usertrust 1.5.0 → 2.0.0

package/dist/cli/verify.js

@@ -6,16 +6,295 @@
  * Calls verifyVault() on the local vault (anchored to the `.meta` head, spans
  * rotated segments) and displays the result. Sets a nonzero process exit code
  * on a FAILED verdict so CI gates fail on a tampered vault.
+ *
+ * External-anchor flags (spec §7.5) mirror the standalone usertrust-verify
+ * CLI: the caller fetches anchor artifacts and pins the public key
+ * out-of-band; trust is never read from the vault under audit.
  */
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import pc from "picocolors";
-import { verifyVault } from "../audit/verify.js";
+import { parseAnchorsContent } from "../audit/anchor-verify.js";
+import { exitCodeForAnchored, verifyVault, verifyVaultWithAnchors, } from "../audit/verify.js";
 import { VAULT_DIR } from "../shared/constants.js";
+function parseDurationMs(raw) {
+    const m = /^(\d+)(ms|s|m|h|d)?$/.exec(raw);
+    if (m === null) {
+        // Silently dropping the policy would quietly disable the staleness
+        // gate — the exact fail-open the unknown-flag rejection exists to stop.
+        throw new Error(`Invalid --max-anchor-age: ${raw} (use e.g. 500ms, 30s, 15m, 1h, 7d)`);
+    }
+    const n = Number.parseInt(m[1], 10);
+    const mult = { ms: 1, s: 1000, m: 60_000, h: 3_600_000, d: 86_400_000 }[m[2] ?? "ms"];
+    return n * mult;
+}
+const KNOWN_VERIFY_FLAGS = new Set([
+    // Global flags main.ts accepts for every subcommand — rejecting them here
+    // would break existing `usertrust verify --skip-verify`-style invocations.
+    "--json",
+    "--skip-verify",
+    "--reconfigure",
+    // Anchor flags.
+    "--anchor",
+    "--anchors",
+    "--anchor-url",
+    "--bundle",
+    "--rekor-receipts",
+    "--rekor-pubkey",
+    "--pubkey",
+    "--successor-pin",
+    "--require-anchor",
+    "--require-external-anchor",
+    "--max-anchor-age",
+    "--max-unanchored-events",
+    "--vault-id",
+]);
+const MAX_PEM_BYTES = 16 * 1024;
+const MAX_BUNDLE_ITEMS = 10_000;
+const BUNDLE_KEYS = new Set(["v", "records", "rekorReceipts"]);
+function readArtifact(pathOrDash) {
+    return pathOrDash === "-" ? readFileSync(0, "utf-8") : readFileSync(pathOrDash, "utf-8");
+}
+/**
+ * Read one pinned log key. A file that carries no usable PEM is a usage error,
+ * not an empty pin: the verifier discards unusable entries, so accepting one
+ * here would leave the caller believing they pinned a key while the receipt was
+ * checked against something else entirely.
+ */
+function readPinnedPem(path) {
+    const pem = readFileSync(path, "utf-8");
+    if (Buffer.byteLength(pem, "utf8") > MAX_PEM_BYTES) {
+        throw new Error(`--rekor-pubkey ${path}: PEM exceeds 16 KiB`);
+    }
+    if (pem.trim().length === 0 || !pem.includes("-----BEGIN PUBLIC KEY-----")) {
+        throw new Error(`--rekor-pubkey ${path}: not a PEM public key (-----BEGIN PUBLIC KEY----- missing)`);
+    }
+    return pem;
+}
+/**
+ * Strict parse of an auditor bundle: `{v:1, records, rekorReceipts?}`. A bundle
+ * is untrusted transport, so unknown top-level fields are rejected rather than
+ * ignored — a field the CLI silently drops is one an exporter can use to carry
+ * evidence the verifier never looks at. Element shapes are NOT validated here:
+ * records and receipts are re-serialized and go through the same strict parsers
+ * every other input does.
+ */
+function parseBundle(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error("--bundle: not valid JSON");
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error("--bundle: not an object");
+    }
+    const obj = parsed;
+    for (const key of Object.keys(obj)) {
+        if (!BUNDLE_KEYS.has(key))
+            throw new Error(`--bundle: unknown field "${key.slice(0, 80)}"`);
+    }
+    if (obj.v !== 1)
+        throw new Error("--bundle: unsupported version (expected 1)");
+    if (!Array.isArray(obj.records))
+        throw new Error("--bundle: records must be an array");
+    if (obj.records.length > MAX_BUNDLE_ITEMS) {
+        throw new Error(`--bundle: records exceeds the ${MAX_BUNDLE_ITEMS} cap`);
+    }
+    const receipts = obj.rekorReceipts ?? [];
+    if (!Array.isArray(receipts))
+        throw new Error("--bundle: rekorReceipts must be an array");
+    if (receipts.length > MAX_BUNDLE_ITEMS) {
+        throw new Error(`--bundle: rekorReceipts exceeds the ${MAX_BUNDLE_ITEMS} cap`);
+    }
+    return {
+        anchorsRaw: obj.records.map((record) => JSON.stringify(record)).join("\n"),
+        receiptsRaw: receipts.map((receipt) => JSON.stringify(receipt)),
+    };
+}
+function fetchAnchorUrl(url) {
+    return new Promise((resolve) => {
+        import("node:https")
+            .then((https) => {
+            const req = https.get(url, { timeout: 15_000 }, (res) => {
+                const code = res.statusCode ?? 0;
+                if (code < 200 || code >= 300) {
+                    res.resume();
+                    resolve({ ok: false, error: `HTTP ${code}` });
+                    return;
+                }
+                const chunks = [];
+                res.on("data", (c) => chunks.push(c));
+                res.on("end", () => resolve({ ok: true, body: Buffer.concat(chunks).toString("utf-8") }));
+            });
+            req.on("timeout", () => req.destroy(new Error("timeout")));
+            req.on("error", (err) => resolve({ ok: false, error: err.message }));
+        })
+            .catch((err) => resolve({ ok: false, error: err.message }));
+    });
+}
+async function parseAnchorFlags(argv) {
+    const anchorFiles = [];
+    const rekorReceiptFiles = [];
+    const rekorPubkeyFiles = [];
+    let bundleFile;
+    let anchorUrl;
+    let pubkeyFile;
+    const successorPinFiles = [];
+    let requireAnchor = false;
+    let requireExternalAnchor = false;
+    let maxAnchorAgeMs;
+    let maxUnanchoredEvents;
+    let vaultId;
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        const next = () => argv[++i];
+        if (arg === "--anchor" || arg === "--anchors") {
+            const v = next();
+            if (v !== undefined)
+                anchorFiles.push(v);
+        }
+        else if (arg === "--rekor-receipts") {
+            const v = next();
+            if (v !== undefined)
+                rekorReceiptFiles.push(v);
+        }
+        else if (arg === "--rekor-pubkey") {
+            const v = next();
+            if (v !== undefined)
+                rekorPubkeyFiles.push(v);
+        }
+        else if (arg === "--bundle")
+            bundleFile = next();
+        else if (arg === "--anchor-url")
+            anchorUrl = next();
+        else if (arg === "--pubkey")
+            pubkeyFile = next();
+        else if (arg === "--successor-pin") {
+            const v = next();
+            if (v !== undefined)
+                successorPinFiles.push(v);
+        }
+        else if (arg === "--require-anchor")
+            requireAnchor = true;
+        else if (arg === "--require-external-anchor")
+            requireExternalAnchor = true;
+        else if (arg === "--max-anchor-age") {
+            const v = next();
+            if (v === undefined)
+                throw new Error("--max-anchor-age requires a value");
+            maxAnchorAgeMs = parseDurationMs(v);
+        }
+        else if (arg === "--max-unanchored-events") {
+            const v = next();
+            maxUnanchoredEvents = Number.parseInt(v ?? "", 10);
+            // parseInt("1O0") === 1 (partial parse) and NaN comparisons are always
+            // false — either typo would silently weaken the staleness gate.
+            // Require the WHOLE value to be a non-negative integer.
+            if (!/^\d+$/.test(v ?? "") ||
+                !Number.isSafeInteger(maxUnanchoredEvents) ||
+                maxUnanchoredEvents < 0) {
+                throw new Error(`Invalid --max-unanchored-events: ${v} (non-negative integer required)`);
