@sunaiva/gate - npm Package Compare versions

Comparing version 1.1.9 to 2.0.0

dist/engine/audit-chain.d.ts

+/**
+ * Audit hash chain for @sunaiva/gate — Fault #12 / Patent Claim 19.
+ *
+ * Ported from mcp-servers/validation-gate-mcp/src/engine/audit-chain.ts
+ * and adapted to Gate types + Gate config path.
+ *
+ * Hash-chain property (Patent Claim 19: "immutable hash-chain audit trail"):
+ *   entry[n].prev_hash = sha256(entry[n-1].entry_hash)
+ *   entry[0].prev_hash = "GENESIS"
+ *
+ * Modifying any past entry changes that entry's entry_hash,
+ * which invalidates every subsequent prev_hash reference —
+ * making tampering detectable by verifyChainIntegrity().
+ *
+ * Privacy: action text is NEVER stored. Only sha256(action) is written.
+ *
+ * Concurrency safety (two layers, same design as validation-gate-mcp):
+ *   Layer 1 — in-process async mutex (promise-chain):
+ *     Serialises concurrent appendAuditEntry() calls within one Node.js process.
+ *     Never rejects — if the critical section throws, the next waiter still runs.
+ *   Layer 2 — cross-process advisory O_EXCL lock file:
+ *     Atomic kernel-level create. Stale lock (>10s) is stolen. Fail-OPEN on
+ *     timeout so a buggy lock never prevents audit writes.
+ *
+ * Rotation — archive-then-continue (replaces the old destructive rename):
+ *   When audit.jsonl exceeds AUDIT_ROTATE_BYTES, it is renamed to
+ *   audit.jsonl.<ISO-timestamp> (timestamped archive). A fresh audit.jsonl
+ *   starts a new chain (prev_hash = "GENESIS"). Old archives are never deleted.
+ */
+export interface GateAuditEntry {
+    /** UUID v4 */
+    audit_id: string;
+    /** ISO 8601 */
+    ts: string;
+    /** Gate version from the evaluation call */
+    gate_version: string;
+    /** "pass" | "block" | "dry_run_pass" | "dry_run_block" */
+    type: string;
+    /** "GENESIS" for entry[0]; sha256(entries[n-1].entry_hash) for entry[n] */
+    prev_hash: string;
+    /**
+     * sha256 of canonical content (all data fields, excluding entry_hash and sigs).
+     * Tampering with any data field changes this hash, breaking the chain.
+     */
+    entry_hash: string;
+    /** sha256(action_text) — privacy: raw action is NOT stored */
+    action_sha256: string;
+    severity_tier: string | null;
+    violations: string[];
+    warnings: string[];
+    skipped_premium: string[];
+    would_have_blocked: string[];
+    /** Ed25519 signature over entry_hash (hex) — present when signing key is available */
+    ed25519_sig?: string;
+    /** Ed25519 public key used to sign (hex) — present alongside ed25519_sig */
+    ed25519_pub?: string;
+    /**
+     * Extra context fields for non-validation events (bypass, rollback, error).
+     * NOT included in entry_hash computation so they are metadata-only (not
+     * part of the integrity-protected chain). Written verbatim to the JSONL so
+     * bypass rule_id/reason and error class/message survive in the audit trail.
+     * Never set by the core validation path (validate_action).
+     */
+    extra_fields?: Record<string, unknown>;
+}
+/** For tests only — override the rotation threshold. */
+export declare function setRotateBytes(n: number): void;
+/**
+ * appendAuditEntry — write a new hash-chained audit entry to the JSONL log.
+ *
+ * The entire getPrevHash → build-entry → appendFile critical section runs
+ * inside two nested locks so concurrent callers cannot race on the chain tip.
+ *
+ * Never throws — audit failures are logged to stderr but never block the gate.
+ *
+ * @param logPath   Full path to the audit JSONL file (from getConfig().audit_log_path)
+ * @param params    Gate evaluation outcome fields
+ */
+export declare function appendAuditEntry(logPath: string, params: {
+    gate_version: string;
+    type: string;
+    action: string;
+    severity_tier: string | null;
+    violations: string[];
+    warnings: string[];
+    skipped_premium: string[];
+    would_have_blocked: string[];
+    /** Extra context fields written verbatim (not included in hash computation). */
+    extra_fields?: Record<string, unknown>;
+}): Promise<GateAuditEntry>;
+/**
+ * verifyChainIntegrity — reads the audit file and verifies the prev_hash chain.
+ *
+ * Checks for:
+ *   1. First entry has prev_hash === "GENESIS"
+ *   2. Each entry's entry_hash matches recomputed hash of its content fields
+ *   3. Each entry's prev_hash === sha256(previous entry's entry_hash)
+ *   4. If ed25519_sig is present: signature over entry_hash is valid
+ *
+ * Returns { valid, entry_count, errors }.
+ * Old-format entries (no entry_hash) are skipped — they predate the chain.
+ */
+export declare function verifyChainIntegrity(logPath: string): Promise<{
+    valid: boolean;
+    entry_count: number;
+    checked_count: number;
+    errors: string[];
+    chain_tip_hash: string | null;
+    unsigned_count: number;
+}>;
+//# sourceMappingURL=audit-chain.d.ts.map

dist/engine/audit-chain.d.ts.map

+{"version":3,"file":"audit-chain.d.ts","sourceRoot":"","sources":["../../src/engine/audit-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAmBH,MAAM,WAAW,cAAc;IAC7B,cAAc;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe;IACf,EAAE,EAAE,MAAM,CAAC;IACX,4CAA4C;IAC5C,YAAY,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,sFAAsF;IACtF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAUD,wDAAwD;AACxD,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAG9C;AAiKD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE;IACN,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC,GACA,OAAO,CAAC,cAAc,CAAC,CAsEzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IACnE,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC,CAgFD"}

dist/engine/audit-chain.js

+/**
+ * Audit hash chain for @sunaiva/gate — Fault #12 / Patent Claim 19.
+ *
+ * Ported from mcp-servers/validation-gate-mcp/src/engine/audit-chain.ts
+ * and adapted to Gate types + Gate config path.
+ *
+ * Hash-chain property (Patent Claim 19: "immutable hash-chain audit trail"):
+ *   entry[n].prev_hash = sha256(entry[n-1].entry_hash)
+ *   entry[0].prev_hash = "GENESIS"
+ *
+ * Modifying any past entry changes that entry's entry_hash,
+ * which invalidates every subsequent prev_hash reference —
+ * making tampering detectable by verifyChainIntegrity().
+ *
+ * Privacy: action text is NEVER stored. Only sha256(action) is written.
+ *
+ * Concurrency safety (two layers, same design as validation-gate-mcp):
+ *   Layer 1 — in-process async mutex (promise-chain):
+ *     Serialises concurrent appendAuditEntry() calls within one Node.js process.
+ *     Never rejects — if the critical section throws, the next waiter still runs.
+ *   Layer 2 — cross-process advisory O_EXCL lock file:
+ *     Atomic kernel-level create. Stale lock (>10s) is stolen. Fail-OPEN on
+ *     timeout so a buggy lock never prevents audit writes.
+ *
+ * Rotation — archive-then-continue (replaces the old destructive rename):
+ *   When audit.jsonl exceeds AUDIT_ROTATE_BYTES, it is renamed to
+ *   audit.jsonl.<ISO-timestamp> (timestamped archive). A fresh audit.jsonl
+ *   starts a new chain (prev_hash = "GENESIS"). Old archives are never deleted.
+ */
+import { randomUUID } from "node:crypto";
+import { appendFile, mkdir, open, readFile, rename, stat, unlink, } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { signEntry, verifyEntry, getPublicKey, sha256hex } from "./crypto-ed25519.js";
+// ---------------------------------------------------------------------------
+// Rotation threshold
+// ---------------------------------------------------------------------------
+let AUDIT_ROTATE_BYTES = 10 * 1024 * 1024; // 10 MB
+const ROTATE_CHECK_MS = 60_000; // stat at most every 60s
+let _lastRotateCheckMs = 0;
+/** For tests only — override the rotation threshold. */
+export function setRotateBytes(n) {
+    AUDIT_ROTATE_BYTES = n;
+    _lastRotateCheckMs = 0; // force next call to check
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/**
+ * Compute the canonical entry_hash for an entry.
+ * All data fields are included EXCEPT entry_hash and ed25519_sig/ed25519_pub
+ * (which are derived from or computed after entry_hash).
+ */
+function computeEntryHash(e) {
+    const canonical = JSON.stringify({
+        audit_id: e.audit_id,
+        ts: e.ts,
+        gate_version: e.gate_version,
+        type: e.type,
+        prev_hash: e.prev_hash,
+        action_sha256: e.action_sha256,
+        severity_tier: e.severity_tier,
+        violations: e.violations,
+        warnings: e.warnings,
+        skipped_premium: e.skipped_premium,
+        would_have_blocked: e.would_have_blocked,
+    });
+    return sha256hex(canonical);
+}
+/** Read the last line of the audit file to get previous entry_hash. */
+async function getPrevHash(logPath) {
+    try {
+        const content = await readFile(logPath, "utf8");
+        const lines = content.trim().split("\n").filter((l) => l.trim());
+        if (lines.length === 0)
+            return "GENESIS";
+        const last = JSON.parse(lines[lines.length - 1]);
+        // Support both old-format entries (no entry_hash) and new-format entries.
+        if (last.entry_hash)
+            return sha256hex(last.entry_hash);
+        // Old entry: use sha256 of audit_id as a stable chain anchor.
+        if (last.audit_id)
+            return sha256hex(last.audit_id);
+        return "GENESIS";
+    }
+    catch {
+        return "GENESIS";
+    }
+}
+// ---------------------------------------------------------------------------
+// Archive-then-continue rotation (non-destructive)
+// ---------------------------------------------------------------------------
+async function maybeRotate(logPath) {
+    const now = Date.now();
+    if (now - _lastRotateCheckMs < ROTATE_CHECK_MS)
+        return;
+    _lastRotateCheckMs = now;
+    try {
+        let size;
+        try {
+            const s = await stat(logPath);
+            size = s.size;
+        }
+        catch (e) {
+            if (e.code === "ENOENT")
+                return;
+            throw e;
+        }
+        if (size < AUDIT_ROTATE_BYTES)
+            return;
+        // Archive: rename to audit.jsonl.<ISO> (timestamped, never destructive)
+        const ts = new Date().toISOString().replace(/[:.]/g, "-");
+        const archived = `${logPath}.${ts}`;
+        await rename(logPath, archived);
+        process.stderr.write(JSON.stringify({
+            event: "gate_audit_rotated",
+            archived,
+            size_bytes: size,
+            ts: new Date().toISOString(),
+        }) + "\n");
+        // Reset the in-process rotate throttle so next call re-checks promptly
+        _lastRotateCheckMs = 0;
+    }
+    catch {
+        // Fail-OPEN: rotation failure must never block audit writes
+    }
+}
+// ---------------------------------------------------------------------------
+// Layer 1: In-process async mutex (promise-chain serialiser)
+// ---------------------------------------------------------------------------
+let _mutexTail = Promise.resolve();
+function runExclusive(fn) {
+    const next = _mutexTail.then(() => fn());
+    _mutexTail = next.catch(() => { });
+    return next;
+}
+// ---------------------------------------------------------------------------
+// Layer 2: Cross-process advisory O_EXCL lock file
+// ---------------------------------------------------------------------------
+const LOCK_STALE_MS = 10_000;
+const LOCK_RETRY_DELAY_MS = 20;
+const LOCK_MAX_RETRIES = 100;
+async function acquireFileLock(lockPath) {
+    const noopRelease = async () => { };
+    for (let attempt = 0; attempt <= LOCK_MAX_RETRIES; attempt++) {
+        try {
+            const fh = await open(lockPath, "wx");
+            await fh.close();
+            return async () => {
+                try {
+                    await unlink(lockPath);
+                }
+                catch {
+                    // Best-effort; stale lock stolen after LOCK_STALE_MS
+                }
+            };
+        }
+        catch (err) {
+            const code = err.code;
+            if (code !== "EEXIST") {
+                process.stderr.write(JSON.stringify({
+                    event: "gate_audit_lock_error",
+                    error: err instanceof Error ? err.message : String(err),
+                    ts: new Date().toISOString(),
+                }) + "\n");
+                return noopRelease;
+            }
+            try {
+                const st = await stat(lockPath);
+                if (Date.now() - st.mtimeMs > LOCK_STALE_MS) {
+                    try {
+                        await unlink(lockPath);
+                    }
+                    catch { /* another process beat us */ }
+                    continue;
+                }
+            }
+            catch {
+                continue; // lock vanished between EEXIST and stat — retry
+            }
+            if (attempt < LOCK_MAX_RETRIES) {
+                await new Promise((resolve) => setTimeout(resolve, LOCK_RETRY_DELAY_MS));
+            }
+        }
+    }
+    process.stderr.write(JSON.stringify({
+        event: "gate_audit_lock_timeout",
+        note: "Could not acquire cross-process lock. Proceeding without it (in-process mutex still active).",
+        ts: new Date().toISOString(),
+    }) + "\n");
+    return noopRelease;
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * appendAuditEntry — write a new hash-chained audit entry to the JSONL log.
+ *
+ * The entire getPrevHash → build-entry → appendFile critical section runs
+ * inside two nested locks so concurrent callers cannot race on the chain tip.
+ *
+ * Never throws — audit failures are logged to stderr but never block the gate.
+ *
+ * @param logPath   Full path to the audit JSONL file (from getConfig().audit_log_path)
+ * @param params    Gate evaluation outcome fields
+ */
+export async function appendAuditEntry(logPath, params) {
+    return runExclusive(async () => {
+        const logDir = dirname(logPath);
+        const lockPath = join(logDir, "audit.lock");
+        try {
+            await mkdir(logDir, { recursive: true });
+        }
+        catch {
+            // Ignore — will surface below if appendFile also fails
+        }
+        // Archive if the file has grown too large (non-destructive)
+        await maybeRotate(logPath);
+        const releaseLock = await acquireFileLock(lockPath);
+        try {
+            const ts = new Date().toISOString();
+            const prev_hash = await getPrevHash(logPath);
+            // Build entry without entry_hash first so we can compute it
+            const partial = {
+                audit_id: randomUUID(),
+                ts,
+                gate_version: params.gate_version,
+                type: params.type,
+                prev_hash,
+                action_sha256: sha256hex(params.action),
+                severity_tier: params.severity_tier,
+                violations: params.violations,
+                warnings: params.warnings,
+                skipped_premium: params.skipped_premium,
+                would_have_blocked: params.would_have_blocked,
+            };
+            const entry_hash = computeEntryHash(partial);
+            const entry = { ...partial, entry_hash };
+            // Extra context fields (bypass, rollback, error paths) — written verbatim
+            // AFTER hash computation so they do not affect the integrity chain.
+            if (params.extra_fields && Object.keys(params.extra_fields).length > 0) {
+                entry.extra_fields = params.extra_fields;
+            }
+            // Optional ed25519 signature — fail-open (signature absent, chain still valid)
+            const sig = await signEntry(entry_hash);
+            if (sig !== null) {
+                entry.ed25519_sig = sig;
+                entry.ed25519_pub = await getPublicKey();
+            }
+            try {
+                await appendFile(logPath, JSON.stringify(entry) + "\n", "utf8");
+            }
+            catch (writeErr) {
+                process.stderr.write(JSON.stringify({
+                    event: "gate_audit_chain_write_error",
+                    error: writeErr instanceof Error ? writeErr.message : String(writeErr),
+                    audit_id: entry.audit_id,
+                    ts,
+                }) + "\n");
+                // Fail-open: return the entry even if disk write failed
+            }
+            return entry;
+        }
+        finally {
+            await releaseLock();
+        }
+    });
+}
+/**
+ * verifyChainIntegrity — reads the audit file and verifies the prev_hash chain.
+ *
+ * Checks for:
+ *   1. First entry has prev_hash === "GENESIS"
+ *   2. Each entry's entry_hash matches recomputed hash of its content fields
+ *   3. Each entry's prev_hash === sha256(previous entry's entry_hash)
+ *   4. If ed25519_sig is present: signature over entry_hash is valid
+ *
+ * Returns { valid, entry_count, errors }.
+ * Old-format entries (no entry_hash) are skipped — they predate the chain.
+ */
+export async function verifyChainIntegrity(logPath) {
+    const errors = [];
+    let content;
+    try {
+        content = await readFile(logPath, "utf8");
+    }
+    catch {
+        return { valid: true, entry_count: 0, checked_count: 0, errors: [], chain_tip_hash: null, unsigned_count: 0 };
+    }
+    const lines = content.trim().split("\n").filter((l) => l.trim());
+    const allEntries = lines.map((l) => {
+        try {
+            return JSON.parse(l);
+        }
+        catch {
+            return null;
+        }
+    }).filter(Boolean);
+    // Only verify new-format entries that have an entry_hash
+    const chainEntries = allEntries.filter((e) => e.entry_hash);
+    let unsignedCount = 0;
+    for (let i = 0; i < chainEntries.length; i++) {
+        const entry = chainEntries[i];
+        // 1. Verify entry_hash matches recomputed value
+        const expectedHash = computeEntryHash({
+            audit_id: entry.audit_id,
+            ts: entry.ts,
+            gate_version: entry.gate_version,
+            type: entry.type,
+            prev_hash: entry.prev_hash,
+            action_sha256: entry.action_sha256,
+            severity_tier: entry.severity_tier,
+            violations: entry.violations ?? [],
+            warnings: entry.warnings ?? [],
+            skipped_premium: entry.skipped_premium ?? [],
+            would_have_blocked: entry.would_have_blocked ?? [],
+        });
+        if (entry.entry_hash !== expectedHash) {
+            errors.push(`Entry ${i} (${entry.audit_id}): entry_hash mismatch — stored ${entry.entry_hash.slice(0, 16)}… expected ${expectedHash.slice(0, 16)}…`);
+        }
+        // 2. Verify chain link
+        if (i === 0) {
+            if (entry.prev_hash !== "GENESIS") {
+                errors.push(`Entry 0 (${entry.audit_id}): first chain entry must have prev_hash="GENESIS", got "${entry.prev_hash}"`);
+            }
+        }
+        else {
+            const expected = sha256hex(chainEntries[i - 1].entry_hash);
+            if (entry.prev_hash !== expected) {
+                errors.push(`Entry ${i} (${entry.audit_id}): chain break — expected prev_hash ${expected.slice(0, 16)}…, got ${entry.prev_hash.slice(0, 16)}…`);
+            }
+        }
+        // 3. Verify ed25519 signature if present; count unsigned entries
+        if (entry.ed25519_sig && entry.ed25519_pub) {
+            const ok = verifyEntry(entry.entry_hash, entry.ed25519_sig, entry.ed25519_pub);
+            if (!ok) {
+                errors.push(`Entry ${i} (${entry.audit_id}): ed25519 signature invalid`);
+            }
+        }
+        else {
+            unsignedCount++;
+        }
+    }
+    const chainTipHash = chainEntries.length > 0
+        ? chainEntries[chainEntries.length - 1].entry_hash
+        : null;
+    return {
+        valid: errors.length === 0,
+        entry_count: allEntries.length,
+        checked_count: chainEntries.length,
+        errors,
+        chain_tip_hash: chainTipHash,
+        unsigned_count: unsignedCount,
+    };
+}
+//# sourceMappingURL=audit-chain.js.map

dist/engine/audit-chain.js.map

+{"version":3,"file":"audit-chain.js","sourceRoot":"","sources":["../../src/engine/audit-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,UAAU,EACV,KAAK,EACL,IAAI,EACJ,QAAQ,EACR,MAAM,EACN,IAAI,EACJ,MAAM,GACP,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AA2CtF,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,IAAI,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ;AACnD,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,yBAAyB;AACzD,IAAI,kBAAkB,GAAG,CAAC,CAAC;AAE3B,wDAAwD;AACxD,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,kBAAkB,GAAG,CAAC,CAAC;IACvB,kBAAkB,GAAG,CAAC,CAAC,CAAC,2BAA2B;AACrD,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,CAAqE;IAC7F,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,eAAe,EAAE,CAAC,CAAC,eAAe;QAClC,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;KACzC,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC;AAC9B,CAAC;AAED,uEAAuE;AACvE,KAAK,UAAU,WAAW,CAAC,OAAe;IACxC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAmB,CAAC;QACnE,0EAA0E;QAC1E,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvD,8DAA8D;QAC9D,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,mDAAmD;AACnD,8EAA8E;AAE9E,KAAK,UAAU,WAAW,CAAC,OAAe;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,GAAG,GAAG,kBAAkB,GAAG,eAAe;QAAE,OAAO;IACvD,kBAAkB,GAAG,GAAG,CAAC;IAEzB,IAAI,CAAC;QACH,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QAChB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO;YAC3D,MAAM,CAAC,CAAC;QACV,CAAC;QACD,IAAI,IAAI,GAAG,kBAAkB;YAAE,OAAO;QAEtC,wEAAwE;QACxE,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,GAAG,OAAO,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,oBAAoB;YAC3B,QAAQ;YACR,UAAU,EAAE,IAAI;YAChB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC7B,CAAC,GAAG,IAAI,CACV,CAAC;QACF,uEAAuE;QACvE,kBAAkB,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,6DAA6D;AAC7D,8EAA8E;AAE9E,IAAI,UAAU,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;AAErD,SAAS,YAAY,CAAI,EAAoB;IAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACzC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,mDAAmD;AACnD,8EAA8E;AAE9E,MAAM,aAAa,GAAG,MAAM,CAAC;AAC7B,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,KAAK,UAAU,eAAe,CAAC,QAAgB;IAC7C,MAAM,WAAW,GAAG,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;IAEnC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,gBAAgB,EAAE,OAAO,EAAE,EAAE,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACtC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,KAAK,IAAI,EAAE;gBAChB,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACzB,CAAC;gBAAC,MAAM,CAAC;oBACP,qDAAqD;gBACvD,CAAC;YACH,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,uBAAuB;oBAC9B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;oBACvD,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBAC7B,CAAC,GAAG,IAAI,CACV,CAAC;gBACF,OAAO,WAAW,CAAC;YACrB,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAChC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,GAAG,aAAa,EAAE,CAAC;oBAC5C,IAAI,CAAC;wBAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,6BAA6B,CAAC,CAAC;oBACvE,SAAS;gBACX,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,CAAC,gDAAgD;YAC5D,CAAC;YAED,IAAI,OAAO,GAAG,gBAAgB,EAAE,CAAC;gBAC/B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,yBAAyB;QAChC,IAAI,EAAE,8FAA8F;QACpG,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC7B,CAAC,GAAG,IAAI,CACV,CAAC;IACF,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAe,EACf,MAWC;IAED,OAAO,YAAY,CAAC,KAAK,IAAI,EAAE;QAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAE5C,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,uDAAuD;QACzD,CAAC;QAED,4DAA4D;QAC5D,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QAE3B,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACpC,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;YAE7C,4DAA4D;YAC5D,MAAM,OAAO,GAAuE;gBAClF,QAAQ,EAAE,UAAU,EAAE;gBACtB,EAAE;gBACF,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,SAAS;gBACT,aAAa,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;gBACvC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;aAC9C,CAAC;YAEF,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAE7C,MAAM,KAAK,GAAmB,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,CAAC;YAEzD,0EAA0E;YAC1E,oEAAoE;YACpE,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvE,KAAK,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;YAC3C,CAAC;YAED,+EAA+E;YAC/E,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;YACxC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,KAAK,CAAC,WAAW,GAAG,GAAG,CAAC;gBACxB,KAAK,CAAC,WAAW,GAAG,MAAM,YAAY,EAAE,CAAC;YAC3C,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;YAClE,CAAC;YAAC,OAAO,QAAQ,EAAE,CAAC;gBAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,8BAA8B;oBACrC,KAAK,EAAE,QAAQ,YAAY,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;oBACtE,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,EAAE;iBACH,CAAC,GAAG,IAAI,CACV,CAAC;gBACF,wDAAwD;YAC1D,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;gBAAS,CAAC;YACT,MAAM,WAAW,EAAE,CAAC;QACtB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAe;IAQxD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAe,CAAC;IAEpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;IAChH,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACjC,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAmB,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;IACxE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAqB,CAAC;IAEvC,yDAAyD;IACzD,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAE9B,gDAAgD;QAChD,MAAM,YAAY,GAAG,gBAAgB,CAAC;YACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,EAAE;YAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;YAC9B,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,EAAE;YAC5C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,EAAE;SACnD,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CACT,SAAS,CAAC,KAAK,KAAK,CAAC,QAAQ,mCAAmC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CACxI,CAAC;QACJ,CAAC;QAED,uBAAuB;QACvB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACZ,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAClC,MAAM,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,QAAQ,4DAA4D,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;YACxH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YAC3D,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACjC,MAAM,CAAC,IAAI,CACT,SAAS,CAAC,KAAK,KAAK,CAAC,QAAQ,uCAAuC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CACnI,CAAC;YACJ,CAAC;QACH,CAAC;QAED,iEAAiE;QACjE,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YAC3C,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;YAC/E,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,QAAQ,8BAA8B,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;aAAM,CAAC;YACN,aAAa,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAChB,YAAY,CAAC,MAAM,GAAG,CAAC;QACrB,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,UAAU;QAClD,CAAC,CAAC,IAAI,CAAC;IAEX,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,WAAW,EAAE,UAAU,CAAC,MAAM;QAC9B,aAAa,EAAE,YAAY,CAAC,MAAM;QAClC,MAAM;QACN,cAAc,EAAE,YAAY;QAC5B,cAAc,EAAE,aAAa;KAC9B,CAAC;AACJ,CAAC"}

dist/engine/crypto-ed25519.d.ts

+/**
+ * Ed25519 signing layer for @sunaiva/gate — Fault #11 / Patent Claim 1.
+ *
+ * Ported from mcp-servers/validation-gate-mcp/src/engine/crypto-bind.ts
+ * and adapted to the Gate runtime (node:crypto only — no @noble/ed25519 dep).
+ *
+ * Back-compat: the existing hmac-verifier.ts HMAC-SHA256 layer is UNCHANGED.
+ * This module ADDS ed25519 as the publicly third-party-verifiable layer.
+ * Any third party who knows only the public key (returned by getPublicKey())
+ * can verify an audit entry signature without the signing secret.
+ *
+ * Key persistence order (same resolution chain as validation-gate-mcp):
+ *   1. SUNAIVA_GATE_SIGNING_KEY env var  (hex-encoded 32-byte seed)
+ *   2. ~/.sunaiva/gate/signing.key file  (hex-encoded 32-byte seed)
+ *   3. Non-production: generate + persist; Production: FAIL-CLOSED.
+ *
+ * Security: key material never appears in logs, error messages, or test output.
+ */
+export declare const ALGORITHM = "ed25519";
+/** For tests only — reset in-process key cache. */
+export declare function resetKeyCache(): void;
+/**
+ * sha256hex — convenience SHA-256 helper.
+ * Re-exported so audit-chain.ts can keep a single shared implementation.
+ */
+export declare function sha256hex(data: string | Buffer): string;
+/**
+ * getPublicKey — returns the hex-encoded 32-byte Ed25519 public key.
+ *
+ * Include this in validate_action responses so callers can record the
+ * verification key alongside audit entries. Any third party can then call
+ * verifyEntry(entryHash, sigHex, publicKey) without any secret.
+ */
+export declare function getPublicKey(): Promise<string>;
+/**
+ * signEntry — sign a string with the Ed25519 key.
+ *
+ * Typically called with the audit entry's `entry_hash` so the signature
+ * commits to all data fields in that entry.
+ *
+ * @param data  String to sign (e.g. an entry_hash hex value).
+ * @returns     Hex-encoded 64-byte Ed25519 signature, or null on failure
+ *              (fail-open: the caller omits the ed25519_sig field).
+ */
+export declare function signEntry(data: string): Promise<string | null>;
+/**
+ * verifyEntry — verify an Ed25519 signature over a string.
+ *
+ * Pure function — never throws, returns false on any error.
+ * Suitable for use in verifyChainIntegrity() where individual failures
+ * are collected rather than thrown.
+ *
+ * @param data      The string that was originally signed (entry_hash value).
+ * @param sigHex    Hex-encoded 64-byte signature.
+ * @param pubKeyHex Hex-encoded 32-byte Ed25519 public key.
+ * @returns         true if the signature is valid.
+ */
+export declare function verifyEntry(data: string, sigHex: string, pubKeyHex: string): boolean;
+//# sourceMappingURL=crypto-ed25519.d.ts.map

dist/engine/crypto-ed25519.d.ts.map

+{"version":3,"file":"crypto-ed25519.d.ts","sourceRoot":"","sources":["../../src/engine/crypto-ed25519.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAkBH,eAAO,MAAM,SAAS,YAAY,CAAC;AAgBnC,mDAAmD;AACnD,wBAAgB,aAAa,IAAI,IAAI,CAGpC;AAkDD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAKvD;AA2FD;;;;;;GAMG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAGpD;AAED;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgBpE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAST"}

