usertrust 0.2.6 → 1.1.0

package/dist/headless.js

@@ -0,0 +1,566 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 Usertools, Inc.
+/**
+ * headless.ts — Headless Governance API
+ *
+ * A two-phase lifecycle API (authorize → settle/abort) for governing
+ * LLM calls WITHOUT requiring a provider SDK client instance.
+ *
+ * This is the integration surface for non-SDK environments like OpenClaw
+ * (which uses pi-ai streaming) or any system that makes raw LLM calls.
+ *
+ * Usage:
+ * ```ts
+ * import { createGovernor } from "usertrust/headless";
+ *
+ * const governor = await createGovernor({ dryRun: true, budget: 100_000 });
+ *
+ * const auth = await governor.authorize({
+ *   model: "claude-sonnet-4-6",
+ *   estimatedInputTokens: 500,
+ *   maxOutputTokens: 4096,
+ * });
+ *
+ * try {
+ *   // ... make the LLM call, accumulate usage ...
+ *   const receipt = await governor.settle(auth, {
+ *     inputTokens: actualInput,
+ *     outputTokens: actualOutput,
+ *   });
+ * } catch (err) {
+ *   await governor.abort(auth, err);
+ *   throw err;
+ * }
+ *
+ * await governor.destroy();
+ * ```
+ */
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync } from "node:fs";
+import { readFile, rename, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { createAuditWriter } from "./audit/chain.js";
+import { writeReceipt } from "./audit/rotation.js";
+import { TrustTBClient, XFER_SPEND } from "./ledger/client.js";
+import { estimateCost, estimateInputTokens } from "./ledger/pricing.js";
+import { recordPattern } from "./memory/patterns.js";
+import { evaluatePolicy, loadPolicies } from "./policy/gate.js";
+import { detectPII } from "./policy/pii.js";
+import { connectProxy } from "./proxy.js";
+import { CircuitBreakerRegistry } from "./resilience/circuit.js";
+import { DEFAULT_BUDGET, VAULT_DIR } from "./shared/constants.js";
+import { LedgerUnavailableError, PolicyDeniedError } from "./shared/errors.js";
+import { trustId } from "./shared/ids.js";
+import { TrustConfigSchema } from "./shared/types.js";
+// ── Verify URL base ──
+const VERIFY_URL_BASE = "https://verify.usertrust.dev";
+// ── Async mutex (same as govern.ts AUD-453) ──
+class AsyncMutex {
+    queue = Promise.resolve();
+    async acquire() {
+        let release;
+        const next = new Promise((resolve) => {
+            release = resolve;
+        });
+        const prev = this.queue;
+        this.queue = next;
+        await prev;
+        return release;
+    }
+}
+async function loadSpendLedger(vaultBase) {
+    const ledgerPath = join(vaultBase, VAULT_DIR, "spend-ledger.json");
+    try {
+        const raw = await readFile(ledgerPath, "utf-8");
+        const parsed = JSON.parse(raw);
+        if (parsed != null &&
+            typeof parsed === "object" &&
+            "budgetSpent" in parsed &&
+            typeof parsed.budgetSpent === "number") {
+            const value = parsed.budgetSpent;
+            if (Number.isFinite(value) && value >= 0) {
+                return value;
+            }
+        }
+    }
+    catch {
+        // No ledger file or corrupt — start from zero
+    }
+    return 0;
+}
+async function persistSpendLedger(vaultBase, budgetSpent) {
+    const dir = join(vaultBase, VAULT_DIR);
+    const ledgerPath = join(dir, "spend-ledger.json");
+    const tmpPath = join(dir, "spend-ledger.json.tmp");
+    const data = {
+        budgetSpent,
+        updatedAt: new Date().toISOString(),
+    };
+    try {
+        if (!existsSync(dir)) {
+            mkdirSync(dir, { recursive: true });
+        }
+        await writeFile(tmpPath, JSON.stringify(data), "utf-8");
+        await rename(tmpPath, ledgerPath);
+    }
+    catch {
+        // Best-effort — do not fail the LLM call over ledger persistence
+    }
+}
+// ── TigerBeetle engine factory (same as govern.ts) ──
+async function createTBEngine(config) {
+    const tbAddresses = config.tigerbeetle.addresses;
+    const tbClusterId = BigInt(config.tigerbeetle.clusterId);
+    const tbClient = new TrustTBClient({
+        addresses: tbAddresses,
+        clusterId: tbClusterId,
+    });
+    await tbClient.createTreasury();
+    await tbClient.ensureEscrowAccount("trust:escrow");
+    const pendingMap = new Map();
+    return {
+        async spendPending(params) {
+            const treasury = tbClient.getTreasuryId();
+            const escrowId = TrustTBClient.deriveAccountId("trust:escrow");
+            const tbTransferId = await tbClient.createPendingTransfer({
+                debitAccountId: escrowId,
+                creditAccountId: treasury,
+                amount: params.amount,
+                code: XFER_SPEND,
+            });
+            pendingMap.set(params.transferId, tbTransferId);
+            return { transferId: params.transferId };
+        },
+        async postPendingSpend(transferId) {
+            const tbId = pendingMap.get(transferId);
+            if (tbId === undefined) {
+                throw new Error(`No pending transfer found for ${transferId}`);
+            }
+            await tbClient.postTransfer(tbId);
+            pendingMap.delete(transferId);
+        },
+        async voidPendingSpend(transferId) {
+            const tbId = pendingMap.get(transferId);
+            if (tbId === undefined) {
+                throw new Error(`No pending transfer found for ${transferId}`);
+            }
+            await tbClient.voidTransfer(tbId);
+            pendingMap.delete(transferId);
+        },
+        async voidAllPending() {
+            const entries = [...pendingMap.entries()];
+            for (const [trustIdKey, tbTransferId] of entries) {
+                try {
+                    await tbClient.voidTransfer(tbTransferId);
+                }
+                catch {
+                    // Best-effort
+                }
+                pendingMap.delete(trustIdKey);
+            }
+        },
+        destroy() {
+            tbClient.destroy();
+        },
+    };
+}
+// ── createGovernor() ──
+/**
+ * Create a headless governance engine for non-SDK integrations.
