usertrust 1.4.0 → 2.0.0

package/dist/detect.js

@@ -3,14 +3,25 @@
 /**
  * Detect which LLM SDK a client belongs to by inspecting its shape.
  *
- * Governance boundary: only the following methods are intercepted and governed:
- * - Anthropic: `client.messages.create()`
- * - OpenAI: `client.chat.completions.create()`
+ * Governance boundary: the following methods are intercepted and governed:
+ * - Anthropic: `client.messages.create()`, `client.messages.stream()`,
+ *   `client.messages.parse()`, `client.beta.messages.create()`,
+ *   `client.beta.messages.stream()`, `client.beta.messages.parse()`
+ * - OpenAI: `client.chat.completions.create()`, and `client.responses.create()`
+ *   when present (feature-detected — the Responses API postdates the peer-range
+ *   floor, so older clients simply lack it and it stays a pass-through). A streaming
+ *   `responses.create({ stream: true })` is governed; the `responses.stream()`
+ *   helper is NOT.
  * - Google: `client.models.generateContent()`
  *
- * Alternative methods (e.g., `client.messages.stream`, `client.beta.*`, streaming APIs)
- * are NOT intercepted and will bypass governance, audit, and budget enforcement.
- * This is a known limitation of duck-typed proxy interception.
+ * Remaining ungoverned pass-throughs: `client.messages.batches`,
+ * `client.beta.messages.batches`, `client.beta.models`, `client.beta.files`, the
+ * OpenAI Responses non-create methods (`client.responses.retrieve/cancel/delete`,
+ * plus the `client.responses.stream()` and `client.responses.parse()` helpers,
+ * which drive the SDK's raw client and bypass the governed `create`), the OpenAI
+ * `client.beta.*` namespace (assistants/threads/realtime), and the legacy
+ * `client.completions.create`. These bypass governance, audit, and budget
+ * enforcement (they do not mirror the `create` request/response shape).
  *
  * @throws {Error} if the client does not match any known SDK shape
  */
@@ -47,4 +58,128 @@ export function detectClientKind(client) {
     }
     throw new Error("Unsupported LLM client: could not detect Anthropic, OpenAI, or Google SDK");
 }
+// ── Endpoint classification (M2 local-model governance) ──
+// Compared against normalizeHostname(url.hostname) — the WHATWG-serialized,
+// bracket-stripped form. `::ffff:7f00:1` is how Node's URL serializes the
+// IPv4-mapped IPv6 loopback `::ffff:127.0.0.1` (the last 32 bits render as hex,
+// never dotted-quad), so the map entry MUST be the serialized form to match.
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "::1", "::ffff:7f00:1"]);
+/** Best-effort runtime hint by conventional default port (metadata only). */
+const RUNTIME_BY_PORT = {
+    "11434": "ollama",
+    "1234": "lmstudio",
+    "8000": "vllm",
+};
+const CLOUD_DEFAULT = { class: "cloud", runtime: "unknown" };
+function parseUrl(value) {
+    try {
+        return new URL(value);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Normalize a URL hostname for comparison: lowercase, IPv6 brackets stripped
+ * (Node's WHATWG URL keeps brackets in `hostname` for IPv6 literals).
+ */
+function normalizeHostname(hostname) {
+    const lower = hostname.toLowerCase();
+    if (lower.startsWith("[") && lower.endsWith("]"))
+        return lower.slice(1, -1);
+    return lower;
+}
+/**
+ * Match a parsed baseURL against one config.endpoints[].match entry (A1).
+ * Exactly three entry forms — never raw string prefixing:
+ * (i)   scheme entry ("http://gpu-box:8000") → parsed; match iff origins are equal
+ *       (path/query/trailing slash ignored; kills "http://gpu-box:8000.evil.com"
+ *       and "http://gpu-box:8000@evil.com" bypass shapes);
+ * (ii)  leading-star entry ("*.gpu.internal") → hostname SUFFIX match: matches
+ *       "a.gpu.internal" and "x.y.gpu.internal", NOT "gpu.internal" itself;
+ * (iii) bare hostname → case-insensitive hostname equality (any port).