dist/engine/crypto-ed25519.js

+/**
+ * Ed25519 signing layer for @sunaiva/gate — Fault #11 / Patent Claim 1.
+ *
+ * Ported from mcp-servers/validation-gate-mcp/src/engine/crypto-bind.ts
+ * and adapted to the Gate runtime (node:crypto only — no @noble/ed25519 dep).
+ *
+ * Back-compat: the existing hmac-verifier.ts HMAC-SHA256 layer is UNCHANGED.
+ * This module ADDS ed25519 as the publicly third-party-verifiable layer.
+ * Any third party who knows only the public key (returned by getPublicKey())
+ * can verify an audit entry signature without the signing secret.
+ *
+ * Key persistence order (same resolution chain as validation-gate-mcp):
+ *   1. SUNAIVA_GATE_SIGNING_KEY env var  (hex-encoded 32-byte seed)
+ *   2. ~/.sunaiva/gate/signing.key file  (hex-encoded 32-byte seed)
+ *   3. Non-production: generate + persist; Production: FAIL-CLOSED.
+ *
+ * Security: key material never appears in logs, error messages, or test output.
+ */
+import { sign, verify, createHash, createPrivateKey, createPublicKey, randomBytes, } from "node:crypto";
+import { readFile, writeFile, mkdir } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+// ---------------------------------------------------------------------------
+// Algorithm identifier (PQC hook point — swap to "dilithium3" in v1.2)
+// ---------------------------------------------------------------------------
+export const ALGORITHM = "ed25519";
+// ---------------------------------------------------------------------------
+// Key storage path
+// ---------------------------------------------------------------------------
+const KEY_DIR = join(homedir(), ".sunaiva", "gate");
+const KEY_FILE = join(KEY_DIR, "signing.key");
+// ---------------------------------------------------------------------------
+// In-process key cache — cleared by resetKeyCache() in tests
+// ---------------------------------------------------------------------------
+let _seedHex = null;
+let _pubKeyHex = null;
+/** For tests only — reset in-process key cache. */
+export function resetKeyCache() {
+    _seedHex = null;
+    _pubKeyHex = null;
+}
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+/**
+ * Convert a 32-byte seed Buffer to a node:crypto Ed25519 private KeyObject.
+ *
+ * Uses PKCS#8 DER encoding (RFC 8410 / RFC 5958).
+ * The 16-byte prefix = PKCS#8 outer SEQUENCE + INTEGER 0 (version) +
+ * AlgorithmIdentifier SEQUENCE with Ed25519 OID (1.3.101.112) + OCTET STRING wrapper.
+ * Appending the 32-byte seed produces a valid 48-byte DER private key.
+ */
+function seedToPrivateKey(seed) {
+    const der = Buffer.concat([
+        Buffer.from("302e020100300506032b657004220420", "hex"), // PKCS#8 DER prefix
+        seed,
+    ]);
+    return createPrivateKey({ key: der, format: "der", type: "pkcs8" });
+}
+/**
+ * Convert a hex-encoded 32-byte raw public key to a node:crypto KeyObject.
+ *
+ * Uses SubjectPublicKeyInfo (SPKI) DER encoding (RFC 8410).
+ * 12-byte prefix = SPKI SEQUENCE + AlgorithmIdentifier with Ed25519 OID +
+ * BIT STRING tag/length/unused-bits. Total SPKI = 44 bytes.
+ */
+function pubHexToKeyObject(pubKeyHex) {
+    const spki = Buffer.concat([
+        Buffer.from("302a300506032b6570032100", "hex"), // SPKI DER prefix
+        Buffer.from(pubKeyHex, "hex"),
+    ]);
+    return createPublicKey({ key: spki, format: "der", type: "spki" });
+}
+/**
+ * pubKeyObjectToHex — extract the raw 32-byte Ed25519 public key as hex.
+ *
+ * TypeScript's @types/node does not expose format:"raw" for asymmetric keys
+ * (it is only valid for symmetric secret keys). We use JWK export instead:
+ * the `x` field in an Ed25519 JWK is the base64url-encoded 32-byte raw key.
+ */
+function pubKeyObjectToHex(pub) {
+    const jwk = pub.export({ format: "jwk" });
+    if (!jwk.x)
+        throw new Error("Ed25519 JWK missing x field");
+    return Buffer.from(jwk.x, "base64url").toString("hex");
+}
+/**
+ * sha256hex — convenience SHA-256 helper.
+ * Re-exported so audit-chain.ts can keep a single shared implementation.
+ */
+export function sha256hex(data) {
+    const h = createHash("sha256");
+    if (typeof data === "string")
+        h.update(data, "utf8");
+    else
+        h.update(data);
+    return h.digest("hex");
+}
+// ---------------------------------------------------------------------------
+// Key resolution: env → file → generate+persist (non-prod) / FAIL (prod)
+// ---------------------------------------------------------------------------
+async function loadOrCreateKey() {
+    // 1. Environment variable
+    const envKey = process.env.SUNAIVA_GATE_SIGNING_KEY;
+    if (envKey) {
+        const seed = Buffer.from(envKey, "hex");
+        if (seed.length !== 32) {
+            throw new Error("SUNAIVA_GATE_SIGNING_KEY must be 64 hex chars (32 bytes). Key omitted from log.");
+        }
+        const priv = seedToPrivateKey(seed);
+        const pub = createPublicKey(priv);
+        return { seedHex: envKey, pubKeyHex: pubKeyObjectToHex(pub) };
+    }
+    // 2. Persistent key file
+    try {
+        const stored = (await readFile(KEY_FILE, "utf8")).trim();
+        const seed = Buffer.from(stored, "hex");
+        if (seed.length !== 32) {
+            throw new Error(`Signing key at ${KEY_FILE} is corrupt (expected 64 hex chars). Delete and restart to regenerate.`);
+        }
+        const priv = seedToPrivateKey(seed);
+        const pub = createPublicKey(priv);
+        return { seedHex: stored, pubKeyHex: pubKeyObjectToHex(pub) };
+    }
+    catch (err) {
+        if (err.code !== "ENOENT")
+            throw err;
+    }
+    // 3. No key found — fail-closed in production
+    if (process.env.NODE_ENV === "production") {
+        throw new Error("FATAL: No Ed25519 signing key available. " +
+            "Set SUNAIVA_GATE_SIGNING_KEY or create " +
+            KEY_FILE +
+            ". Refusing to issue unsigned proofs.");
+    }
+    // Non-production: generate + persist
+    const seed = randomBytes(32);
+    const seedHex = seed.toString("hex");
+    const priv = seedToPrivateKey(seed);
+    const pub = createPublicKey(priv);
+    const pubKeyHex = pubKeyObjectToHex(pub);
+    try {
+        await mkdir(KEY_DIR, { recursive: true });
+        await writeFile(KEY_FILE, seedHex, { encoding: "utf8", mode: 0o600 });
+        process.stderr.write(JSON.stringify({
+            event: "gate_signing_key_generated",
+            key_path: KEY_FILE,
+            note: "New Ed25519 signing key generated and persisted. Set SUNAIVA_GATE_SIGNING_KEY in production.",
+            ts: new Date().toISOString(),
+        }) + "\n");
+    }
+    catch (writeErr) {
+        process.stderr.write(JSON.stringify({
+            event: "gate_signing_key_persist_failed",
+            error: writeErr instanceof Error ? writeErr.message : String(writeErr),
+            note: "Could not persist signing key. Key is ephemeral for this session.",
+            ts: new Date().toISOString(),
+        }) + "\n");
+    }
+    return { seedHex, pubKeyHex };
+}
+async function getKeys() {
+    if (_seedHex && _pubKeyHex)
+        return { seedHex: _seedHex, pubKeyHex: _pubKeyHex };
+    const keys = await loadOrCreateKey();
+    _seedHex = keys.seedHex;
+    _pubKeyHex = keys.pubKeyHex;
+    return keys;
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * getPublicKey — returns the hex-encoded 32-byte Ed25519 public key.
+ *
+ * Include this in validate_action responses so callers can record the
+ * verification key alongside audit entries. Any third party can then call
+ * verifyEntry(entryHash, sigHex, publicKey) without any secret.
+ */
+export async function getPublicKey() {
+    const { pubKeyHex } = await getKeys();
+    return pubKeyHex;
+}
+/**
+ * signEntry — sign a string with the Ed25519 key.
+ *
+ * Typically called with the audit entry's `entry_hash` so the signature
+ * commits to all data fields in that entry.
+ *
+ * @param data  String to sign (e.g. an entry_hash hex value).
+ * @returns     Hex-encoded 64-byte Ed25519 signature, or null on failure
+ *              (fail-open: the caller omits the ed25519_sig field).
+ */
+export async function signEntry(data) {
+    try {
+        const { seedHex } = await getKeys();
+        const privKey = seedToPrivateKey(Buffer.from(seedHex, "hex"));
+        const sig = sign(null, Buffer.from(data, "utf8"), privKey);
+        return sig.toString("hex");
+    }
+    catch (err) {
+        process.stderr.write(JSON.stringify({
+            event: "gate_ed25519_sign_failed",
+            error: err instanceof Error ? err.message : String(err),
+            ts: new Date().toISOString(),
+        }) + "\n");
+        return null;
+    }
+}
+/**
+ * verifyEntry — verify an Ed25519 signature over a string.
+ *
+ * Pure function — never throws, returns false on any error.
+ * Suitable for use in verifyChainIntegrity() where individual failures
+ * are collected rather than thrown.
+ *
+ * @param data      The string that was originally signed (entry_hash value).
+ * @param sigHex    Hex-encoded 64-byte signature.
+ * @param pubKeyHex Hex-encoded 32-byte Ed25519 public key.
+ * @returns         true if the signature is valid.
+ */
+export function verifyEntry(data, sigHex, pubKeyHex) {
+    try {
+        const pubKey = pubHexToKeyObject(pubKeyHex);
+        const dataBytes = Buffer.from(data, "utf8");
+        const sigBytes = Buffer.from(sigHex, "hex");
+        return verify(null, dataBytes, pubKey, sigBytes);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=crypto-ed25519.js.map

dist/engine/crypto-ed25519.js.map

+{"version":3,"file":"crypto-ed25519.js","sourceRoot":"","sources":["../../src/engine/crypto-ed25519.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACL,IAAI,EACJ,MAAM,EACN,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAE9E,MAAM,CAAC,MAAM,SAAS,GAAG,SAAS,CAAC;AAEnC,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;AACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAE9C,8EAA8E;AAC9E,6DAA6D;AAC7D,8EAA8E;AAE9E,IAAI,QAAQ,GAAkB,IAAI,CAAC;AACnC,IAAI,UAAU,GAAkB,IAAI,CAAC;AAErC,mDAAmD;AACnD,MAAM,UAAU,aAAa;IAC3B,QAAQ,GAAG,IAAI,CAAC;IAChB,UAAU,GAAG,IAAI,CAAC;AACpB,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC,EAAE,oBAAoB;QAC5E,IAAI;KACL,CAAC,CAAC;IACH,OAAO,gBAAgB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,EAAE,kBAAkB;QAClE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC;KAC9B,CAAC,CAAC;IACH,OAAO,eAAe,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,GAAuC;IAChE,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,IAAqB;IAC7C,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;;QAChD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpB,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAE9E,KAAK,UAAU,eAAe;IAC5B,0BAA0B;IAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;IACpD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;IAChE,CAAC;IAED,yBAAyB;IACzB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,wEAAwE,CACnG,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;IAED,8CAA8C;IAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,2CAA2C;YACzC,yCAAyC;YACzC,QAAQ;YACR,sCAAsC,CACzC,CAAC;IACJ,CAAC;IAED,qCAAqC;IACrC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAEzC,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,4BAA4B;YACnC,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,8FAA8F;YACpG,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC7B,CAAC,GAAG,IAAI,CACV,CAAC;IACJ,CAAC;IAAC,OAAO,QAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,iCAAiC;YACxC,KAAK,EAAE,QAAQ,YAAY,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;YACtE,IAAI,EAAE,mEAAmE;YACzE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC7B,CAAC,GAAG,IAAI,CACV,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,OAAO;IACpB,IAAI,QAAQ,IAAI,UAAU;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;IAChF,MAAM,IAAI,GAAG,MAAM,eAAe,EAAE,CAAC;IACrC,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;IACxB,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;IACtC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY;IAC1C,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;QAC3D,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,0BAA0B;YACjC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACvD,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC7B,CAAC,GAAG,IAAI,CACV,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CACzB,IAAY,EACZ,MAAc,EACd,SAAiB;IAEjB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC5C,OAAO,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

dist/installer/cli-args.d.ts

+/**
+ * Pure argument parser for the `--install` / `install` CLI command (U3).
+ *
+ * Isolated from src/index.ts so tests can import this module without
+ * triggering the MCP server startup side-effect at the bottom of that file.
+ *
+ * Pattern: argv.includes / argv.indexOf — no third-party arg parser.
+ * Mirrors the convention used for --mcp-bridge and --ship-confidence in index.ts.
+ */
+import type { InstallOptions, InstallResult } from "./install.js";
+/**
+ * Parse install-command flags from a process.argv slice (process.argv.slice(2)).
+ * Returns an InstallOptions object; absent flags leave optional fields undefined,
+ * matching the InstallOptions signature exactly.
+ */
+export declare function parseInstallArgs(argv: string[]): InstallOptions;
+/**
+ * Derive the CLI exit code from an installAll() result array.
+ *   0 = all agents succeeded (or no agents targeted)
+ *   1 = at least one per-agent failure (r.error is set)
+ *
+ * exit 2 = unhandled exception thrown by installAll() itself; handled in main().
+ */
+export declare function computeInstallExitCode(results: Pick<InstallResult, "error">[]): 0 | 1;
+/**
+ * Build the summary line printed after formatResults().
+ * Format: "N agent(s) configured, M failed."
+ */
+export declare function buildInstallSummary(results: Pick<InstallResult, "error">[]): string;
+//# sourceMappingURL=cli-args.d.ts.map

dist/installer/cli-args.d.ts.map

+{"version":3,"file":"cli-args.d.ts","sourceRoot":"","sources":["../../src/installer/cli-args.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElE;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,cAAc,CAkB/D;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,GACtC,CAAC,GAAG,CAAC,CAEP;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,GACtC,MAAM,CAIR"}

dist/installer/cli-args.js

+/**
+ * Pure argument parser for the `--install` / `install` CLI command (U3).
+ *
+ * Isolated from src/index.ts so tests can import this module without
+ * triggering the MCP server startup side-effect at the bottom of that file.
+ *
+ * Pattern: argv.includes / argv.indexOf — no third-party arg parser.
+ * Mirrors the convention used for --mcp-bridge and --ship-confidence in index.ts.
+ */
+/**
+ * Parse install-command flags from a process.argv slice (process.argv.slice(2)).
+ * Returns an InstallOptions object; absent flags leave optional fields undefined,
+ * matching the InstallOptions signature exactly.
+ */
+export function parseInstallArgs(argv) {
+    const dryRun = argv.includes("--dry-run");
+    const detectedOnly = argv.includes("--detected-only");
+    const agentsIdx = argv.indexOf("--agents");
+    const agents = agentsIdx !== -1 && argv[agentsIdx + 1]
+        ? argv[agentsIdx + 1]
+            .split(",")
+            .map((s) => s.trim())
+            .filter(Boolean)
+        : undefined;
+    const mcpEpIdx = argv.indexOf("--mcp-endpoint");
+    const mcpEndpoint = mcpEpIdx !== -1 && argv[mcpEpIdx + 1] ? argv[mcpEpIdx + 1] : undefined;
+    return { dryRun, detectedOnly, agents, mcpEndpoint };
+}
+/**
+ * Derive the CLI exit code from an installAll() result array.
+ *   0 = all agents succeeded (or no agents targeted)
+ *   1 = at least one per-agent failure (r.error is set)
+ *
+ * exit 2 = unhandled exception thrown by installAll() itself; handled in main().
+ */
+export function computeInstallExitCode(results) {
+    return results.some((r) => r.error !== undefined) ? 1 : 0;
+}
+/**
+ * Build the summary line printed after formatResults().
+ * Format: "N agent(s) configured, M failed."
+ */
+export function buildInstallSummary(results) {
+    const failed = results.filter((r) => r.error !== undefined).length;
+    const ok = results.length - failed;
+    return `${ok} agent(s) configured, ${failed} failed.`;
+}
+//# sourceMappingURL=cli-args.js.map

dist/installer/cli-args.js.map

+{"version":3,"file":"cli-args.js","sourceRoot":"","sources":["../../src/installer/cli-args.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAc;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAEtD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,MAAM,GACV,SAAS,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;QACrC,CAAC,CAAE,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;aACjB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAiB;QACpC,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAChD,MAAM,WAAW,GACf,QAAQ,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEzE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAuC;IAEvC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAuC;IAEvC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IACnE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;IACnC,OAAO,GAAG,EAAE,yBAAyB,MAAM,UAAU,CAAC;AACxD,CAAC"}

dist/middleware.cjs

+'use strict';
+/**
+ * dist/middleware.cjs — CJS companion for @sunaiva/gate/middleware.
+ * Auto-generated by scripts/build-middleware-cjs.cjs — do not edit directly.
+ *
+ * Resolves to @sunaiva/gate/middleware when required() from CommonJS.
+ * The package.json exports map selects this file for the "require" condition.
+ *
+ * CI smoke test (run from sunaiva-gate/ after build):
+ *   node --input-type=commonjs -e "const {withGate}=require('./dist/middleware.cjs'); console.log(typeof withGate)"
+ *   Expected output: function
+ */
+const path = require('path');
+const _impl = require(path.join(__dirname, "../../mcp-servers/sunaiva-gate-backend/connectors/hermes/gate-middleware.js"));
+module.exports = {
+  withGate: _impl.withGate,
+  MIDDLEWARE_VERSION: _impl.MIDDLEWARE_VERSION,
+};

dist/middleware.d.ts

+/**
+ * middleware.ts — ESM re-export of the withGate Hermes middleware for the
+ * @sunaiva/gate npm dual-package.
+ *
+ * Consumers using ESM:
+ *   import { withGate, MIDDLEWARE_VERSION } from '@sunaiva/gate/middleware';
+ *
+ * Consumers using CJS (Node.js require):
+ *   const { withGate } = require('@sunaiva/gate/middleware');
+ *   // resolves to dist/middleware.cjs via the package.json exports map.
+ *
+ * The canonical implementation lives in:
+ *   mcp-servers/sunaiva-gate-backend/connectors/hermes/gate-middleware.js
+ * This file is the typed ESM surface for the published npm package.
+ *
+ * ENFORCEMENT MODES (as of v2.0.0 — enforce is the default):
+ *   'enforce'  (default since v2.0.0) — hard-block on BLOCK_DECISIONS ('deny', 'degraded').
+ *   'shadow'   — emit obs event but never block. Safe rollout / escape hatch.
+ *   'advisory' — emit advisory_warn obs but never block. For staged rollout.
+ *
+ * Env escape hatch: set SUNAIVA_GATE_MODE=shadow to restore the v1.x non-blocking
+ * default without any code changes (zero-code migration path for existing embedders).
+ * See MIGRATION.md §v1.x→v2.0.0: callers that relied on shadow-default must add
+ * mode:'shadow' or set SUNAIVA_GATE_MODE=shadow.
+ */
+/** Result returned by every withGate() call. */
+export interface GateResult {
+    /** true only in enforce mode when a BLOCK_DECISIONS verdict is received. */
+    blocked: boolean;
+    /**
+     * Set to true on all fail-open paths (network error, timeout, non-2xx,
+     * JSON parse error, missing API key). A gate bug must NEVER brick the agent
+     * (hook_discipline_001).
+     */
+    failOpen?: boolean;
+    /** Human-readable reason for the block or fail-open. */
+    reason?: string;
+}
+/** Optional overrides for a withGate() call. */
+export interface WithGateOptions {
+    /** Override the gatehooks endpoint URL (for tests or staging). */
+    url?: string;
+    /** Override request timeout in milliseconds (default 4000). */
+    timeout?: number;
+    /** Additional context forwarded verbatim to the backend. */
+    context?: object;
+    /** Retries on 5xx responses only (default 1). No retry on timeouts or 4xx. */
+    retries?: number;
+    /** Agent identifier — appears as the 'agent' field in observability events. */
+    agentId?: string;
+    /** Session identifier — appears as the 'session_id' field in obs events. */
+    sessionId?: string;
+    /**
+     * Gate enforcement mode (default: 'enforce' since v2.0.0).
+     *
+     * - 'enforce'  : hard-block on BLOCK_DECISIONS (deny, degraded). **Default since v2.0.0.**
+     * - 'shadow'   : emit obs event but NEVER block. Safe rollout / escape hatch.
+     * - 'advisory' : emit advisory_warn obs but NEVER block. For staged rollout.
+     *
+     * Priority: opts.mode (explicit) > SUNAIVA_GATE_MODE env var > 'enforce' (hardened default).
+     * Set SUNAIVA_GATE_MODE=shadow at the container level to restore the v1.x non-blocking
+     * behaviour without changing any call sites. See MIGRATION.md §v1.x→v2.0.0.
+     */
+    mode?: 'shadow' | 'advisory' | 'enforce';
+}
+/**
+ * withGate — pre-flight gate check for a Hermes/Storm tool call.
+ *
+ * @example
+ * const { blocked, reason } = await withGate('financial', inputText, sgkKey, {
+ *   mode: 'enforce',
+ * });
+ * if (blocked) return { error: `Tool blocked: ${reason}` };
+ */
+export declare const withGate: (toolName: string | string[], inputText: string, sgkKey: string, opts?: WithGateOptions) => Promise<GateResult>;
+/** Semver of the gate middleware — included in every observability event. */
+export declare const MIDDLEWARE_VERSION: string;
+//# sourceMappingURL=middleware.d.ts.map

dist/middleware.js

+/**
+ * middleware.ts — ESM re-export of the withGate Hermes middleware for the
+ * @sunaiva/gate npm dual-package.
+ *
+ * Consumers using ESM:
+ *   import { withGate, MIDDLEWARE_VERSION } from '@sunaiva/gate/middleware';
+ *
+ * Consumers using CJS (Node.js require):
+ *   const { withGate } = require('@sunaiva/gate/middleware');
+ *   // resolves to dist/middleware.cjs via the package.json exports map.
+ *
+ * The canonical implementation lives in:
+ *   mcp-servers/sunaiva-gate-backend/connectors/hermes/gate-middleware.js
+ * This file is the typed ESM surface for the published npm package.
+ *
+ * ENFORCEMENT MODES (as of v2.0.0 — enforce is the default):
+ *   'enforce'  (default since v2.0.0) — hard-block on BLOCK_DECISIONS ('deny', 'degraded').
+ *   'shadow'   — emit obs event but never block. Safe rollout / escape hatch.
+ *   'advisory' — emit advisory_warn obs but never block. For staged rollout.
+ *
+ * Env escape hatch: set SUNAIVA_GATE_MODE=shadow to restore the v1.x non-blocking
+ * default without any code changes (zero-code migration path for existing embedders).
+ * See MIGRATION.md §v1.x→v2.0.0: callers that relied on shadow-default must add
+ * mode:'shadow' or set SUNAIVA_GATE_MODE=shadow.
+ */
+import { createRequire } from 'module';
+// Load the CJS gate-middleware implementation via createRequire interop.
+// In the monorepo context this resolves to the source gate-middleware.js.
+// The published npm package exposes this via the package.json exports map.
+const _require = createRequire(import.meta.url);
+const _mod = _require('../../mcp-servers/sunaiva-gate-backend/connectors/hermes/gate-middleware.js');
+// ---------------------------------------------------------------------------
+// Typed re-exports from the CJS implementation
+// ---------------------------------------------------------------------------
+/**
+ * withGate — pre-flight gate check for a Hermes/Storm tool call.
+ *
+ * @example
+ * const { blocked, reason } = await withGate('financial', inputText, sgkKey, {
+ *   mode: 'enforce',
+ * });
+ * if (blocked) return { error: `Tool blocked: ${reason}` };
+ */
+export const withGate = _mod.withGate;
+/** Semver of the gate middleware — included in every observability event. */
+export const MIDDLEWARE_VERSION = _mod.MIDDLEWARE_VERSION;
+//# sourceMappingURL=middleware.js.map

dist/tools/custom-rules.d.ts

+/**
+ * MCP tool handlers for custom-rule CRUD control-plane operations (U4).
+ *
+ * All handlers return { content: [{ type: "text", text: JSON.stringify(result) }] }
+ * and never throw — errors are serialised into the JSON response.
+ */
+import { BackendClient } from "../engine/backend-client.js";
+type ToolResult = {
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+};
+/**
+ * add_custom_rule — POST /v1/rules/custom
+ * Adds a new custom detection rule (Pro+).
+ */
+export declare function handleAddCustomRule(args: {
+    name?: string;
+    description?: string;
+    pattern?: string;
+    detection_pattern?: string;
+    severity?: string;
+    tier?: string;
+}, client?: BackendClient): Promise<ToolResult>;
+/**
+ * update_custom_rule — PUT /v1/rules/custom/:id
+ * Updates an existing custom rule (Pro+).
+ */
+export declare function handleUpdateCustomRule(args: {
+    id?: string;
+    name?: string;
+    description?: string;
+    pattern?: string;
+    detection_pattern?: string;
+    severity?: string;
+    tier?: string;
+}, client?: BackendClient): Promise<ToolResult>;
+/**
+ * delete_custom_rule — DELETE /v1/rules/custom/:id
+ * Deletes a custom rule (Pro+).
+ */
+export declare function handleDeleteCustomRule(args: {
+    id?: string;
+}, client?: BackendClient): Promise<ToolResult>;
+/**
+ * list_custom_rules — GET /v1/rules/custom
+ * Lists all custom rules for the authenticated customer (Pro+).
+ */
+export declare function handleListCustomRules(_args: Record<string, unknown>, client?: BackendClient): Promise<ToolResult>;
+export {};
+//# sourceMappingURL=custom-rules.d.ts.map

dist/tools/custom-rules.d.ts.map

+{"version":3,"file":"custom-rules.d.ts","sourceRoot":"","sources":["../../src/tools/custom-rules.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAG5D,KAAK,UAAU,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC;AAQrE;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE;IACJ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,EACD,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAuBrB;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE;IACJ,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,EACD,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAmBrB;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,EACrB,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAWrB;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAQrB"}

dist/tools/custom-rules.js

+/**
+ * MCP tool handlers for custom-rule CRUD control-plane operations (U4).
+ *
+ * All handlers return { content: [{ type: "text", text: JSON.stringify(result) }] }
+ * and never throw — errors are serialised into the JSON response.
+ */
+import { BackendClient } from "../engine/backend-client.js";
+function ok(data) {
+    return { content: [{ type: "text", text: JSON.stringify(data) }] };
+}
+/**
+ * add_custom_rule — POST /v1/rules/custom
+ * Adds a new custom detection rule (Pro+).
+ */
+export async function handleAddCustomRule(args, client) {
+    if (!args.name) {
+        return ok({ error: "name is required for add_custom_rule" });
+    }
+    const validSeverities = ["block", "warn", "log"];
+    if (!args.severity || !validSeverities.includes(args.severity)) {
+        return ok({ error: `severity must be one of: ${validSeverities.join(", ")}` });
+    }
+    const rule = {
+        name: args.name,
+        severity: args.severity,
+        ...(args.description ? { description: args.description } : {}),
+        ...(args.pattern ? { pattern: args.pattern } : {}),
+        ...(args.detection_pattern ? { detection_pattern: args.detection_pattern } : {}),
+        ...(args.tier ? { tier: args.tier } : {}),
+    };
+    const bc = client ?? new BackendClient();
+    try {
+        const result = await bc.addCustomRule(rule);
+        return ok(result);
+    }
+    catch {
+        return ok({ error: "unexpected error in add_custom_rule", skipped: true });
+    }
+}
+/**
+ * update_custom_rule — PUT /v1/rules/custom/:id
+ * Updates an existing custom rule (Pro+).
+ */
+export async function handleUpdateCustomRule(args, client) {
+    if (!args.id) {
+        return ok({ error: "id is required for update_custom_rule" });
+    }
+    const update = {};
+    if (args.name !== undefined)
+        update.name = args.name;
+    if (args.description !== undefined)
+        update.description = args.description;
+    if (args.pattern !== undefined)
+        update.pattern = args.pattern;
+    if (args.detection_pattern !== undefined)
+        update.detection_pattern = args.detection_pattern;
+    if (args.severity !== undefined)
+        update.severity = args.severity;
+    if (args.tier !== undefined)
+        update.tier = args.tier;
+    const bc = client ?? new BackendClient();
+    try {
+        const result = await bc.updateCustomRule(args.id, update);
+        return ok(result);
+    }
+    catch {
+        return ok({ error: "unexpected error in update_custom_rule", skipped: true });
+    }
+}
+/**
+ * delete_custom_rule — DELETE /v1/rules/custom/:id
+ * Deletes a custom rule (Pro+).
+ */
+export async function handleDeleteCustomRule(args, client) {
+    if (!args.id) {
+        return ok({ error: "id is required for delete_custom_rule" });
+    }
+    const bc = client ?? new BackendClient();
+    try {
+        const result = await bc.deleteCustomRule(args.id);
+        return ok(result);
+    }
+    catch {
+        return ok({ error: "unexpected error in delete_custom_rule", skipped: true });
+    }
+}
+/**
+ * list_custom_rules — GET /v1/rules/custom
+ * Lists all custom rules for the authenticated customer (Pro+).
+ */
+export async function handleListCustomRules(_args, client) {
+    const bc = client ?? new BackendClient();
+    try {
+        const result = await bc.listCustomRules();
+        return ok(result);
+    }
+    catch {
+        return ok({ error: "unexpected error in list_custom_rules", skipped: true });
+    }
+}
+//# sourceMappingURL=custom-rules.js.map

dist/tools/custom-rules.js.map

+{"version":3,"file":"custom-rules.js","sourceRoot":"","sources":["../../src/tools/custom-rules.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAK5D,SAAS,EAAE,CAAC,IAAa;IACvB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9E,CAAC;AAID;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAOC,EACD,MAAsB;IAEtB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,4BAA4B,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,IAAI,GAAkB;QAC1B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,IAAI,CAAC,QAAkC;QACjD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;IACF,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC5C,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAQC,EACD,MAAsB;IAEtB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,MAAM,GAAoC,EAAE,CAAC;IACnD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACrD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;QAAE,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IAC1E,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;QAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9D,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS;QAAE,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC;IAC5F,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;QAAE,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAkC,CAAC;IAC3F,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IAErD,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1D,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAqB,EACrB,MAAsB;IAEtB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClD,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAA8B,EAC9B,MAAsB;IAEtB,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,eAAe,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC"}

dist/tools/modes.d.ts

+/**
+ * MCP tool handlers for rule-mode control-plane operations (U4).
+ *
+ * All handlers return { content: [{ type: "text", text: JSON.stringify(result) }] }
+ * and never throw — errors are serialised into the JSON response.
+ */
+import { BackendClient } from "../engine/backend-client.js";
+type ToolResult = {
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+};
+/**
+ * set_rule_mode — PUT /v1/rules/modes
+ * Sets enforcement mode for a specific rule (Pro+).
+ */
+export declare function handleSetRuleMode(args: {
+    rule_id?: string;
+    mode?: string;
+    agent_id?: string;
+}, client?: BackendClient): Promise<ToolResult>;
+/**
+ * get_rule_modes — GET /v1/rules/modes
+ * Lists all mode overrides for the authenticated customer.
+ */
+export declare function handleGetRuleModes(_args: Record<string, unknown>, client?: BackendClient): Promise<ToolResult>;
+/**
+ * reset_rule_mode — DELETE /v1/rules/modes/:rule_id
+ * Removes a mode override for a specific rule, reverting to default.
+ */
+export declare function handleResetRuleMode(args: {
+    rule_id?: string;
+}, client?: BackendClient): Promise<ToolResult>;
+export {};
+//# sourceMappingURL=modes.d.ts.map

dist/tools/modes.d.ts.map

+{"version":3,"file":"modes.d.ts","sourceRoot":"","sources":["../../src/tools/modes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAG5D,KAAK,UAAU,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC;AAMrE;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,EAC5D,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAmBrB;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAQrB;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,EAC1B,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAWrB"}

dist/tools/modes.js

+/**
+ * MCP tool handlers for rule-mode control-plane operations (U4).
+ *
+ * All handlers return { content: [{ type: "text", text: JSON.stringify(result) }] }
+ * and never throw — errors are serialised into the JSON response.
+ */
+import { BackendClient } from "../engine/backend-client.js";
+function ok(data) {
+    return { content: [{ type: "text", text: JSON.stringify(data) }] };
+}
+/**
+ * set_rule_mode — PUT /v1/rules/modes
+ * Sets enforcement mode for a specific rule (Pro+).
+ */
+export async function handleSetRuleMode(args, client) {
+    if (!args.rule_id) {
+        return ok({ error: "rule_id is required" });
+    }
+    const validModes = ["shadow", "advisory", "enforce"];
+    if (!args.mode || !validModes.includes(args.mode)) {
+        return ok({ error: `mode must be one of: ${validModes.join(", ")}` });
+    }
+    const bc = client ?? new BackendClient();
+    try {
+        const result = await bc.setMode(args.rule_id, args.mode, args.agent_id);
+        return ok(result);
+    }
+    catch {
+        return ok({ error: "unexpected error in set_rule_mode", skipped: true });
+    }
+}
+/**
+ * get_rule_modes — GET /v1/rules/modes
+ * Lists all mode overrides for the authenticated customer.
+ */
+export async function handleGetRuleModes(_args, client) {
+    const bc = client ?? new BackendClient();
+    try {
+        const result = await bc.getModes();
+        return ok(result);
+    }
+    catch {
+        return ok({ error: "unexpected error in get_rule_modes", skipped: true });
+    }
+}
+/**
+ * reset_rule_mode — DELETE /v1/rules/modes/:rule_id
+ * Removes a mode override for a specific rule, reverting to default.
+ */
+export async function handleResetRuleMode(args, client) {
+    if (!args.rule_id) {
+        return ok({ error: "rule_id is required" });
+    }
+    const bc = client ?? new BackendClient();
+    try {
+        const result = await bc.resetMode(args.rule_id);
+        return ok(result);
+    }
+    catch {
+        return ok({ error: "unexpected error in reset_rule_mode", skipped: true });
+    }
+}
+//# sourceMappingURL=modes.js.map

dist/tools/modes.js.map

+{"version":3,"file":"modes.js","sourceRoot":"","sources":["../../src/tools/modes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAK5D,SAAS,EAAE,CAAC,IAAa;IACvB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAA4D,EAC5D,MAAsB;IAEtB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,UAAU,GAA8B,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAChF,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAA0B,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,wBAAwB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC7B,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,IAA0B,EAC/B,IAAI,CAAC,QAAQ,CACd,CAAC;QACF,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAA8B,EAC9B,MAAsB;IAEtB,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA0B,EAC1B,MAAsB;IAEtB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChD,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC"}

dist/tools/presets.d.ts

+/**
+ * MCP tool handlers for preset-bundle control-plane operations (U4).
+ *
+ * All handlers return { content: [{ type: "text", text: JSON.stringify(result) }] }
+ * and never throw — errors are serialised into the JSON response.
+ */
+import { BackendClient } from "../engine/backend-client.js";
+type ToolResult = {
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+};
+/**
+ * list_presets — GET /v1/rules/presets
+ * Lists available rule preset bundles (Dev+).
+ */
+export declare function handleListPresets(_args: Record<string, unknown>, client?: BackendClient): Promise<ToolResult>;
+/**
+ * apply_preset — POST /v1/rules/presets/:id/apply
+ * Applies a preset bundle, setting all included rule IDs to enforce mode (Pro+).
+ */
+export declare function handleApplyPreset(args: {
+    preset_id?: string;
+}, client?: BackendClient): Promise<ToolResult>;
+export {};
+//# sourceMappingURL=presets.d.ts.map

dist/tools/presets.d.ts.map

+{"version":3,"file":"presets.d.ts","sourceRoot":"","sources":["../../src/tools/presets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5D,KAAK,UAAU,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC;AAMrE;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAQrB;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EAC5B,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAWrB"}

dist/tools/presets.js

+/**
+ * MCP tool handlers for preset-bundle control-plane operations (U4).
+ *
+ * All handlers return { content: [{ type: "text", text: JSON.stringify(result) }] }
+ * and never throw — errors are serialised into the JSON response.
+ */
+import { BackendClient } from "../engine/backend-client.js";
+function ok(data) {
+    return { content: [{ type: "text", text: JSON.stringify(data) }] };
+}
+/**
+ * list_presets — GET /v1/rules/presets
+ * Lists available rule preset bundles (Dev+).
+ */
+export async function handleListPresets(_args, client) {
+    const bc = client ?? new BackendClient();
+    try {
+        const result = await bc.listPresets();
+        return ok(result);
+    }
+    catch {
+        return ok({ error: "unexpected error in list_presets", skipped: true });
+    }
+}
+/**
+ * apply_preset — POST /v1/rules/presets/:id/apply
+ * Applies a preset bundle, setting all included rule IDs to enforce mode (Pro+).
+ */
+export async function handleApplyPreset(args, client) {
+    if (!args.preset_id) {
+        return ok({ error: "preset_id is required for apply_preset" });
+    }
+    const bc = client ?? new BackendClient();
+    try {
+        const result = await bc.applyPreset(args.preset_id);
+        return ok(result);
+    }
+    catch {
+        return ok({ error: "unexpected error in apply_preset", skipped: true });
+    }
+}
+//# sourceMappingURL=presets.js.map

dist/tools/presets.js.map

+{"version":3,"file":"presets.js","sourceRoot":"","sources":["../../src/tools/presets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAI5D,SAAS,EAAE,CAAC,IAAa;IACvB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAA8B,EAC9B,MAAsB;IAEtB,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC;QACtC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAA4B,EAC5B,MAAsB;IAEtB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpD,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC"}