+ *
+ * Unlike `trust()` which wraps a provider SDK client, `createGovernor()`
+ * returns a standalone engine with an explicit authorize/settle/abort
+ * lifecycle. This is designed for systems like OpenClaw that make raw
+ * LLM calls via streaming libraries (pi-ai) rather than SDK clients.
+ */
+export async function createGovernor(opts) {
+    // 1. Load config
+    const vaultBase = opts?.vaultBase ?? process.cwd();
+    const configPath = opts?.configPath ?? join(vaultBase, VAULT_DIR, "usertrust.config.json");
+    let config;
+    if (existsSync(configPath)) {
+        const raw = JSON.parse(await readFile(configPath, "utf-8"));
+        config = TrustConfigSchema.parse({
+            ...raw,
+            ...(opts?.budget !== undefined ? { budget: opts.budget } : {}),
+        });
+    }
+    else {
+        config = TrustConfigSchema.parse({
+            budget: opts?.budget ?? DEFAULT_BUDGET,
+        });
+    }
+    const customRates = config.pricing === "custom" ? config.customRates : undefined;
+    const isDryRun = opts?.dryRun ?? process.env.USERTRUST_DRY_RUN === "true";
+    const isTestEnv = process.env.USERTRUST_TEST === "1" || process.env.NODE_ENV === "test";
+    // 2. Initialize subsystems
+    const vaultPath = vaultBase;
+    const audit = (isTestEnv ? opts?._audit : undefined) ?? createAuditWriter(vaultPath);
+    const policiesPath = join(vaultPath, VAULT_DIR, config.policies);
+    const policyRules = existsSync(policiesPath) ? loadPolicies(policiesPath) : [];
+    const breaker = new CircuitBreakerRegistry({
+        failureThreshold: config.circuitBreaker.failureThreshold,
+        resetTimeoutMs: config.circuitBreaker.resetTimeout,
+    });
+    // 3. Proxy connection
+    let proxyConn = null;
+    if (opts?.proxy) {
+        proxyConn = connectProxy(opts.proxy, opts.key);
+    }
+    // 4. Engine
+    let engine;
+    if (isTestEnv && opts?._engine !== undefined) {
+        engine = opts._engine;
+    }
+    else if (!isDryRun && proxyConn == null) {
+        try {
+            engine = await createTBEngine(config);
+        }
+        catch (err) {
+            throw new LedgerUnavailableError(err instanceof Error ? err.message : String(err));
+        }
+    }
+    else {
+        engine = null;
+    }
+    // 5. State
+    let destroyed = false;
+    let budgetSpent = await loadSpendLedger(vaultBase);
+    const budgetMutex = new AsyncMutex();
+    let inFlightHoldTotal = 0;
+    const activeAuths = new Map();
+    // 6. Governor implementation
+    const governor = {
+        config,
+        async authorize(params) {
+            if (destroyed) {
+                throw new Error("Governor has been destroyed");
+            }
+            const model = params.model;
+            const actor = params.actor ?? "local";
+            const messages = params.messages ?? [];
+            // Circuit breaker — key on "headless" since we don't have a client kind
+            const cb = breaker.get("headless");
+            cb.allowRequest();
+            // Estimate cost
+            const transferId = trustId("tx");
+            const estInputTokens = params.estimatedInputTokens ?? estimateInputTokens(messages);
+            const maxOutputTokens = params.maxOutputTokens ?? 4096;
+            const estCost = estimateCost(model, estInputTokens, maxOutputTokens, customRates);
+            // Acquire mutex for budget atomicity (AUD-453)
+            const releaseBudgetLock = await budgetMutex.acquire();
+            let proxyTransferId;
+            try {
+                // Policy gate — caller params spread FIRST so governance
+                // fields cannot be shadowed (prevents budget_remaining injection).
