offrouter-core 0.5.0 → 0.6.0

package/dist/audit.d.ts

@@ -1,10 +1,10 @@
-import type { FallbackChainEntry, FallbackReason, PolicyDenial, RouteDecision, RouteRequest, SelectedRoute } from "./types.js";
+import type { ClassifierName, FallbackChainEntry, FallbackReason, PolicyDenial, RouteClassification, RouteDecision, RouteRequest, SelectedRoute } from "./types.js";
 /** Default max chars kept for an opt-in redacted prompt preview. */
 export declare const DEFAULT_PREVIEW_MAX_CHARS = 80;
 /** Cancellation lifecycle for an audited request/decision in-process. */
 export type CancellationState = "active" | "cancelled" | "completed";
 /** High-level audit event kind. */
-export type AuditRecordKind = "route_decision" | "api_key_fallback" | "cancellation";
+export type AuditRecordKind = "route_decision" | "api_key_fallback" | "cancellation" | "outbound_secret_finding";
 /**
  * Append-only audit record. Intentionally omits raw prompt text.
  * `promptPreviewRedacted` appears only when explicitly requested at append.
@@ -32,11 +32,32 @@ export interface AuditRecord {
     fallbackChain?: FallbackChainEntry[];
     /** Explicit API-key fallback reason when paid capacity was used. */
     apiKeyFallbackReason?: FallbackReason | string;
+    /** True when an api-key route was used with explicit spend approval. */
+    apiSpendApproved?: boolean;
+    /** True when a subscription route was used with an explicit account-switch acknowledgment. */
+    switchApproved?: boolean;
     policyDenials?: PolicyDenial[];
     blocked?: boolean;
     needsConfiguration?: boolean;
+    /**
+     * Classifier signal copied from the route decision. Family / confidence /
+     * stable signal ids only — never prompt text.
+     */
+    classification?: RouteClassification;
+    /**
+     * Which classifier produced the recorded classification signal.
+     * Present when classification is recorded. Never prompt text.
+     */
+    classifierName?: ClassifierName;
     cancellationState?: CancellationState;
     cancelledAt?: string;
+    /**
+     * Credential pattern names matched in outbound content (outbound_secret_finding).
+     * Names only — never matched content, not even redacted excerpts.
+     */
+    secretPatternNames?: string[];
+    /** Enforcement mode in effect when findings were recorded. */
+    outboundSecretScanMode?: "block" | "warn" | "off";
 }
 export interface AppendDecisionOptions {
     /**
@@ -51,6 +72,10 @@ export interface AppendDecisionOptions {
      * Never stored; used only during redaction.
      */
     knownSecrets?: Iterable<string>;
+    /** Record that explicit api-spend approval accompanied this request. */
+    apiSpendApproved?: boolean;
+    /** Record that an explicit subscription account-switch acknowledgment accompanied this request. */
+    switchApproved?: boolean;
     /** Initial cancellation state; default "active" for successful routes. */
     cancellationState?: CancellationState;
     /** Override clock for tests. */
@@ -92,6 +117,20 @@ export interface AuditStore {
     markCompleted(requestId: string, options?: {
         now?: () => Date;
     }): Promise<AuditRecord | undefined>;
+    /**
+     * Record outbound secret-scan findings. Persists pattern names only —
+     * never matched content or redacted excerpts.
+     */
+    recordOutboundSecretFindings(input: {
+        requestId: string;
+        decisionId?: string;
+        promptDigest?: string;
+        patternNames: string[];
+        mode: "block" | "warn" | "off";
+        /** Free-text explanation; must not include matched secret values. */
+        explanation?: string;
+        now?: () => Date;
+    }): Promise<AuditRecord>;
     getCancellationState(requestId: string): Promise<CancellationState | undefined>;
     list(options?: ListAuditOptions): Promise<AuditRecord[]>;
     get(recordId: string): Promise<AuditRecord | undefined>;
@@ -107,6 +146,7 @@ export interface InMemoryAuditStoreOptions {
     knownSecrets?: Iterable<string>;
     now?: () => Date;
 }
+export declare function clampPreview(text: string, maxChars: number): string;
 /**
  * In-memory audit store for tests and single-process V1 use.
  * Appends are serialized so concurrent writers cannot interleave corruptly.
@@ -129,6 +169,15 @@ export declare class InMemoryAuditStore implements AuditStore {
     markCompleted(requestId: string, options?: {
         now?: () => Date;
     }): Promise<AuditRecord | undefined>;
+    recordOutboundSecretFindings(input: {
+        requestId: string;
+        decisionId?: string;
+        promptDigest?: string;
+        patternNames: string[];
+        mode: "block" | "warn" | "off";
+        explanation?: string;
+        now?: () => Date;
+    }): Promise<AuditRecord>;
     getCancellationState(requestId: string): Promise<CancellationState | undefined>;
     list(options?: ListAuditOptions): Promise<AuditRecord[]>;
     get(recordId: string): Promise<AuditRecord | undefined>;

package/dist/audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,aAAa,EACd,MAAM,YAAY,CAAC;AAEpB,oEAAoE;AACpE,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C,yEAAyE;AACzE,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,WAAW,GAAG,WAAW,CAAC;AAErE,mCAAmC;AACnC,MAAM,MAAM,eAAe,GACvB,gBAAgB,GAChB,kBAAkB,GAClB,cAAc,CAAC;AAEnB;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,eAAe,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IAC7B,aAAa,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACrC,oEAAoE;IACpE,oBAAoB,CAAC,EAAE,cAAc,GAAG,MAAM,CAAC;IAC/C,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC;IAC/B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,uEAAuE;IACvE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,cAAc,CACZ,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,WAAW,CAAC,CAAC;IAExB;;;OAGG;IACH,oBAAoB,CAAC,KAAK,EAAE;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,cAAc,GAAG,MAAM,CAAC;QAChC,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;QAC7B,qEAAqE;QACrE,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;KAClB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAEzB,aAAa,CACX,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IAEpC,aAAa,CACX,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;KAAE,GAC7B,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IAEpC,oBAAoB,CAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAAC;IAE1C,IAAI,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAEzD,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IAExD;;OAEG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,yBAAyB;IACxC,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAqED;;;GAGG;AACH,qBAAa,kBAAmB,YAAW,UAAU;;gBAUvC,OAAO,GAAE,yBAA8B;IAkB7C,cAAc,CAClB,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,aAAa,EACvB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,WAAW,CAAC;IA+EjB,oBAAoB,CAAC,KAAK,EAAE;QAChC,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,cAAc,GAAG,MAAM,CAAC;QAChC,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;QAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;KAClB,GAAG,OAAO,CAAC,WAAW,CAAC;IAyBlB,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IA4B7B,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;KAAO,GACjC,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAuB7B,oBAAoB,CACxB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAKnC,IAAI,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAmB5D,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAK7D,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CA8ElC"}
