usertrust 1.3.0 → 1.5.0

package/dist/cli/snapshot.js.map

@@ -1 +1 @@
-{"version":3,"file":"snapshot.js","sourceRoot":"","sources":["../../src/cli/snapshot.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAG3F,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAgB,EAAE,IAAiB;IAC5D,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;IAEjC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,IAAI,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;gBACd,OAAO,EAAE,UAAU;gBACnB,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,EAAE,OAAO,EAAE,mDAAmD,EAAE;aACtE,CAAC,CACF,CAAC;QACH,CAAC;aAAM,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC,gCAAgC,CAAC,CAAC;QACjF,CAAC;QACD,OAAO;IACR,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE7B,QAAQ,UAAU,EAAE,CAAC;QACpB,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,IAAI,IAAI,EAAE,CAAC;oBACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;wBACd,OAAO,EAAE,UAAU;wBACnB,OAAO,EAAE,KAAK;wBACd,IAAI,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE;qBAC1C,CAAC,CACF,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACP,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;gBACxD,CAAC;gBACD,OAAO;YACR,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACnD,IAAI,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;oBACd,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE;wBACL,MAAM,EAAE,QAAQ;wBAChB,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;wBACxB,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,SAAS,EAAE,IAAI,CAAC,SAAS;qBACzB;iBACD,CAAC,CACF,CAAC;YACH,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBACxD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;gBACrD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC;gBAClD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YACvD,CAAC;YACD,MAAM;QACP,CAAC;QAED,KAAK,SAAS,CAAC,CAAC,CAAC;YAChB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,IAAI,IAAI,EAAE,CAAC;oBACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;wBACd,OAAO,EAAE,UAAU;wBACnB,OAAO,EAAE,KAAK;wBACd,IAAI,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE;qBAC1C,CAAC,CACF,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACP,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;gBACzD,CAAC;gBACD,OAAO;YACR,CAAC;YACD,MAAM,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACvC,IAAI,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;oBACd,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE;iBACjC,CAAC,CACF,CAAC;YACH,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,CAAC;YACrD,CAAC;YACD,MAAM;QACP,CAAC;QAED,KAAK,MAAM,CAAC,CAAC,CAAC;YACb,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;oBACd,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE;wBACL,MAAM,EAAE,MAAM;wBACd,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;4BAChC,IAAI,EAAE,CAAC,CAAC,IAAI;4BACZ,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM;4BACrB,IAAI,EAAE,CAAC,CAAC,IAAI;4BACZ,SAAS,EAAE,CAAC,CAAC,SAAS;yBACtB,CAAC,CAAC;qBACH;iBACD,CAAC,CACF,CAAC;YACH,CAAC;iBAAM,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC1B,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;oBAC3B,OAAO,CAAC,GAAG,CACV,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,WAAW,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,SAAS,GAAG,CAAC,EAAE,CAC/F,CAAC;gBACH,CAAC;YACF,CAAC;YACD,MAAM;QACP,CAAC;QAED;YACC,IAAI,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;oBACd,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,KAAK;oBACd,IAAI,EAAE,EAAE,OAAO,EAAE,gDAAgD,EAAE;iBACnE,CAAC,CACF,CAAC;YACH,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;YACvE,CAAC;YACD,MAAM;IACR,CAAC;AACF,CAAC"}
+{"version":3,"file":"snapshot.js","sourceRoot":"","sources":["../../src/cli/snapshot.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAG3F,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAgB,EAAE,IAAiB;IAC5D,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;IAEjC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,IAAI,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;gBACd,OAAO,EAAE,UAAU;gBACnB,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,EAAE,OAAO,EAAE,mDAAmD,EAAE;aACtE,CAAC,CACF,CAAC;QACH,CAAC;aAAM,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC,gCAAgC,CAAC,CAAC;QACjF,CAAC;QACD,OAAO;IACR,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnC,uEAAuE;IACvE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAE/C,QAAQ,UAAU,EAAE,CAAC;QACpB,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,IAAI,IAAI,EAAE,CAAC;oBACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;wBACd,OAAO,EAAE,UAAU;wBACnB,OAAO,EAAE,KAAK;wBACd,IAAI,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE;qBAC1C,CAAC,CACF,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACP,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;gBACxD,CAAC;gBACD,OAAO;YACR,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACnD,IAAI,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;oBACd,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE;wBACL,MAAM,EAAE,QAAQ;wBAChB,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;wBACxB,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,SAAS,EAAE,IAAI,CAAC,SAAS;qBACzB;iBACD,CAAC,CACF,CAAC;YACH,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBACxD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;gBACrD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC;gBAClD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YACvD,CAAC;YACD,MAAM;QACP,CAAC;QAED,KAAK,SAAS,CAAC,CAAC,CAAC;YAChB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,IAAI,IAAI,EAAE,CAAC;oBACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;wBACd,OAAO,EAAE,UAAU;wBACnB,OAAO,EAAE,KAAK;wBACd,IAAI,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE;qBAC1C,CAAC,CACF,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACP,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;gBACzD,CAAC;gBACD,OAAO;YACR,CAAC;YACD,IAAI,CAAC;gBACJ,MAAM,eAAe,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC;YACtE,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACZ,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACvD,IAAI,IAAI,EAAE,CAAC;oBACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;wBACd,OAAO,EAAE,UAAU;wBACnB,OAAO,EAAE,KAAK;wBACd,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE;qBAC7C,CAAC,CACF,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACP,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;gBACrD,CAAC;gBACD,OAAO;YACR,CAAC;YACD,IAAI,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;oBACd,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE;iBACjC,CAAC,CACF,CAAC;YACH,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,CAAC;YACrD,CAAC;YACD,MAAM;QACP,CAAC;QAED,KAAK,MAAM,CAAC,CAAC,CAAC;YACb,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;oBACd,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE;wBACL,MAAM,EAAE,MAAM;wBACd,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;4BAChC,IAAI,EAAE,CAAC,CAAC,IAAI;4BACZ,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM;4BACrB,IAAI,EAAE,CAAC,CAAC,IAAI;4BACZ,SAAS,EAAE,CAAC,CAAC,SAAS;yBACtB,CAAC,CAAC;qBACH;iBACD,CAAC,CACF,CAAC;YACH,CAAC;iBAAM,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC1B,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;oBAC3B,OAAO,CAAC,GAAG,CACV,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,WAAW,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,SAAS,GAAG,CAAC,EAAE,CAC/F,CAAC;gBACH,CAAC;YACF,CAAC;YACD,MAAM;QACP,CAAC;QAED;YACC,IAAI,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;oBACd,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,KAAK;oBACd,IAAI,EAAE,EAAE,OAAO,EAAE,gDAAgD,EAAE;iBACnE,CAAC,CACF,CAAC;YACH,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;YACvE,CAAC;YACD,MAAM;IACR,CAAC;AACF,CAAC"}