+ * Unparseable scheme entries never match (and never throw).
+ */
+function matchesEndpointEntry(entry, url) {
+    if (/^https?:\/\//i.test(entry)) {
+        const entryUrl = parseUrl(entry);
+        return entryUrl !== null && entryUrl.origin === url.origin;
+    }
+    const host = normalizeHostname(url.hostname);
+    if (entry.startsWith("*.")) {
+        const suffix = entry.slice(1).toLowerCase(); // ".gpu.internal"
+        return host.endsWith(suffix);
+    }
+    return host === entry.toLowerCase();
+}
+/** Read a string `baseURL` property off an SDK client instance, if present. */
+function readBaseURL(client) {
+    if (client != null && typeof client === "object" && "baseURL" in client) {
+        const value = client.baseURL;
+        if (typeof value === "string")
+            return value;
+    }
+    return undefined;
+}
+/**
+ * Classify the endpoint a client points at — local (self-hosted) or cloud —
+ * selecting the settlement regime for every governed call. Runs BESIDE
+ * `detectClientKind` (which stays the transport detector); the endpoint class,
+ * not the model string, picks local vs cloud metering, so model-name spoofing
+ * (`ollama cp llama3.2 gpt-4o`) cannot change the regime.
+ *
+ * Classification order:
+ * 1. `override.class` provided → override wins (runtime defaults to "unknown").
+ * 2. `client.baseURL` read when it is a string; absent or malformed (URL parse
+ *    failure) → treated as absent → cloud default. Never throws.
+ * 3. `config.endpoints[]` first match (origin / leading-star hostname suffix /
+ *    bare hostname — see matchesEndpointEntry).
+ * 4. Loopback autodetect (config.local.autoDetectLoopback): hostname
+ *    localhost | 127.0.0.1 | ::1 | ::ffff:127.0.0.1 (case-insensitive, IPv6
+ *    brackets stripped, IPv4-mapped form matched by its WHATWG serialization) →
+ *    local, runtime hinted by port (11434 ollama, 1234 lmstudio, 8000 vllm,
+ *    else "openai-compat").
+ * 5. Default `{ class: "cloud", runtime: "unknown" }` — fail-EXPENSIVE:
+ *    over-charging at cloud rates is recoverable, under-charging a paid
+ *    endpoint is not.
+ *
+ * **Security posture (trusted-operator boundary):** endpoint classification —
+ * config matchers, overrides, and loopback autodetect — is a TRUSTED-OPERATOR
+ * decision. Never wire it to end-user or request input. In server/multi-tenant
+ * deployments set `local.autoDetectLoopback: false` and classify via explicit
+ * `endpoints[]` config: loopback inside a container can be a forwarding sidecar
+ * to a paid API. This is the same trust boundary as `budget`/`customRates` —
+ * the config author already controls billing entirely. Note that a compromised
+ * local server can under-report usage; receipts expose `usageSource` and
+ * `meter.rateSource` precisely so that this is auditable.
+ */
+export function classifyEndpoint(client, config, override) {
+    const baseURL = readBaseURL(client);
+    // (1) Explicit override wins over everything.
+    if (override?.class !== undefined) {
+        const info = { class: override.class, runtime: override.runtime ?? "unknown" };
+        const overrideBase = override.baseURL ?? baseURL;
+        if (overrideBase !== undefined)
+            info.baseURL = overrideBase;
+        return info;
+    }
+    // (2) No readable baseURL → cloud default. Malformed → treat as absent, never throw.
+    if (baseURL === undefined)
+        return { ...CLOUD_DEFAULT };
+    const url = parseUrl(baseURL);
+    if (url === null)
+        return { ...CLOUD_DEFAULT };
+    // (3) config.endpoints[] — first match wins.
+    for (const entry of config.endpoints) {
+        if (matchesEndpointEntry(entry.match, url)) {
+            return { class: entry.class, runtime: entry.runtime, baseURL };
+        }
+    }
+    // (4) Loopback autodetect.
