usertrust 1.5.0 → 2.0.0

package/README.md

@@ -112,7 +112,8 @@ All commands support `--json` for machine-readable output.
 usertrust init          # Create .usertrust/ vault
 usertrust inspect       # Vault bank statement
 usertrust health        # Entropy diagnostics (6 signals, 0-100 score)
-usertrust verify        # Verify audit chain integrity
+usertrust verify        # Verify audit chain integrity (+ external anchors)
+usertrust anchor        # External anchoring: init|now|status|doctor|export|export-bundle|rotate|resume
 usertrust snapshot      # Checkpoint/restore vault state
 usertrust tb            # TigerBeetle process management
 usertrust completions   # Shell completions (bash, zsh, fish)
@@ -189,6 +190,8 @@ const config = defineConfig({
 
 **Merkle proofs (RFC 6962)** — Inclusion and consistency proofs for public verifiability. Any third party can verify a specific event existed in the chain.
 
+**External anchoring** — Ed25519-signed chain-head checkpoints pushed to an append-only store the vault operator cannot rewrite (S3 Object Lock, protected git branch, SIEM). Even a fully re-hashed, internally-consistent rewrite fails verification against the externally-held root. Ships a native SigV4 S3 sink (no AWS SDK), an experimental [Rekor](https://docs.sigstore.dev/logging/overview/) transparency-log witness that publishes digests only, `anchor doctor` to probe whether the writer identity can actually delete or overwrite in the store, and `anchor export-bundle` to hand an auditor the records and receipts in one file. See the [anchoring guide](https://github.com/usertools-ai/usertrust/blob/master/docs/anchoring.md).
+
 **Policy engine** — 12 field operators (`eq`, `gt`, `in`, `regex`, etc.) with soft/hard enforcement. Block specific models, cap costs, require approvals.
 
 **PII detection** — Luhn-validated credit card numbers, SSN patterns, email addresses, phone numbers, IPv4 addresses. Block or warn before data leaves your network.
@@ -255,6 +258,19 @@ All hashes: valid (847/847)
 
 The verify package has zero runtime dependencies. It reads JSONL, recomputes SHA-256 hashes, and checks the chain. Anyone can verify a vault without trusting the usertrust SDK.
 
+With [external anchoring](https://github.com/usertools-ai/usertrust/blob/master/docs/anchoring.md) enabled, verification goes further: the auditor fetches signed checkpoints from an append-only store the operator cannot rewrite and pins the public key out-of-band — so even a fully re-hashed rewrite of the vault fails:
+
+```bash
+usertrust anchor init                                     # once: mint identity, pin the key
+usertrust anchor now --sink-file /mnt/worm/anchors.jsonl  # from cron/CI, or in-process
+
+# or publish straight to S3, after checking the store really refuses deletes
+usertrust anchor doctor --sink-s3 bucket=audit-anchors,region=us-east-1
+usertrust anchor now    --sink-s3 bucket=audit-anchors,region=us-east-1
+
+npx usertrust-verify .usertrust --anchors anchors.jsonl --pubkey root.pem --require-external-anchor
+```
+
 ## License
 