+            }
+        }
+        else if (arg === "--vault-id")
+            vaultId = next();
+        else if (arg.startsWith("--") && !KNOWN_VERIFY_FLAGS.has(arg)) {
+            // Reject unknown flags rather than silently ignoring them — a typoed
+            // --require-anchro must not quietly weaken a CI gate.
+            throw new Error(`Unknown flag: ${arg}`);
+        }
+    }
+    const externalAnchorsRaw = anchorFiles.map(readArtifact);
+    const rekorReceiptsRaw = rekorReceiptFiles.map(readArtifact);
+    const rekorLogPubkeysPem = rekorPubkeyFiles.map(readPinnedPem);
+    if (bundleFile !== undefined) {
+        const bundle = parseBundle(readArtifact(bundleFile));
+        externalAnchorsRaw.push(bundle.anchorsRaw);
+        rekorReceiptsRaw.push(...bundle.receiptsRaw);
+    }
+    let witness = { requested: false };
+    if (anchorUrl !== undefined) {
+        const fetched = await fetchAnchorUrl(anchorUrl);
+        // Empty/fully-unparseable body = witness unreachable (inconclusive).
+        // A body with ANY cleanly parsed records IS evidence — keep it whole;
+        // embedded parse errors fail closed downstream instead of discarding
+        // the rollback proof the valid records carry.
+        const parsed = fetched.ok && fetched.body !== undefined ? parseAnchorsContent(fetched.body) : null;
+        if (parsed !== null && parsed.records.length > 0) {
+            externalAnchorsRaw.push(fetched.body);
+            witness = { requested: true, ok: true };
+        }
+        else {
+            witness = {
+                requested: true,
+                ok: false,
+                error: fetched.ok
+                    ? "witness returned an empty or unparseable body"
+                    : (fetched.error ?? "fetch failed"),
+            };
+        }
+    }
+    const anchorMode = anchorFiles.length > 0 ||
+        anchorUrl !== undefined ||
+        pubkeyFile !== undefined ||
+        bundleFile !== undefined ||
+        rekorReceiptFiles.length > 0 ||
+        requireAnchor ||
+        requireExternalAnchor;
+    const trust = pubkeyFile !== undefined
+        ? {
+            rootPem: readFileSync(pubkeyFile, "utf-8"),
+            ...(successorPinFiles.length > 0
+                ? { successorPinsPem: successorPinFiles.map((f) => readFileSync(f, "utf-8")) }
+                : {}),
+        }
+        : undefined;
+    return {
+        anchorMode,
+        requireAnchor,
+        requireExternalAnchor,
+        params: {
+            externalAnchorsRaw,
+            rekorReceiptsRaw,
+            rekorLogPubkeysPem,
+            ...(trust !== undefined ? { trust } : {}),
+            witness,
+            ...(maxAnchorAgeMs !== undefined ? { maxAnchorAgeMs } : {}),
+            ...(maxUnanchoredEvents !== undefined ? { maxUnanchoredEvents } : {}),
+            ...(vaultId !== undefined ? { expectedVaultId: vaultId } : {}),
+        },
+    };
+}
+/**
+ * A witness-attested time on its way to a terminal. The receipt parser bounds
+ * integratedTime, but this value also arrives from library callers, and
+ * `toISOString()` throws RangeError outside ±8.64e15 ms — printing raw
+ * milliseconds beats crashing the verifier over a number it already distrusts.
+ */
+function formatAttestedMs(ms) {
+    return Number.isFinite(ms) && Math.abs(ms) <= 8.64e15 ? new Date(ms).toISOString() : `${ms} ms`;
+}
 export async function run(rootDir, opts) {
     const root = rootDir ?? process.cwd();
     const vaultPath = join(root, VAULT_DIR);
     const json = opts?.json === true;
+    let flags;
+    try {
+        flags = await parseAnchorFlags(process.argv.slice(2));
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (json) {
+            console.log(JSON.stringify({ command: "verify", success: false, data: { message } }));
+        }
+        else {
+            console.log(pc.red(message));
+        }
+        process.exitCode = 1;
+        return;
+    }
     if (!existsSync(vaultPath)) {
         if (json) {
             console.log(JSON.stringify({
@@ -31,8 +310,66 @@ export async function run(rootDir, opts) {
         process.exitCode = 1;
         return;
     }
-    const result = verifyVault(vaultPath);
     const verifiedAt = new Date().toISOString();
+    if (flags.anchorMode) {
+        const result = verifyVaultWithAnchors(vaultPath, flags.params);
+        const exitCode = exitCodeForAnchored(result, {
+            requireAnchor: flags.requireAnchor,
+            requireExternalAnchor: flags.requireExternalAnchor,
+        });
+        if (json) {
+            console.log(JSON.stringify({
+                command: "verify",
+                success: result.valid,
+                data: {
+                    valid: result.valid,
+                    chainLength: result.chainLength,
+                    errors: result.errors,
+                    merkleRoot: result.merkleRoot,
+                    anchorState: result.anchorState,
+                    anchoring: result.anchoring,
+                    verifiedAt,
+                },
+            }));
+            if (exitCode !== 0)
+                process.exitCode = exitCode;
+            return;
+        }
+        if (result.valid) {
+            console.log(pc.green(`Chain verified: ${result.chainLength} events, all hashes valid.`));
+        }
+        else {
+            console.log(pc.red(`Chain verification FAILED: ${result.errors.length} error(s) found.`));
+            for (const err of result.errors) {
+                console.log(pc.red(`  - ${err}`));
+            }
+        }
+        console.log(`Anchor state: ${result.anchorState} (source: ${result.anchoring.anchorSource})`);
+        if (result.anchoring.latestAnchor) {
+            const la = result.anchoring.latestAnchor;
+            console.log(`Latest anchor: #${la.anchorSeq} treeSize ${la.treeSize} (${la.timestamp})`);
+        }
+        console.log(`Unanchored tail: ${result.anchoring.unanchoredTail.events} event(s)`);
+        const rekor = result.anchoring.rekor;
+        if (rekor !== undefined) {
+            const attested = rekor.latestAttestedTimeMs === null
+                ? ""
+                : `, attested ${formatAttestedMs(rekor.latestAttestedTimeMs)}`;
+            const failed = rekor.receiptsFailed > 0 ? `, ${rekor.receiptsFailed} FAILED` : "";
+            console.log(`Rekor: ${rekor.receiptsVerified} receipt(s) verified${failed}${attested}`);
+        }
+        if (result.anchoring.anchorSource === "vault-mirror") {
+            console.log(pc.yellow("WARNING: anchors verified from the vault-local mirror only — supply an externally fetched copy for deletion protection."));
+        }
+        for (const w of result.anchoring.warnings) {
+            console.log(pc.yellow(`WARNING: ${w}`));
+        }
+        console.log(pc.dim(`Verified at: ${verifiedAt}`));
+        if (exitCode !== 0)
+            process.exitCode = exitCode;
+        return;
+    }
+    const result = verifyVault(vaultPath);
     if (json) {
         console.log(JSON.stringify({
             command: "verify",
@@ -42,6 +379,7 @@ export async function run(rootDir, opts) {
                 chainLength: result.chainLength,
                 errors: result.errors,
                 merkleRoot: result.merkleRoot,
+                anchorState: "UNANCHORED",
                 verifiedAt,
             },
         }));
@@ -53,6 +391,7 @@ export async function run(rootDir, opts) {
         console.log(pc.green(`Chain verified: ${result.chainLength} events, all hashes valid.`));
         if (result.merkleRoot)
             console.log(`Merkle root: ${pc.dim(result.merkleRoot)}`);
+        console.log(pc.dim("Anchor state: UNANCHORED — internal consistency only; supply --anchor + --pubkey for independent verification."));
     }
     else {
         console.log(pc.red(`Chain verification FAILED: ${result.errors.length} error(s) found.`));