BUSINESS_LICENSE.md

@@ -28,8 +28,9 @@ # Business Source License — `@sunaiva/gate`
 
-- **Change Date**: **2030-05-10** (4 years after the first publication of
-  `@sunaiva/gate` on the npm registry — version `1.0.0`, 2026-05-10).
+- **Change Date**: **2030-06-30** (4 years from the `@sunaiva/gate@2.0.0`
+  publication. Per Rule 43 each version carries its own 4-year clock from its
+  own publish date; finalized to the exact publish-date + 4 years at npm publish).
 - **Change License**: **Apache License, Version 2.0** (chosen for its broad
   compatibility, explicit patent grant, and standing as the most common
   conversion target for BUSL-licensed projects).
-- **Current version**: `1.1.0` ("Foundation Release"), 2026-05-12 — the first
+- **Current version**: `2.0.0` ("Foundation Release"), 2026-05-12 — the first
   release with the full constitutional rule set enforced locally and the Ship
@@ -62,3 +63,3 @@ Confidence Gate MCP tool wired. The `1.0.x` releases are deprecated on npm
 status is **independent** of any clock in this repository. When the
-`@sunaiva/gate` wrapper converts to Apache-2.0 on 2030-05-10, the backend
+`@sunaiva/gate` wrapper converts to Apache-2.0 on 2030-06-30, the backend
 remains commercial and proprietary — only the wrapper code's licence
@@ -65,0 +66,0 @@ changes. Customers relying on backend-tier features will continue to need a

CHANGELOG.md

@@ -7,2 +7,34 @@ # Changelog
 
+## [2.0.0] — 2026-06-28 — "Enforcement Release"
+
+### Added
+- **TripleGate `/v1/gatehooks` enforcement** — conjunctive Gate A/B/C evaluation (Crown Jewel patent 64/006,491); any FAIL→BLOCK, any UNAVAILABLE→DEGRADED, all PASS→PASS, ed25519 signed-hash + append-only audit trail. Backend CF Worker now routes live.
+- **`withGate()` mode dial** (`shadow` / `advisory` / `enforce`) — `enforce` is the default (hard-blocks on `deny`/`degraded` verdicts); set `SUNAIVA_GATE_MODE=shadow` or pass `mode: 'shadow'` to restore emit-only behaviour. Replaces prior effective-enforce-only behaviour. See MIGRATION.md.
+- **Agent-native CLI** — `sunaiva-gate rules`, `sunaiva-gate status`, `sunaiva-gate mode set`, `sunaiva-gate mode get`, `sunaiva-gate cancel` subcommands for agent-driven rule governance (Rule 68 autonomous wiring authority).
+- **Dual CJS+ESM distribution** — `dist/middleware.cjs` (CommonJS) + `dist/middleware.js` (ESM) both exported via `package.json` exports map so Hermes/Storm and ESM consumers both work without import gymnastics.
+- **Enforcement fix — free constitutional engine now blocks** `git push origin main`, payment debits, and `cat .env` patterns. Prior `v1.1.9` shipped `allowed:true` for all three (Trinity violation; now closed).
+- **49-string contamination strip** — EU-AI-Act / GDPR / "works with any model" cross-provider framing removed from dashboard, marketing, backend rule copy, and spec files (Lane S).
+
+### Changed
+- **Rule count: 100 → 104 total; 23 → 27 constitutional** — Wave 1 (U5) hardened all 23 heuristic-detection constitutional rules with `compiled_regex` fields. The 4 v1.1.5 compiled-regex constitutional rules (`cnst-fin-debit`, `cnst-gov-deploy`, `cnst-gov-outreach`, `cnst-sec-exposure`) were already hardened; U5 brought the remaining 23 to the same standard. Local rule count: 31 → 35 (27 constitutional + 8 recommended_default). Total: 27 + 8 + 69 = 104.
+- `PKG_VERSION` bumped `1.1.9` → `2.0.0` (`src/index.ts`).
+- `MIDDLEWARE_VERSION` bumped `1.2.0` → `2.0.0` (`connectors/hermes/gate-middleware.js`).
+- `HOOK_VERSION` bumped `1.2.0` → `2.0.0` (`src/engine/ship-confidence-gate.ts`).
+- All User-Agent headers updated to `2.0.0`.
+- Vitest pool changed to `forks` + `singleFork: true` — eliminates forked-worker timeout on 9p/WSL mounts.
+
+### BREAKING
+
+- **`withGate()` default mode is now `'enforce'`** (was `'shadow'` in v1.2.0). Any call site
+  relying on the v1.2.0 shadow default will now hard-block on `deny`/`degraded` gate verdicts.
+  Escape hatch: pass `mode: 'shadow'` explicitly, or set `SUNAIVA_GATE_MODE=shadow` at the
+  container level to restore the prior non-blocking behaviour. See MIGRATION.md for details.
+
+### Migration from 1.x
+- `withGate()` callers: default mode is now `'enforce'` (was `'shadow'` in v1.2.0). Add
+  `mode: 'shadow'` or set `SUNAIVA_GATE_MODE=shadow` to preserve prior non-blocking behaviour.
+- No MCP tool surface changes — all 6 tools (`validate_action`, `log_bypass`, `get_rules`, `update_rules`, `get_audit_log`, `ship_confidence_check`) are backward compatible.
+
+---
+
 ## [1.1.7] — 2026-06-03 — "Bundle Fix"
@@ -9,0 +41,0 @@

dist/compliance/exporters/pdf.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"pdf.d.ts","sourceRoot":"","sources":["../../../src/compliance/exporters/pdf.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAEhE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,KAAK,GAAG,UAAU,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAoED,wBAAsB,WAAW,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CA2BlF"}
+{"version":3,"file":"pdf.d.ts","sourceRoot":"","sources":["../../../src/compliance/exporters/pdf.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAEhE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,KAAK,GAAG,UAAU,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAwED,wBAAsB,WAAW,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CA2BlF"}

dist/compliance/exporters/pdf.js

@@ -25,2 +25,6 @@ /**
     try {
+        // pdfkit is an optional runtime dep — types may not be installed; the
+        // function returns false when the module is absent (runtime fallback path).
+        // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+        // @ts-ignore — optional dep without guaranteed type declarations
         const mod = await import("pdfkit").catch(() => null);
@@ -27,0 +31,0 @@ return mod !== null && mod !== undefined;

dist/compliance/exporters/pdf.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"pdf.js","sourceRoot":"","sources":["../../../src/compliance/exporters/pdf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAepC;;;;GAIG;AACH,KAAK,UAAU,eAAe;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACrD,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,QAA+B;IAC5D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;IAC7E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,gBAAgB,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,eAAe,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1E,KAAK,CAAC,IAAI,CAAC,kBAAkB,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;IACtD,KAAK,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;IACnE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,kCAAkC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IACrF,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,oBAAoB,QAAQ,CAAC,eAAe,IAAI,gBAAgB,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACnC,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,MAAM,UAAU,CAAC,CAAC,gBAAgB,UAAU,CAAC,CAAC,gBAAgB,GAAG,CAAC,CAAC;IACtG,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,yBAAyB,EAAE,CAAC,CAAC;IAC1E,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9C,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAsD;QAClE,CAAC,mBAAmB,EAAE,QAAQ,CAAC,gBAAgB,CAAC,cAAc,CAAC;QAC/D,CAAC,wBAAwB,EAAE,QAAQ,CAAC,gBAAgB,CAAC,mBAAmB,CAAC;QACzE,CAAC,2BAA2B,EAAE,QAAQ,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;QAC/E,CAAC,iCAAiC,EAAE,QAAQ,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;QACzF,CAAC,yBAAyB,EAAE,QAAQ,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;KAC5E,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CACR,GAAG,QAAQ,CAAC,oBAAoB,CAAC,KAAK,wEAAwE,CAC/G,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,wBAAwB,QAAQ,CAAC,oBAAoB,CAAC,IAAI,IAAI,CAAC,CAAC;IAC3E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAsB;IACtD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,MAAM,eAAe,EAAE,CAAC;IAC1C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,oDAAoD;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClD,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACrC,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC;YAC5C,MAAM,EAAE,UAAU;YAClB,OAAO,EACL,oFAAoF;SACvF,CAAC;IACJ,CAAC;IACD,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,sCAAsC;IACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,yDAAyD,IAAI,CAAC,WAAW,EAAE,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC;IACrE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACnE,CAAC"}
+{"version":3,"file":"pdf.js","sourceRoot":"","sources":["../../../src/compliance/exporters/pdf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAepC;;;;GAIG;AACH,KAAK,UAAU,eAAe;IAC5B,IAAI,CAAC;QACH,sEAAsE;QACtE,4EAA4E;QAC5E,6DAA6D;QAC7D,iEAAiE;QACjE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACrD,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,QAA+B;IAC5D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;IAC7E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,gBAAgB,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,eAAe,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1E,KAAK,CAAC,IAAI,CAAC,kBAAkB,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;IACtD,KAAK,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;IACnE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,kCAAkC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IACrF,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,oBAAoB,QAAQ,CAAC,eAAe,IAAI,gBAAgB,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACnC,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,MAAM,UAAU,CAAC,CAAC,gBAAgB,UAAU,CAAC,CAAC,gBAAgB,GAAG,CAAC,CAAC;IACtG,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,yBAAyB,EAAE,CAAC,CAAC;IAC1E,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9C,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAsD;QAClE,CAAC,mBAAmB,EAAE,QAAQ,CAAC,gBAAgB,CAAC,cAAc,CAAC;QAC/D,CAAC,wBAAwB,EAAE,QAAQ,CAAC,gBAAgB,CAAC,mBAAmB,CAAC;QACzE,CAAC,2BAA2B,EAAE,QAAQ,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;QAC/E,CAAC,iCAAiC,EAAE,QAAQ,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;QACzF,CAAC,yBAAyB,EAAE,QAAQ,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;KAC5E,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CACR,GAAG,QAAQ,CAAC,oBAAoB,CAAC,KAAK,wEAAwE,CAC/G,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,wBAAwB,QAAQ,CAAC,oBAAoB,CAAC,IAAI,IAAI,CAAC,CAAC;IAC3E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAsB;IACtD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,MAAM,eAAe,EAAE,CAAC;IAC1C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,oDAAoD;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClD,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACrC,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC;YAC5C,MAAM,EAAE,UAAU;YAClB,OAAO,EACL,oFAAoF;SACvF,CAAC;IACJ,CAAC;IACD,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,sCAAsC;IACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,yDAAyD,IAAI,CAAC,WAAW,EAAE,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC;IACrE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACnE,CAAC"}

dist/config/defaults.d.ts

@@ -27,4 +27,7 @@ /**
  *
- * v1.1.4 constitutional set: 23 rules (8 demoted from v1.1.3 to recommended_default
- * or premium — com-001/002/005/006/009, know-009, fin-004, cmp-002, sec-010).
+ * v1.2.0 constitutional set: 27 rules.
+ *   23 original rules (v1.1.4) plus 4 compiled-regex free constitutional rules:
+ *   cnst-fin-debit, cnst-gov-deploy, cnst-gov-outreach, cnst-sec-exposure.
+ *   These carry deterministic compiled_regex patterns — no backend, no API key
+ *   needed — and enforce the highest-risk agent action classes directly.
  *
@@ -59,3 +62,3 @@ * UPDATE PROCEDURE: when rules.json gains a new constitutional rule,
     active_preset?: string;
-    enforcement_mode: "enforce" | "warn-only" | "audit";
+    enforcement_mode: "enforce" | "warn-only" | "audit" | "shadow";
     model: ModelConfig;
@@ -62,0 +65,0 @@ audit_log_path: string;

dist/config/defaults.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,eAAO,MAAM,UAAU,QAA8B,CAAC;AACtD,eAAO,MAAM,WAAW,QAAuC,CAAC;AAChE,eAAO,MAAM,cAAc,QAAkC,CAAC;AAE9D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EA6BnD,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EASxD,CAAC;AAEH,eAAO,MAAM,cAAc,EAAE,UAS5B,CAAC;AAEF,eAAO,MAAM,gBAAgB,mCAAmC,CAAC;AAEjE,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,SAAS,GAAG,QAAQ,GAAG,WAAW,GAAG,YAAY,GAAG,OAAO,CAAC;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC;IACpD,KAAK,EAAE,WAAW,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC"}
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,eAAO,MAAM,UAAU,QAA8B,CAAC;AACtD,eAAO,MAAM,WAAW,QAAuC,CAAC;AAChE,eAAO,MAAM,cAAc,QAEQ,CAAC;AAEpC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAmCnD,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EASxD,CAAC;AAEH,eAAO,MAAM,cAAc,EAAE,UAS5B,CAAC;AAEF,eAAO,MAAM,gBAAgB,mCAAmC,CAAC;AAEjE,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,SAAS,GAAG,QAAQ,GAAG,WAAW,GAAG,YAAY,GAAG,OAAO,CAAC;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,SAAS,GAAG,WAAW,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC/D,KAAK,EAAE,WAAW,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC"}

dist/config/defaults.js

@@ -23,3 +23,5 @@ /**
 export const CONFIG_PATH = join(CONFIG_DIR, "gate-config.json");
-export const AUDIT_LOG_PATH = join(CONFIG_DIR, "audit.jsonl");
+export const AUDIT_LOG_PATH = process.env.SUNAIVA_GATE_AUDIT_DIR
+    ? join(process.env.SUNAIVA_GATE_AUDIT_DIR, "audit.jsonl")
+    : join(CONFIG_DIR, "audit.jsonl");
 /**
@@ -30,4 +32,7 @@ * Every constitutional rule ID (tier === "constitutional") shipped in rules/rules.json.
  *
- * v1.1.4 constitutional set: 23 rules (8 demoted from v1.1.3 to recommended_default
- * or premium — com-001/002/005/006/009, know-009, fin-004, cmp-002, sec-010).
+ * v1.2.0 constitutional set: 27 rules.
+ *   23 original rules (v1.1.4) plus 4 compiled-regex free constitutional rules:
+ *   cnst-fin-debit, cnst-gov-deploy, cnst-gov-outreach, cnst-sec-exposure.
+ *   These carry deterministic compiled_regex patterns — no backend, no API key
+ *   needed — and enforce the highest-risk agent action classes directly.
  *
@@ -66,2 +71,8 @@ * UPDATE PROCEDURE: when rules.json gains a new constitutional rule,
     "sec-011",
+    // compiled-regex free constitutional rules (v1.2.0) — deterministic fast-path,
+    // no backend required, block the most common catastrophic agent action classes
+    "cnst-fin-debit",
+    "cnst-gov-deploy",
+    "cnst-gov-outreach",
+    "cnst-sec-exposure",
 ]);
@@ -68,0 +79,0 @@ /**

dist/config/defaults.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;AACtD,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;AAChE,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAE9D;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACtE,qDAAqD;IACrD,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,mEAAmE;IACnE,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,mEAAmE;IACnE,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,mEAAmE;IACnE,SAAS;IACT,SAAS;IACT,8DAA8D;IAC9D,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;CACV,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC3E,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,UAAU;IACV,SAAS;IACT,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAe;IACxC,OAAO,EAAE,EAAE;IACX,YAAY,EAAE,CAAC,GAAG,uBAAuB,EAAE,GAAG,4BAA4B,CAAC;IAC3E,aAAa,EAAE,SAAS;IACxB,gBAAgB,EAAE,SAAS;IAC3B,KAAK,EAAE;QACL,QAAQ,EAAE,SAAS;KACpB;IACD,cAAc,EAAE,cAAc;CAC/B,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,gCAAgC,CAAC"}
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;AACtD,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;AAChE,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB;IAC9D,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,aAAa,CAAC;IACzD,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAEpC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACtE,qDAAqD;IACrD,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,mEAAmE;IACnE,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,mEAAmE;IACnE,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,mEAAmE;IACnE,SAAS;IACT,SAAS;IACT,8DAA8D;IAC9D,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,+EAA+E;IAC/E,+EAA+E;IAC/E,gBAAgB;IAChB,iBAAiB;IACjB,mBAAmB;IACnB,mBAAmB;CACpB,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC3E,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,UAAU;IACV,SAAS;IACT,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAe;IACxC,OAAO,EAAE,EAAE;IACX,YAAY,EAAE,CAAC,GAAG,uBAAuB,EAAE,GAAG,4BAA4B,CAAC;IAC3E,aAAa,EAAE,SAAS;IACxB,gBAAgB,EAAE,SAAS;IAC3B,KAAK,EAAE;QACL,QAAQ,EAAE,SAAS;KACpB;IACD,cAAc,EAAE,cAAc;CAC/B,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,gCAAgC,CAAC"}

dist/config/loader.d.ts

@@ -5,2 +5,10 @@ import { type GateConfig } from "./defaults.js";
 export declare function getActiveRuleIds(): string[];
+/** Returns true iff the local enforcement_mode is set to "enforce". */
+export declare function getEnforceMode(): boolean;
+/**
+ * Toggles local enforcement mode (no backend call).
+ * on=true  → writes "enforce"  (full blocking)
+ * on=false → writes "shadow"   (observe-only, no blocks)
+ */
+export declare function setEnforceMode(on: boolean): void;
 //# sourceMappingURL=loader.d.ts.map

dist/config/loader.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAQA,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAGzF,wBAAgB,SAAS,IAAI,UAAU,CAiBtC;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAGhD;AAED,wBAAgB,gBAAgB,IAAI,MAAM,EAAE,CAE3C"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAQA,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAGzF,wBAAgB,SAAS,IAAI,UAAU,CAiBtC;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAGhD;AAED,wBAAgB,gBAAgB,IAAI,MAAM,EAAE,CAE3C;AAED,uEAAuE;AACvE,wBAAgB,cAAc,IAAI,OAAO,CAExC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,OAAO,GAAG,IAAI,CAIhD"}

dist/config/loader.js

@@ -37,2 +37,16 @@ /**
 }
+/** Returns true iff the local enforcement_mode is set to "enforce". */
+export function getEnforceMode() {
+    return getConfig().enforcement_mode === "enforce";
+}
+/**
+ * Toggles local enforcement mode (no backend call).
+ * on=true  → writes "enforce"  (full blocking)
+ * on=false → writes "shadow"   (observe-only, no blocks)
+ */
+export function setEnforceMode(on) {
+    const cfg = getConfig();
+    cfg.enforcement_mode = on ? "enforce" : "shadow";
+    saveConfig(cfg);
+}
 //# sourceMappingURL=loader.js.map

dist/config/loader.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAmB,MAAM,eAAe,CAAC;AACzF,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAExE,MAAM,UAAU,SAAS;IACvB,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5B,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,cAAc,CAAC,CAAC;YAC3B,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC;QACjC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,CAAC,cAAc,CAAC,CAAC;QAC3B,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC;IACjC,CAAC;IAED,sEAAsE;IACtE,qDAAqD;IACrD,OAAO,2BAA2B,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAe;IACxC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,SAAS,EAAE,CAAC,YAAY,CAAC;AAClC,CAAC"}
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAmB,MAAM,eAAe,CAAC;AACzF,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAExE,MAAM,UAAU,SAAS;IACvB,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5B,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,cAAc,CAAC,CAAC;YAC3B,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC;QACjC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,CAAC,cAAc,CAAC,CAAC;QAC3B,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC;IACjC,CAAC;IAED,sEAAsE;IACtE,qDAAqD;IACrD,OAAO,2BAA2B,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAe;IACxC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,SAAS,EAAE,CAAC,YAAY,CAAC;AAClC,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc;IAC5B,OAAO,SAAS,EAAE,CAAC,gBAAgB,KAAK,SAAS,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,EAAW;IACxC,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,GAAG,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjD,UAAU,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC"}

dist/cost/tool.js

@@ -14,3 +14,3 @@ /**
 import { checkBudget, recordSpend } from "./budget.js";
-const PKG_VERSION = "1.2.0";
+const PKG_VERSION = "2.0.0";
 const HOOK_NAME = "sunaiva-gate";
@@ -17,0 +17,0 @@ /**

dist/engine/backend-client.d.ts

@@ -28,3 +28,3 @@ /**
  */
-import { BackendClientOptions, BackendEvalResult } from "../types/backend.js";
+import { BackendClientOptions, BackendEvalResult, type ModeRecord, type CustomRule, type PresetBundle, type ControlPlaneError } from "../types/backend.js";
 /**
@@ -54,2 +54,9 @@ * Reset the once-per-process notice flag. Test-only — wired so that test
     evaluate(ruleIds: string[], inputText: string, context?: Record<string, unknown>): Promise<BackendEvalResult>;
+    /**
+     * Batch evaluation: POST all ruleIds in one request to /v1/gatehooks.
+     * If the backend returns a well-formed array, map it to BackendRuleResult[].
+     * If the batch endpoint fails or returns an unexpected shape, fall back to
+     * serial per-rule evaluation so older backend deployments stay compatible.
+     */
+    private evaluateBatch;
     /** Single-rule call with retry + timeout. */
@@ -59,3 +66,67 @@ private evaluateOne;
     private callOnce;
+    /**
+     * Derive the backend base URL from the stored gatehooks URL.
+     * e.g. "https://mcp.sunaivacore.io/v1/gatehooks" → "https://mcp.sunaivacore.io"
+     */
+    private get controlBaseUrl();
+    /**
+     * Low-level control-plane fetch. Returns parsed body or a ControlPlaneError.
+     * Never throws.
+     */
+    private cpFetch;
+    /** Helper to check if a cpFetch result is an error. */
+    private static isCpError;
+    /**
+     * PUT /v1/rules/modes — set per-rule enforcement mode (Pro+).
+     * Returns the updated ModeRecord or a ControlPlaneError on failure.
+     */
+    setMode(ruleId: string, mode: ModeRecord["mode"], agentId?: string): Promise<ModeRecord | ControlPlaneError>;
+    /**
+     * GET /v1/rules/modes — list all mode overrides for this customer.
+     * Returns an array of ModeRecord or a ControlPlaneError on failure.
+     */
+    getModes(): Promise<ModeRecord[] | ControlPlaneError>;
+    /**
+     * DELETE /v1/rules/modes/:ruleId — reset a rule's mode override (Pro+).
+     * Returns a success object or a ControlPlaneError on failure.
+     */
+    resetMode(ruleId: string): Promise<{
+        deleted: boolean;
+    } | ControlPlaneError>;
+    /**
+     * POST /v1/rules/custom — add a custom rule (Pro+).
+     * Returns the created CustomRule or a ControlPlaneError on failure.
+     */
+    addCustomRule(rule: Omit<CustomRule, "id" | "created_at" | "updated_at">): Promise<CustomRule | ControlPlaneError>;
+    /**
+     * PUT /v1/rules/custom/:id — update a custom rule (Pro+).
+     * Returns the updated CustomRule or a ControlPlaneError on failure.
+     */
+    updateCustomRule(id: string, rule: Partial<Omit<CustomRule, "id">>): Promise<CustomRule | ControlPlaneError>;
+    /**
+     * DELETE /v1/rules/custom/:id — delete a custom rule (Pro+).
+     * Returns a success object or a ControlPlaneError on failure.
+     */
+    deleteCustomRule(id: string): Promise<{
+        deleted: boolean;
+    } | ControlPlaneError>;
+    /**
+     * GET /v1/rules/custom — list custom rules for this customer (Pro+).
+     * Returns an array of CustomRule or a ControlPlaneError on failure.
+     */
+    listCustomRules(): Promise<CustomRule[] | ControlPlaneError>;
+    /**
+     * GET /v1/rules/presets — list available preset bundles (Dev+).
+     * Returns an array of PresetBundle or a ControlPlaneError on failure.
+     */
+    listPresets(): Promise<PresetBundle[] | ControlPlaneError>;
+    /**
+     * POST /v1/rules/presets/:presetId/apply — apply a preset bundle (Pro+).
+     * Returns a success object or a ControlPlaneError on failure.
+     */
+    applyPreset(presetId: string): Promise<{
+        applied: boolean;
+        preset_id: string;
+    } | ControlPlaneError>;
 }
 //# sourceMappingURL=backend-client.d.ts.map

dist/engine/backend-client.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"backend-client.d.ts","sourceRoot":"","sources":["../../src/engine/backend-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EAOlB,MAAM,qBAAqB,CAAC;AAM7B;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAED;;GAEG;AACH,wBAAgB,4BAA4B,IAAI,OAAO,CAEtD;AA0CD,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;gBAE7B,OAAO,GAAE,oBAAyB;IAkB9C,uDAAuD;IACvD,YAAY,IAAI,OAAO;IAIvB;;;;OAIG;IACG,QAAQ,CACZ,OAAO,EAAE,MAAM,EAAE,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,iBAAiB,CAAC;IA8C7B,6CAA6C;YAC/B,WAAW;IAgEzB,yEAAyE;YAC3D,QAAQ;CAiFvB"}
+{"version":3,"file":"backend-client.d.ts","sourceRoot":"","sources":["../../src/engine/backend-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EAOjB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACvB,MAAM,qBAAqB,CAAC;AAM7B;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAED;;GAEG;AACH,wBAAgB,4BAA4B,IAAI,OAAO,CAEtD;AA0CD,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;gBAE7B,OAAO,GAAE,oBAAyB;IAkB9C,uDAAuD;IACvD,YAAY,IAAI,OAAO;IAIvB;;;;OAIG;IACG,QAAQ,CACZ,OAAO,EAAE,MAAM,EAAE,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,iBAAiB,CAAC;IA8C7B;;;;;OAKG;YACW,aAAa;IAmF3B,6CAA6C;YAC/B,WAAW;IAgEzB,yEAAyE;YAC3D,QAAQ;IAoFtB;;;OAGG;IACH,OAAO,KAAK,cAAc,GAMzB;IAED;;;OAGG;YACW,OAAO;IA8CrB,uDAAuD;IACvD,OAAO,CAAC,MAAM,CAAC,SAAS;IAMxB;;;OAGG;IACG,OAAO,CACX,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,EACxB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,GAAG,iBAAiB,CAAC;IAU1C;;;OAGG;IACG,QAAQ,IAAI,OAAO,CAAC,UAAU,EAAE,GAAG,iBAAiB,CAAC;IAW3D;;;OAGG;IACG,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,GAAG,iBAAiB,CAAC;IAQlF;;;OAGG;IACG,aAAa,CACjB,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,YAAY,GAAG,YAAY,CAAC,GACzD,OAAO,CAAC,UAAU,GAAG,iBAAiB,CAAC;IAM1C;;;OAGG;IACG,gBAAgB,CACpB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,GACpC,OAAO,CAAC,UAAU,GAAG,iBAAiB,CAAC;IAM1C;;;OAGG;IACG,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,GAAG,iBAAiB,CAAC;IAMrF;;;OAGG;IACG,eAAe,IAAI,OAAO,CAAC,UAAU,EAAE,GAAG,iBAAiB,CAAC;IAalE;;;OAGG;IACG,WAAW,IAAI,OAAO,CAAC,YAAY,EAAE,GAAG,iBAAiB,CAAC;IAWhE;;;OAGG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,iBAAiB,CAAC;CAQ1G"}