 Apache 2.0

package/dist/anomaly/detector.js.map

@@ -1 +1 @@
-{"version":3,"file":"detector.js","sourceRoot":"","sources":["../../src/anomaly/detector.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAEN,4BAA4B,EAC5B,6BAA6B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAEN,yBAAyB,EACzB,0BAA0B,GAC1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAEN,qBAAqB,EACrB,sBAAsB,GACtB,MAAM,yBAAyB,CAAC;AAajC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,qDAAqD;AACrD,MAAM,UAAU,oBAAoB,CAAC,GAAmB;IACvD,OAAO;QACN,OAAO,EAAE,GAAG,EAAE,OAAO,IAAI,KAAK;QAC9B,SAAS,EAAE,sBAAsB,CAAC,GAAG,EAAE,SAAS,CAAC;QACjD,aAAa,EAAE,0BAA0B,CAAC,GAAG,EAAE,aAAa,CAAC;QAC7D,gBAAgB,EAAE,6BAA6B,CAAC,GAAG,EAAE,gBAAgB,CAAC;QACtE,UAAU,EAAE,GAAG,EAAE,UAAU,IAAI,mBAAmB;KAClD,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAErC,SAAS,qBAAqB,CAC7B,KAAa,EACb,WAAmB,EACnB,YAAoB,EACpB,KAAyB;IAEzB,IAAI,KAAK,EAAE,aAAa,KAAK,OAAO,EAAE,CAAC;QACtC,6EAA6E;QAC7E,0EAA0E;QAC1E,8EAA8E;QAC9E,6EAA6E;QAC7E,+EAA+E;QAC/E,OAAO,aAAa,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IACpF,CAAC;IACD,+EAA+E;IAC/E,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IAClE,OAAO,UAAU,GAAG,qBAAqB,CAAC;AAC3C,CAAC;AAED,0FAA0F;AAC1F,SAAS,gBAAgB,CAAC,CAIzB;IACA,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC;IACjE,OAAO,CAAC,CAAC,cAAc,KAAK,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC,cAAc,GAAG,CAAC;AAC3F,CAAC;AAED,uFAAuF;AACvF,SAAS,oBAAoB,CAAC,CAK7B;IACA,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC7B,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,cAAc,GAAG,CAAC;IACxF,CAAC;IACD,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC;AACzD,CAAC;AAeD,MAAM,UAAU,qBAAqB,CACpC,GAAmB,EACnB,OAAgC;IAEhC,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,SAAS,CAAC;IAC1C,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,IAAI,qBAAqB,CAAC;IAExE,MAAM,SAAS,GAAoB,qBAAqB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3E,MAAM,aAAa,GAAwB,yBAAyB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC3F,MAAM,gBAAgB,GAA2B,4BAA4B,CAC5E,MAAM,CAAC,gBAAgB,CACvB,CAAC;IAEF,MAAM,KAAK,GAAyB;QACnC,OAAO,EAAE,KAAK;QACd,SAAS,EAAE,IAAI;QACf,WAAW,EAAE,IAAI;KACjB,CAAC;IAEF,SAAS,gBAAgB;QACxB,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI;YAAE,OAAO;QACtD,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAClD,OAAO,EAAE,CAAC;QACX,CAAC;IACF,CAAC;IAED,SAAS,YAAY,CAAC,EAAqB;QAC1C,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC;QACzB,0EAA0E;QAC1E,sEAAsE;QACtE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,cAAc,CAC1B,EAAE,CAAC,KAAK,IAAI,KAAK,EACjB,EAAE,CAAC,qBAAqB,EACxB,EAAE,CAAC,sBAAsB,EACzB,EAAE,CACF,CAAC;QACF,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,IAAI,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED,SAAS,gBAAgB,CAAC,EAAyB;QAClD,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,SAAS,OAAO,CAAC,KAAmB;QACnC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QAC5B,gBAAgB,EAAE,CAAC;QACnB,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,YAAY,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACP,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACF,CAAC;IAED,SAAS,KAAK;QACb,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC/C,gBAAgB,EAAE,CAAC;QACnB,0EAA0E;QAC1E,4DAA4D;QAC5D,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;YAChD,OAAO,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAEhB,gGAAgG;QAChG,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;YAChB,OAAO,WAAW,CAAC,YAAY,EAAE,gBAAgB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;YAChB,OAAO,WAAW,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;YAChB,OAAO,WAAW,CACjB,mBAAmB,EACnB,oBAAoB,EAAE,CAAC,MAAM,OAAO,EAAE,CAAC,SAAS,gBAAgB,EAChE,EAAE,CAAC,MAAM,EACT,EAAE,CAAC,SAAS,CACZ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED,SAAS,cAAc,CAAC,IAAiB;QACxC,wEAAwE;QACxE,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,YAAY,CAAC,CAAC,CAAC;gBACnB,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC7B,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,IAAI;oBACJ,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;oBAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,SAAS,EAAE,CAAC,CAAC,SAAS;iBACtB,CAAC;YACH,CAAC;YACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;gBACvB,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACjC,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,IAAI;oBACJ,OAAO,EAAE,oBAAoB,CAAC,CAAC,CAAC;oBAChC,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,SAAS,EAAE,CAAC,CAAC,SAAS;iBACtB,CAAC;YACH,CAAC;YACD,KAAK,mBAAmB,CAAC,CAAC,CAAC;gBAC1B,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACpC,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,IAAI;oBACJ,OAAO,EAAE,oBAAoB,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,SAAS,gBAAgB;oBACvE,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,SAAS,EAAE,CAAC,CAAC,SAAS;iBACtB,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAED,SAAS,WAAW,CACnB,IAAiB,EACjB,OAAe,EACf,MAAc,EACd,SAAiB;QAEjB,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;QACrB,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACxB,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC5D,CAAC;IAED,SAAS,OAAO;QACf,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC;QACtB,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;QACvB,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;QACzB,SAAS,CAAC,KAAK,EAAE,CAAC;QAClB,aAAa,CAAC,KAAK,EAAE,CAAC;QACtB,gBAAgB,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED,SAAS,SAAS;QACjB,wEAAwE;QACxE,+DAA+D;QAC/D,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACtC,KAAK,EAAE,CAAC;QACT,CAAC;QACD,gBAAgB,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,OAAO;QACN,MAAM;QACN,KAAK;QACL,OAAO;QACP,KAAK;QACL,KAAK,EAAE,OAAO;QACd,SAAS;KACT,CAAC;AACH,CAAC"}