package/dist/cli/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/cli/verify.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAGnD,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAgB,EAAE,IAAiB;IAC5D,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;IAEjC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,IAAI,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;gBACd,OAAO,EAAE,QAAQ;gBACjB,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,EAAE,OAAO,EAAE,mDAAmD,EAAE;aACtE,CAAC,CACF,CAAC;QACH,CAAC;aAAM,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC,gCAAgC,CAAC,CAAC;QACjF,CAAC;QACD,4DAA4D;QAC5D,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACR,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE5C,IAAI,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;YACd,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,MAAM,CAAC,KAAK;YACrB,IAAI,EAAE;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,UAAU;aACV;SACD,CAAC,CACF,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACxC,OAAO;IACR,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,mBAAmB,MAAM,CAAC,WAAW,4BAA4B,CAAC,CAAC,CAAC;QACzF,IAAI,MAAM,CAAC,UAAU;YAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;SAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,8BAA8B,MAAM,CAAC,MAAM,CAAC,MAAM,kBAAkB,CAAC,CAAC,CAAC;QAC1F,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QACrD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC;QACnC,CAAC;QACD,sEAAsE;QACtE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gBAAgB,UAAU,EAAE,CAAC,CAAC,CAAC;AACnD,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/cli/verify.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAEN,mBAAmB,EACnB,WAAW,EACX,sBAAsB,GAEtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAGnD,SAAS,eAAe,CAAC,GAAW;IACnC,MAAM,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAChB,mEAAmE;QACnE,wEAAwE;QACxE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,qCAAqC,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAW,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAW,CAAC;IAChG,OAAO,CAAC,GAAG,IAAI,CAAC;AACjB,CAAC;AASD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IAClC,0EAA0E;IAC1E,2EAA2E;IAC3E,QAAQ;IACR,eAAe;IACf,eAAe;IACf,gBAAgB;IAChB,UAAU;IACV,WAAW;IACX,cAAc;IACd,UAAU;IACV,kBAAkB;IAClB,gBAAgB;IAChB,UAAU;IACV,iBAAiB;IACjB,kBAAkB;IAClB,2BAA2B;IAC3B,kBAAkB;IAClB,yBAAyB;IACzB,YAAY;CACZ,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC;AAChC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;AAE/D,SAAS,YAAY,CAAC,UAAkB;IACvC,OAAO,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,IAAY;IAClC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,aAAa,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,sBAAsB,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACd,kBAAkB,IAAI,6DAA6D,CACnF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,GAAW;IAC/B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC/E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACvF,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,iCAAiC,gBAAgB,MAAM,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC1F,IAAI,QAAQ,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,uCAAuC,gBAAgB,MAAM,CAAC,CAAC;IAChF,CAAC;IACD,OAAO;QACN,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1E,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;KAC/D,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IAClC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,CAAC,YAAY,CAAC;aAClB,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;gBACvD,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;gBACjC,IAAI,IAAI,GAAG,GAAG,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;oBAC/B,GAAG,CAAC,MAAM,EAAE,CAAC;oBACb,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC;oBAC9C,OAAO;gBACR,CAAC;gBACD,MAAM,MAAM,GAAa,EAAE,CAAC;gBAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3F,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAC3D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACtE,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAc;IAC7C,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,iBAAiB,GAAa,EAAE,CAAC;IACvC,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,IAAI,UAA8B,CAAC;IACnC,IAAI,SAA6B,CAAC;IAClC,IAAI,UAA8B,CAAC;IACnC,MAAM,iBAAiB,GAAa,EAAE,CAAC;IACvC,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,qBAAqB,GAAG,KAAK,CAAC;IAClC,IAAI,cAAkC,CAAC;IACvC,IAAI,mBAAuC,CAAC;IAC5C,IAAI,OAA2B,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAC9B,MAAM,IAAI,GAAG,GAAuB,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACjD,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/C,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,KAAK,SAAS;gBAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;aAAM,IAAI,GAAG,KAAK,kBAAkB,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,KAAK,SAAS;gBAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;aAAM,IAAI,GAAG,KAAK,gBAAgB,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,KAAK,SAAS;gBAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC;aAAM,IAAI,GAAG,KAAK,UAAU;YAAE,UAAU,GAAG,IAAI,EAAE,CAAC;aAC9C,IAAI,GAAG,KAAK,cAAc;YAAE,SAAS,GAAG,IAAI,EAAE,CAAC;aAC/C,IAAI,GAAG,KAAK,UAAU;YAAE,UAAU,GAAG,IAAI,EAAE,CAAC;aAC5C,IAAI,GAAG,KAAK,iBAAiB,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,KAAK,SAAS;gBAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;aAAM,IAAI,GAAG,KAAK,kBAAkB;YAAE,aAAa,GAAG,IAAI,CAAC;aACvD,IAAI,GAAG,KAAK,2BAA2B;YAAE,qBAAqB,GAAG,IAAI,CAAC;aACtE,IAAI,GAAG,KAAK,kBAAkB,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YAC1E,cAAc,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;aAAM,IAAI,GAAG,KAAK,yBAAyB,EAAE,CAAC;YAC9C,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YACjB,mBAAmB,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACnD,uEAAuE;YACvE,gEAAgE;YAChE,wDAAwD;YACxD,IACC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