dist/engine/backend-client.js

@@ -116,9 +116,9 @@ /**
         }
-        // Sequential calls — the backend is per-rule. Could be parallelised in
-        // a future version; sequential is fine for v1.1.0 because premium rule
-        // counts per validate() call are bounded by the active_rules set.
-        const results = [];
-        for (const ruleId of ruleIds) {
-            results.push(await this.evaluateOne(ruleId, inputText, context));
-        }
+        // Fault #21 fix: replace serial per-rule calls with a single batch POST to
+        // /v1/gatehooks?batch=1. Backend accepts { rule_ids, input_text, context }
+        // and returns { results: [{ rule_id, matched, severity, decision, reason }] }.
+        // Falls back to per-rule serial evaluation if the batch endpoint is absent
+        // (404) or returns a non-array body, preserving backward compatibility with
+        // older backend deployments.
+        const results = await this.evaluateBatch(ruleIds, inputText, context);
         const matched_rule_ids = results.filter((r) => r.matched).map((r) => r.rule_id);
@@ -137,2 +137,82 @@ const skipped_rule_ids = results
     }
+    /**
+     * Batch evaluation: POST all ruleIds in one request to /v1/gatehooks.
+     * If the backend returns a well-formed array, map it to BackendRuleResult[].
+     * If the batch endpoint fails or returns an unexpected shape, fall back to
+     * serial per-rule evaluation so older backend deployments stay compatible.
+     */
+    async evaluateBatch(ruleIds, inputText, context) {
+        if (ruleIds.length === 0)
+            return [];
+        const t0 = Date.now();
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            const resp = await this.fetchImpl(this.url, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    Authorization: `Bearer ${this.apiToken}`,
+                    "User-Agent": "sunaiva-gate-client/2.0.0",
+                    "X-Batch": "1",
+                },
+                body: JSON.stringify({
+                    rule_ids: ruleIds,
+                    input_text: inputText,
+                    context: context ?? {},
+                }),
+                signal: controller.signal,
+            });
+            if (resp.status >= 200 && resp.status < 300) {
+                let body;
+                try {
+                    body = await resp.json();
+                }
+                catch {
+                    body = null;
+                }
+                // Expect { results: Array<{rule_id, matched, ...}> }
+                const batchBody = body;
+                if (Array.isArray(batchBody?.results)) {
+                    const latency = Date.now() - t0;
+                    return batchBody.results.map((item) => {
+                        const r = item;
+                        const ruleId = typeof r.rule_id === "string" ? r.rule_id : "unknown";
+                        const matched = r.matched === true;
+                        return {
+                            rule_id: ruleId,
+                            status: (matched ? "matched" : "no_match"),
+                            matched,
+                            severity: r.severity,
+                            decision: r.decision,
+                            reason: r.reason,
+                            http_status: resp.status,
+                            latency_ms: latency,
+                        };
+                    });
+                }
+                // Batch body shape unexpected — fall through to serial
+            }
+            else if (resp.status === 404) {
+                // Batch endpoint not yet deployed — fall through to serial
+                void resp.body?.cancel();
+            }
+            else {
+                // Other error — fall through to serial
+                void resp.body?.cancel();
+            }
+        }
+        catch {
+            // Network/timeout — fall through to serial
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        // Fallback: serial per-rule evaluation (backward compat with pre-batch backends)
+        const results = [];
+        for (const ruleId of ruleIds) {
+            results.push(await this.evaluateOne(ruleId, inputText, context));
+        }
+        return results;
+    }
     /** Single-rule call with retry + timeout. */
@@ -273,2 +353,182 @@ async evaluateOne(ruleId, inputText, context) {
     }
+    // ─── Control-plane helpers ─────────────────────────────────────────────────
+    /**
+     * Derive the backend base URL from the stored gatehooks URL.
+     * e.g. "https://mcp.sunaivacore.io/v1/gatehooks" → "https://mcp.sunaivacore.io"
+     */
+    get controlBaseUrl() {
+        try {
+            return new URL(this.url).origin;
+        }
+        catch {
+            return this.url.replace(/\/v1\/.*$/, "");
+        }
+    }
+    /**
+     * Low-level control-plane fetch. Returns parsed body or a ControlPlaneError.
+     * Never throws.
+     */
+    async cpFetch(method, path, body) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            const opts = {
+                method,
+                headers: {
+                    "Content-Type": "application/json",
+                    Authorization: `Bearer ${this.apiToken ?? ""}`,
+                    "User-Agent": "sunaiva-gate-client/2.0.0",
+                },
+                signal: controller.signal,
+            };
+            if (body !== undefined) {
+                opts.body = JSON.stringify(body);
+            }
+            const resp = await this.fetchImpl(`${this.controlBaseUrl}${path}`, opts);
+            let parsed;
+            try {
+                parsed = await resp.json();
+            }
+            catch {
+                parsed = {};
+            }
+            if (resp.status >= 200 && resp.status < 300) {
+                return parsed;
+            }
+            const errBody = parsed;
+            return {
+                error: errBody?.error ?? `HTTP ${resp.status}`,
+                skipped: true,
+            };
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            return {
+                error: msg.includes("aborted") ? "request timeout" : msg,
+                skipped: true,
+            };
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    /** Helper to check if a cpFetch result is an error. */
+    static isCpError(v) {
+        return typeof v === "object" && v !== null && v.skipped === true;
+    }
+    // ─── Modes ─────────────────────────────────────────────────────────────────
+    /**
+     * PUT /v1/rules/modes — set per-rule enforcement mode (Pro+).
+     * Returns the updated ModeRecord or a ControlPlaneError on failure.
+     */
+    async setMode(ruleId, mode, agentId) {
+        const result = await this.cpFetch("PUT", "/v1/rules/modes", {
+            rule_id: ruleId,
+            mode,
+            ...(agentId ? { agent_id: agentId } : {}),
+        });
+        if (BackendClient.isCpError(result))
+            return result;
+        return result;
+    }
+    /**
+     * GET /v1/rules/modes — list all mode overrides for this customer.
+     * Returns an array of ModeRecord or a ControlPlaneError on failure.
+     */
+    async getModes() {
+        const result = await this.cpFetch("GET", "/v1/rules/modes");
+        if (BackendClient.isCpError(result))
+            return result;
+        const body = result;
+        if (Array.isArray(body))
+            return body;
+        if (Array.isArray(body.modes)) {
+            return body.modes;
+        }
+        return [];
+    }
+    /**
+     * DELETE /v1/rules/modes/:ruleId — reset a rule's mode override (Pro+).
+     * Returns a success object or a ControlPlaneError on failure.
+     */
+    async resetMode(ruleId) {
+        const result = await this.cpFetch("DELETE", `/v1/rules/modes/${encodeURIComponent(ruleId)}`);
+        if (BackendClient.isCpError(result))
+            return result;
+        return { deleted: true };
+    }
+    // ─── Custom Rules ──────────────────────────────────────────────────────────
+    /**
+     * POST /v1/rules/custom — add a custom rule (Pro+).
+     * Returns the created CustomRule or a ControlPlaneError on failure.
+     */
+    async addCustomRule(rule) {
+        const result = await this.cpFetch("POST", "/v1/rules/custom", rule);
+        if (BackendClient.isCpError(result))
+            return result;
+        return result;
+    }
+    /**
+     * PUT /v1/rules/custom/:id — update a custom rule (Pro+).
+     * Returns the updated CustomRule or a ControlPlaneError on failure.
+     */
+    async updateCustomRule(id, rule) {
+        const result = await this.cpFetch("PUT", `/v1/rules/custom/${encodeURIComponent(id)}`, rule);
+        if (BackendClient.isCpError(result))
+            return result;
+        return result;
+    }
+    /**
+     * DELETE /v1/rules/custom/:id — delete a custom rule (Pro+).
+     * Returns a success object or a ControlPlaneError on failure.
+     */
+    async deleteCustomRule(id) {
+        const result = await this.cpFetch("DELETE", `/v1/rules/custom/${encodeURIComponent(id)}`);
+        if (BackendClient.isCpError(result))
+            return result;
+        return { deleted: true };
+    }
+    /**
+     * GET /v1/rules/custom — list custom rules for this customer (Pro+).
+     * Returns an array of CustomRule or a ControlPlaneError on failure.
+     */
+    async listCustomRules() {
+        const result = await this.cpFetch("GET", "/v1/rules/custom");
+        if (BackendClient.isCpError(result))
+            return result;
+        const body = result;
+        if (Array.isArray(body))
+            return body;
+        if (Array.isArray(body.rules)) {
+            return body.rules;
+        }
+        return [];
+    }
+    // ─── Presets ───────────────────────────────────────────────────────────────
+    /**
+     * GET /v1/rules/presets — list available preset bundles (Dev+).
+     * Returns an array of PresetBundle or a ControlPlaneError on failure.
+     */
+    async listPresets() {
+        const result = await this.cpFetch("GET", "/v1/rules/presets");
+        if (BackendClient.isCpError(result))
+            return result;
+        const body = result;
+        if (Array.isArray(body))
+            return body;
+        if (Array.isArray(body.presets)) {
+            return body.presets;
+        }
+        return [];
+    }
+    /**
+     * POST /v1/rules/presets/:presetId/apply — apply a preset bundle (Pro+).
+     * Returns a success object or a ControlPlaneError on failure.
+     */
+    async applyPreset(presetId) {
+        const result = await this.cpFetch("POST", `/v1/rules/presets/${encodeURIComponent(presetId)}/apply`);
+        if (BackendClient.isCpError(result))
+            return result;
+        return { applied: true, preset_id: presetId };
+    }
 }
@@ -275,0 +535,0 @@ /** Map a 4xx status to a BackendEvalStatus. */

dist/engine/backend-client.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"backend-client.js","sourceRoot":"","sources":["../../src/engine/backend-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAKL,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAE7B,2EAA2E;AAC3E,4EAA4E;AAC5E,IAAI,0BAA0B,GAAG,KAAK,CAAC;AAEvC;;;;GAIG;AACH,MAAM,UAAU,yBAAyB;IACvC,0BAA0B,GAAG,KAAK,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO,0BAA0B,CAAC;AACpC,CAAC;AAED,yDAAyD;AACzD,SAAS,4BAA4B;IACnC,IAAI,0BAA0B;QAAE,OAAO;IACvC,0BAA0B,GAAG,IAAI,CAAC;IAClC,uCAAuC;IACvC,kFAAkF;IAClF,2CAA2C;IAC3C,OAAO,CAAC,KAAK,CACX,+EAA+E;QAC7E,sCAAsC,CACzC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAqBD,MAAM,OAAO,aAAa;IACP,GAAG,CAAS;IACZ,QAAQ,CAAgB;IACxB,SAAS,CAAS;IAClB,SAAS,CAAe;IAEzC,YAAY,UAAgC,EAAE;QAC5C,IAAI,CAAC,GAAG;YACN,OAAO,CAAC,GAAG;gBACX,OAAO,CAAC,GAAG,CAAC,wBAAwB;gBACpC,mBAAmB,CAAC;QACtB,IAAI,CAAC,QAAQ;YACX,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,IAAI,CAAC;QACjE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC;QAC/D,MAAM,gBAAgB,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC5E,IAAI,CAAC,SAAS;YACZ,OAAO,CAAC,SAAS;gBACjB,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,GAAG,CAAC;oBACxD,CAAC,CAAC,gBAAgB;oBAClB,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC1B,8DAA8D;QAC9D,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACzD,CAAC;IAED,uDAAuD;IACvD,YAAY;QACV,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CACZ,OAAiB,EACjB,SAAiB,EACjB,OAAiC;QAEjC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEtB,+EAA+E;QAC/E,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,4BAA4B,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAwB,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBACxD,OAAO,EAAE,EAAE;gBACX,MAAM,EAAE,kBAAuC;gBAC/C,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,CAAC;gBACb,KAAK,EAAE,2CAA2C;aACnD,CAAC,CAAC,CAAC;YACJ,OAAO;gBACL,eAAe,EAAE,OAAO;gBACxB,OAAO;gBACP,gBAAgB,EAAE,EAAE;gBACpB,gBAAgB,EAAE,CAAC,GAAG,OAAO,CAAC;gBAC9B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBAC3B,+BAA+B,EAAE,IAAI;aACtC,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,OAAO,GAAwB,EAAE,CAAC;QACxC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAChF,MAAM,gBAAgB,GAAG,OAAO;aAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;aAC9C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAEzB,OAAO;YACL,eAAe,EAAE,OAAO;YACxB,OAAO;YACP,gBAAgB;YAChB,gBAAgB;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;YAC3B,+BAA+B,EAAE,KAAK;SACvC,CAAC;IACJ,CAAC;IAED,6CAA6C;IACrC,KAAK,CAAC,WAAW,CACvB,MAAc,EACd,SAAiB,EACjB,OAAiC;QAEjC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,IAAI,SAA6B,CAAC;QAClC,IAAI,UAA8B,CAAC;QAEnC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;YACxD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;gBAEhE,uEAAuE;gBACvE,2DAA2D;gBAC3D,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;oBAC1B,OAAO;wBACL,OAAO,EAAE,MAAM;wBACf,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;wBACrD,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO;wBAC7B,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAyC;wBAChE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAyC;wBAChE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;wBAC3B,WAAW,EAAE,OAAO,CAAC,MAAM;wBAC3B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;qBAC5B,CAAC;gBACJ,CAAC;gBAED,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;oBACpC,gEAAgE;oBAChE,OAAO;wBACL,OAAO,EAAE,MAAM;wBACf,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC;wBAC3C,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,OAAO,CAAC,MAAM;wBAC3B,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,QAAQ,OAAO,CAAC,MAAM,EAAE;wBAC3D,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;qBAC5B,CAAC;gBACJ,CAAC;gBAED,oEAAoE;gBACpE,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC;gBACjC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;YAC9B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,+EAA+E;gBAC/E,SAAS,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACzD,CAAC;YAED,IAAI,OAAO,GAAG,WAAW,EAAE,CAAC;gBAC1B,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,2CAA2C;QAC3C,OAAO;YACL,OAAO,EAAE,MAAM;YACf,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,UAAU;YACvB,KAAK,EAAE,SAAS,IAAI,mCAAmC;YACvD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;SAC5B,CAAC;IACJ,CAAC;IAED,yEAAyE;IACjE,KAAK,CAAC,QAAQ,CACpB,MAAc,EACd,SAAiB,EACjB,OAAiC;QAEjC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC1C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE;oBACxC,YAAY,EAAE,2BAA2B;iBAC1C;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,OAAO,EAAE,MAAM;oBACf,UAAU,EAAE,SAAS;oBACrB,OAAO,EAAE,OAAO,IAAI,EAAE;iBACvB,CAAC;gBACF,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,mEAAmE;YACnE,6DAA6D;YAC7D,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC5C,IAAI,IAA2B,CAAC;gBAChC,IAAI,CAAC;oBACH,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA0B,CAAC;gBACtD,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,kDAAkD;oBAClD,OAAO;wBACL,IAAI,EAAE,cAAc;wBACpB,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,YAAY,EAAE,wBAAwB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;qBACnF,CAAC;gBACJ,CAAC;gBACD,IAAI,OAAQ,IAAgC,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;oBACpE,OAAO;wBACL,IAAI,EAAE,cAAc;wBACpB,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,YAAY,EAAE,6CAA6C;qBAC5D,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;YACnD,CAAC;YAED,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC5C,IAAI,SAAyC,CAAC;gBAC9C,IAAI,CAAC;oBACH,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAuB,CAAC;gBACxD,CAAC;gBAAC,MAAM,CAAC;oBACP,mCAAmC;gBACrC,CAAC;gBACD,OAAO;oBACL,IAAI,EAAE,cAAc;oBACpB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,YAAY,EAAE,SAAS,EAAE,KAAK,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE;iBACxD,CAAC;YACJ,CAAC;YAED,qCAAqC;YACrC,IAAI,SAAyC,CAAC;YAC9C,IAAI,CAAC;gBACH,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAuB,CAAC;YACxD,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU;YACZ,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;QAClE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,2DAA2D;YAC3D,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO;gBACL,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,SAAS;gBACjB,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG;aAChE,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;CACF;AAED,+CAA+C;AAC/C,SAAS,mBAAmB,CAAC,MAAc;IACzC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG;YACN,OAAO,cAAc,CAAC;QACxB,KAAK,GAAG;YACN,OAAO,cAAc,CAAC;QACxB,KAAK,GAAG;YACN,OAAO,iBAAiB,CAAC;QAC3B,KAAK,GAAG;YACN,OAAO,eAAe,CAAC;QACzB;YACE,OAAO,eAAe,CAAC;IAC3B,CAAC;AACH,CAAC"}
+{"version":3,"file":"backend-client.js","sourceRoot":"","sources":["../../src/engine/backend-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAKL,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,gBAAgB,GAKjB,MAAM,qBAAqB,CAAC;AAE7B,2EAA2E;AAC3E,4EAA4E;AAC5E,IAAI,0BAA0B,GAAG,KAAK,CAAC;AAEvC;;;;GAIG;AACH,MAAM,UAAU,yBAAyB;IACvC,0BAA0B,GAAG,KAAK,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO,0BAA0B,CAAC;AACpC,CAAC;AAED,yDAAyD;AACzD,SAAS,4BAA4B;IACnC,IAAI,0BAA0B;QAAE,OAAO;IACvC,0BAA0B,GAAG,IAAI,CAAC;IAClC,uCAAuC;IACvC,kFAAkF;IAClF,2CAA2C;IAC3C,OAAO,CAAC,KAAK,CACX,+EAA+E;QAC7E,sCAAsC,CACzC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAqBD,MAAM,OAAO,aAAa;IACP,GAAG,CAAS;IACZ,QAAQ,CAAgB;IACxB,SAAS,CAAS;IAClB,SAAS,CAAe;IAEzC,YAAY,UAAgC,EAAE;QAC5C,IAAI,CAAC,GAAG;YACN,OAAO,CAAC,GAAG;gBACX,OAAO,CAAC,GAAG,CAAC,wBAAwB;gBACpC,mBAAmB,CAAC;QACtB,IAAI,CAAC,QAAQ;YACX,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,IAAI,CAAC;QACjE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC;QAC/D,MAAM,gBAAgB,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC5E,IAAI,CAAC,SAAS;YACZ,OAAO,CAAC,SAAS;gBACjB,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,GAAG,CAAC;oBACxD,CAAC,CAAC,gBAAgB;oBAClB,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC1B,8DAA8D;QAC9D,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACzD,CAAC;IAED,uDAAuD;IACvD,YAAY;QACV,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CACZ,OAAiB,EACjB,SAAiB,EACjB,OAAiC;QAEjC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEtB,+EAA+E;QAC/E,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,4BAA4B,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAwB,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBACxD,OAAO,EAAE,EAAE;gBACX,MAAM,EAAE,kBAAuC;gBAC/C,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,CAAC;gBACb,KAAK,EAAE,2CAA2C;aACnD,CAAC,CAAC,CAAC;YACJ,OAAO;gBACL,eAAe,EAAE,OAAO;gBACxB,OAAO;gBACP,gBAAgB,EAAE,EAAE;gBACpB,gBAAgB,EAAE,CAAC,GAAG,OAAO,CAAC;gBAC9B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBAC3B,+BAA+B,EAAE,IAAI;aACtC,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,2EAA2E;QAC3E,+EAA+E;QAC/E,2EAA2E;QAC3E,4EAA4E;QAC5E,6BAA6B;QAC7B,MAAM,OAAO,GAAwB,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAE3F,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAChF,MAAM,gBAAgB,GAAG,OAAO;aAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;aAC9C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAEzB,OAAO;YACL,eAAe,EAAE,OAAO;YACxB,OAAO;YACP,gBAAgB;YAChB,gBAAgB;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;YAC3B,+BAA+B,EAAE,KAAK;SACvC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,aAAa,CACzB,OAAiB,EACjB,SAAiB,EACjB,OAAiC;QAEjC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAEpC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC1C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE;oBACxC,YAAY,EAAE,2BAA2B;oBACzC,SAAS,EAAE,GAAG;iBACf;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,QAAQ,EAAE,OAAO;oBACjB,UAAU,EAAE,SAAS;oBACrB,OAAO,EAAE,OAAO,IAAI,EAAE;iBACvB,CAAC;gBACF,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC5C,IAAI,IAAa,CAAC;gBAClB,IAAI,CAAC;oBACH,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,GAAG,IAAI,CAAC;gBACd,CAAC;gBACD,qDAAqD;gBACrD,MAAM,SAAS,GAAG,IAAsC,CAAC;gBACzD,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;oBACtC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;oBAChC,OAAO,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;wBACpC,MAAM,CAAC,GAAG,IAMT,CAAC;wBACF,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;wBACrE,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC;wBACnC,OAAO;4BACL,OAAO,EAAE,MAAM;4BACf,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAsB;4BAC/D,OAAO;4BACP,QAAQ,EAAE,CAAC,CAAC,QAAyC;4BACrD,QAAQ,EAAE,CAAC,CAAC,QAAyC;4BACrD,MAAM,EAAE,CAAC,CAAC,MAAM;4BAChB,WAAW,EAAE,IAAI,CAAC,MAAM;4BACxB,UAAU,EAAE,OAAO;yBACpB,CAAC;oBACJ,CAAC,CAAC,CAAC;gBACL,CAAC;gBACD,uDAAuD;YACzD,CAAC;iBAAM,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC/B,2DAA2D;gBAC3D,KAAK,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,uCAAuC;gBACvC,KAAK,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAC3B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2CAA2C;QAC7C,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAED,iFAAiF;QACjF,MAAM,OAAO,GAAwB,EAAE,CAAC;QACxC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,6CAA6C;IACrC,KAAK,CAAC,WAAW,CACvB,MAAc,EACd,SAAiB,EACjB,OAAiC;QAEjC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,IAAI,SAA6B,CAAC;QAClC,IAAI,UAA8B,CAAC;QAEnC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;YACxD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;gBAEhE,uEAAuE;gBACvE,2DAA2D;gBAC3D,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;oBAC1B,OAAO;wBACL,OAAO,EAAE,MAAM;wBACf,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;wBACrD,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO;wBAC7B,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAyC;wBAChE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAyC;wBAChE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;wBAC3B,WAAW,EAAE,OAAO,CAAC,MAAM;wBAC3B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;qBAC5B,CAAC;gBACJ,CAAC;gBAED,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;oBACpC,gEAAgE;oBAChE,OAAO;wBACL,OAAO,EAAE,MAAM;wBACf,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC;wBAC3C,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,OAAO,CAAC,MAAM;wBAC3B,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,QAAQ,OAAO,CAAC,MAAM,EAAE;wBAC3D,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;qBAC5B,CAAC;gBACJ,CAAC;gBAED,oEAAoE;gBACpE,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC;gBACjC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;YAC9B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,+EAA+E;gBAC/E,SAAS,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACzD,CAAC;YAED,IAAI,OAAO,GAAG,WAAW,EAAE,CAAC;gBAC1B,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,2CAA2C;QAC3C,OAAO;YACL,OAAO,EAAE,MAAM;YACf,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,UAAU;YACvB,KAAK,EAAE,SAAS,IAAI,mCAAmC;YACvD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;SAC5B,CAAC;IACJ,CAAC;IAED,yEAAyE;IACjE,KAAK,CAAC,QAAQ,CACpB,MAAc,EACd,SAAiB,EACjB,OAAiC;QAEjC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC1C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE;oBACxC,YAAY,EAAE,2BAA2B;iBAC1C;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,OAAO,EAAE,MAAM;oBACf,UAAU,EAAE,SAAS;oBACrB,OAAO,EAAE,OAAO,IAAI,EAAE;iBACvB,CAAC;gBACF,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,mEAAmE;YACnE,6DAA6D;YAC7D,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC5C,IAAI,IAA2B,CAAC;gBAChC,IAAI,CAAC;oBACH,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA0B,CAAC;gBACtD,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,kDAAkD;oBAClD,OAAO;wBACL,IAAI,EAAE,cAAc;wBACpB,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,YAAY,EAAE,wBAAwB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;qBACnF,CAAC;gBACJ,CAAC;gBACD,IAAI,OAAQ,IAAgC,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;oBACpE,OAAO;wBACL,IAAI,EAAE,cAAc;wBACpB,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,YAAY,EAAE,6CAA6C;qBAC5D,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;YACnD,CAAC;YAED,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC5C,IAAI,SAAyC,CAAC;gBAC9C,IAAI,CAAC;oBACH,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAuB,CAAC;gBACxD,CAAC;gBAAC,MAAM,CAAC;oBACP,mCAAmC;gBACrC,CAAC;gBACD,OAAO;oBACL,IAAI,EAAE,cAAc;oBACpB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,YAAY,EAAE,SAAS,EAAE,KAAK,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE;iBACxD,CAAC;YACJ,CAAC;YAED,qCAAqC;YACrC,IAAI,SAAyC,CAAC;YAC9C,IAAI,CAAC;gBACH,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAuB,CAAC;YACxD,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU;YACZ,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;QAClE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,2DAA2D;YAC3D,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO;gBACL,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,SAAS;gBACjB,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG;aAChE,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,8EAA8E;IAE9E;;;OAGG;IACH,IAAY,cAAc;QACxB,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,OAAO,CACnB,MAAc,EACd,IAAY,EACZ,IAAc;QAEd,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,IAAI,GAAgB;gBACxB,MAAM;gBACN,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE;oBAC9C,YAAY,EAAE,2BAA2B;iBAC1C;gBACD,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC;YACF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,cAAc,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;YACzE,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,EAAE,CAAC;YACd,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC5C,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,MAAM,OAAO,GAAG,MAAmC,CAAC;YACpD,OAAO;gBACL,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE;gBAC9C,OAAO,EAAE,IAAa;aACvB,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO;gBACL,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG;gBACxD,OAAO,EAAE,IAAa;aACvB,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,uDAAuD;IAC/C,MAAM,CAAC,SAAS,CAAC,CAAU;QACjC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAK,CAA6B,CAAC,OAAO,KAAK,IAAI,CAAC;IAChG,CAAC;IAED,8EAA8E;IAE9E;;;OAGG;IACH,KAAK,CAAC,OAAO,CACX,MAAc,EACd,IAAwB,EACxB,OAAgB;QAEhB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,iBAAiB,EAAE;YAC1D,OAAO,EAAE,MAAM;YACf,IAAI;YACJ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC,CAAC;QACH,IAAI,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QACnD,OAAO,MAAoB,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ;QACZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAC5D,IAAI,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QACnD,MAAM,IAAI,GAAG,MAAiD,CAAC;QAC/D,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,KAAK,CAAC,OAAO,CAAE,IAAiC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5D,OAAQ,IAAgC,CAAC,KAAK,CAAC;QACjD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,MAAc;QAC5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,mBAAmB,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7F,IAAI,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,8EAA8E;IAE9E;;;OAGG;IACH,KAAK,CAAC,aAAa,CACjB,IAA0D;QAE1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC;QACpE,IAAI,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QACnD,OAAO,MAAoB,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CACpB,EAAU,EACV,IAAqC;QAErC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,oBAAoB,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC7F,IAAI,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QACnD,OAAO,MAAoB,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CAAC,EAAU;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,oBAAoB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1F,IAAI,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe;QACnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;QAC7D,IAAI,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QACnD,MAAM,IAAI,GAAG,MAAiD,CAAC;QAC/D,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,KAAK,CAAC,OAAO,CAAE,IAAiC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5D,OAAQ,IAAgC,CAAC,KAAK,CAAC;QACjD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,8EAA8E;IAE9E;;;OAGG;IACH,KAAK,CAAC,WAAW;QACf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;QAC9D,IAAI,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QACnD,MAAM,IAAI,GAAG,MAAuD,CAAC;QACrE,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,KAAK,CAAC,OAAO,CAAE,IAAqC,CAAC,OAAO,CAAC,EAAE,CAAC;YAClE,OAAQ,IAAoC,CAAC,OAAO,CAAC;QACvD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,QAAgB;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAC/B,MAAM,EACN,qBAAqB,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAC1D,CAAC;QACF,IAAI,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IAChD,CAAC;CACF;AAED,+CAA+C;AAC/C,SAAS,mBAAmB,CAAC,MAAc;IACzC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG;YACN,OAAO,cAAc,CAAC;QACxB,KAAK,GAAG;YACN,OAAO,cAAc,CAAC;QACxB,KAAK,GAAG;YACN,OAAO,iBAAiB,CAAC;QAC3B,KAAK,GAAG;YACN,OAAO,eAAe,CAAC;QACzB;YACE,OAAO,eAAe,CAAC;IAC3B,CAAC;AACH,CAAC"}

dist/engine/rule-engine.d.ts

@@ -28,2 +28,10 @@ /**
     detection_pattern: string;
+    /**
+     * Optional compiled regex string for deterministic <1ms evaluation in the free
+     * npm bundle. When present, this string is compiled via `new RegExp(..., "i")`
+     * and tested directly against the action+context text — bypassing the heuristic
+     * keyword extraction path in pattern-matcher. Only rules with this field make
+     * the "deterministic regex" claim TRUE (Fault #24 fix).
+     */
+    compiled_regex?: string;
     tags: string[];
@@ -52,2 +60,7 @@ preset_groups: string[];
 export declare function setBackendClient(client: BackendClient | null): void;
+/**
+ * Reset the rules and regex caches — used in tests to achieve clean isolation
+ * between test suites that call loadAllRules() or setBackendClient().
+ */
+export declare function resetRulesCache(): void;
 export declare function loadAllRules(): Rule[];
@@ -54,0 +67,0 @@ /**

dist/engine/rule-engine.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"rule-engine.d.ts","sourceRoot":"","sources":["../../src/engine/rule-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAqB7D,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEtD,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,gBAAgB,GAAG,UAAU,CAAC;IAC3C,oFAAoF;IACpF,IAAI,CAAC,EAAE,gBAAgB,GAAG,qBAAqB,GAAG,SAAS,GAAG,iBAAiB,CAAC;IAChF,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,iBAAiB,CAAC;IAC/C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,IAAI,EAAE,CAAC;IACnB,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjB,mEAAmE;IACnE,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;IACnC,qFAAqF;IACrF,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,0FAA0F;IAC1F,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,wFAAwF;IACxF,eAAe,CAAC,EAAE,iBAAiB,EAAE,CAAC;CACvC;AAmBD,iCAAiC;AACjC,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,GAAG,IAAI,CAEnE;AAOD,wBAAgB,YAAY,IAAI,IAAI,EAAE,CAerC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,2BAA2B,IAAI,IAAI,EAAE,CAWpD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,EAAE,CAGzD;AAwBD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,MAAM,GACf,gBAAgB,CAiElB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,CAAC,CAmF3B"}
+{"version":3,"file":"rule-engine.d.ts","sourceRoot":"","sources":["../../src/engine/rule-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAqB7D,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEtD,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,gBAAgB,GAAG,UAAU,CAAC;IAC3C,oFAAoF;IACpF,IAAI,CAAC,EAAE,gBAAgB,GAAG,qBAAqB,GAAG,SAAS,GAAG,iBAAiB,CAAC;IAChF,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,iBAAiB,CAAC;IAC/C,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,IAAI,EAAE,CAAC;IACnB,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjB,mEAAmE;IACnE,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;IACnC,qFAAqF;IACrF,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,0FAA0F;IAC1F,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,wFAAwF;IACxF,eAAe,CAAC,EAAE,iBAAiB,EAAE,CAAC;CACvC;AAoBD,iCAAiC;AACjC,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,GAAG,IAAI,CAEnE;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,IAAI,CAGtC;AAkDD,wBAAgB,YAAY,IAAI,IAAI,EAAE,CAkBrC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,2BAA2B,IAAI,IAAI,EAAE,CAEpD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,EAAE,CAGzD;AA6BD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,MAAM,GACf,gBAAgB,CAyElB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,CAAC,CAmF3B"}