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,aAAa,EACb,YAAY,EACZ,aAAa,EACd,MAAM,YAAY,CAAC;AAEpB,oEAAoE;AACpE,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C,yEAAyE;AACzE,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,WAAW,GAAG,WAAW,CAAC;AAErE,mCAAmC;AACnC,MAAM,MAAM,eAAe,GACvB,gBAAgB,GAChB,kBAAkB,GAClB,cAAc,GACd,yBAAyB,CAAC;AAE9B;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,eAAe,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IAC7B,aAAa,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACrC,oEAAoE;IACpE,oBAAoB,CAAC,EAAE,cAAc,GAAG,MAAM,CAAC;IAC/C,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,8FAA8F;IAC9F,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC;IAC/B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;OAGG;IACH,cAAc,CAAC,EAAE,mBAAmB,CAAC;IACrC;;;OAGG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,8DAA8D;IAC9D,sBAAsB,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;CACnD;AAED,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,uEAAuE;IACvE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,mGAAmG;IACnG,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,cAAc,CACZ,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,WAAW,CAAC,CAAC;IAExB;;;OAGG;IACH,oBAAoB,CAAC,KAAK,EAAE;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,cAAc,GAAG,MAAM,CAAC;QAChC,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;QAC7B,qEAAqE;QACrE,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;KAClB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAEzB,aAAa,CACX,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IAEpC,aAAa,CACX,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;KAAE,GAC7B,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IAEpC;;;OAGG;IACH,4BAA4B,CAAC,KAAK,EAAE;QAClC,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;QAC/B,qEAAqE;QACrE,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;KAClB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAEzB,oBAAoB,CAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAAC;IAE1C,IAAI,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAEzD,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IAExD;;OAEG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,yBAAyB;IACxC,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAMD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGnE;AA4DD;;;GAGG;AACH,qBAAa,kBAAmB,YAAW,UAAU;;gBAUvC,OAAO,GAAE,yBAA8B;IAkB7C,cAAc,CAClB,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,aAAa,EACvB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,WAAW,CAAC;IAsGjB,oBAAoB,CAAC,KAAK,EAAE;QAChC,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,cAAc,GAAG,MAAM,CAAC;QAChC,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;QAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;KAClB,GAAG,OAAO,CAAC,WAAW,CAAC;IAyBlB,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IA4B7B,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;KAAO,GACjC,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAuB7B,4BAA4B,CAAC,KAAK,EAAE;QACxC,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;QAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;KAClB,GAAG,OAAO,CAAC,WAAW,CAAC;IAqClB,oBAAoB,CACxB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAKnC,IAAI,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAmB5D,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAK7D,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAoFlC"}

package/dist/audit.js

@@ -14,7 +14,7 @@ export const DEFAULT_PREVIEW_MAX_CHARS = 80;
 function newId(prefix) {
     return `${prefix}_${randomBytes(8).toString("hex")}`;
 }
-function clampPreview(text, maxChars) {
+export function clampPreview(text, maxChars) {
     if (text.length <= maxChars)
         return text;
     return `${text.slice(0, Math.max(0, maxChars - 1))}…`;
@@ -122,6 +122,14 @@ export class InMemoryAuditStore {
                 auditSummary,
                 reason,
                 explanation,
+                ...(options.apiSpendApproved === true &&
+                    decision.route?.authTier === "api-key"
+                    ? { apiSpendApproved: true }
+                    : {}),
+                ...(options.switchApproved === true &&
+                    decision.route?.authTier === "subscription"
+                    ? { switchApproved: true }
+                    : {}),
                 route: decision.route ?? null,
                 fallbackChain: decision.fallbackChain
                     ? decision.fallbackChain.map((e) => ({ ...e }))
@@ -135,6 +143,19 @@ export class InMemoryAuditStore {
                     : undefined,
                 blocked: decision.blocked,
                 needsConfiguration: decision.needsConfiguration,
+                ...(decision.classification
+                    ? {
+                        classification: {
+                            recommendedFamily: decision.classification.recommendedFamily,
+                            confidence: decision.classification.confidence,
+                            // signals are stable rule ids; still run through redaction defensively
+                            signals: decision.classification.signals.map((s) => safeRedact(s, known)),
+                        },
+                    }
+                    : {}),
+                ...(decision.classifierName
+                    ? { classifierName: decision.classifierName }
+                    : {}),
                 cancellationState: initialCancellation,
             };
             if (redactedStoredPreview !== undefined) {
@@ -220,6 +241,36 @@ export class InMemoryAuditStore {
             return structuredClone(update);
         });
     }
+    async recordOutboundSecretFindings(input) {
+        return this.#exclusive(() => {
+            const now = (input.now ?? this.#now)();
+            // Names only — strip any free-text that might accidentally embed secrets.