+{"version":3,"file":"detector.js","sourceRoot":"","sources":["../../src/anomaly/detector.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EACN,4BAA4B,EAE5B,6BAA6B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACN,yBAAyB,EACzB,0BAA0B,GAE1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACN,qBAAqB,EACrB,sBAAsB,GAEtB,MAAM,yBAAyB,CAAC;AAajC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,qDAAqD;AACrD,MAAM,UAAU,oBAAoB,CAAC,GAAmB;IACvD,OAAO;QACN,OAAO,EAAE,GAAG,EAAE,OAAO,IAAI,KAAK;QAC9B,SAAS,EAAE,sBAAsB,CAAC,GAAG,EAAE,SAAS,CAAC;QACjD,aAAa,EAAE,0BAA0B,CAAC,GAAG,EAAE,aAAa,CAAC;QAC7D,gBAAgB,EAAE,6BAA6B,CAAC,GAAG,EAAE,gBAAgB,CAAC;QACtE,UAAU,EAAE,GAAG,EAAE,UAAU,IAAI,mBAAmB;KAClD,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAErC,SAAS,qBAAqB,CAC7B,KAAa,EACb,WAAmB,EACnB,YAAoB,EACpB,KAAyB;IAEzB,IAAI,KAAK,EAAE,aAAa,KAAK,OAAO,EAAE,CAAC;QACtC,6EAA6E;QAC7E,0EAA0E;QAC1E,8EAA8E;QAC9E,6EAA6E;QAC7E,+EAA+E;QAC/E,OAAO,aAAa,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IACpF,CAAC;IACD,+EAA+E;IAC/E,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IAClE,OAAO,UAAU,GAAG,qBAAqB,CAAC;AAC3C,CAAC;AAED,0FAA0F;AAC1F,SAAS,gBAAgB,CAAC,CAIzB;IACA,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC;IACjE,OAAO,CAAC,CAAC,cAAc,KAAK,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC,cAAc,GAAG,CAAC;AAC3F,CAAC;AAED,uFAAuF;AACvF,SAAS,oBAAoB,CAAC,CAK7B;IACA,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC7B,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,cAAc,GAAG,CAAC;IACxF,CAAC;IACD,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC;AACzD,CAAC;AAeD,MAAM,UAAU,qBAAqB,CACpC,GAAmB,EACnB,OAAgC;IAEhC,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,SAAS,CAAC;IAC1C,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,IAAI,qBAAqB,CAAC;IAExE,MAAM,SAAS,GAAoB,qBAAqB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3E,MAAM,aAAa,GAAwB,yBAAyB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC3F,MAAM,gBAAgB,GAA2B,4BAA4B,CAC5E,MAAM,CAAC,gBAAgB,CACvB,CAAC;IAEF,MAAM,KAAK,GAAyB;QACnC,OAAO,EAAE,KAAK;QACd,SAAS,EAAE,IAAI;QACf,WAAW,EAAE,IAAI;KACjB,CAAC;IAEF,SAAS,gBAAgB;QACxB,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI;YAAE,OAAO;QACtD,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAClD,OAAO,EAAE,CAAC;QACX,CAAC;IACF,CAAC;IAED,SAAS,YAAY,CAAC,EAAqB;QAC1C,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC;QACzB,0EAA0E;QAC1E,sEAAsE;QACtE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,cAAc,CAC1B,EAAE,CAAC,KAAK,IAAI,KAAK,EACjB,EAAE,CAAC,qBAAqB,EACxB,EAAE,CAAC,sBAAsB,EACzB,EAAE,CACF,CAAC;QACF,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,IAAI,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED,SAAS,gBAAgB,CAAC,EAAyB;QAClD,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,SAAS,OAAO,CAAC,KAAmB;QACnC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QAC5B,gBAAgB,EAAE,CAAC;QACnB,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,YAAY,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACP,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACF,CAAC;IAED,SAAS,KAAK;QACb,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC/C,gBAAgB,EAAE,CAAC;QACnB,0EAA0E;QAC1E,4DAA4D;QAC5D,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;YAChD,OAAO,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAEhB,gGAAgG;QAChG,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;YAChB,OAAO,WAAW,CAAC,YAAY,EAAE,gBAAgB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;YAChB,OAAO,WAAW,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;YAChB,OAAO,WAAW,CACjB,mBAAmB,EACnB,oBAAoB,EAAE,CAAC,MAAM,OAAO,EAAE,CAAC,SAAS,gBAAgB,EAChE,EAAE,CAAC,MAAM,EACT,EAAE,CAAC,SAAS,CACZ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED,SAAS,cAAc,CAAC,IAAiB;QACxC,wEAAwE;QACxE,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,YAAY,CAAC,CAAC,CAAC;gBACnB,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC7B,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,IAAI;oBACJ,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;oBAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,SAAS,EAAE,CAAC,CAAC,SAAS;iBACtB,CAAC;YACH,CAAC;YACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;gBACvB,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACjC,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,IAAI;oBACJ,OAAO,EAAE,oBAAoB,CAAC,CAAC,CAAC;oBAChC,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,SAAS,EAAE,CAAC,CAAC,SAAS;iBACtB,CAAC;YACH,CAAC;YACD,KAAK,mBAAmB,CAAC,CAAC,CAAC;gBAC1B,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACpC,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,IAAI;oBACJ,OAAO,EAAE,oBAAoB,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,SAAS,gBAAgB;oBACvE,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,SAAS,EAAE,CAAC,CAAC,SAAS;iBACtB,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAED,SAAS,WAAW,CACnB,IAAiB,EACjB,OAAe,EACf,MAAc,EACd,SAAiB;QAEjB,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;QACrB,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACxB,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC5D,CAAC;IAED,SAAS,OAAO;QACf,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC;QACtB,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;QACvB,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;QACzB,SAAS,CAAC,KAAK,EAAE,CAAC;QAClB,aAAa,CAAC,KAAK,EAAE,CAAC;QACtB,gBAAgB,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED,SAAS,SAAS;QACjB,wEAAwE;QACxE,+DAA+D;QAC/D,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACtC,KAAK,EAAE,CAAC;QACT,CAAC;QACD,gBAAgB,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,OAAO;QACN,MAAM;QACN,KAAK;QACL,OAAO;QACP,KAAK;QACL,KAAK,EAAE,OAAO;QACd,SAAS;KACT,CAAC;AACH,CAAC"}