+                const policyResult = evaluatePolicy(policyRules, {
+                    ...(params.params ?? {}),
+                    model,
+                    tier: config.tier,
+                    estimated_cost: estCost,
+                    budget_remaining: config.budget - budgetSpent - inFlightHoldTotal,
+                });
+                if (policyResult.decision === "deny") {
+                    const reason = policyResult.reasons.length > 0 ? policyResult.reasons.join("; ") : "Policy denied";
+                    throw new PolicyDeniedError(reason);
+                }
+                // PII check
+                if (config.pii !== "off" && messages.length > 0) {
+                    const piiResult = detectPII(messages);
+                    if (piiResult.found && config.pii === "block") {
+                        throw new PolicyDeniedError(`PII detected: ${piiResult.types.join(", ")}`);
+                    }
+                }
+                // PENDING hold
+                if (proxyConn != null && !isDryRun) {
+                    try {
+                        const proxyResult = await proxyConn.spend({
+                            model,
+                            estimatedCost: estCost,
+                            actor,
+                        });
+                        proxyTransferId = proxyResult.transferId;
+                    }
+                    catch (holdErr) {
+                        throw new LedgerUnavailableError(holdErr instanceof Error ? holdErr.message : String(holdErr));
+                    }
+                }
+                else if (engine != null && !isDryRun) {
+                    try {
+                        await engine.spendPending({ transferId, amount: estCost });
+                    }
+                    catch (holdErr) {
+                        throw new LedgerUnavailableError(holdErr instanceof Error ? holdErr.message : String(holdErr));
+                    }
+                }
+                inFlightHoldTotal += estCost;
+            }
+            finally {
+                releaseBudgetLock();
+            }
+            const auth = {
+                transferId,
+                estimatedCost: estCost,
+                model,
+                proxyTransferId,
+                createdAt: Date.now(),
+            };
+            activeAuths.set(transferId, auth);
+            return auth;
+        },
+        async settle(auth, params) {
+            if (!activeAuths.has(auth.transferId)) {
+                throw new Error(`Authorization ${auth.transferId} is not active (already settled or aborted)`);
+            }
+            activeAuths.delete(auth.transferId);
+            const model = auth.model;
+            let callAuditDegraded = false;
+            // Determine actual cost
+            let actualCost;
+            let usageSource;
+            if (params?.inputTokens != null || params?.outputTokens != null) {
+                actualCost = estimateCost(model, params.inputTokens ?? 0, params.outputTokens ?? 0, customRates);
+                usageSource = params.usageSource ?? "provider";
+            }
+            else {
+                actualCost = auth.estimatedCost;
+                usageSource = "estimated";
+            }
+            // AUD-453: Acquire mutex for budget atomicity — prevents concurrent
+            // settle() calls from corrupting inFlightHoldTotal or budgetSpent.
+            const releaseLock = await budgetMutex.acquire();
+            try {
+                inFlightHoldTotal -= auth.estimatedCost;
+                budgetSpent += actualCost;
+            }
+            finally {
+                releaseLock();
+            }
+            await persistSpendLedger(vaultBase, budgetSpent);
+            // Circuit breaker: success
+            const cb = breaker.get("headless");
+            cb.recordSuccess();
+            // POST settlement
+            let settled = true;
+            if (proxyConn != null && !isDryRun) {
+                try {
+                    await proxyConn.settle(auth.proxyTransferId ?? auth.transferId, actualCost);
+                }
+                catch (postErr) {
+                    settled = false;
+                    await audit
+                        .appendEvent({
+                        kind: "settlement_ambiguous",
+                        actor: "local",
+                        data: {
+                            model,
+                            cost: actualCost,
+                            transferId: auth.transferId,
+                            error: postErr instanceof Error
+                                ? postErr.message.slice(0, 200)
+                                : String(postErr).slice(0, 200),
+                        },
+                    })
+                        .catch(() => {
+                        callAuditDegraded = true;
+                    });
+                }
+            }
+            else if (engine != null && !isDryRun) {
+                try {
+                    await engine.postPendingSpend(auth.transferId);
+                }
+                catch (postErr) {
+                    settled = false;
+                    await audit
+                        .appendEvent({
+                        kind: "settlement_ambiguous",
+                        actor: "local",
+                        data: {
+                            model,
+                            cost: actualCost,