+            const names = [
+                ...new Set((input.patternNames ?? []).filter((n) => typeof n === "string" && n.length > 0)),
+            ];
+            const explanation = input.explanation !== undefined
+                ? safeRedact(input.explanation, this.#defaultKnownSecrets)
+                : `Outbound content matched credential pattern(s): ${names.join(", ") || "(none)"}`;
+            const record = {
+                recordId: newId("aud"),
+                kind: "outbound_secret_finding",
+                timestamp: now.toISOString(),
+                requestId: input.requestId,
+                decisionId: input.decisionId,
+                promptDigest: input.promptDigest,
+                reason: input.mode === "block"
+                    ? "outbound_secret_blocked"
+                    : "outbound_secret_warning",
+                explanation,
+                secretPatternNames: names,
+                outboundSecretScanMode: input.mode,
+                blocked: input.mode === "block",
+                cancellationState: input.mode === "block" ? "completed" : "active",
+            };
+            this.#push(record, { trackAsLatest: false });
+            return structuredClone(record);
+        });
+    }
     async getCancellationState(requestId) {
         const latest = this.#latestByRequest.get(requestId);
         return latest?.cancellationState;
@@ -262,10 +313,16 @@ export class InMemoryAuditStore {
             }, {}),
         };
     }
-    #push(record) {
+    #push(record, options = {}) {
         this.#records.push(record);
         this.#byId.set(record.recordId, record);
-        this.#latestByRequest.set(record.requestId, record);
+        // Side-car findings (outbound secret scan) stay on the log but must not
+        // become the cancellation/completion base — otherwise markCompleted would
+        // clone them as a second "finding" row.
+        const trackAsLatest = options.trackAsLatest ?? true;
+        if (trackAsLatest) {
+            this.#latestByRequest.set(record.requestId, record);
+        }
         if (this.#maxRecords !== undefined &&
             this.#records.length > this.#maxRecords) {
             const overflow = this.#records.length - this.#maxRecords;

package/dist/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAUhD,oEAAoE;AACpE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAwI5C,SAAS,KAAK,CAAC,MAAc;IAC3B,OAAO,GAAG,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,QAAgB;IAClD,IAAI,IAAI,CAAC,MAAM,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CACjB,KAAyB,EACzB,YAA8B;IAE9B,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,KAAK,IAAI,EAAE,CAAC;IACtD,OAAO,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAuB;IACtD,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3C,IAAI,QAAQ,CAAC,MAAM,KAAK,kBAAkB;YAAE,OAAO,IAAI,CAAC;QACxD,IACE,QAAQ,CAAC,aAAa,EAAE,IAAI,CAC1B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,kBAAkB,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,CACnE,EACD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,oEAAoE;QACpE,IACE,QAAQ,CAAC,aAAa,EAAE,IAAI,CAC1B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,MAAM,KAAK,wBAAwB;YACrC,CAAC,CAAC,MAAM,KAAK,uBAAuB;YACpC,CAAC,CAAC,MAAM,KAAK,2BAA2B;YACxC,CAAC,CAAC,MAAM,KAAK,gBAAgB,CAChC,EACD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,KAAK,kBAAkB,CAAC;AAChD,CAAC;AAED,SAAS,2BAA2B,CAClC,QAAuB;IAEvB,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACzD,MAAM,QAAQ,GAAG,QAAQ,CAAC,aAAa,EAAE,IAAI,CAC3C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,kBAAkB,CACvC,CAAC;IACF,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC;IACrC,MAAM,SAAS,GAAG,QAAQ,CAAC,aAAa,EAAE,IAAI,CAC5C,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,MAAM,KAAK,wBAAwB;QACrC,CAAC,CAAC,MAAM,KAAK,uBAAuB;QACpC,CAAC,CAAC,MAAM,KAAK,2BAA2B;QACxC,CAAC,CAAC,MAAM,KAAK,gBAAgB,CAChC,CAAC;IACF,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC,MAAM,CAAC;IACvC,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ,KAAK,SAAS;QAAE,OAAO,kBAAkB,CAAC;IACtE,OAAO,QAAQ,CAAC,MAAM,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IACpB,QAAQ,GAAkB,EAAE,CAAC;IAC7B,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAChD,wDAAwD;IAC/C,gBAAgB,GAAG,IAAI,GAAG,EAAuB,CAAC;IAClD,WAAW,CAAqB;IAChC,oBAAoB,CAAW;IAC/B,IAAI,CAAa;IAC1B,MAAM,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAE7C,YAAY,UAAqC,EAAE;QACjD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,YAAY;YAC9C,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAChF,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,6EAA6E;IAC7E,UAAU,CAAI,EAAwB;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,CACpB,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACF,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,OAAqB,EACrB,QAAuB,EACvB,UAAiC,EAAE;QAEnC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YAC1B,MAAM,KAAK,GAAG,UAAU,CACtB,IAAI,CAAC,oBAAoB,EACzB,OAAO,CAAC,YAAY,CACrB,CAAC;YACF,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,cAAc,GAAG,OAAO,CAAC,oBAAoB,KAAK,IAAI,CAAC;YAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,IAAI,yBAAyB,CAAC;YAEtE,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC;YACnE,MAAM,IAAI,GAAoB,oBAAoB;gBAChD,CAAC,CAAC,kBAAkB;gBACpB,CAAC,CAAC,gBAAgB,CAAC;YAErB,MAAM,mBAAmB,GACvB,OAAO,CAAC,iBAAiB;gBACzB,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAExE,8EAA8E;YAC9E,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAClD,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAC5D,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY;gBACxC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC;gBAC1C,CAAC,CAAC,UAAU,CACR,YAAY,QAAQ,CAAC,UAAU,WAAW,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,EACrE,KAAK,CACN,CAAC;YAEN,iEAAiE;YACjE,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;YAC9C,MAAM,qBAAqB,GAAG,cAAc;gBAC1C,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC;gBACvD,CAAC,CAAC,SAAS,CAAC;YAEd,MAAM,MAAM,GAAgB;gBAC1B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC;gBACtB,IAAI;gBACJ,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;gBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO;gBAChC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;gBACjC