+    if (config.local.autoDetectLoopback && LOOPBACK_HOSTS.has(normalizeHostname(url.hostname))) {
+        return { class: "local", runtime: RUNTIME_BY_PORT[url.port] ?? "openai-compat", baseURL };
+    }
+    // (5) Cloud default.
+    return { class: "cloud", runtime: "unknown", baseURL };
+}
 //# sourceMappingURL=detect.js.map

package/dist/detect.js.map

@@ -1 +1 @@
-{"version":3,"file":"detect.js","sourceRoot":"","sources":["../src/detect.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAuBjC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAe;IAC/C,IACC,MAAM,IAAI,IAAI;QACd,OAAO,MAAM,KAAK,QAAQ;QAC1B,UAAU,IAAI,MAAM;QACpB,MAAM,CAAC,QAAQ,IAAI,IAAI;QACvB,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QACnC,QAAQ,IAAI,MAAM,CAAC,QAAQ;QAC3B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,UAAU,EAC3C,CAAC;QACF,OAAO,WAAW,CAAC;IACpB,CAAC;IAED,IACC,MAAM,IAAI,IAAI;QACd,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,IAAI,MAAM;QAChB,MAAM,CAAC,IAAI,IAAI,IAAI;QACnB,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAC/B,aAAa,IAAI,MAAM,CAAC,IAAI;QAC5B,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI;QAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,QAAQ;QAC3C,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW;QACnC,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,UAAU,EACnD,CAAC;QACF,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,IACC,MAAM,IAAI,IAAI;QACd,OAAO,MAAM,KAAK,QAAQ;QAC1B,QAAQ,IAAI,MAAM;QAClB,MAAM,CAAC,MAAM,IAAI,IAAI;QACrB,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QACjC,iBAAiB,IAAI,MAAM,CAAC,MAAM;QAClC,OAAO,MAAM,CAAC,MAAM,CAAC,eAAe,KAAK,UAAU,EAClD,CAAC;QACF,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;AAC9F,CAAC"}
+{"version":3,"file":"detect.js","sourceRoot":"","sources":["../src/detect.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAkCjC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAe;IAC/C,IACC,MAAM,IAAI,IAAI;QACd,OAAO,MAAM,KAAK,QAAQ;QAC1B,UAAU,IAAI,MAAM;QACpB,MAAM,CAAC,QAAQ,IAAI,IAAI;QACvB,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QACnC,QAAQ,IAAI,MAAM,CAAC,QAAQ;QAC3B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,UAAU,EAC3C,CAAC;QACF,OAAO,WAAW,CAAC;IACpB,CAAC;IAED,IACC,MAAM,IAAI,IAAI;QACd,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,IAAI,MAAM;QAChB,MAAM,CAAC,IAAI,IAAI,IAAI;QACnB,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAC/B,aAAa,IAAI,MAAM,CAAC,IAAI;QAC5B,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI;QAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,QAAQ;QAC3C,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW;QACnC,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,UAAU,EACnD,CAAC;QACF,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,IACC,MAAM,IAAI,IAAI;QACd,OAAO,MAAM,KAAK,QAAQ;QAC1B,QAAQ,IAAI,MAAM;QAClB,MAAM,CAAC,MAAM,IAAI,IAAI;QACrB,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QACjC,iBAAiB,IAAI,MAAM,CAAC,MAAM;QAClC,OAAO,MAAM,CAAC,MAAM,CAAC,eAAe,KAAK,UAAU,EAClD,CAAC;QACF,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;AAC9F,CAAC;AAED,4DAA4D;AAE5D,4EAA4E;AAC5E,0EAA0E;AAC1E,gFAAgF;AAChF,6EAA6E;AAC7E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC;AAEnF,6EAA6E;AAC7E,MAAM,eAAe,GAAiC;IACrD,OAAO,EAAE,QAAQ;IACjB,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,MAAM;CACd,CAAC;AAEF,MAAM,aAAa,GAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAE3E,SAAS,QAAQ,CAAC,KAAa;IAC9B,IAAI,CAAC;QACJ,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,QAAgB;IAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5E,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,oBAAoB,CAAC,KAAa,EAAE,GAAQ;IACpD,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC;IAC5D,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,kBAAkB;QAC/D,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