[];
+    constructor(dialect: string, supported: readonly string[], apiUrl: string);
+}
+/**
+ * Vericto could not return a verdict after the configured retries. With
+ * `failMode: 'closed'` (the default) the statement is not executed and this is thrown.
+ */
+declare class VerictoUnavailableError extends VerictoError {
+    readonly status: number | undefined;
+    readonly code: string | undefined;
+    constructor(message: string, options?: {
+        status?: number;
+        code?: string;
+    });
+}
+/** The workspace used its monthly query quota (HTTP 429 `QUOTA_EXCEEDED`). Not retried. */
+declare class VerictoQuotaExceededError extends VerictoUnavailableError {
+    readonly resetsAt: string | undefined;
+    readonly upgradeUrl: string | undefined;
+    constructor(message: string, options?: {
+        resetsAt?: string;
+        upgradeUrl?: string;
+    });
+}
+/** Vericto blocked the statement. It was not executed. */
+declare class VerictoBlockedError extends VerictoError {
+    readonly verdict: Verdict;
+    readonly sql: string;
+    constructor(verdict: Verdict, sql: string);
+    get findings(): readonly Finding[];
+    get suggestedFix(): string | undefined;
+}
+
+/** The package version (kept in sync with package.json by a test). */
+declare const VERSION = "0.2.0";
+
+export { Finding, KNOWN_DIALECTS, VERSION, Verdict, VerictoBlockedError, VerictoConfigError, VerictoError, VerictoQuotaExceededError, VerictoUnavailableError, VerictoUnsupportedDialectError, normalizeDialect };