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY;gBACvC,YAAY;gBACZ,MAAM;gBACN,WAAW;gBACX,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,IAAI;gBAC7B,aAAa,EAAE,QAAQ,CAAC,aAAa;oBACnC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC/C,CAAC,CAAC,SAAS;gBACb,oBAAoB;gBACpB,aAAa,EAAE,QAAQ,CAAC,aAAa;oBACnC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBACjC,GAAG,CAAC;wBACJ,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC;qBACtC,CAAC,CAAC;oBACL,CAAC,CAAC,SAAS;gBACb,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;gBAC/C,iBAAiB,EAAE,mBAAmB;aACvC,CAAC;YAEF,IAAI,qBAAqB,KAAK,SAAS,EAAE,CAAC;gBACxC,uEAAuE;gBACvE,MAAM,CAAC,qBAAqB;oBAC1B,qBAAqB,CAAC,MAAM,GAAG,CAAC;wBAC9B,CAAC,CAAC,qBAAqB;wBACvB,CAAC,CAAC,QAAQ,CAAC;YACjB,CAAC;YAED,+EAA+E;YAC/E,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;YAEjD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,KAS1B;QACC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YAC1B,MAAM,KAAK,GAAG,UAAU,CACtB,IAAI,CAAC,oBAAoB,EACzB,KAAK,CAAC,YAAY,CACnB,CAAC;YACF,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,MAAM,GAAgB;gBAC1B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC;gBACtB,IAAI,EAAE,kBAAkB;gBACxB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;gBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC;gBAC/C,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC;gBACjD,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;gBAC1B,oBAAoB,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC;gBAC7D,iBAAiB,EAAE,QAAQ;aAC5B,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,SAAiB,EACjB,UAAgC,EAAE;QAElC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAC9B,IAAI,MAAM,CAAC,iBAAiB,KAAK,WAAW,EAAE,CAAC;gBAC7C,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;YACjC,CAAC;YACD,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,oBAAoB,CAAC;YACxC,MAAM,MAAM,GAAgB;gBAC1B,GAAG,MAAM;gBACT,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC;gBACtB,IAAI,EAAE,cAAc;gBACpB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;gBAC5B,iBAAiB,EAAE,WAAW;gBAC9B,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE;gBAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;oBACpB,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC;oBACnC,CAAC,CAAC,WAAW;gBACf,WAAW,EAAE,OAAO,CAAC,MAAM;oBACzB,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC;oBACnC,CAAC,CAAC,+BAA+B;aACpC,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,SAAiB,EACjB,UAAgC,EAAE;QAElC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAC9B,IACE,MAAM,CAAC,iBAAiB,KAAK,WAAW;gBACxC,MAAM,CAAC,iBAAiB,KAAK,WAAW,EACxC,CAAC;gBACD,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;YACjC,CAAC;YACD,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,MAAM,GAAgB;gBAC1B,GAAG,MAAM;gBACT,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC;gBACtB,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI;gBACnE,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;gBAC5B,iBAAiB,EAAE,WAAW;aAC/B,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,SAAiB;QAEjB,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpD,OAAO,MAAM,EAAE,iBAAiB,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,UAA4B,EAAE;QACvC,IAAI,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC;QACD,qBAAqB;QACrB,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YACtD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAgB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,OAAO,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChD,CAAC;IAED,MAAM;QACJ,6EAA6E;QAC7E,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;YACjC,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YAC/D,wDAAwD;YACxD,OAAO,EAAE,IAAI,CAAC,QAAQ;iBACnB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;iBAC1B,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACpD,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAyB,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;gBAC7D,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBACrC,OAAO,GAAG,CAAC;YACb,CAAC,EAAE,EAAE,CAAC;SACP,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAmB;QACvB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAEpD,IACE,IAAI,CAAC,WAAW,KAAK,SAAS;YAC9B,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,WAAW,EACvC,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;YACzD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YAClD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC1B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAChC,qEAAqE;gBACrE,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACxD,IAAI,MAAM,EAAE,QAAQ,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;oBACtC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC9C,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,gBAAgB,CACd,MAAmB,EACnB,UAAkB,EAClB,YAAsB;QAEtB,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO;QACjD,MAAM,KAAK,GAAG;YACZ,MAAM,CAAC,YAAY;YACnB,MAAM,CAAC,MAAM;YACb,MAAM,CAAC,WAAW;YAClB,MAAM,CAAC,qBAAqB;YAC5B,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;SACvD;aACE,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;aACjD,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,wFAAwF;QACxF,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,+DAA+D;YAC/D,IAAI,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9C,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,UAAU,CACxE,UAAU,EACV,QAAQ,CACT,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5C,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,UAAU,CACtE,UAAU,EACV,QAAQ,CACT,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACvC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,UAAU,CAC5D,UAAU,EACV,QAAQ,CACT,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,SAAS,UAAU,CACjB,IAAuB,EACvB,KAAmC;IAEnC,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACtB,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAYhD,oEAAoE;AACpE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAiL5C,SAAS,KAAK,CAAC,MAAc;IAC3B,OAAO,GAAG,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,QAAgB;IACzD,IAAI,IAAI,CAAC,MAAM,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CACjB,KAAyB,EACzB,YAA8B;IAE9B,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,KAAK,IAAI,EAAE,CAAC;IACtD,OAAO,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAuB;IACtD,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3C,IAAI,QAAQ,CAAC,MAAM,KAAK,kBAAkB;YAAE,OAAO,IAAI,CAAC;QACxD,IACE,QAAQ,CAAC,aAAa,EAAE,IAAI,CAC1B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,kBAAkB,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,CACnE,EACD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,oEAAoE;QACpE,IACE,QAAQ,CAAC,aAAa,EAAE,IAAI,CAC1B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,MAAM,KAAK,wBAAwB;YACrC,CAAC,CAAC,MAAM,KAAK,uBAAuB;YACpC,CAAC,CAAC,MAAM,KAAK,2BAA2B;YACxC,CAAC,CAAC,MAAM,KAAK,gBAAgB,CAChC,EACD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,KAAK,kBAAkB,CAAC;AAChD,CAAC;AAED,SAAS,2BAA2B,CAClC,QAAuB;IAEvB,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACzD,MAAM,QAAQ,GAAG,QAAQ,CAAC,aAAa,EAAE,IAAI,CAC3C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,kBAAkB,CACvC,CAAC;IACF,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC;IACrC,MAAM,SAAS,GAAG,QAAQ,CAAC,aAAa,EAAE,IAAI,CAC5C,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,MAAM,KAAK,wBAAwB;QACrC,CAAC,CAAC,MAAM,KAAK,uBAAuB;QACpC,CAAC,CAAC,MAAM,KAAK,2BAA2B;QACxC,CAAC,CAAC,MAAM,KAAK,gBAAgB,CAChC,CAAC;IACF,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC,MAAM,CAAC;IACvC,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ,KAAK,SAAS;QAAE,OAAO,kBAAkB,CAAC;IACtE,OAAO,QAAQ,CAAC,MAAM,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IACpB,QAAQ,GAAkB,EAAE,CAAC;IAC7B,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAChD,wDAAwD;IAC/C,gBAAgB,GAAG,IAAI,GAAG,EAAuB,CAAC;IAClD,WAAW,CAAqB;IAChC,oBAAoB,CAAW;IAC/B,IAAI,CAAa;IAC1B,MAAM,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAE7C,YAAY,UAAqC,EAAE;QACjD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,YAAY;YAC9C,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAChF,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,6EAA6E;IAC7E,UAAU,CAAI,EAAwB;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,CACpB,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACF,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,OAAqB,EACrB,QAAuB,EACvB,UAAiC,EAAE;QAEnC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YAC1B,MAAM,KAAK,GAAG,UAAU,CACtB,IAAI,CAAC,oBAAoB,EACzB,OAAO,CAAC,YAAY,CACrB,CAAC;YACF,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,cAAc,GAAG,OAAO,CAAC,oBAAoB,KAAK,IAAI,CAAC;YAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,IAAI,yBAAyB,CAAC;YAEtE,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC;YACnE,MAAM,IAAI,GAAoB,oBAAoB;gBAChD,CAAC,CAAC,kBAAkB;gBACpB,CAAC,CAAC,gBAAgB,CAAC;YAErB,MAAM,mBAAmB,GACvB,OAAO,CAAC,iBAAiB;gBACzB,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAExE,8EAA8E;YAC9E,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAClD,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAC5D,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY;gBACxC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC;gBAC1C,CAAC,CAAC,UAAU,CACR,YAAY,QAAQ,CAAC,UAAU,WAAW,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,EACrE,KAAK,CACN,CAAC;YAEN,iEAAiE;YACjE,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;YAC9C,MAAM,qBAAqB,GAAG,cAAc;gBAC1C,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC;gBACvD,CAAC,CAAC,SAAS,CAAC;YAEd,MAAM,MAAM,GAAgB;gBAC1B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC;gBACtB,IAAI;gBACJ,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;gBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO;gBAChC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;gBACjC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY;gBACvC,YAAY;gBACZ,MAAM;gBACN,WAAW;gBACX,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,IAAI;oBACrC,QAAQ,CAAC,KAAK,EAAE,QAAQ,KAAK,SAAS;oBACpC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE;oBAC5B,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,IAAI;oBACnC,QAAQ,CAAC,KAAK,EAAE,QAAQ,KAAK,cAAc;oBACzC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;oBAC1B,CAAC,CAAC,EAAE,CAAC;gBACP,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,IAAI;gBAC7B,aAAa,EAAE,QAAQ,CAAC,aAAa;oBACnC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC/C,CAAC,CAAC,SAAS;gBACb,oBAAoB;gBACpB,aAAa,EAAE,QAAQ,CAAC,aAAa;oBACnC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBACjC,GAAG,CAAC;wBACJ,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC;qBACtC,CAAC,CAAC;oBACL,CAAC,CAAC,SAAS;gBACb,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;gBAC/C,GAAG,CAAC,QAAQ,CAAC,cAAc;oBACzB,CAAC,CAAC;wBACE,cAAc,EAAE;4BACd,iBAAiB,EAAE,QAAQ,CAAC,cAAc,CAAC,iBAAiB;4BAC5D,UAAU,EAAE,QAAQ,CAAC,cAAc,CAAC,UAAU;4BAC9C,uEAAuE;4BACvE,OAAO,EAAE,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACjD,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CACrB;yBACF;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,QAAQ,CAAC,cAAc;oBACzB,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE;oBAC7C,CAAC,CAAC,EAAE,CAAC;gBACP,iBAAiB,EAAE,mBAAmB;aACvC,CAAC;YAEF,IAAI,qBAAqB,KAAK,SAAS,EAAE,CAAC;gBACxC,uEAAuE;gBACvE,MAAM,CAAC,qBAAqB;oBAC1B,qBAAqB,CAAC,MAAM,GAAG,CAAC;wBAC9B,CAAC,CAAC,qBAAqB;wBACvB,CAAC,CAAC,QAAQ,CAAC;YACjB,CAAC;YAED,+EAA+E;YAC/E,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;YAEjD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,KAS1B;QACC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YAC1B,MAAM,KAAK,GAAG,UAAU,CACtB,IAAI,CAAC,oBAAoB,EACzB,KAAK,CAAC,YAAY,CACnB,CAAC;YACF,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,MAAM,GAAgB;gBAC1B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC;gBACtB,IAAI,EAAE,kBAAkB;gBACxB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;gBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC;gBAC/C,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC;gBACjD,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;gBAC1B,oBAAoB,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC;gBAC7D,iBAAiB,EAAE,QAAQ;aAC5B,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,SAAiB,EACjB,UAAgC,EAAE;QAElC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAC9B,IAAI,MAAM,CAAC,iBAAiB,KAAK,WAAW,EAAE,CAAC;gBAC7C,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;YACjC,CAAC;YACD,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,oBAAoB,CAAC;YACxC,MAAM,MAAM,GAAgB;gBAC1B,GAAG,MAAM;gBACT,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC;gBACtB,IAAI,EAAE,cAAc;gBACpB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;gBAC5B,iBAAiB,EAAE,WAAW;gBAC9B,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE;gBAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;oBACpB,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC;oBACnC,CAAC,CAAC,WAAW;gBACf,WAAW,EAAE,OAAO,CAAC,MAAM;oBACzB,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC;oBACnC,CAAC,CAAC,+BAA+B;aACpC,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,SAAiB,EACjB,UAAgC,EAAE;QAElC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAC9B,IACE,MAAM,CAAC,iBAAiB,KAAK,WAAW;gBACxC,MAAM,CAAC,iBAAiB,KAAK,WAAW,EACxC,CAAC;gBACD,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;YACjC,CAAC;YACD,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,MAAM,GAAgB;gBAC1B,GAAG,MAAM;gBACT,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC;gBACtB,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI;gBACnE,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;gBAC5B,iBAAiB,EAAE,WAAW;aAC/B,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,4BAA4B,CAAC,KAQlC;QACC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YAC1B,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,0EAA0E;YAC1E,MAAM,KAAK,GAAG;gBACZ,GAAG,IAAI,GAAG,CACR,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAC7C,CACF;aACF,CAAC;YACF,MAAM,WAAW,GACf,KAAK,CAAC,WAAW,KAAK,SAAS;gBAC7B,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,oBAAoB,CAAC;gBAC1D,CAAC,CAAC,mDAAmD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;YACxF,MAAM,MAAM,GAAgB;gBAC1B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC;gBACtB,IAAI,EAAE,yBAAyB;gBAC/B,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;gBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,MAAM,EACJ,KAAK,CAAC,IAAI,KAAK,OAAO;oBACpB,CAAC,CAAC,yBAAyB;oBAC3B,CAAC,CAAC,yBAAyB;gBAC/B,WAAW;gBACX,kBAAkB,EAAE,KAAK;gBACzB,sBAAsB,EAAE,KAAK,CAAC,IAAI;gBAClC,OAAO,EAAE,KAAK,CAAC,IAAI,KAAK,OAAO;gBAC/B,iBAAiB,EAAE,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;aACnE,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7C,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,SAAiB;QAEjB,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpD,OAAO,MAAM,EAAE,iBAAiB,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,UAA4B,EAAE;QACvC,IAAI,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC;QACD,qBAAqB;QACrB,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YACtD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAgB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,OAAO,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChD,CAAC;IAED,MAAM;QACJ,6EAA6E;QAC7E,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;YACjC,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YAC/D,wDAAwD;YACxD,OAAO,EAAE,IAAI,CAAC,QAAQ;iBACnB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;iBAC1B,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACpD,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAyB,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;gBAC7D,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBACrC,OAAO,GAAG,CAAC;YACb,CAAC,EAAE,EAAE,CAAC;SACP,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAmB,EAAE,UAAuC,EAAE;QAClE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxC,wEAAwE;QACxE,0EAA0E;QAC1E,wCAAwC;QACxC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC;QACpD,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACtD,CAAC;QAED,IACE,IAAI,CAAC,WAAW,KAAK,SAAS;YAC9B,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,WAAW,EACvC,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;YACzD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YAClD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC1B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAChC,qEAAqE;gBACrE,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACxD,IAAI,MAAM,EAAE,QAAQ,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;oBACtC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC9C,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,gBAAgB,CACd,MAAmB,EACnB,UAAkB,EAClB,YAAsB;QAEtB,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO;QACjD,MAAM,KAAK,GAAG;YACZ,MAAM,CAAC,YAAY;YACnB,MAAM,CAAC,MAAM;YACb,MAAM,CAAC,WAAW;YAClB,MAAM,CAAC,qBAAqB;YAC5B,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;SACvD;aACE,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;aACjD,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,wFAAwF;QACxF,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,+DAA+D;YAC/D,IAAI,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9C,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,UAAU,CACxE,UAAU,EACV,QAAQ,CACT,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5C,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,UAAU,CACtE,UAAU,EACV,QAAQ,CACT,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACvC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,UAAU,CAC5D,UAAU,EACV,QAAQ,CACT,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,SAAS,UAAU,CACjB,IAAuB,EACvB,KAAmC;IAEnC,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACtB,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/config.d.ts

@@ -9,6 +9,14 @@ export interface ConfiguredProvider {
     id: string;
     enabled: boolean;
     accounts: ConfiguredAccount[];
+    /** Optional base URL override for an OpenAI-compatible provider endpoint. */
+    baseUrl?: string;
+    /** Per-provider hard spend cap in USD; overrides the global policy cap. */
+    spendCapUsd?: number;
+    /** When present, only these model ids (plus optional trailing `*` prefix glob) are allowed for this provider. */
+    allowedModels?: string[];
+    /** Listed model ids (plus optional trailing `*` prefix glob) are always blocked. Deny beats allow. */
+    deniedModels?: string[];
 }
 /** Named profile overlay loaded from profiles/*.toml. */
 export interface ConfiguredProfile {
@@ -22,6 +30,23 @@ export interface ConfiguredAccount {
     id: string;
     label?: string;
 }
+/**
+ * Synthetic provider ids for OAuth subscription candidates (built at runtime
+ * from stored tokens, never declared under `[providers.<id>]`). Routing rules
+ * may target these without a matching config stanza; see
+ * validateRoutingRules.