;AACrC,CAAC;AAED,+EAA+E;AAC/E,SAAS,WAAW,CAAC,MAAe;IACnC,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;QACzE,MAAM,KAAK,GAAI,MAAgC,CAAC,OAAO,CAAC;QACxD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;IAC7C,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,gBAAgB,CAC/B,MAAe,EACf,MAAmB,EACnB,QAAgC;IAEhC,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAEpC,8CAA8C;IAC9C,IAAI,QAAQ,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,GAAiB,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC;QAC7F,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC;QACjD,IAAI,YAAY,KAAK,SAAS;YAAE,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC;QAC5D,OAAO,IAAI,CAAC;IACb,CAAC;IAED,qFAAqF;IACrF,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;IACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;IAE9C,6CAA6C;IAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;YAC5C,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;QAChE,CAAC;IACF,CAAC;IAED,2BAA2B;IAC3B,IAAI,MAAM,CAAC,KAAK,CAAC,kBAAkB,IAAI,cAAc,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC5F,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,eAAe,EAAE,OAAO,EAAE,CAAC;IAC3F,CAAC;IAED,qBAAqB;IACrB,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AACxD,CAAC"}

package/dist/export/markdown.d.ts

@@ -0,0 +1,12 @@
+export interface ExportResult {
+    written: number;
+    outDir: string;
+    /** Parsed-chain walk verdict (hash linkage over readable events). */
+    chainValid: boolean;
+    breakIndex: number | null;
+    /** Full vault verification (segments, malformed lines, .meta anchor). */
+    vaultValid: boolean;
+    vaultErrors: string[];
+}
+export declare function exportMarkdown(vaultPath: string, outDir: string): ExportResult;
+//# sourceMappingURL=markdown.d.ts.map

package/dist/export/markdown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../src/export/markdown.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,YAAY;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,yEAAyE;IACzE,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;CACtB;AAkGD,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,YAAY,CAiD9E"}

package/dist/export/markdown.js

@@ -0,0 +1,142 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 Usertools, Inc.
+/**
+ * Markdown / Obsidian exporter.
+ *
+ * Writes one frontmatter-rich note per ledger event, a Bases view
+ * (`Receipts.base`), and a `Ledger Index.md` summary. Notes wikilink their
+ * previous event so the hash chain renders as a literal chain in graph view.
+ * Read-only against the vault; writes only into `outDir`.
+ */
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { deriveChainIntegrity, readLedgerEvents } from "../audit/read.js";
+import { verifyVault } from "../audit/verify.js";
+const UT_TO_USD = 0.0001;
+/** Mirrors packages/verify/src/receipt.ts detectProvider (verify stays zero-dep). */
+function detectProvider(model) {
+    if (model.startsWith("claude"))
+        return "anthropic";
+    if (model.startsWith("gpt") || model.startsWith("o1") || model.startsWith("o3"))
+        return "openai";
+    if (model.startsWith("gemini"))
+        return "google";
+    if (model.startsWith("command"))
+        return "cohere";
+    if (model.startsWith("mistral") || model.startsWith("mixtral"))
+        return "mistral";
+    return "unknown";
+}
+// ANCHOR-INTEGRATION: swap for real anchor verification when feat/external-anchoring lands.
+function anchorState(vaultPath) {
+    return existsSync(join(vaultPath, "audit", "anchors", "anchors.jsonl"))
+        ? "present"
+        : "unanchored";
+}
+/**
+ * Event ids come from the ledger on disk — never trust them as path
+ * components. Used for both the `.md` filename and the wikilink target so
+ * links keep resolving after sanitization.