dist/engine/rule-engine.js

@@ -24,5 +24,5 @@ /**
     const candidates = [
-        join(__dirname, "../rules/rules.json"), // dist: dist/engine -> dist/rules (preferred)
-        join(__dirname, "../../dist/rules/rules.json"), // src: src/engine -> dist/rules (test runs from src after build)
-        join(__dirname, "../../rules/rules.json"), // src: src/engine -> rules (raw fallback, no backend_required flags)
+        join(__dirname, "../rules/rules.json"), // dist: dist/engine -> dist/rules (preferred for production)
+        join(__dirname, "../../rules/rules.json"), // src: src/engine -> rules (source rules, preferred for vitest — always current)
+        join(__dirname, "../../dist/rules/rules.json"), // src: src/engine -> dist/rules (last resort — may be stale relative to source)
     ];
@@ -37,2 +37,3 @@ for (const c of candidates) {
 let _rules = null;
+let _compiledRegexCache = null;
 // ----------------------------------------------------------------------
@@ -56,2 +57,52 @@ // Backend client wiring (B4 closes the orphan B3 left behind)
 }
+/**
+ * Reset the rules and regex caches — used in tests to achieve clean isolation
+ * between test suites that call loadAllRules() or setBackendClient().
+ */
+export function resetRulesCache() {
+    _rules = null;
+    _compiledRegexCache = null;
+}
+/**
+ * Single authoritative predicate for "is this rule constitutional?"
+ * Used by both loadConstitutionalRulesOnly() and the block-routing logic
+ * in evaluateAction() so the invariant is maintained consistently.
+ *
+ * A rule is constitutional when:
+ *   - tier === "constitutional", OR
+ *   - enforcement === "constitutional", OR
+ *   - constitutional === true (legacy flag)
+ * AND it is not overridden by a non-constitutional tier value.
+ */
+function isConstitutional(r) {
+    return (r.tier === "constitutional" ||
+        r.enforcement === "constitutional" ||
+        r.constitutional === true) &&
+        r.tier !== "recommended_default" &&
+        r.tier !== "premium" &&
+        r.tier !== "genesis_private";
+}
+/**
+ * Get or compile the cached RegExp for a rule.
+ * Returns null if the rule has no compiled_regex or the pattern is invalid.
+ * Caches results in the module-level _compiledRegexCache to avoid
+ * recompiling on every evaluateAction() call.
+ */
+function getCompiledRegex(rule) {
+    if (!rule.compiled_regex)
+        return null;
+    if (!_compiledRegexCache)
+        _compiledRegexCache = new Map();
+    let re = _compiledRegexCache.get(rule.id);
+    if (!re) {
+        try {
+            re = new RegExp(rule.compiled_regex, "i");
+            _compiledRegexCache.set(rule.id, re);
+        }
+        catch {
+            return null;
+        }
+    }
+    return re;
+}
 /** True iff the premium backend is fully configured (token present). */
@@ -64,2 +115,5 @@ function isBackendConfigured() {
         return _rules;
+    // Reset regex cache whenever rules are (re-)loaded so cache entries from
+    // a previous test-injected rules set cannot bleed into the new set.
+    _compiledRegexCache = null;
     try {
@@ -92,9 +146,3 @@ const raw = readFileSync(RULES_PATH, "utf-8");
 export function loadConstitutionalRulesOnly() {
-    return loadAllRules().filter((r) => r &&
-        (r.tier === "constitutional" ||
-            r.enforcement === "constitutional" ||
-            r.constitutional === true) &&
-        r.tier !== "recommended_default" &&
-        r.tier !== "premium" &&
-        r.tier !== "genesis_private");
+    return loadAllRules().filter((r) => r && isConstitutional(r));
 }
@@ -112,9 +160,13 @@ /**
 }
-/** Returns true if the rule should be enforced locally. */
-function isLocalRule(rule, backendConfigured) {
-    if (!rule.backend_required)
-        return true;
-    // Premium rule + backend configured => future HTTP path. Until that lands,
-    // we still skip locally and log it so the caller can see what was deferred.
-    return backendConfigured;
+/**
+ * Returns true if the rule should be enforced locally (synchronous path).
+ *
+ * Premium rules (backend_required: true) are ALWAYS deferred to the async
+ * backend path via evaluateActionAsync(). They are never evaluated locally,
+ * regardless of whether a backend token is configured. This prevents the
+ * double-evaluation bug where a premium rule was matched locally by the
+ * heuristic AND then again by the backend, producing inconsistent results.
+ */
+function isLocalRule(rule) {
+    return !rule.backend_required;
 }
@@ -144,8 +196,2 @@ /** Map a rule + enforcement_mode to the severity tier label. */
     const skippedPremium = [];
-    // B4: sync evaluateAction always skips premium rules locally — the
-    // BackendClient lives behind the async wrapper `evaluateActionAsync`.
-    // This keeps the smoke test + legacy sync callers synchronous. Premium
-    // rules show up in skipped_premium; the async wrapper then enriches the
-    // result with backend_results when SUNAIVA_GATE_API_TOKEN is set.
-    const backendConfigured = false;
     let maxSeverity = null;
@@ -161,13 +207,29 @@ const bumpSeverity = (s) => {
     for (const rule of activeRules) {
-        if (!isLocalRule(rule, backendConfigured)) {
+        // Premium rules (backend_required: true) are always deferred to the async
+        // path. isLocalRule() returns false for them unconditionally so they land
+        // in skipped_premium and evaluateActionAsync() delegates them to the backend.
+        if (!isLocalRule(rule)) {
             skippedPremium.push(rule.id);
             continue;
         }
-        const result = matchAction(combined, rule.detection_pattern);
-        if (!result.matched)
+        // Deterministic compiled-regex fast path (Fault #24 fix). When a rule
+        // carries `compiled_regex`, use the module-level cached RegExp — O(<1ms),
+        // no keyword extraction heuristics. Falls back to heuristic pattern-matcher
+        // if the rule has no compiled_regex (getCompiledRegex returns null).
+        let matched;
+        const cachedRe = getCompiledRegex(rule);
+        if (cachedRe !== null) {
+            matched = cachedRe.test(combined);
+        }
+        else {
+            matched = matchAction(combined, rule.detection_pattern).matched;
+        }
+        if (!matched)
             continue;
         const tier = deriveSeverity(rule);
         bumpSeverity(tier);
-        if (rule.enforcement === "constitutional") {
+        if (isConstitutional(rule)) {
             // HARD: always block, regardless of enforcement_mode.
+            // Uses the shared isConstitutional() predicate — catches both
+            // enforcement==="constitutional" AND tier==="constitutional" rules.
             violations.push(rule);
@@ -174,0 +236,0 @@ wouldHaveBlocked.push(rule.id);

dist/engine/rule-engine.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"rule-engine.js","sourceRoot":"","sources":["../../src/engine/rule-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,yEAAyE;AACzE,8EAA8E;AAC9E,2DAA2D;AAC3D,SAAS,gBAAgB;IACvB,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC,EAAE,8CAA8C;QACtF,IAAI,CAAC,SAAS,EAAE,6BAA6B,CAAC,EAAE,iEAAiE;QACjH,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,EAAE,qEAAqE;KACjH,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,yCAAyC;AACjE,CAAC;AAED,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAC;AAsCtC,IAAI,MAAM,GAAkB,IAAI,CAAC;AAEjC,yEAAyE;AACzE,8DAA8D;AAC9D,yEAAyE;AACzE,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,iDAAiD;AACjD,IAAI,cAAc,GAAyB,IAAI,CAAC;AAEhD,iEAAiE;AACjE,SAAS,gBAAgB;IACvB,IAAI,CAAC,cAAc;QAAE,cAAc,GAAG,IAAI,aAAa,EAAE,CAAC;IAC1D,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,iCAAiC;AACjC,MAAM,UAAU,gBAAgB,CAAC,MAA4B;IAC3D,cAAc,GAAG,MAAM,CAAC;AAC1B,CAAC;AAED,wEAAwE;AACxE,SAAS,mBAAmB;IAC1B,OAAO,gBAAgB,EAAE,CAAC,YAAY,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAW,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2DAA2D;QAC3D,2DAA2D;QAC3D,OAAO,CAAC,KAAK,CACX,qDAAqD,UAAU,IAAI;YACjE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CACrD,CAAC;QACF,MAAM,GAAG,EAAE,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO,YAAY,EAAE,CAAC,MAAM,CAC1B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC;QACD,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB;YAC1B,CAAC,CAAC,WAAW,KAAK,gBAAgB;YAClC,CAAC,CAAC,cAAc,KAAK,IAAI,CAAC;QAC5B,CAAC,CAAC,IAAI,KAAK,qBAAqB;QAChC,CAAC,CAAC,IAAI,KAAK,SAAS;QACpB,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAC/B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAkB;IAC/C,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,2DAA2D;AAC3D,SAAS,WAAW,CAAC,IAAU,EAAE,iBAA0B;IACzD,IAAI,CAAC,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACxC,2EAA2E;IAC3E,4EAA4E;IAC5E,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,gEAAgE;AAChE,SAAS,cAAc,CAAC,IAAU;IAChC,+CAA+C;IAC/C,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,IAAI,IAAI,CAAC,WAAW,KAAK,gBAAgB;QAAE,OAAO,MAAM,CAAC;IAC3F,4EAA4E;IAC5E,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC;QAC5C,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IAC5C,sCAAsC;IACtC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,MAAkB,EAClB,aAAkC,EAClC,OAAgB;IAEhB,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAE3D,MAAM,UAAU,GAAW,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAW,EAAE,CAAC;IAC5B,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,MAAM,cAAc,GAAa,EAAE,CAAC;IAEpC,mEAAmE;IACnE,sEAAsE;IACtE,uEAAuE;IACvE,wEAAwE;IACxE,kEAAkE;IAClE,MAAM,iBAAiB,GAAG,KAAK,CAAC;IAEhC,IAAI,WAAW,GAAwB,IAAI,CAAC;IAC5C,MAAM,YAAY,GAAG,CAAC,CAAe,EAAE,EAAE;QACvC,IAAI,WAAW,KAAK,IAAI;YAAE,WAAW,GAAG,CAAC,CAAC;aACrC,IAAI,CAAC,KAAK,MAAM;YAAE,WAAW,GAAG,MAAM,CAAC;aACvC,IAAI,CAAC,KAAK,QAAQ,IAAI,WAAW,KAAK,MAAM;YAAE,WAAW,GAAG,QAAQ,CAAC;IAC5E,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC1C,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,SAAS;QAE9B,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAClC,YAAY,CAAC,IAAI,CAAC,CAAC;QAEnB,IAAI,IAAI,CAAC,WAAW,KAAK,gBAAgB,EAAE,CAAC;YAC1C,sDAAsD;YACtD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;aAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,mDAAmD;YACnD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,qDAAqD;YACrD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,MAAM,CAAC,gBAAgB,KAAK,WAAW,IAAI,MAAM,CAAC,gBAAgB,KAAK,OAAO,EAAE,CAAC;gBACnF,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjC,CAAC;iBAAM,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC;IACxC,OAAO;QACL,OAAO;QACP,UAAU;QACV,QAAQ;QACR,aAAa,EAAE,WAAW;QAC1B,kBAAkB,EAAE,gBAAgB;QACpC,eAAe,EAAE,cAAc;KAChC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,MAAkB,EAClB,aAAkC,EAClC,OAAgB;IAEhB,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IAEpE,+DAA+D;IAC/D,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAC1E,CAAC;IAEF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3C,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3D,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,QAAQ,CACvC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC7B,QAAQ,EACR,EAAE,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACzC,CAAC;IAEF,mEAAmE;IACnE,oEAAoE;IACpE,MAAM,UAAU,GAAW,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAW,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,gBAAgB,GAAa,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAChE,IAAI,WAAW,GAAwB,IAAI,CAAC,aAAa,CAAC;IAE1D,MAAM,IAAI,GAAG,CAAC,CAAe,EAAE,EAAE;QAC/B,IAAI,WAAW,KAAK,IAAI;YAAE,WAAW,GAAG,CAAC,CAAC;aACrC,IAAI,CAAC,KAAK,MAAM;YAAE,WAAW,GAAG,MAAM,CAAC;aACvC,IAAI,CAAC,KAAK,QAAQ,IAAI,WAAW,KAAK,MAAM;YAAE,WAAW,GAAG,QAAQ,CAAC;IAC5E,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,SAAS;QACzB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI;YAAE,SAAS;QAEpB,wEAAwE;QACxE,MAAM,IAAI,GACR,IAAI,CAAC,WAAW,KAAK,gBAAgB;YACnC,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM;gBACrB,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,QAAQ,CAAC;QACjB,IAAI,CAAC,IAAI,CAAC,CAAC;QAEX,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAChD,CAAC,EAAE,EAAE,EAAE,CACL,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,OAAO,KAAK,EAAE;QAChB,CAAC,CAAC,MAAM,KAAK,kBAAkB;QAC/B,CAAC,CAAC,MAAM,KAAK,kBAAkB;QAC/B,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CACnC,CACJ,CAAC;IAEF,kFAAkF;IAClF,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO;SACrC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;SAC9C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAEzB,iDAAiD;IACjD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,cAAc,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAE/E,OAAO;QACL,OAAO,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC;QAChC,UAAU;QACV,QAAQ;QACR,aAAa,EAAE,WAAW;QAC1B,kBAAkB,EAAE,gBAAgB;QACpC,eAAe,EAAE,YAAY;QAC7B,eAAe,EAAE,WAAW,CAAC,OAAO;KACrC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"rule-engine.js","sourceRoot":"","sources":["../../src/engine/rule-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,yEAAyE;AACzE,8EAA8E;AAC9E,2DAA2D;AAC3D,SAAS,gBAAgB;IACvB,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC,EAAE,6DAA6D;QACrG,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,EAAE,iFAAiF;QAC5H,IAAI,CAAC,SAAS,EAAE,6BAA6B,CAAC,EAAE,gFAAgF;KACjI,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,yCAAyC;AACjE,CAAC;AAED,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAC;AA8CtC,IAAI,MAAM,GAAkB,IAAI,CAAC;AACjC,IAAI,mBAAmB,GAA+B,IAAI,CAAC;AAE3D,yEAAyE;AACzE,8DAA8D;AAC9D,yEAAyE;AACzE,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,iDAAiD;AACjD,IAAI,cAAc,GAAyB,IAAI,CAAC;AAEhD,iEAAiE;AACjE,SAAS,gBAAgB;IACvB,IAAI,CAAC,cAAc;QAAE,cAAc,GAAG,IAAI,aAAa,EAAE,CAAC;IAC1D,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,iCAAiC;AACjC,MAAM,UAAU,gBAAgB,CAAC,MAA4B;IAC3D,cAAc,GAAG,MAAM,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,GAAG,IAAI,CAAC;IACd,mBAAmB,GAAG,IAAI,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,gBAAgB,CAAC,CAAO;IAC/B,OAAO,CACL,CAAC,CAAC,IAAI,KAAK,gBAAgB;QAC3B,CAAC,CAAC,WAAW,KAAK,gBAAgB;QAClC,CAAC,CAAC,cAAc,KAAK,IAAI,CAC1B;QACC,CAAC,CAAC,IAAI,KAAK,qBAAqB;QAChC,CAAC,CAAC,IAAI,KAAK,SAAS;QACpB,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,IAAU;IAClC,IAAI,CAAC,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC,mBAAmB;QAAE,mBAAmB,GAAG,IAAI,GAAG,EAAE,CAAC;IAC1D,IAAI,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,IAAI,CAAC;YACH,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;YAC1C,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,wEAAwE;AACxE,SAAS,mBAAmB;IAC1B,OAAO,gBAAgB,EAAE,CAAC,YAAY,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,yEAAyE;IACzE,oEAAoE;IACpE,mBAAmB,GAAG,IAAI,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAW,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2DAA2D;QAC3D,2DAA2D;QAC3D,OAAO,CAAC,KAAK,CACX,qDAAqD,UAAU,IAAI;YACjE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CACrD,CAAC;QACF,MAAM,GAAG,EAAE,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO,YAAY,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAkB;IAC/C,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,IAAU;IAC7B,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC;AAChC,CAAC;AAED,gEAAgE;AAChE,SAAS,cAAc,CAAC,IAAU;IAChC,+CAA+C;IAC/C,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,IAAI,IAAI,CAAC,WAAW,KAAK,gBAAgB;QAAE,OAAO,MAAM,CAAC;IAC3F,4EAA4E;IAC5E,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC;QAC5C,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IAC5C,sCAAsC;IACtC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,MAAkB,EAClB,aAAkC,EAClC,OAAgB;IAEhB,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAE3D,MAAM,UAAU,GAAW,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAW,EAAE,CAAC;IAC5B,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,MAAM,cAAc,GAAa,EAAE,CAAC;IAEpC,IAAI,WAAW,GAAwB,IAAI,CAAC;IAC5C,MAAM,YAAY,GAAG,CAAC,CAAe,EAAE,EAAE;QACvC,IAAI,WAAW,KAAK,IAAI;YAAE,WAAW,GAAG,CAAC,CAAC;aACrC,IAAI,CAAC,KAAK,MAAM;YAAE,WAAW,GAAG,MAAM,CAAC;aACvC,IAAI,CAAC,KAAK,QAAQ,IAAI,WAAW,KAAK,MAAM;YAAE,WAAW,GAAG,QAAQ,CAAC;IAC5E,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,0EAA0E;QAC1E,0EAA0E;QAC1E,8EAA8E;QAC9E,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,sEAAsE;QACtE,0EAA0E;QAC1E,4EAA4E;QAC5E,qEAAqE;QACrE,IAAI,OAAgB,CAAC;QACrB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAClC,YAAY,CAAC,IAAI,CAAC,CAAC;QAEnB,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,sDAAsD;YACtD,8DAA8D;YAC9D,oEAAoE;YACpE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;aAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,mDAAmD;YACnD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,qDAAqD;YACrD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,MAAM,CAAC,gBAAgB,KAAK,WAAW,IAAI,MAAM,CAAC,gBAAgB,KAAK,OAAO,EAAE,CAAC;gBACnF,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjC,CAAC;iBAAM,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC;IACxC,OAAO;QACL,OAAO;QACP,UAAU;QACV,QAAQ;QACR,aAAa,EAAE,WAAW;QAC1B,kBAAkB,EAAE,gBAAgB;QACpC,eAAe,EAAE,cAAc;KAChC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,MAAkB,EAClB,aAAkC,EAClC,OAAgB;IAEhB,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IAEpE,+DAA+D;IAC/D,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAC1E,CAAC;IAEF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3C,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3D,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,QAAQ,CACvC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC7B,QAAQ,EACR,EAAE,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACzC,CAAC;IAEF,mEAAmE;IACnE,oEAAoE;IACpE,MAAM,UAAU,GAAW,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAW,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,gBAAgB,GAAa,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAChE,IAAI,WAAW,GAAwB,IAAI,CAAC,aAAa,CAAC;IAE1D,MAAM,IAAI,GAAG,CAAC,CAAe,EAAE,EAAE;QAC/B,IAAI,WAAW,KAAK,IAAI;YAAE,WAAW,GAAG,CAAC,CAAC;aACrC,IAAI,CAAC,KAAK,MAAM;YAAE,WAAW,GAAG,MAAM,CAAC;aACvC,IAAI,CAAC,KAAK,QAAQ,IAAI,WAAW,KAAK,MAAM;YAAE,WAAW,GAAG,QAAQ,CAAC;IAC5E,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,SAAS;QACzB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI;YAAE,SAAS;QAEpB,wEAAwE;QACxE,MAAM,IAAI,GACR,IAAI,CAAC,WAAW,KAAK,gBAAgB;YACnC,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM;gBACrB,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,QAAQ,CAAC;QACjB,IAAI,CAAC,IAAI,CAAC,CAAC;QAEX,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAChD,CAAC,EAAE,EAAE,EAAE,CACL,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,OAAO,KAAK,EAAE;QAChB,CAAC,CAAC,MAAM,KAAK,kBAAkB;QAC/B,CAAC,CAAC,MAAM,KAAK,kBAAkB;QAC/B,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CACnC,CACJ,CAAC;IAEF,kFAAkF;IAClF,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO;SACrC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;SAC9C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAEzB,iDAAiD;IACjD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,cAAc,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAE/E,OAAO;QACL,OAAO,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC;QAChC,UAAU;QACV,QAAQ;QACR,aAAa,EAAE,WAAW;QAC1B,kBAAkB,EAAE,gBAAgB;QACpC,eAAe,EAAE,YAAY;QAC7B,eAAe,EAAE,WAAW,CAAC,OAAO;KACrC,CAAC;AACJ,CAAC"}

dist/engine/ship-confidence-gate.d.ts

@@ -50,3 +50,3 @@ /**
 export declare const HOOK_NAME = "ship_confidence_gate";
-export declare const HOOK_VERSION = "1.2.0";
+export declare const HOOK_VERSION = "2.0.0";
 export declare const RULE_NAME = "Rule 42 \u2014 Ship Confidence Gate";
@@ -53,0 +53,0 @@ export declare const RULE_VERSION = "1.0";

dist/engine/ship-confidence-gate.js

@@ -57,3 +57,3 @@ /**
 export const HOOK_NAME = "ship_confidence_gate";
-export const HOOK_VERSION = "1.2.0";
+export const HOOK_VERSION = "2.0.0";
 export const RULE_NAME = "Rule 42 — Ship Confidence Gate";
@@ -60,0 +60,0 @@ export const RULE_VERSION = "1.0";

dist/index.js

@@ -9,3 +9,3 @@ #!/usr/bin/env node
 import { handleUpdateRules } from "./tools/update.js";
-import { handleGetAuditLog } from "./tools/audit.js";
+import { handleGetAuditLog, handleVerifyAuditChain } from "./tools/audit.js";
 import { handleShipConfidenceCheck } from "./tools/ship-confidence.js";
@@ -18,9 +18,16 @@ import { ShipConfidenceGate } from "./engine/ship-confidence-gate.js";
 import { SUPPORTED_AGENTS } from "./installer/detect.js";
+import { installAll, formatResults } from "./installer/install.js";
+import { parseInstallArgs, computeInstallExitCode, buildInstallSummary } from "./installer/cli-args.js";
 import { maybeShowNudge } from "./identity/nudge.js";
 import { emitFirstRunIfNeeded } from "./identity/first-run.js";
 import { emitObsEventAwaitable } from "./identity/telemetry.js";
+import { handleSetRuleMode, handleGetRuleModes, handleResetRuleMode } from "./tools/modes.js";
+import { handleAddCustomRule, handleUpdateCustomRule, handleDeleteCustomRule, handleListCustomRules } from "./tools/custom-rules.js";
+import { handleListPresets, handleApplyPreset } from "./tools/presets.js";
+import { setEnforceMode } from "./config/loader.js";
+import { BackendClient } from "./engine/backend-client.js";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
-const PKG_VERSION = "1.1.9";
+const PKG_VERSION = "2.0.0";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -68,2 +75,52 @@ const server = new Server({ name: "sunaiva-gate", version: PKG_VERSION }, { capabilities: { tools: {} } });
         },
+        {
+            name: "audit_verify",
+            description: "Verify the forward-linked cryptographic hash chain of the Gate audit log (Patent Claim 19). Reports chain integrity, tamper evidence, and ed25519 signature validity per entry.",
+            inputSchema: { type: "object", properties: {} },
+        },
+        {
+            name: "set_rule_mode",
+            description: "Set enforcement mode (shadow/advisory/enforce) for a specific rule. Requires API key (Pro+).",
+            inputSchema: { type: "object", properties: { rule_id: { type: "string", description: "Rule ID to configure" }, mode: { type: "string", enum: ["shadow", "advisory", "enforce"], description: "Enforcement mode" }, agent_id: { type: "string", description: "Optional: scope override to a specific agent ID" } }, required: ["rule_id", "mode"] },
+        },
+        {
+            name: "get_rule_modes",
+            description: "List all enforcement-mode overrides configured for the authenticated customer. Requires API key (Pro+).",
+            inputSchema: { type: "object", properties: {} },
+        },
+        {
+            name: "reset_rule_mode",
+            description: "Remove a mode override for a rule, reverting it to its default enforcement mode. Requires API key (Pro+).",
+            inputSchema: { type: "object", properties: { rule_id: { type: "string", description: "Rule ID whose override to remove" } }, required: ["rule_id"] },
+        },
+        {
+            name: "add_custom_rule",
+            description: "Create a custom detection rule in the backend. Requires API key (Pro+).",
+            inputSchema: { type: "object", properties: { name: { type: "string", description: "Rule name" }, description: { type: "string", description: "Optional description" }, pattern: { type: "string", description: "Detection pattern (regex or keyword)" }, detection_pattern: { type: "string", description: "Compiled regex detection pattern" }, severity: { type: "string", enum: ["block", "warn", "log"], description: "Severity on match" }, tier: { type: "string", description: "Optional tier restriction" } }, required: ["name", "severity"] },
+        },
+        {
+            name: "update_custom_rule",
+            description: "Update an existing custom rule. Requires API key (Pro+).",
+            inputSchema: { type: "object", properties: { id: { type: "string", description: "Rule ID to update" }, name: { type: "string" }, description: { type: "string" }, pattern: { type: "string" }, detection_pattern: { type: "string" }, severity: { type: "string", enum: ["block", "warn", "log"] }, tier: { type: "string" } }, required: ["id"] },
+        },
+        {
+            name: "delete_custom_rule",
+            description: "Delete a custom rule. Requires API key (Pro+).",
+            inputSchema: { type: "object", properties: { id: { type: "string", description: "Rule ID to delete" } }, required: ["id"] },
+        },
+        {
+            name: "list_custom_rules",
+            description: "List all custom rules for the authenticated customer. Requires API key (Pro+).",
+            inputSchema: { type: "object", properties: {} },
+        },
+        {
+            name: "list_presets",
+            description: "List available rule preset bundles. Requires API key (Dev+).",
+            inputSchema: { type: "object", properties: {} },
+        },
+        {
+            name: "apply_preset",
+            description: "Apply a preset bundle, activating all its included rules. Requires API key (Pro+).",
+            inputSchema: { type: "object", properties: { preset_id: { type: "string", description: "ID of the preset to apply" } }, required: ["preset_id"] },
+        },
     ],
@@ -84,2 +141,12 @@ }));
             case "ship_confidence_check": return await handleShipConfidenceCheck(args);
+            case "audit_verify": return await handleVerifyAuditChain((args ?? {}));
+            case "set_rule_mode": return await handleSetRuleMode(args);
+            case "get_rule_modes": return await handleGetRuleModes((args ?? {}));
+            case "reset_rule_mode": return await handleResetRuleMode(args);
+            case "add_custom_rule": return await handleAddCustomRule(args);
+            case "update_custom_rule": return await handleUpdateCustomRule(args);
+            case "delete_custom_rule": return await handleDeleteCustomRule(args);
+            case "list_custom_rules": return await handleListCustomRules((args ?? {}));
+            case "list_presets": return await handleListPresets((args ?? {}));
+            case "apply_preset": return await handleApplyPreset(args);
             default: return { content: [{ type: "text", text: `Unknown tool: ${name}` }] };
@@ -254,6 +321,11 @@ }
 Usage:
-  npx @sunaiva/gate                Run as MCP server (stdio transport)
-  npx @sunaiva/gate --smoke-test   Run a local health check and exit
-  npx @sunaiva/gate --version      Print version and exit
-  npx @sunaiva/gate --help         Show this message
+  npx @sunaiva/gate                       Run as MCP server (stdio transport)
+  npx @sunaiva/gate install               Wire gate into detected AI agent environments
+    --dry-run                               Preview installs without writing files (exit 0)
+    --detected-only                         Install only for agents already present
+    --agents <csv>                          Target specific agents: claude-code,cursor,codex,...
+    --mcp-endpoint <url>                    Override MCP endpoint in generated shims
+  npx @sunaiva/gate --smoke-test          Run a local health check and exit
+  npx @sunaiva/gate --version             Print version and exit
+  npx @sunaiva/gate --help               Show this message
 
@@ -264,3 +336,3 @@ Environment:
 
-MCP integration: add the command to your client's mcpServers config.
+MCP integration: add the command to your client's mcpServers config, or run \`npx @sunaiva/gate install\`.
 Docs:    https://sunaiva.ai/products/gate
@@ -386,2 +458,167 @@ Support: [e-mail]`);
     }
+    // install / --install — wire sunaiva-gate into detected AI agent environments.
+    // Flags: --dry-run | --detected-only | --agents <csv> | --mcp-endpoint <url>
+    // Exit 0 = all succeeded; 1 = per-agent failure(s); 2 = internal unhandled error.
+    if (argv.includes("--install") || argv[0] === "install") {
+        const installOpts = parseInstallArgs(argv);
+        try {
+            const results = await installAll(installOpts);
+            const output = formatResults(results);
+            if (output)
+                console.log(output);
+            console.log(`\n${buildInstallSummary(results)}`);
+            process.exit(computeInstallExitCode(results));
+        }
+        catch (err) {
+            console.error(`[sunaiva-gate v${PKG_VERSION}] install error: ${err instanceof Error ? err.message : String(err)}`);
+            process.exit(2);
+        }
+    }
+    // --enforce-on / --enforce-off — free local toggle, no API key required.
+    // Writes enforcement_mode to ~/.sunaiva/gate-config.json.
+    if (argv.includes("--enforce-on")) {
+        setEnforceMode(true);
+        console.log("Gate enforcement enabled (enforce mode).");
+        process.exit(0);
+    }
+    if (argv.includes("--enforce-off")) {
+        setEnforceMode(false);
+        console.log("Gate enforcement disabled (shadow mode).");
+        process.exit(0);
+    }
+    // Control-plane CLI commands — all require SUNAIVA_GATE_API_KEY.
+    const cpApiKey = process.env.SUNAIVA_GATE_API_KEY;
+    const requireCpKey = () => {
+        if (!cpApiKey) {
+            console.error("API key required for mode changes (Pro+)");
+            process.exit(1);
+        }
+    };
+    // --mode-get
+    if (argv.includes("--mode-get")) {
+        requireCpKey();
+        const client = new BackendClient({ apiToken: cpApiKey });
+        const r = await handleGetRuleModes({}, client);
+        console.log(r.content[0].text);
+        process.exit(0);
+    }
+    // --mode-set <rule-id> <mode>
+    const modeSetIdx = argv.indexOf("--mode-set");
+    if (modeSetIdx !== -1) {
+        requireCpKey();
+        const ruleId = argv[modeSetIdx + 1];
+        const mode = argv[modeSetIdx + 2];
+        if (!ruleId || !mode) {
+            console.error("--mode-set requires <rule-id> <mode>");
+            process.exit(1);
+        }
+        const client = new BackendClient({ apiToken: cpApiKey });
+        const r = await handleSetRuleMode({ rule_id: ruleId, mode }, client);
+        console.log(r.content[0].text);
+        process.exit(0);
+    }
+    // --mode-reset <rule-id>
+    const modeResetIdx = argv.indexOf("--mode-reset");
+    if (modeResetIdx !== -1) {
+        requireCpKey();
+        const ruleId = argv[modeResetIdx + 1];
+        if (!ruleId) {
+            console.error("--mode-reset requires <rule-id>");
+            process.exit(1);
+        }
+        const client = new BackendClient({ apiToken: cpApiKey });
+        const r = await handleResetRuleMode({ rule_id: ruleId }, client);
+        console.log(r.content[0].text);
+        process.exit(0);
+    }
+    // --rule-list
+    if (argv.includes("--rule-list")) {
+        requireCpKey();
+        const client = new BackendClient({ apiToken: cpApiKey });
+        const r = await handleListCustomRules({}, client);
+        console.log(r.content[0].text);
+        process.exit(0);
+    }
+    // --rule-add '<json>'
+    const ruleAddIdx = argv.indexOf("--rule-add");
+    if (ruleAddIdx !== -1) {
+        requireCpKey();
+        const jsonStr = argv[ruleAddIdx + 1];
+        if (!jsonStr) {
+            console.error("--rule-add requires a JSON argument");
+            process.exit(1);
+        }
+        let ruleDef;
+        try {
+            ruleDef = JSON.parse(jsonStr);
+        }
+        catch {
+            console.error("--rule-add: invalid JSON");
+            process.exit(1);
+        }
+        const client = new BackendClient({ apiToken: cpApiKey });
+        const r = await handleAddCustomRule(ruleDef, client);
+        console.log(r.content[0].text);
+        process.exit(0);
+    }
+    // --rule-update <id> '<json>'
+    const ruleUpdateIdx = argv.indexOf("--rule-update");
+    if (ruleUpdateIdx !== -1) {
+        requireCpKey();
+        const ruleId = argv[ruleUpdateIdx + 1];
+        const jsonStr = argv[ruleUpdateIdx + 2];
+        if (!ruleId || !jsonStr) {
+            console.error("--rule-update requires <id> <json>");
+            process.exit(1);
+        }
+        let ruleDef;
+        try {
+            ruleDef = JSON.parse(jsonStr);
+            ruleDef.id = ruleId;
+        }
+        catch {
+            console.error("--rule-update: invalid JSON");
+            process.exit(1);
+        }
+        const client = new BackendClient({ apiToken: cpApiKey });
+        const r = await handleUpdateCustomRule(ruleDef, client);
+        console.log(r.content[0].text);
+        process.exit(0);
+    }
+    // --rule-delete <id>
+    const ruleDeleteIdx = argv.indexOf("--rule-delete");
+    if (ruleDeleteIdx !== -1) {
+        requireCpKey();
+        const ruleId = argv[ruleDeleteIdx + 1];
+        if (!ruleId) {
+            console.error("--rule-delete requires <id>");
+            process.exit(1);
+        }
+        const client = new BackendClient({ apiToken: cpApiKey });
+        const r = await handleDeleteCustomRule({ id: ruleId }, client);
+        console.log(r.content[0].text);
+        process.exit(0);
+    }
+    // --preset-list
+    if (argv.includes("--preset-list")) {
+        requireCpKey();
+        const client = new BackendClient({ apiToken: cpApiKey });
+        const r = await handleListPresets({}, client);
+        console.log(r.content[0].text);
+        process.exit(0);
+    }
+    // --preset-apply <id>
+    const presetApplyIdx = argv.indexOf("--preset-apply");
+    if (presetApplyIdx !== -1) {
+        requireCpKey();
+        const presetId = argv[presetApplyIdx + 1];
+        if (!presetId) {
+            console.error("--preset-apply requires <preset-id>");
+            process.exit(1);
+        }
+        const client = new BackendClient({ apiToken: cpApiKey });
+        const r = await handleApplyPreset({ preset_id: presetId }, client);
+        console.log(r.content[0].text);
+        process.exit(0);
+    }
     // Kill-switch: do not even attach the transport when disabled. The MCP host
@@ -388,0 +625,0 @@ // will see a server that responds with allowed=true to everything (validate.ts