package/dist/anomaly/index.d.ts

@@ -1,8 +1,8 @@
 /**
  * anomaly/index.ts — Public exports for streaming anomaly governance.
  */
-export { createAnomalyDetector, resolveAnomalyConfig } from "./detector.js";
+export { AnomalyError } from "../shared/errors.js";
 export type { AnomalyDetector } from "./detector.js";
+export { createAnomalyDetector, resolveAnomalyConfig } from "./detector.js";
 export type { AnomalyChunkEvent, AnomalyConfig, AnomalyDetectorOptions, AnomalyDetectorState, AnomalyEvent, AnomalyInjectionEvent, AnomalyKind, AnomalyVerdict, InjectionCascadeConfig, ResolvedAnomalyConfig, SpendVelocityConfig, TokenRateConfig, } from "./types.js";
-export { AnomalyError } from "../shared/errors.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/anomaly/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/anomaly/index.ts"],"names":[],"mappings":"AAGA;;GAEG;AAEH,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC5E,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,YAAY,EACX,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EACtB,oBAAoB,EACpB,YAAY,EACZ,qBAAqB,EACrB,WAAW,EACX,cAAc,EACd,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/anomaly/index.ts"],"names":[],"mappings":"AAGA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC5E,YAAY,EACX,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EACtB,oBAAoB,EACpB,YAAY,EACZ,qBAAqB,EACrB,WAAW,EACX,cAAc,EACd,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,GACf,MAAM,YAAY,CAAC"}

package/dist/anomaly/index.js

@@ -3,6 +3,6 @@
 /**
  * anomaly/index.ts — Public exports for streaming anomaly governance.
  */
-export { createAnomalyDetector, resolveAnomalyConfig } from "./detector.js";
 export { AnomalyError } from "../shared/errors.js";
+export { createAnomalyDetector, resolveAnomalyConfig } from "./detector.js";
 //# sourceMappingURL=index.js.map

package/dist/anomaly/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/anomaly/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;GAEG;AAEH,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAgB5E,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/anomaly/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC"}

package/dist/audit/anchor-doctor.d.ts

@@ -0,0 +1,42 @@
+export interface DoctorCheck {
+    name: string;
+    status: "pass" | "fail" | "info";
+    detail: string;
+}
+export interface DoctorReport {
+    sink: string;
+    checks: DoctorCheck[];
+    failed: boolean;
+}
+/**
+ * Injectable HTTP transport — the probe's only impure edge, so tests script
+ * store responses instead of reaching the network. Response `headers` are
+ * optional because only the S3 versioning probe reads one.
+ */
+export type HttpTransport = (opts: {
+    method: string;
+    url: string;
+    headers: Record<string, string>;
+    body: Buffer;
+}) => Promise<{
+    status: number;
+    body: string;
+    headers?: Record<string, string>;
+}>;
+export interface S3ProbeConfig {
+    bucket: string;
+    region: string;
+    prefix?: string;
+    endpoint?: string;
+}
+/**
+ * Probe the directory holding a file sink. The probe object is created next to
+ * the store file (same directory, hence same permissions) and removed again.
+ */
+export declare function doctorFileSink(sinkPath: string): DoctorReport;
+/**
+ * Probe an S3-compatible store: write a probe object, then attempt the two
+ * operations an append-only store must refuse against that same key.
+ */
+export declare function doctorS3Sink(cfg: S3ProbeConfig, transport?: HttpTransport): Promise<DoctorReport>;
+//# sourceMappingURL=anchor-doctor.d.ts.map

package/dist/audit/anchor-doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anchor-doctor.d.ts","sourceRoot":"","sources":["../../src/audit/anchor-doctor.ts"],"names":[],"mappings":"AAkCA,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;CACb,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC,CAAC;AAElF,MAAM,WAAW,aAAa;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AA2CD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAmD7D;AA6BD;;;GAGG;AACH,wBAAsB,YAAY,CACjC,GAAG,EAAE,aAAa,EAClB,SAAS,GAAE,aAA8B,GACvC,OAAO,CAAC,YAAY,CAAC,CAsCvB"}