package/dist/cli/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/cli/verify.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C,wBAAsB,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAoD5E"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/cli/verify.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C,wBAAsB,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAyD5E"}

package/dist/cli/verify.js

@@ -3,12 +3,14 @@
 /**
  * CLI: usertrust verify — Verify audit chain integrity
  *
- * Calls verifyChain() on the local vault's audit log and displays the result.
+ * Calls verifyVault() on the local vault (anchored to the `.meta` head, spans
+ * rotated segments) and displays the result. Sets a nonzero process exit code
+ * on a FAILED verdict so CI gates fail on a tampered vault.
  */
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import pc from "picocolors";
-import { verifyChain } from "../audit/verify.js";
+import { verifyVault } from "../audit/verify.js";
 import { VAULT_DIR } from "../shared/constants.js";
 export async function run(rootDir, opts) {
     const root = rootDir ?? process.cwd();
@@ -25,35 +27,42 @@ export async function run(rootDir, opts) {
         else {
             console.log(`${pc.red("No trust vault found.")} Run \`usertrust init\` first.`);
         }
+        // A missing vault is a failed verification for CI purposes.
+        process.exitCode = 1;
         return;
     }
-    const logPath = join(vaultPath, "audit", "events.jsonl");
-    const result = verifyChain(logPath);
+    const result = verifyVault(vaultPath);
+    const verifiedAt = new Date().toISOString();
     if (json) {
         console.log(JSON.stringify({
             command: "verify",
             success: result.valid,
             data: {
                 valid: result.valid,
-                eventsVerified: result.eventsVerified,
+                chainLength: result.chainLength,
                 errors: result.errors,
-                latestHash: result.latestHash,
-                verifiedAt: result.verifiedAt,
+                merkleRoot: result.merkleRoot,
+                verifiedAt,
             },
         }));
+        if (!result.valid)
+            process.exitCode = 1;
         return;
     }
     if (result.valid) {
-        console.log(pc.green(`Chain verified: ${result.eventsVerified} events, all hashes valid.`));
-        console.log(`Latest hash: ${pc.dim(result.latestHash)}`);
+        console.log(pc.green(`Chain verified: ${result.chainLength} events, all hashes valid.`));
+        if (result.merkleRoot)
+            console.log(`Merkle root: ${pc.dim(result.merkleRoot)}`);
     }
     else {
         console.log(pc.red(`Chain verification FAILED: ${result.errors.length} error(s) found.`));
-        console.log(`Events checked: ${result.eventsVerified}`);
+        console.log(`Events checked: ${result.chainLength}`);
         for (const err of result.errors) {
             console.log(pc.red(`  - ${err}`));
         }
+        // Use process.exitCode (not process.exit) so buffered stdout flushes.
+        process.exitCode = 1;
     }
-    console.log(pc.dim(`Verified at: ${result.verifiedAt}`));
+    console.log(pc.dim(`Verified at: ${verifiedAt}`));
 }
 //# sourceMappingURL=verify.js.map