;gBACtB,CAAC,MAAM,CAAC,aAAa,CAAC,mBAAmB,CAAC;gBAC1C,mBAAmB,GAAG,CAAC,EACtB,CAAC;gBACF,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,kCAAkC,CAAC,CAAC;YAC1F,CAAC;QACF,CAAC;aAAM,IAAI,GAAG,KAAK,YAAY;YAAE,OAAO,GAAG,IAAI,EAAE,CAAC;aAC7C,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/D,qEAAqE;YACrE,sDAAsD;YACtD,MAAM,IAAI,KAAK,CAAC,iBAAiB,GAAG,EAAE,CAAC,CAAC;QACzC,CAAC;IACF,CAAC;IACD,MAAM,kBAAkB,GAAG,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC7D,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC/D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;QACrD,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3C,gBAAgB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,OAAO,GAAiB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACjD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;QAChD,qEAAqE;QACrE,sEAAsE;QACtE,qEAAqE;QACrE,8CAA8C;QAC9C,MAAM,MAAM,GACX,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrF,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAc,CAAC,CAAC;YAChD,OAAO,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACzC,CAAC;aAAM,CAAC;YACP,OAAO,GAAG;gBACT,SAAS,EAAE,IAAI;gBACf,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,OAAO,CAAC,EAAE;oBAChB,CAAC,CAAC,+CAA+C;oBACjD,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,cAAc,CAAC;aACpC,CAAC;QACH,CAAC;IACF,CAAC;IACD,MAAM,UAAU,GACf,WAAW,CAAC,MAAM,GAAG,CAAC;QACtB,SAAS,KAAK,SAAS;QACvB,UAAU,KAAK,SAAS;QACxB,UAAU,KAAK,SAAS;QACxB,iBAAiB,CAAC,MAAM,GAAG,CAAC;QAC5B,aAAa;QACb,qBAAqB,CAAC;IACvB,MAAM,KAAK,GACV,UAAU,KAAK,SAAS;QACvB,CAAC,CAAC;YACA,OAAO,EAAE,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC;YAC1C,GAAG,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC;gBAC/B,CAAC,CAAC,EAAE,gBAAgB,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE;gBAC9E,CAAC,CAAC,EAAE,CAAC;SACN;QACF,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACN,UAAU;QACV,aAAa;QACb,qBAAqB;QACrB,MAAM,EAAE;YACP,kBAAkB;YAClB,gBAAgB;YAChB,kBAAkB;YAClB,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,OAAO;YACP,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D;KACD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,EAAU;IACnC,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC;AACjG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAgB,EAAE,IAAiB;IAC5D,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;IAEjC,IAAI,KAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,KAAK,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QACvF,CAAC;aAAM,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACR,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,IAAI,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;gBACd,OAAO,EAAE,QAAQ;gBACjB,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,EAAE,OAAO,EAAE,mDAAmD,EAAE;aACtE,CAAC,CACF,CAAC;QACH,CAAC;aAAM,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC,gCAAgC,CAAC,CAAC;QACjF,CAAC;QACD,4DAA4D;QAC5D,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACR,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE5C,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,EAAE;YAC5C,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;SAClD,CAAC,CAAC;QACH,IAAI,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;gBACd,OAAO,EAAE,QAAQ;gBACjB,OAAO,EAAE,MAAM,CAAC,KAAK;gBACrB,IAAI,EAAE;oBACL,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,UAAU;iBACV;aACD,CAAC,CACF,CAAC;YACF,IAAI,QAAQ,KAAK,CAAC;gBAAE,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAChD,OAAO;QACR,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,mBAAmB,MAAM,CAAC,WAAW,4BAA4B,CAAC,CAAC,CAAC;QAC1F,CAAC;aAAM,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,8BAA8B,MAAM,CAAC,MAAM,CAAC,MAAM,kBAAkB,CAAC,CAAC,CAAC;YAC1F,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBACjC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC;YACnC,CAAC;QACF,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,WAAW,aAAa,MAAM,CAAC,SAAS,CAAC,YAAY,GAAG,CAAC,CAAC;QAC9F,IAAI,MAAM,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;YACnC,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,SAAS,aAAa,EAAE,CAAC,QAAQ,KAAK,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,oBAAoB,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,MAAM,WAAW,CAAC,CAAC;QACnF,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,QAAQ,GACb,KAAK,CAAC,oBAAoB,KAAK,IAAI;gBAClC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,cAAc,gBAAgB,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC;YACjE,MAAM,MAAM,GAAG,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,cAAc,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,CAAC,gBAAgB,uBAAuB,MAAM,GAAG,QAAQ,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;YACtD,OAAO,CAAC,GAAG,CACV,EAAE,CAAC,MAAM,CACR,yHAAyH,CACzH,CACD,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gBAAgB,UAAU,EAAE,CAAC,CAAC,CAAC;QAClD,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAChD,OAAO;IACR,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAEtC,IAAI,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;YACd,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,MAAM,CAAC,KAAK;YACrB,IAAI,EAAE;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,WAAW,EAAE,YAAY;gBACzB,UAAU;aACV;SACD,CAAC,CACF,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACxC,OAAO;IACR,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,mBAAmB,MAAM,CAAC,WAAW,4BAA4B,CAAC,CAAC,CAAC;QACzF,IAAI,MAAM,CAAC,UAAU;YAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CACV,EAAE,CAAC,GAAG,CACL,gHAAgH,CAChH,CACD,CAAC;IACH,CAAC;SAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,8BAA8B,MAAM,CAAC,MAAM,CAAC,MAAM,kBAAkB,CAAC,CAAC,CAAC;QAC1F,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QACrD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC;QACnC,CAAC;QACD,sEAAsE;QACtE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gBAAgB,UAAU,EAAE,CAAC,CAAC,CAAC;AACnD,CAAC"}