+                            transferId: auth.transferId,
+                            error: postErr instanceof Error
+                                ? postErr.message.slice(0, 200)
+                                : String(postErr).slice(0, 200),
+                        },
+                    })
+                        .catch(() => {
+                        callAuditDegraded = true;
+                    });
+                }
+            }
+            // Audit event
+            const syntheticHash = createHash("sha256").update(auth.transferId).digest("hex");
+            let auditHash = syntheticHash;
+            try {
+                const auditEvent = await audit.appendEvent({
+                    kind: "llm_call",
+                    actor: "local",
+                    data: {
+                        model,
+                        cost: actualCost,
+                        settled,
+                        transferId: auth.transferId,
+                        usageSource,
+                        ...(params?.chunksDelivered != null ? { chunksDelivered: params.chunksDelivered } : {}),
+                        source: "headless",
+                    },
+                });
+                auditHash = auditEvent.hash;
+            }
+            catch {
+                callAuditDegraded = true;
+            }
+            // Daily-rotated receipt
+            if (config.audit.rotation !== "none") {
+                writeReceipt(vaultPath, {
+                    kind: "llm_call",
+                    subsystem: "headless",
+                    actor: "local",
+                    data: {
+                        model,
+                        cost: actualCost,
+                        settled,
+                        transferId: auth.transferId,
+                    },
+                }, config.audit.indexLimit);
+            }
+            // Pattern memory
+            if (config.patterns.enabled) {
+                const promptHash = createHash("sha256").update(auth.transferId).digest("hex");
+                await recordPattern({
+                    promptHash,
+                    model,
+                    cost: actualCost,
+                    success: true,
+                }).catch(() => { });
+            }
+            const receipt = {
+                transferId: auth.transferId,
+                cost: actualCost,
+                budgetRemaining: config.budget - budgetSpent - inFlightHoldTotal,
+                auditHash,
+                chainPath: join(VAULT_DIR, "audit"),
+                receiptUrl: opts?.proxy != null ? `${VERIFY_URL_BASE}/${auth.transferId}` : null,
+                settled,
+                model,
+                provider: "headless",
+                timestamp: new Date().toISOString(),
+                usageSource,
+                ...(params?.chunksDelivered != null ? { chunksDelivered: params.chunksDelivered } : {}),
+                ...(callAuditDegraded ? { auditDegraded: true } : {}),
+                ...(proxyConn != null ? { proxyStub: true } : {}),
+            };
+            return receipt;
+        },
+        async abort(auth, error) {
+            if (!activeAuths.has(auth.transferId)) {
+                // Already settled or aborted — idempotent
+                return;
+            }
+            activeAuths.delete(auth.transferId);
+            // AUD-453: Acquire mutex for budget atomicity
+            const releaseLock = await budgetMutex.acquire();
+            try {
+                inFlightHoldTotal -= auth.estimatedCost;
+            }
+            finally {
+                releaseLock();
+            }
+            // Circuit breaker: failure
+            const cb = breaker.get("headless");
+            cb.recordFailure();
+            // VOID the pending hold
+            if (proxyConn != null && !isDryRun) {
+                try {
+                    await proxyConn.void(auth.proxyTransferId ?? auth.transferId);
+                }
+                catch {
+                    // Best-effort void
+                }
+            }
+            else if (engine != null && !isDryRun) {
+                try {
+                    await engine.voidPendingSpend(auth.transferId);
+                }
+                catch {
+                    // Best-effort void
+                }
+            }
+            // Audit the failure
+            await audit
+                .appendEvent({
+                kind: "llm_call_failed",
+                actor: "local",
+                data: {
+                    model: auth.model,
+                    transferId: auth.transferId,
+                    error: error instanceof Error
+                        ? error.message.slice(0, 200)
+                        : error != null
+                            ? String(error).slice(0, 200)
+                            : "aborted",
+                    source: "headless",
+                },
+            })
+                .catch(() => { });
+        },
+        async destroy() {
+            if (destroyed)
+                return;
+            destroyed = true;
+            // Void all active authorizations (engine + proxy paths)
+            for (const [txId, auth] of activeAuths) {
+                if (proxyConn != null && !isDryRun) {
+                    try {
+                        await proxyConn.void(auth.proxyTransferId ?? txId);
+                    }
+                    catch {