package/dist/cli/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/cli/verify.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAGnD,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAgB,EAAE,IAAiB;IAC5D,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;IAEjC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,IAAI,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;gBACd,OAAO,EAAE,QAAQ;gBACjB,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,EAAE,OAAO,EAAE,mDAAmD,EAAE;aACtE,CAAC,CACF,CAAC;QACH,CAAC;aAAM,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC,gCAAgC,CAAC,CAAC;QACjF,CAAC;QACD,OAAO;IACR,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAEpC,IAAI,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;YACd,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,MAAM,CAAC,KAAK;YACrB,IAAI,EAAE;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;aAC7B;SACD,CAAC,CACF,CAAC;QACF,OAAO;IACR,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,mBAAmB,MAAM,CAAC,cAAc,4BAA4B,CAAC,CAAC,CAAC;QAC5F,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC;SAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,8BAA8B,MAAM,CAAC,MAAM,CAAC,MAAM,kBAAkB,CAAC,CAAC,CAAC;QAC1F,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;QACxD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC;QACnC,CAAC;IACF,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/cli/verify.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAGnD,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAgB,EAAE,IAAiB;IAC5D,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;IAEjC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,IAAI,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;gBACd,OAAO,EAAE,QAAQ;gBACjB,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,EAAE,OAAO,EAAE,mDAAmD,EAAE;aACtE,CAAC,CACF,CAAC;QACH,CAAC;aAAM,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC,gCAAgC,CAAC,CAAC;QACjF,CAAC;QACD,4DAA4D;QAC5D,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACR,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE5C,IAAI,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;YACd,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,MAAM,CAAC,KAAK;YACrB,IAAI,EAAE;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,UAAU;aACV;SACD,CAAC,CACF,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACxC,OAAO;IACR,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,mBAAmB,MAAM,CAAC,WAAW,4BAA4B,CAAC,CAAC,CAAC;QACzF,IAAI,MAAM,CAAC,UAAU;YAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;SAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,8BAA8B,MAAM,CAAC,MAAM,CAAC,MAAM,kBAAkB,CAAC,CAAC,CAAC;QAC1F,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QACrD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC;QACnC,CAAC;QACD,sEAAsE;QACtE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gBAAgB,UAAU,EAAE,CAAC,CAAC,CAAC;AACnD,CAAC"}