+ */
+function sanitizeId(id) {
+    return id.replace(/[^A-Za-z0-9._-]/g, "_");
+}
+function yamlString(value) {
+    return /^[A-Za-z0-9._:-]+$/.test(value) ? value : JSON.stringify(value);
+}
+function integrityFor(index, breakIndex) {
+    return breakIndex !== null && index >= breakIndex ? "after-break" : "verified";
+}
+function noteFor(e, index, prev, breakIndex, anchor) {
+    const model = typeof e.data.model === "string" ? e.data.model : undefined;
+    const cost = typeof e.data.cost === "number" ? e.data.cost : undefined;
+    const fm = ["---"];
+    fm.push(`ts: ${yamlString(e.timestamp)}`);
+    fm.push(`kind: ${yamlString(e.kind)}`);
+    fm.push(`actor: ${yamlString(e.actor)}`);
+    if (model) {
+        fm.push(`model: ${yamlString(model)}`);
+        fm.push(`provider: ${detectProvider(model)}`);
+    }
+    if (cost !== undefined) {
+        fm.push(`cost_ut: ${cost}`);
+        fm.push(`cost_usd: ${cost * UT_TO_USD}`);
+    }
+    if (typeof e.data.settled === "boolean")
+        fm.push(`settled: ${e.data.settled}`);
+    if (typeof e.data.transferId === "string")
+        fm.push(`transfer_id: ${yamlString(e.data.transferId)}`);
+    if (typeof e.sequence === "number")
+        fm.push(`seq: ${e.sequence}`);
+    fm.push(`hash: ${yamlString(e.hash)}`);
+    fm.push(`previous_hash: ${yamlString(e.previousHash)}`);
+    fm.push(`integrity: ${integrityFor(index, breakIndex)}`);
+    fm.push(`anchor_state: ${anchor}`);
+    fm.push("---");
+    const body = [""];
+    body.push(`# ${e.kind} — ${e.timestamp}`);
+    body.push("");
+    body.push("```");
+    body.push(JSON.stringify(e.data, null, 2));
+    body.push("```");
+    body.push("");
+    body.push(prev ? `Previous: [[${sanitizeId(prev.id)}]]` : "Previous: _genesis_");
+    body.push("");
+    return fm.join("\n") + body.join("\n");
+}
+const BASE_VIEW = `views:
+  - type: table
+    name: Receipts
+    order:
+      - ts
+      - kind
+      - actor
+      - model
+      - cost_ut
+      - settled
+      - integrity
+      - transfer_id
+    sort:
+      - property: ts
+        direction: DESC
+`;
+export function exportMarkdown(vaultPath, outDir) {
+    const events = readLedgerEvents(vaultPath);
+    const integrity = deriveChainIntegrity(events);
+    // Parsed-chain walk alone misses vault-level failures (torn trailing line,
+    // tail truncation vs the .meta anchor, sequence gaps) — run the full vault
+    // verification too so an export from a tampered vault says so.
+    const vault = verifyVault(vaultPath);
+    const anchor = anchorState(vaultPath);
+    mkdirSync(join(outDir, "receipts"), { recursive: true });
+    let written = 0;
+    for (let i = 0; i < events.length; i++) {
+        const e = events[i];
+        const day = sanitizeId(e.timestamp.slice(0, 10)) || "unknown-date";
+        const dir = join(outDir, "receipts", day);
+        mkdirSync(dir, { recursive: true });
+        writeFileSync(join(dir, `${sanitizeId(e.id)}.md`), noteFor(e, i, i > 0 ? events[i - 1] : undefined, integrity.breakIndex, anchor), "utf-8");
+        written++;
+    }
+    writeFileSync(join(outDir, "Receipts.base"), BASE_VIEW, "utf-8");
+    const index = ["# Ledger Index", ""];
+    index.push(`- Events exported: ${written}`);
+    index.push(`- Chain integrity: ${integrity.valid ? "verified" : `BROKEN at seq ${(events[integrity.breakIndex ?? 0]?.sequence ?? integrity.breakIndex ?? 0).toString()}`}`);
+    index.push(`- Vault verification: ${vault.valid ? "passed" : `FAILED — ${vault.errors[0] ?? "unknown error"}`}`);
+    index.push(`- Anchor state: ${anchor}`);
+    index.push(`- Vault: ${vaultPath}`);
+    const newest = events.at(-1);
+    if (newest)
+        index.push(`- Newest receipt: [[${sanitizeId(newest.id)}]]`);
+    index.push("");
+    writeFileSync(join(outDir, "Ledger Index.md"), index.join("\n"), "utf-8");
+    return {
+        written,
+        outDir,
+        chainValid: integrity.valid,
+        breakIndex: integrity.breakIndex,
+        vaultValid: vault.valid,
+        vaultErrors: vault.errors,
+    };
+}
+//# sourceMappingURL=markdown.js.map