dist/index.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAmB,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAkB,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,WAAW,GAAG,OAAO,CAAC;AAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/D,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE,EAC9C,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;AAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IAC5D,KAAK,EAAE;QACL;YACE,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,8GAA8G;YAC3H,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wBAAwB,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6BAA6B,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;SAClN;QACD;YACE,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,2FAA2F;YACxG,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0BAA0B,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8BAA8B,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;SAChO;QACD;YACE,IAAI,EAAE,WAAW;YACjB,WAAW,EAAE,0EAA0E;YACvF,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uBAAuB,EAAE,EAAE,EAAE;SACnL;QACD;YACE,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,8EAA8E;YAC3F,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,qBAAqB,EAAE,EAAE,EAAE;SACpO;QACD;YACE,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,sEAAsE;YACnF,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oCAAoC,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,EAAE,EAAE;SAC7L;QACD;YACE,IAAI,EAAE,uBAAuB;YAC7B,WAAW,EAAE,kMAAkM;YAC/M,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yDAAyD,EAAE;oBACvG,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oEAAoE,EAAE;oBACtH,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uDAAuD,EAAE;iBAChG;gBACD,QAAQ,EAAE,CAAC,aAAa,CAAC;aAC1B;SACF;KACF;CACF,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5D,6EAA6E;IAC7E,gFAAgF;IAChF,KAAK,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAEvC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;IAC7C,IAAI,CAAC;QACH,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,iBAAiB,CAAC,CAAC,OAAO,MAAM,oBAAoB,CAAC,IAAkD,CAAC,CAAC;YAC9G,KAAK,YAAY,CAAC,CAAC,OAAO,MAAM,eAAe,CAAC,IAA6C,CAAC,CAAC;YAC/F,KAAK,WAAW,CAAC,CAAC,OAAO,MAAM,cAAc,CAAC,IAA4C,CAAC,CAAC;YAC5F,KAAK,cAAc,CAAC,CAAC,OAAO,MAAM,iBAAiB,CAAC,IAA+C,CAAC,CAAC;YACrG,KAAK,eAAe,CAAC,CAAC,OAAO,MAAM,iBAAiB,CAAC,IAA+C,CAAC,CAAC;YACtG,KAAK,uBAAuB,CAAC,CAAC,OAAO,MAAM,yBAAyB,CAAC,IAAuD,CAAC,CAAC;YAC9H,OAAO,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,iBAAiB,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;QAC1F,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACtH,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,8FAA8F;AAC9F,SAAS,oBAAoB,CAAC,UAAoB;IAChD,OAAO;QACL,GAAG,cAAc;QACjB,YAAY,EAAE,UAAU;QACxB,gBAAgB,EAAE,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,MAAM,GAAqD,EAAE,CAAC;IACpE,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;IAC9D,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,QAAQ,GAAmC,EAAE,CAAC;IAElD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAChC,CAAC,CAAE,MAAyC;YAC5C,CAAC,CAAE,MAAM,CAAC,MAAM,CAAC,MAAmC,CAAC,CAAC,IAAI,EAAqC,CAAC;QAClG,QAAQ,GAAG,IAAI,CAAC;QAChB,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC;QACzB,mBAAmB,GAAG,IAAI,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,KAAK,gBAAgB,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI,CAAC,CAC9E,CAAC,MAAM,CAAC;QACT,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;QAC3E,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,QAAQ,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,sBAAsB;YAC7B,EAAE,EAAE,mBAAmB,GAAG,CAAC;YAC3B,MAAM,EAAE,GAAG,mBAAmB,yCAAyC;SACxE,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,eAAe;YACtB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,GAAG,YAAY,4BAA4B;SACpD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,GAAG,IAAI,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,aAAa;YACpB,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,8BAA8B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACzF,CAAC,CAAC;IACL,CAAC;IAED,yDAAyD;IACzD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,oBAAoB;YAC3B,EAAE,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC;YACrB,MAAM,EAAE,YAAY,QAAQ,CAAC,IAAI,iCAAiC;SACnE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,oBAAoB;YAC3B,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACxE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAClF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,GAAG,IAAI,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,cAAc;YACrB,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SAC3F,CAAC,CAAC;IACL,CAAC;IAED,oDAAoD;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG,CAAC;IACxD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAY,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG;YAChB,EAAE,KAAK,EAAE,sBAAsB,EAAE,MAAM,EAAE,sBAAsB,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE;YAC5G,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE;YACxD,4FAA4F;YAC5F,6FAA6F;YAC7F,iGAAiG;YACjG,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,0BAA0B,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE;YACpG,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,gDAAgD,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE;SACxI,CAAC;QAEF,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,EAAkB,CAAC,CAAC;gBACzE,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,KAAK,MAAM,CAAC;gBAChD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC;gBACxE,IAAI,EAAW,CAAC;gBAChB,IAAI,MAAc,CAAC;gBAEnB,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;oBAClB,EAAE,GAAG,OAAO,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBACrD,MAAM,GAAG,EAAE;wBACT,CAAC,CAAC,kBAAkB,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE;wBACtG,CAAC,CAAC,qBAAqB,EAAE,CAAC,YAAY,cAAc,MAAM,CAAC,aAAa,eAAe,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1I,CAAC;qBAAM,CAAC;oBACN,EAAE,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC;oBAChC,MAAM,GAAG,EAAE;wBACT,CAAC,CAAC,OAAO;wBACT,CAAC,CAAC,kCAAkC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvF,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,KAAK,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAChE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,cAAc,EAAE,CAAC,KAAK,GAAG;oBAChC,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC,CAAC;IAE5F,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,aAAa;YACpB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,2EAA2E;SACpF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,SAAS;YAChB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,mEAAmE;SAC5E,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IACrG,OAAO,CAAC,GAAG,CAAC,YAAY,WAAW,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAE3C,mDAAmD;IACnD,gBAAgB;IAChB,8CAA8C;IAC9C,yEAAyE;IACzE,IAAI,KAAK;QAAE,OAAO,CAAC,CAAC;IACpB,IAAI,YAAY;QAAE,OAAO,CAAC,CAAC;IAC3B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,kBAAkB,WAAW;;;;;;;;;;;;;;4BAcjB,CAAC,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,+CAA+C;IAC/C,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,wEAAwE;IACxE,0CAA0C;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,8EAA8E;QAC9E,cAAc,EAAE,CAAC;QAEjB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ,IAAI,CAAE,gBAAsC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7E,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9C,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,+CAA+C,SAAS,GAAG,CACzF,CAAC;YACF,+DAA+D;YAC/D,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;gBACb,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE,SAAS;gBAChB,YAAY,EAAE,QAAQ,IAAI,SAAS;gBACnC,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,SAAS;gBACrB,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,oCAAoC;gBAC5C,SAAS,EAAE,IAAI;gBACf,YAAY,EAAE,WAAW;aAC1B,CAAC,CACH,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,yEAAyE;QACzE,IAAI,GAAG,GAAY,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;YAC/B,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,mEAAmE;QACrE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,QAAqB,EAAE,WAAW,CAAC,CAAC;YACzE,yEAAyE;YACzE,uEAAuE;YACvE,4DAA4D;YAC5D,0EAA0E;YAC1E,2EAA2E;YAC3E,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACrC,MAAM,qBAAqB,CAAC;gBAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,KAAK,EAAE,OAAO,CAAC,YAAY;gBAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8DAA8D;YAC9D,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,wCAAwC,EACrE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;gBACb,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE,SAAS;gBAChB,YAAY,EAAE,QAAQ;gBACtB,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,SAAS;gBACrB,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,wCAAwC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;gBAClG,SAAS,EAAE,IAAI;gBACf,YAAY,EAAE,WAAW;aAC1B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,oEAAoE;IACpE,oEAAoE;IACpE,iCAAiC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChD,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,kBAAkB,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE;gBAC1C,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;aAC5C,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;gBACE,OAAO,EAAE,MAAM,CAAC,QAAQ,KAAK,OAAO;gBACpC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,4CAA4C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC5H,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,+EAA+E;IAC/E,mEAAmE;IACnE,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG,EAAE,CAAC;QAC7C,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,sEAAsE,CACpG,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,yEAAyE;AACzE,qDAAqD;AACrD,yEAAyE;AACzE,0EAA0E;AAC1E,sEAAsE;AACtE,2EAA2E;AAC3E,kCAAkC;AAClC,kCAAkC;AAClC,0EAA0E;AAC1E,6DAA6D;AAC7D,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,yEAAyE;AAEzE,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,GAAG,CAAC;IACrE,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,cAAc,GAAG,GAAG,KAAK,aAAa,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAErF,yDAAyD;IACzD,IAAI,CAAC;QACH,yEAAyE;QACzE,MAAM,CAAC,kBAAkB,CAAC;aACvB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACV,CAAC,CAAC,WAAW,CAAC;gBACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,YAAY,EAAE,WAAW;gBACzB,SAAS,EAAE,cAAc;gBACzB,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO;gBAChD,WAAW,EAAE,GAAG;gBAChB,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAChC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB;aAClE,CAAC,CAAC;QACL,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,oDAAoD;IACtD,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,+EAA+E,EAC5G,GAAG,CACJ,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,yCAAyC,EACtE,GAAG,CACJ,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,0CAA0C,EACvE,GAAG,CACJ,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAmB,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAkB,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACxG,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC9F,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACrI,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,WAAW,GAAG,OAAO,CAAC;AAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/D,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE,EAC9C,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;AAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IAC5D,KAAK,EAAE;QACL;YACE,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,8GAA8G;YAC3H,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wBAAwB,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6BAA6B,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;SAClN;QACD;YACE,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,2FAA2F;YACxG,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0BAA0B,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8BAA8B,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;SAChO;QACD;YACE,IAAI,EAAE,WAAW;YACjB,WAAW,EAAE,0EAA0E;YACvF,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uBAAuB,EAAE,EAAE,EAAE;SACnL;QACD;YACE,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,8EAA8E;YAC3F,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,qBAAqB,EAAE,EAAE,EAAE;SACpO;QACD;YACE,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,sEAAsE;YACnF,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oCAAoC,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,EAAE,EAAE;SAC7L;QACD;YACE,IAAI,EAAE,uBAAuB;YAC7B,WAAW,EAAE,kMAAkM;YAC/M,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yDAAyD,EAAE;oBACvG,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oEAAoE,EAAE;oBACtH,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uDAAuD,EAAE;iBAChG;gBACD,QAAQ,EAAE,CAAC,aAAa,CAAC;aAC1B;SACF;QACD;YACE,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,iLAAiL;YAC9L,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;SAChD;QACD;YACE,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,8FAA8F;YAC3G,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sBAAsB,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,WAAW,EAAE,kBAAkB,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iDAAiD,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE;SACnV;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,yGAAyG;YACtH,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;SAChD;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,2GAA2G;YACxH,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kCAAkC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE;SACrJ;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,yEAAyE;YACtF,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sBAAsB,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sCAAsC,EAAE,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kCAAkC,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,2BAA2B,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE;SACxhB;QACD;YACE,IAAI,EAAE,oBAAoB;YAC1B,WAAW,EAAE,0DAA0D;YACvE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE;SACnV;QACD;YACE,IAAI,EAAE,oBAAoB;YAC1B,WAAW,EAAE,gDAAgD;YAC7D,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE;SAC5H;QACD;YACE,IAAI,EAAE,mBAAmB;YACzB,WAAW,EAAE,gFAAgF;YAC7F,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;SAChD;QACD;YACE,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,8DAA8D;YAC3E,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;SAChD;QACD;YACE,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,oFAAoF;YACjG,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,2BAA2B,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE;SAClJ;KACF;CACF,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5D,6EAA6E;IAC7E,gFAAgF;IAChF,KAAK,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAEvC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;IAC7C,IAAI,CAAC;QACH,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,iBAAiB,CAAC,CAAC,OAAO,MAAM,oBAAoB,CAAC,IAAkD,CAAC,CAAC;YAC9G,KAAK,YAAY,CAAC,CAAC,OAAO,MAAM,eAAe,CAAC,IAA6C,CAAC,CAAC;YAC/F,KAAK,WAAW,CAAC,CAAC,OAAO,MAAM,cAAc,CAAC,IAA4C,CAAC,CAAC;YAC5F,KAAK,cAAc,CAAC,CAAC,OAAO,MAAM,iBAAiB,CAAC,IAA+C,CAAC,CAAC;YACrG,KAAK,eAAe,CAAC,CAAC,OAAO,MAAM,iBAAiB,CAAC,IAA+C,CAAC,CAAC;YACtG,KAAK,uBAAuB,CAAC,CAAC,OAAO,MAAM,yBAAyB,CAAC,IAAuD,CAAC,CAAC;YAC9H,KAAK,cAAc,CAAC,CAAC,OAAO,MAAM,sBAAsB,CAAC,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,CAAC;YAClG,KAAK,eAAe,CAAC,CAAC,OAAO,MAAM,iBAAiB,CAAC,IAA+C,CAAC,CAAC;YACtG,KAAK,gBAAgB,CAAC,CAAC,OAAO,MAAM,kBAAkB,CAAC,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,CAAC;YAChG,KAAK,iBAAiB,CAAC,CAAC,OAAO,MAAM,mBAAmB,CAAC,IAAiD,CAAC,CAAC;YAC5G,KAAK,iBAAiB,CAAC,CAAC,OAAO,MAAM,mBAAmB,CAAC,IAAiD,CAAC,CAAC;YAC5G,KAAK,oBAAoB,CAAC,CAAC,OAAO,MAAM,sBAAsB,CAAC,IAAoD,CAAC,CAAC;YACrH,KAAK,oBAAoB,CAAC,CAAC,OAAO,MAAM,sBAAsB,CAAC,IAAoD,CAAC,CAAC;YACrH,KAAK,mBAAmB,CAAC,CAAC,OAAO,MAAM,qBAAqB,CAAC,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,CAAC;YACtG,KAAK,cAAc,CAAC,CAAC,OAAO,MAAM,iBAAiB,CAAC,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,CAAC;YAC7F,KAAK,cAAc,CAAC,CAAC,OAAO,MAAM,iBAAiB,CAAC,IAA+C,CAAC,CAAC;YACrG,OAAO,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,iBAAiB,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;QAC1F,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACtH,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,8FAA8F;AAC9F,SAAS,oBAAoB,CAAC,UAAoB;IAChD,OAAO;QACL,GAAG,cAAc;QACjB,YAAY,EAAE,UAAU;QACxB,gBAAgB,EAAE,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,MAAM,GAAqD,EAAE,CAAC;IACpE,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;IAC9D,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,QAAQ,GAAmC,EAAE,CAAC;IAElD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAChC,CAAC,CAAE,MAAyC;YAC5C,CAAC,CAAE,MAAM,CAAC,MAAM,CAAC,MAAmC,CAAC,CAAC,IAAI,EAAqC,CAAC;QAClG,QAAQ,GAAG,IAAI,CAAC;QAChB,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC;QACzB,mBAAmB,GAAG,IAAI,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,KAAK,gBAAgB,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI,CAAC,CAC9E,CAAC,MAAM,CAAC;QACT,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;QAC3E,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,QAAQ,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,sBAAsB;YAC7B,EAAE,EAAE,mBAAmB,GAAG,CAAC;YAC3B,MAAM,EAAE,GAAG,mBAAmB,yCAAyC;SACxE,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,eAAe;YACtB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,GAAG,YAAY,4BAA4B;SACpD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,GAAG,IAAI,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,aAAa;YACpB,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,8BAA8B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACzF,CAAC,CAAC;IACL,CAAC;IAED,yDAAyD;IACzD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,oBAAoB;YAC3B,EAAE,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC;YACrB,MAAM,EAAE,YAAY,QAAQ,CAAC,IAAI,iCAAiC;SACnE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,oBAAoB;YAC3B,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACxE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAClF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,GAAG,IAAI,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,cAAc;YACrB,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SAC3F,CAAC,CAAC;IACL,CAAC;IAED,oDAAoD;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG,CAAC;IACxD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAY,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG;YAChB,EAAE,KAAK,EAAE,sBAAsB,EAAE,MAAM,EAAE,sBAAsB,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE;YAC5G,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE;YACxD,4FAA4F;YAC5F,6FAA6F;YAC7F,iGAAiG;YACjG,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,0BAA0B,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE;YACpG,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,gDAAgD,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE;SACxI,CAAC;QAEF,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,EAAkB,CAAC,CAAC;gBACzE,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,KAAK,MAAM,CAAC;gBAChD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC;gBACxE,IAAI,EAAW,CAAC;gBAChB,IAAI,MAAc,CAAC;gBAEnB,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;oBAClB,EAAE,GAAG,OAAO,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBACrD,MAAM,GAAG,EAAE;wBACT,CAAC,CAAC,kBAAkB,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE;wBACtG,CAAC,CAAC,qBAAqB,EAAE,CAAC,YAAY,cAAc,MAAM,CAAC,aAAa,eAAe,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1I,CAAC;qBAAM,CAAC;oBACN,EAAE,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC;oBAChC,MAAM,GAAG,EAAE;wBACT,CAAC,CAAC,OAAO;wBACT,CAAC,CAAC,kCAAkC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvF,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,KAAK,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAChE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,cAAc,EAAE,CAAC,KAAK,GAAG;oBAChC,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC,CAAC;IAE5F,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,aAAa;YACpB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,2EAA2E;SACpF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,SAAS;YAChB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,mEAAmE;SAC5E,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IACrG,OAAO,CAAC,GAAG,CAAC,YAAY,WAAW,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAE3C,mDAAmD;IACnD,gBAAgB;IAChB,8CAA8C;IAC9C,yEAAyE;IACzE,IAAI,KAAK;QAAE,OAAO,CAAC,CAAC;IACpB,IAAI,YAAY;QAAE,OAAO,CAAC,CAAC;IAC3B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,kBAAkB,WAAW;;;;;;;;;;;;;;;;;;;4BAmBjB,CAAC,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,+CAA+C;IAC/C,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,wEAAwE;IACxE,0CAA0C;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,8EAA8E;QAC9E,cAAc,EAAE,CAAC;QAEjB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ,IAAI,CAAE,gBAAsC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7E,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9C,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,+CAA+C,SAAS,GAAG,CACzF,CAAC;YACF,+DAA+D;YAC/D,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;gBACb,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE,SAAS;gBAChB,YAAY,EAAE,QAAQ,IAAI,SAAS;gBACnC,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,SAAS;gBACrB,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,oCAAoC;gBAC5C,SAAS,EAAE,IAAI;gBACf,YAAY,EAAE,WAAW;aAC1B,CAAC,CACH,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,yEAAyE;QACzE,IAAI,GAAG,GAAY,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;YAC/B,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,mEAAmE;QACrE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,QAAqB,EAAE,WAAW,CAAC,CAAC;YACzE,yEAAyE;YACzE,uEAAuE;YACvE,4DAA4D;YAC5D,0EAA0E;YAC1E,2EAA2E;YAC3E,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACrC,MAAM,qBAAqB,CAAC;gBAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,KAAK,EAAE,OAAO,CAAC,YAAY;gBAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8DAA8D;YAC9D,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,wCAAwC,EACrE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;gBACb,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE,SAAS;gBAChB,YAAY,EAAE,QAAQ;gBACtB,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,SAAS;gBACrB,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,wCAAwC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;gBAClG,SAAS,EAAE,IAAI;gBACf,YAAY,EAAE,WAAW;aAC1B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,oEAAoE;IACpE,oEAAoE;IACpE,iCAAiC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChD,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,kBAAkB,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE;gBAC1C,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;aAC5C,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;gBACE,OAAO,EAAE,MAAM,CAAC,QAAQ,KAAK,OAAO;gBACpC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,4CAA4C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC5H,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,6EAA6E;IAC7E,kFAAkF;IAClF,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,MAAM;gBAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,KAAK,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACjD,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACpG,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,0DAA0D;IAC1D,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAClC,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACnC,cAAc,CAAC,KAAK,CAAC,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,iEAAiE;IACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAClD,MAAM,YAAY,GAAG,GAAS,EAAE;QAC9B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC;IAEF,aAAa;IACb,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,YAAY,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,8BAA8B;IAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,YAAY,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,yBAAyB;IACzB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAClD,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;QACxB,YAAY,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,mBAAmB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,cAAc;IACd,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,YAAY,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,qBAAqB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,sBAAsB;IACtB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,YAAY,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,OAAkD,CAAC;QACvD,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA8C,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,8BAA8B;IAC9B,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,aAAa,KAAK,CAAC,CAAC,EAAE,CAAC;QACzB,YAAY,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,OAAqD,CAAC;QAC1D,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAiD,CAAC;YAC9E,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,qBAAqB;IACrB,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,aAAa,KAAK,CAAC,CAAC,EAAE,CAAC;QACzB,YAAY,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,gBAAgB;IAChB,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACnC,YAAY,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,sBAAsB;IACtB,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtD,IAAI,cAAc,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1B,YAAY,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;QACnE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,4EAA4E;IAC5E,+EAA+E;IAC/E,mEAAmE;IACnE,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG,EAAE,CAAC;QAC7C,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,sEAAsE,CACpG,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,yEAAyE;AACzE,qDAAqD;AACrD,yEAAyE;AACzE,0EAA0E;AAC1E,sEAAsE;AACtE,2EAA2E;AAC3E,kCAAkC;AAClC,kCAAkC;AAClC,0EAA0E;AAC1E,6DAA6D;AAC7D,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,yEAAyE;AAEzE,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,GAAG,CAAC;IACrE,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,cAAc,GAAG,GAAG,KAAK,aAAa,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAErF,yDAAyD;IACzD,IAAI,CAAC;QACH,yEAAyE;QACzE,MAAM,CAAC,kBAAkB,CAAC;aACvB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACV,CAAC,CAAC,WAAW,CAAC;gBACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,YAAY,EAAE,WAAW;gBACzB,SAAS,EAAE,cAAc;gBACzB,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO;gBAChD,WAAW,EAAE,GAAG;gBAChB,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAChC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB;aAClE,CAAC,CAAC;QACL,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,oDAAoD;IACtD,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,+EAA+E,EAC5G,GAAG,CACJ,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,yCAAyC,EACtE,GAAG,CACJ,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,KAAK,CACX,kBAAkB,WAAW,0CAA0C,EACvE,GAAG,CACJ,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC"}

dist/installer/attestation/intoto.js

@@ -33,3 +33,3 @@ /**
 const BUILD_TYPE = "https://sunaiva.ai/buildtypes/ship-confidence/v1";
-const BUILDER_ID = "https://sunaiva.ai/builders/sunaiva-gate@v1.2.0";
+const BUILDER_ID = "https://sunaiva.ai/builders/sunaiva-gate@v2.0.0";
 // ---------------------------------------------------------------------------
@@ -69,3 +69,3 @@ // Public API
             internalParameters: {
-                gate_version: "1.2.0",
+                gate_version: "2.0.0",
                 verdict_level: verdict.level,
@@ -85,3 +85,3 @@ freshness_window_minutes: verdict.freshness_window_minutes ?? null,
                 id: BUILDER_ID,
-                version: { "@sunaiva/gate": "1.2.0" },
+                version: { "@sunaiva/gate": "2.0.0" },
             },
@@ -88,0 +88,0 @@ metadata: {

dist/rules/categories.json

@@ -7,3 +7,3 @@ [
     "description": "Prevent unauthorized spending, subscriptions, wire transfers, and financial actions. The category that pays for itself immediately.",
-    "rule_count": 12,
+    "rule_count": 13,
     "risk_if_skipped": "Unauthorized charges, runaway API costs, accidental subscriptions, fraudulent transfers",
@@ -26,3 +26,3 @@ "example_incident": "gemini_credit_blaster.py ran 8 days, 35 workers, ~$800 charged — no billing cap"
     "description": "Gate destructive, irreversible, and high-impact actions — deployments, deletions, DNS changes, permission changes.",
-    "rule_count": 12,
+    "rule_count": 14,
     "risk_if_skipped": "Production outages, accidental data deletion, broken infrastructure, unauthorized access grants",
@@ -72,3 +72,3 @@ "example_incident": "Agent deletes MX record while reconfiguring email routing — all inbound email down for 4 hours"
     "description": "Prevent secret exposure in logs, privilege escalation, dependency injection, SSRF, and banned provider routing.",
-    "rule_count": 12,
+    "rule_count": 13,
     "risk_if_skipped": "Credential theft, supply chain compromise, auth bypass, proprietary code leaked to banned AI providers",
@@ -75,0 +75,0 @@ "example_incident": "Agent routes prompt containing proprietary IP to a DeepSeek endpoint to save costs"

dist/rules/presets.json

 [
   {
     "id": "minimal",
-    "name": "Minimal (5 Rules)",
-    "tagline": "The absolute floor. Five non-negotiables every AI user needs.",
-    "description": "Five constitutional rules that prevent the most catastrophic agent failures: financial loss, production destruction, data deletion, credential exposure, and unauthorised outreach. No AI agent should operate without these.",
-    "rule_count": 5,
+    "name": "Minimal (9 Rules)",
+    "tagline": "The absolute floor. Nine non-negotiables every AI user needs.",
+    "description": "Nine constitutional rules that prevent the most catastrophic agent failures: financial debit, production deploys, outreach campaigns, secret exposure — each evaluated with deterministic compiled regex, no backend required.",
+    "rule_count": 9,
     "estimated_setup_time": "30 seconds",
@@ -15,6 +15,10 @@ "best_for": "First-time users, quick start, any AI agent regardless of use case",
       "dat-001",
-      "gov-008"
+      "gov-008",
+      "cnst-fin-debit",
+      "cnst-gov-deploy",
+      "cnst-gov-outreach",
+      "cnst-sec-exposure"
     ],
     "enforcement_breakdown": {
-      "constitutional": 5,
+      "constitutional": 9,
       "standard": 0
@@ -25,6 +29,6 @@ }
     "id": "essential",
-    "name": "Essential Safety (15 Rules)",
-    "tagline": "The 15 rules every AI user should have. Prevents financial, data, and deployment disasters.",
-    "description": "Core protection across all high-risk categories. Covers the most common and most damaging agent failure modes. Recommended as the baseline for any autonomous agent setup.",
-    "rule_count": 15,
+    "name": "Essential Safety (19 Rules)",
+    "tagline": "The 19 rules every AI user should have. Prevents financial, data, and deployment disasters.",
+    "description": "Core protection across all high-risk categories. Covers the most common and most damaging agent failure modes. Includes the four compiled-regex constitutional rules that block financial debit, production deploys, outreach campaigns, and secret exposure — all free, no backend required.",
+    "rule_count": 19,
     "estimated_setup_time": "2 minutes",
@@ -47,6 +51,10 @@ "best_for": "General-purpose AI agents, automation workflows, coding assistants",
       "com-005",
-      "know-006"
+      "know-006",
+      "cnst-fin-debit",
+      "cnst-gov-deploy",
+      "cnst-gov-outreach",
+      "cnst-sec-exposure"
     ],
     "enforcement_breakdown": {
-      "constitutional": 10,
+      "constitutional": 14,
       "standard": 5
@@ -57,6 +65,6 @@ }
     "id": "developer-safety",
-    "name": "Developer Safety (25 Rules)",
+    "name": "Developer Safety (27 Rules)",
     "tagline": "Built for AI coding agents (Claude Code, Cursor, Copilot, OpenClaw). Covers quality, security, and deployment.",
-    "description": "Comprehensive ruleset for AI agents working in codebases. Addresses the unique risks of autonomous coding: accidental deletion, bad deploys, secret exposure, dependency injection, scope creep, and test-skipping. Drawn directly from real-world Genesis agent incident patterns.",
-    "rule_count": 25,
+    "description": "Comprehensive ruleset for AI agents working in codebases. Addresses the unique risks of autonomous coding: accidental deletion, bad deploys, secret exposure, dependency injection, scope creep, and test-skipping. Includes the compiled-regex deploy and secret-exposure constitutional rules.",
+    "rule_count": 27,
     "estimated_setup_time": "5 minutes",
@@ -89,6 +97,8 @@ "best_for": "Claude Code, Cursor, GitHub Copilot, OpenClaw, Jules, n8n coding workflows",
       "sec-007",
-      "know-001"
+      "know-001",
+      "cnst-gov-deploy",
+      "cnst-sec-exposure"
     ],
     "enforcement_breakdown": {
-      "constitutional": 8,
+      "constitutional": 10,
       "standard": 17
@@ -138,6 +148,6 @@ }
     "id": "full-suite",
-    "name": "Full Suite (100 Rules)",
+    "name": "Full Suite (104 Rules)",
     "tagline": "Every rule active. Maximum protection across all categories.",
-    "description": "All 100 rules enabled across all 9 categories. Comprehensive coverage for enterprise, regulated, or high-stakes AI agent deployments. Some warn-only rules may surface frequently during setup — tune severity thresholds after initial calibration.",
-    "rule_count": 100,
+    "description": "All 104 rules enabled across all 9 categories — the original 100 plus the four compiled-regex constitutional free rules. Comprehensive coverage for enterprise, regulated, or high-stakes AI agent deployments.",
+    "rule_count": 104,
     "estimated_setup_time": "10 minutes for review and calibration",
@@ -162,6 +172,7 @@ "best_for": "Enterprise deployments, regulated industries, high-stakes automation, EU AI Act compliance environments",
       "sec-007", "sec-008", "sec-009", "sec-010", "sec-011", "sec-012",
-      "cmp-001", "cmp-002", "cmp-003", "cmp-004"
+      "cmp-001", "cmp-002", "cmp-003", "cmp-004",
+      "cnst-fin-debit", "cnst-gov-deploy", "cnst-gov-outreach", "cnst-sec-exposure"
     ],
     "enforcement_breakdown": {
-      "constitutional": 35,
+      "constitutional": 39,
       "standard": 65
@@ -168,0 +179,0 @@ }

dist/tools/audit.d.ts

@@ -1,7 +0,1 @@
-/**
- * Async-style audit write. The file I/O is deferred to setImmediate so the hot
- * path (the validate_action response) returns before the syscall. Errors are
- * swallowed because the audit log is informational and must never break
- * enforcement.
- */
 export declare function appendAudit(entry: Record<string, unknown>): void;
@@ -17,2 +11,23 @@ export declare function handleGetAuditLog(args: {
 }>;
+/**
+ * handleVerifyAuditChain — MCP handler for the audit_verify tool.
+ *
+ * Verifies the forward-linked hash chain in the Gate audit log (Patent Claim 19).
+ * Checks:
+ *   1. entry_hash self-consistency (re-derives hash from all data fields)
+ *   2. prev_hash chain linkage (each entry links to sha256 of previous entry_hash)
+ *   3. ed25519 signature validity where present (Fault #11 / Patent Claim 1)
+ *
+ * Returns { valid, entry_count, checked_count, errors[] }.
+ * Suitable as a standalone diagnostic tool and as a smoke-test endpoint.
+ *
+ * index.ts registration (DO NOT add here — integration step handles this):
+ *   server.tool("audit_verify", "Verify audit log hash chain integrity", {}, handleVerifyAuditChain)
+ */
+export declare function handleVerifyAuditChain(_args?: Record<string, unknown>): Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+}>;
 //# sourceMappingURL=audit.d.ts.map