package/dist/detect.d.ts

@@ -16,7 +16,7 @@
  * implement their own budget and audit controls or wrap calls through the
  * governed entry points above.
  */
-import type { LLMClientKind } from "./shared/types.js";
+import type { EndpointInfo, LLMClientKind, TrustConfig } from "./shared/types.js";
 /**
  * Detect which LLM SDK a client belongs to by inspecting its shape.
  *
@@ -32,4 +32,37 @@ import type { LLMClientKind } from "./shared/types.js";
  * @throws {Error} if the client does not match any known SDK shape
  */
 export declare function detectClientKind(client: unknown): LLMClientKind;
+/**
+ * Classify the endpoint a client points at — local (self-hosted) or cloud —
+ * selecting the settlement regime for every governed call. Runs BESIDE
+ * `detectClientKind` (which stays the transport detector); the endpoint class,
+ * not the model string, picks local vs cloud metering, so model-name spoofing
+ * (`ollama cp llama3.2 gpt-4o`) cannot change the regime.
+ *
+ * Classification order:
+ * 1. `override.class` provided → override wins (runtime defaults to "unknown").
+ * 2. `client.baseURL` read when it is a string; absent or malformed (URL parse
+ *    failure) → treated as absent → cloud default. Never throws.
+ * 3. `config.endpoints[]` first match (origin / leading-star hostname suffix /
+ *    bare hostname — see matchesEndpointEntry).
+ * 4. Loopback autodetect (config.local.autoDetectLoopback): hostname
+ *    localhost | 127.0.0.1 | ::1 | ::ffff:127.0.0.1 (case-insensitive, IPv6
+ *    brackets stripped, IPv4-mapped form matched by its WHATWG serialization) →
+ *    local, runtime hinted by port (11434 ollama, 1234 lmstudio, 8000 vllm,
+ *    else "openai-compat").
+ * 5. Default `{ class: "cloud", runtime: "unknown" }` — fail-EXPENSIVE:
+ *    over-charging at cloud rates is recoverable, under-charging a paid
+ *    endpoint is not.
+ *
+ * **Security posture (trusted-operator boundary):** endpoint classification —
+ * config matchers, overrides, and loopback autodetect — is a TRUSTED-OPERATOR
+ * decision. Never wire it to end-user or request input. In server/multi-tenant
+ * deployments set `local.autoDetectLoopback: false` and classify via explicit
+ * `endpoints[]` config: loopback inside a container can be a forwarding sidecar
+ * to a paid API. This is the same trust boundary as `budget`/`customRates` —
+ * the config author already controls billing entirely. Note that a compromised
+ * local server can under-report usage; receipts expose `usageSource` and
+ * `meter.rateSource` precisely so that this is auditable.
+ */
+export declare function classifyEndpoint(client: unknown, config: TrustConfig, override?: Partial<EndpointInfo>): EndpointInfo;
 //# sourceMappingURL=detect.d.ts.map

package/dist/detect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../src/detect.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,OAAO,GAAG,aAAa,CAyC/D"}
+{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../src/detect.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAgB,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhG;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,OAAO,GAAG,aAAa,CAyC/D;AAsED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,gBAAgB,CAC/B,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,WAAW,EACnB,QAAQ,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,GAC9B,YAAY,CA8Bd"}