+                        // Best-effort void
+                    }
+                }
+                else if (engine != null && !isDryRun) {
+                    try {
+                        await engine.voidPendingSpend(txId);
+                    }
+                    catch {
+                        // Best-effort void
+                    }
+                }
+            }
+            activeAuths.clear();
+            // Flush audit
+            await audit.flush();
+            audit.release();
+            // Destroy engine
+            if (engine != null && typeof engine.destroy === "function") {
+                engine.destroy();
+            }
+            // Destroy proxy
+            if (proxyConn != null) {
+                proxyConn.destroy();
+            }
+        },
+        estimateCost(model, inputTokens, outputTokens) {
+            return estimateCost(model, inputTokens, outputTokens, customRates);
+        },
+        estimateInputTokens(messages) {
+            return estimateInputTokens(messages);
+        },
+        budgetRemaining() {
+            return config.budget - budgetSpent - inFlightHoldTotal;
+        },
+    };
+    // Safety net: clean up on process exit (use once to avoid listener accumulation)
+    const cleanupHandler = () => {
+        if (!destroyed) {
+            governor.destroy().catch(() => { });
+        }
+    };
+    process.once("beforeExit", cleanupHandler);
+    process.once("SIGTERM", cleanupHandler);
+    process.once("SIGINT", cleanupHandler);
+    return governor;
+}
+//# sourceMappingURL=headless.js.map

package/dist/headless.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"headless.js","sourceRoot":"","sources":["../src/headless.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAoB,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAiB,cAAc,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAwB,YAAY,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAiFtD,wBAAwB;AAExB,MAAM,eAAe,GAAG,8BAA8B,CAAC;AAEvD,gDAAgD;AAEhD,MAAM,UAAU;IACP,KAAK,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEjD,KAAK,CAAC,OAAO;QACZ,IAAI,OAAiC,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC1C,OAAO,GAAG,OAAO,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,MAAM,IAAI,CAAC;QACX,OAAO,OAAqB,CAAC;IAC9B,CAAC;CACD;AASD,KAAK,UAAU,eAAe,CAAC,SAAiB;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACnE,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IACC,MAAM,IAAI,IAAI;YACd,OAAO,MAAM,KAAK,QAAQ;YAC1B,aAAa,IAAI,MAAM;YACvB,OAAQ,MAAsB,CAAC,WAAW,KAAK,QAAQ,EACtD,CAAC;YACF,MAAM,KAAK,GAAI,MAAsB,CAAC,WAAW,CAAC;YAClD,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;gBAC1C,OAAO,KAAK,CAAC;YACd,CAAC;QACF,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,8CAA8C;IAC/C,CAAC;IACD,OAAO,CAAC,CAAC;AACV,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,SAAiB,EAAE,WAAmB;IACvE,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IACnD,MAAM,IAAI,GAAgB;QACzB,WAAW;QACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACnC,CAAC;IACF,IAAI,CAAC;QACJ,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACxD,MAAM,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACR,iEAAiE;IAClE,CAAC;AACF,CAAC;AAED,uDAAuD;AAEvD,KAAK,UAAU,cAAc,CAAC,MAAmB;IAChD,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC;IACjD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAEzD,MAAM,QAAQ,GAAG,IAAI,aAAa,CAAC;QAClC,SAAS,EAAE,WAAW;QACtB,SAAS,EAAE,WAAW;KACtB,CAAC,CAAC;IAEH,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAC;IAChC,MAAM,QAAQ,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC;IAEnD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE7C,OAAO;QACN,KAAK,CAAC,YAAY,CAAC,MAGlB;YACA,MAAM,QAAQ,GAAG,QAAQ,CAAC,aAAa,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,aAAa,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC;YAE/D,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,qBAAqB,CAAC;gBACzD,cAAc,EAAE,QAAQ;gBACxB,eAAe,EAAE,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,IAAI,EAAE,UAAU;aAChB,CAAC,CAAC;YAEH,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YAChD,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1C,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,UAAkB;YACxC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,iCAAiC,UAAU,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YAClC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC/B,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,UAAkB;YACxC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,iCAAiC,UAAU,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YAClC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC/B,CAAC;QAED,KAAK,CAAC,cAAc;YACnB,MAAM,OAAO,GAAG,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1C,KAAK,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,IAAI,OAAO,EAAE,CAAC;gBAClD,IAAI,CAAC;oBACJ,MAAM,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;gBAC3C,CAAC;gBAAC,MAAM,CAAC;oBACR,cAAc;gBACf,CAAC;gBACD,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC/B,CAAC;QACF,CAAC;QAED,OAAO;YACN,QAAQ,CAAC,OAAO,EAAE,CAAC;QACpB,CAAC;KACD,CAAC;AACH,CAAC;AAED,yBAAyB;AAEzB;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAgB;IACpD,iBAAiB;IACjB,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACnD,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,IAAI,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,uBAAuB,CAAC,CAAC;IAE3F,IAAI,MAAmB,CAAC;IACxB,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