dist/tools/audit.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/tools/audit.ts"],"names":[],"mappings":"AAgCA;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAYhE;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;GAejF"}
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/tools/audit.ts"],"names":[],"mappings":"AAsCA,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAiChE;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;GAyBjF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;;;;;GAqB/E"}

dist/tools/audit.js

@@ -1,51 +0,68 @@
-import { readFileSync, appendFileSync, existsSync, mkdirSync, statSync, renameSync } from "node:fs";
-import { dirname } from "node:path";
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
 import { getConfig } from "../config/loader.js";
-// Rotate audit log when it crosses this size (bytes).
-const AUDIT_ROTATE_BYTES = 10 * 1024 * 1024; // 10 MB
-// Throttle rotation checks: only stat the file at most every 60s.
-const ROTATE_CHECK_MS = 60_000;
-let _lastRotateCheck = 0;
+import { appendAuditEntry, verifyChainIntegrity } from "../engine/audit-chain.js";
 function getLogPath() {
+    // SUNAIVA_GATE_AUDIT_DIR overrides at call time (env-set at test setup or deploy time)
+    // so tests and Docker environments can isolate without touching the on-disk config file.
+    if (process.env.SUNAIVA_GATE_AUDIT_DIR) {
+        return join(process.env.SUNAIVA_GATE_AUDIT_DIR, "audit.jsonl");
+    }
     return getConfig().audit_log_path;
 }
-function maybeRotate(logPath) {
-    const now = Date.now();
-    if (now - _lastRotateCheck < ROTATE_CHECK_MS)
-        return;
-    _lastRotateCheck = now;
-    try {
-        if (!existsSync(logPath))
-            return;
-        const size = statSync(logPath).size;
-        if (size < AUDIT_ROTATE_BYTES)
-            return;
-        // Rotate: audit.jsonl -> audit.jsonl.1 (best-effort). Single-slot rotation
-        // is acceptable for an informational audit ledger.
-        const rotated = `${logPath}.1`;
-        renameSync(logPath, rotated);
-    }
-    catch {
-        // Fail-OPEN: never let rotation block writes.
-    }
-}
 /**
- * Async-style audit write. The file I/O is deferred to setImmediate so the hot
- * path (the validate_action response) returns before the syscall. Errors are
- * swallowed because the audit log is informational and must never break
- * enforcement.
+ * appendAudit — fire-and-forget wrapper around the hash-chained appendAuditEntry.
+ *
+ * Maintains the same synchronous call signature used by validate.ts so no
+ * callers need to change. The actual I/O runs asynchronously (same behaviour
+ * as the old setImmediate path). Errors are swallowed — audit must never block
+ * enforcement (fail-OPEN per Patent Claim 17 spirit).
+ *
+ * The new appendAuditEntry from audit-chain.ts replaces the plain appendFileSync
+ * path and adds:
+ *   - forward-linked hash chain (Patent Claim 19)
+ *   - archive-then-continue rotation (never overwrites old history)
+ *   - optional ed25519 signature per entry (Fault #11 / Patent Claim 1)
+ *   - dual-lock concurrency (in-process mutex + O_EXCL file lock)
  */
+/** Standard fields that are mapped directly into the GateAuditEntry chain params. */
+const STANDARD_AUDIT_FIELDS = new Set([
+    "gate_version", "type", "action", "severity_tier",
+    "violations", "warnings", "skipped_premium", "would_have_blocked",
+    // Legacy aliases callers may use (normalised below)
+    "timestamp",
+]);
 export function appendAudit(entry) {
-    const stamped = { ...entry };
-    setImmediate(() => {
+    // Fire-and-forget — detach from the hot validation path.
+    void (async () => {
         try {
             const logPath = getLogPath();
-            mkdirSync(dirname(logPath), { recursive: true });
-            maybeRotate(logPath);
-            appendFileSync(logPath, JSON.stringify(stamped) + "\n");
+            // Collect non-standard fields (bypass rule_id/reason, rollback context,
+            // error class/message) as extra_fields. These are written verbatim to
+            // the JSONL after hash computation so they appear in audit reads without
+            // affecting chain integrity. Fixes the silent field drop for bypass.ts,
+            // rollback/engine.ts, and the failClosed error path.
+            const extra_fields = {};
+            for (const [k, v] of Object.entries(entry)) {
+                if (!STANDARD_AUDIT_FIELDS.has(k) && v !== undefined && v !== null) {
+                    extra_fields[k] = v;
+                }
+            }
+            await appendAuditEntry(logPath, {
+                gate_version: typeof entry.gate_version === "string" ? entry.gate_version : "unknown",
+                type: typeof entry.type === "string" ? entry.type : "unknown",
+                action: typeof entry.action === "string" ? entry.action : "",
+                severity_tier: typeof entry.severity_tier === "string" ? entry.severity_tier : null,
+                violations: Array.isArray(entry.violations) ? entry.violations : [],
+                warnings: Array.isArray(entry.warnings) ? entry.warnings : [],
+                skipped_premium: Array.isArray(entry.skipped_premium) ? entry.skipped_premium : [],
+                would_have_blocked: Array.isArray(entry.would_have_blocked) ? entry.would_have_blocked : [],
+                ...(Object.keys(extra_fields).length > 0 ? { extra_fields } : {}),
+            });
         }
         catch {
-            // Fail-OPEN
+            // Fail-OPEN: audit failure must never propagate to the caller.
         }
-    });
+    })();
 }
@@ -55,5 +72,6 @@ export async function handleGetAuditLog(args) {
     if (!existsSync(logPath)) {
-        return { content: [{ type: "text", text: JSON.stringify({ entries: [], total: 0 }) }] };
+        return { content: [{ type: "text", text: JSON.stringify({ entries: [], total: 0, has_unsigned_entries: false, entry_count: 0 }) }] };
     }
-    const lines = readFileSync(logPath, "utf-8").trim().split("\n").filter(Boolean);
+    const raw = await readFile(logPath, "utf-8");
+    const lines = raw.trim().split("\n").filter(Boolean);
     let entries = lines.map(l => { try {
@@ -65,8 +83,46 @@ return JSON.parse(l);
     } }).filter(Boolean);
-    if (args.rule_id)
-        entries = entries.filter((e) => e.rule_id === args.rule_id);
+    // Fix: rule_id lives at top-level OR in extra_fields (bypass/rollback events)
+    if (args.rule_id) {
+        entries = entries.filter((e) => e.rule_id === args.rule_id ||
+            e.extra_fields?.rule_id === args.rule_id);
+    }
     const limit = args.limit || 50;
+    const total_before_limit = entries.length;
     entries = entries.slice(-limit);
-    return { content: [{ type: "text", text: JSON.stringify({ entries, total: entries.length }, null, 2) }] };
+    const has_unsigned_entries = entries.some((e) => e.entry_hash && !e.ed25519_sig);
+    return { content: [{ type: "text", text: JSON.stringify({ entries, total: total_before_limit, has_unsigned_entries, entry_count: total_before_limit }, null, 2) }] };
 }
+/**
+ * handleVerifyAuditChain — MCP handler for the audit_verify tool.
+ *
+ * Verifies the forward-linked hash chain in the Gate audit log (Patent Claim 19).
+ * Checks:
+ *   1. entry_hash self-consistency (re-derives hash from all data fields)
+ *   2. prev_hash chain linkage (each entry links to sha256 of previous entry_hash)
+ *   3. ed25519 signature validity where present (Fault #11 / Patent Claim 1)
+ *
+ * Returns { valid, entry_count, checked_count, errors[] }.
+ * Suitable as a standalone diagnostic tool and as a smoke-test endpoint.
+ *
+ * index.ts registration (DO NOT add here — integration step handles this):
+ *   server.tool("audit_verify", "Verify audit log hash chain integrity", {}, handleVerifyAuditChain)
+ */
+export async function handleVerifyAuditChain(_args = {}) {
+    const logPath = getLogPath();
+    const result = await verifyChainIntegrity(logPath);
+    return {
+        content: [{
+                type: "text",
+                text: JSON.stringify({
+                    valid: result.valid,
+                    entry_count: result.entry_count,
+                    checked_count: result.checked_count,
+                    errors: result.errors,
+                    chain_tip_hash: result.chain_tip_hash,
+                    unsigned_count: result.unsigned_count,
+                    log_path: logPath,
+                }, null, 2),
+            }],
+    };
+}
 //# sourceMappingURL=audit.js.map

dist/tools/audit.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/tools/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,sDAAsD;AACtD,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ;AAErD,kEAAkE;AAClE,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,IAAI,gBAAgB,GAAG,CAAC,CAAC;AAEzB,SAAS,UAAU;IACjB,OAAO,SAAS,EAAE,CAAC,cAAc,CAAC;AACpC,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,GAAG,GAAG,gBAAgB,GAAG,eAAe;QAAE,OAAO;IACrD,gBAAgB,GAAG,GAAG,CAAC;IACvB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO;QACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;QACpC,IAAI,IAAI,GAAG,kBAAkB;YAAE,OAAO;QACtC,2EAA2E;QAC3E,mDAAmD;QACnD,MAAM,OAAO,GAAG,GAAG,OAAO,IAAI,CAAC;QAC/B,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAA8B;IACxD,MAAM,OAAO,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IAC7B,YAAY,CAAC,GAAG,EAAE;QAChB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;YAC7B,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,WAAW,CAAC,OAAO,CAAC,CAAC;YACrB,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAA0C;IAChF,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IACnG,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChF,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEvG,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC;IAEvG,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;IAEhC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACrH,CAAC"}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/tools/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAElF,SAAS,UAAU;IACjB,uFAAuF;IACvF,yFAAyF;IACzF,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,aAAa,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,SAAS,EAAE,CAAC,cAAc,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,qFAAqF;AACrF,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe;IACjD,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,oBAAoB;IACjE,oDAAoD;IACpD,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,UAAU,WAAW,CAAC,KAA8B;IACxD,yDAAyD;IACzD,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;YAE7B,wEAAwE;YACxE,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,qDAAqD;YACrD,MAAM,YAAY,GAA4B,EAAE,CAAC;YACjD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;oBACnE,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;YAED,MAAM,gBAAgB,CAAC,OAAO,EAAE;gBAC9B,YAAY,EAAE,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;gBACrF,IAAI,EAAU,OAAO,KAAK,CAAC,IAAI,KAAc,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAU,CAAC,CAAC,SAAS;gBACvF,MAAM,EAAQ,OAAO,KAAK,CAAC,MAAM,KAAY,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAQ,CAAC,CAAC,EAAE;gBAChF,aAAa,EAAE,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;gBACnF,UAAU,EAAK,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAI,CAAC,CAAE,KAAK,CAAC,UAA0B,CAAC,CAAC,CAAC,EAAE;gBAC1F,QAAQ,EAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAM,CAAC,CAAE,KAAK,CAAC,QAA0B,CAAC,CAAC,CAAC,EAAE;gBAC1F,eAAe,EAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAG,CAAC,CAAE,KAAK,CAAC,eAA8B,CAAC,CAAC,CAAC,EAAE;gBACtG,kBAAkB,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,kBAA+B,CAAC,CAAC,CAAC,EAAE;gBACzG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClE,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;QACjE,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAA0C;IAChF,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,oBAAoB,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IAChJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAA8B,CAAC;IAEpI,8EAA8E;IAC9E,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7B,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;YACzB,CAAC,CAAC,YAAoD,EAAE,OAAO,KAAK,IAAI,CAAC,OAAO,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,MAAM,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC;IAC1C,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;IAEhC,MAAM,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAEjF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,WAAW,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAChL,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAAiC,EAAE;IAC9E,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACnD,OAAO;QACL,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB;oBACE,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;oBACnC,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,cAAc,EAAE,MAAM,CAAC,cAAc;oBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;oBACrC,QAAQ,EAAE,OAAO;iBAClB,EACD,IAAI,EACJ,CAAC,CACF;aACF,CAAC;KACH,CAAC;AACJ,CAAC"}

dist/tools/validate.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/tools/validate.ts"],"names":[],"mappings":"AASA,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;;;;;GAgGA"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/tools/validate.ts"],"names":[],"mappings":"AA0BA,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;;;;;GA2GA"}

dist/tools/validate.js

@@ -0,1 +1,4 @@
+import { readFileSync } from "fs";
+import { join, dirname } from "path";
+import { fileURLToPath } from "url";
 import { evaluateActionAsync } from "../engine/rule-engine.js";
@@ -6,6 +9,21 @@ import { getConfig } from "../config/loader.js";
 import { emitObsEventAwaitable } from "../identity/telemetry.js";
-const PKG_VERSION = "1.1.1";
+// Fault #47/#31 fix: read version from package.json at load-time so the
+// published bundle never ships a stale hardcoded string. Uses the same
+// path-resolution pattern as rule-engine.ts (dist/tools → ../../package.json).
+function _readPackageVersion() {
+    try {
+        const __dir = dirname(fileURLToPath(import.meta.url));
+        const raw = readFileSync(join(__dir, "../../package.json"), "utf-8");
+        const pkg = JSON.parse(raw);
+        return pkg.version ?? "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+}
+const PKG_VERSION = _readPackageVersion();
 const HOOK_NAME = "sunaiva-gate";
 export async function handleValidateAction(args) {
     // Kill-switch: short-circuit everything if disabled.
+    // Fault #23 fix: message must NOT name the env var — never advertise the bypass.
     if (process.env.DISABLE_SUNAIVA_GATE === "1") {
@@ -20,3 +38,3 @@ return {
                         disabled: true,
-                        message: `[${HOOK_NAME} v${PKG_VERSION}] DISABLED via DISABLE_SUNAIVA_GATE=1 — all actions allowed.`,
+                        message: `[${HOOK_NAME} v${PKG_VERSION}] Gate disabled by operator configuration — all actions allowed.`,
                     }, null, 2),
@@ -58,5 +76,14 @@ }],
     // NO file paths, NO prompt text — tool + decision + rule_ids only.
+    //
+    // DELTA 4: Decision vocabulary matches the backend spec enum:
+    //   ALLOW / WARN / BLOCK / DRY_RUN  (not "allow"/"ask"/"deny")
+    // Backend GET /v1/obs/events aggregates by_status expects these exact values.
+    const obsDecision = !result.allowed
+        ? (dryRun ? "DRY_RUN" : "BLOCK")
+        : result.warnings.length > 0
+            ? "WARN"
+            : "ALLOW";
     void emitObsEventAwaitable({
         tool: args.tool_name,
-        decision: finalAllowed ? (result.warnings.length > 0 ? "ask" : "allow") : "deny",
+        decision: obsDecision,
         rule_id: result.violations[0]?.id ?? result.warnings[0]?.id ?? null,
@@ -68,7 +95,9 @@ agent: args.agent ?? null,
     });
-    // Self-stamping: every block/warn message identifies the gate + escape hatch.
+    // Self-stamping: every block/warn message identifies the gate.
+    // Fault #23 fix: the kill-switch env var stays in code but must NOT be
+    // advertised in user-facing block/warn messages (prevents self-bypass hints).
     let stamp = `[${HOOK_NAME} v${PKG_VERSION}]`;
     if (!finalAllowed) {
         const violationNames = result.violations.map(r => `${r.id} (${r.name})`).join(", ");
-        stamp += ` BLOCKED by ${violationNames}. Escape: export DISABLE_SUNAIVA_GATE=1`;
+        stamp += ` BLOCKED by ${violationNames}`;
     }
@@ -80,3 +109,3 @@ else if (dryRun && result.would_have_blocked.length > 0) {
         const warnNames = result.warnings.map(r => `${r.id} (${r.name})`).join(", ");
-        stamp += ` WARN ${warnNames}. Next match will block. Escape: export DISABLE_SUNAIVA_GATE=1`;
+        stamp += ` WARN ${warnNames}. Next match will block.`;
     }
@@ -93,3 +122,2 @@ else {
                     hook_name: HOOK_NAME,
-                    escape_hatch: "DISABLE_SUNAIVA_GATE=1",
                     severity_tier: result.severity_tier,
@@ -96,0 +124,0 @@ dry_run: dryRun,

dist/tools/validate.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/tools/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACtH,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,MAAM,WAAW,GAAG,OAAO,CAAC;AAC5B,MAAM,SAAS,GAAG,cAAc,CAAC;AAEjC,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAa1C;IACC,qDAAqD;IACrD,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG,EAAE,CAAC;QAC7C,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,OAAO,EAAE,IAAI;wBACb,YAAY,EAAE,WAAW;wBACzB,SAAS,EAAE,SAAS;wBACpB,QAAQ,EAAE,IAAI;wBACd,OAAO,EAAE,IAAI,SAAS,KAAK,WAAW,8DAA8D;qBACrG,EAAE,IAAI,EAAE,CAAC,CAAC;iBACZ,CAAC;SACH,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,eAAe,EAAE,CAAC;IAClB,sBAAsB,EAAE,CAAC;IAEzB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG,CAAC;IACxD,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAElC,qEAAqE;IACrE,+DAA+D;IAC/D,mEAAmE;IACnE,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAEjF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ;QAAE,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAErD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IACnD,MAAM,KAAK,GAAG;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,YAAY,EAAE,WAAW;QACzB,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ;QAC/C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QACjC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;KAC9C,CAAC;IACF,WAAW,CAAC,KAAK,CAAC,CAAC;IAEnB,sEAAsE;IACtE,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IAEpD,mEAAmE;IACnE,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,mEAAmE;IACnE,KAAK,qBAAqB,CAAC;QACzB,IAAI,EAAE,IAAI,CAAC,SAAS;QACpB,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM;QAChF,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI;QACnE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;QACzB,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;QACnC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;QACzB,MAAM,EAAE,IAAI,EAAE,yDAAyD;KACxE,CAAC,CAAC;IAEH,8EAA8E;IAC9E,IAAI,KAAK,GAAG,IAAI,SAAS,KAAK,WAAW,GAAG,CAAC;IAC7C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpF,KAAK,IAAI,eAAe,cAAc,yCAAyC,CAAC;IAClF,CAAC;SAAM,IAAI,MAAM,IAAI,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,KAAK,IAAI,kCAAkC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACpF,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7E,KAAK,IAAI,SAAS,SAAS,gEAAgE,CAAC;IAC9F,CAAC;SAAM,CAAC;QACN,KAAK,IAAI,QAAQ,CAAC;IACpB,CAAC;IAED,OAAO;QACL,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,OAAO,EAAE,YAAY;oBACrB,YAAY,EAAE,WAAW;oBACzB,SAAS,EAAE,SAAS;oBACpB,YAAY,EAAE,wBAAwB;oBACtC,aAAa,EAAE,MAAM,CAAC,aAAa;oBACnC,OAAO,EAAE,MAAM;oBACf,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;oBAC7C,eAAe,EAAE,MAAM,CAAC,eAAe;oBACvC,OAAO,EAAE,KAAK;oBACd,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;oBAC/F,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;iBACjE,EAAE,IAAI,EAAE,CAAC,CAAC;aACZ,CAAC;KACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/tools/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACtH,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,wEAAwE;AACxE,uEAAuE;AACvE,+EAA+E;AAC/E,SAAS,mBAAmB;IAC1B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,OAAO,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;QACpD,OAAO,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;AAC1C,MAAM,SAAS,GAAG,cAAc,CAAC;AAEjC,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAa1C;IACC,qDAAqD;IACrD,iFAAiF;IACjF,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG,EAAE,CAAC;QAC7C,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,OAAO,EAAE,IAAI;wBACb,YAAY,EAAE,WAAW;wBACzB,SAAS,EAAE,SAAS;wBACpB,QAAQ,EAAE,IAAI;wBACd,OAAO,EAAE,IAAI,SAAS,KAAK,WAAW,kEAAkE;qBACzG,EAAE,IAAI,EAAE,CAAC,CAAC;iBACZ,CAAC;SACH,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,eAAe,EAAE,CAAC;IAClB,sBAAsB,EAAE,CAAC;IAEzB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG,CAAC;IACxD,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAElC,qEAAqE;IACrE,+DAA+D;IAC/D,mEAAmE;IACnE,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAEjF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ;QAAE,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAErD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IACnD,MAAM,KAAK,GAAG;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,YAAY,EAAE,WAAW;QACzB,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ;QAC/C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QACjC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;KAC9C,CAAC;IACF,WAAW,CAAC,KAAK,CAAC,CAAC;IAEnB,sEAAsE;IACtE,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IAEpD,mEAAmE;IACnE,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,mEAAmE;IACnE,EAAE;IACF,8DAA8D;IAC9D,+DAA+D;IAC/D,8EAA8E;IAC9E,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,OAAO;QACjC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;QAChC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC1B,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,OAAO,CAAC;IACd,KAAK,qBAAqB,CAAC;QACzB,IAAI,EAAE,IAAI,CAAC,SAAS;QACpB,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI;QACnE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;QACzB,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;QACnC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;QACzB,MAAM,EAAE,IAAI,EAAE,yDAAyD;KACxE,CAAC,CAAC;IAEH,+DAA+D;IAC/D,uEAAuE;IACvE,8EAA8E;IAC9E,IAAI,KAAK,GAAG,IAAI,SAAS,KAAK,WAAW,GAAG,CAAC;IAC7C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpF,KAAK,IAAI,eAAe,cAAc,EAAE,CAAC;IAC3C,CAAC;SAAM,IAAI,MAAM,IAAI,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,KAAK,IAAI,kCAAkC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACpF,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7E,KAAK,IAAI,SAAS,SAAS,0BAA0B,CAAC;IACxD,CAAC;SAAM,CAAC;QACN,KAAK,IAAI,QAAQ,CAAC;IACpB,CAAC;IAED,OAAO;QACL,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,OAAO,EAAE,YAAY;oBACrB,YAAY,EAAE,WAAW;oBACzB,SAAS,EAAE,SAAS;oBACpB,aAAa,EAAE,MAAM,CAAC,aAAa;oBACnC,OAAO,EAAE,MAAM;oBACf,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;oBAC7C,eAAe,EAAE,MAAM,CAAC,eAAe;oBACvC,OAAO,EAAE,KAAK;oBACd,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;oBAC/F,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;iBACjE,EAAE,IAAI,EAAE,CAAC,CAAC;aACZ,CAAC;KACH,CAAC;AACJ,CAAC"}

dist/types/backend.d.ts

@@ -69,2 +69,34 @@ /**
 export declare const MAX_RETRIES = 1;
+/** A per-rule mode override record. */
+export interface ModeRecord {
+    rule_id: string;
+    mode: "shadow" | "advisory" | "enforce";
+    agent_id?: string;
+    updated_at: string;
+}
+/** A custom rule definition (Pro+ feature). */
+export interface CustomRule {
+    id: string;
+    name: string;
+    description?: string;
+    pattern?: string;
+    detection_pattern?: string;
+    severity: "block" | "warn" | "log";
+    tier?: string;
+    created_at?: string;
+    updated_at?: string;
+}
+/** A preset bundle returned by GET /v1/rules/presets. */
+export interface PresetBundle {
+    id: string;
+    name: string;
+    description?: string;
+    rule_ids: string[];
+    tier?: string;
+}
+/** Generic error shape returned by control-plane methods on failure. */
+export interface ControlPlaneError {
+    error: string;
+    skipped: true;
+}
 //# sourceMappingURL=backend.d.ts.map

dist/types/backend.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../../src/types/backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,gEAAgE;AAChE,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAEvD,oEAAoE;AACpE,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;AAEvD;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,UAAU,GACV,kBAAkB,GAClB,cAAc,GACd,cAAc,GACd,eAAe,GACf,iBAAiB,GACjB,eAAe,GACf,kBAAkB,CAAC;AAEvB,mCAAmC;AACnC,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,kEAAkE;AAClE,MAAM,WAAW,iBAAiB;IAChC,oCAAoC;IACpC,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,uCAAuC;IACvC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,6DAA6D;IAC7D,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,kEAAkE;IAClE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,+BAA+B,EAAE,OAAO,CAAC;CAC1C;AAED,gDAAgD;AAChD,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,8BAA8B;AAC9B,eAAO,MAAM,mBAAmB,4CAA4C,CAAC;AAC7E,eAAO,MAAM,kBAAkB,OAAO,CAAC;AACvC,eAAO,MAAM,gBAAgB,MAAM,CAAC;AACpC,eAAO,MAAM,WAAW,IAAI,CAAC"}
+{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../../src/types/backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,gEAAgE;AAChE,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAEvD,oEAAoE;AACpE,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;AAEvD;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,UAAU,GACV,kBAAkB,GAClB,cAAc,GACd,cAAc,GACd,eAAe,GACf,iBAAiB,GACjB,eAAe,GACf,kBAAkB,CAAC;AAEvB,mCAAmC;AACnC,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,kEAAkE;AAClE,MAAM,WAAW,iBAAiB;IAChC,oCAAoC;IACpC,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,uCAAuC;IACvC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,6DAA6D;IAC7D,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,kEAAkE;IAClE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,+BAA+B,EAAE,OAAO,CAAC;CAC1C;AAED,gDAAgD;AAChD,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,8BAA8B;AAC9B,eAAO,MAAM,mBAAmB,4CAA4C,CAAC;AAC7E,eAAO,MAAM,kBAAkB,OAAO,CAAC;AACvC,eAAO,MAAM,gBAAgB,MAAM,CAAC;AACpC,eAAO,MAAM,WAAW,IAAI,CAAC;AAI7B,uCAAuC;AACvC,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,+CAA+C;AAC/C,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wEAAwE;AACxE,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,IAAI,CAAC;CACf"}

dist/version-pin/registry.js

@@ -65,3 +65,3 @@ /**
                 Authorization: `Bearer ${apiToken}`,
-                "User-Agent": "@sunaiva/gate@1.2.0",
+                "User-Agent": "@sunaiva/gate@2.0.0",
             },
@@ -68,0 +68,0 @@ });

LICENSE

@@ -5,3 +5,3 @@ Business Source License 1.1
 Licensed Work: @sunaiva/gate
-Change Date: 2030-05-09 (4 years from publication)
+Change Date: 2030-06-30 (4 years from the @sunaiva/gate@2.0.0 publication; finalized to the exact publish-date + 4 years at npm publish, per Rule 43 per-publish doctrine)
 Change License: Apache License, Version 2.0
@@ -8,0 +8,0 @@

package.json

 {
   "name": "@sunaiva/gate",
-  "version": "1.1.9",
+  "version": "2.0.0",
   "description": "Sunaiva Gate MCP — enforcement layer for AI agent rules. Stop documenting rules your agents ignore. Start enforcing them.",
   "main": "dist/index.js",
   "type": "module",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    },
+    "./middleware": {
+      "require": "./dist/middleware.cjs",
+      "import": "./dist/middleware.js",
+      "types": "./dist/middleware.d.ts"
+    }
+  },
   "bin": {
@@ -15,2 +26,5 @@ "sunaiva-gate": "dist/index.js"
     "dist/index.d.ts.map",
+    "dist/middleware.js",
+    "dist/middleware.d.ts",
+    "dist/middleware.cjs",
     "dist/bypass/**",
@@ -42,3 +56,3 @@ "dist/compliance/**",
   "scripts": {
-    "build": "tsc && node scripts/strip-patterns.js",
+    "build": "tsc && node scripts/strip-patterns.js && node scripts/build-middleware-cjs.cjs",
     "start": "node dist/index.js",
@@ -50,3 +64,3 @@ "dev": "tsx src/index.ts",
     "prepublishOnly": "npm run build && node scripts/verify-bundle.js",
-    "test": "node --experimental-vm-modules node_modules/.bin/jest --passWithNoTests"
+    "test": "vitest run"
   },
@@ -63,2 +77,3 @@ "keywords": [
   "bugs": {
+    "url": "https://sunaiva.ai/products/gate/support",
     "email": "[e-mail]"
@@ -77,8 +92,9 @@ },
   "devDependencies": {
+    "@types/jest": "^29.0.0",
     "@types/node": "^22.0.0",
-    "@types/jest": "^29.0.0",
     "jest": "^29.0.0",
     "ts-jest": "^29.0.0",
     "tsx": "^4.0.0",
-    "typescript": "^5.0.0"
+    "typescript": "^5.0.0",
+    "vitest": "^4.1.9"
   },
@@ -85,0 +101,0 @@ "jest": {

README.md

@@ -14,3 +14,3 @@ # @sunaiva/gate
 
-> **Status**: `1.1.5` "Freemium Monetization" — strip-patterns constitutional fix +
+> **Status**: `2.0.0` "Freemium Monetization" — strip-patterns constitutional fix +
 > per-session upsell trigger. Full changelog: [`CHANGELOG.md`](./CHANGELOG.md).
@@ -28,7 +28,7 @@
 npx @sunaiva/gate --smoke-test
-# → ✓ Gate loaded — 100 rules
-# → ✓ Constitutional rules — 31 local (23 constitutional + 8 recommended) (cannot be disabled, enforced locally)
-# → ✓ Premium rules — 69 server-side (require backend service)
+# → ✓ Gate loaded — 104 rules
+# → ✓ Constitutional rules — 27 (cannot be disabled, enforced locally)
+# → ✓ Premium rules — 69 (require backend service)
 # → Status: HEALTHY
-# → Version: 1.1.0
+# → Version: 2.0.0
 
@@ -39,3 +39,3 @@ # 3. Add to your MCP client (Claude Code, Cursor, Windsurf, Cline)
 
-That is the entire onboarding. The 31 local rules are active on first
+That is the entire onboarding. The 35 local rules are active on first
 boot; no other configuration is required.
@@ -50,3 +50,3 @@
 
-- **31 local rules (23 constitutional + 8 recommended) enforced locally** across five categories —
+- **35 local rules (27 constitutional + 8 recommended) enforced locally** across five categories —
   financial-safety, data-protection, action-governance, security, and
@@ -67,3 +67,3 @@ communication-safety. Detection patterns ship intact inside the package at
   records `would_have_blocked: [...]` without ever blocking.
-- **Constitutional immutability** — the 31 local rules cannot be disabled via
+- **Constitutional immutability** — the 35 local rules cannot be disabled via
   `update_rules` and cannot be bypassed via `log_bypass`, even if
@@ -79,3 +79,3 @@ `~/.sunaiva/gate-config.json` is hand-edited (the loader re-merges on every
 The Free tier is BUSL-1.1 licensed and converts to **Apache-2.0** on
-**2030-05-10**. You can fork it, modify it, embed it in internal CI, and ship
+**2030-06-30**. You can fork it, modify it, embed it in internal CI, and ship
 it in non-production workflows today — no contract, no signup, no credit card.
@@ -85,35 +85,39 @@
 
-## What you get with Pro (recommended, BYOK)
+## Pricing
 
-Pro adds the things a deterministic local engine cannot do on its own. Full
-tier matrix in [`TIER_DEFINITIONS.md`](./TIER_DEFINITIONS.md). Current pricing
-at **https://sunaivacore.io/pricing** (canonical source of truth across all
-Sunaiva Core products). Manage your account and audit dashboard at
-**https://dashboard.sunaivacore.io**.
+| Plan       | Price           | Rules              | Agents      | Seats       | Webhook | Support              |
+|------------|-----------------|-------------------|------------|------------|---------|----------------------|
+| Open       | $0/mo           | 35 local rules     | —           | 1           | —       | Community            |
+| Dev        | $0/mo (account) | 35 local rules     | —           | 1           | —       | Email (2 business days) |
+| Pro        | $29/mo †        | 69 premium rules   | 5           | Multiple    | ✓       | Priority (1 business day) |
+| Team       | $79/mo          | 69 premium rules   | Larger team | Larger team | ✓       | Priority email (same day) |
+| Enterprise | Custom          | Custom rule sets   | Unlimited   | Unlimited   | ✓ + SSO | Dedicated + MSA SLA  |
 
-- **69 premium rules** (100 total) evaluated server-side via the
-  premium backend at `https://mcp.sunaivacore.io/v1/gatehooks`. Detection
-  patterns are proprietary and stay in our infrastructure.
-- **Signed Ship-Confidence verdicts** — HMAC-SHA256, 60-minute freshness
-  window. The `ship_confidence_check` MCP tool verifies the signature in
-  constant time and returns `allowed: true` only when the verdict is
-  `GREEN`, fresh, and untampered.
-- **`sunaiva-ship-confidence` skill integration** — three independent
-  verification layers (cross-provider spec verification, property-based
-  testing with Hypothesis, adversarial audit via garak + DeepTeam) that
-  emit signed verdicts the Gate honours automatically in CI.
-- **Dashboard** — rules tab, audit tab, settings tab, billing tab. Cloud
-  audit sync with 90-day retention.
-- **BYOK** — bring your own `ANTHROPIC_API_KEY` and `OPENROUTER_API_KEY`.
-  You pay your own inference bill. We never see your tokens.
-- **Email support** — `[e-mail]`, 2-business-day SLA
-  target.
-- **Stripe-managed billing** — early-reviewer coupons are distributed privately to
-  invited testers; the public price is the price you see.
+† A/B launch: $29 (arm A, hero) vs $49 (arm B). See [sunaivacore.io/pricing](https://sunaivacore.io/pricing) for the live price.
 