package/dist/detect.js

@@ -47,4 +47,128 @@ export function detectClientKind(client) {
     }
     throw new Error("Unsupported LLM client: could not detect Anthropic, OpenAI, or Google SDK");
 }
+// ── Endpoint classification (M2 local-model governance) ──
+// Compared against normalizeHostname(url.hostname) — the WHATWG-serialized,
+// bracket-stripped form. `::ffff:7f00:1` is how Node's URL serializes the
+// IPv4-mapped IPv6 loopback `::ffff:127.0.0.1` (the last 32 bits render as hex,
+// never dotted-quad), so the map entry MUST be the serialized form to match.
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "::1", "::ffff:7f00:1"]);
+/** Best-effort runtime hint by conventional default port (metadata only). */
+const RUNTIME_BY_PORT = {
+    "11434": "ollama",
+    "1234": "lmstudio",
+    "8000": "vllm",
+};
+const CLOUD_DEFAULT = { class: "cloud", runtime: "unknown" };
+function parseUrl(value) {
+    try {
+        return new URL(value);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Normalize a URL hostname for comparison: lowercase, IPv6 brackets stripped
+ * (Node's WHATWG URL keeps brackets in `hostname` for IPv6 literals).
+ */
+function normalizeHostname(hostname) {
+    const lower = hostname.toLowerCase();
+    if (lower.startsWith("[") && lower.endsWith("]"))
+        return lower.slice(1, -1);
+    return lower;
+}
+/**
+ * Match a parsed baseURL against one config.endpoints[].match entry (A1).
+ * Exactly three entry forms — never raw string prefixing:
+ * (i)   scheme entry ("http://gpu-box:8000") → parsed; match iff origins are equal
+ *       (path/query/trailing slash ignored; kills "http://gpu-box:8000.evil.com"
+ *       and "http://gpu-box:8000@evil.com" bypass shapes);
+ * (ii)  leading-star entry ("*.gpu.internal") → hostname SUFFIX match: matches
+ *       "a.gpu.internal" and "x.y.gpu.internal", NOT "gpu.internal" itself;
+ * (iii) bare hostname → case-insensitive hostname equality (any port).
+ * Unparseable scheme entries never match (and never throw).
+ */
+function matchesEndpointEntry(entry, url) {
+    if (/^https?:\/\//i.test(entry)) {
+        const entryUrl = parseUrl(entry);
+        return entryUrl !== null && entryUrl.origin === url.origin;
+    }
+    const host = normalizeHostname(url.hostname);
+    if (entry.startsWith("*.")) {
+        const suffix = entry.slice(1).toLowerCase(); // ".gpu.internal"
+        return host.endsWith(suffix);
+    }
+    return host === entry.toLowerCase();
+}
+/** Read a string `baseURL` property off an SDK client instance, if present. */
+function readBaseURL(client) {
+    if (client != null && typeof client === "object" && "baseURL" in client) {
+        const value = client.baseURL;
+        if (typeof value === "string")
+            return value;
+    }
+    return undefined;
+}
+/**
+ * Classify the endpoint a client points at — local (self-hosted) or cloud —
+ * selecting the settlement regime for every governed call. Runs BESIDE
+ * `detectClientKind` (which stays the transport detector); the endpoint class,
+ * not the model string, picks local vs cloud metering, so model-name spoofing
+ * (`ollama cp llama3.2 gpt-4o`) cannot change the regime.
+ *
+ * Classification order:
+ * 1. `override.class` provided → override wins (runtime defaults to "unknown").
+ * 2. `client.baseURL` read when it is a string; absent or malformed (URL parse
+ *    failure) → treated as absent → cloud default. Never throws.
+ * 3. `config.endpoints[]` first match (origin / leading-star hostname suffix /
+ *    bare hostname — see matchesEndpointEntry).
+ * 4. Loopback autodetect (config.local.autoDetectLoopback): hostname
+ *    localhost | 127.0.0.1 | ::1 | ::ffff:127.0.0.1 (case-insensitive, IPv6
+ *    brackets stripped, IPv4-mapped form matched by its WHATWG serialization) →
+ *    local, runtime hinted by port (11434 ollama, 1234 lmstudio, 8000 vllm,
+ *    else "openai-compat").
+ * 5. Default `{ class: "cloud", runtime: "unknown" }` — fail-EXPENSIVE:
+ *    over-charging at cloud rates is recoverable, under-charging a paid
+ *    endpoint is not.
+ *
+ * **Security posture (trusted-operator boundary):** endpoint classification —
+ * config matchers, overrides, and loopback autodetect — is a TRUSTED-OPERATOR
+ * decision. Never wire it to end-user or request input. In server/multi-tenant
+ * deployments set `local.autoDetectLoopback: false` and classify via explicit
+ * `endpoints[]` config: loopback inside a container can be a forwarding sidecar
+ * to a paid API. This is the same trust boundary as `budget`/`customRates` —
+ * the config author already controls billing entirely. Note that a compromised
+ * local server can under-report usage; receipts expose `usageSource` and
+ * `meter.rateSource` precisely so that this is auditable.
+ */
+export function classifyEndpoint(client, config, override) {
+    const baseURL = readBaseURL(client);
+    // (1) Explicit override wins over everything.
+    if (override?.class !== undefined) {
+        const info = { class: override.class, runtime: override.runtime ?? "unknown" };
+        const overrideBase = override.baseURL ?? baseURL;
+        if (overrideBase !== undefined)
+            info.baseURL = overrideBase;
+        return info;
+    }
+    // (2) No readable baseURL → cloud default. Malformed → treat as absent, never throw.
+    if (baseURL === undefined)
+        return { ...CLOUD_DEFAULT };
+    const url = parseUrl(baseURL);
+    if (url === null)
+        return { ...CLOUD_DEFAULT };
+    // (3) config.endpoints[] — first match wins.
+    for (const entry of config.endpoints) {
+        if (matchesEndpointEntry(entry.match, url)) {
+            return { class: entry.class, runtime: entry.runtime, baseURL };
+        }
+    }
+    // (4) Loopback autodetect.
+    if (config.local.autoDetectLoopback && LOOPBACK_HOSTS.has(normalizeHostname(url.hostname))) {
+        return { class: "local", runtime: RUNTIME_BY_PORT[url.port] ?? "openai-compat", baseURL };
+    }
+    // (5) Cloud default.
+    return { class: "cloud", runtime: "unknown", baseURL };
+}
 //# sourceMappingURL=detect.js.map