package/dist/audit/anchor-doctor.js

@@ -0,0 +1,285 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 Usertools, Inc.
+/**
+ * `anchor doctor` — append-only store PERMISSION PROBES.
+ *
+ * What this module establishes is narrow and worth stating precisely: it writes
+ * a throwaway probe object to the store and reports whether THIS identity, with
+ * the credentials in THIS environment, could delete or overwrite that object
+ * RIGHT NOW. It does not prove the store is append-only. A store can deny these
+ * operations today and allow them tomorrow, deny them for this identity and
+ * allow them for an admin one, or accept an overwrite as a new object version.
+ * Immutability comes from the store's own configuration (S3 Object Lock
+ * retention, POSIX directory permissions, an appliance's WORM mode) — the
+ * doctor only tells an operator whether their configuration is doing anything
+ * at all, which is the failure mode worth catching before an audit.
+ *
+ * The two probes are independent on purpose: on POSIX, deletion is governed by
+ * write permission on the DIRECTORY while in-place truncation is governed by
+ * permission on the FILE, so a store can deny one and allow the other.
+ *
+ * The S3 probe leaves its probe object behind whenever the store denies
+ * deletion — that is the store working as intended, not a leak, and the probe
+ * key is named in every check detail so it can be reconciled or lifecycled.
+ *
+ * Never in the output: credentials, the `authorization` header, or the session
+ * token — a diagnostic that gets pasted into an issue tracker must be safe to
+ * paste (plan delta D6).
+ */
+import { closeSync, openSync, unlinkSync, writeSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { sigV4Headers } from "./sigv4.js";
+const PROBE_BODY = Buffer.from(`${JSON.stringify({ probe: "usertrust-anchor-doctor", note: "safe to delete" })}\n`, "utf8");
+// ── Report helpers ──
+const pass = (name, detail) => ({ name, status: "pass", detail });
+const fail = (name, detail) => ({ name, status: "fail", detail });
+const info = (name, detail) => ({ name, status: "info", detail });
+function report(sink, checks) {
+    return { sink, checks, failed: checks.some((c) => c.status === "fail") };
+}
+/**
+ * Untrusted text (store error bodies, transport error messages) on its way into
+ * a check detail. Anything that could carry a signed header is dropped to the
+ * end of its line rather than partially masked — a diagnostic is worth less
+ * than a credential.
+ */
+function redact(text) {
+    const scrubbed = text
+        .replace(/authorization[^\n]*/gi, "[redacted]")
+        .replace(/x-amz-security-token[^\n]*/gi, "[redacted]")
+        .replace(/AWS4-HMAC-SHA256[^\n]*/g, "[redacted]")
+        .replace(/Credential=[^\s,]*/g, "[redacted]")
+        .replace(/Signature=[^\s,]*/g, "[redacted]")
+        .replace(/\s+/g, " ")
+        .trim();
+    return scrubbed.length > 120 ? `${scrubbed.slice(0, 120)}…` : scrubbed;
+}
+const messageOf = (err) => redact(err instanceof Error ? err.message : String(err));
+const errnoOf = (err) => typeof err.code === "string" ? err.code : "unknown";
+// ── File sink ──
+/**
+ * Probe the directory holding a file sink. The probe object is created next to
+ * the store file (same directory, hence same permissions) and removed again.
+ */
+export function doctorFileSink(sinkPath) {
+    const sink = `file:${sinkPath}`;
+    const dir = dirname(sinkPath);
+    // PID-scoped so concurrent doctors never probe each other's object; opened
+    // with "w" so a stale probe from a crashed run is reused, not fatal.
+    const probe = join(dir, `.doctor-probe-${process.pid}`);
+    const created = writeProbe(probe);
+    if (created !== null) {
+        return report(sink, [
+            info("probe", `cannot probe: this identity could not create a probe object in ${dir} (${created}) — ` +
+                "the store's delete and overwrite permissions were not exercised"),
+        ]);
+    }
+    const checks = [];
+    let deleted = false;
+    try {
+        unlinkSync(probe);
+        deleted = true;
+        checks.push(fail("delete-denied", `this identity could delete a probe object at ${probe} right now`));
+    }
+    catch (err) {
+        checks.push(pass("delete-denied", `this identity could not delete a probe object at ${probe} right now (${errnoOf(err)})`));