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AA4BrD;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC/B,SAAS,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,EAChC,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,WAAW,CAAC,CAwBtB;AAED,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,CAE7D"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AA6BrD;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC/B,SAAS,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,EAChC,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,WAAW,CAAC,CAwBtB;AAED,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,CAE7D"}

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAGtD,4FAA4F;AAC5F,MAAM,UAAU,GAAG,0BAA0B,CAAC;AAE9C,qFAAqF;AACrF,SAAS,WAAW,CAAC,OAAe;IACnC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAS;QAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACrC,8CAA8C;QAC9C,IACC,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC7C,CAAC;YACF,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC1B,CAAC;IACF,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,SAAgC,EAChC,SAAkB;IAElB,MAAM,IAAI,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAExC,gEAAgE;IAChE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACpD,WAAW,CAAC,UAAU,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,uBAAuB,CAAC,CAAC;IAClE,IAAI,GAAG,GAA4B,EAAE,CAAC;IACtC,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAA4B,CAAC;IAClF,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;IAC1B,IAAI,SAAS,EAAE,CAAC;QACf,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACpD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAkC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;YAChD,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,YAAY,CAAC,MAAmB;IAC/C,OAAO,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,4FAA4F;AAC5F,MAAM,UAAU,GAAG,0BAA0B,CAAC;AAE9C,qFAAqF;AACrF,SAAS,WAAW,CAAC,OAAe;IACnC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAS;QAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACrC,8CAA8C;QAC9C,IACC,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC7C,CAAC;YACF,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC1B,CAAC;IACF,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,SAAgC,EAChC,SAAkB;IAElB,MAAM,IAAI,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAExC,gEAAgE;IAChE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACpD,WAAW,CAAC,UAAU,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,uBAAuB,CAAC,CAAC;IAClE,IAAI,GAAG,GAA4B,EAAE,CAAC;IACtC,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAA4B,CAAC;IAClF,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;IAC1B,IAAI,SAAS,EAAE,CAAC;QACf,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACpD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAkC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;YAChD,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,YAAY,CAAC,MAAmB;IAC/C,OAAO,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC"}