package/dist/detect.js.map

@@ -1 +1 @@
-{"version":3,"file":"detect.js","sourceRoot":"","sources":["../src/detect.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAuBjC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAe;IAC/C,IACC,MAAM,IAAI,IAAI;QACd,OAAO,MAAM,KAAK,QAAQ;QAC1B,UAAU,IAAI,MAAM;QACpB,MAAM,CAAC,QAAQ,IAAI,IAAI;QACvB,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QACnC,QAAQ,IAAI,MAAM,CAAC,QAAQ;QAC3B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,UAAU,EAC3C,CAAC;QACF,OAAO,WAAW,CAAC;IACpB,CAAC;IAED,IACC,MAAM,IAAI,IAAI;QACd,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,IAAI,MAAM;QAChB,MAAM,CAAC,IAAI,IAAI,IAAI;QACnB,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAC/B,aAAa,IAAI,MAAM,CAAC,IAAI;QAC5B,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI;QAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,QAAQ;QAC3C,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW;QACnC,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,UAAU,EACnD,CAAC;QACF,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,IACC,MAAM,IAAI,IAAI;QACd,OAAO,MAAM,KAAK,QAAQ;QAC1B,QAAQ,IAAI,MAAM;QAClB,MAAM,CAAC,MAAM,IAAI,IAAI;QACrB,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QACjC,iBAAiB,IAAI,MAAM,CAAC,MAAM;QAClC,OAAO,MAAM,CAAC,MAAM,CAAC,eAAe,KAAK,UAAU,EAClD,CAAC;QACF,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;AAC9F,CAAC"}
+{"version":3,"file":"detect.js","sourceRoot":"","sources":["../src/detect.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAuBjC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAe;IAC/C,IACC,MAAM,IAAI,IAAI;QACd,OAAO,MAAM,KAAK,QAAQ;QAC1B,UAAU,IAAI,MAAM;QACpB,MAAM,CAAC,QAAQ,IAAI,IAAI;QACvB,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QACnC,QAAQ,IAAI,MAAM,CAAC,QAAQ;QAC3B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,UAAU,EAC3C,CAAC;QACF,OAAO,WAAW,CAAC;IACpB,CAAC;IAED,IACC,MAAM,IAAI,IAAI;QACd,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,IAAI,MAAM;QAChB,MAAM,CAAC,IAAI,IAAI,IAAI;QACnB,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAC/B,aAAa,IAAI,MAAM,CAAC,IAAI;QAC5B,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI;QAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,QAAQ;QAC3C,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW;QACnC,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,UAAU,EACnD,CAAC;QACF,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,IACC,MAAM,IAAI,IAAI;QACd,OAAO,MAAM,KAAK,QAAQ;QAC1B,QAAQ,IAAI,MAAM;QAClB,MAAM,CAAC,MAAM,IAAI,IAAI;QACrB,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QACjC,iBAAiB,IAAI,MAAM,CAAC,MAAM;QAClC,OAAO,MAAM,CAAC,MAAM,CAAC,eAAe,KAAK,UAAU,EAClD,CAAC;QACF,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;AAC9F,CAAC;AAED,4DAA4D;AAE5D,4EAA4E;AAC5E,0EAA0E;AAC1E,gFAAgF;AAChF,6EAA6E;AAC7E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC;AAEnF,6EAA6E;AAC7E,MAAM,eAAe,GAAiC;IACrD,OAAO,EAAE,QAAQ;IACjB,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,MAAM;CACd,CAAC;AAEF,MAAM,aAAa,GAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAE3E,SAAS,QAAQ,CAAC,KAAa;IAC9B,IAAI,CAAC;QACJ,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,QAAgB;IAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5E,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,oBAAoB,CAAC,KAAa,EAAE,GAAQ;IACpD,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC;IAC5D,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,kBAAkB;QAC/D,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;AACrC,CAAC;AAED,+EAA+E;AAC/E,SAAS,WAAW,CAAC,MAAe;IACnC,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;QACzE,MAAM,KAAK,GAAI,MAAgC,CAAC,OAAO,CAAC;QACxD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;IAC7C,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,gBAAgB,CAC/B,MAAe,EACf,MAAmB,EACnB,QAAgC;IAEhC,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAEpC,8CAA8C;IAC9C,IAAI,QAAQ,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,GAAiB,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC;QAC7F,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC;QACjD,IAAI,YAAY,KAAK,SAAS;YAAE,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC;QAC5D,OAAO,IAAI,CAAC;IACb,CAAC;IAED,qFAAqF;IACrF,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;IACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;IAE9C,6CAA6C;IAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;YAC5C,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;QAChE,CAAC;IACF,CAAC;IAED,2BAA2B;IAC3B,IAAI,MAAM,CAAC,KAAK,CAAC,kBAAkB,IAAI,cAAc,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC5F,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,eAAe,EAAE,OAAO,EAAE,CAAC;IAC3F,CAAC;IAED,qBAAqB;IACrB,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AACxD,CAAC"}