+    }
+    // The delete probe consumed the object when it succeeded; the overwrite
+    // probe needs one to truncate.
+    const recreated = deleted ? writeProbe(probe) : null;
+    if (recreated !== null) {
+        checks.push(info("overwrite-denied", `cannot probe overwrite: ${recreated}`));
+        return report(sink, checks);
+    }
+    checks.push(overwriteProbe(probe));
+    try {
+        unlinkSync(probe);
+    }
+    catch {
+        // Best effort: a store that refuses the delete is the passing case, and
+        // the probe object is named in the check detail either way.
+    }
+    return report(sink, checks);
+}
+/** Creates or truncates the probe object; returns an errno on failure, else null. */
+function writeProbe(probe) {
+    try {
+        const fd = openSync(probe, "w", 0o600);
+        try {
+            writeSync(fd, PROBE_BODY);
+        }
+        finally {
+            closeSync(fd);
+        }
+        return null;
+    }
+    catch (err) {
+        return errnoOf(err);
+    }
+}
+function overwriteProbe(probe) {
+    const errno = writeProbe(probe);
+    return errno === null
+        ? fail("overwrite-denied", `this identity could overwrite a probe object at ${probe} right now`)
+        : pass("overwrite-denied", `this identity could not overwrite a probe object at ${probe} right now (${errno})`);
+}
+// ── S3 sink ──
+/**
+ * Probe an S3-compatible store: write a probe object, then attempt the two
+ * operations an append-only store must refuse against that same key.
+ */
+export async function doctorS3Sink(cfg, transport = httpsTransport) {
+    const prefix = (cfg.prefix ?? "anchors").replace(/^\/+|\/+$/g, "");
+    const sink = `s3:${cfg.bucket}/${prefix}`;
+    const creds = credentialsFromEnv();
+    if (creds === null) {
+        return report(sink, [
+            info("probe", "cannot probe: AWS credentials not found in the environment " +
+                "(AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY)"),
+        ]);
+    }
+    const target = probeTarget(cfg, prefix);
+    const loc = `s3://${cfg.bucket}/${target.key}`;
+    const send = (method, payload) => s3Request(transport, target, cfg.region, method, payload, creds);
+    const put = await attempt(() => send("PUT", PROBE_BODY));
+    if (put.error !== null) {
+        return report(sink, [info("probe", `cannot probe: writing ${loc} failed — ${put.error}`)]);
+    }
+    if (!is2xx(put.status)) {
+        return report(sink, [
+            info("probe", `cannot probe: writing ${loc} returned HTTP ${put.status}${snippet(put.body)} — ` +
+                "the store's delete and overwrite permissions were not exercised"),
+        ]);
+    }
+    return report(sink, [
+        verdict("delete-denied", "delete", loc, await attempt(() => send("DELETE", Buffer.alloc(0)))),
+        verdict("overwrite-denied", "overwrite", loc, await attempt(() => send("PUT", PROBE_BODY))),
+    ]);
+}
+async function attempt(run) {
+    try {
+        const res = await run();
+        const headers = res.headers ?? {};
+        const versionId = Object.entries(headers).find(([k]) => k.toLowerCase() === "x-amz-version-id")?.[1] ?? null;
+        return { status: res.status, body: res.body, versionId, error: null };
+    }
+    catch (err) {
+        return { status: 0, body: "", versionId: null, error: messageOf(err) };
+    }
+}
+/**
+ * Turn one store response into a verdict. 403 is the shape a store takes when
+ * its policy refuses; a 2xx that carries `x-amz-version-id` is neither a
+ * refusal nor a true overwrite, so it reports as info rather than a verdict.
+ */
+function verdict(name, op, loc, res) {
+    if (res.error !== null) {
+        return info(name, `cannot probe ${op}: ${loc} — ${res.error}`);
+    }
+    if (res.status === 403) {
+        return pass(name, `this identity could not ${op} a probe object at ${loc} right now (HTTP 403)`);
+    }
+    if (!is2xx(res.status)) {
+        return info(name, `inconclusive: ${op} of ${loc} returned HTTP ${res.status}${snippet(res.body)}`);
+    }
+    if (op === "overwrite" && res.versionId !== null) {
+        return info(name, `this identity could write a new version of a probe object at ${loc} right now ` +
+            `(HTTP ${res.status}, x-amz-version-id) — a new version does not remove the previous ` +
+            "one; confirm Object Lock retention denies deletion of individual versions");