package/dist/export/markdown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown.js","sourceRoot":"","sources":["../../src/export/markdown.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAA4B,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpG,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAajD,MAAM,SAAS,GAAG,MAAM,CAAC;AAEzB,qFAAqF;AACrF,SAAS,cAAc,CAAC,KAAa;IACpC,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,WAAW,CAAC;IACnD,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IACjG,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChD,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,QAAQ,CAAC;IACjD,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACjF,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,4FAA4F;AAC5F,SAAS,WAAW,CAAC,SAAiB;IACrC,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QACtE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,YAAY,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,EAAU;IAC7B,OAAO,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAChC,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,UAAyB;IAC7D,OAAO,UAAU,KAAK,IAAI,IAAI,KAAK,IAAI,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC;AAChF,CAAC;AAED,SAAS,OAAO,CACf,CAAsB,EACtB,KAAa,EACb,IAAqC,EACrC,UAAyB,EACzB,MAAgC;IAEhC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,EAAE,GAAa,CAAC,KAAK,CAAC,CAAC;IAC7B,EAAE,CAAC,IAAI,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC1C,EAAE,CAAC,IAAI,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvC,EAAE,CAAC,IAAI,CAAC,UAAU,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzC,IAAI,KAAK,EAAE,CAAC;QACX,EAAE,CAAC,IAAI,CAAC,UAAU,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvC,EAAE,CAAC,IAAI,CAAC,aAAa,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,EAAE,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QAC5B,EAAE,CAAC,IAAI,CAAC,aAAa,IAAI,GAAG,SAAS,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS;QAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ;QACxC,EAAE,CAAC,IAAI,CAAC,gBAAgB,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClE,EAAE,CAAC,IAAI,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvC,EAAE,CAAC,IAAI,CAAC,kBAAkB,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACxD,EAAE,CAAC,IAAI,CAAC,cAAc,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;IACzD,EAAE,CAAC,IAAI,CAAC,iBAAiB,MAAM,EAAE,CAAC,CAAC;IACnC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAEf,MAAM,IAAI,GAAa,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACd,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACd,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;IACjF,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACd,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;CAejB,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,MAAc;IAC/D,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC/C,2EAA2E;IAC3E,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAEtC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAwB,CAAC;QAC3C,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,cAAc,CAAC;QACnE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;QAC1C,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,aAAa,CACZ,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EACnC,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC,EAC9E,OAAO,CACP,CAAC;QACF,OAAO,EAAE,CAAC;IACX,CAAC;IAED,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAEjE,MAAM,KAAK,GAAa,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;IAC5C,KAAK,CAAC,IAAI,CACT,sBAAsB,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,EAAE,QAAQ,IAAI,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE,CAC/J,CAAC;IACF,KAAK,CAAC,IAAI,CACT,yBAAyB,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,EAAE,CACpG,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;IACxC,KAAK,CAAC,IAAI,CAAC,YAAY,SAAS,EAAE,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,uBAAuB,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IACzE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IAE1E,OAAO;QACN,OAAO;QACP,MAAM;QACN,UAAU,EAAE,SAAS,CAAC,KAAK;QAC3B,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,UAAU,EAAE,KAAK,CAAC,KAAK;QACvB,WAAW,EAAE,KAAK,CAAC,MAAM;KACzB,CAAC;AACH,CAAC"}

package/dist/govern.d.ts

@@ -1,5 +1,5 @@
 import { type AuditWriter } from "./audit/chain.js";
-import type { ActionDescriptor, GovernedActionResult } from "./shared/types.js";
+import type { ActionDescriptor, EndpointInfo, GovernedActionResult, LLMClientKind, TrustReceipt } from "./shared/types.js";
 export interface TrustOpts {
     /** Path to usertrust.config.json. Defaults to `.usertrust/usertrust.config.json`. */
     configPath?: string;
@@ -25,6 +25,13 @@ export interface TrustOpts {
     dryRun?: boolean;
     /** Vault directory override (default: cwd). */
     vaultBase?: string;
+    /**
+     * Explicit endpoint classification override (M2) — wins over config.endpoints
+     * matchers and loopback autodetect. TRUSTED-OPERATOR input, same trust
+     * boundary as budget/customRates: never derive it from end-user or request
+     * data (A10).