package/dist/govern.d.ts

@@ -1,5 +1,5 @@
 import { type AuditWriter } from "./audit/chain.js";
-import type { ActionDescriptor, GovernedActionResult } from "./shared/types.js";
+import type { ActionDescriptor, EndpointInfo, GovernedActionResult } from "./shared/types.js";
 export interface TrustOpts {
     /** Path to usertrust.config.json. Defaults to `.usertrust/usertrust.config.json`. */
     configPath?: string;
@@ -25,6 +25,13 @@ export interface TrustOpts {
     dryRun?: boolean;
     /** Vault directory override (default: cwd). */
     vaultBase?: string;
+    /**
+     * Explicit endpoint classification override (M2) — wins over config.endpoints
+     * matchers and loopback autodetect. TRUSTED-OPERATOR input, same trust
+     * boundary as budget/customRates: never derive it from end-user or request
+     * data (A10).
+     */
+    endpoint?: Partial<EndpointInfo> | undefined;
     /**
      * Inject a mock/test engine. When set, used instead of TigerBeetle.
      * Primarily for testing failure modes.
@@ -45,7 +52,11 @@ export interface TrustEngine {
     }): Promise<{
         transferId: string;
     }>;
-    postPendingSpend(transferId: string): Promise<void>;
+    /**
+     * Settle a PENDING hold. `actualAmount` posts the true consumed cost (which may
+     * be less than the reserved estimate); omitting it posts the full pending amount.
+     */
+    postPendingSpend(transferId: string, actualAmount?: number): Promise<void>;
     voidPendingSpend(transferId: string): Promise<void>;
     /** AUD-461: Void all remaining pending transfers on destroy. */
     voidAllPending?(): Promise<void>;

package/dist/govern.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"govern.d.ts","sourceRoot":"","sources":["../src/govern.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,KAAK,WAAW,EAAqB,MAAM,kBAAkB,CAAC;AAoBvE,OAAO,KAAK,EACX,gBAAgB,EAChB,oBAAoB,EAKpB,MAAM,mBAAmB,CAAC;AAK3B,MAAM,WAAW,SAAS;IACzB,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,OAAO,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC7B;;;OAGG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC3B,YAAY,CAAC,MAAM,EAAE;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpC,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,gEAAgE;IAChE,cAAc,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,IAAI,CAAC;CACjB;AAED,sEAAsE;AACtE,MAAM,MAAM,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG;IAClC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,YAAY,CAAC,CAAC,EACb,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACvB,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;CACpC,CAAC;AAyEF,wBAAsB,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAikCrF"}
+{"version":3,"file":"govern.d.ts","sourceRoot":"","sources":["../src/govern.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,KAAK,WAAW,EAAqB,MAAM,kBAAkB,CAAC;AAgCvE,OAAO,KAAK,EACX,gBAAgB,EAChB,YAAY,EACZ,oBAAoB,EAKpB,MAAM,mBAAmB,CAAC;AAK3B,MAAM,WAAW,SAAS;IACzB,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC;IAC7C;;;;OAIG;IACH,OAAO,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC7B;;;OAGG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC3B,YAAY,CAAC,MAAM,EAAE;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpC;;;OAGG;IACH,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,gEAAgE;IAChE,cAAc,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,IAAI,CAAC;CACjB;AAED,sEAAsE;AACtE,MAAM,MAAM,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG;IAClC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,YAAY,CAAC,CAAC,EACb,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACvB,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;CACpC,CAAC;AA6KF,wBAAsB,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CA2xCrF"}