package/dist/detect.d.ts

@@ -4,30 +4,52 @@
  * Uses structural checks (duck typing) to identify which SDK a client object
  * belongs to, without requiring the SDK packages as dependencies.
  *
- * **Governance boundary:** only the following methods are intercepted and governed:
- * - Anthropic: `client.messages.create()`
- * - OpenAI: `client.chat.completions.create()`
+ * **Governance boundary:** the following methods are intercepted and governed:
+ * - Anthropic: `client.messages.create()`, `client.messages.stream()`,
+ *   `client.messages.parse()`, `client.beta.messages.create()`,
+ *   `client.beta.messages.stream()`, `client.beta.messages.parse()`
+ * - OpenAI: `client.chat.completions.create()`, and `client.responses.create()`
+ *   when present (feature-detected — the Responses API postdates the peer-range
+ *   floor, so older clients simply lack it and it stays a pass-through). A streaming
+ *   `responses.create({ stream: true })` is governed; the `responses.stream()`
+ *   convenience helper is NOT (see below).
  * - Google: `client.models.generateContent()`
  *
- * Alternative methods (e.g., `client.messages.stream`, `client.beta.*`, streaming
- * APIs, `client.completions.create`) are **NOT** intercepted and will bypass
- * governance, audit, and budget enforcement. This is a known limitation of
- * duck-typed proxy interception. Callers relying on ungoverned methods should
- * implement their own budget and audit controls or wrap calls through the
- * governed entry points above.
+ * Remaining ungoverned surfaces (feature-detected pass-throughs, or shapes that do
+ * not mirror `create`): `client.messages.batches`, `client.beta.messages.batches`,
+ * `client.beta.models`, `client.beta.files`, the OpenAI Responses non-create
+ * methods (`client.responses.retrieve/cancel/delete`, plus the
+ * `client.responses.stream()` and `client.responses.parse()` helpers — both drive
+ * the SDK's raw client internally and so bypass the governed `create`), the OpenAI
+ * `client.beta.*` namespace (assistants/threads/realtime — a different shape from
+ * Anthropic beta), and the legacy `client.completions.create`. These are **NOT**
+ * intercepted and bypass governance, audit, and budget enforcement. Callers relying
+ * on ungoverned methods should implement their own budget and audit controls or wrap
+ * calls through the governed entry points above.
  */
 import type { EndpointInfo, LLMClientKind, TrustConfig } from "./shared/types.js";
 /**
  * Detect which LLM SDK a client belongs to by inspecting its shape.
  *
- * Governance boundary: only the following methods are intercepted and governed:
- * - Anthropic: `client.messages.create()`
- * - OpenAI: `client.chat.completions.create()`
+ * Governance boundary: the following methods are intercepted and governed:
+ * - Anthropic: `client.messages.create()`, `client.messages.stream()`,
+ *   `client.messages.parse()`, `client.beta.messages.create()`,
+ *   `client.beta.messages.stream()`, `client.beta.messages.parse()`
+ * - OpenAI: `client.chat.completions.create()`, and `client.responses.create()`
+ *   when present (feature-detected — the Responses API postdates the peer-range
+ *   floor, so older clients simply lack it and it stays a pass-through). A streaming
+ *   `responses.create({ stream: true })` is governed; the `responses.stream()`
+ *   helper is NOT.
  * - Google: `client.models.generateContent()`
  *
- * Alternative methods (e.g., `client.messages.stream`, `client.beta.*`, streaming APIs)
- * are NOT intercepted and will bypass governance, audit, and budget enforcement.
- * This is a known limitation of duck-typed proxy interception.
+ * Remaining ungoverned pass-throughs: `client.messages.batches`,
+ * `client.beta.messages.batches`, `client.beta.models`, `client.beta.files`, the
+ * OpenAI Responses non-create methods (`client.responses.retrieve/cancel/delete`,
+ * plus the `client.responses.stream()` and `client.responses.parse()` helpers,
+ * which drive the SDK's raw client and bypass the governed `create`), the OpenAI
+ * `client.beta.*` namespace (assistants/threads/realtime), and the legacy
+ * `client.completions.create`. These bypass governance, audit, and budget
+ * enforcement (they do not mirror the `create` request/response shape).
  *
  * @throws {Error} if the client does not match any known SDK shape
  */