QACrE,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC;YAChC,GAAI,GAA+B;YACnC,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;IACJ,CAAC;SAAM,CAAC;QACP,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,cAAc;SACtC,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,MAAM,QAAQ,GAAG,IAAI,EAAE,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,MAAM,CAAC;IAC1E,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC;IAExF,2BAA2B;IAC3B,MAAM,SAAS,GAAG,SAAS,CAAC;IAC5B,MAAM,KAAK,GAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAElG,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,WAAW,GAAe,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE3F,MAAM,OAAO,GAAG,IAAI,sBAAsB,CAAC;QAC1C,gBAAgB,EAAE,MAAM,CAAC,cAAc,CAAC,gBAAgB;QACxD,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC,YAAY;KAClD,CAAC,CAAC;IAEH,sBAAsB;IACtB,IAAI,SAAS,GAA2B,IAAI,CAAC;IAC7C,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;QACjB,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,CAAC;IAED,YAAY;IACZ,IAAI,MAA0B,CAAC;IAC/B,IAAI,SAAS,IAAI,IAAI,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;IACvB,CAAC;SAAM,IAAI,CAAC,QAAQ,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC;YACJ,MAAM,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,sBAAsB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACpF,CAAC;IACF,CAAC;SAAM,CAAC;QACP,MAAM,GAAG,IAAI,CAAC;IACf,CAAC;IAED,WAAW;IACX,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,WAAW,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,IAAI,UAAU,EAAE,CAAC;IACrC,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,MAAM,WAAW,GAAG,IAAI,GAAG,EAAyB,CAAC;IAErD,6BAA6B;IAC7B,MAAM,QAAQ,GAAa;QAC1B,MAAM;QAEN,KAAK,CAAC,SAAS,CAAC,MAAuB;YACtC,IAAI,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAChD,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC;YACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;YAEvC,wEAAwE;YACxE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,UAAmB,CAAC,CAAC;YAC5C,EAAE,CAAC,YAAY,EAAE,CAAC;YAElB,gBAAgB;YAChB,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,cAAc,GAAG,MAAM,CAAC,oBAAoB,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YACpF,MAAM,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,IAAI,CAAC;YACvD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;YAElF,+CAA+C;YAC/C,MAAM,iBAAiB,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC;YACtD,IAAI,eAAmC,CAAC;YAExC,IAAI,CAAC;gBACJ,yDAAyD;gBACzD,mEAAmE;gBACnE,MAAM,YAAY,GAAG,cAAc,CAAC,WAAW,EAAE;oBAChD,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;oBACxB,KAAK;oBACL,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,cAAc,EAAE,OAAO;oBACvB,gBAAgB,EAAE,MAAM,CAAC,MAAM,GAAG,WAAW,GAAG,iBAAiB;iBACjE,CAAC,CAAC;gBACH,IAAI,YAAY,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;oBACtC,MAAM,MAAM,GACX,YAAY,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;oBACrF,MAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBACrC,CAAC;gBAED,YAAY;gBACZ,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACjD,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;oBACtC,IAAI,SAAS,CAAC,KAAK,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;wBAC/C,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAC5E,CAAC;gBACF,CAAC;gBAED,eAAe;gBACf,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACpC,IAAI,CAAC;wBACJ,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC;4BACzC,KAAK;4BACL,aAAa,EAAE,OAAO;4BACtB,KAAK;yBACL,CAAC,CAAC;wBACH,eAAe,GAAG,WAAW,CAAC,UAAU,CAAC;oBAC1C,CAAC;oBAAC,OAAO,OAAO,EAAE,CAAC;wBAClB,MAAM,IAAI,sBAAsB,CAC/B,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAC5D,CAAC;oBACH,CAAC;gBACF,CAAC;qBAAM,IAAI,MAAM,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACxC,IAAI,CAAC;wBACJ,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;oBAC5D,CAAC;oBAAC,OAAO,OAAO,EAAE,CAAC;wBAClB,MAAM,IAAI,sBAAsB,CAC/B,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAC5D,CAAC;oBACH,CAAC;gBACF,CAAC;gBAED,iBAAiB,IAAI,OAAO,CAAC;YAC9B,CAAC;oBAAS,CAAC;gBACV,iBAAiB,EAAE,CAAC;YACrB,CAAC;YAED,MAAM,IAAI,GAAkB;gBAC3B,UAAU;gBACV,aAAa,EAAE,OAAO;gBACtB,KAAK;gBACL,eAAe;gBACf,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACrB,CAAC;YACF,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAClC,OAAO,IAAI,CAAC;QACb,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,IAAmB,EAAE,MAAqB;YACtD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACd,iBAAiB,IAAI,CAAC,UAAU,6CAA6C,CAC7E,CAAC;YACH,CAAC;YACD,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAEpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YACzB,IAAI,iBAAiB,GAAG,KAAK,CAAC;YAE9B,wBAAwB;YACxB,IAAI,UAAkB,CAAC;YACvB,IAAI,WAAqC,CAAC;YAC1C,IAAI,MAAM,EAAE,WAAW,IAAI,IAAI,IAAI,MAAM,EAAE,YAAY,IAAI,IAAI,EAAE,CAAC;gBACjE,UAAU,GAAG,YAAY,CACxB,KAAK,EACL,MAAM,CAAC,WAAW,IAAI,CAAC,EACvB,MAAM,CAAC,YAAY,IAAI,CAAC,EACxB,WAAW,CACX,CAAC;gBACF,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,UAAU,CAAC;YAChD,CAAC;iBAAM,CAAC;gBACP,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC;gBAChC,WAAW,GAAG,WAAW,CAAC;YAC3B,CAAC;YAED,oEAAoE;YACpE,mEAAmE;YACnE,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC;YAChD,IAAI,CAAC;gBACJ,iBAAiB,IAAI,IAAI,CAAC,aAAa,CAAC;gBACxC,WAAW,IAAI,UAAU,CAAC;YAC3B,CAAC;oBAAS,CAAC;gBACV,WAAW,EAAE,CAAC;YACf,CAAC;YACD,MAAM,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YAEjD,2BAA2B;YAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,UAAmB,CAAC,CAAC;YAC5C,EAAE,CAAC,aAAa,EAAE,CAAC;YAEnB,kBAAkB;YAClB,IAAI,OAAO,GAAG,IAAI,CAAC;YACnB,