-Enterprise (SSO, on-prem, multi-tenant org dashboard, named CSM) is
-quote-to-cash — see the [Enterprise tier in `TIER_DEFINITIONS.md`](./TIER_DEFINITIONS.md#enterprise--contact-sales).
+All paid plans include: offline-capable on-device enforcement, model routing (bring your own
+inference provider API key, or use Sunaiva-managed inference), fail-open guarantee,
+multi-target policy compilation (Pro+), and `@sunaiva/gate` npm package (BUSL-1.1).
 
+**Open (no account):** `npm i @sunaiva/gate` — 35 local rules, no network call required, zero
+telemetry. One immutable policy constitution, compiled to Claude Code, MCP clients, and future
+agent platforms.
+
+**Dev (free account)** (sign up at [portal.sunaiva.ai](https://portal.sunaiva.ai)):
+your own live dashboard showing enforcement activity, blocked actions, and rule coverage — your
+value made visible. Premium rules and features are shown visible-but-locked until you upgrade.
+
+Current pricing at **https://sunaivacore.io/pricing** (canonical source of truth).
+Manage your account and audit dashboard at **https://dashboard.sunaivacore.io**.
+
+Full tier matrix: [`TIER_DEFINITIONS.md`](./TIER_DEFINITIONS.md).
+
 ---
 
+> **Need adversarial multi-gate output verification with cryptographic proof anchors?**
+> → [Sunaiva Validation](https://sunaiva.ai) — a separate product for verifying AI outputs,
+> documents, and claims. Enterprise pricing, sales-led.
+
+---
+
 ## Architecture
@@ -137,3 +141,3 @@
 │   │     │                                                  │    │
-│   │     ├─►  Local rules (31) — pattern matched  │    │
+│   │     ├─►  Local rules (35) — pattern matched  │    │
 │   │     │     LOCALLY against dist/rules/rules.json       │    │
@@ -161,18 +165,53 @@ │   │     │     ─────────────────────────────► block/warn   │    │
 
-## Sunaiva Gate vs. the Sunaiva Validation Engine
+## Installation
 
-`@sunaiva/gate` is an **action-governance** product: it intercepts AI agent
-tool calls at runtime and enforces constitutional hook rules with a
-deterministic OR-logic engine (any matching rule blocks). It validates
-**agent ACTIONS** — things the agent is about to do.
+Wire `@sunaiva/gate` into every AI agent environment detected on this machine with a single command:
 
-The **Sunaiva Validation Engine** at [sunaiva.ai](https://sunaiva.ai) is a
-separate product that validates AI **OUTPUTS** — documents, reports, claims, and
-decisions — via a multi-gate architecture with composite cryptographic binding.
-These are complementary layers, not substitutes for each other.
+```sh
+npx @sunaiva/gate install
+```
 
-The Sunaiva product family includes patent-pending validation technologies
-(USPTO 64/006,491 family) — see [sunaiva.ai](https://sunaiva.ai) for the full
-Validation Engine.
+Or using the long form:
 
+```sh
+npx @sunaiva/gate --install
+```
+
+### What it does
+
+`install` scans for known AI agent environments (Claude Code, Cursor, Codex, Aider, Continue, Cline, Gemini), writes the appropriate MCP configuration for each one it finds, and reports results. All writes are idempotent — re-running on an already-configured system is safe.
+
+### Flags
+
+| Flag | Description |
+|------|-------------|
+| `--dry-run` | Print what would be written without making any changes. Exit 0 even if some agents would fail. |
+| `--detected-only` | Only configure agents that are already installed/active on this machine. Skip undetected ones. |
+| `--agents <csv>` | Comma-separated list of specific agents to target (e.g. `claude-code,cursor`). Overrides detection. |
+| `--mcp-endpoint <url>` | Custom MCP server URL. Defaults to `https://gate.sunaivacore.io/mcp`. |
+
+### Examples
+
+```sh
+# Dry-run: preview all changes without writing
+npx @sunaiva/gate install --dry-run
+
+# Install only for Claude Code
+npx @sunaiva/gate install --agents claude-code
+
+# Install for detected agents with a custom endpoint
+npx @sunaiva/gate install --detected-only --mcp-endpoint https://my-gate.example.com/mcp
+
+# Install for multiple specific agents
+npx @sunaiva/gate install --agents claude-code,cursor,codex
+```
+
+### Install exit codes
+
+| Code | Meaning |
+|------|---------|
+| `0`  | All targeted agents configured successfully. |
+| `1`  | One or more per-agent failures (see output for details). Agents that succeeded are still configured. |
+| `2`  | Internal unhandled exception — no changes made. |
+
 ---
@@ -249,3 +288,3 @@
 ```
-[sunaiva-gate v1.1.0] BLOCK — rule: dat-001 (recursive root deletion)
+[sunaiva-gate v2.0.0] BLOCK — rule: dat-001 (recursive root deletion)
 Escape: export DISABLE_SUNAIVA_GATE=1
@@ -297,14 +336,14 @@ Audit: ~/.sunaiva/audit/audit.jsonl
 $ npx @sunaiva/gate --smoke-test
-✓ Gate loaded — 100 rules
-✓ Constitutional rules — 31 local (23 constitutional + 8 recommended) (cannot be disabled, enforced locally)
-✓ Premium rules — 69 server-side (require backend service)
+✓ Gate loaded — 104 rules
+✓ Constitutional rules — 27 (cannot be disabled, enforced locally)
+✓ Premium rules — 69 (require backend service)
+✓ Immutability guard — ACTIVE — 27 constitutional rule IDs locked
 ✓ Presets file — 5 presets available
-✓ Live eval (git push origin main) — HARD block via gov-001
+✓ Live eval (git push origin main) — HARD block via gov-001,cnst-gov-deploy
 ✓ Live eval (ls -la) — ALLOW
-✓ Live eval (rm -rf /) — HARD block via dat-001
-✓ Live eval (stripe.charges.create) — HARD block via fin-001
-✓ Immutability guard — ACTIVE (31 local rules pinned)
+✓ Live eval (rm -rf /) — HARD block via gov-002
+✓ Live eval (stripe.charges.create) — HARD block via fin-001,cnst-fin-debit
 ✓ MCP server — ready (not started in smoke test)
 Status: HEALTHY
-Version: 1.1.1
+Version: 2.0.0
 Support: [e-mail]
@@ -315,2 +354,9 @@ ```
 
+**Runtime note (WSL / 9p mounts):** `scripts/smoke.sh` makes two Node.js invocations
+(`--version` then `--smoke-test`). On WSL with a 9p-mounted working directory, each
+startup takes ~10-60 s of real time because Node.js ESM resolution performs many
+metadata stat calls across the network filesystem. On a native Linux or macOS host
+the script finishes in 1-3 s. The script caches the `--version` result to avoid a
+third invocation, but the two remaining calls are irreducible without bundling.
+
 ---
@@ -328,3 +374,3 @@
 | `financial-protection` | 24 | All financial + resource rules |
-| `full-suite` | 100 | Everything — Free constitutional set + Pro premium set |
+| `full-suite` | 104 | Everything — Free constitutional set + Pro premium set |
 
@@ -435,3 +481,3 @@ Presets read from `dist/rules/presets.json`. Premium presets require
 rule IDs to the backend; we never see your code, your secrets, or your
-filesystem. BYOK means your `ANTHROPIC_API_KEY` and `OPENROUTER_API_KEY` go
+filesystem. BYOK means your inference provider API keys go
 direct from your machine to those providers — they do not transit Sunaiva.
@@ -466,3 +512,3 @@
 the critical path of a third-party paying-customer product before the
-**Change Date of 2030-05-10**, after which the wrapper converts to
+**Change Date of 2030-06-30**, after which the wrapper converts to
 **Apache-2.0** automatically. The premium backend stays proprietary regardless
@@ -472,3 +518,3 @@ of the Change Date.
 - Licensor: Sunaiva Digital
-- Change Date: **2030-05-10**
+- Change Date: **2030-06-30**
 - Change License: **Apache License, Version 2.0**
@@ -475,0 +521,0 @@

TIER_DEFINITIONS.md

@@ -15,3 +15,3 @@ # Tier Definitions — `@sunaiva/gate`
 
-> **Free tier** (no signup) runs the full constitutional rule set locally on
+> **Open tier** (no signup) runs the full constitutional rule set locally on
 > your machine. Paid tiers add the hosted dashboard, premium rule evaluation,
@@ -24,9 +24,10 @@ > audit aggregation, and team features. Without a paid tier the gate still
 
-## Free — `@sunaiva/gate` (npm package, no signup)
+## Open — `@sunaiva/gate` (npm package, no signup)
 
-- **Price**: free forever
+- **Price**: free forever; no account required
 - **License**: BUSL-1.1 wrapper (Change Date `2030-05-10` → Apache-2.0)
 - **Scope**:
-  - All 31 local rules (23 constitutional + 8 recommended) evaluated locally (cannot be disabled per the immutability guard)
-  - All 69 premium rule slots present but marked `[server-side]` placeholders (no evaluation — requires Pro+)
+  - All 35 local rules (27 constitutional + 8 recommended) evaluated locally on-device (cannot be disabled per the immutability guard)
+  - Zero telemetry — no data leaves the machine; no account, no backend calls
+  - All 69 premium rule slots present but marked `[server-side]` placeholders (no evaluation — requires Dev+)
   - Local audit log at `~/.sunaiva/audit/audit.jsonl`
@@ -38,14 +39,13 @@ - 5 presets (Minimal / Essential / Developer-Safety / Financial-Protection / Full-Suite)
 - **SLA**: none
-- **Use case**: solo developer running Claude Code / Cursor / Windsurf / Copilot locally and wanting a deterministic safety layer
+- **Use case**: solo developer running Claude Code / Cursor / Windsurf / Copilot locally and wanting a deterministic safety layer with zero telemetry
 
 ---
 
-## Starter
+## Dev
 
-Everything in Free, plus:
+Everything in Open, plus:
 
+- **Free account** — sign up at https://portal.sunaiva.ai; no credit card required
 - **Hosted dashboard** — real-time validation activity, audit log search/filter/export, rules manager UI, per-agent integration cards (see `LOVABLE_DASHBOARD_PROMPT.md` in this directory for the spec)
-- **Metered validations per month** (Free tier is locally unmetered; Starter introduces backend-evaluated premium rules with a budget)
-- **Curated subset of premium rules** active — server-side evaluation via `https://mcp.sunaivacore.io/v1/gatehooks` (token-authenticated)
-- **1 connected agent** (Claude Code OR Cursor OR Windsurf OR Copilot — one at a time)
+- **Shadow preview** — premium rule matches are shown in the dashboard without blocking, so you can see what you'd gain before upgrading; no backend rule evaluation, no metering
 - **Short-window audit log retention** (see pricing page for current tier limits)
@@ -55,3 +55,3 @@ - **Single user seat**
 
-**Best for**: solo developers who want the dashboard view + a curated subset of premium rules
+**Best for**: solo developers who want the dashboard view + a shadow preview of premium rule coverage before committing to a paid tier
 
@@ -62,3 +62,3 @@ ---
 
-Everything in Starter, plus:
+Everything in Dev, plus:
 
@@ -79,7 +79,7 @@ - **Higher metered validation budget**
 
-## Power
+## Team
 
 Everything in Pro, plus:
 
-- **Even higher validation budget**
+- **Higher validation budget** (see pricing page for current limits)
 - **Custom rules** — author your own detection patterns with severity, category, enforcement type; replicated to all team members
@@ -89,3 +89,3 @@ - **Cross-session severity escalation** — warn-first-block-on-repeat state machine persists across sessions, not just per-session
 - **Audit log export to S3 / GCS / Azure Blob** on schedule
-- **Larger team seat allocation**
+- **Multi-seat management** — seat assignment UI coming in v2.1; contact support for manual provisioning in the interim
 - **Priority email support** with same-business-day acknowledgement
@@ -100,3 +100,3 @@ - **Sandbox endpoint** for testing rule changes before pushing to production
 
-Everything in Power, plus:
+Everything in Team, plus:
 
@@ -120,5 +120,5 @@ - **Unlimited validations**
 
-| Feature | Free | Starter | Pro | Power | Enterprise |
+| Feature | Open | Dev | Pro | Team | Enterprise |
 |---|---|---|---|---|---|
-| 31 local rules (23 constitutional + 8 recommended) | ✓ | ✓ | ✓ | ✓ | ✓ |
+| 35 local rules (27 constitutional + 8 recommended) | ✓ | ✓ | ✓ | ✓ | ✓ |
 | 69 premium rules (server-eval) | — | curated subset | All 69 | All 69 + custom | All 69 + custom |
@@ -130,3 +130,3 @@ | Hosted dashboard | — | ✓ | ✓ | ✓ | ✓ (self-host option) |
 | Custom rules | — | — | — | ✓ | ✓ |
-| BYOK (Gemini/Anthropic/OpenRouter) | N/A (no LLM call from free) | — | ✓ | ✓ | ✓ |
+| BYOK (Gemini/Anthropic/OpenRouter) | N/A (no LLM call from open) | — | ✓ | ✓ | ✓ |
 | User seats | 1 (local) | 1 | multiple | larger team | up to enterprise tier |
@@ -161,3 +161,3 @@ | Webhook | — | — | ✓ | ✓ | ✓ |
 
-- Self-service: upgrade Starter → Pro → Power via dashboard billing settings (Stripe-managed)
+- Self-service: upgrade Dev → Pro → Team via dashboard billing settings (Stripe-managed)
 - Self-service: downgrade with proration via the same flow
@@ -164,0 +164,0 @@ - Enterprise: contractual; transitions handled per the master services agreement

README.DRAFT.md

-# @sunaiva/gate — Free Safety Hook for AI Coding Agents
-
-**A fail-open safety net for your AI agent workflows. It catches more than
-you have today. If it ever errors, it gets out of your way. It cannot break
-your build.**
-
-> **Current version**: `1.1.2` | BUSL-1.1 license, Apache-2.0 on 2030-05-10
-> **Status**: learning in public — pattern coverage improves with every release.
-
-```bash
-npx @sunaiva/gate
-```
-
-No signup. No API key. No DNS record. Just add it to your MCP config and the
-31 free local rules (23 constitutional + 8 recommended) are active on the next tool call.
-
----
-
-## The honest pitch
-
-AI coding agents are capable and fast. They are also capable of:
-
-- Committing hardcoded API keys to a public repository
-- Firing off a bulk email campaign the moment copy is approved
-- Charging a Stripe customer to test a payment flow
-- Running `rm -rf` on the wrong directory at 2am
-- Deploying a broken build to production because the test suite was skipped
-
-None of these require a rogue model. They happen from completely reasonable
-agent behaviour applied in the wrong moment. The gate intercepts those
-moments.
-
-The free tier works entirely on your machine — no backend, no telemetry,
-no external calls of any kind. It evaluates 31 local rules (23 constitutional + 8 recommended) locally
-against pattern matching. It is not perfect. Some edge cases are unmapped.
-The patterns improve with each release. We publish the miss reports and the
-fixes together.
-
-The core guarantee: **if the gate itself errors, it degrades to exactly
-your current behaviour**. You lose nothing by installing it.
-
----
-
-## Install
-
-### 1. Add to your MCP client
-
-```json
-{
-  "mcpServers": {
-    "sunaiva-gate": {
-      "command": "npx",
-      "args": ["@sunaiva/gate"]
-    }
-  }
-}
-```
-
-Supported clients: Claude Code, Cursor, Windsurf, Cline, Aider, Codex, Zed.
-Restart your client. The gate loads on the first tool call.
-
-### 2. Verify it is working
-
-```bash
-npx @sunaiva/gate --smoke-test
-```
-
-Expected output:
-
-```
-✓ Gate loaded — 100 rules
-✓ Constitutional rules — 31 local (23 constitutional + 8 recommended) (cannot be disabled, enforced locally)
-✓ Premium rules — 69 server-side (require backend service)
-✓ Live eval (git push origin main) — HARD block via gov-001
-✓ Live eval (rm -rf /) — HARD block via dat-001
-✓ Live eval (stripe.charges.create) — HARD block via fin-001
-Status: HEALTHY
-Version: 1.1.2
-```
-
-That is the full install. No further configuration required.
-
----
-
-## What it catches today (free, local, no backend)
-
-The 31 local rules (23 constitutional + 8 recommended) are evaluated entirely on your machine using
-keyword and pattern matching against the action text. They are split across
-five categories.
-
-### Financial safety (6 rules)
-
-| Rule | What it blocks |
-|------|---------------|
-| `fin-001` | Stripe charges, PayPal payments, checkout submissions, in-app purchase flows |
-| `fin-002` | Cumulative API cost overruns, cloud billing events that exceed cap |
-| `fin-003` | Subscription changes, free-trial conversions, auto-renewal toggles |
-| `fin-004` | Crypto wallet transfers, DeFi interactions, gas fee submissions |
-| `fin-008` | Wire transfers, ACH batch files, SWIFT/IBAN banking API payloads |
-| `fin-009` | Google Ads / Meta Ads / TikTok campaign launches with spend attached |
-
-### Action governance (7 rules)
-
-| Rule | What it blocks |
-|------|---------------|
-| `gov-001` | `git push origin main/master`, Netlify prod deploys, Docker prod pushes |
-| `gov-002` | `rm -rf`, `DROP TABLE`, `git reset --hard`, S3 bucket deletes, file overwrites without backup |
-| `gov-004` | Cloudflare/Route 53/GoDaddy DNS record changes via API |
-| `gov-005` | IAM role assignment, OAuth scope escalation, admin privilege grants |
-| `gov-006` | Account deletion API calls (Stripe customer delete, workspace deactivation) |
-| `gov-008` | Instantly / Mailchimp / Klaviyo / Twilio bulk campaign activations |
-| `gov-012` | `terraform destroy`, CloudFormation stack deletion, Kubernetes namespace purges |
-
-### Data protection (4 rules)
-
-| Rule | What it blocks |
-|------|---------------|
-| `dat-001` | API key patterns in logs, secret env vars written to stdout, Bearer tokens in debug output |
-| `dat-002` | Names + email combinations, SSNs, passport numbers, health identifiers stored without consent |
-| `dat-004` | API keys hardcoded in git diffs, secrets in PR descriptions, keys in chat history |
-| `dat-010` | Audit log deletion, timestamp modification in records, log rotation bypasses |
-
-### Communication safety (6 rules)
-
-| Rule | What it blocks |
-|------|---------------|
-| `com-001` | SMTP sends, Gmail API message sends, SendGrid/Postmark sends to external recipients |
-| `com-002` | Twitter/X, LinkedIn, Facebook, Instagram, TikTok API post submissions |
-| `com-005` | CRM-triggered customer emails, in-app messages sent to user segments |
-| `com-006` | PR Newswire / Business Wire distribution API calls, investor relation sends |
-| `com-007` | DocuSign envelope sends, HelloSign contract submissions, NDA emails |
-| `com-009` | Cold email sequence activations (Instantly, Lemlist, Apollo, Outreach) |
-| `com-011` | Emails or messages attributed to a named human without a disclosure header |
-
-### Security and compliance (8 rules)
-
-| Rule | What it blocks |
-|------|---------------|
-| `sec-001` | API keys / passwords printed via `console.log`, `print()`, `logger.info()` |
-| `sec-002` | `eval()` on external input, `exec()` with user strings, `subprocess.run` with unvalidated args |
-| `sec-004` | `sudo` commands outside approved list, IAM scope requests exceeding declared need |
-| `sec-006` | JWT secret changes, OAuth provider config modifications, MFA bypass additions |
-| `sec-010` | API calls to banned model providers (DeepSeek, Kimi, MiniMax, and similar) |
-| `sec-011` | MFA disable API calls, TOTP secret deletion, 2FA removal from admin accounts |
-| `cmp-002` | EU resident data stored without consent record, PII transfers without lawful basis |
-| `know-009` | Market size claims without cited research, conversion rates without a source, fabricated benchmarks |
-
-**A further 68 standard rules are enumerated in the package** but require
-the premium backend (`SUNAIVA_GATE_BACKEND_URL`) to evaluate. Without it,
-they are skipped and recorded as `skipped_premium` in the audit log. You
-will see a once-per-session notice on stderr pointing to the upgrade path.
-
----
-
-## The fail-open guarantee
-
-This is the property that makes install low-risk:
-
-- **Backend errors are always fail-open** — if the premium backend times out
-  or returns 5xx, that rule is skipped and recorded as
-  `skipped_premium_backend_error`. The action proceeds.
-- **The Python hook adapter (`hooks/sunaiva_gate_hook.py`) is always
-  fail-open** — any exception exits `0`, never blocks.
-- **The ship-confidence gate engine is always fail-open on its own
-  exceptions** — records `FAIL_OPEN_ON_EXCEPTION` in the audit, decision
-  is `allow`.
-- **Bad `rules.json`** — if the rules file is corrupt or unreadable, the
-  gate loads an empty rule set and logs to stderr. Nothing blocks.
-
-The **one exception to fail-open**: the 31 local rules evaluated
-by the local engine exit with code `3` (internal error) or `4` (malformed
-input) if the gate binary itself crashes on those paths. This is intentional
-— a gate that silently passes everything on an internal error provides no
-protection. You can opt back into legacy fail-open with
-`SUNAIVA_GATE_FAIL_OPEN_ON_ERROR=1`.
-
-**Worst case: you set `DISABLE_SUNAIVA_GATE=1` and the gate is gone.**
-Every block message discloses this escape hatch, because an enforcement
-tool that hides its bypass is one that gets silently routed around. The
-kill-switch invocation is logged to the audit ledger as
-`decision: 'bypass_kill_switch'`.
-
----
-
-## Honest limitations
-
-The free constitutional rules use **keyword and pattern matching**. They
-are not semantic. They can be:
-
-- **Defeated by rephrasing** — `send email to [e-mail]` blocks;
-  a sufficiently indirect phrasing may not.
-- **Wrong about context** — `gov-002` blocks `git reset --hard`; in a
-  deliberate rollback context that is correct behaviour that you have
-  deliberately chosen. Use the kill-switch or approval-token workflow to
-  unblock one-shot legitimate actions.
-- **Incomplete** — some attack patterns are not yet mapped. The 69 premium
-  rules cover more edge cases server-side; the free set is the foundation,
-  not the ceiling.
-
-We track miss reports. When a rule fails to catch a real incident, we log
-it, write a failing test fixture, and ship a new detection pattern in the
-next release. The changelog records every addition.
-
----
-
-## Severity ladder
-
-The gate has three severity levels:
-
-| Severity | First match | Subsequent matches |
-|----------|-------------|-------------------|
-| `block` (constitutional) | Block immediately | Block every time |
-| `warn-then-block` | Warn, allow | Block |
-| `warn` | Warn, allow | Warn, allow |
-
-Constitutional rules always `block` on first match. The session escalation
-counter resets when the MCP server process restarts.
-
----
-
-## Escaping a false positive
-
-Three escape valves, in order of preference:
-
-**1. Dry-run mode** — measure what would block without actually blocking:
-
-```bash
-export SUNAIVA_GATE_DRY_RUN=1
-# response.dry_run: true
-# response.would_have_blocked: [{rule_id, name, severity}, ...]
-```
-
-**2. Approval token** — for a one-shot legitimate deploy or action, drop a
-token file:
-
-```json
-// data/deploy_queue/APPROVAL_TOKENS/<artifact>.json
-{
-  "artifact": "my-package@1.0.0",
-  "approved_by": "you",
-  "approved_at": "2026-05-29T12:00:00Z",
-  "ttl_minutes": 60
-}
-```
-
-The gate honours it once within the TTL, then the token is consumed.
-
-**3. Kill-switch** — temporarily disables all enforcement:
-
-```bash
-export DISABLE_SUNAIVA_GATE=1  # Loud: logs every bypass
-unset DISABLE_SUNAIVA_GATE     # Enforcement resumes
-```
-
----
-
-## Audit log
-
-Every gate decision is written to `~/.sunaiva/audit/audit.jsonl`:
-
-```json
-{
-  "timestamp": "2026-05-29T12:00:00.000Z",
-  "action": "git push origin main",
-  "decision": "blocked",
-  "rule_id": "gov-001",
-  "rule_name": "Production Deployment Gate",
-  "tier": "free",
-  "audit_status": "constitutional_block",
-  "evidence": ["keyword: git push", "keyword: origin main"],
-  "event_type": "validate_action"
-}
-```
-
-The audit log has no rotation cap. It is local only on the free tier —
-nothing leaves your machine. The `get_audit_log` MCP tool queries it
-directly.
-
----
-
-## Data privacy
-
-**Free tier**: zero external network calls. Constitutional rules are evaluated
-against patterns shipped inside the package at `dist/rules/rules.json`. No
-action text, no code, no secrets leave your machine.
-
-**Pro tier** (opt-in): when you set `SUNAIVA_GATE_BACKEND_URL`, the engine
-POSTs only the proposed action text and rule IDs to the backend for the
-premium-rule subset. We never see your source code, your file contents, or
-your secrets. BYOK means your `ANTHROPIC_API_KEY` and `OPENROUTER_API_KEY`
-go directly from your machine to those providers — they do not transit
-Sunaiva infrastructure.
-
----
-
-## Environment variables
-
-| Variable | Default | Purpose |
-|----------|---------|---------|
-| `DISABLE_SUNAIVA_GATE` | unset | Set to `1` to allow all actions (logged loudly) |
-| `SUNAIVA_GATE_DRY_RUN` | unset | Set to `1` to evaluate but never block |
-| `SUNAIVA_GATE_FAIL_OPEN_ON_ERROR` | unset | Set to `1` for legacy fail-open on internal errors |
-| `SUNAIVA_GATE_BACKEND_URL` | unset | Premium backend endpoint (Pro tier) |
-| `SUNAIVA_GATE_API_TOKEN` | unset | Bearer token for the premium backend |
-| `SUNAIVA_GATE_BACKEND_TIMEOUT_MS` | `3000` | Backend timeout — network errors fail-open |
-| `SUNAIVA_GATE_AUDIT_PATH` | `~/.sunaiva/audit/audit.jsonl` | Override audit log location |
-| `SHIP_CONFIDENCE_SIGNING_KEY` | unset | HMAC key for verifying signed ship-confidence verdicts |
-
----
-
-## MCP tool reference
-
-| Tool | What it does |
-|------|--------------|
-| `validate_action` | Evaluate a proposed action against all active rules |
-| `get_audit_log` | Query the local audit log |
-| `get_rules` | List active rules; filter by `category` or `preset` |
-| `update_rules` | Enable / disable non-constitutional rules |
-| `log_bypass` | Record an intentional bypass (constitutional rules rejected) |
-| `ship_confidence_check` | Production deploy gate — free (approval token) or paid (signed verdict) |
-
----
-
-## Exit codes
-
-| Code | Meaning |
-|------|---------|
-| `0` | Allow / success / smoke-test HEALTHY |
-| `2` | Block |
-| `3` | Internal error, fail-CLOSED (opt into fail-open via `SUNAIVA_GATE_FAIL_OPEN_ON_ERROR=1`) |
-| `4` | Invalid input, fail-CLOSED (same opt-in) |
-
----
-
-## Where this is going
-
-The free gate is the entry point to a capability ladder that maps directly
-to the hard problems of AI agent governance. Each tier unlocks capabilities
-that a local pattern-matching engine structurally cannot provide:
-
-**Tier 1 — Free gate (now)**: 31 local rules (23 constitutional + 8 recommended). Fail-open
-guarantee. Pattern coverage grows with every release. This is the floor.
-
-**Tier 2 — Cross-provider verification (~$0.002 per call)**: The same
-action evaluated by independent model providers simultaneously. A single
-model can be convinced; three models from different training lineages
-reaching the same verdict is structurally harder to manipulate. This is
-the conjunctive-routing layer.
-
-**Tier 3 — Signed compliance records ($50k/yr enterprise, $0.05/record
-metered)**: Cryptographically signed audit records for EU AI Act Article 12
-(transparency), Article 14 (human oversight), and Article 15 (accuracy)
-requirements. An immutable, tamper-evident trail that satisfies enterprise
-procurement and regulatory review — not documentation, but provable
-evidence. The ZK-receipt variant makes the proof verifiable without
-disclosing the underlying data.
-
-**Tier 4 — Adaptive memory**: The gate learns which rules generated
-friction with no follow-on incident (false positives) and which rules were
-bypassed before a real incident (missed catches). The pattern library
-improves from usage signals. Cost model: a share of the token-budget
-savings from avoiding the incidents the gate prevents.
-
-The cryptographic infrastructure behind Tiers 3 and 4 is covered by USPTO
-provisional patents 64/006,491 and 64/030,411.
-
-If Tier 2 or Tier 3 sounds relevant, email `[e-mail]`.
-
----
-
-## Known gaps in the current release
-
-We track these openly:
-
-- The `--mcp-bridge` flag documented in the installer shims is not yet
-  wired into the binary entrypoint. Installer output references it but the
-  bridge path is a no-op until the next patch. The `validate_action` MCP
-  tool works correctly; only the direct-hook installer path is affected.
-- Version badge in this file reflects `1.1.2`. If `--smoke-test` shows a
-  different version, the package cache may be stale — run
-  `npx --yes @sunaiva/gate@latest --smoke-test`.
-- No aggregate telemetry today. The gate records decisions locally but
-  does not phone home. This means we cannot see which rules trigger most
-  often across the install base. A privacy-preserving aggregate metrics
-  channel (opt-in, anonymous counters only) is on the roadmap.
-
----
-
-## License
-
-[BUSL-1.1](./BUSINESS_LICENSE.md) — free for evaluation, internal
-development, hobby and academic use. Commercial license required if you
-embed the gate in the critical path of a product sold to third-party
-paying customers before **2030-05-10**, after which the wrapper converts
-to **Apache-2.0** automatically. The premium backend stays proprietary
-regardless of the Change Date.
-
-- **Licensor**: Sunaiva Digital
-- **Change Date**: 2030-05-10
-- **Change License**: Apache License, Version 2.0
-
----
-
-## Support
-
-| Need | Where |
-|------|-------|
-| Bug or crash | `[e-mail]` — include `--smoke-test` output and `node --version` |
-| Feature request | `[e-mail]` with subject `[feature-request]` |
-| Security vulnerability | `[e-mail]` — do not file publicly |
-| Pro / Enterprise enquiry | `[e-mail]` |
-| Product page | `https://sunaivacore.io/products/gate` |
-
----
-
-*Built by a team whose own hooks locked them out of their development
-environment for nine hours. We fixed it. Then we shipped the fix.
-Then we signed the proof.*

New alerts

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 4 instances

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 2 instances

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 5 instances

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 2 instances

No bug tracker

Maintenance

Package does not have a linked bug tracker in package.json.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

1066429

15.77%

Number of package files

304

9.35%

Lines of code

16605

15.89%

Number of low maintenance alerts

0

-100%

Number of lines in readme file

536

9.39%

Worsened metrics

Dev dependency count

7

16.67%

Number of low supply chain risk alerts

105

19.32%

No dependency changes