+    }
+    return fail(name, `this identity could ${op} a probe object at ${loc} right now (HTTP ${res.status})`);
+}
+const is2xx = (status) => status >= 200 && status < 300;
+const snippet = (body) => (body === "" ? "" : `: ${redact(body)}`);
+function credentialsFromEnv() {
+    const accessKeyId = process.env.AWS_ACCESS_KEY_ID;
+    const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY;
+    if (!accessKeyId || !secretAccessKey)
+        return null;
+    const sessionToken = process.env.AWS_SESSION_TOKEN;
+    return { accessKeyId, secretAccessKey, ...(sessionToken ? { sessionToken } : {}) };
+}
+/** Virtual-host addressing by default; path-style when an endpoint is configured. */
+function probeTarget(cfg, prefix) {
+    const key = `${prefix === "" ? "" : `${prefix}/`}doctor-probe/${process.pid}-${amzDate()}.json`;
+    const encoded = key.split("/").map(encodeURIComponent).join("/");
+    if (cfg.endpoint !== undefined) {
+        const base = parseEndpoint(cfg.endpoint);
+        const path = `/${encodeURIComponent(cfg.bucket)}/${encoded}`;
+        return { host: base.host, path, url: `${base.protocol}//${base.host}${path}`, key };
+    }
+    const host = `${cfg.bucket}.s3.${cfg.region}.amazonaws.com`;
+    return { host, path: `/${encoded}`, url: `https://${host}/${encoded}`, key };
+}
+/**
+ * Endpoint for an S3-compatible store, under the SAME rule as the sink
+ * (rekor.ts / s3-sink): plaintext is refused off-loopback. The doctor's probes
+ * are SigV4-signed like any other request, so an http endpoint on the network
+ * would put the credential-bearing headers on the wire — and a diagnostic
+ * command is exactly where an operator would paste an attacker-suggested URL.
+ * Loopback stays allowed for dev MinIO/LocalStack.
+ */
+function parseEndpoint(endpoint) {
+    let url;
+    try {
+        url = new URL(endpoint);
+    }
+    catch {
+        throw new Error(`s3 doctor: endpoint must include a scheme, got "${endpoint.slice(0, 60)}"`);
+    }
+    const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1";
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+        throw new Error(`s3 doctor: endpoint must be https (http is allowed only for localhost/127.0.0.1), got "${url.protocol}//${url.host}"`);
+    }
+    return url;
+}
+/** `YYYYMMDDTHHMMSSZ` — also the probe key's uniqueness across runs. */
+function amzDate() {
+    return `${new Date().toISOString().replace(/[-:]/g, "").slice(0, 15)}Z`;
+}
+function s3Request(transport, target, region, method, payload, creds) {
+    const extra = payload.length > 0 ? { "content-type": "application/json" } : {};
+    const signed = sigV4Headers({
+        method,
+        host: target.host,
+        path: target.path,
+        headers: extra,
+        payload,
+        region,
+        service: "s3",
+        amzDate: amzDate(),
+    }, creds);
+    // sigV4Headers signs caller headers but returns only its own — the caller
+    // must send both, or the signature covers headers that never arrive.
+    return transport({ method, url: target.url, headers: { ...extra, ...signed }, body: payload });
+}
+/** Default transport. `http://` endpoints (dev MinIO) require an injected one. */
+async function httpsTransport(opts) {
+    const { request } = await import("node:https");
+    return new Promise((resolve, reject) => {
+        const req = request(opts.url, {
+            method: opts.method,
+            headers: { ...opts.headers, "content-length": String(opts.body.length) },
+            timeout: 15_000,
+        }, (res) => {
+            const chunks = [];
+            res.on("data", (c) => chunks.push(c));
+            res.on("end", () => {
+                const headers = {};
+                for (const [name, value] of Object.entries(res.headers)) {
+                    if (typeof value === "string")
+                        headers[name] = value;
+                }
+                resolve({
+                    status: res.statusCode ?? 0,
+                    body: Buffer.concat(chunks).toString("utf8").slice(0, 4096),
+                    headers,
+                });
+            });
+        });
+        req.on("timeout", () => req.destroy(new Error("s3 doctor: request timeout")));
+        req.on("error", reject);
+        req.end(opts.body);
+    });
+}
+//# sourceMappingURL=anchor-doctor.js.map