package/dist/detect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../src/detect.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAgB,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhG;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,OAAO,GAAG,aAAa,CAyC/D;AAsED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,gBAAgB,CAC/B,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,WAAW,EACnB,QAAQ,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,GAC9B,YAAY,CA8Bd"}
+{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../src/detect.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAgB,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhG;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,OAAO,GAAG,aAAa,CAyC/D;AAsED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,gBAAgB,CAC/B,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,WAAW,EACnB,QAAQ,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,GAC9B,YAAY,CA8Bd"}

package/dist/detect.js

@@ -3,14 +3,25 @@
 /**
  * Detect which LLM SDK a client belongs to by inspecting its shape.
  *
- * Governance boundary: only the following methods are intercepted and governed:
- * - Anthropic: `client.messages.create()`
- * - OpenAI: `client.chat.completions.create()`
+ * Governance boundary: the following methods are intercepted and governed:
+ * - Anthropic: `client.messages.create()`, `client.messages.stream()`,
+ *   `client.messages.parse()`, `client.beta.messages.create()`,
+ *   `client.beta.messages.stream()`, `client.beta.messages.parse()`
+ * - OpenAI: `client.chat.completions.create()`, and `client.responses.create()`
+ *   when present (feature-detected — the Responses API postdates the peer-range
+ *   floor, so older clients simply lack it and it stays a pass-through). A streaming
+ *   `responses.create({ stream: true })` is governed; the `responses.stream()`
+ *   helper is NOT.
  * - Google: `client.models.generateContent()`
  *
- * Alternative methods (e.g., `client.messages.stream`, `client.beta.*`, streaming APIs)
- * are NOT intercepted and will bypass governance, audit, and budget enforcement.
- * This is a known limitation of duck-typed proxy interception.
+ * Remaining ungoverned pass-throughs: `client.messages.batches`,
+ * `client.beta.messages.batches`, `client.beta.models`, `client.beta.files`, the
+ * OpenAI Responses non-create methods (`client.responses.retrieve/cancel/delete`,
+ * plus the `client.responses.stream()` and `client.responses.parse()` helpers,
+ * which drive the SDK's raw client and bypass the governed `create`), the OpenAI
+ * `client.beta.*` namespace (assistants/threads/realtime), and the legacy
+ * `client.completions.create`. These bypass governance, audit, and budget
+ * enforcement (they do not mirror the `create` request/response shape).
  *
  * @throws {Error} if the client does not match any known SDK shape
  */