+ */
+export declare const SUBSCRIPTION_PROVIDER_IDS: readonly ["anthropic-sub", "openai-sub"];
+/** Single user-defined routing rule from [[routing.rules]]. */
+export interface RoutingRule {
+    /** Match keys (AND-ed). At least one of role or family is required. */
+    role?: string;
+    family?: "fast-coder" | "frontier-coder";
+    /** Target keys (exactly one of). */
+    model?: string;
+    provider?: string;
+    tier?: "subscription" | "local" | "api-key";
+}
 export interface ConfigWarning {
     filePath: string;
     path: string;
@@ -34,6 +59,7 @@ export interface OffRouterConfig {
     policyDefaults: PolicyDefaults;
     providers: Record<string, ConfiguredProvider>;
     profiles: Record<string, ConfiguredProfile>;
+    routingRules: RoutingRule[];
     warnings: ConfigWarning[];
 }
 export interface LoadConfigOptions {

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,4DAA4D;AAC5D,MAAM,WAAW,cAAc;IAC7B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED,6DAA6D;AAC7D,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,mDAAmD;AACnD,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,YAAY,CAAC;IACrB,cAAc,EAAE,cAAc,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC9C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC5C,QAAQ,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;IACvB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;CACxB;AAED,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;gBAEd,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,OAAO;CAUhE;AA+DD;;GAEG;AACH,wBAAgB,aAAa,CAAC,OAAO,SAAK,GAAG,eAAe,CAkB3D;AAED,wBAAgB,oBAAoB,CAClC,OAAO,GAAE,kBAAuB,GAC/B,MAAM,CAQR;AAsSD;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAC9B,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,eAAe,CAAC,CAe1B"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,4DAA4D;AAC5D,MAAM,WAAW,cAAc;IAC7B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED,6DAA6D;AAC7D,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iHAAiH;IACjH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,sGAAsG;IACtG,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,mDAAmD;AACnD,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,0CAG5B,CAAC;AAEX,+DAA+D;AAC/D,MAAM,WAAW,WAAW;IAC1B,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,YAAY,GAAG,gBAAgB,CAAC;IACzC,oCAAoC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,GAAG,SAAS,CAAC;CAC7C;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,YAAY,CAAC;IACrB,cAAc,EAAE,cAAc,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC9C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC5C,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,QAAQ,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;IACvB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;CACxB;AAED,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;gBAEd,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,OAAO;CAUhE;AAiHD;;GAEG;AACH,wBAAgB,aAAa,CAAC,OAAO,SAAK,GAAG,eAAe,CAuB3D;AAED,wBAAgB,oBAAoB,CAClC,OAAO,GAAE,kBAAuB,GAC/B,MAAM,CAQR;AA4XD;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAC9B,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,eAAe,CAAC,CA2C1B"}

package/dist/config.js

@@ -8,6 +8,16 @@ import { homedir as osHomedir } from "node:os";
 import { join, resolve } from "node:path";
 import { parse as parseToml } from "smol-toml";
 import { z } from "zod";
+/**
+ * Synthetic provider ids for OAuth subscription candidates (built at runtime
+ * from stored tokens, never declared under `[providers.<id>]`). Routing rules
+ * may target these without a matching config stanza; see
+ * validateRoutingRules.
+ */
+export const SUBSCRIPTION_PROVIDER_IDS = [
+    "anthropic-sub",
+    "openai-sub",
+];
 export class ConfigError extends Error {
     filePath;
     issues;
@@ -26,16 +36,42 @@ function allowedFromZodShape(shape) {
 }
 const ProviderConfigShape = {
     enabled: z.boolean().optional(),
+    base_url: z.string().optional(),
+    spend_cap_usd: z.number().min(0).optional(),
     accounts: z
         .array(z.object({ id: z.string().min(1), label: z.string().optional() }).strict())
         .optional(),
+    allowed_models: z.array(z.string().min(1)).optional(),
+    denied_models: z.array(z.string().min(1)).optional(),
 };
+const OutboundSecretScanSchema = z.enum(["block", "warn", "off"]);
+const SubscriptionSwitchSchema = z.enum(["auto", "ask"]);
+const RoutingRuleSchema = z
+    .object({
+    role: z.string().min(1).optional(),
+    family: z.enum(["fast-coder", "frontier-coder"]).optional(),
+    model: z.string().min(1).optional(),
+    provider: z.string().min(1).optional(),
+    tier: z.enum(["subscription", "local", "api-key"]).optional(),
+})
+    .strict()
+    .refine((rule) => (rule.role !== undefined || rule.family !== undefined) &&
+    [rule.model, rule.provider, rule.tier].filter(Boolean).length === 1, {
+    message: "routing.rules entry must have at least one of role/family and exactly one of model/provider/tier",
+});
 const PolicySectionShape = {
     subscription_first: z.boolean().optional(),
     allow_api_key_fallback: z.boolean().optional(),
     allow_third_party_subscription_adapters: z.boolean().optional(),
     denied_providers: z.array(z.string().min(1)).optional(),
     near_limit_threshold: z.number().min(0).max(1).optional(),
+    /** Scan outbound prompts for credential shapes: block | warn | off. Default warn. */
+    outbound_secret_scan: OutboundSecretScanSchema.optional(),
+    /** Consent mode for switching subscription accounts within a provider family: auto | ask. Default auto. */
+    subscription_switch: SubscriptionSwitchSchema.optional(),
+    spend_cap_usd: z.number().min(0).optional(),
+    require_api_spend_approval: z.boolean().optional(),
+    classifier: z.enum(["heuristic", "llm"]).optional(),
 };
 const RootConfigShape = {
     allowlisted_profiles: z.array(z.string().min(1)).optional(),
@@ -44,6 +80,12 @@ const RootConfigShape = {
     providers: z
         .record(z.string().min(1), z.object(ProviderConfigShape).strict())
         .optional(),
+    routing: z
+        .object({
+        rules: z.array(RoutingRuleSchema),
+    })
+        .strict()
+        .optional(),
 };
 const ProfileFileShape = {
     id: z.string().min(1).optional(),
@@ -57,10 +99,20 @@ const PROVIDER_ALLOWED = {
     ...allowedFromZodShape(ProviderConfigShape),
     accounts: "leaf",
 };
+const ROUTING_ALLOWED = {
+    rules: {
+        role: "leaf",
+        family: "leaf",
+        model: "leaf",
+        provider: "leaf",
+        tier: "leaf",
+    },
+};
 const ROOT_ALLOWED = {
     ...allowedFromZodShape(RootConfigShape),
     policy: allowedFromZodShape(PolicySectionShape),
     providers: "record",
+    routing: ROUTING_ALLOWED,
 };
 const PROFILE_ALLOWED = allowedFromZodShape(ProfileFileShape);
 const DEFAULT_DENIED_PROFILE_PATTERNS = ["*-work"];
@@ -76,6 +128,10 @@ export function defaultConfig(homeDir = "") {
             deniedProfilePatterns: [...DEFAULT_DENIED_PROFILE_PATTERNS],
             allowThirdPartySubscriptionAdapters: false,
             deniedProviders: [],
+            // Default warn: do not break existing users; blocking is opt-in.
+            outboundSecretScan: "warn",
+            // Default auto: current routing behavior; ask-before-switch is opt-in.
+            subscriptionSwitch: "auto",
         },
         policyDefaults: {
             subscriptionFirst: true,
@@ -83,6 +139,7 @@ export function defaultConfig(homeDir = "") {
         },
         providers: {},
         profiles: {},
+        routingRules: [],
         warnings: [],
     };
 }
@@ -109,6 +166,13 @@ function formatZodIssues(error) {
  * Uses Zod internals only as type-shape guidance via a parallel known-keys model.