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACpC,IAAI,CAAC;oBACJ,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;gBAC7E,CAAC;gBAAC,OAAO,OAAO,EAAE,CAAC;oBAClB,OAAO,GAAG,KAAK,CAAC;oBAChB,MAAM,KAAK;yBACT,WAAW,CAAC;wBACZ,IAAI,EAAE,sBAAsB;wBAC5B,KAAK,EAAE,OAAO;wBACd,IAAI,EAAE;4BACL,KAAK;4BACL,IAAI,EAAE,UAAU;4BAChB,UAAU,EAAE,IAAI,CAAC,UAAU;4BAC3B,KAAK,EACJ,OAAO,YAAY,KAAK;gCACvB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gCAC/B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;yBACjC;qBACD,CAAC;yBACD,KAAK,CAAC,GAAG,EAAE;wBACX,iBAAiB,GAAG,IAAI,CAAC;oBAC1B,CAAC,CAAC,CAAC;gBACL,CAAC;YACF,CAAC;iBAAM,IAAI,MAAM,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxC,IAAI,CAAC;oBACJ,MAAM,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAChD,CAAC;gBAAC,OAAO,OAAO,EAAE,CAAC;oBAClB,OAAO,GAAG,KAAK,CAAC;oBAChB,MAAM,KAAK;yBACT,WAAW,CAAC;wBACZ,IAAI,EAAE,sBAAsB;wBAC5B,KAAK,EAAE,OAAO;wBACd,IAAI,EAAE;4BACL,KAAK;4BACL,IAAI,EAAE,UAAU;4BAChB,UAAU,EAAE,IAAI,CAAC,UAAU;4BAC3B,KAAK,EACJ,OAAO,YAAY,KAAK;gCACvB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gCAC/B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;yBACjC;qBACD,CAAC;yBACD,KAAK,CAAC,GAAG,EAAE;wBACX,iBAAiB,GAAG,IAAI,CAAC;oBAC1B,CAAC,CAAC,CAAC;gBACL,CAAC;YACF,CAAC;YAED,cAAc;YACd,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjF,IAAI,SAAS,GAAG,aAAa,CAAC;YAC9B,IAAI,CAAC;gBACJ,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC;oBAC1C,IAAI,EAAE,UAAU;oBAChB,KAAK,EAAE,OAAO;oBACd,IAAI,EAAE;wBACL,KAAK;wBACL,IAAI,EAAE,UAAU;wBAChB,OAAO;wBACP,UAAU,EAAE,IAAI,CAAC,UAAU;wBAC3B,WAAW;wBACX,GAAG,CAAC,MAAM,EAAE,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACvF,MAAM,EAAE,UAAU;qBAClB;iBACD,CAAC,CAAC;gBACH,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACR,iBAAiB,GAAG,IAAI,CAAC;YAC1B,CAAC;YAED,wBAAwB;YACxB,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACtC,YAAY,CACX,SAAS,EACT;oBACC,IAAI,EAAE,UAAU;oBAChB,SAAS,EAAE,UAAU;oBACrB,KAAK,EAAE,OAAO;oBACd,IAAI,EAAE;wBACL,KAAK;wBACL,IAAI,EAAE,UAAU;wBAChB,OAAO;wBACP,UAAU,EAAE,IAAI,CAAC,UAAU;qBAC3B;iBACD,EACD,MAAM,CAAC,KAAK,CAAC,UAAU,CACvB,CAAC;YACH,CAAC;YAED,iBAAiB;YACjB,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBAC7B,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC9E,MAAM,aAAa,CAAC;oBACnB,UAAU;oBACV,KAAK;oBACL,IAAI,EAAE,UAAU;oBAChB,OAAO,EAAE,IAAI;iBACb,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACpB,CAAC;YAED,MAAM,OAAO,GAAiB;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,IAAI,EAAE,UAAU;gBAChB,eAAe,EAAE,MAAM,CAAC,MAAM,GAAG,WAAW,GAAG,iBAAiB;gBAChE,SAAS;gBACT,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC;gBACnC,UAAU,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,eAAe,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI;gBAChF,OAAO;gBACP,KAAK;gBACL,QAAQ,EAAE,UAAU;gBACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,WAAW;gBACX,GAAG,CAAC,MAAM,EAAE,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvF,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D,CAAC;YAEF,OAAO,OAAO,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,IAAmB,EAAE,KAAe;YAC/C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACvC,0CAA0C;gBAC1C,OAAO;YACR,CAAC;YACD,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAEpC,8CAA8C;YAC9C,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC;YAChD,IAAI,CAAC;gBACJ,iBAAiB,IAAI,IAAI,CAAC,aAAa,CAAC;YACzC,CAAC;oBAAS,CAAC;gBACV,WAAW,EAAE,CAAC;YACf,CAAC;YAED,2BAA2B;YAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,UAAmB,CAAC,CAAC;YAC5C,EAAE,CAAC,aAAa,EAAE,CAAC;YAEnB,wBAAwB;YACxB,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACpC,IAAI,CAAC;oBACJ,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC/D,CAAC;gBAAC,MAAM,CAAC;oBACR,mBAAmB;gBACpB,CAAC;YACF,CAAC;iBAAM,IAAI,MAAM,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxC,IAAI,CAAC;oBACJ,MAAM,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAChD,CAAC;gBAAC,MAAM,CAAC;oBACR,mBAAmB;gBACpB,CAAC;YACF,CAAC;YAED,oBAAoB;YACpB,MAAM,KAAK;iBACT,WAAW,CAAC;gBACZ,IAAI,EAAE,iBAAiB;gBACvB,KAAK,EAAE,OAAO;gBACd,IAAI,EAAE;oBACL,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,KAAK,EACJ,KAAK,YAAY,KAAK;wBACrB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBAC7B,CAAC,CAAC,KAAK,IAAI,IAAI;4BACd,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;4BAC7B,CAAC,CAAC,SAAS;oBACd,MAAM,EAAE,UAAU;iBAClB;aACD,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,OAAO;YACZ,IAAI,SAAS;gBAAE,OAAO;YACtB,SAAS,GAAG,IAAI,CAAC;YAEjB,wDAAwD;YACxD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC;gBACxC,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACpC,IAAI,CAAC;wBACJ,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC;oBACpD,CAAC;oBAAC,MAAM,CAAC;wBACR,mBAAmB;oBACpB,CAAC;gBACF,CAAC;qBAAM,IAAI,MAAM,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACxC,IAAI,CAAC;wBACJ,MAAM,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;oBACrC,CAAC;oBAAC,MAAM,CAAC;wBACR,mBAAmB;oBACpB,CAAC;gBACF,CAAC;YACF,CAAC;YACD,WAAW,CAAC,KAAK,EAAE,CAAC;YAEpB,cAAc;YACd,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;YACpB,KAAK,CAAC,OAAO,EAAE,CAAC;YAEhB,iBAAiB;YACjB,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;gBAC5D,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,CAAC;YAED,gBAAgB;YAChB,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;gBACvB,SAAS,CAAC,OAAO,EAAE,CAAC;YACrB,CAAC;QACF,CAAC;QAED,YAAY,CAAC,KAAa,EAAE,WAAmB,EAAE,YAAoB;YACpE,OAAO,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;QACpE,CAAC;QAED,mBAAmB,CAAC,QAAmB;YACtC,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;QAED,eAAe;YACd,OAAO,MAAM,CAAC,MAAM,GAAG,WAAW,GAAG,iBAAiB,CAAC;QACxD,CAAC;KACD,CAAC;IAEF,iFAAiF;IACjF,MAAM,cAAc,GAAG,GAAS,EAAE;QACjC,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACpC,CAAC;IACF,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAC3C,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACxC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAEvC,OAAO,QAAQ,CAAC;AACjB,CAAC"}