package/dist/detect.js.map

@@ -1 +1 @@
-{"version":3,"file":"detect.js","sourceRoot":"","sources":["../src/detect.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAuBjC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAe;IAC/C,IACC,MAAM,IAAI,IAAI;QACd,OAAO,MAAM,KAAK,QAAQ;QAC1B,UAAU,IAAI,MAAM;QACpB,MAAM,CAAC,QAAQ,IAAI,IAAI;QACvB,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QACnC,QAAQ,IAAI,MAAM,CAAC,QAAQ;QAC3B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,UAAU,EAC3C,CAAC;QACF,OAAO,WAAW,CAAC;IACpB,CAAC;IAED,IACC,MAAM,IAAI,IAAI;QACd,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,IAAI,MAAM;QAChB,MAAM,CAAC,IAAI,IAAI,IAAI;QACnB,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAC/B,aAAa,IAAI,MAAM,CAAC,IAAI;QAC5B,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI;QAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,QAAQ;QAC3C,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW;QACnC,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,UAAU,EACnD,CAAC;QACF,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,IACC,MAAM,IAAI,IAAI;QACd,OAAO,MAAM,KAAK,QAAQ;QAC1B,QAAQ,IAAI,MAAM;QAClB,MAAM,CAAC,MAAM,IAAI,IAAI;QACrB,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QACjC,iBAAiB,IAAI,MAAM,CAAC,MAAM;QAClC,OAAO,MAAM,CAAC,MAAM,CAAC,eAAe,KAAK,UAAU,EAClD,CAAC;QACF,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;AAC9F,CAAC;AAED,4DAA4D;AAE5D,4EAA4E;AAC5E,0EAA0E;AAC1E,gFAAgF;AAChF,6EAA6E;AAC7E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC;AAEnF,6EAA6E;AAC7E,MAAM,eAAe,GAAiC;IACrD,OAAO,EAAE,QAAQ;IACjB,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,MAAM;CACd,CAAC;AAEF,MAAM,aAAa,GAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAE3E,SAAS,QAAQ,CAAC,KAAa;IAC9B,IAAI,CAAC;QACJ,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,QAAgB;IAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5E,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,oBAAoB,CAAC,KAAa,EAAE,GAAQ;IACpD,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC;IAC5D,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,kBAAkB;QAC/D,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;AACrC,CAAC;AAED,+EAA+E;AAC/E,SAAS,WAAW,CAAC,MAAe;IACnC,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;QACzE,MAAM,KAAK,GAAI,MAAgC,CAAC,OAAO,CAAC;QACxD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;IAC7C,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,gBAAgB,CAC/B,MAAe,EACf,MAAmB,EACnB,QAAgC;IAEhC,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAEpC,8CAA8C;IAC9C,IAAI,QAAQ,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,GAAiB,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC;QAC7F,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC;QACjD,IAAI,YAAY,KAAK,SAAS;YAAE,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC;QAC5D,OAAO,IAAI,CAAC;IACb,CAAC;IAED,qFAAqF;IACrF,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;IACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;IAE9C,6CAA6C;IAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;YAC5C,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;QAChE,CAAC;IACF,CAAC;IAED,2BAA2B;IAC3B,IAAI,MAAM,CAAC,KAAK,CAAC,kBAAkB,IAAI,cAAc,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC5F,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,eAAe,EAAE,OAAO,EAAE,CAAC;IAC3F,CAAC;IAED,qBAAqB;IACrB,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AACxD,CAAC"}
+{"version":3,"file":"detect.js","sourceRoot":"","sources":["../src/detect.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAkCjC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAe;IAC/C,IACC,MAAM,IAAI,IAAI;QACd,OAAO,MAAM,KAAK,QAAQ;QAC1B,UAAU,IAAI,MAAM;QACpB,MAAM,CAAC,QAAQ,IAAI,IAAI;QACvB,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QACnC,QAAQ,IAAI,MAAM,CAAC,QAAQ;QAC3B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,UAAU,EAC3C,CAAC;QACF,OAAO,WAAW,CAAC;IACpB,CAAC;IAED,IACC,MAAM,IAAI,IAAI;QACd,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,IAAI,MAAM;QAChB,MAAM,CAAC,IAAI,IAAI,IAAI;QACnB,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAC/B,aAAa,IAAI,MAAM,CAAC,IAAI;QAC5B,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI;QAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,QAAQ;QAC3C,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW;QACnC,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,UAAU,EACnD,CAAC;QACF,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,IACC,MAAM,IAAI,IAAI;QACd,OAAO,MAAM,KAAK,QAAQ;QAC1B,QAAQ,IAAI,MAAM;QAClB,MAAM,CAAC,MAAM,IAAI,IAAI;QACrB,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QACjC,iBAAiB,IAAI,MAAM,CAAC,MAAM;QAClC,OAAO,MAAM,CAAC,MAAM,CAAC,eAAe,KAAK,UAAU,EAClD,CAAC;QACF,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;AAC9F,CAAC;AAED,4DAA4D;AAE5D,4EAA4E;AAC5E,0EAA0E;AAC1E,gFAAgF;AAChF,6EAA6E;AAC7E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC;AAEnF,6EAA6E;AAC7E,MAAM,eAAe,GAAiC;IACrD,OAAO,EAAE,QAAQ;IACjB,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,MAAM;CACd,CAAC;AAEF,MAAM,aAAa,GAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAE3E,SAAS,QAAQ,CAAC,KAAa;IAC9B,IAAI,CAAC;QACJ,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,QAAgB;IAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5E,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,oBAAoB,CAAC,KAAa,EAAE,GAAQ;IACpD,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC;IAC5D,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,kBAAkB;QAC/D,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;AACrC,CAAC;AAED,+EAA+E;AAC/E,SAAS,WAAW,CAAC,MAAe;IACnC,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;QACzE,MAAM,KAAK,GAAI,MAAgC,CAAC,OAAO,CAAC;QACxD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;IAC7C,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,gBAAgB,CAC/B,MAAe,EACf,MAAmB,EACnB,QAAgC;IAEhC,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAEpC,8CAA8C;IAC9C,IAAI,QAAQ,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,GAAiB,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC;QAC7F,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC;QACjD,IAAI,YAAY,KAAK,SAAS;YAAE,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC;QAC5D,OAAO,IAAI,CAAC;IACb,CAAC;IAED,qFAAqF;IACrF,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;IACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;IAE9C,6CAA6C;IAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;YAC5C,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;QAChE,CAAC;IACF,CAAC;IAED,2BAA2B;IAC3B,IAAI,MAAM,CAAC,KAAK,CAAC,kBAAkB,IAAI,cAAc,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC5F,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,eAAe,EAAE,OAAO,EAAE,CAAC;IAC3F,CAAC;IAED,qBAAqB;IACrB,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AACxD,CAAC"}

package/dist/export/markdown.d.ts

@@ -0,0 +1,12 @@
+export interface ExportResult {
+    written: number;
+    outDir: string;
+    /** Parsed-chain walk verdict (hash linkage over readable events). */
+    chainValid: boolean;
+    breakIndex: number | null;
+    /** Full vault verification (segments, malformed lines, .meta anchor). */
+    vaultValid: boolean;
+    vaultErrors: string[];
+}
+export declare function exportMarkdown(vaultPath: string, outDir: string): ExportResult;
+//# sourceMappingURL=markdown.d.ts.map

package/dist/export/markdown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../src/export/markdown.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,YAAY;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,yEAAyE;IACzE,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;CACtB;AAkGD,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,YAAY,CAiD9E"}