  */
 function collectUnknownKeyWarnings(value, allowed, filePath, pathPrefix) {
+    if (Array.isArray(value)) {
+        const warnings = [];
+        for (let i = 0; i < value.length; i++) {
+            warnings.push(...collectUnknownKeyWarnings(value[i], allowed, filePath, `${pathPrefix}[${i}]`));
+        }
+        return warnings;
+    }
     if (!isPlainObject(value)) {
         return [];
     }
@@ -186,6 +250,9 @@ function validateProfile(raw, filePath, fallbackId) {
     };
 }
 function stripUnknown(value, allowed) {
+    if (Array.isArray(value)) {
+        return value.map((item) => stripUnknown(item, allowed));
+    }
     if (!isPlainObject(value)) {
         return value;
     }
@@ -246,6 +313,22 @@ function mergeRootInto(target, root, sourcePath) {
         if (root.policy.near_limit_threshold !== undefined) {
             target.policy.nearLimitThreshold = root.policy.near_limit_threshold;
         }
+        if (root.policy.outbound_secret_scan !== undefined) {
+            target.policy.outboundSecretScan = root.policy.outbound_secret_scan;
+        }
+        if (root.policy.subscription_switch !== undefined) {
+            target.policy.subscriptionSwitch = root.policy.subscription_switch;
+        }
+        if (root.policy.spend_cap_usd !== undefined) {
+            target.policy.spendCapUsd = root.policy.spend_cap_usd;
+        }
+        if (root.policy.require_api_spend_approval !== undefined) {
+            target.policy.requireApiSpendApproval =
+                root.policy.require_api_spend_approval;
+        }
+        if (root.policy.classifier !== undefined) {
+            target.policy.classifier = root.policy.classifier;
+        }
         if (root.policy.denied_providers) {
             target.policy.deniedProviders = uniqueStrings([
                 ...(target.policy.deniedProviders ?? []),
@@ -253,22 +336,72 @@ function mergeRootInto(target, root, sourcePath) {
             ]);
         }
     }
+    if (root.routing?.rules) {
+        target.routingRules.push(...root.routing.rules);
+    }
     if (root.providers) {
         for (const [id, provider] of Object.entries(root.providers)) {
             const accounts = provider.accounts
                 ? provider.accounts.map((a) => ({ id: a.id, label: a.label }))
                 : [{ id }];
-            target.providers[id] = {
+            const configured = {
                 id,
                 enabled: provider.enabled ?? true,
                 accounts,
             };
+            if (provider.base_url !== undefined) {
+                configured.baseUrl = provider.base_url;
+            }
+            if (provider.spend_cap_usd !== undefined) {
+                configured.spendCapUsd = provider.spend_cap_usd;
+            }
+            if (provider.allowed_models !== undefined) {
+                configured.allowedModels = provider.allowed_models;
+            }
+            if (provider.denied_models !== undefined) {
+                configured.deniedModels = provider.denied_models;
+            }
+            target.providers[id] = configured;
         }
     }
 }
 function uniqueStrings(values) {
     return [...new Set(values)];
 }
+function validateRoutingRules(config) {
+    const validRules = [];
+    for (let i = 0; i < config.routingRules.length; i++) {
+        const rule = config.routingRules[i];
+        let providerId;
+        if (rule.provider !== undefined) {
+            providerId = rule.provider;
+        }
+        else if (rule.model !== undefined) {
+            const slashIdx = rule.model.indexOf("/");
+            if (slashIdx <= 0 || slashIdx === rule.model.length - 1) {
+                config.warnings.push({
+                    filePath: config.sources[0] ?? config.homeDir,
+                    path: `routing.rules[${i}]`,
+                    message: `Routing rule ${i} model "${rule.model}" is not in provider/model-id form; rule ignored.`,
+                });
+                continue;
+            }
+            providerId = rule.model.slice(0, slashIdx);
+        }
+        if (providerId !== undefined &&
+            !(providerId in config.providers) &&
+            !SUBSCRIPTION_PROVIDER_IDS.includes(providerId)) {
+            config.warnings.push({
+                filePath: config.sources[0] ?? config.homeDir,
+                path: `routing.rules[${i}]`,
+                message: `Routing rule ${i} references unconfigured provider "${providerId}"; rule ignored.`,
+            });
+            continue;
+        }
+        validRules.push(rule);
+    }
+    config.routingRules = validRules;
+}
 async function readOptionalFile(path) {
     try {
         return await readFile(path, "utf8");
@@ -350,6 +483,32 @@ export async function loadConfig(options = {}) {
     if (options.workspaceDir && options.workspaceTrusted) {
         await loadRootFile(join(options.workspaceDir, ".offrouter", "config.toml"), config);
     }
+    validateRoutingRules(config);
+    // Derive per-provider spend cap overrides onto the policy config so every
+    // caller of loadConfig enforces the same caps without remapping providers.
+    const providerSpendCapsUsd = {};
+    const providerAllowedModels = {};
+    const providerDeniedModels = {};
+    for (const [id, provider] of Object.entries(config.providers)) {
+        if (provider.spendCapUsd !== undefined) {
+            providerSpendCapsUsd[id] = provider.spendCapUsd;
+        }
+        if (provider.allowedModels !== undefined && provider.allowedModels.length > 0) {
+            providerAllowedModels[id] = provider.allowedModels;
+        }
+        if (provider.deniedModels !== undefined && provider.deniedModels.length > 0) {
+            providerDeniedModels[id] = provider.deniedModels;
+        }
+    }
+    if (Object.keys(providerSpendCapsUsd).length > 0) {
+        config.policy.providerSpendCapsUsd = providerSpendCapsUsd;
+    }
+    if (Object.keys(providerAllowedModels).length > 0) {
+        config.policy.providerAllowedModels = providerAllowedModels;
+    }
+    if (Object.keys(providerDeniedModels).length > 0) {
+        config.policy.providerDeniedModels = providerDeniedModels;
+    }
     return config;
 }
 //# sourceMappingURL=config.js.map