package/dist/audit/anchor-doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anchor-doctor.js","sourceRoot":"","sources":["../../src/audit/anchor-doctor.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAyB,YAAY,EAAE,MAAM,YAAY,CAAC;AAiCjE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAC7B,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,IAAI,EACnF,MAAM,CACN,CAAC;AAEF,uBAAuB;AAEvB,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,MAAc,EAAe,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AAC/F,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,MAAc,EAAe,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AAC/F,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,MAAc,EAAe,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AAE/F,SAAS,MAAM,CAAC,IAAY,EAAE,MAAqB;IAClD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,SAAS,MAAM,CAAC,IAAY;IAC3B,MAAM,QAAQ,GAAG,IAAI;SACnB,OAAO,CAAC,uBAAuB,EAAE,YAAY,CAAC;SAC9C,OAAO,CAAC,8BAA8B,EAAE,YAAY,CAAC;SACrD,OAAO,CAAC,yBAAyB,EAAE,YAAY,CAAC;SAChD,OAAO,CAAC,qBAAqB,EAAE,YAAY,CAAC;SAC5C,OAAO,CAAC,oBAAoB,EAAE,YAAY,CAAC;SAC3C,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;IACT,OAAO,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;AACxE,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,GAAY,EAAU,EAAE,CAC1C,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,MAAM,OAAO,GAAG,CAAC,GAAY,EAAU,EAAE,CACxC,OAAQ,GAA0B,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAEnG,kBAAkB;AAElB;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC9C,MAAM,IAAI,GAAG,QAAQ,QAAQ,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,2EAA2E;IAC3E,qEAAqE;IACrE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,iBAAiB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAExD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,IAAI,EAAE;YACnB,IAAI,CACH,OAAO,EACP,kEAAkE,GAAG,KAAK,OAAO,MAAM;gBACtF,iEAAiE,CAClE;SACD,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACJ,UAAU,CAAC,KAAK,CAAC,CAAC;QAClB,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,CAAC,IAAI,CACV,IAAI,CAAC,eAAe,EAAE,gDAAgD,KAAK,YAAY,CAAC,CACxF,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CACV,IAAI,CACH,eAAe,EACf,oDAAoD,KAAK,eAAe,OAAO,CAAC,GAAG,CAAC,GAAG,CACvF,CACD,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,+BAA+B;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,2BAA2B,SAAS,EAAE,CAAC,CAAC,CAAC;QAC9E,OAAO,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC;QACJ,UAAU,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACR,wEAAwE;QACxE,4DAA4D;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED,qFAAqF;AACrF,SAAS,UAAU,CAAC,KAAa;IAChC,IAAI,CAAC;QACJ,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC;YACJ,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QAC3B,CAAC;gBAAS,CAAC;YACV,SAAS,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACF,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACpC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,OAAO,KAAK,KAAK,IAAI;QACpB,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,mDAAmD,KAAK,YAAY,CAAC;QAChG,CAAC,CAAC,IAAI,CACJ,kBAAkB,EAClB,uDAAuD,KAAK,eAAe,KAAK,GAAG,CACnF,CAAC;AACL,CAAC;AAED,gBAAgB;AAEhB;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,GAAkB,EAClB,YAA2B,cAAc;IAEzC,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC;IAE1C,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IACnC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,IAAI,EAAE;YACnB,IAAI,CACH,OAAO,EACP,6DAA6D;gBAC5D,6CAA6C,CAC9C;SACD,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,QAAQ,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,OAAe,EAAE,EAAE,CAChD,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAElE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;IACzD,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,yBAAyB,GAAG,aAAa,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,IAAI,EAAE;YACnB,IAAI,CACH,OAAO,EACP,yBAAyB,GAAG,kBAAkB,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK;gBAChF,iEAAiE,CAClE;SACD,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,EAAE;QACnB,OAAO,CAAC,eAAe,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,OAAO,CAAC,kBAAkB,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;KAC3F,CAAC,CAAC;AACJ,CAAC;AASD,KAAK,UAAU,OAAO,CACrB,GAAsF;IAEtF,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,GAAG,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAClC,MAAM,SAAS,GACd,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC5F,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;IACxE,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,SAAS,OAAO,CAAC,IAAY,EAAE,EAA0B,EAAE,GAAW,EAAE,GAAY;IACnF,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACxB,OAAO,IAAI,CACV,IAAI,EACJ,2BAA2B,EAAE,sBAAsB,GAAG,uBAAuB,CAC7E,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CACV,IAAI,EACJ,iBAAiB,EAAE,OAAO,GAAG,kBAAkB,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAC/E,CAAC;IACH,CAAC;IACD,IAAI,EAAE,KAAK,WAAW,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,IAAI,CACV,IAAI,EACJ,gEAAgE,GAAG,aAAa;YAC/E,SAAS,GAAG,CAAC,MAAM,mEAAmE;YACtF,2EAA2E,CAC5E,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CACV,IAAI,EACJ,uBAAuB,EAAE,sBAAsB,GAAG,oBAAoB,GAAG,CAAC,MAAM,GAAG,CACnF,CAAC;AACH,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,MAAc,EAAW,EAAE,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC;AAEzE,MAAM,OAAO,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAEnF,SAAS,kBAAkB;IAC1B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAClD,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAC1D,IAAI,CAAC,WAAW,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACnD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACpF,CAAC;AASD,qFAAqF;AACrF,SAAS,WAAW,CAAC,GAAkB,EAAE,MAAc;IACtD,MAAM,GAAG,GAAG,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,gBAAgB,OAAO,CAAC,GAAG,IAAI,OAAO,EAAE,OAAO,CAAC;IAChG,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEjE,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QAC7D,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC;IACrF,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,OAAO,GAAG,CAAC,MAAM,gBAAgB,CAAC;IAC5D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,EAAE,GAAG,EAAE,WAAW,IAAI,IAAI,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,QAAgB;IACtC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,mDAAmD,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC;IAC9E,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CACd,0FAA0F,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,GAAG,CACtH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,wEAAwE;AACxE,SAAS,OAAO;IACf,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;AACzE,CAAC;AAED,SAAS,SAAS,CACjB,SAAwB,EACxB,MAAmB,EACnB,MAAc,EACd,MAAc,EACd,OAAe,EACf,KAAuB;IAEvB,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,MAAM,MAAM,GAAG,YAAY,CAC1B;QACC,MAAM;QACN,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,KAAK;QACd,OAAO;QACP,MAAM;QACN,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,OAAO,EAAE;KAClB,EACD,KAAK,CACL,CAAC;IACF,0EAA0E;IAC1E,qEAAqE;IACrE,OAAO,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAChG,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,cAAc,CAAC,IAK7B;IACA,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;IAC/C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,GAAG,GAAG,OAAO,CAClB,IAAI,CAAC,GAAG,EACR;YACC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YACxE,OAAO,EAAE,MAAM;SACf,EACD,CAAC,GAAG,EAAE,EAAE;YACP,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBAClB,MAAM,OAAO,GAA2B,EAAE,CAAC;gBAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBACzD,IAAI,OAAO,KAAK,KAAK,QAAQ;wBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;gBACtD,CAAC;gBACD,OAAO,CAAC;oBACP,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;oBAC3B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;oBAC3D,OAAO;iBACP,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;QACJ,CAAC,CACD,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC;QAC9E,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;AACJ,CAAC"}