package/dist/index.d.ts

@@ -1,6 +1,16 @@
 export { trust } from "./govern.js";
 export type { TrustOpts, TrustedClient } from "./govern.js";
+export { createGovernor } from "./headless.js";
+export type { Governor, Authorization, AuthorizeParams, SettleParams } from "./headless.js";
 export { loadConfig, defineConfig } from "./config.js";
-export type { TrustedResponse, TrustReceipt, TrustConfig, PolicyRule, FieldCondition, BoardDecision, AuditEvent, LLMClientKind, } from "./shared/types.js";
-export { InsufficientBalanceError, PolicyDeniedError, LedgerUnavailableError, AuditDegradedError, VaultNotInitializedError, } from "./shared/errors.js";
+export type { TrustedResponse, TrustReceipt, TrustConfig, PolicyRule, FieldCondition, BoardDecision, AuditEvent, LLMClientKind, ActionKind, ActionDescriptor, GovernedActionResult, InjectionDetection, CanaryToken, SkillPermission, SkillManifest, SkillVerification, CredentialScope, CredentialEntry, CredentialAccessResult, } from "./shared/types.js";
+export { detectInjection } from "./policy/injection.js";
+export { generateCanary, injectCanary, detectCanaryLeak } from "./policy/canary.js";
+export { validateManifest, createUnsignedManifest, hashManifest } from "./supply-chain/manifest.js";
+export { generateKeyPair, signManifest, verifySignature } from "./supply-chain/sign.js";
+export { checkPermissions, enforceSkillLoad } from "./supply-chain/permissions.js";
+export { createVaultStore } from "./vault/store.js";
+export type { VaultStore } from "./vault/store.js";
+export { checkScope } from "./vault/scope.js";
+export { InsufficientBalanceError, PolicyDeniedError, LedgerUnavailableError, AuditDegradedError, VaultNotInitializedError, SkillVerificationError, VaultKeyMissingError, CredentialAccessDeniedError, } from "./shared/errors.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG5D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGvD,YAAY,EACX,eAAe,EACf,YAAY,EACZ,WAAW,EACX,UAAU,EACV,cAAc,EACd,aAAa,EACb,UAAU,EACV,aAAa,GACb,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACN,wBAAwB,EACxB,iBAAiB,EACjB,sBAAsB,EACtB,kBAAkB,EAClB,wBAAwB,GACxB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG5D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG5F,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGvD,YAAY,EACX,eAAe,EACf,YAAY,EACZ,WAAW,EACX,UAAU,EACV,cAAc,EACd,aAAa,EACb,UAAU,EACV,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,sBAAsB,GACtB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGpF,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AACpG,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAGnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG9C,OAAO,EACN,wBAAwB,EACxB,iBAAiB,EACjB,sBAAsB,EACtB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,2BAA2B,GAC3B,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -3,8 +3,20 @@
 // usertrust — AI Financial Governance SDK
 // Core
 export { trust } from "./govern.js";
+// Headless governance (non-SDK integrations)
+export { createGovernor } from "./headless.js";
 // Config
 export { loadConfig, defineConfig } from "./config.js";
+// Injection detection
+export { detectInjection } from "./policy/injection.js";
+export { generateCanary, injectCanary, detectCanaryLeak } from "./policy/canary.js";
+// Supply Chain
+export { validateManifest, createUnsignedManifest, hashManifest } from "./supply-chain/manifest.js";
+export { generateKeyPair, signManifest, verifySignature } from "./supply-chain/sign.js";
+export { checkPermissions, enforceSkillLoad } from "./supply-chain/permissions.js";
+// Credential Vault
+export { createVaultStore } from "./vault/store.js";
+export { checkScope } from "./vault/scope.js";
 // Errors
-export { InsufficientBalanceError, PolicyDeniedError, LedgerUnavailableError, AuditDegradedError, VaultNotInitializedError, } from "./shared/errors.js";
+export { InsufficientBalanceError, PolicyDeniedError, LedgerUnavailableError, AuditDegradedError, VaultNotInitializedError, SkillVerificationError, VaultKeyMissingError, CredentialAccessDeniedError, } from "./shared/errors.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,0CAA0C;AAE1C,OAAO;AACP,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAGpC,SAAS;AACT,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAcvD,SAAS;AACT,OAAO,EACN,wBAAwB,EACxB,iBAAiB,EACjB,sBAAsB,EACtB,kBAAkB,EAClB,wBAAwB,GACxB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,0CAA0C;AAE1C,OAAO;AACP,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAGpC,6CAA6C;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG/C,SAAS;AACT,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAyBvD,sBAAsB;AACtB,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEpF,eAAe;AACf,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AACpG,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEnF,mBAAmB;AACnB,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,SAAS;AACT,OAAO,EACN,wBAAwB,EACxB,iBAAiB,EACjB,sBAAsB,EACtB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,2BAA2B,GAC3B,MAAM,oBAAoB,CAAC"}