+     */
+    endpoint?: Partial<EndpointInfo> | undefined;
     /**
      * Inject a mock/test engine. When set, used instead of TigerBeetle.
      * Primarily for testing failure modes.
@@ -55,10 +62,67 @@ export interface TrustEngine {
     voidAllPending?(): Promise<void>;
     destroy?(): void;
 }
-/** The trusted client: original client shape + governance methods. */
-export type TrustedClient<T> = T & {
+/** `stream` becomes `(...args) => Promise<MessageStream & { receipt: Promise<TrustReceipt> }>`. */
+type GovernedStreamMethod<F> = F extends (...args: infer A) => infer R ? (...args: A) => Promise<Awaited<R> & {
+    receipt: Promise<TrustReceipt>;
+}> : F;
+/** `parse` becomes `(...args) => Promise<ParsedMessage & { receipt: TrustReceipt }>`. */
+type GovernedParseMethod<F> = F extends (...args: infer A) => infer R ? (...args: A) => Promise<Awaited<R> & {
+    receipt: TrustReceipt;
+}> : F;
+/** Rewrite `stream`/`parse` on a `messages` resource; leave `create`/everything else. */
+type GovernedMessages<M> = M extends object ? Omit<M, "stream" | "parse"> & ("stream" extends keyof M ? {
+    stream: GovernedStreamMethod<M["stream"]>;
+} : unknown) & ("parse" extends keyof M ? {
+    parse: GovernedParseMethod<M["parse"]>;
+} : unknown) : M;
+/** Rewrite `beta.messages` when present; otherwise leave `beta` untouched. */
+type GovernedBeta<B> = B extends {
+    messages: infer BM;
+} ? Omit<B, "messages"> & {
+    messages: GovernedMessages<BM>;
+} : B;
+/**
+ * Rewrite only the Anthropic `messages` / `beta.messages` surfaces. A client
+ * without a `messages` resource (OpenAI, Google) is returned unchanged — its
+ * governed `create`/`responses` shapes are unaffected by this rewrite.
+ */
+type GovernedShape<T> = T extends {
+    messages: infer M;
+} ? Omit<T, "messages" | "beta"> & {
+    messages: GovernedMessages<M>;
+} & (T extends {
+    beta: infer B;
+} ? {
+    beta: GovernedBeta<B>;
+} : unknown) : T;
+/** The trusted client: governed client shape (F5) + governance methods. */
+export type TrustedClient<T> = GovernedShape<T> & {
     destroy(): Promise<void>;
     governAction<R>(action: ActionDescriptor, execute: () => Promise<R>): Promise<GovernedActionResult<R>>;
 };
 export declare function trust<T>(client: T, opts?: TrustOpts): Promise<TrustedClient<T>>;
+/**
+ * Normalize the prompt-bearing payload across providers so PII/injection scanning
+ * and token estimation cover ALL shapes, not just Anthropic/OpenAI `messages`:
+ *   - Anthropic/OpenAI: `params.messages` (+ Anthropic top-level `system` string)
+ *   - Google:           `params.contents` (the prompt lives here, not `messages`)
+ *
+ * Without this, a Google `generateContent({ model, contents })` call has an empty
+ * `messages` array, so every PII/injection scan sees nothing and PII egresses.
+ */
+/**
+ * Normalize the prompt-bearing payload across providers into a flat parts array
+ * that PII/injection scanning, token estimation, redaction, and pattern hashing
+ * all consume. Exported for the A8 byte-exact regression test (kept internal to
+ * the package — not re-exported from index.ts).
+ *
+ * Branch order is load-bearing (A8): the OpenAI Responses branch is shape-
+ * discriminated (`kind === "openai"` AND no `messages` key) and placed so it can
+ * NEVER preempt the chat.completions / Anthropic `messages` branch — every
+ * chat.completions or Anthropic call carries `messages` and skips it, so existing
+ * extraction stays byte-unchanged.
+ */
+export declare function extractPromptParts(params: Record<string, unknown>, kind: LLMClientKind): unknown[];
+export {};
 //# sourceMappingURL=govern.d.ts.map

package/dist/govern.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"govern.d.ts","sourceRoot":"","sources":["../src/govern.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,KAAK,WAAW,EAAqB,MAAM,kBAAkB,CAAC;AA0BvE,OAAO,KAAK,EACX,gBAAgB,EAChB,oBAAoB,EAKpB,MAAM,mBAAmB,CAAC;AAK3B,MAAM,WAAW,SAAS;IACzB,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,OAAO,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC7B;;;OAGG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC3B,YAAY,CAAC,MAAM,EAAE;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpC;;;OAGG;IACH,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,gEAAgE;IAChE,cAAc,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,IAAI,CAAC;CACjB;AAED,sEAAsE;AACtE,MAAM,MAAM,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG;IAClC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,YAAY,CAAC,CAAC,EACb,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACvB,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;CACpC,CAAC;AAuFF,wBAAsB,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAorCrF"}
+{"version":3,"file":"govern.d.ts","sourceRoot":"","sources":["../src/govern.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,KAAK,WAAW,EAAqB,MAAM,kBAAkB,CAAC;AAgCvE,OAAO,KAAK,EACX,gBAAgB,EAChB,YAAY,EACZ,oBAAoB,EACpB,aAAa,EAGb,YAAY,EACZ,MAAM,mBAAmB,CAAC;AAM3B,MAAM,WAAW,SAAS;IACzB,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC;IAC7C;;;;OAIG;IACH,OAAO,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC7B;;;OAGG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC3B,YAAY,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9F;;;OAGG;IACH,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,gEAAgE;IAChE,cAAc,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,IAAI,CAAC;CACjB;AAWD,mGAAmG;AACnG,KAAK,oBAAoB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,GACnE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;CAAE,CAAC,GACxE,CAAC,CAAC;AAEL,yFAAyF;AACzF,KAAK,mBAAmB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,GAClE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC,GAC/D,CAAC,CAAC;AAEL,yFAAyF;AACzF,KAAK,gBAAgB,CAAC,CAAC,IAAI,CAAC,SAAS,MAAM,GACxC,IAAI,CAAC,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,GAC3B,CAAC,QAAQ,SAAS,MAAM,CAAC,GAAG;IAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,GACpF,CAAC,OAAO,SAAS,MAAM,CAAC,GAAG;IAAE,KAAK,EAAE,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,GAChF,CAAC,CAAC;AAEL,8EAA8E;AAC9E,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GACpD,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG;IAAE,QAAQ,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAA;CAAE,GACxD,CAAC,CAAC;AAEL;;;;GAIG;AACH,KAAK,aAAa,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;CAAE,GACpD,IAAI,CAAC,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC,GAAG;IAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAA;CAAE,GAAG,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC,CAAA;CAAE,GAC5F;IAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAA;CAAE,GACzB,OAAO,CAAC,GACX,CAAC,CAAC;AAEL,2EAA2E;AAC3E,MAAM,MAAM,aAAa,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG;IACjD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,YAAY,CAAC,CAAC,EACb,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACvB,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;CACpC,CAAC;AA6KF,wBAAsB,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAgoDrF;AAID;;;;;;;;GAQG;AACH;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,EAAE,aAAa,GACjB,OAAO,EAAE,CAiCX"}